Java Platform Module System: Public Review Reconsideration Ballot - <AUTHOR> https://jcp.org/en/jsr/results?id=6016 <comment><USER2> As a java dev, I'm not sure Jigsaw helps in any way. Tooling has pretty much solved the classpath management issue. What would've been awesome is if modules were version aware, and code was allowed to depend on different versions of the same module, but that's not the case.

Now the private access thing is really being pushed by the java maintainers. They want the luxury to refactor internals without breaking anyone, so they want to make it so everything non public is 100% inaccessible in all contexts to users. I don't know that I agree with this necessarily. Especially now, the problem is they already shot themselves in the foot by allowing reflection on them in the past, so changing it back would break a lot of code for a lot of people.

<comment><USER3> Jigsaw is not maven, nor gradle, the versioning problems should be solved by those tools. I'm getting sick of the multiple version dependency problem being brought up over and over again. That's one of the reason why OSGI is not widely adopted. You should watch some of the talks delivered by the jigsaw team.

<comment><USER4> > the versioning problems should be solved by those tools

I'm not a Java developer; could you explain a bit about how Maven/Gradle solve this problem? My understanding is that what people want is something like what Node gives you—the ability to have both libfoo-1.0 and libfoo-1.1 loaded into the same VM at the same time without clashing. Do the build tools use e.g. name-mangling to achieve this?

<comment><USER5> For Maven, there is a repackaging facility with name mangling that can do this, the Maven Shade Plugin. [https://maven.apache.org/plugins/maven-shade- plugin/](https://maven.apache.org/plugins/maven-shade-plugin/)

</comment></comment></comment></comment><comment><USER6> According to [https://www.heise.de/developer/meldung/Freie-Fahrt-fuer- Java...](https://www.heise.de/developer/meldung/Freie-Fahrt-fuer- Java-9-Public-Review-Ballot-im-zweiten-Anlauf-geschafft-3756449.html) the change that led to the approval was --permit-illegal-access being default, which prevents existing code from breaking.

<comment><USER7> In case someone (along with me) is curious what this option with suspicious name does, here's an explanation: [https://jaxenter.com/jdk-9-replace-permit- illegal-access-134...](https://jaxenter.com/jdk-9-replace-permit-illegal- access-134180.html)

But I, not being Java dev, still fail to understand what that "illegal reflective access" is.

<comment> frant-hartm Basically accessing private (or any other non public in scope where you don't have access) field or method.

Usually bad in application code, but quite a lot of libraries and frameworks do it.

<comment><USER8> Spring, Jackson, and other libraries that perform various "magical" feats around DI and serialization make __heavy __use of reflection to inspect private fields. Generally though they don 't require write access to those fields (Spring possibly being the exception), but do generally require at least read access. Would be nice if there was a system to flag certain classes or jars as OK to violate access restrictions while still preventing others.

<comment><USER9> It already exist something along that line.

If the classes that Spring, Jackson, etc want to access are in the classpath, it works by default in 9 (will not in 10, you will have to use the --add-opens on the command line). If the classes are enclosed inside a module, it's simpler, either you declare the package as open or the whole module as open. (when you declare a package open you also can specify the module for which it will be 'open', by example, open com.foo.mylib to org.jackson.core)

<comment><USER10> > If the classes that Spring, Jackson, etc want to access are in the > classpath, it works by default in 9 (will not in 10, you will have to use > the --add-opens on the command line).

AFAIK "classpath-mode" is not affected by Jigsaw. All of classpath is one big module so "anything goes". As long as all of your code is on the classpath or a custom class loader created from the classpath anything should continue to work with 9 and even in 10. Things only start to break if you:

\- reflect on JDK internals

\- you put your code or frameworks or libraries in the modulepath

</comment></comment></comment></comment></comment></comment><comment><USER11> All voted YES, only one abstained. Now remember suspictions: "Are IBM and RedHat just against Jigsaw because of commercial interests in JBoss Modules and OSGI?"...

<comment><USER12> I think that's obvious, but I caught a hint of an implication that "commercial interests" are bad.

Both companies contribute to the OSS community in a refreshing way: they grow the Java economy by healthy competition, rather than using it to shut out competitors.

<comment><USER13> Not "bad" per-se, but perhaps in the interest of progress not accepting a path forward could be considered a hindrance to open-source ideologies.

It's not quite a fair judgement, because as you say, Red Hat has done more as a collective for FOSS than many of us will do in our lifetimes. It's not very black and white.

</comment></comment></comment><comment><AUTHOR> This is a major step forward (recall that the May 8 vote was not approved). Though there is another vote (Final Approval Ballot), it appears that JDK 9 is on track for September 2017 release.

</comment><comment><USER14> Redhat abstained instead of saying No. Few weeks back they dumped their home grown Ceylon language on to Eclipse foundation. Seems like they are going to stick with Java even if unwillingly.

<comment><USER12> A few years ago, all the hip kids were making JVM languages that were "Better" and "More Productive". Ceylon was just a few Redhat employees attempt at chasing market trends.

<comment><USER15> And now we have Kotlin, which is in fact better.

<comment><USER16> Kotlin was designed from the ground up to work seamlessly with IDE IntelliJ (and hence Android Studio), whereas Ceylon joining the Eclipse Foundation was just an afterthought and its Eclipse IDE integration isn't guaranteed to be great.

</comment></comment></comment></comment><comment><USER17> Anyone know the details of:

" _The specification of the module system's resolution algorithm, in the java.lang.module package, was rewritten in order to clarify the definition of readability and the means by which dependences are resolved at compile time._ "

</comment><comment><USER18> What happened to the concerns of Jigsaw breaking Maven builds?

