1. 14

    Google, the only problems in email are security related (spam, viruses, privacy, authentication, etc). Be engineers, fix that boring stuff and stop trying to control the web.

    1. 5

      there are other problems in email, though unfortunately they are caused or enabled by gmail (top posting, html, exclusion of independent servers).

    1. 13

      So who wants to adopt the lobster for lobste.rs?

      1. 6

        why not zoidberg?

        1. 5

          I’m up for donating to a pool for this.

          1. 4

            Agreed with /u/gerikson, I’m up for a donation pool! Who wants to spearhead it?

            1. 15

              I could put together a pool to try to hit the Silver or Gold level. The link would point back to a note on the about page. There would be no reward for donating besides the warm glow of knowing you’ve helped support an organization that is the source of so much error handling in our code.

              Please take this ad-hoc poll by upvoting the single highest amount you’d donate towards this. Enough support and I’ll put something together. (If you made judicious use of your GPU a few years ago and have cryptocurrency to donate, please select the amount of USD you’d convert it into before sending it because I’m game for a fun lark, not a major project.) (Edit: tweeted)

              1. 59

                10 USD

                1. 17

                  1 USD

                  1. 9

                    50 USD

                    1. 4

                      100 USD

                      1. 1

                        This is in progress.

                        1. 1

                          500 USD

                    1. 17

                      Key part I’ve often used to debunk anti-MS sentiment from security folks:

                      “Despite the above, the quality of the code is generally excellent. Modules are small, and procedures generally fit on a single screen. The commenting is very detailed about intentions, but doesn’t fall into “add one to i” redundancy.”

                      “From the comments, it also appears that most of the uglier hacks are due to compatibility issues: either backward-compatibility, hardware compatibility or issues caused by particular software. Microsoft’s vast compatibility strengths have clearly come at a cost, both in developer-sweat and the elegance (and hence stability and maintainability) of the code.”

                      Seems most of their problems came not from apathy but from caring about compatibility more than about anyone on desktop. That helped ensure their lock-in and billions. The cost was worse flexibility, reliability, and security. Acceptable cost given Gates’ goal of becoming super rich. Not as great for users, though. Fortunately, the Security Development Lifecycle got some of that under control with Windows kernel 0-days becoming rare versus other types. Their servers are very reliable, too.

                      Anyone wondering what Microsoft could do if not so focused on backward compatibility need only look at MS Research’s projects. Far as OS’s, Midori and VerveOS come to mind for different purposes. One could be a foundation of the other actually.

                      1. 7

                        Not as great for users, though.

                        I beg to disagree. A lot of end users and small businesses rely on some unmaintained piece of legacy software in one way or another. The fact that they don’t have to keep a separate PC with an unmaintained, insecure OS on it is a definite plus for those people.

                        1. 4

                          Regarding the “what Microsoft could do” – that’s exactly what they’re trying to with UWP apps in Windows 10. Proper sandboxing for all applications, ideally even all browser tabs in OS-level sandboxes.

                          I’m especially interested (and scared at the same time) in the rumors about Polaris, which is said to be a Windows 10 throwing the entire Win32 layer away, with all the backwards compatibility patches only existing within of the UWP sandbox of each separate application, and with much better security (but also, obviously, less customizability).

                          1. 3

                            They’re definitely doing new stuff with UWP. I’ve been off Windows too long to know anything about it. I was mainly talking about designing every aspect of an OS around high-level, modular, safe, and/or concurrent programming. The two links in my comment will give you an idea of what they’re capable of.

                          2. 3

                            I’ve never thought that microsoft wrote bad functions, but that their design is over-complicated. There’s too many moving parts, too many function arguments, too many layers, … It’s the accidental complexity that seems to cause logical bugs.

                          1. 1

                            How about another bug, int*2 is an undefined overflow. That’ll certainly cause problems.

                            1. 4

                              This is one area where Rust and C are different; overflow is well-defined in Rust.

                            1. 11

                              Finally a proper use of the caps lock key:

                              Press caps lock to switch to a command line interface; here’s the debug screen.

                              1. 8

                                Well, I’d rather use it for Control. But maybe if keyboards would put Control where it belongs, next to Space (it should go Super Alt Control Space Control Alt Super), then it wouldn’t be necessary to have Control where most keyboards have Caps Lock.

                                1. 5

                                  I always map Caps Locks to Ctrl, so whenever I’m on someone else’s laptop I keep flipping into caps when I mean to copy/paste/break/etc.

                                  1. 3

                                    it should go Super Alt Control Space Control Alt Super

                                    What’s the premise for “should” here?

                                    1. 1

                                      Because of the frequency of use. Control is used almost all the time, in Windows, Linux & emacs. As such, it should go into the easiest-to-strike location, right next to the spacebar where the thumb can strike it in conjunction with other keys.

                                      Alt/Meta is used less often, so it should receive the less-convenient spot. Alt should be used for less-frequently used functionality, and to modify Control (e.g. C-f moves forward one character; C-M-f moves forward one word).

                                      Super should be used least of the three, and ideally would be reserved for OS-, desktop-environment– or window-manager–specific tasks, e.g. for switching windows are accessing an app chooser. Since it’s used less than either Alt or Control, it belongs in the least-convenient spot, far from the spacebar.

                                      If we were really going to do things right, there’d be a pair of Hyper keys outboard of super, reserved for individual user assignment. But we don’t live in a perfect world.

                                  2. 4

                                    as a vi user, i would have said “use escape” but then remembered my caps-lock key is remapped to escape.

                                  1. 2

                                    https://blogs.msdn.microsoft.com/philipsu/2006/06/14/broken-windows-theory/

                                    Windows code is too complicated. It’s not the components themselves, it’s their interdependencies. An architectural diagram of Windows would suggest there are more than 50 dependency layers (never mind that there also exist circular dependencies). After working in Windows for five years, you understand only, say, two of them. Add to this the fact that building Windows on a dual-proc dev box takes nearly 24 hours, and you’ll be slow enough to drive Miss Daisy.

