feelin_googley

I would bet there are still quite a few G5's to be found in recording studios around the world, not to mention G4's and even a few G3's.

Post-2004, did Apple follow up with a suitable replacement for the G5 in that context, i.e., audio engineering? What was it?

Addendum: By "audio engineering" I mean "DAW" use with software such as Pro Tools, DigitalPerformer, etc. and some non-Apple, dedicated hardware for line level inputs and outputs such as that made by Digidesign, MOTU, etc. (The performance of "web browsing" on today's bloated web and other tasks not related to running the above software, which may include older versions, is irrelevant.)

Maybe Apple's acquisition of Logic had something to do with what happened?

Correct. They are not visible.

I could convert these anchors into visible URLs and they should work. Nevertheless I will not be doing that.

When I mentioned JS I was thinking of the presence of the onclick attribute and the vote() function as seen below.

<a id='up_15739117' onclick='return vote(event, this, "up")' href='vote?id=15739117&amp;how=up&amp;auth=&amp;goto=reply%3Fgoto%3Dedit%3Fid%3D15738201%2315739117%26id%3D15739117#15739117'>

"Also, can we please stop using the word "modern" in everything?"

I am using a text-based browser and so I do not use the upvote/downvote javascript. Consider this comment an upvote.

The increasingly pervasive attachment of the word "modern" to software descriptions in recent years is confounding. I thought maybe it was annoying only me but apparently not.

Sometimes I have thought it could be a manifestation of cognitive dissonance arising from the realization that in software, in most cases, "there is nothing new under the sun".

Honestly I do not understand where it comes from or what it means. Is it some sort of marketing buzzword?

I think the Qubes website is also quite useful for informational purposes.

Example, found through Qubes website: http://pete.akeo.ie/2011/06/crafting-bios-from-scratch.html

fgen(1) FCode tokenizer

ftp://ftp.netbsd.org/pub/NetBSD/NetBSD-release-8/src/usr.bin/fgen/Makefile ftp://ftp.netbsd.org/pub/NetBSD/NetBSD-release-8/src/usr.bin/fgen/fgen.1 ftp://ftp.netbsd.org/pub/NetBSD/NetBSD-release-8/src/usr.bin/fgen/fgen.h ftp://ftp.netbsd.org/pub/NetBSD/NetBSD-release-8/src/usr.bin/fgen/fgen.l

Addendum: I also believe it is possible to write software that does not need to be "improved". I prefer reliable software more than "dynamic" software that is a constant state of flux. And as you might guess I am not fond of software that keeps expanding with "features" to fill available space. I am quite happy if software just keeps doing what I expect it do, without slowing down or failing. The question I would have as to other users who appear to want updates is whether they want new features or whether they are hoping the next update fixes some specific or general annoyance they are experiencing, e.g., perhaps generally they are not thrilled with the software and hope the "new" or "updated" version will be less disappointing.

While some may think I have misinterpreted the blog author (and I acknowledge this is a valid response), I still think that bug or nondescript "security fixes" is a powerful, fear-based mechanism to compel users to allow updates -- of any kind. And it therefore relevant to any discussion of "updates". Especially when it is common for these bug or "security fixes" to be inextricably mixed with non-security items such as "features" in such a way that the user must except the "whole hog", perhaps in some way similar to "omnibus legislation" in the US Congress.

I respect everyone's opinions whether you agree with me or not. I am just happy to see that some users may be thinking about "updates" and what they really are instead of blindly accepting them without ever pausing to think.

From my perspective every new "feature" that adds code is also introducing a new potential for a bug or security issue. I want programs and systems to get smaller not larger.

Glad to see this being written.

"Trained" is the word I have thought of many times as well. It is perplexing to see people wanting updates.

It is possible to write finished programs that are bug-free[FN1]. But when eternal rounds of patching becomes a religion, what sort of standard are developers promoting? Every program is expected to have security holes that will need to be patched? What about not releasing software unless it is safe to begin with? Why does a liability need to be created? Solve the problems before the software is released. Not after. Can't solve them? Then do not release.