<comment><USER19> Here you can see the changes that were done.

[http://cr.openjdk.java.net/~mr/jigsaw/spec/#History](http://cr.openjdk.java.net/~mr/jigsaw/spec/#History)

</comment></comment><comment><USER20> I wonder what Java developers' opinion on this?

<comment><USER21> JVM developer her (Java and more recently Kotlin). In an era where microservices are becoming increasingly popular I think this change is unnecessary. This was needed back when Java 6/7 was king and people were still investing heavily in monolithic architectures.

I am really not convinced this does anything besides make Java development more painful for those of us who are building small self-contained services with limited scope and library dependencies.

On the positive side this looks like a road forward for minimizing the size of a JRE in a world with AOT compilation. It would be really nice to be able to ship self-contained, executable binaries for native targets with the entire runtime embedded in the executable. I've only been loosely following but it looks like the jlink and jaotc tools shipping with JDK9 may make that possible.

<comment><USER22> > I think this change is unnecessary.

Just the opposite, faster startup time and lower memory footprint for the JVM via modules would be great. Both via process start, storage read, container image transfer. It'd also be a boon to JVM based dynamic languages by extension.

Albeit if you're layering images the cost could balance out over time in deployment. The runtime density would be increased overall with modules though.

> It would be really nice to be able to ship self-contained, executable > binaries for native targets with the entire runtime embedded in the > executable.

This is where go wins over JVM hosted languages, it'd be nice to bring JVM into new domains.

<comment><USER10> > Just the opposite, faster startup time and lower memory footprint for the > JVM via modules would be great.

Why would modules lead to faster startup time and lower memory footprint? Java class loading has always been lazy, if you do not need a class it will not be loaded. If anything modules should increase startup time because additional runtime checks needs to be performed and increase memory footprint since additional metadata needs to be referenced. Modules do not affect memory layout of Java objects.

</comment></comment></comment></comment><comment> aurora- Is there an overview somewhere of the key changes between the original (rejected) proposal and this (approved) one?</comment>


Ask YC: How do non-developers with a startup plan to find a developer to help put it on the web? - <AUTHOR>

Here's the situation: I have two good friends with an awesome real estate-based startup idea. The problem is that I'm the only developer they know and can't go in on it with them for other reasons not important here.
I've been helping them try to find their third partner, and it has been a real learning experience in how hard it is to find a stranger willing to take the plunge and try out a startup.
We've tried our Facebook contacts, I've floated the idea around my office, we've even put paid job listings up on job boards -- a few months later and no real success.
Can startups only be formed among existing acquaintances? How do you go about the founder-search? Do you think that you have to just go full-ahead with the plan without a developer, and trust that you'll find one before you it's too late? <comment><USER2> Have they tried meet-ups? if in SF go to SF New Tech <http://newtech.meetup.com/15/> which offers a 60 sec open mic for people looking for talent.

Also, consider hooking up with another start-up w/programmers; <http://www.us4real.com/> allows consumers to research a metropolitan area before deciding to move.

<comment><AUTHOR> We've been to a few Ruby group meetings, hoping that community might overlap a bit with the startup minded, but haven't checked into Meetup yet -- thanks for the idea.

We're split between Boston & Washington, DC actually, but looking to base the startup out of NYC.

<comment><USER2> I wish you the best of luck with the venture. ;-D

</comment></comment></comment><comment><USER3> If you want to find someone in your area that reads y combinator, you should check <http://www.hackrtrackr.com></comment>


Facebook reactivated my account and posted my SMS rejection against my will - <AUTHOR> Please take a look at these images and explain why Facebook reactivated my account and posted my "No" rejection to my feed contemporaneously? I deactivated my account for a reason! https://imgur.com/a/UTecw <comment><USER2> Facebook has a nearly unused feature where if you send it a text message, it posts it for you. When mobile phones that didn't have a web browser/facebook app were more common, this was how you did mobile status updates.

[https://www.facebook.com/help/125384024209252?helpref=faq_co...](https://www.facebook.com/help/125384024209252?helpref=faq_content)

</comment><comment><USER3> It's kind of funny. I wonder what you thought would happen by responding "No" to an automated message.

<comment><USER4> Nothing usually happens.

</comment></comment><comment><USER5> I think you all are missing the point. How many accounts are reactivated in the way tzakrajs described, without the users true intention to reactivate? Those numbers are handed to advertisers, analysts and shareholders as "active subscribers," a metric upon which the company and its advertising services are valued. Just food for thought. It was no accident.

</comment><comment><USER6> Image link for those on mobile: [https://imgur.com/a/UTecw](https://imgur.com/a/UTecw).

</comment><comment><USER7> I get random idiots trying to login to my facebook all the time. Maybe they think they have my email address (I doubt that) or maybe they're just trying to hack and see if your password is weak

Facebook authentication is pretty big so owning a FB account can be a bonana

<comment><USER8> Don't underestimate stupidity.

I was a early gmail person and got a good username. I've had the following happen:

\- An Attorney send me surveillance video of a accident involving a company bus.

\- Lots of spam associated with a guy who test drives cars every weekend.

\- Some factory manager sent a zip file with a vpn client, and a list of passwords.

I could go on.

<comment><USER9> I've gotten song demos, recording contracts, lease agreements, company financials, and more.

In only one case, do I know the "correct" email address and I notify the banks and realtors of his correct email address. (It helps that he is in South Africa, so the .za is usually a giveaway.) For the singer/songwriter, I've actually been asked for my opinion on a song demo. For the company financials, they actually ignored me and told me they had the correct email address until I told them I was not "Josh." (I had to look them up and find out who was on the Board.)

</comment></comment></comment><comment><USER10> Why didn't you delete your account and just deactivated ?