                                    I haven’t been around in the industry too long, i was in school when this blog entry was posted. But I’ve seen a few projects struggle and fail because of bad architecture and increasing technical debt. The OPs article definitely reflects the struggle between new features, legacy support, and paying down the technical debt (improving security, etc.).

                                    1. 2

                                      The microservices that are all the rage these days adds a whole new layer of challenge to understanding dependencies. While monoliths have their own challenges, at least all of the information is there to understand what is connected. I’m still not sure if this has been adequately solved.

                                      1. 2

                                        Arguably microservices can simplify this dependency tree tremendously. In the world to date, it has been essentially impossible to compile many differently versioned libraries together into one monolithic application, which is what generally happens when you have a large number of teams doing separate development.

                                        With microservices, again arguably, encapsulation happens at the whole-service layer, so each team is free to develop using whatever versions they like, and just provide HTTP (or whatever) as their high level API.

                                        Where this tends to break down in my experience is (a) where true shared dependencies exist, which can happen if you either were bad at data modeling to begin with or if your needs organically grew differently than your original design, and (b) operationally, in a world of incredibly broken and insecure software, processors, etc., resulting from C (and now JS) and the shared memory model, where it is no longer possible to understand what in the opaque blobs need patching.

                                        1. 1

                                          C obviously has memory bugs but I’m curious what insecurity you see stemming from JS. Is it the automatic type casting? (I write JavaScript every day and think a good portion of the new parts of the language are good, but I will fully admit it spent its formative years on crack.)

                                          1. 1

                                            I don’t see how adding more dependencies simplifies anything, that can only make it more complicated. It may be convenient, but it’s not simpler. And in order to have that architecture one needs to have network protocols and serialization going on which has a performance and cognitive cost. There certainly are reasons to have a microservice architecture but I have a hard time seeing simplification as one of them.

                                          2. 1

                                            Microservices exist mostly to facilitate development by many teams on a large system. They are one of the best examples of Conway’s Law.

                                            You are correct that they add complexity, and they tend to be adopted regardless of if they solve a real problem.

                                        1. 2

                                          A competent CPU engineer would fix this by making sure speculation doesn’t happen across protection domains. Maybe even a L1 I$ that is keyed by CPL.

                                          I feel like Linus of all people should be experienced enough to know that you shouldn’t be making assumptions about complex fields you’re not an expert in.

                                          1. 22

                                            To be fair, Linus worked at a CPU company,Transmeta, from about ‘96 - ‘03(??) and reportedly worked on, drumrolll, the Crusoe’s code morphing software, which speculatively morphs code written for other CPUs, live, to the Crusoe instruction set.

                                            1. 4

                                              My original statement is pretty darn wrong then!

                                              1. 13

                                                You were just speculating. No harm in that.

                                            2. 15

                                              To be fair to him, he’s describing the reason AMD processors aren’t vulnerable to the same kernel attacks.

                                              1. 1

                                                I thought AMD were found to be vulnerable to the same attacks. Where did you read they weren’t?

                                                1. 17

                                                  AMD processors have the same flaw (that speculative execution can lead to information leakage through cache timings) but the impact is way less severe because the cache is protection-level-aware. On AMD, you can use Spectre to read any memory in your own process, which is still bad for things like web browsers (now javascript can bust through its sandbox) but you can’t read from kernel memory, because of the mitigation that Linus is describing. On Intel processors, you can read from both your memory and the kernel’s memory using this attack.

                                                  1. 0

                                                    basically both will need the patch that I presume will lead to the same slowdown.

                                                    1. 9

                                                      I don’t think AMD needs the separate address space for kernel patch (KAISER) which is responsible for the slowdown.

                                              2. 12

                                                Linus worked for a CPU manufacturer (Transmeta). He also writes an operating system that interfaces with multiple chips. He is pretty darn close to an expert in this complex field.

                                                1. 3

                                                  I think this statement is correct. As I understand, part of the problem in meltdown is that a transient code path can load a page into cache before page access permissions are checked. See the meltdown paper.

                                                  1. 3

                                                    The fact that he is correct doesn’t prove that a competent CPU engineer would agree. I mean, Linux is (to the best of my knowledge) not a CPU engineer, so he’s probably wrong when it comes to get all the constraints of the field.

                                                    1. 4

                                                      So? This problem is not quantum physics, it has to do with a well known mechanism in CPU design that is understood by good kernel engineers - and it is a problem that AMD and Via both avoided with the same instruction set.

                                                      1. 3

                                                        Not a CPU engineer, but see my direct response to the OP, which shows that Linus has direct experience with CPUs, frim his tenure at Transmeta, a defunct CPU company.

                                                        1. 5

                                                          frim his tenure at Transmeta, a defunct CPU company.

                                                          Exactly. A company whose innovative CPU’s didn’t meet the markets needs and were shelved on acquisition. What he learned at a company making unmarketable, lower-performance products might not tell him much about constraints Intel faces.

                                                          1. 11

                                                            What he learned at a company making unmarketable, lower-performance products might not tell him much about constraints Intel faces.

                                                            This is a bit of a logical stretch. Quite frankly, Intel took a gamble with speculative execution and lost. The first several years were full of erata for genuine bugs and now we finally have a userland exploitable issue with it. Often security and performance are at odds. Security engineers often examine / fuzz interfaces looking for things that cause state changes. While the instruction execution state was not committed, the cache state change was. I truly hope intel engineers will now question all the state changes that happen due to speculative execution. This is Linus’ bluntly worded point.

