- readsa Hacker News discussion tree
- becomessubtree size → mass; reply tempo → hue
- writes
--w--cat - you seebig subthreads loom in the type; fast exchanges run warm, slow ones cool
No canvas is drawn here — the field is invisible; these variables are its only output. Without it you would build: comment scores plus a collapse heuristic.
field-ui · invisible fields · threads
Arguments have structure.
A comment thread is a binding structure: every reply binds to the comment it answers, and busy subtrees heat up while dead ends go quiet. Most thread UIs flatten that into uniform rows, so you reconstruct the argument by reading all of it. These are the first 160 comments of a real Hacker News discussion — the CrowdStrike boot-loop thread — run as a field.
Each comment is a body whose mass is the subtree it spawned — a comment that started an argument is heavy; a reply nobody answered sits at the floor. Reply tempo shows as heat: warm comments landed minutes after their parent, cool ones took hours. Hover or focus any comment and its full ancestor chain plus its direct replies light up — the discussion's real shape, readable before you read a word. Collapse any subtree with its caret — the hidden comments leave the field, not just the page — and expand it back when you want the argument. The field is invisible: no particle swarm, only type weight, ink, and anchor.
size = subtree — the replies a comment spawned · color = tempo — warm replies landed within minutes of their parent, cool ones took hours
- Aa size = replies spawned — most comments spawn none and sit at the floor; that is the real shape of a discussion
- color = the heat lens (reply tempo)
- hover or focus → the full ancestor chain + direct replies light
- indent = depth, capped at 6 — deeper replies hold the cap
- the caret collapses a comment's whole subtree — a "+N replies hidden" chip holds its place, and the field re-runs over what's still visible
- the ink is live — --w is the subtree's weight and --cat the tempo lens; --d is the engine's local density (hold a comment and the field gathers — its binding chain charges with it) and --field-attention the recipe's eased attention as you scroll.
-
Yep happened to us too. Its global. And it just started happening.
-
Same in Adelaide. Reports coming in from Gov agencies, utilities etc.
-
It's crowdstrike: https://www.reddit.com/r/crowdstrike/comments/1e6vmkf/bsod_e... > 7/18/24 10:20PT - Hello everyone - We have widespread reports of BSODs on windows hosts, occurring on multiple sensor versions. Investigating cause. TA will be published shortly. Pinned thread. > SCOPE: EU-1, US-1, US-2
-
Can you post a summary? We're affected but I don't have access to that portal.
-
Someone posted this in the thread, but I also can't log in to verify > Summary > CrowdStrike is aware of reports of crashes on Windows hosts related to the Falcon Sensor. > Details > Symptoms include hosts experiencing a bugcheck\blue screen error related to the Falcon Sensor. > Current Action > Our Engineering teams are actively worki
-
They've bumped this support info to a blog post that's linked from their home page: https://www.crowdstrike.com/blog/statement-on-falcon-content... It includes PDFs of some relevant support pages that someone printed with their browser 5 hours ago. That's probably the right thing to do in such a situation to get this kind o
-
"Start your free trial now." Hahahahah you have got to ne kidding me :)
-
Right after you enter the bit locker recovery key. You do have your bit locker recovery key, right? .....right?
-
I doubt most of the clients who use CS know what BitLocker is, let alone how to back it up, assuming it wasn’t backed up automatically by Windows.
-
Doesn't that get backed up automatically to the Microsoft account?
-
That's opt-in. In Enterprise setups the key should be backed somewhere in Active Directory.
-
Yes you should be able to pull it from your domain controllers. Unless they're also down, which they're likely to be seeing as Tier 0 assets are most likely to have crowdstrike on them. So you're now in a catch 22.
-
Log into hypervisor, rollback VM
-
Microsoft shops gonna be running Hyper-V. Probably also got hosed.
-
Rolling back an Active Directory server is a spectacularly bad idea. Better make doubly sure it's not connected to any network before you even attempt to do so.
-
In theory. I've seen it not happen twice. (The worst part is that you can hit the Bitlocker recovery somewhat randomly because of an irrelevant piece of hardware failing, and now you have to rebuild the OS because the recovery key is MIA.)
-
I know it does for personal accounts once linked to your machine. Years ago, I used the enterprise version and it didn’t, probably because it was “assumed” that it should be done with group policies, but that was in 2017.