</comment><comment><USER11> F

</comment><comment><USER12> Facebook's like that. It does all sorts of shit you probably don't want it to.

Try contacting them and tell them to delete your account. I have no idea if this will work but it might be worth a try and in future don't link your phone number to internet accounts unless you want bullshit like that.</comment>


Six Flags on the Moon: What Is Their Current Condition? - <AUTHOR> http://www.hq.nasa.gov/alsj/ApolloFlags-Condition.html <comment><USER2> Is it possible to simulate conditions on Earth with similar flags to see how long they last?

</comment><comment><USER3> Great juxtaposition with the 'Roller Coaster' post.</comment>


Apple Defends iOS 6 Maps as Work in Progress - <AUTHOR> http://www.pcmag.com/article2/0,2817,2410010,00.asp <comment><USER2> This looks like a potential disaster.</comment>


Signing Bonuses: Indentured Servitude of the Engineering World - <AUTHOR> http://blog.james-carr.org/2016/06/16/signing-bonuses-indentured-servitude-of-the-engineering-world/ <comment><USER2> Is this common? I would never accept this. The 10k shackles guy could still pursue new employment with a 10k+ signing bonus (without strings this time) to pay off the first, or take his chances and leave to see what a judge will say.

Edit: relevant article with some good advice (pro-rated, pay off over time, negotiate) so I guess it's not uncommon, just a bad deal. [http://www.bryankuhnlaw.com/blog/2014/04/signing- bonuses.sht...](http://www.bryankuhnlaw.com/blog/2014/04/signing- bonuses.shtml)</comment>


Hitting the High Notes - <AUTHOR> http://www.joelonsoftware.com/articles/HighNotes.html

<comment><USER2> Admins: Please decorate title with year for posts dredged up from the archives.

This post is from 2005.

</comment><comment><USER3> I have enjoyed reading Joel on Software for years.</comment>


Three Years on Google App Engine - <AUTHOR> https://blog.stephanbehnke.com/3-years-on-google-app-engine-an-epic-review/ <comment><USER3> Bear in mind this article was written back in March 2017; quite a few things have changed/improved in GAE-land since. To name a few, off the top of my head:

\- Java 8 is already generally available on GAE standard and, on top of that, previous limitations wr/t class whitelisting, threading capabilities and others have been lifted

\- appcfg is pretty much outdated these days; all GAE management operations have been progressively integrated into gcloud app subcommand, which also fully supports newer GAE features like Flex, firewall rules, etc.

\- GAE standard instances are indeed limited in computing power, but it should be enough for most web-based applications. Again, GAE Flex fills in the gap here in case more muscle is needed, since it leverages GCE-class instances

\- Besides the already mentioned background work options (background threads, task queues, cron jobs), there's also Pub/Sub which can be used to inter- communicate GAE services or even other GCP services like GCE or GKE

<comment><USER4> Java 8 became available on GAE about 3 years after it was released. If Google continues that trend, Java 9 won't be available until 2020.

Slow adoption of new Java versions is a pretty big downside. Even if you are satisfied using Java 8 on GAE today, you may want to use Java 9 in the near future, and you won't be able to. By choosing GAE you are committing yourself to being stuck with Java 8 for a long time.

<comment><USER5> If you sign an NDA with Google, you'll get more up to date info about future features/roadmap etc. I think you'll be happy to know those plans.

Disclaimer I work on GAE.

<comment><USER6> If I signed the NDA, would I also be happy to know the roadmap for Python 3 on GAE-Std?

<comment><USER5> That's a good question but I'm an engineer and not authorized to talk about any future plans :-)

We do monitor the public issue tracker ([https://issuetracker.google.com/savedsearches/559750](https://issuetracker.google.com/savedsearches/559750)) and will prioritize appropriately according to vote number.

<comment><USER7> OMG! Python 3 support was brought up 10 years ago (it is 2018 now depending on your timezone) in 2008 and comments were closed in 2012 for unknown reasons...

Tack this on as one of the reasons people don't trust google cloud...

<comment><USER8> Not really unknown reasons IMO - the comments were clearly unuseful that just served to spam the people who starred the issue.

No more information from users is needed to implement it, so the only useful comments can come from Google employees who can still comment.

This is standard procedure on Google bugtrackers.

</comment></comment></comment></comment></comment></comment></comment><comment><USER9> I recently restarted fiddling with GAE after stopping in 2012 and moving everything to heroku/aws. To say I'm blown away by how far it has come is an understatement.

Within less than a day I had a prototype up and running that handled inbound requests, did some processing, offloaded the rest to background workers and returned the request. The workers asynchronously stream data to BigQuery for real-time reporting.

The only thing I found baffling is that I could not load Googles' own cloud sdk from within the GAE environment and had to "vendor" it in, doing a bunch of workarounds/patching to get it to run. That probably consumed 3 of 4 hours it took to get this running.

Load testing this thing, GAE automatically managed everything and I never saw any error responses throughout the load test with. It's amazing how little ops work is needed.

AWS lambda and kinesis firehose/s3/Athena could provide part of this, but it's far from turnkey/conclusive. GAE/GC are just so much more complete.

<comment><USER10> > [...] doing a bunch of workarounds/patching to get it to run. That probably > consumed 3 of 4 hours it took to get this running.

This always happens when I try to use one of Google's APIs/SDKs. I dread using them, I feel like they're overengineered most of the time.

<comment><USER9> Unfortunately, that's not one of those over-engineering times. GAE standard environment simply does not include the needed SDK. I'm guessing they just haven't gotten to it.

The SDK works as expected once imported as the outside library and various outbound requests things are configured and patched.