                                                            1. 3

                                                              (At @apg too)

                                                              My main comment shows consumers didnt pay for more secure CPU’s. So, that’s not really a market requirement even if it might prevent costly mistakes later. Their goal was making things go faster over time with acceptable watts despite poorly-written code from humans or compilers while remaining backwards compatible with locked-in customers running worse, weirder code. So, that’s what they thought would maximize profit. That’s what they executed on.

                                                              We can test if they made a mistake by getting a list of x86 vendors sorted by revenues and market share. (Looks.) Intel is still a mega corporation dominating in x86. They achieved their primary goal. A secondary goal is no liabilities dislodging them from that. These attacks will only be a failure for them if AMD gets a huge chunk of their market like they did beating them to proper 64-bit when Intel/HP made the Itanium mistake.

                                                              Bad security is only a mistake for these companies when it severely disrupts their business objectives. In the past, bad security was a great idea. Right now, it mostly works with the equation maybe shifting a bit in future as breakers start focusing on hardware flaws. It’s sort of an unknown for these recent flaws. All depends on mitigations and how many that replace CPU’s will stop buying Intel.

                                                            2. 3

                                                              A company whose innovative CPU’s didn’t meet the markets needs and were shelved on acquisition.

                                                              Tons of products over the years have failed based simply on timing. So, yeah, it didn’t meet the market demand then. I’m curious about what they could have done in the 10+ years after they called it quits.

                                                              might not tell him much about constraints Intel faces.

                                                              I haven’t seen confirmation of this, but there’s speculation that these bugs could affect CPUs as far back as Pentium II from the 90s….

                                                          2. 1

                                                            The fact that he is correct doesn’t prove that a competent CPU engineer would agree.

                                                            Can you expand on this? I’m having trouble making sense of it. Agree with what?

                                                      1. 25

                                                        Spectre PoC: https://gist.github.com/ErikAugust/724d4a969fb2c6ae1bbd7b2a9e3d4bb6 (I had to inline one #DEF, but otherwise works)

                                                        1. 5

                                                          I’ve tested it with some success on FreeBSD/HardenedBSD on an Intel Xeon. It works on bare metal, but doesn’t work in bhyve.

                                                          1. 4

                                                            oh god that runs quickly. terrifying.

                                                            1. 3
                                                              $ ./spectre
                                                              Reading 40 bytes:
                                                              Illegal instruction (core dumped)
                                                              

                                                              That was kinda disappointing. (OpenBSD on Hyper-V here.)

                                                              1. 10

                                                                It worked for me on OpenBSD running on real hardware.

                                                                1. 1

                                                                  That was kinda disappointing. (OpenBSD on Hyper-V here.)

                                                                  perhaps it was the cache flush intrinsic.

                                                                2. 2

                                                                  I’m impressed how easy it is to run this PoC - even for somebody who didn’t do C programming for years. Just one file, correct the line

                                                                  #define CACHE_HIT_THRESHOLD(80)

                                                                  to

                                                                  #define CACHE_HIT_THRESHOLD 80

                                                                  then compile: gcc -O0 -o spectre spectre.c

                                                                  run:

                                                                  ./spectre

                                                                  and look for lines with “Success: “.

                                                                  I am wondering if there is some PoC for JavaScript in the Browser - single HTML page with no dependencies containing everything to show the vulnerability?

                                                                  1. 2

                                                                    I’ve been playing quickly with the PoC. It seems to work just fine on memory with PROT_WRITE only, but doesn’t work on memory protected with PROT_NONE. (At least on my CPU)

                                                                  1. 3

                                                                    Time to rewrite all our programs to drastically reduce the number of system calls they make. Not to make the security problem go away, but to shrink the performance impact of the workaround for it. :)

                                                                    1. 3

                                                                      The main piece of code I work on for work exports stats to a shared memory segment that we can see in the UI. One of the most important stats is “avgcommit” - the number of units written per syscall. It is, by far, the most important performance statistic we have.

                                                                      1. 1

                                                                        Cool! If you’re looking closely at that, are you getting into the kind of territory where you might want to be looking at the storage equivalents of DPDK’s approach? By that I mean an approach like driving iSCSI or FC HBAs or NVMe controllers directly from userspace instead of via a kernel filesystem. I think that https://software.intel.com/en-us/articles/introduction-to-the-storage-performance-development-kit-spdk is the kind of thing I’m thinking of.

                                                                        1. 1

                                                                          We’ve looked into similar things, but the limitations on what hardware we can use and how we interact with legacy systems means that it’s basically a non-starter. Instead we do some cleverness with how we write both data and metadata, and end up writing about 250-300 units and their metadata per syscall (the original system, written before I got here, was one syscall per unit and one syscall per metadata chunk).

                                                                          The 250-300 units metric is the speed that we’re receiving things, so we’re operating at speed. I’ve got some ideas on how to speed things up further, but they’re radical departures from what we’re doing now, so much so that it would be essentially a complete rewrite of the subsystem.

                                                                      2. 3

                                                                        system calls are already ridiculously expensive.

                                                                        1. 2

                                                                          Good thing I’ve got a one year head start. :)

                                                                          1. 1

                                                                            What, pledge()? I thought that was more of a restriction of variety rather than frequency. ;)

                                                                            1. 3

                                                                              No, just running ktrace and asking “why is this program being stupid?”

                                                                        1. 10

                                                                          Our goal is to deliver the best experience for customers, which includes overall performance and prolonging the life of their devices. Lithium-ion batteries become less capable of supplying peak current demands when in cold conditions, have a low battery charge or as they age over time, which can result in the device unexpectedly shutting down to protect its electronic components.

                                                                          Last year we released a feature for iPhone 6, iPhone 6s and iPhone SE to smooth out the instantaneous peaks only when needed to prevent the device from unexpectedly shutting down during these conditions. We’ve now extended that feature to iPhone 7 with iOS 11.2, and plan to add support for other products in the future.