-
Most people installed CrowdStrike because an audit said they needed it. I find it exceedingly unlikely that the same audit did not say they have to enable Bitlocker and backup its keys.
-
I can confirm this. EDR checkbox for CrowdStrike, BitLocker enabled for local disk encryption checkbox. BitLocker backups to Entra because we know reality happens, no checkbox for that.
-
This was particularly interesting (from the reddit thread posted above): > A colleague is dealing with a particularly nasty case. The server storing the BitLocker recovery keys (for thousands of users) is itself BitLocker protected and running CrowdStrike (he says mandates state that all servers must have "encryption at rest"). > His team bel
-
I find that hilarious
-
Me too, as I am also not affected. But I do pity those guys who now try to solve that deadlock.
-
> but they can't access any of the documentation to do so, because everything is down. One of my biggest frustrations with learning networking was not being able to access the internet. Nowadays you probably have a phone with a browser, but back in the day if you were sitting in a data room and you'd configured stuff wrong, you had a problem.
-
Nobody, not one person, thought that documentation should be stored in hard copy?
-
I'm guessing someone somewhere said that "it must be stored in hard copy in a safe" and the answer was in the range of "we don't have a safe, we'll be fine". Or worse, if it's like where I worked in the past, they're still in the buying process for a safe (started 13 months ago) and the analysts are building up a
-
Not just financial / process barriers. I worked for a company in the early 90's that needed a large secure safe to store classified documents and removable hard drives. A significant part of the delay in getting it was figuring out how to get it into the upstairs office where it would be located. The solution involved removing a window and hiring a
-
Any chance you have a link to that comment?
-
Didn't bookmark it or anything and going back to the original reddit thread I now see that there are close to 9,000 comments, so unfortunately the answer is no...
-
Here you go. < https://www.reddit.com/r/crowdstrike/comments/1e6vmkf/commen... >
-
Just hope there is no mutual recursion, i.e. recovery key A is stored on machine B, recovery key B is stored on machine A!
-
Isn’t that what office safes are for? I don’t know the location, but all the old guard at my company knew that room xyz at Company Office A held a safe with printed out recovery keys and the root account credentials. No idea where the key to the safe is or if it’s a keypad lock instead. Almost had to use it one time.
-
BitLocker for Business stores the bitlocker key centrally. Still, it is a huge manual undertaking fixing every system.
-
Absolutely correct. Unfortunately, there is no other solution to this issue. If the laptops were powered down overnight, there might be a stroke of luck. However, this will be one of the most challenging recoveries in IT history, making it a highly unpleasant experience.
-
Yeah in context we have about 1000 remote workers down. We have to call them and talk through each machine because we can't fix them remotely because they are stuck boot looping. A large proportion of these users are non-technical.
-
How fortunate the phone system is not vulnerable to CrowdStrike...
-
Man, talk about a mass-phishing opportunity.
-
I heard the central system was on Azure, running CrowdStrike.
-
MS Windows Recovery screen (or the OS installer disk) might ask you for the recovery key only, but you can unlock the drive manually with the password as well! I had to do that a week ago after a disk clone gone wrong, so in case someone steps on the same issue (this here is tested with Win 10, but it should be just the same for W11 and Server): 1. Boot the
-
On my corporate Windows 11 22H2 "manage-bde -unlock C: -Password" does not unlock the disk with the user key. I guess it needs recovery key as well.
-
Don’t you need more options if the key is in a TPM, or there is a password but it’s only part of the key? Can you even get the secret from the TPM in recovery mode?
-
> Can you even get the secret from the TPM in recovery mode? Given that you can (relatively trivially) sniff the TPM communication to obtain the key [1], yes it should be possible. Can't verify it though as I've long ago switched to Mac for my primary driver and the old cheesegrater Mac I use as a gaming rig doesn't have a hardware TPM chip
-
TPMs embedded in the processor (fTPM) are pretty popular and it's a lot harder to sniff communications that stay inside the cpu.
-
yea I don't need an attack on a weak system, I mean the authorized legal normal way of unlocking BL from Windows when you have the right credentials. Windows might not be able to unlock BitLocker with just your password. I don't know how common it is to disable TPM-stored keys in companies, but on personal licenses, you need group policy to even al
-
help for if you have bitlocker turned on (because of course you do). https://x.com/attilabubby/status/1814216589559861673 https://x.com/nathanmcnulty/status/1785094215749476722?s=46 GPO to fix: https://gist.github.com/whichbuffer/7830c73711589dcf9e7a5217...
