felixrieseberg

Excellent effort! However, it also introduces a _major_ security hole:

The Electron Desktop App simply loads an index.html which points at remote JavaScript. That's crazy dangerous - if that endpoint gets compromised, nothing keeps the attacker from running `rm -rf /` on every user's machine.

I'm a member of the Electron maintainers group and fully realize that this is partly on us for not educating better. Remote code should never run with full privileges - consider using a `webview` instead, which can be sandboxed.

I used to be the project lead for Electron at Microsoft (now building the Slack Desktop App) and I'm super happy to say that there's been a lot of great work around interacting with native Windows APIs from Electron: https://felixrieseberg.com/using-native-windows-features-fro...

You can now publish win32 binaries to the Windows Store, which run in a virtualized environment. They get the same rights as normal win32 exes because they _are_ exes.

I worked at Microsoft during the development of this - and I'm so very happy it finally shipped.

We started working on this about a year ago after chatting with npm, git, Ember, and various other command line tools that were substantially slower (or straight up broken) on Windows. I casually mentioned how big of a performance impact we could have to Satya's Assistant and found myself in a meeting with all required groups (filesystems, security, etc), making my case for non-elevated symlink support, within a few days.

Windows still is a massive tanker, but I'm so excited for the Microsoft that is able to make sensible changes quickly.

I cannot understand how a company like Apple, known and proven to build exceptional hardware, won't let me use my iPhone headset with the new MacBook.

This is similar to electron-compile, built by my fellow desktop app coders over at Slack.

https://github.com/electron/electron-compile

This is probably the most sensational text I've read all weekend. Yes, Android has security flaws (that have been previously covered in-depth).

The bar for "hacking WhatsApp" should be dramatically higher than installing an app on the very device that decrypts the message. Heck, you could probably just use the NotificationListenerService[0]. There, I hacked all messaging apps that use notifications. I didn't even need "servers deep in the remote mountains of Colorado".

[0]: https://developer.android.com/reference/android/service/noti...

I'm not sure that that's entirely fair. I for instance don't dislike Cordova for some philosophical reason, but because I have so far hated every single iOS/Android Cordova app - mostly for performance and polish reasons.

I do enjoy Visual Studio Code, Atom, Slack, and other apps built with Electron. Yes, people also use it to build horrible apps, but Electron has proven that it's capable of powering apps people love. I have yet to see a Cordova app people love.

TL;DR: I love various Electron apps. If I see an amazing Cordova app, I will reconsider my position towards Cordova.

If you're based in San Francisco, come to our next meetup! We'll have a bunch of people working on and with Electron there.

www.meetup.com/Bay-Area-Electron-User-Group/

We at Microsoft think about bots as somewhat "intelligent", as in - they understand your intent. There's a little example chat with a pizza bot: It's a subtle difference, but being able to have a conversation vs navigating a flow chart is pretty powerful for a bunch of applications.

Hey pizza bot!

> Hey Jeremy! The usual tonight?

Nah, I'd like to try something new

> We have added three new items:

> 1) Hawaiian

> 2) BBQ

> 3) The Works

Option 3 please.

> Shall I send this to your home?

I built Electron's native Windows notification integration and I'd be suuuuper happy about seeing it become a standard Chromium feature.

You bake deprecation notices into npm, to be displayed during install. He has more than 3m installs a month, if he really wanted to, he could have easily display a giant "npm sucks" banner during every single install. Same message, but it wouldn't immediately hurt people who trusted his modules.

Azer has contributed awesome modules to the community, but such a move _obviously_ messes with a bunch of people who previously didn't trust npm, but Azer. Npm works fine. There might be issues with it, but the reason builds are failing right now is that he decided to unpublish all of them - in a move that feels very kneejerky, despite him claiming that it's the opposite.

If this had been actually in the interest of the community (because he thinks that npm isn't acting in our interest), he'd give people a fair warning. I could have lived with a "Hey, this was my experience, it sucked, I'll unpublish things in 30 days. Please update your dependencies." We know how to deprecate things gracefully.

I don't see a clear answer on whether or not Facebook will analyze or use the data in any way. It is said that a company can "control" the data, but I'd like to know how Facebook will handle the data.

Yahoo still has a bunch of really smart people doing important open source contributions - I wish all of them all the best and I really hope that the tighter belt will allow them to continue their work.