                                                                          Come on. If this is really about managing demand spikes, why limit the “feature” to the older phones? Surely iPhone 8 and X users would also prefer that their phones not shut down when it’s cold or the battery is low?

                                                                          1. 6

                                                                            I would assume most of those phones are new enough where the battery cycles aren’t enough to cause significant enough wear on the battery to trip the governor, and/or battery technology improved on those models.

                                                                            It’s really a lose-lose for Apple whichever way they do it, and they IMHO picked the best compromise: run the phone normally on a worn battery and reduce battery life further, and risk just shutting off when the battery can’t deliver the necessary voltages on bursty workloads; or throttle the performance to try to keep battery life consistent and phone running with a battery delivering reduced voltages?

                                                                            1. 6

                                                                              Apple could have also opted to make the battery replaceable, and communicate to the user when to do that. But then that’s not really Apple’s style.

                                                                              1. 3

                                                                                I believe that’s called “visiting an Apple store.” Besides, as I’ve said elsewhere in this thread, replacing a battery on an iPhone is pretty easy; remove the screen, (it’s held in with two screws and comes out with a suction cup) and the battery is right there.

                                                                              2. 4

                                                                                and plan to add support for other products in the future.

                                                                                They probably launched on older phones first since older phones are disproportionately affected.

                                                                                1. 2

                                                                                  Other media reports indicate that battery performance loss is not just a function of age but of other things like exposure to heat. They also indicate that this smoothing doesn’t just happen indiscriminately but is triggered by some diagnostic checks of the battery’s condition. So it seems like making this feature available on newer phones would have no detrimental effect on most users (because their batteries would still be good) and might help some users (whose batteries have seen abnormally harsh use or environmental conditions). So what is gained by limiting it only to those using older models? Why does a brand new iPhone 7 bought new from Apple today, with a brand new battery, have this feature enabled while an 8 does not?

                                                                                  1. 2

                                                                                    Probably easier for the test team to find an iPhone 7 or 6 with a worse battery than an 8. the cpu and some other components are different.

                                                                                    1. 3

                                                                                      There are documented standards for rapidly aging different kinds of batteries (for lead-acid batteries, like in cars, SAE J240 says you basically sous-vide cook them while rapidly charging and draining them), and I’d be appalled if Apple didn’t simulate battery aging for two or more years as part of engineering a product that makes or breaks the company.

                                                                              1. 5

                                                                                Excellent — if i work much overtime then i just end up making a mess. But the 8 hours i do put in, they drain me. So it doesn’t feel like excellent work life balance.

                                                                                1. 5

                                                                                  Here’s a study that suggests that lines of code is a better predictor of the number of bugs/faults in a codebase than a lot of other historical OO-related metrics.

                                                                                  I would be very interested in reading other studies about this, rather than just anecdotes.

                                                                                  1. 1

                                                                                    Those metrics might be useful for maintenance though. Nothing is worse than jumping around 20 files and classes with virtual methods to figure out what’s going on.

                                                                                  1. 8

                                                                                    Part of me seriously wonders if this is Apple playing privacy advocate, or if this is Apple playing Google hunter.

                                                                                    Also, super cookies anyone?

                                                                                    1. 13

                                                                                      Part of me seriously wonders if this is Apple playing privacy advocate, or if this is Apple playing Google hunter.

                                                                                      I mean, yes? Both things are certainly concerns of Apple’s, and any distance than can put between themselves and the attention economy is good for them long term.

                                                                                      1. 3

                                                                                        any distance than can put between themselves and the attention economy is good for them long term.

                                                                                        Is this true of every company, or a statement about Apple specifically?

                                                                                        That is, is the attention economy a race-to-the-bottom kind of thing that no company should want to be a part of? Or are you saying this is a smart strategy to boost Apple’s market share among the privacy-minded? Or that Apple is in a unique position to dictate industry trends, and that getting close to ad companies will somehow dilute that power?

                                                                                        1. 8

                                                                                          Apple makes money by selling its goods and services to the people who use their phones. This is good in two ways; it aligns their interests and those of their customers, and also allows their users to exert market pressure on them. Making obvious the incentive misalignment between Google’s users and Google is obviously a tactic they are in a unique position to use.

                                                                                          1. 1

                                                                                            As a die hard Android user these sort of features make me wish Google wanted me to have the best phone possible, not “a tracking device that also happens to have phone features I can use”.

                                                                                            1. 2

                                                                                              I got an Android phone for work (a Pixel) and it’s very nice, but yeah, there’s that all-enveloping sense that everything is working towards getting my personal information in from of advertisers all the time, even as the side-effect of that creeping is genuinely useful.

                                                                                      2. 4

                                                                                        My first thought was that this is a way to push facebook and google’s heads underwater a bit. It’s also fairly standard contrarian market positioning.

                                                                                        1. 3

                                                                                          google went evil. they’re open season.

                                                                                        1. 24

                                                                                          Bring back IRC I say

                                                                                          No need to bring it back, it’s always been there. The problem is convincing everyone else to use it.

                                                                                          1. 33

                                                                                            IRC has a fair share of problems which are often circumvented by layering additional services like bouncers on top of it. I like it for its ubiquity, but let’s not pretend it doesn’t show age everywhere.

                                                                                            1. 19

                                                                                              I think matrix could very well be the successor to IRC. Open, federated, secure, multi-device sync and good support for bridges to other protocols.

                                                                                              1. 13

                                                                                                I can’t bring myself to like a communications protocol that’s based on HTTP+JSON, with the reference client written as an Electron app. It just all feels so… inefficient :(

                                                                                                1. 4

                                                                                                  The very core of matrix is just the graph behind it all. JSON is just one representation of the information and HTTP is just one transport. Those are the only reference implementations right now, but others are possible, if I’ve understood correctly. But someone more knowledgeable should probably weigh in.