-
Saved to my desktop? How does that help? /s
-
Happy weekend to everyone who works there.
-
They had me at "crowdstrike engineering" So engineer-like.
-
Our company is in panic mode. 15 machines blue screened for no apparent reason and stuck in boot loop. I’m a gloating Linux user :) Also in Australia
-
I think there are companies with 10000+ or probably more
-
Year of the Linux desktop at last!
-
According to Reddit It's hitting Croatia, Philippines, US, Germany, Mexico, India, Japan. SAP servers dropping like flies, that's Defence,Banks, Payroll all affected. Major Retail Chains like Big W down.
-
We have outages across whole APAC and most EMEA. Despite being a very big client of CS, we do not have an official resolution yet, an hour into the incident.
-
SAP isn't linux?
-
Thundering herd? Idk
-
Starting to get media coverage: https://www.abc.net.au/news/2024-07-19/technology-shutdown-a...
-
Australian news reporting this has hit hospitals, fire and rescue, banking, media, airlines and many other companies worldwide.
-
yep spreading quickly now. https://www.geekersdigest.com/windows-blue-screen-crash-caus... https://www.timesnownews.com/technology-science/latest-crowd... This is gonna be a tough Friday for IT departments...
-
Newsreaders on the ABC are reading off paper notepads lmao
-
I was listening to Triple J (one of ABC's radio stations), they said: "welcome to our first and possibly last ever Triple J's USB Fridays, we can't play any of our usual music because the computers are all down, all we can play is the songs that happen to be on the USB stick that one of us had in our pocket". LOL!
-
The impact is Australia is immense. https://downdetector.com.au/ , it's almost every major org in the country. NSW Government is completely offline.
-
I assume you have to install "CrowdStrike" yourself (i.e. not bundled with Windows by default)? I have no idea what it is before.
-
Its paid antivirus software, they cater to businesses
-
Anyone found any fixes, while Crowdstrike comes up with a fix?
-
we will found a troubleshooting , we start in revovery mode and rename the path C:\windows\system32\drivers\Crowdstrike
-
Do this at your own risk!! Apparently there are two NON-OFFICIAL solutions: 1. Rename csagent.sys ( the file causing the BSOD ) 2. Rename c:\windows\System32\Drivers\Crowdstrike Again, do this at your own risk. Both workaround have been reported as "working". I am Linux user so I cannot tell.
-
Husband is a deputy in California. His department and many others here are down as well (including PDs, jails, ambulance companies, etc.)
-
This seems like a pretty severe point of failure.
-
We have ~50 thousand laptops in reboot loop and ~1.5k servers as well. No resolution yet.
-
Faced the same issue few minutes back after few loops of reboot my system is up
-
We had a few machines come out of the boot loop - only to re-enter it 20 mins later. I am sure CS pulled the patch from their CDNs but ...maybe some cached versions still linger?
-
A system restore helps. But obviously not when you’ve got an environment of ~500 or more clients
-
Quick fix that worked for us, In safe mode: 1.enter in drive C: 2.system 32 folder 3. Drivers 4. Rename crowdstrike folder to something else doesent matter what.
-
Could you potentially do the same by just attaching the HDD to another computer as a secondary drive and renaming the folder if safe mode falls through?
-
Not likely, not unless the disk is also not BitLockered.
-
Was just using the energy vic website and thought I'd been rate limited when their API stopped working. Seems like it could be this.
-
In terms of analysing risk factors to minimise something like this happening again, what are the factors at play here? A Crowdstrike update being able to blue-screen Windows Desktops and Servers. Whilst Crowdstrike are going to cop a potentially existential-threatening amount of blame, an application shouldn't be able to do this kind of damage to an ope
-
> an application shouldn't be able to do this kind of damage to an operating system Antivirus software by its nature probably needs the kind of access that would let it bluescreen your computer.
-
Wading out my depth here, so forgive any stupidity following. And there's a certain amount of sense to that, it has to get "under" the layer that viruses can typically get to, but I still think there should be another layer at which the OS is protected from misbehaving anti-virus software (which has been known to happen).