If anyone wants to give Shout a try - you can run it in Azure for free (via free web apps). Also, you can deploy it with one click: https://github.com/felixrieseberg/shout-azure

Disclaimer: Love Shout, just made this

> We're calling it version 0.14, but it's a full rewrite so we think of it more like a 2.0 release.

I love React, but that just seems like a bad idea. Especially given the fact that the previous version was called "v2-beta".

Copying my comment from below. Disclaimer: I work for John Shewchuck / Microsoft.

W3C is working on Web App Manifests (http://www.w3.org/TR/appmanifest/), allowing websites to declare app-like properties. ManifoldJS uses that standard for those platforms that support it, but falls back to Cordova for those who don't. Cordova is awesome, but the W3C also considers work done at Mozilla (Firefox Open Web Apps), Google (Chrome Hosted Apps) and stuff we did (Windows 8 had local web apps, Windows 10 extends over to hosted web apps).

(Disclaimer: I work for John Shewchuck)

W3C is working on Web App Manifests (http://www.w3.org/TR/appmanifest/), allowing websites to declare app-like properties. ManifoldJS uses that standard for those platforms that support it, but falls back to Cordova for those who don't. Cordova is awesome, but the W3C also considers work done at Mozilla (Firefox Open Web Apps), Google (Chrome Hosted Apps) and stuff we did (Windows 8 had local web apps, Windows 10 extends over to hosted web apps).

If you're looking for alternatives, OneDrive has been ported to Linux. It currently has 15GB free and fairly cheap plans.

https://github.com/xybu/onedrive-d/ (using https://github.com/mk-fg/python-onedrive)

(The usual disclaimer: I work for MS).

I had a lot of fun hacking away with the DEIS guyson the Azure integration. If you want a quick overview post, I wrote a "from 0 to cluster": http://felixrieseberg.com/deis-azure-coreos/

If anybody is interested in a some code, I released a small sample application: https://github.com/felixrieseberg/MicrosoftBand-Sample.

We can feel that inside the company, too. I joined the company right before we launched Windows 8 as a Developer Advocate and I have to admit that there was a bunch of stuff inside W8 that made Windows devs need advocacy.

Shortly after Satya took over, a bunch of things quickly changed. We founded an open source team. I'm contributing to and writing open source code full-time. My team is literally tasked with 'building epic stuff and putting it on GitHub". The common reaction is of course "Wtf, Microsoft paid you to hack with us here? On GitHub?" - which makes sense, because such a team wouldn't have existed three years ago. There's definitely a different vibe in the company (at least in the developer-focusses teams I'm working with).

It should be pretty easy to look at the approach I took and mimic it for other providers. I write Open Source code for Microsoft, so we made it work with Azure first - but the code should be clean enough for someone else to pick it up and work in other stacks.

I should probably also mention that the engine running Azure Websites is open source itself (https://github.com/projectkudu/kudu), so you could just point it to your own engine.

Hey guys, Felix here - happy to answer any questions!

I'm one of the open source engineers spending a fair chunk of time helping YC companies that are making use of this deal.

Personally, I don't think that money buys love. It gets us attention, but I believe that we'll only win people over by providing an awesome cloud solution. Furthermore, I'm hoping that doing so much of our development out in the open on Github allows devs to see what we're doing, that we care about it being awesome, and that we're not afraid to sit down and quickly put out a repo with code if we run into a company that needs something.

If anybody has questions, I'm happy to answer them.

Do me a favor and shoot me a mail at feriese@microsoft.com - I'm sure we can set something up!

We have a bunch of Microsofties at YC today, but reach out to Steve or me directly at (founders@microsoft.com) if you're a Winter 2015 batch company and for some reason not at YC today.

It's also worth pointing out that our $60k offer for YC companies is still around, if you're in one of the older batches.

Good to see that a new version is out - if anybody here wants to take it for a spin on Azure Websites, we at Microsoft just created a small one-click script[1] that installs this version.

[1]: https://github.com/felixrieseberg/node12-azure

This post is a few hours old, but I just want to put it out there: We're hiring OPEN SOURCE ENGINEERS. I'm one and our job is awesome[1]. Please get in touch with me if you're interested[2].

[1]: http://instagram.com/p/yqQe0bK3Bq/ [2]: felix.rieseberg@microsoft.com