                                                                                                  1. 2

                                                                                                    Those are the only reference implementations right now

                                                                                                    The problem with reference implementations is that, by inertia, they end up being the only implementation.

                                                                                                    1. 1

                                                                                                      Would you rather there wasn’t an implementation? But, in this case, there are several other implementations. There’s the next generation reference home server dendrite (in golang instead of python like synapse) and ruma (in rust). And there are lots of clients. I think only riot supports e2e crypto, but I hope others will start supporting it as it stabilises.

                                                                                                  2. 4

                                                                                                    To be fair, Riot can run perfectly happy standalone. In fact, I have it running right now on my OpenBSD box. Also, there are many other clients!

                                                                                                    1. 5

                                                                                                      HTTP+JSON isn’t all that inefficient, just a bit of extra headers, whatever.

                                                                                                      Matrix is actually fundamentally inefficient in a different way — it’s not ephemeral message passing like IRC or XMPP, it’s a replicated database — and it’s worth it.

                                                                                                    2. 6

                                                                                                      I stopped using IRC and my bouncer 2 weeks ago for Matrix/Riot on my own server with my own IRC bridges and couldn’t be more pleased. Works incredibly well.

                                                                                                      edit: was an irssi+irssi-proxy user for over 15 years. Tried every other bouncer. Hated them all. Had a perl script to send my phone a pushover notification for mentions. It worked, but it sucked trying to open up IRC app and find the conversation with no scrollback and respond.

                                                                                                      Now I have: consistent chat client on every device, always have scrollback, all my logs are stored in Postgres, logs are searchable in every client and the search is handled server-side, and I can do E2E encryption with my friends on Matrix. I will never experience Slack bloat because the federation means I only need one server connection and account.

                                                                                                      1. 4

                                                                                                        The Riot web app can also serve as a nice IRC client (+bouncer, email notification, etc) if you only need the networks they bridge to.

                                                                                                        1. 3

                                                                                                          I haven’t been impressed with the quality of tooling or clients yet. Their Debian package documentation is incorrect and commands tell you to… run the same command you just ran. I haven’t seen a client I’ve been terribly impressed by either; Riot is your typical Electron fare.

                                                                                                          1. 3

                                                                                                            Riot is your typical Electron fare

                                                                                                            The electron wrapper is completely optional, why do so many people say such things, that’s unfair :( I just use it as a pinned tab in Firefox.

                                                                                                            1. 3

                                                                                                              Even without the performance concerns of Electron or running in the browser, there’s still the fact these overgrown web apps feel alien in UX on every platform.

                                                                                                              1. 2

                                                                                                                I’ve found it to be very unperformant and laggy.

                                                                                                            2. 1

                                                                                                              Didn’t know about this. Thanks for the tip.

                                                                                                            3. 10

                                                                                                              The IRCv3 working group is attempting to standardise a lot of interesting extensions to the old IRC protocol in a backwards-compatible manner. Amongst other things, they seem to be working on history, standardised registration/authentication, and metadata such as user avatars.

                                                                                                              1. [Comment removed by author]

                                                                                                                1. 1

                                                                                                                  It’s really too bad IRC v3 is moving along slowly

                                                                                                                  It is, isn’t it? I am watching their repo on GitHub and get excited every time I get a notification, hoping that it’s about something major like a good history extension. If I had more time I would love to contribute. Wish they had a Patreon account, or something similar.

                                                                                                                2. 2

                                                                                                                  One aspect of Slack I’d be interested to hear any progress on is the fact that it combines chat and fileshare for groups.

                                                                                                                3. 1

                                                                                                                  Is Twitch still running this way?

                                                                                                                4. 5

                                                                                                                  Maybe if it was written in JavaScript, used a million npm packages, invented some new Json/Jose derived protocol,.. then you might have a hope.

                                                                                                                  In all seriousness, I ask myself that question all along. At work we use lync and skype for business and those still feel like a step backwards compared to old Skype, man, icq, and irc. In fact we had logging turned on for a while but the fat xml logs are up our entire email box so it was turned off company wide.

                                                                                                                  1. 5

                                                                                                                    Additionally, Slack supports IRC. I just use tmux + issi to connect to Slack and other IRC networks.

                                                                                                                    1. 6

                                                                                                                      Slack’s gateway is highly lossy though.

                                                                                                                      1. 2

                                                                                                                        What do you mean? I haven’t had a single issue.

                                                                                                                        1. 12

                                                                                                                          You lose formatting, inline replies (so you will see out of context messages), that kind of thing.

                                                                                                                          1. 1

                                                                                                                            Ah, gotcha. Thanks for the clarification.

                                                                                                                    2. 4

                                                                                                                      I’m confident that if a company made an open-source IRC client with the bells and whistles of Slack’s UI, and sold a managed IRC server that was not marketed as IRC, they could eat Slack’s lunch. Instant messaging is a commodity and it makes no sense for proprietary software to dominate the field.

                                                                                                                      1. 14

                                                                                                                        IRCcloud comes pretty close to that.

                                                                                                                        1. 3

                                                                                                                          IRCcloud has a couple of interesting issues when using it in a business setup. For example, for simplicities sake, they load twitters, facebooks and stripes JS libraries into their webapp, giving third parties access to that data. We talked to them about this and they said they were looking into it, but never ended up doing something.

                                                                                                                          It’s nice otherwise, but I prefer to only use it as a bouncer. Finally, it costs ~5$, so it’s not a feasible chat for many people outside of companies.

                                                                                                                        2. 6

                                                                                                                          It’s been done (minus the open source). Used to be called Convore, then changed names to Grove: https://grove.io/

                                                                                                                          In fact, they conceded defeat to Slack: https://grove.io/blog/closing-shop

                                                                                                                          1. 3

                                                                                                                            Grove is better than mIRC, but it’s no Slack. Slack is winning because of UX and polish, not for any technical reason. A competitor would need a native client, with Windows or OS X integration instead of Electron, if you ask me.