Automatic updates are also a security hazard in the same way as "antivirus", which also trained users to want updates. It is a backdoor that users are advised to leave open.

FN1. Inevitably there will be the HN commenter who repeats some meme that says all software has bugs. True perhaps if we forget about Ada and the world outside of MS Windows, but are all the bugs major ones? Consider the stuff you find at http://cr.yp.to. Or many of the small UNIX utilities. I could name more selected examples. There is such a thing as finished software. With no major bugs. That does not need constant updates.

"Note that in 32-bit code, memcpy is typically implemented by first copying blocks of 4 bytes using the movsd (move double word) instruction, while any remaining bytes are then copied using movsb (move byte)."

Some software authors do not use memcpy().

https://marc.info/?l=djbdns&m=96477313901746&w=2

http://cr.yp.to/lib/byte.html

   #include "byte.h"

   void byte_copy(to,n,from)
   register char *to;
   register unsigned int n;
   register char *from;
   {
     for (;;) {
       if (!n) return; *to++ = *from++; --n;
       if (!n) return; *to++ = *from++; --n;
       if (!n) return; *to++ = *from++; --n;
       if (!n) return; *to++ = *from++; --n;
     }
   }

"When a Quad9 user clicks on a website link or types an address into a web browser, Quad9 checks the site against IBM X-Force's threat intelligence database of more than 40 billion analysed web pages and images. The service also taps feeds from 18 further threat intelligence partners, including Abuse.ch, the Anti-Phishing Working Group, Bambenek Consulting, F-Secure, mnemonic, 360Netlab, Hybrid Analysis GmbH, Proofpoint, RiskIQ and ThreatSTOP."

Why not share the database with the public? This is meant to be a free service, isn't it?

"Quad9 is designed to provide these protections without affecting the speed that users expect when accessing websites and services."

Very careful choice of words. It does not say it will not affect the speed. It says it will not affect the "speed which user expect". What speed is that?

I already check domains against a database of ones I want to block. I do this locally using djbdns, without needing to send DNS queries over the internet. The speed is better than any third party DNS service, including 8.8.8.8 or 9.9.9.9. IMO, there is no need to send personal, private DNS queries to "18 further threat intelligence providers".

"Telemetry data on blocked domains from Quad9 will be shared with threat intelligence partners to improve their threat intelligence responses for their customers and Quad9."

Telemetry. So they are collecting data about users' DNS queries. This would explain how the service is "free".

When a user tries to access a blacklisted domain, a host of "threat intelligence partners" are notified.

"PCH, which provides Quad9's network infrastructure; and IBM, which provides IBM X-Force threat intelligence and the easily memorable IP address (9.9.9.9)."

Quad9 suggests IP addresses can be memorized. I will rememeber that.

"The personal information protections and selectable DNS encryption, DNSSEC, and blocklist that are in place show that this project is in line with PCH's values," he said. "Quad9 will inspire trust in both individuals and businesses who understand the importance of securing their private browsing data."

If someone digitally signs a document, does anyone believe the document is hence "encrypted"?

When DNSSEC is used, does anyone believe that DNS is hence "encrypted"?

A less misleading description might be something like "DNS record signing".

Using DNSSEC does not mean the DNS packets are encrypted. Anyone sniffing the network can read them.

DNSSEC also makes DDOS easier for malfeasants.

Have those providing the DNSSEC signed records and those providing DNSSEC enabled third party DNS service solved this problem yet?

I am not implying that this "service" could not be useful for users who must use third party DNS service. The question is whether users who really care about security issues must use third party DNS services.

source: http://www.computerweekly.com/news/450430188/Free-Quad9-inte...

"HQ

1442 A Walnut Street

Suite 501

Berkeley CA 94709"

source: https://www.quad9.net

Is this an office of IBM?

64-bit only?