I think I overstated the complexity. All I needed to do was enable SSL for outbound connections (one-liner in the yaml file) and add the requests library patch to use URLFetch service (python/GAE specific step). Searching SO and Google documentation is what took up 95% of the 3 hours I spent on this.

<comment><USER10> Yeah, poor choice of word on my part, but I feel you. This happens to me a lot with their stuff: the solution is trivial yet not obvious and it's not documented properly so you end losing a lot of time.

</comment></comment></comment></comment><comment><USER11> I agree with the author that GAE is fascinating, for hosting large scale web apps. But I strongly recommend to avoid using the Java runtime on GAE. Each GAE instance has very limited memory, 128M (the prices of high memory instances are much higher). 128M is not enough for most Java web apps! Another big problem of Java apps on GAE is a general Java app needs 20 seconds to fully warm-up (considering that the 128M instance has a 600MHz CPU). GAE instances stop and start frequently. If a user visits your website and the visit is served by an instance which has not warmed-up yet, the unlucky user will wait 10s+ to get responded. Then the user experience is very bad. (GAE really provides a way to avoid cold instances serving requests, but the way is tedious to setup and often needs more instances to run. More instances mean higher cost.)

So if you would like to use GAE to host your web app, Go is most preferred. Go instances consume much less memory than Java instances (less than 1/5) and need much less time to fully warm-up (less than one second, so you don't need to handle the cold instance problems at all).

Just my personal experiences.

<comment><USER12> As someone that's been building GAE apps on Java since the runtime first launched... well, it's a mixed bag, mostly good. It works fine for basic web apps. If you have any significant traffic it's a good idea to upgrade to F2 or F4 instances; you get more throughput per-instance so it's break-even costwise.

The instance warmup time tends not to be an issue at scale, but it does mean you end up paying for more idle instances than "optimum". It's still cheaper than hiring a devops team. The cool thing about GAE is that you can build a multi-million-dollar business with a couple engineers and they can both go camping for a weekend at the same time.

Go is nice on GAE because you have near-zero instance start time. But then you must work in Go, which is a poor language for general business processing (despite its other merits). The Go runtime also lags behind the Java and Python runtimes on GAE Standard. The GAE community does not think "Go is most preferred"; actually the GAE/Go community tends to whine a bit about support. It's not perfect, but then again nothing is.

<comment><USER11> Yes, if the traffic of your web app is large and need tons of GAE instances, then the memory and warm-up problems will become much less severe. But if the traffic is not large, then the two problems are the big obstacles to save spending and happy roll deployments. One the other hand, Go is good for both low traffic and high traffic websites.

I disagree on "Go is a poor language for general business processing". The current Go runtime on GAE is very mature to build all kinds of websites.

<comment><USER13> I love Go and use it daily, but it really is inferior to other languages for general business processing.

The lack of generics, and a nice map, filter, reduce, flatten workflow cause this for me.

Sometimes I'll just use goderive then, but it still looks clunky. (No pipe or fluent API)

</comment></comment></comment></comment><comment><USER14> It's also expensive as fuck. Good for prototyping, for when you're starting out and maybe for when you are creating an app that serves very specific uses cases that are easier to address with a fully managed architecture.

But for everything else just start adding APIs and Services and see how your costs balloon out of control.

<comment><USER15> I never get this, why would you use it for prototype if you will not run on it? Why are we prototyping in the cloud? What happened to localhost?

<comment><USER16> One use case would be for getting the product/market fit. Launch fast, then either fail fast or succeed and port to a cheaper service.

</comment></comment></comment><comment><USER17> I've been using GAE for a while now starting from when they only supported Java and Python (I think). It's my go to source when I want to create an MVP or proof of concept. I've also used it to run some sites with medium traffic.

Over the years they've introduced a whole bunch of stuff/services, simplified a bunch of things (e.g. datastore pricing is now simpler).

They've also made things more complicated (in my opinion). Years ago, downloading and using GAE was straight forward. Now they have all sorts of versions (standard, flexible, etc) and running a program is no longer as simple as before.

Their documentation is also extremely poor and they sometimes change/remove services without enough notification (switching from modules to services, changing support for openID/Federated login even though it still showed up in GAE).

At the end of the day, I would still recommend it. It just takes more effort for me to explain to new folks how to use it.

</comment><comment><USER18> For those who are interested to know how much App Engine Standard Environment roughly will cost in real world applications here is my simple formula for it:

Average RPS * $15

So for 100 RPS for one month it costs around $1,500.

Also, you can optimize for cost by adding the following to your app.yaml:

threadsafe: true

Also Golang and Node costs less than other environments.

My two cents.

Update: Formatting.

<comment><USER19> I'm sorry, I'm lost. What is RPS?

<comment><USER18> Requests per second

</comment></comment></comment><comment><USER20> Still in beta, but also consider Firebase + Cloud Functions on GCP. Very fast to build with. And easy to upgrade to GAE or K8 containers if need be.

Cloud Functions for Firebase

[https://firebase.google.com/docs/functions/](https://firebase.google.com/docs/functions/)

</comment><comment><USER21> _It is a fully-managed application platform. So far, I do not know a platform which comes close to GAE 's full package: log management, mail delivery, scaling, memcache, image manipulation, distributed Cron jobs, load balancing, version management, task queue, search, performance analysis, cloud debugging, content delivery network - and that is not even mentioning auxiliary services that have popped up on Google's cloud in the meantime like SQL, BigQuery, file storage... the list goes on._

I think the promise was never actually realized. When first released, you didn't have to worry about load balancing instances or scaling, it was "internet scale", out of the box, dependent only on your traffic. Then they went to the per instance pricing and raised prices.

I was really disappointed no service ever arose to fill this gap; internet scale as service you could say.

