slowenough

Some heresies:

- React is bad and bloated.

- Startup industry is exploiting idealistic young people, as slaves of VC/venture partner "bet placers" with the promises of often unrealizable rewards, by promoting startup mythology, as lab rats most of whom will end up failed experiments.

- China is not bad and should be supported, and the West can learn much from it, if the West could set aside its insecurity and pomp and see clearly.

FYI this is based on my remote browser and it's just that with an audio component so you just have to navigate to any pages with audio and if you're on your mobile device you can do it and then lock the screen and keep listening to it.

I made this because listening to audio from YouTube on mobile is not always possible if you lock the screen. I want to be able to lock my phone and just kind of have it in my pocket.

Thanks for offering to send a screenshot of what you see!

Sorry I don't have a random email, but here you go: cris@dosyago.com

Hey, this is actually atop FreeBSD so it is not as simple as just making a Dockerfile.

It should be too much tho, perhaps just making an install_deps.sh script alternative to use apt, and writing a Dockerfile.

You're welcome to submit a PR but I might get to it first.

Edit: I just made some changes relating to this, including a Dockerfile. I have not tested in Docker, but it now works on Nix (Debian)

Hey, yeah I think it doesn't support fully on the input end, but it does support on the output (if you change the $format variable in the convert script).

Input looks a bit weird, for example,

https://secureview.cloudbrowser.xyz/uploads/file1tda.4paa65d...

Which is from:

https://dev.w3.org/SVG/tools/svgweb/samples/svg-files/AJ_Dig...

Thanks, this is actually on FreeBSD, so it's not so easy to make it for Docker, but the repo now has a Dockerfile for nix systems. I haven't tested it tho.

This has been updated to now run on Docker.

For original discussion, see https://news.ycombinator.com/item?id=21561613

The round function is just 4 SLOC:

    function q( state, val, numerator, denominator ) {
      // Continued Fraction mixed with Egyptian fraction "Continued Egyptian Fraction"
      // with denominator = val + pos / state[1]
      state[0] += numerator / denominator;
      state[0] = 1.0 / state[0];

      // Standard Continued Fraction with a_i = val, b_i = (a_i-1) + i + 1
      state[1] += val;
      state[1] = numerator / state[1];
    }

On GitHub: https://github.com/crislin2046/dosyrng

And an even simpler version (built with just base64 and xor): https://github.com/crislin2046/tarobox which I

haven't tested with SMHasher or PractRand.

The link about Go with quotes by Rob Pike lets me think that maybe Abc.xyz made Go like they did because they wanted to be able to have some sort of AI generate code eventually.

that's rich. The Hong Kong people had their freedom and autonomy. And what have they done with it? squandered it. They've been subjects of an empire. They are not equipped to rule themselves. They don't seek self-determination and autonomy and responsibility for creating their future they seek to blame the government or China or the police. and now they are seeking to destroy not to create. And yet they should possess greater freedom?

China doesn't want the protest to end. People who believe they are protesting China by supporting these terrorists and their activities in Hong Kong are only supporting the central government's plan.

The Hong Kong human rights and democracy act if enacted only supports the central government's position on Hong Kong. The unrest is an opportunity for Beijing. The media discourse suggests otherwise... only to the benefit of Beijing. Understand the true meaning of your position, so as not to look so foolish.

Or not, and keep supporting China ( I thank you ) but thinking you're not.

The world doesn't have to be unipolar.

Probably meditation, pranayama, basic stretching, basic posture, basic self awareness.

That's a clever idea about running screen readers server side, thanks!

Wow, this was really useful. Thanks for that! :)

The load balancing setup I used today has issues, which you can see if you're using it now (very slow).

Namely, load balancing and scaling based on CPU is not a good metric, because new instances (which are still serving multiple users), will keep absorbing new users before the metric is triggered, and even when it is triggered, a new instance will take a while to spin up and build some browsers, so scaling lags too far behind load and the effect is existing instances get and stay overloaded.

So, I have an idea for a new autoscaling system that puts 1 tiny machine per user, but it will take some reconfiguring. So, in the meantime, I'm switching back to the old system (massive instances, vertical scale).

I'll do that now and the servers should switch to the new system in about 30 mins.

Hey, thanks a lot for that!

It sounds like it might be work to stop the browser loading itself inception style.

I like it can load itself.

What's the biggest problem you've had with that ability?

Edit: Servers are back up

I moved from a single massive instance to a target pool behind a load balancer with health checks based on if there's available queue.

https://free.cloudbrowser.xyz

https://hk.cloudbrowser.xyz

I have not worked out how to geographically load balance both of those from a single domain based on which you are closest too, but I want to see if these new smaller instances in load balanced target group pools can scale to take the load like a larger instance.