"Becoming true "User Agents," in other words"

I remember the early browsers as smaller programs that were oriented around retrieving content for further viewing/interaction using other applications. As I understood it, this was one of the ways that MIME was useful.

The problems with "modern" web browsing that annoy users probably have less to do with what, back then, would have been separate programs. They have more to do with the retrieval step. User have little control over 1. the content the browser requests and retrieves and 2. whether and how that content is processed (i.e. the "default settings" of the browser decide and to my knowledge few users today manually adjust MIME settings or whatever today's equivalent is). Because users today expect the browser to do everything. It is more than a user agent i.e. http client, it is an "all-in-one" program that can seemingly do anything. No auxiliary programs are needed. This comes at a cost. I would argue that cost includes many hassles that users experience, including "speed".

The point is that this blog post is talking about #2, the processing of retrieved content. But is that really what causes most of the user annoyances? Is that what ultimately affects "speed"?

Or could it be, at least in part, that some web page is controlling the web browser to have it make dozens upon dozens of DNS and HTTP requests, not only for tracking, but in some cases for "content" the user does not want.

The first task of the user agent, #1, to retrieve content, is not nearly as complex as the second, #2. It probably has not changed much since the early days of the www. (I still use original netcat from 1996 as well as other 1990's tcp clients to great effect.) Retrieval of content can be user controlled. The complexity is manageable. The "user agent" can be small, open source and easily compiled by the user. And with todays memory and networking retrieval can be very fast.

When I think of a "user agent" I think of a tcp or http client, a small program that can make TCP connections and HTTP requests, not one that is also a graphics rendering engine, a video player, a programming language interpreter or a PDF viewer, etc.

It is the disappearance of the MIME idea in favor of a highly complex, all-in-one application called a "modern web browser" that is at the source of every known problem I can think of that is associated with "modern web browsers" today, whether it is browser "speed" or privacy or security or whatever. It is the price one must pay for not having separate programs with separate privileges to accomplish separate tasks.

"Antivirus is the ultimate back door," Blake Darche, a former N.S.A. operator and co-founder of Area 1 Security. "It provides consistent, reliable and remote access that can be used for any purpose, from launching a destructive attack to conducting espionage on thousands or even millions of users."

Humble opinion: s/Antivirus/Automatic updates/

Perhaps antivirus were in fact an early experiment to test the feasbility of automatic software updates.

I recall many years ago, pre-smartphone, users being advised to leave their computers online 24/7 "so antivirus could download updates". Yikes.

"... remember that the purpose of DNS is to be public."

DNS records, e.g. zone files, are supposed to be public information.

As such, ICANN requires gTLD registries to provide users with access to them.[FN1]

However, various ccTLDs at various times refused to comply, and most still try to pretend their zone files are private.

Obviously, as the blog post shows, users can still get a large quantity of the data freely from other sources.

Google search results for ccTLD zone files are dominated by individuals who have done so and are selling this data. IMO, this sale of public data is unnecessary, not to mention annoying.

Last year .se and .nu started making their zone files public.

https://www.iis.se/english/press/pressreleases/iis-releases-...

https://zonedata.iis.se

They were also the first to try their hand at DNSSEC. As the blog post shows, DNSSEC makes it easier to get contents of a zone.

FN1. "About Zone File Access

Registry operators must provide to ICANN bulk access to the zone files of the Generic Top Level Domain (gTLD) at least on a daily basis. For gTLDs, a zone file contains information about domain names that are active in that gTLD. In general, Internet users may be able to access and download zone file data at no cost for certain purposes.

This contractual obligation does not apply to any ccTLD (such as .us, .de, or .uk). If you have a complaint about gTLD zone file access, please submit a Zone File Access Complaint Form."

source: https://www.icann.org/resources/pages/zfa-2013-06-28-en

"... trivial deployment, etc.)..."

Does this refer to static binaries?

What amazes me most about Go is that they managed to successfully pitch a C-like systems language that does not promote use of shared libraries. About six years passed before they added an option to create them.