<comment><USER22> They still have the autoscaling. "Internet scale" doesn't mean we can ask for more resources without paying more.

</comment></comment><comment><USER23> I've been hosting a service on GAE since the beginning. Pretty much 100% uptime, just had to update a .yaml file twice in... a decade? Amazing service.

</comment><comment><USER24> I've been on GAE continuously since 2008. Can confirm virtually all comments (pro/con) in this HN thread.

</comment><comment><USER25> \- Doesn't support Python 3

<comment><USER9> Standard environment does not and it's a damn shame.

Flexible environment does not have that restriction.

<comment><USER26> But there is no free tier in flexible as far as I know.

<comment><USER27> Free tiers are probably the least economically interesting aspect of cloud services. If you're using gae to do valuable work, you shouldn't mind paying a little bit for the service.

</comment></comment></comment></comment><comment><USER28> Good, balanced article. I'd love to see something similar for the competitors like AWS Elastic Beanstalk or the upcoming "App Engine Flexible Environment" that the author mentions (of course it'd be hard to get a "3 years in" perspective for such a new product).

<comment><USER29> App Engine Flex is newer but I wouldn't describe it as "upcoming". My company's been using it in production for a while now.

<comment><USER30> Agree. In fact, I _strongly_ prefer the Flex environment as it doesn't require you to use any proprietary libs or services: your applications get deployed as containers, can auto-scale, and are health checked.

This has always been one of the benefits of Heroku to me: I don't have to architect my application _for_ a single vendor's environment. If I use a hosted Postgres backend, then even more so.

What Google should consider doing is making App Engine "classic" services like Memcached, etc. available to any service running across GCP. Flex is fairly different from classic, but I think there's some confusion generated from the "App Engine" name and the baggage (good & bad) it has gathered over the years.

<comment><USER31> > What Google should consider doing is making App Engine "classic" services > like Memcached, etc. available to any service running across GCP.

Already being done. First was Datastore, now Cloud Tasks is in Alpha. Expect to see others (Cron, Cache, etc) come as well.

<comment><USER32> But there is still no way to use ndb from outside App Engine standard, right?

<comment><USER33> > But there is still no way to use ndb from outside App Engine standard, > right?

Shameless plug, but for Go, there is an unofficial third-party (Chromium team) datastore package that feature near-seamless AppEngine standard/flex datastore support: [https://chromium.googlesource.com/infra/luci/gae/+/master](https://chromium.googlesource.com/infra/luci/gae/+/master)

It currently couples to any hosted memcached service, but should be forward- compatible with AppEngine if/when they release a Flex-accessible cloud version of their hosted memcache.

"luci/gae" also features a fully-compliant in-memory datastore mock for 1000x+ faster datastore testing and uses a memcache implementation based on "qedus/nds" which fixes several consistency issues present in "ndb".

</comment></comment></comment></comment></comment></comment><comment><USER34> At the end of the article (and in the linked article), the author says that Flex is too immature for production use, but also says that GAE Standard is practically on autopilot and not recommended for new projects. So it seems that the author doesn't recommend starting new production projects on GAE at all. Has this been others' experience?

Given Google's record with other products, I'm particularly worried Google might discontinue or stop improving GAE. Does Google provide any offical reassurance that GAE is a high-priority product that will be quickly improved and not put on autopilot? If so, do their promises seem to match the reality observed by the author for GAE standard?

quote from the end of the article: " It feels like they only invest the bare minimum anymore. Actually, I have had this feeling for the last two years...It is infuriating if there are known issues but they are not fixed. It is depressing to receive so little information on where the platform is heading. You feel trapped. ... the 'old' App Engine is on its way out. I do not think it is a good idea to start new projects on it anymore. If App Engine Flexible Environment on the other hand can actually fix its predecessor's major issues, it might become a very intriguing platform to develop apps on. "

</comment><comment><USER35> I built my first startup (Socialwok) in 2008 on GAE Java it had just launch then. Since then I've totally been sold on the Google Cloud and building products with serverless tech like GAE.

Even today surprisingly few people know about it. So I finally authored and published a book on building products using the Google Cloud this year. (Free to read on the site)

[http://www.howtobuildthefuture.com/](http://www.howtobuildthefuture.com/)

</comment><comment><USER36> I tried to use App Engine flex for my application, but it seems to only support the simplest of apps. `gcloud app deploy` would always time out after about 10 mins with DEADLINE_EXCEEDED due to the Docker build taking too long. It was not well documented, but I figured out I could work around that by defining a custom cloudbuild.yaml with my own "timeout" parameter and submit remote builds using that (`gcloud container builds submit --config cloudbuild.yaml .`), then deploy that specific image (`gcloud app deploy --image`).

Then I found out that I couldn't run my own sidecar container (nginx reverse proxy), and also that Cloud CDN doesn't support App Engine Flex yet. Those were dealbreakers, so I switched to GKE. So far things are working well except a Kubernetes issue not terminating Job/CronJob sidecars correctly which gets tangled up with Google forcing you to run a "magic" proxy sidecar container to access your Cloud SQL instance(s).

<comment><USER37> what are you doing that takes over 10 minutes that can't be broken up into a series of retryable (and likely parallelizable) steps that a worksflow or queue system wouldn't work, be more resilient, scalable?

<comment><USER36> `docker build` is not parallelizable by its very nature of each layer depending on the previous layer

<comment><USER37> so you're running a build server?

<comment><USER36> No. App Engine Flex uses containers internally (the "flex" meaning supporting any type of app rather than the traditional built-in App Engine environments of Ruby, Python, etc.).