                                                                                                                            1. 5

                                                                                                                              Those are really hard to iterate on without a lot of people. You’d have a hard time keeping up with Slack’s fire and motion around you.

                                                                                                                              Possible though. Particularly if you used their IRC gateway to counter their network effect advantage (until they close it).

                                                                                                                              1. 2

                                                                                                                                You just want a native slack client?

                                                                                                                                1. 2

                                                                                                                                  Yes, with an interoperable service provider as well.

                                                                                                                            2. 6

                                                                                                                              I think Jabber would make more sense as a modern communication platform than IRC. There’s not much that IRC provides that Jabber conference rooms don’t, but Jabber provides a lot more extensibility than IRC (especially without add-on services like Chanserv, Nickserv, etc.). In which case there are already commercial packages like Cisco Jabber and Openfire that are quite popular.

                                                                                                                              1. 1

                                                                                                                                I liked PSYC back when I was comparing them directly since Jabber seemed too complicated:

                                                                                                                                http://about.psyc.eu/Jabber

                                                                                                                                http://about.psyc.eu/PSYC

                                                                                                                                Whatever we use needs to be really simple and efficient at the core. Then, layers or plug-ins for more complex stuff from there. Preferably, super-easy for library users to add or remove. What’s closest any of you know to that which has a decent chance of being converted into a Slack competitor? Other than IRC.

                                                                                                                                1. 2

                                                                                                                                  There aren’t many that are federated like IRC. I can only think of Jabber/XMPP and Matrix. But if you look at slack, which doesn’t seem to be federated, you have lots of options, like mattermost, rocketchat, hipchat, …

                                                                                                                              2. 5

                                                                                                                                You can’t offer Slack’s UI on top of the standard IRC protocol (it lacks links, images, replies, authentication, history…). Proposals to extend the IRC protocol have not been welcomed by the IRC userbase or by established networks. You could tunnel a custom protocol over IRC with magic strings etc. but this would be inherently clunky and the user experience from any other client would be very similar to using Slack’s IRC gateway. You could publish your custom protocol but what would you gain from that? What’s the value proposition where this idea improves over what Slack offers?

                                                                                                                                1. 2

                                                                                                                                  Extend IRC all you want as long as the extensions are public. You develop the client and sell the server; established networks don’t matter.

                                                                                                                                  1. 3

                                                                                                                                    Why would this “eat Slack’s lunch”? Theoretically an open protocol would make it easier for others to integrate with you, but Slack attracted plenty of integrations (which now act as a competitive advantage precisely because their protocol isn’t open). Other than that, what’s the advantage of making the protocol public?

                                                                                                                                    1. 1

                                                                                                                                      Well, you’re saying “other than the advantage, what is the advantage?” Another advantage is that it could be cheaper.

                                                                                                                                      1. 1

                                                                                                                                        Well I explained that that particular issue doesn’t seem to have been a disadvantage for slack, quite the opposite.

                                                                                                                                        Building a protocol as an extension of IRC is inherently going to be more expensive than building it without regard to compatibility with IRC, not cheaper.

                                                                                                                                        1. 1

                                                                                                                                          I don’t believe that, but I haven’t quantified it, so we’ll need to agree to disagree. Slack extensions are not interoperable. IRC bots have been written for decades.

                                                                                                                                          1. 1

                                                                                                                                            Slack extensions are not interoperable. IRC bots have been written for decades.

                                                                                                                                            All true. And yet for so many services one might use when developing (e.g. CI), it’s so much easier to find a good Slack integration than a good IRC integration.

                                                                                                                                  2. 2

                                                                                                                                    Proposals to extend the IRC protocol have not been welcomed by the IRC userbase or by established networks

                                                                                                                                    Not sure whether you’re talking about some specific extensions, but from what I can see there are multiple IRCv3 extensions that are implemented by common servers.

                                                                                                                              1. 16

                                                                                                                                I’ve never fully embraced TDD, but I’m also old. Tests are important, and automated tests doubly so. But TDD- writing tests before the code- means that I’m in the ultimate “black box testing” situation- I may know what the code’s supposed to do, but I don’t know its implementation yet.

                                                                                                                                When writing a module, I also tend to refactor as I write- as I gain a better understanding of the problem I’m solving, I reorganize the code, even before the specific function is even complete and working. The contract changes as I write (and if I’m designing to a contract, the last step will be adapting to the contract).

                                                                                                                                1. 4

                                                                                                                                  Yeah. That’s what annoys me with the constant commit philosophy. I try my best to design things up front to hit all the big points that are hard to fix but little things change constantly and I hate merging before I’m ready.

                                                                                                                                  1. 1

                                                                                                                                    If it is a more complex feature that I’m probably going to get wrong a few times I’ll make a temporary branch, work on that til it is perfect,then create my real feature branch, and either cherry pick the good stuff or literally delete the code in the real branch and copy the final version of the temporary branch over it then create sensible commits from there. By the end the final revisions in each should be identical, but the real branch can do it in 3 or 4 commits instead of 20 with lots of messy debug stuff.

                                                                                                                                    1. 2

                                                                                                                                      I used to do this but found it messy. Nowadays I use squash/amend more heavily, running my tests, and do a new branch (or tag) in case I feel I’ll need a backup.

                                                                                                                                      If time allows, I’ll do a pre-review and see if the commits can be reordered and/or edited further to make life easier for the person who will review it.

                                                                                                                                      In that case I bear in mind it might be future me.

                                                                                                                                  2. 1

                                                                                                                                    I think a huge part of alleviating that pain is to not do TDD with unit tests, but strictly functional tests.