Were there many complaints about the absence of shared libraries originally?

Whenever I have mentioned the benefits of compiling C programs as static binaries and that in some cases with todays hardware one can have enough memory that shared libraries may not be necessary in order to conserve memory (one of the original goals of shared libraries), I have encountered substantial resistance to the idea. Perhaps some folks are interested in shared libraries for reasons other than memory conservation.

"He developed the well respected Reva Forth, used by hobbyists around the world. "

Reva Forth always seemed nice but I could never get it working on anything other than Windows.

As such, I have little faith that "8th" will place any value on portability either, e.g., that it will be ported to BSD, Plan 9 or other RPi-compatible OS.

Meanwhile, there are plenty of more portable, open source Forths to choose from.

Example:

    ftp -4o cforthu.zip https://codeload.github.com/pahihu/cforthu/zip/master

Some HN commenters are questioning the peculiar security claims.

The author discloses that 8th depends on a number of third party libraries. Would this mean that each of those third parties would also have to make similar security claims to 8th?

For example, 8th uses an HTML5 parsing library from Google called gumbo-parser.

"Non-goals:

Security. Gumbo was initially designed for a product that worked with trusted input files only. We're working to harden this and make sure that it behaves as expected even on malicious input, but for now, Gumbo should only be run on trusted input or within a sandbox. Gumbo underwent a number of security fixes and passed Google's security review as of version 0.9.1."

source: https://github.com/google/gumbo-parser

It may be the case the only input parsed by 8th is trusted or "within a sandbox" but without the source code how would this be verified?

Already discussed on HN: GNU readline, BSD editline, rlwrap and linenoise. I suspect enhance and libtecla have been discussed too (alternatives to rlwrap and readline).

For example: https://news.ycombinator.com/item?id=5086837

Both editline and readline are large, too large to be compiled into every program that could benefit from REPL.

The answer to the bloat is linenoise. Great project.

But then there are all the programs that already have the readline bloat compiled in. How to replace it with something smaller? Can this be done?

There is another editline, not NetBSD's editline. It may predate the web, as it was originally distributed via Usenet. I do not recall it ever being discussed on HN. I suspect the original author probably has an HN account.

From Github:

   *call compatible with GNU readline*

   small size (<30K)

   originally developed for older UNIX and Plan 9

   forked from Minix 3, not related to NetBSD editline

   does not rely on libtermcap/curses

source: https://github.com/troglobit/editline

socat can function as a replacement for rlwrap, something like:

   socat -t0 readline exec:q

where "q" is a program that could benefit from a REPL.

Perceptually I find socat readline exits faster than rlwrap. The later always feels a bit sluggish. Same for libtecla's enhance.

Is there a linenoise-based replacement for rlwrap?

.io domains are perhaps fashionable, but they are expensive.

For $0.88-$0.99/yr one can have a domain in the same registry as the Alphabet Inc. website's domainname. For that price, it would not be a clever name, but it could be an easy-to-memorize 6-digit number. What if it is only used for an API endpoint?

A higher level of "reliability" IMHO could be achieved by use and publication of a stable IP address, perhaps anycasted if one can afford it. At least it could be a backup for emergencies, such as DNS failures.

Consider that DNS itself e.g., disseminiation of root.zone, does not rely on DNS. The IP address for ftp.internic.net is well known and rarely changes. As I recall, when it does, they notify the public in advance. Some years ago if I am not mistaken, there was a change from 208.77.188.26 to 192.0.32.9.

Another example is third party DNS providers. They too publish stable IP addresses. Sometimes users might even memorize them, or store lists of these addresses e.g. included within installed software.

As a user, I hold no bias against any company that publishes its stable IP addresses. In fact, on the issue of reliablity I would hold them in higher regard than those who rely 100% on DNS and third parties associated with DNS service. DNS is reasonably reliable, but IMO not more so than a stable IP address.