Hey HN, thanks for all the love on this, and for helping me think about other use cases for and how to communicate about this product. I really appreciate this!

Also, I noticed I spent a lot of time maintaining the demo instances (resizing). In a real deployment the number of users per machine is pretty much static, but here I've had to deal with scaling and spikes.

It occurred to me today that I could probably put the free demos behind a load balancer (smaller basic machines, and scale them up or down), so that I don't have to manually resize the instance.

I've taken down the two demo sites (free & hk) for now, while I work on the load balancer setup. Should be back up in a couple hours.

You might need to reach out at cris@dosyago.com I think the G Suite email (dosycorp) is dropping mails.

This is very exciting, thanks for creating this! I've been hoping for a way to build native apps via web technologies without the bloat.

Please let this be it.

.NET is such a good runtime.

Yes, it listens for LayerTree.layerPainted events, and queues a screenshot on that. It also queues screenshots on other things, such as on "clicks", "scrolls" and a few other interactions.

After Screenshots are queued, they're throttled to a low framerate, and then each frame is compared with the last sent, before it is sent to the client, and dropped if there's no change.

I got rid of CAPTCHA by changing the search provider to DDG.

Thank you for your comments, I really appreciate it! :)

That's a great point, and something I have not considered.

It's a big oversight, I'm sorry about that. Let me think about it.

There must be a way to do this.

Thanks for saying that!

As for text selection, the best I have so far is

right click to open context menu

select "Copy text from here"

And you should get a box pop up with text you can select. :)

Thanks for the report, it's very valuable and thanks for pointing me to noVNC, it looks great!

I'm very serious about usability issues, would it be impossible for you to provide some examples of sites where the click failed and what you clicked on?

I try to get those things fixed ASAP because the experience of using is so important, I think it should be as familiar to a regular browser as possible.

That's very cool!

Thank you so much for sharing this.

I'm looking at your app and I love the long scroll feature. How did you do that? It's so cool how you can scroll down the page natively, and the image updates, that's really incredible.

And I'm reading the initial discussion, and it's ... in 2015! Wow, how did you do this back then! I think thing's are so much easier now with all the features in the protocol.

I am really interested in how you did this and I love the site. It's very cool and I prefer it to my own work in many ways. Would you be a terrible idea for you to contribute to BrowserGap?

About half way through development, I was travelling and buying 4G data sims and I also thought I needed to use it for that (easily use 50Mb just on a news site).

So I made a HTML only version (no images, just stripped back HTML, you can see the work in the various 'appminifier' subdirectories somewhere in the repo). It saved me data, but introduced lots of quirks. At some point I realized it was too difficult, and I was committed to another idea with it, rather than this low bandwidth, so I stopped working on that feature.

Also, I love the Open in new tab? feature you have. This really rocks. It made me so happy to see this work! Thank you so much for sharing with me. :)

I wanted to get a scrolling feature like you have and I couldn't think of a way to make it work. If yow could do that in BG I'd love it!

I'm sorry about that! That's sounds like a really terrible experience you had trying this out today. It must feel really uncomfortable to not be in control of what's happening on screen.

Edit: the HK site is back up. https://hk.cloudbrowser.xyz

There's a couple of factors that could be playing into this. Primarily it's likely just the application itself. It is more slow, and less responsive than using a regular browser on your device.

The frame-rate is capped very low, the image quality is lower, and there's more lag to each interaction since it involves (at the very least) a WebSocket round trip and a screenshot.

Secondly, you could be affected by geography, which has a very significant effect. If you are close to the primary server (US East, Virginia) you'll have a faster more responsive experience.

In a few minutes I'll have the HK server (Asia Pacific) back up ( I was just resizing it down, it was seeing significantly less use than the US server), and if you're closer to that you can try there.

Also, the free demo has many caps (so as to control costs). I cap the outgoing bandwidth of each user to a very low 3Mbit/s, and I use multiple ways to cap CPU usage, including (in extreme cases) killing the process. All of this means that if the page you are using wants to eat a lot of CPU (happens sometimes) then the app will slow right down for you (to preserve resources for everyone else on the system).

I can say confidently that it is not about the number of users. We had More 100s at peak before and a single browser still felt snappy. So if you're getting slow down I think it is (to summarise), either:

- You are experiencing the app for the first time, it is different to using a normal browser, interactions are slower and more choppy (but page loads should be as fast or faster).