                                                                                                                                    I think most people try to modularize their code, so there’s a top layer that’s publicly facing that you probably commit to pretty early in development. So you write some functional tests around that defining what’s supposed to happen in pretty broad strokes.

                                                                                                                                    I end up adding unit tests for tricky bits of internal logic, but the functional tests are almost always more important in confirming the design and well-functioning of the system as a whole.

                                                                                                                                  1. 13

                                                                                                                                    I’m typing this on a nexus 4 and while I agree Google’s commitment leaves more to be desired, I’d like to point users towards community efforts (specifically lineage in my case). This isn’t my primary phone anymore but it is still alive and kicking as a WiFi only Internet device.

                                                                                                                                    Edit: link https://download.lineageos.org/

                                                                                                                                    1. 9

                                                                                                                                      Update: Moved this “in thread”.

                                                                                                                                      Yeah, and Nexus phones are still the best you can get on Android!

                                                                                                                                      As for running LineageOS, I do wonder about the security, a couple of things:

                                                                                                                                      • Are the releases properly signed and are there signature checks when performing updates?
                                                                                                                                      • Can the boot loader be locked again (as supported by Copperhead OS)?;
                                                                                                                                      • My Samsung Galaxy S3 uses a (long) EOLed Linux kernel, are there any security updates back ported?;
                                                                                                                                      • There is never an update for the BLOBs (baseband, firmware), is this safe?

                                                                                                                                      I mean, I am hardly in a position to complain as this thing is so old…and made by Samsung… and probably this S3, even with a lot of potential security holes, is probably more secure than the latest Samsung flagship with all its crap and spyware…

                                                                                                                                      1. 3

                                                                                                                                        I’m not affiliated with LineageOS, but these answers are based on what I understand:

                                                                                                                                        • Releases are not pgp-signed, but for each release they currently provide a md5sum (yeah.. not ideal) that you can either manually check, or if you use the “LineageOS Updater” in the Settings app, it will automatically verify the md5sum.
                                                                                                                                        • Locking the boot loader on a custom ROM is generally discouraged, due to the complications it can cause with the ROM and with the custom recovery (e.g. TWRP). On Nexus devices it’s usually less risky, but on anything else people always recommend against it.
                                                                                                                                        • Kernel update backports depend to a large extent on your device maintainer for LineageOS and how active they are. For instance, here’s the main hammerhead (Nexus 5) kernel and this I think is the kernel used for Galaxy S3 devices.
                                                                                                                                        • This also depends on your device maintainer, but I think there are actually updates to the blobs from time to time.
                                                                                                                                        1. 3

                                                                                                                                          Qualcomm never produced the binary blob updates. It simply goes vulnerable until someone creates an open source version by reverse engineering.

                                                                                                                                        2. 1

                                                                                                                                          Does anyone know a short summary of exactly what the goals of the LineageOS project are?

                                                                                                                                          Based purely on the name I’m guessing a long-term Android variant for a given device?

                                                                                                                                          The about page is rather irritatingly terse, and the rest of the site isn’t much more informative.

                                                                                                                                          https://www.lineageos.org/about/

                                                                                                                                          1. 5

                                                                                                                                            It’s the fork/continuation of the still-better-known CyanogenMod. CyanogenMod’s main initial claim to fame was that it distributed a de-Googlized, power-user-oriented version of Android: all open-source base software, nothing that does tracking by default, unlocked root access, as many underlying OS/hardware/firmware features as possible exposed as user-modifiable settings, etc. It’s also become popular among people who have phones EoL’d by the official Android releases, though.

                                                                                                                                            1. 1

                                                                                                                                              Thank you very much.

                                                                                                                                              Maybe there is hope for my Nexus 5X from October 2018. :-D

                                                                                                                                        1. 1

                                                                                                                                          Based on the principle of object-orientation

                                                                                                                                          That’s why it will never gain traction. Doing OOP databases was a bad idea so why would a file system be any different?

                                                                                                                                          1. 1

                                                                                                                                            .app distribution on Mac has some nice characteristics. To install the whole app (“object”) you just copy the folder.

                                                                                                                                            1. 1

                                                                                                                                              ah the joys of copying “System” folder back in the day… :-)

                                                                                                                                          1. 33

                                                                                                                                            I’m an Ocaml user and, except for a few rare conditions, I’ve found I much prefer a result type to exceptions. My response will be based on Ocaml which may not be the same as F# so if they don’t apply there then ignore it.

                                                                                                                                            Some points I disagree with the author on:

                                                                                                                                            AN ISSUE OF RUNTIME

                                                                                                                                            I didn’t really understand the example here. How is the author accessing an optional value? In Ocaml we have to use an accessor that would throw an exception if the value is not present or pattern match the value out. This doesn’t seem to have anything to do with exceptions or results, just an invalid usage of an option.

                                                                                                                                            AN AWKWARD RECONCILIATION

                                                                                                                                            This is the case in Ocaml as well, which is why many libraries try to make exceptions never escape the API boundary. But writing combinators for this are really quite easy. A function like (unit -> 'a) -> ('a, exn) result is available in all the various standard libraries for Ocaml.

                                                                                                                                            BOILERPLATE

                                                                                                                                            The author should be using the standard applicative or monadic infix combinators. Maybe F# doesn’t allow that. In Ocaml the example would look like:

                                                                                                                                            let combine x y z =
                                                                                                                                                pure (fun x y z -> (x, y, z)) <*> x <*> y <*> z
                                                                                                                                            
                                                                                                                                            WHERE’S MY STACKTRACE?

                                                                                                                                            This is the one I disagree with quite a bit. If I am using exceptions then yes, I want stacktraces, because it’s a nearly unbounded GOTO. But the value result types give me is that I know, using the types, what errors a function can have and I have to handle it. This makes stacktraces much less valuable and the win of knowing what errors are possible and being forced to handle them. I’d much rather have this than stacktraces.