Working examples:

23.185.0.4 (www.usenix.org) can be abbreviated as 23.185.4

192.0.79.32 (hackaday.com) cannot be abbreviated as 192.79.32

Perhaps there are issues I have not considered, but I always appreciated the fact that original netcat accepts "serialized" IP addresses, as the author calls them. For example, 127.1 as shorthand for 127.0.0.1.

Question: Once they knew there was a problem, and assuming they realized attackers could have already developed faster attacks or could start developing faster attacks at anytime, why did the company and the authors agree to delay publishing the paper?

I used the term "diskless" but did not intend to imply booting from a network. It probably was a poor choice of words as "diskless" may have a loaded meaning.

The media I create require no network to boot. They only require 1. a computer with an appropriate USB or SD card slot that can boot from USB or SD card, respectively, and 2. sufficient RAM to hold the system.

This sort of usage is what I am curious about on the MacIntosh.

Would this allow a user to have a "diskless" Mac?

I create bootable media, e.g. USB sticks or SD cards, for PCs and RPis and I can thus run "diskless"; no disk access is required and the full system fits in RAM.

I can insert the media into any available PC and use the computer, without disturbing anything on its HDD.

This can also be very useful for emergencies where a computer with a HDD will not boot due to some problem with what is on the drive.

Is this flexibilty possible with today's MacIntosh?

found: http://bitcheese.net/web_browsers_must_die

(fwiw, author appears to be a Rails developer)

I recall lua for the browser beginning in 2001.

http://web.archive.org/web/20010428142032/http://links.sourc...

http://web.archive.org/web/20090227050803/http://article.gma...

http://elinks.or.cz/documentation/html/manual.html-chunked/c...

For networking, if necessary, one can use slirp.

"Another alternative to direct pcap and tun/tap networking on all environments is NAT (SLiRP) networking. NAT networking is limited to only IP network protocols so DECnet, LAT and Clusting can't work on a NAT connected interface, but this may be the easiest solution for many folks."

source: https://github.com/simh/simh/blob/master/0readme_ethernet.tx...

https://virtuallyfun.com/category/slirp/

A debate that never grows old?

Against better judgment, I will bite.

The author makes a valid point. Consider command line history, and command line editing via vi or emacs bindings. I use sh like a REPL all day, every day. I make constant use of searching prior tasks with Ctrl-[ + / or fc -l. I also have hundreds of short, saved scripts.

I do not use a mouse or X11, no vim. I do not use a "clipboard", other than tmux buffers. Everything happens through editors/pagers like sed, vi and less. There is constant iteration. What is the GUI equivalent? Keyboard macros?

The ultimate aim is to make tasks non-interactive. To script away the interactive work. Automation. This is in direct opposition to the philosophy of the GUI: that work must be interactive, and to make interaction more pleasant.

But there are so many differences and similarities between CLI and GUI. What really separates them and makes me choose one over the other? If I can pick just one point of differentiation: Most times, CLI is more reliable. What does reliable mean here? It means robust. Less likely to fail.

Assume that for comparison we can have both GUI and CLI versions of the same applications. And that the GUI is more than just a "skin" over the CLI.

Show me a GUI application that is more reliable than the CLI version. I will take notice.

But to get me to switch away from CLI usage, one must show me many GUI applications, all more reliable than their CLI versions.

An entire system of fast, robust GUI applications, all more reliable than CLI alternatives.

This might be possible. But it is not available as of today AFAIK. And I have to go with what works. Today.

FWIW, I am an end user not a developer.