-
It's a kernel mode driver. There aren't layers in kernel drivers. Any kernel module/driver can crash your system if it wants to.
-
You're taking about how things are, the comment you're replying to is talking about how things could be. There's not a contradiction there. Originally, x86 processors had 4 levels of hardware protection, from ring 0 up to ring 3 (if I remember right). The idea was indeed that non-OS drivers could operate at the intermediate levels. But no one
-
It runs at Ring 0, there's no lower ring (besides maybe IME and the like).
-
The problem I have with this is that anti-virus software has never felt like the most reliable, well-written, trustworthy software that's deserving of it's place in Ring 0. I understand I'm yelling into the storm here, because anti-virus also requires that level of system access due to the nature of what it's trying to detect. But then ag
-
Technically, there are rings -1 through -3; hypervisor/-1 actually seems widely used and maybe could be used here. https://en.wikipedia.org/wiki/Protection_ring#Miscellaneous
-
Need something like a hypervisor OS/hardware that isnt IME.
-
Modern Windows installs already run under a hypervisor. It's called Core Isolation or Virtualization Based Security.
-
That usually makes it a port of entry for attacks. Antivirus are really malwares waiting to be exploited.
-
[delayed]
-
This is not the case. There are many possible AV architectures, with or without kernel drivers and/or administrator level permissions.
-
> Whilst Crowdstrike are going to cop a potentially existential-threatening amount of blame, an application shouldn't be able to do this kind of damage to an operating system. It doesn't operate in user space, they install a kernel driver.
-
> "they install a kernel driver" And therein lies the problem!
-
Not like they have an option. Kernel drivers are required.
-
There's a grey area between "kernel drivers are required for crowdstrike" and "windows is not modular enough to expose necessary functionality to userspace". It could be solved differently given enough motivation.
-
An expanded explanation with the third option of: even with existing options, it was really badly implemented - https://social.treehouse.systems/@marcan/112812791936639598
-
Are they? Apple has pretty much banned kernel drivers (kexts) in macOS on Apple Silicon. When they were still used, they were a common cause of crashes and instability, not to mention potential gaping security holes. Most things that third-party kernel drivers used to do (device drivers, file systems, etc) are now done just as well, and much more safely, in
-
> Presumably, Crowdstrike runs on macOS without a kernel extension? That's correct: CrowdStrike now only installs an "Endpoint Security" system extension and a "Network" system extension on macOS, but no kernel extension anymore.
-
Whatever protection is implemented in user-land can be removed from user-land too. This is why most EDR vendors are now gradually relying on kernel based mechanisms rather than doing stuff like injecting their DLL in a process, hooking syscalls, etc...
-
This is wrong, there are many facilities that, once applied, cannot be modified (unless reboot)
-
Such as ?
-
Random example: https://man.openbsd.org/OpenBSD-7.3/msyscall This is a syscall used by userspace to tell the kernel which memory portion is allowed to do syscalls This syscall can only be used once : once the linker has done it, the kernel will refuse extra calls (so allowing more memory pages is not possible)
-
One would hope that Crowdstrike does a similar thing on Linux and relies on fanotify and/or ebpf instead of using a kernel module. The other upside to this would be not having to wait for Crowdstrike to be constantly updating their code for newer kernels.
-
I believe so but would like better details. We used to use another provider that depended on exact kernel versions whereas the falcon-sensor seems quite happy with kernel updates.
-
Wait, you still will be using CS? Why?
-
The original Windows NT had microkernel architecture, where a driver/server could not crash the OS. So no, Crowdstrike didn't have an option really, but Microsoft did. As PC got faster, Microsoft could have returned to the microkernel architecture, or at least focused on isolating drivers better.
-
Yep, this is technical legacy in action.
-
They've done it to a degree but only for graphics drivers, Windows is (AFAIK) unique amongst the major OSes in that it can nearly always recover from a GPU driver or hardware crash without having to reboot. It makes sense that they would focus on that since graphics drivers are by far the most complex ones on most systems and there are only 3 vendors to
-
NT was never a true microkernel. Most drivers are loaded into the kernel. Display drivers being a huge pain point, subsequently rolled back to user space in 2000, and printer drivers being the next pain point, but primarily with security -- hence moving to a Microsoft-supplied universal print driver, finally in Windows 11.
-
Required for crowdstrike to do what crowdstrike does. Which is mostly useless security theatre.