- The page you are browsing is hitting the resource monitoring and being downregulated.

- You are link-wise far from the server (which is often, but not always, related to geography).

If you're interested to give it another try I'm at another time I'm happy to arrange that. Would you be unwilling to leave your email at this form, and I can let you know a quieter time? Also, if you just email me at cris@dosycorp.com and let me know your approximate location, I can set up a server near you and we can attempt to work out any leg issues still occurring.

Thank you for the great question.

Thinking back to when I started this I initially just wanted to keep everything simple and so I avoided putting in a large and high-level lib like pptr, and went with chrome-remote-interface.

I looked at pptr and IIRC at that time (~ 12 months ago) there was not a clear way for me to handle multiple tabs (a key "real UI" use case). The same goes for Cyrus' lib too.

With Cryus' lower level lib I could hack around that, by doing my own target and session management, but at some point in the last couple months I hit a wall with chrome-remote-interface. Cyrus' lib was not up to date with the latest ToT API (specifically flat session mode) and I worked out I could replace the entirety of chrome-remote-interface with some simple code that sent messages down a WebSocket, saved a Promise (by message id) and returned it, and resolved that promise when it received back a message tagged by corresponding id. It was also simple to write an 'on' function to add listeners for various events. So that was that.

Basically, the DevTools protocol is a well specced, well tested, simple protocol and all these libs (like pptr and chrome-remote-interface) began simply as wrappers around the WebSocket, with an API to map function calls to protocol messages and add listeners for events. PPTR has evolved into much more than that now, and during the same time period, I evolved my own "BG protocol" atop the CDTP (Chrome DevTools Protocol). It became easier to deal with the single source of truth that CDTP is, and get the full expressibility of the latest ToT protocol than deal with the limitations and abstractions of other things built atop that.

Specifically, PPTR did not (and I believe probably still does not, tho I have not deeply checked) an easy way to control and manage multiple tabs. And even if it does, I'd have no use for it, because I already have the code that does all that anyway. Scanning PPTR docs now I see that I prefer the abstractions, naming, etc of the CDTP protocol itself, rather than the ones PPTR provides. Like I said, the CDTP protocol is very comprehensive, consistent and makes a lot of sense, and I know it very well. For me and my use case, it's just a better fit.

The way I think about this is not that "PPTR" has some problem, it's that the "BG protocol" and PPTR (et al) are trying to solve (basically) fundamentally different problems. PPTR (et al) try to provide a clean developer experience for common tasks related to browser use cases (such as automation, getting screenshots, PDFs, testing, etc). That's a particular domain, and not exactly the same as what BG protocol does. BG protocol attempts to provide as realistic and familiar as possible experience of using a browser (when you're actually controlling a remote browser through the CDTP). That's not entirely the same domain, because some things that users want, are not required in automation, and some things that automation does are not required or done by users.

One of the ways I code is by picking the right tool for the job, and if that tool doesn't exist, or no longer works, I build the tool. I want to work with tools that fit right. So for this domain and use case BG protocol is a better fit than PPTR.

Perfect prevention of breaches isn't possible, you must assume compromise. Therefore part of your strategy must be the isolation and containment of an attacker's ability to do damage.

For concerns regarding what you say, it's true. The worst case is a browser zero day that escapes the browser, enables privilege escalation, and goes on to compromise the entire client instance and lurks in the server catching everything. That's definitely a possibility on the free demo.

However, for real deployments there are several layers of mitigation. On the most drastic end, we run each browser and server pair inside its own docker container. In that case, the exploit must, first escape the browser -> escape the Docker container -> gain code execution -> gain privilege escalation -> compromise whole instance.

I would never say it's "impossible" but I would say that we have brought effective defenses against that.

Another layer of mitigation is that each browser is totally scrubbed each time it is used. This is a tradeoff as we lose all session cookies and cache data, but we can do this, if required. You can even scrub it yourself while using it (right click/top hold to get the context menu, and select "Wipe everything".

A further layer of mitigation is we completely reprovision / scrub the entire server every hour / day / week.

I think you are getting the idea.

By separating the client's devices and network from DMZ where "web work" occurs, and containing the attacks within this "air gapped" satellite, we greatly limit the attacker's scope to cause harm, plus we greatly increase our ability to deliver mitigation at any scale and schedule we choose.

Another advantage of this is, you don't need to download anything, RDP/VNC requires some extra app or setup, this is just connect to a web site and you're good to go.

You can self host to manage trust. Organizations typically want to partner with a provider even if they do self-host or go hybrid, because they don't want to manage everything themselves.