                                                                                                                                            THE PROBLEM WITH IO

                                                                                                                                            The problem here doesn’t have anything to do with exceptions, it’s that the return type should be a result where the Error case is a variant of the various ways it can fail. Ocaml makes this much much easier because it has polymorphic variants.

                                                                                                                                            STRINGLY-TYPED ERROR HANDLING

                                                                                                                                            Yeah, use a variant not a string.

                                                                                                                                            INTEROP ISSUES

                                                                                                                                            This can indeed be a problem. It’s also a problem with exceptions, though.

                                                                                                                                            1. 9

                                                                                                                                              100% agreed. Debugging from a stack trace is far more complicated than having good error handling through compiler enforced types.

                                                                                                                                              1. 3

                                                                                                                                                Ditto. This is the case I’ve found in any FP language that I worked at, it takes more time to work with the stack trace, and recover anything valuable from it, instead of utilizing the compiler and the type enforcing at compile time.

                                                                                                                                              2. 2

                                                                                                                                                WHERE’S MY STACKTRACE?

                                                                                                                                                This is the one I disagree with quite a bit. If I am using exceptions then yes, I want stacktraces, because it’s a nearly unbounded GOTO. But the value result types give me is that I know, using the types, what errors a function can have and I have to handle it. This makes stacktraces much less valuable and the win of knowing what errors are possible and being forced to handle them. I’d much rather have this than stacktraces.

                                                                                                                                                This is a case where you can eat your cake and have it too. Java has checked exceptions which the compiler enforces are handled. When call a function that can throw a checked exception, the calling a function either has to handle the exception in a try block, or include in its signature that it can throw an exception of the specified type.

                                                                                                                                                You can also do the opposite and add the stack trace to the result type. Most languages provide some way to obtain a stack trace at runtime, so all you need to do is attach the stack trace to the error when it is instantiated.

                                                                                                                                                1. 4

                                                                                                                                                  Checked exceptions in Java are a nice experiment but a rather colossal failure, unfortunately. Since the compiler cannot infer checked exceptions you have to retype them all out at each level and it becomes unwieldy. The situation is even worse with lambda’s where one has to turn a checked exception into an unchecked one.

                                                                                                                                                  1. 3

                                                                                                                                                    Is it simply type inference on function declarations that you see as the difference here? I am curious because as a Java programmer by day, I don’t see a ton of difference between “-> Result<FooVal, BarException>” and “FooVal someFunc() throws BarException { … }”.

                                                                                                                                                    Granted the implementation is quite different (unwinding the stack and all that), but is it simply ergonomics that makes the latter a “colossal failure” in your mind?

                                                                                                                                                    1. 3

                                                                                                                                                      No, the difference is that results are just types and values. From that you get all the great stuff that comes with types and values. For example:

                                                                                                                                                      • Type inference. I only specify the types of my functions at API boundary points.
                                                                                                                                                      • Aliasing types. If I have a bunch of functions that return the same error I can just do type err = ..... rather than type all of the errors out each time.
                                                                                                                                                      • They work with lambdas!
                                                                                                                                                      • They work with parametric polymorphism. I can write a function like 'a list -> ('a -> ('b, 'c) result) -> ('b list, 'c) result.
                                                                                                                                                      • And, probably most importantly, it does not add a new concept to the language.

                                                                                                                                                      That checked exceptions do not compose with lambdas in Java basically tells me they are dead. All the Java code I’m seeing these days makes heavy use of lambdas.

                                                                                                                                                      1. 2

                                                                                                                                                        Gotcha, thanks for the reply. I don’t disagree strongly, but I feel like what you are arguing for is Java, minus checked exceptions, plus more pervasive type inference, plus type aliases, plus several other changes. Which, that’d be pretty cool, but I think at this point we’re discussing sweeping language changes as opposed to the merits of checked exceptions strictly.

                                                                                                                                                        For example, simply replacing checked exceptions in modern Java with use of a Result would (at least as far as I can imagine) still result in a lot of verbosity. You’d just be typing “Result<Foo, Bar>” a lot as opposed to typing “throws Bar” a lot.

                                                                                                                                                        Not to be overly argumentative or anything. But “colossal failure” seems a little strong to me! :)

                                                                                                                                              1. 3

                                                                                                                                                Just tried it out! Great stuff.

                                                                                                                                                1. 2

                                                                                                                                                  I give it a positive review too. Voice calls are much clearer with less latency and jitter. Video is surprisingly sharp and free of artifacts. I was on a spotty LTE connection and the other party was on good Wi-Fi.

                                                                                                                                                  This might have just made Signal a real video calling contender, to say nothing of the benefits of E2E encryption.

                                                                                                                                                  1. 1

                                                                                                                                                    How is the battery life? I’m looking to replace duo and hangouts for video calling my android friends because the CPU spins at 100% on my iphone7 (which nicely handles 4K encoding otherwise)

                                                                                                                                                    1. 1

                                                                                                                                                      How has your experience been using Duo? Mine experience with it thus far has been wonderful (compared to hangouts).

                                                                                                                                                      1. 1

                                                                                                                                                        Can’t really tell the difference except that it doesn’t work on a computer

                                                                                                                                                  1. 10

                                                                                                                                                    He said that most people who are programmers will eventually learn about object-oriented programming, hopefully at university or another school. They will find that the most abstract concept that object-oriented programming has, how it sees the world, is generally the object. On Unix it’s the file. “I’m pretty sure that putting the file as the most basic concept is complete nonsense because the file is way too specific; it’s way too different from a printer, from a sound card. I definitely have big issues ‘everything-is-a-file’ concept and I think it’s misdesigned.”

                                                                                                                                                    Block devices and character devices have been a very successful model for unix. His patronizing tone comes across as infuriatingly arrogant.