-
The people installing crowdstrike have an option: Don't install it.
-
Yep. We can't migrate our workstations to Ubuntu 24.04 because Crowdstrikes falcon kernel modules don't support the kernel version yet. Presumably they wanted to move to EBPF but I'm guessing that hasn't happened yet. Also: I can't find the source code of those kernel modules - they likely use GPL-only symbols, wouldn't that be
-
Probably only a violation if you distribute the linked result. Not if you only install it.
-
How would you install it without them distributing it?
-
Two different "it". As an analogy: selling pizza Hawaii is dicey, but you can sell pineapple slices and customers can add those to their pizza themselves.
-
They mean distributing Linux + the module together. Like e.g. shipping the Nvidia kernel module alone is fine, but shipping a Linux distro with that module preinstalled is not fine.
-
The generally accepted (but not well tested) legal position is that it's ok to have a proprietary kernel module that is dynamically loaded. You can, for instance, ask a running kernel if it is "tainted" by having loaded a non-GPL module.
-
GPL exported symbols are the ones that are thought to be so tightly coupled to the kernel implementation that if you are using them, you are writing a derivative work of the kernel.
-
Yeah that was also my understanding, and I can't imagine a av module able to intercept filesystem and syscalls to be only using non-core symbols. But of course you never know without decompiling the module
-
> and I can't imagine a av module able to intercept filesystem and syscalls to be only using non-core symbols. I can, considering that you can do that from user space using strace. Or ebpf which is probably the actual right way to do this kind of thing.
-
Last time I dealt with HP, I had to use their fakeraid proprietary kernel module which "tainted" the kernel. Of course they never open-sourced it. I guess it's not necessary.
-
Why would you use Crowdstrike on Ubuntu? Is because of a real security concern, or abiding to regulations (thou shalt have an antivirus) or else?
-
Ask my IT dep. AFAIK it's audit related, safety-critical software
-
I think "compliance" would be a better word to use that "safety" when it comes to a lot of "security" software on computers. And I bring up the distinction because while compliance is "sometimes" about safety, it's also very often about KPIs of particular individuals or due to imaginary liability for having not re
-
Just to be safe, of course! In my org they try to rollout sentinel one on every ‘endpoint’ regardless of operating system.
-
I was given to understand that Crowdstrike provided some protection from unvetted export of data. I'm not sure that data would be useful without the rare domain expertise to use it, but I wasn't shown the risk analysis. And then someone else demands and gets ssh access to GitHub. Sigh.
-
> We can't migrate our workstations to Ubuntu 24.04 because Crowdstrikes Should you upgrade before 24.04.1 is released? It's scheduled for August 15.
-
IIRC, about a 12-18 months ago CrowdStrike was recruiting for a development with eBPF skills.
-
So what? Crowdstrike is a kernel AV. How else would you solve this?
-
It's a design decision. People want the antivirus to protect them even if an attacker exploits a local privilege escalation vulnerability or if an attacker that compromised an admin account (which happens all the time in Windows environments) wants to load malicious software. That's kind of the point of these things. Somebody exploits a memory vuln
-
Presumably Crowdstrikes driver also has the ELAM flag which guarantees it will be loaded before any other third party drivers, so even if a malicious driver is already installed they have the opportunity to preempt it at boot. https://learn.microsoft.com/en-us/windows-hardware/drivers/i...
-
> guarantees it will be loaded before any other third party drivers Point of information. "Guarantee" and "any" are unsubstantiated by that MS article.
-
If we are being pedantic then an ELAM driver can't be guaranteed to load before another ELAM driver of course, but only a small list of vetted vendors are able to sign ELAM drivers so it is very unlikely that malware would be able to gain that privilege. That's the whole point.
-
Not pedantic. Just accurate. > an ELAM driver can't be guaranteed to load before another ELAM driver of course, Thanks for the correction.
-
At the end of the day, if you give an application a deep set of permissions, that's on you as an administrator, not the OS. This unchecked global rollout appears to just be a violation of every good software engineering practice we know.
-
> This unchecked global rollout appears to just be a violation of every good software engineering practice we know. Yeah, this is what surprises me. Corporate infrastructure policy seems to have been matched to smart phone default settings.
