Graphics

• GPU accelerated graphics
• a 2D scene graph for arbitrary sophisticated graphics
• 3D capabilities if you need them — we’re not targeting high-end gaming
• Comprehensive, extensible set of UI controls
• Platform native fonts
• Flexible, accelerated animations / transitions
• Support for both declarative and programmatic UI creation

Languages

• Scripting based on a well known scripting language
• JIT for scripting engine tuned for interactive desktop applications not batch or server workloads
• Easy integration of arbitrary native code

Ecosystem

• Cross-platform, supporting at least Windows, macOS and Linux
• Open Source
• Broad set of specialized UI controls and support libraries
• APIs based on standards with both new features arriving and long term support for existing interfaces

Tooling

• Broad IDE support
• Ability for designers to prototype and tweak
• Sophisticated debuggers
• Memory and CPU profiling

And imagine if the technologies underlying this were the subject of vigorous head-to-head competition for performance between the three largest tech companies in the world.

Reality

Anyway, this exists and it’s called Electron. I’m honestly confused when people don’t see its appeal. Mozilla had their own product in this space, XULRunner, but they killed it about a decade ago when they realized that native software was dead.

Chrome remembers all my passwords but unfortunately doesn’t seem to offer a straightforward API to get at them. Conveniently they do sync my passwords to my computer’s password store and there’s an API for that.

I wrote a little script and I’ve been going through generating unique passwords for all the unimportant sites and turning two-factor authentication on where it’s offered. The Secret Service database (and Chrome) seem to sometimes end up with multiple entries for a single site, and Chrome doesn’t seem to sync my updates immediately, but I’ve found this a helpful start.

Originally published at Ian McKellar.

While I’ve never lived under totalitarianism I’ve spent time in some (Mubarak’s Egypt, Suharto’s Indonesia, Mahathir’s Malaysia). In these countries most people went about their daily business quite freely. The fell in love, started businesses, gossiped with their friends, watched television. There were significant parts of the countries that were not ok - political dissidents, religious and ethnic minorities, journalists - but most of the people, most of the time, were doing just fine, and so was everyone around them.

If we just wait and see how the Trump administration affects our lives, for most of us the effects will be minor and possibly even positive. I'm a straight white upper middle class cis white man. I'm an immigrant but with a green card and no discernible accent. I will be okay.

Our coastal bubbles of privilege will protect us from harm like they protected us from seeing what was going on in the country. Our friends of color, our queer friends, our Muslim friends who are in our our cities will be mostly okay - or at least not much worse off than they have been.

We need to look out of our bubbles, not just to understand the country that elected Trump, but more to protect the most vulnerable. Unless we go looking we won’t see the voter suppression, the refugees stuck in war zones, the violence against gay kids or the immigrants dying at the border.

Each party chose a candidate that was dismissed out of hand by half the country as even a valid choice to offer. The core of the debate has not been over policy or even really a vision of the future of the country, but of the fatal personal flaws of the other candidate.

Where do we go from here? If America elects Trump on Tuesday then I and half the country won’t just feel defeated and disappointed, worried about next four years and the country our children will inherit, but we’ll be skeptical of the president elect’s eligibility to hold the office to which he was democratically elected. If Clinton prevails the other half of the country will feel the same way.

Perhaps more disturbingly support for the candidates break heavily along gender, ethnicity and class lines. Whoever wins, whole communities will not only feel unrepresented in the White House, they’ll feel that its occupant is illegitimate. And for all their various skills, neither candidate has demonstrated skill in uniting the nation.

Originally published at Ian McKellar.

Thinking about technology we have a similar situation. Most people are happy to rely on a proprietary operating system like MacOS or Windows because even though it takes away some freedoms, for them these freedoms aren’t as important on a day-to-day basis as the convenience that the platform provides.

Even though they’ve done a terrible job of protecting women and marginalized minorities from abuse, Twitter is a really convenient conversation platform for me. Facebook too with its real names policy excludes many people from honest, safe expression, but for a white cis man like me it’s really convenient.

On the other hand I run Linux on my personal computers because software freedom is morally important to me and the practical benefits for my fringe use case (programming) are significant.

If we’re going to build and promote Free technology — both FLOSS and a decentralized web, we need to accept that the pure principle of freedom isn’t enough to kick-start change. Enough people need to suffer enough discomfort to trigger a revolution.

Originally published at Ian McKellar.

Uber. Or Lyft or AirBnB, or even Etsy.

This new sharing economy supposedly shakes up traditional businesses by harnessing the distributed power of the internet, but when you ignore shiny apps these businesses look a lot like traditional rent-seeking middlemen.

It feels like a bug that we are making new businesses that look like such old businesses. Ride sharing shouldn’t need middleman. Prospective passengers and drivers should be able to discover each other, agree on a transaction, go for a ride and then make payment.

We have a lot of the pieces already, but reputation is the big challenge I see in all this. Even centralized systems struggle with reputation but we don’t have a good way to know if we should trust that a driver is competent or a guest won’t trash my apartment. I don’t know how to solve this, but I sure hope someone is thinking about it.

Originally published at Ian McKellar.

As an obvious example, if you’re implementing a simple arithmetic function in assembly language you have to expend a lot of your brain power to track which registers are used for what, how the CPU will schedule the instructions and so on, while in a high level language you just worry about if you’ve picked the right algorithm and let the compiler worry about communicating it correctly and efficiently to the processor.

