HNHacker News
TopNewBestAskShowJobs

tmcw

2,226 karma · joined August 26, 2009

I write over at https://macwright.com/
submissionscomments
tmcw··on Hacking Is the Opposite of Marketing
[author] Thank you, I was winging it a bit with secondhand (YouTube video) Minecraft knowledge :)
tmcw··on I want to learn D3. I don’t want to learn Observable. Is that ok?
Hi! I wrote that article.

Basically… the anti-patterns stuff is really not that different from "React anti-patterns". JavaScript supports mutability, a lot of frameworks embrace immutable patterns (like Observable, and React). Using the mutability will lead to bad situations, like mutating in Observable or mutating some state in React.

The same with selecting elements, too. Like - if you're in React (or Vue, or… most component libraries) doing a document.querySelector is no good. You break modularity and the ability to add multiple copies of a component to a screen. Same with Observable. Selecting elements from a necessarily-global DOM is bad.

The gist is: Observable isn't JavaScript but is really close to JavaScript. We could either make it mostly-JavaScript and have some gotchas around mutability and such (but make it a lot friendlier to JS devs, use existing libraries, etc) or make it something stricter and do a 'clean break.' If Observable was way different than JavaScript, this thread about Observable "having lock-in / being too hard" would be 10x bigger :) Such is the balance between practicality and purity.

You can see plenty of other things trying to do this balance. Like React (not quite JavaScript, because of JSX), Svelte (very much not vanilla JavaScript), Elm (pure, idealistic, also its own island because of its purity). Unfortunately you can only really do a pure system with those drawbacks, a practical system with those drabacks, or some combination of the two.

tmcw··on Streetmix – A fun little urban design playground
One of my favorite projects, and a great example of how to use technology to help people understand and participate in street design decisions!
tmcw··on Working at a startup is overrated, both financially and emotionally
Little to argue with on the fundamentals here, but ending up in a place where everyone's winning move is to work for one of five unregulated monopolies is, ahem, a bummer, in a macro sense.
tmcw··on Paper Notes
(author) - Yep, I have a few friends with remarkable tablets and generally adore eInk and could totally see them being a worthy alternative to field notes. Planning on getting one sometime, maybe when they come out with a v3 whenever that is.
tmcw··on Google Docs will now use canvas based rendering
Agree on all points but

> Font rendering and layout can all easily be accomplished by embedding libraries like freetype.

Whoooah no. This stuff is way, way, way harder than dropping in freetype.

tmcw··on Why has no one made a better Goodreads
Which APIs? Worldcat, with decent data but paid licensing and lots of dirty data? Amazon’s, which they’ll shut down if you build a competitor? Try finding an API that gives you high-quality book cover images, too. And the ability to retain results.
tmcw··on Why has no one made a better Goodreads
This missed the biggest technical moat by a mile: data.

Book data is scarce and expensive. Goodreads gets it for free because of Amazon, Amazon gets it subsidized because of Amazon's chokehold on book publishing. Any Goodreads competitor needs to license paid data and sort through the duds and the duplicates, and struggle to match up book with only ASINs that are on Amazon Kindles and nowhere else.

And Kindle integration. When you finish a book on a Kindle, it asks you to review it on Goodreads. If you want to add an option to review it on $otherstartup website, your best bet is a supreme court antitrust case.

tmcw··on Only Google is really allowed to crawl the web
I've definitely scraped by this problem on several occasions. Recently I was writing a tool to check outgoing links from my site, to see which sites are offline (it's called notfoundbot). What I found was that many sites have "DDoS Protection" that makes such an effort impossible, other sites whitelist the CuRL headers, others like it when you pretend to be a search engine.

Basically writing some code that tests whether "a website is currently online or offline" is much, much harder than you think, because, yep, the only company that can do that is Google.

tmcw··on GitHub's Web Component Collection
On my last project - which was mostly a Rails app with Stimulus, but Web Components for the parts where they fit, we exclusively used GitHub's components. They're all really solid and well-engineered, and you have the guarantee that they're actually used on GitHub, in production.
tmcw··on Bitcoin network average energy consumption per transaction compared to VISA
It costs about 16 cents to make a $20 bill. https://www.federalreserve.gov/faqs/currency_12771.htm

In truth, if I factor in the establishment of the United States and several hundred years of money policy, it'll be higher. But for a fair comparison with Bitcoin, that'd be unfair, right? Because the US's money policy is obviously historically tied to Britain's, so I should include that too. And Britain was adapting the system that was established in feudal times. A lot of work went into making fiat currency real.

So a fair comparison would be Bitcoin versus the cost to print money, plus the history of the US currency system, UK, and all of monetary history before that. This is starting to look pretty bad!

tmcw··on Bitcoin network average energy consumption per transaction compared to VISA
If they factored in the other-bank transaction costs, there'd be something else to "what-about." What about the company's energy costs in its non-payment processing? How about all the plastic they use to make those credit cards? The silicon in the card swipe machine?

None of these things will bridge that gap, unveiling a missing data point that somehow makes VISA less efficient by six magnitudes that somehow researchers were missing all this time. But constantly asking for more detail is a good way to stay in denial about Bitcoin's terrible numbers.

tmcw··on One Way to Represent Things
(author)

I appreciate Haskell's power in this domain, and apparently sum types are life-changing (they get mentioned in so many language conversations).