The appeal of App Engine is simply being able to type `gcloud app deploy`, which tars up your local source code, builds a Docker image from it, then does a rolling deploy of the new image to replace your old app containers - <USER2> from that one command, no complicated build system needed on your part (i.e. Google Cloud does it all for you).

My point was the moment you stray from the App Engine happy path (`gcloud app deploy` fails for obtuse reasons), you're out in the weeds. That plus the fact that App Engine has some weird missing integrations (e.g. Cloud CDN) often makes it easier to just jump to GKE in my opinion.

<comment><USER37> Okay, I think I totally missed the point you were complaining about. In my day to day I see a lot of people doing large tasks in things like AWS lambda (5 minute timeout) that really should be decomposed into workflows, decoupled with SQS, done with a batch processor or the like to make them more resilient, debuggable, and parallelizable.

Sounds like you're doing something totally different and the heroku-ness is failing you.

<comment><USER36> No worries. If we were talking about Lambda I could air grievances there too - unpredictable cold start latency, quarterly major outages, random periods of increased latency w/ no visibility as to why, etc. ;) (unless things've changed a lot in the last 6 months)

</comment></comment></comment></comment></comment></comment></comment><comment><USER38> I've generally had a lot of trouble with GAE. Debugging is really hard and things seem to fail for weird reasons. The use case I have, with a front end and a static backend, has been surprisingly complicated. I recently shut my app down because it wasn't worth the time to figure out how to change my app for the Dec 15th upgrade.

</comment><comment><AUTHOR> Believe this article was posted about 3-5 times previously on HN in 2017, and never gained traction. I think perhaps that "cloud" and "serverless" have become even more of a thing throughout 2017. Even since March (was in the job market in right after March), I noticed how positions in tech really seemed to be coalescing around "cloud engineers," and "SRE's/Devops" and the like... people on LinkedIn getting 5 AWS certs in a week (lots of this), stuff like that; I really don't even think we are at peak cloud/serverless usage/hype right now. Believe it will continue to grow in 2018, as that other article on HN right now (about serverless in 2018) also proposes.

<comment><USER29> I've seen that most companies are still coming around to containerization as the future of their infrastructure. Serverless isn't even on the roadmap, so we're definitely far from peak hype.

<comment><USER39> I think there is much to show how to leverage container in development. I personally still struggling to get my mindset fix on using containers than running locally. It gets me every time and this makes me feel sad as if I am not in touch with the trend. If people were so stereotype about age and workers, which is not really true as my older coworkers are just as competent and as curious and as willing to adopt new technologies, now I find myself in that stereotype fallacy. But I feel helpless. Anyone?

</comment></comment></comment><comment><USER40> This largely matches my own experience in using GAE. I might just add that since I was using GAE for personal projects, it is very easy to accidentally use a lot of money with the ease to scale up and handle more traffic. There is a way to tell GAE to have a budget limit though.

And yes, although this is essentially vendor lock-in, the access to the many services provided is really really a timesaver that boosts productivity tremendously. I just wonder whether Google is spending much time on it, given how slow they support newer versions of languages.

</comment><comment><USER41> For me AWS is still a king of serverless. In particular, recent AWS step functions really help with connecting microservices (and other tasks) for more complex flows, and does so in a nice visual manner: [https://aws.amazon.com/step-functions/](https://aws.amazon.com/step- functions/)

p.s. it is pricey, but probably this will improve soon.

<comment><USER42> The topic of this article is Google App Engine (GAE), which is a PaaS. Comparing GAE to AWS step functions (which is some wrapping around AWS Lambda) is moot since they are different categories of products solving different problems.

For PaaS products, GAE is comparable to AWS Beanstalk (or Heroku, or CloudFoundry, etc).

For "serverless" products * , AWS Lambda/Step Functions are comparable to Google Cloud Functions.

      * Serverless in the product sense rather than the literal sense.

<comment><USER41> > The topic of this article is Google App Engine (GAE), which is a PaaS.

PaaS & FaaS are quite related; so it is not unreasonable to discuss in this threat. e.g. see informative comments by @indigodaddy on the same threat.

p.s. article also talks about other non-PaaS topics e.g. Data Store, Memchase, BigQuery, etc.

> Comparing GAE to AWS step functions (which is some wrapping around AWS > Lambda) is moot since they are different categories of products solving > different problems.

Many of the problems that they solve are the same; but they do so in a different manner.

AWS Step Functions is a lot more than "wrapping around Lambda"

> For "serverless" products * , AWS Lambda/Step Functions are comparable to > Google Cloud Functions.

AWS Step Functions has no comparable service on Google Cloud

</comment></comment></comment><comment><USER43> I understand the the benefits of using a fully managed platform like GAE, but wonder if it would be the right choice for most scenarios. Personally, I would prototype with GAE, but go into production with GKE, under the impression that the application would be a little more decoupled from the platform.

</comment><comment><USER44> When is GAE & Cloud SQL coming to Southeast region?

</comment><comment><USER45> What are does he mean by using mnemonic as key?

</comment><comment><USER46> Does GAE support websockets?

<comment><USER47> No. You would need to use a third-party service or build one on a VM in GCE. You can deploy a queue with websocket support to save some effort.

</comment></comment><comment><USER48> GAE -> easy to get in...very hard to get out! and expensive...and risky...it's not worth it!

<comment><USER49> It's actually not that hard to get out of, unless you rely on their scaling - in which case any system is hard to get out of.

We did some contingency planning a while back, which included moving a low volume service to a LAPP (Linux/Apache/Python/PostgreSQL) stack to see how difficult is was. The biggest job was re-writing the NDB API calls, but it was not difficult.