"Can you provide a name or a link?"

https://ianix.com/pub/dnssec-outages.html

http://web.archive.org/web/20000824181520/http://cr.yp.to/dj...

https://media.ccc.de/v/27c3-4295-en-high_speed_high_security...

http://cr.yp.to/talks/2017.09.18/slides-djb-20170918-dnssec-... http://cr.yp.to/talks/2016.12.08/slides-djb-20161208-dnssec-... http://cr.yp.to/talks/2016.06.10/slides-djb-20160610-a4.pdf http://cr.yp.to/talks/2015.12.17/slides-djb-20151217-a4.pdf http://cr.yp.to/talks/2013.12.27/slides-djb-20131227-a4.pdf http://cr.yp.to/talks/2013.02.07/slides.pdf http://cr.yp.to/talks/2012.11.16/slides.pdf http://cr.yp.to/talks/2012.06.04/slides.pdf http://cr.yp.to/talks/2009.10.30/slides.pdf http://cr.yp.to/talks/2009.08.11/slides.pdf http://cr.yp.to/talks/2009.08.10/slides.pdf http://cr.yp.to/talks/2009.06.27/slides.pdf http://cr.yp.to/talks/2009.06.24/slides.pdf http://cr.yp.to/talks/2009.03.21/slides.pdf http://cr.yp.to/talks/2009.03.20/slides.pdf http://cr.yp.to/talks/2009.03.17/slides.pdf http://cr.yp.to/talks/2009.03.04/slides.pdf http://cr.yp.to/talks/2009.03.03/slides.pdf http://cr.yp.to/talks/2009.03.02/slides.pdf http://cr.yp.to/talks/2008.09.22/slides.pdf http://cr.yp.to/talks/2008.08.22/slides.pdf http://cr.yp.to/talks/2007.03.20/slides.pdf http://cr.yp.to/talks/2007.02.02/slides.pdf http://cr.yp.to/talks/2006.10.17/slides.pdf http://cr.yp.to/talks/2006.08.28/slides.pdf http://cr.yp.to/talks/2004.04.28/slides.pdf http://cr.yp.to/talks/2003.03.18/slides.pdf http://cr.yp.to/talks/2003.02.11/slides.pdf

"Personal experience and insight would also be appreciated"

Personal experience:

I never learned how to set up DNSSEC. It was a moving target at the time I became interested in DNS and as we know it has never been easy to set up. I did learn how to set up DNSCurve though.

Insight:

I have no great insight. Around 2008 when the BIND "experts" acknowledged the problems with forgery and started pushing DNSSEC again, I stopped using shared caches. I switched to local dnscache only. Hence I see never had any need for DNSSEC.

Today I do not even use a local cache. I only use /etc/hosts and local authoritative servers, tinydns and nsd. This is mainly for speed and availability. To gather DNS data, I created a "nonrecursive resolver". It beats the speed of a cold cache.

The "Do Not Speculate!" idea reminds me of the practice of delivering "the kitchen sink" when only a small program that does one thing would suffice.

It reminds me of when, e.g., a 1990s-2000s Windows user needed a small program that does one thing, and in order to get it, the download from Microsoft was an installer with hundreds of megabytes of unneeded binary files. It was not possible to download only the single program, which was no more than 1-2MB in size.

It reminds me of this quote: "The problem with object-oriented languages is they've got all this implicit environment that they carry around with them. You wanted a banana but what you got was a gorilla holding the banana and the entire jungle." - Joe Armstrong

It reminds me of bloat, of giving users things they do not need. A problem that continues to this day.

Instead of bloated, complex UEFI, I wish something like OpenBIOS/OpenFirmware/SmartFirmware/OpenBOOT would be available for today's hardware. I have played around with fgen on i386 and read some of the history. They even provided courses on how to write drivers. Besides OLPC, why did this not catch on?

IMO, Forth is the most elegant and flexible language for initializing hardware.

This aligns with at least one person's predictions about the use of weak encryption and high margin for error of setting up and maintaining DNSSEC. He occasionally presents on the "DNS Security Mess" and has long highlighted this among DNSSEC's various flaws, with examples of the screw ups so far and their consequences.

Not to those who actually want to read the article:

     curl -o x.htm http://web.archive.org/web/20171029163834/https://www.wsj.com/amp/articles/who-will-rein-in-facebook-challengers-are-lining-up-1509278405

     # remove javascript
     sed -i '/<p>/,/<\/p>/!d' x.htm

New address for article:

     file://x.htm