That said, I'm mostly concerned with types like columns, rows, tables, colors, urls, documents, or images. These are implementable in lots of languages, but many languages just have a lot of ad-hoc implementations of them, of the same concept but with slightly different tilts on it. I'm saying that it would be interesting if a language focused on that part of the ecosystem, so that things could connect together.

Haskell might have a very nice type system, but it does not seem like it has many universally-accepted standard types for everything to use. For example, as soon as it gets up to the complexity of a "text" type, there are lots of slightly-different flavors of text.

tmcw··on OpenStreetMap in Realtime
I worked on this ages ago :). It's replaying the last minute's edits, and since all of the editing tools just file a changeset (like a commit) all at once, it has to reconstruct what it looked like to draw those features. That timing is just based on a fixed count of seconds it should take to draw a line, a point, etc. The code's here:

https://github.com/osmlab/show-me-the-way/blob/gh-pages/js/s...

tmcw··on The new reading stack
There are two hyperlinks in that sentence that I hoped would avoid ambiguity by citing sources, but I'll make it more explicit in the copy.
tmcw··on What it's like to be a nonprofit programmer
Darrell's one of the most informed voices in SF about transit and housing, too! Just following him on Twitter has been one of the best things I've done in terms of acclimating to local politics in California.
tmcw··on Rust is a hard way to make a web API
The post mentions this, but the main concern is continuous deployment, where cache doesn’t really help - you’re building from scratch at least once, and the build isn’t happening on your MacBook or fancy development machine but on Google cloud build or some other time & resource-limited environment.
tmcw··on Over 100 Scientists and Doctors Call for Increased Vitamin D to Combat Covid-19
Hacker news is fixated on the Vitamin D hypothesis. 142 posts in the last year, many hitting the front page.
tmcw··on Ganja.js: Geometric Algebra Generator for JavaScript, C++, C#, Rust, Python
About time this project gets some love. One of the most mind-blowing bits of code I've ever encountered.
tmcw··on Sharrows, the bicycle infrastructure that doesn’t work and nobody wants
Sorry for the delay updating the article - one heck of a week. I've linked it and added a few more notes from folks who wrote back.
tmcw··on Mapbox-gl-js is no longer under the 3-Clause BSD license
To be clearer: "it helps other companies, for free."
tmcw··on Mapbox-gl-js is no longer under the 3-Clause BSD license
I won't get into all the context, but I think we should consider whether a community without contributors is a community. GL JS never had major active contributors outside of the company, and there are no self-funded webgl experts with lots of time who are ready to maintain a fork.

OSS, we hoped, was about enabling people and unlocking people's ability to collaborate. It turns out that in 2020, it's mostly helping companies and getting nothing in return. That's not a dynamic you can build a sustainable business on.

tmcw··on Mapbox-gl-js is no longer under the 3-Clause BSD license
I wrote that paragraph and I agree with the decision to change GL JS's licensing.
tmcw··on Billionaires Build
56% of billionaires build. 44% of billionaires inherit.
tmcw··on Ask HN: How to safely execute user code in browser (like observablehq)?
Yes, use per-user domains to make sure that things like localStorage, which is domain-associated, is not leaked from one script to another.
tmcw··on Ask HN: How to safely execute user code in browser (like observablehq)?
Yep: custom domain, iframe security policies. Communicate with the iframe via postMessage only, be strict about message origins, and have limited trust in those messages, too. Strict CSP policies and use the 'sandbox' iframe attribute.

iframes are cruddy, but they are designed for this - the long era of iframe-based embedded advertisements caused vendors to double-down on those security policies.

Observable doesn't use WebWorkers, duktape, or a custom JavaScript interpreter. If you had sandboxed JavaScript that didn't need access to the DOM, those might be options, but if you want people to write JavaScript like usually, they don't do any good.

tmcw··on San Francisco voters approve taxes on highly paid CEOs, big businesses
https://sfmayor.org/sites/default/files/CSF_Budget_Book_June...

Trains, streets, cops, hospitals, public works, 31k employees, and so on.

tmcw··on 95% of Programming Isn’t Hard (and other random thoughts)
Most languages have one kind of "object" used for data and another kind used for instances of classes associated with OO programming. JavaScript traditionally uses one kind for both (traditionally, in that there is now an alternative, Map, but it's underused https://macwright.com/2017/03/13/maps-not-strictly-better.ht... )

In other languages, the data kind of object - dicts in python, hashes in ruby - allows you to associate any key with any value. In JavaScript, the hybrid kind of object that's used for both, allows you to associate keys with values, but has some keys that are special, like __proto__, that override language constructs and cause chaos and vulnerabilities.

tmcw··on 95% of Programming Isn’t Hard (and other random thoughts)
I commit my full force of being to craft the highest quality posts on my personal blog for you, this is really 1% stuff.
tmcw··on 95% of Programming Isn’t Hard (and other random thoughts)
Fair point, I should have cited that. From snyk: https://www.google.com/search?hl=en&q=prototype%20pollution%...

You'll see prototype pollution CVEs in such libraries as jQuery, Lodash, handlebars, ajv (and transitively, request). A pretty good set of modules that are heavily used.

Scroll through the latest vunerabilities in the database and you'll see prototype pollution popping up very reliably https://snyk.io/vuln?type=npm

← PreviousPage 3 of 13Next →