Lo-fi

More abstraction isn’t necessarily good though. If your abstractions hide important details then the cognitive burden on developers is increased (as they keep track of important information not expressed in the API) or their software will be worse (if they ignore those details). This can take many forms, but generally it makes things that can be expensive feel free by overloading programming language constructs. Here are some examples…

Getters and Setters

Getters and setters can implicitly introduce unexpected, important side effects. Code that looks like:

foo.bar = x;
y = foo.baz;

is familiar to programmers. We think we know what it means and it looks cheap. It looks like we’re writing a value to a memory location in the foo structure and reading out of another. In a language that supports getters and setters that may be what’s happening, or much more may be happening under the hood. Some common unexpected things that happen with getters and setters are:

• unexpected mutation — getting or setting a field changes some other aspect of an object. For example, does setting person.fullName update the person.firstName and person.lastName fields?
• lack of idempotency — reading the same field of an object repeatedly shouldn’t change its value, but with a getter it can. It’s even often convenient to have a nextId getter than returns an incrementing id or something.
• lack of symmetry — if you write to a field does the same value come out when you immediately read from it? Some getters or setters clean up data — useful, but unexpected.
• slow performance — setting a field on a struct is just about the cheapest thing you can do in high level code. Calling a getter or setter can do just about anything. Expensive field validation for setters, expensive computation for getters, and even worse reading from or writing to a database are unexpected yet common.

Getters and setters are really useful to API designers. They allow us to present a simple interface to our consumers but they introduce the risk of hiding details that will impact them or their users.

Automatic Memory Management

Automatic memory management is one of the great step forwards for programmer productivity. Managing memory with malloc and free is difficult to get right, often inefficient (because we err on the side of simple predictability) and the source of many bugs. Automatic memory management introduces its own issues.

It’s not so much that garbage collection is slow, but it makes allocation look free. The more allocation that occurs the more memory is used and the more garbage needs to be collected. The performance price of additional allocations aren’t paid by the code that’s doing the allocations but by the whole application.

APIs’ memory behavior is hidden from callers making it unclear what their cost will be. Worse, in weirder automatic memory management systems like Automatic Reference Counting in modern versions of Objective-C, it’s not clear if APIs will retain objects passed to them or returned from them — often even to the implementers of the API (for example).

IPC and RPC

It’s appealing to hide inter-process communication and remote procedure calls behind interfaces that look like local method calls. Local method calls are cheap, reliable, don’t leak user data, don’t have semantics that can change over time, and so on. Both IPC and RPC have those issues and can have them to radically different extents. When we make calling remote services feel the same as calling local methods we remove the chore of using a library but force developers to carry the burden of the subtle but significant differences in our meagre brains.

But…

But I like abstraction. It can be incredibly valuable to hide unimportant details but incredibly costly to hide important ones. In practice, instead of being aware of the costs hidden by an abstraction and taking them into account, developers will ignore them. We’re a lazy people, and easily distracted.

When designing an API step back and think about how developers will use your API. Make cheap things easy but expensive things obviously expensive.

Originally published at Ian McKellar.

I used apt pinning to bring in versions of nginx and OpenSSL from testing into my jessie server. I first added sources for testing by creating a file /etc/apt/sources.list.d/testing.list:

deb http://ftp.us.debian.org/debian testing main non-free contrib

Then I configured my pin priorities by creating /etc/apt/preferences with:

Package: *
Pin: release a=stable
Pin-Priority: 700

Package: *
Pin: release a=testing
Pin-Priority: 650

Package: *
Pin: release a=unstable
Pin-Priority: 600

After an apt-get update I could install the version of nginx from testing, bringing in the appropriate version of OpenSSL: apt-get -t=testing install nginx-full

Then it was just a matter of changing:

listen 443 ssl;

to:

listen 443 ssl http2;

wherever I wanted it.

Now it looks like I’m serving over HTTP/2. Not that it makes a whole lot of obvious difference yet.

Originally published at Ian McKellar.

I love learning new programming languages and inventing new programming languages. I like designing meta-frameworks that I could use to build frameworks. It’s so intellectually rewarding to reimplement existing functionality in new ways — to try to eek out a little more performance, or see if a different approach will result in more elegantly structured code. I play with expressing algorithms in the most concise way possible. I implement crypto algorithms and network protocols from scratch. I could spend hours or days tweaking or creating the perfect build system for a project. I really want to use bloom filters for something some day.

It’s so much fun. I love being a programmer.

None of that is particularly useful, most of the time. I learn a lot, which can be useful, but it’s rarely creating value or solving real problems. That’s why I do it on my own time.

At work I focus on building products that will excite my users, not myself. I try to avoid impressing my co-workers with my cleverness. I strive to write code that I would want to read. I hope the people I work with do the same. That’s why I hope they spend some of their own time playing with code.

I tried a bunch of different build-system and transpiler approaches but I found them all unsatisfying. Even with automatic transpilation on save, even with source maps, I felt that I was missing too much of the edit/reload cycle that makes web JS programming such a pleasure. Even with low latency I couldn’t take advantage of things like being able to edit my source code inside the Chrome developer tools debugger.

Luckily stable Chrome supports a lot of ES6. Just restricting myself to that quite large subset gives me a great set of features to work with, without losing the development flow I like. Every six weeks I get more features to play with as a new Chrome release launches. When I want to deploy to older browsers I can transpile (Closure Compiler is great) and polyfill, but it’s part of the release / deployment flow rather than obstructing development.

So what am I using? Mostly:

• Classes
• Arrow functions
• let and const
• New collection types — Map, Set, etc

It’s pretty nice.

Originally published at Ian McKellar.