For me, knowing the world's best sysadmins are looking after our services is worth _a lot_. I've heard a couple of talks by Google's system relability engineers, and they are fanatical. Visible evidence of this is the brutally honest post mortem they produce every time there is a significant outage, including the vitally important "what we're going to do to stop this ever happening again" section. This focus works - GAE is way more reliable than AWS or Azure.

So YMMV, but GAE is well worth it for us.

<comment><USER48> It's not the scalling that locks you on GAE. It's about the proprietary services. I have 32 micro services, all depending by datastore, task queues etc. The only contigency plan that someone could implement is to do not use GAE in the first place. Almost 70% of the app code is really just about different ways to index/store and return data. Rewriting all the datastore ops is just like rewriting the whole application. With GAE you get stuck and there is little you can do! I had to choose between moving to their "flex" version or just dumping all the code and start over. Starting over is not an option so I'm still on GAE paying the flex prices. Now I pay regardless if the microservices are running or not. If it would be that simple to just move it all to an open source stack you can be sure I would do that.

<comment><USER49> For a platform to provide scaling, it pretty much _has_ to provide proprietary services if those services are to scale as well. AWS proves this point, with their proprietary elastic block store, elasticache, SQS, SMS, etc). I don't know Azure at all, but I'd be very surprised if it's scalable services weren't proprietary too.

So I hold that it _is_ the scaling that locks you into GAE, but only to the extent that you desire scaling. Scaling gives you redundancy and reliability too, don't forget.

> GAE -> easy to get in...very hard to get out!

If your codebase is really 70% datastore API calls, I'd strongly suggest writing your own wrapper so you can change datastore by updating a few primitives. But in any case, GAE is no harder to get out of than any other scalable platform.

> and expensive...

We run three services with millions of users, for about 250 USD per month. Given a single dedicated server starts at $75 USD per month, and that we'd need at least four servers for redundancy and scaling, and that we'd need to hire a system architect/administrator for say ten hours a month to maintain them, I think GAE is excellent value.

> and risky...

You don't say why you think GAE is risky. In terms of uptime, our experience is that it is an order of magnitude more reliable than AWS or Azure. The other risk people sometimes suggest is that Google will discontinue the platform, but Google seems strongly committed to Appengine and Appengine has a three year deprecation policy for any part of the service.

> it's not worth it

We obviously disagree on this point. I would accept "it's not worth it if you will never need scaling and are happy to do your own system admin for free".

</comment></comment></comment></comment><comment><USER50> Still weird that google doesn't offer a search service.. (there is one but doesnt look good)

<comment><USER51> GAE certainly does have a search service: [https://cloud.google.com/appengine/docs/standard/python/sear...](https://cloud.google.com/appengine/docs/standard/python/search/)

<comment><USER50> Very limited, like no cross-index-search etc...

<comment><USER51> What do you mean by cross index search?

<comment><USER50> Search on 2 indexes and get back the merged results. Like solr/elasticsearch do search on index with 1+ shards.

</comment></comment></comment></comment></comment><comment><USER52> The future of GAE is K8S. GAE should be an app on K8S.

</comment><comment><USER53> Google App Engine (GAE) was cool because it was for free. Then, Google started charging (really expensive), i got enough with it and i quit.

<comment><USER54> GAE does still have a free tier. Also, being able to run as much stuff as you want in the cloud for free does not seem like a reasonable expectation.

<comment><USER55> The previous poster may be confused by the fact that App Engine Flex does _not_ have a free tier. For the record, here are the Standard Edition free tier quotas: [https://cloud.google.com/free/docs/always-free-usage- limits#...](https://cloud.google.com/free/docs/always-free-usage- limits#gae_name)

And you can trivially ensure you never exceed them simply by setting a $0 daily budget. (Although I recommend setting a low but non-zero cap instead, so your app doesn't go down if there's a legit but unexpected traffic surge.)

Disclaimer: I work at GCP.

<comment><USER56> App Engine was free before it forced you to enter a valid card number to be able to use the service.

<comment><USER57> It did? I remember using it as a cheap solution for serving static files, without ever entering a CC number (as I have no CC anyway)

<comment><USER56> Yes, the change was made in 2017.

<comment><USER58> well actually I do not have a cc for my GAE project. Basically I'm on the free version. But I guess you need a CC/bank account to register for Google Cloud and since GAE now lives inside GCloud you need one to register, but after that you can basically "remove"/disable it. And then you never need to set a budget.

<comment><USER56> I was an existing customer. Google sent me a notification to request a card and warned that all applications would be shut down if I don't register one.

I didn't register a card and all applications have been shut down. I will not register a card.

Basically, GAE cannot be used anymore for amateur, high school and student projects.

<comment><USER57> Interesting, I also haven't registered a card with Google cloud, but mine are still working

That said, I had once linked a card from my uncle with the private Google Wallet to buy a Nexus 7.

And yes, the CC requirements are insane. Every professional service supports SEPA transfers, except Google. It basically is an extra 30-60€ a year cost just to use Google services, or to develop for Google Play. 30€ CC cost plus 25$ registration fee. (CCs are basically unused in Germany, where I live).

<comment><USER58> Google Cloud actually does support SEPA.</comment></comment></comment></comment></comment></comment></comment></comment></comment></comment>


Apple's Macintosh Computer Turns 30: Did You Know It Almost Failed?.com - <AUTHOR> http://techland.time.com/2014/01/24/apples-macintosh-computer-turns-30-did-you-know-it-almost-failed/ <comment><USER2> Almost failed over and over again.

Jobs was afraid the Apple 2 would get obsolete fast.

Made the Apple 3. That computer was so FUBAR they wouldn't let you try it at the computer store because it might burn up.

Made the Apple LISA, way too expensive.

Made the Mac with just a lot of memory to be useful.