-
I have worked in Finance for 25 years, and the amount of pressure I had to stand from Auditing on "Why do we have a 20-day-window on applying most updates as we get them from suppliers? We are not best practice!" is gruelling. These people report to the Board Chairman, don't understand any real implication of their work, and believe the world
-
So the silver lining from this incident would be that you can simply point to it, and tell those auditors to fuck off.
-
I'm pretty sure Apple does gradual rollouts of upgrades, so default smartphone settings are better than that.
-
It's actually worse than phone updates. Ever looked at your phone and noticed it hasn't updated to the new OS despite it having been out for a few days already? This is why.
-
Administrators are to blame because management (and a lot of 'cybersecurity policies') demand there's a virus scanner on the machines? While virus scanners might pick up some threats not addressed by OS updates yet every one of them I've seen is a rootkit in disguise wanting full system privileges. There are numerous incidents with securi
-
Not so much in disguise. CS has official RCE root/admin access on all the clients. Which skips any normal auth of the OS. Yes, on all windows, mac and linux.
-
I often watch Crowdstrike thrash my laptop's resources, making it slow to do compiles. Cybersecurity won't let me disable it either, so I just set it to lower priority process.
-
You might have more luck asking Cybersecurity to add a path like ~/code which contains your source code to the exclusion list.
-
As someone who worked for a company, who's a Crowdstrike partner, I assure you that Crowdstrike does not sell to administrators. It is very much a product sold to management and company auditors. Where you're correct is that it's on the administrators to rollout the updates, but I'm not sure that's how Crowdstrike works. It's a
-
This should clue you in. CS is not sold to SA or technical types. It's sold to management as a risk reduction. The whole point is that if you are technical, you are so untrusted that management is willing to require circumvention of known good practices and force installation of this software against technical advice.
-
I feel the need to make a mustang car crowdsrike meme
-
Could you elaborate?
-
Mustangs are famous for their high power and poor handling - there are lots of videos showing drivers doing burnouts, losing control, and striking the crowd they are showing off to.
-
Mustangs have a reputation as being 'crowd (or streetlight) seeking' missiles. This is due to their price making them relatively more available to the enthusiasts than say Hellcats, enthusiasts who may not be experienced enough to deal with having that much power available to them in a RWD car. This confluence of power, confidence and lack of skill
-
I think it was a Dodge charger. That pro-trump KKK guy in the gray car who drove through the crowd while the crowd was I think it was a George Floyd protest? Also heard today crowd stroke.
-
There's a better joke, Crowdstrike sponsors the Mercedes Formula 1 team and in 1955 Mercedes was involved in the worst motorsport accident ever, killing over 80 people watching from the stands when parts of the cars flew off and... striked the crowd...
-
maybe they installed crowdstrike because they wanted updated without testing. and crowdstrike failed at testing them in their environment. sounds like they didnt test all cases and stumbled on a windows bug
-
My experience working with Crowdstrike was that they were super arrogant about these risks. I was working on a ~50k enterprise rollout, and our CS guy was very belligerent about how long we were taking to do it, how much testing we wanted to do, the way that we were staggering roll outs and managing rollback plans. He didn’t think any of this was necessary,
-
> constantly yapped about how many bigger enterprises than ours completed their rollouts in just a couple of weeks. Evidence is pointing towards him actually being right about this, despite likely being wrong about everything else. It'd be worth giving him a call, just to check in how he's going, and take him up on the offer to fire you as a cli
-
I was just a contractor there, and don’t work with them at the moment. But I’m a customer of theirs and they’re definitely having an outage right now, so I’m guessing it’s all still in place.
-
Mind rephrasing? I don't understand what you're saying.
-
I don’t work there any more. But they were having an outage, so I’m guessing they never got fired as a client (guessing that they’re still using Crowdstrike) and could still take that offer (of being fired as a client) if they wanted to.
-
What evidence are you referring to? Was there a company that was breached for taking a few days or weeks to update crowdstrike?
-
Ouch, considering the devil works under Oracles lawyers, thats bad!
-
>I hope this sort of thing humbles them a little. Hopefully not. It would be better that this company is sued into oblivion by all the customers that were affected by this huge outage.
-
Maybe humbles all the other surviving companies? We can only dream
-
sounds like a very inexperienced person. If their mission is to protect businesses they should understand your concerns. Speed is useless without control.
How it's built
Every comment is ordinary semantic HTML — an <li> carrying its id, its
parent's id, and its tempo as data attributes. Mass is the log-normalized count of replies
it spawned; CSS turns that one number into type heft, ink, and anchor. The binding chain is
a parent-id walk — no SVG, no canvas, no per-element listeners beyond hover and focus. Two
live channels sit on top, engine-written every frame: --d (local density,
gathered by data-hot on hover — the hovered comment's density also charges its
chain's connector ink) and --field-attention (the recipe's eased attention).
They touch only ink; the tree's mass is fixed history. Collapse is the same walk run the
other way: a caret hides a comment's whole subtree (every descendant whose parent chain
crosses it), and the scoped field is destroyed and re-applied over the bodies still
visible — collapsed comments stop participating instead of lingering as zero-size ghosts.
1 — mark each comment as a field body
<!-- each comment is a body. data-feedback: the engine writes
--d (live local density) back every frame. data-hot:
hover/focus a comment and the field gathers toward it.
data-top marks a top-level comment (the glow channel). -->
<li
data-body="attract"
data-strength="1.36"
data-feedback
data-hot
data-top
data-id="41002198" data-parent="41002195"
data-tempo="0.91"
style="--w: 0.60; --cat: hsl(31 74% 64%); --depth: 0;"
>
<!-- your ordinary HTML here -->
</li> data-body="attract"— registers as a field participantdata-strength— mass, from the subtree the comment spawneddata-parent— the binding: which comment this one answersdata-feedback— opt in to--field-*writebacks (--d)data-hot— hover/focus gathers the field toward this comment
2 — CSS reads weight, depth + the live channels
.th-c {
/* --depth = min(depth, 6) — the indent; --d is the
ENGINE's lane: live density, data-hot gathers it */
--live: var(--d, 0);
padding-left: calc(var(--depth) * var(--ind));
}
.th-row {
opacity: calc(0.58 + var(--w) * 0.42);
box-shadow: 0 0 calc(var(--live) * 14px) -6px
color-mix(in srgb,
var(--cat) calc(var(--live) * 50%), transparent);
background: color-mix(in srgb, var(--text)
calc(1.5% + var(--w) * 4% + var(--live) * 4%
+ var(--field-attention, 0) * 4%),
transparent);
}
/* top-level comments with big subtrees burn steadier */
.th-c[data-top] .th-row {
box-shadow: 0 0
calc(var(--w) * 8px + var(--live) * 14px) -6px
color-mix(in srgb, var(--cat)
calc(var(--w) * 30% + var(--live) * 50%),
transparent);
}
One log-normalized subtree count drives weight, ink, and anchor; the indentation
(--depth) supplies the tree geometry for free. --d belongs to
the engine — live local density, written back every frame.
3 — the chain and the collapse are the same walk
// hover or focus a comment:
row.classList.add("lit");
// walk the ancestor ids up to the story
let p = byId.get(row.dataset.parent);
while (p) {
p.classList.add("cited");
p = byId.get(p.dataset.parent);
}
// and light the direct replies
for (const kid of kids.get(row.dataset.id))
kid.classList.add("cited");
// the chain CHARGES: while a comment is lit, mirror its
// live --d (engine-written) onto the list as --chain —
// the connector ink reads it
list.style.setProperty("--chain",
row.style.getPropertyValue("--d") || "0");
// the scoped field runs invisible (renderless) and asks
// for the attention metric lane (--field-attention) —
// applyRecipe options, not a hand-spread recipe:
// { renderless: true, extraMetrics: ["attention"] } // collapse = hide the subtree, then RE-BIND
caret.addEventListener("click", () => {
row.toggleAttribute("data-collapsed");
// a comment hides iff ANY ancestor is collapsed
// (the same parent-id walk the chain uses)
for (const r of rows) {
let p = byId.get(r.dataset.parent), hide = false;
while (p && !(hide = p.hasAttribute("data-collapsed")))
p = byId.get(p.dataset.parent);
r.hidden = hide;
}
// and the field re-runs over the VISIBLE bodies —
// collapsed comments leave the field, not just
// the page (destroy + apply, like field on/off)
field?.destroy();
field = applyRecipe(list, base, {
bodies: rows.filter((r) => !r.hidden),
annotateBodies: false,
renderless: true,
extraMetrics: ["attention"],
});
});