Apple bet on the the wrong horse, Motorola didn't want to make the 68k anymore.

Meanwhile the 6502-based Apple 2 series had lasted longer than anyone had expected. Apple cripples the Apple 2gs so you will buy a more expensive mac. In an alternate timeline the Apple 2gs might been gradually upgraded and take the place of the PowerPC Mac. But no...

PowerPC Macs struggle through the 1990s. The web gradually destroys Mac OS Classic. The OS that was designed to shoehorn an impossible demo into 128k of RAM was designed on the assumption that events rain in slowly from the keyboard and mouse. Add the internet to that and you find it is all a mess of race conditions.

Add locks to avoid the race conditions and you don't have so many crashes but then the computer is always freezing up for a few moments here and there...

Apple tried to modernize the operating systems a few times, took Mac OS X as a last ditch effort, succeeded.

Then PowerPC became unviable, Apple switches to Intel.

Apple uses the Mac as a springboard to launch the iPod, then the iPhone.

The Mac suffers from the dominance of the iPhone much as Apple 2gs suffered from the Mac.

Apple harvests from the Mac brand, focusing on "thin and light" at the expense of everything else.

What next?</comment>


Tuned and asynchronous stencil kernels for CPU/GPU systems - <AUTHOR> http://smartech.gatech.edu/handle/1853/29728

<comment><USER2> Might want to change this link from an <https://> to an <http://>, it's throwing up red flags in firefox (and I assume other browsers too)

<comment><AUTHOR> You're absolutely right, unfortunately it seems that you can't edit the links after submission any more.

This sucks.

Sorry, I should have noticed that before submitting.

The fixed link:

<http://smartech.gatech.edu/handle/1853/29728>

If some editor could please correct the other url I'd be most happy...</comment></comment>


Show HN: Hack your tastebuds to enhance the flavor of alcohol and mellow burn - <AUTHOR> https://www.miracle-nutrition.com/ <comment><AUTHOR> Hi fellow hackers! I came across this great video that shows the impact of Synsepalum Dulcificum (miracle berry) on the flavor profile of high end whiskeys: [https://youtu.be/MBcp-kY_XGo?t=322](https://youtu.be/MBcp- kY_XGo?t=322)

I did a miracle berry cocktail night last weekend and it was incredible. We were able to make some super smooth, unsweetened cranberry-vodkas and whiskey sours. Best thing, since there was no sugar, we didn't have much of a headache the next morning :D

I spent the last year making a formulation that dissolves 10+ times faster than the competition. Whereas the pills on market (depicted in the video) take 5-10 minutes to dissolve, my pixy-stick like product dissolves in 10 seconds. You won't find anything out there like my product.

I would love to hear what you guys think about the product! I believe miracle fruit has the potential to take willpower out of the equation of a healthy diet by making nutritious foods taste as indulgent as the junk foods that are otherwise killing us. No one has the patience to wait 5 minutes in the morning while they are rushing to school or work, so I knew this is what needed to be changed in order for miracle berry to go mainstream and positively impact people's diet and health.

Please use the code "hn" for 10% off at checkout.</comment>


A trip to the (virtual) grocery store - <AUTHOR> http://arstechnica.com/staff/forcequit/2012/05/a-trip-to-the-virtual-grocery-store.ars

<comment><USER2> Sounds like they've reinvented Argos, but for groceries instead of mail order goods.</comment>


U.S. to host World Press Freedom Day - <AUTHOR> http://www.state.gov/r/pa/prs/ps/2010/12/152465.htm

<comment><USER2> This paragraph is hilarious: "The theme for next year's commemoration will be 21st Century Media: New Frontiers, New Barriers. The United States places technology and innovation at the forefront of its diplomatic and development efforts. New media has empowered citizens around the world to report on their circumstances, express opinions on world events, and exchange information in environments sometimes hostile to such exercises of individuals' right to freedom of expression. At the same time, we are concerned about the determination of some governments to censor and silence individuals, and to restrict the free flow of information. We mark events such as World Press Freedom Day in the context of our enduring commitment to support and expand press freedom and the free flow of information in this digital age."

</comment><comment><USER3> While hunting down Wikileaks and Julian Assange?

dont get me wrong, i live in iran and what you have as freedom of press is a thousand years ahead of us, but really, 'world press freedom day' and calling wikileaks 'a terrorist organization' AT THE SAME TIME?

<comment><USER4> s/haunting/hunting

</comment></comment><comment><USER5> I love how the lede makes it sound like UNESCO is the only real press-freedom organization in the world. Never mind folks like Reporter without Borders <http://www.rsf.org> who have condemned US actions. Or, <http://www.cpj.org>, or <http://freedomhouse.org>, or <http://amnesty.org>, or <http://www.hrw.org/>

</comment><comment><USER6> I guess the event will be sponsored by the Ministry of Truth.

<comment><USER7> The accommodations will, of course, be provided by the Ministry of Love.

</comment></comment><comment><USER8> How hypocritical!

It's not press freedom if you only allow it when it suits your agenda.

<comment><USER9> This year's special guest speaker will be held in a CIA rendition cell in a secret location. Get your tickets now!

</comment></comment><comment><USER10> Say what you will, but the U.S. puts up with a lot more than most countries. Be thankful for the freedoms you have and celebrate the freedom of others.

Edit: Not sure why some went on the defensive. I never said you shouldn't fight to protect your own freedoms. Nor did I condemn anyone or anything. Is this really what we've been reduced to? In our search for freedom of speech we're squelching the voice of those who don't agree with us? Isn't that what you are aiming to fight?

<comment><USER8> The fact that it's better than some others is no reason to avoid condemning it when it fails to live up to its own standards.

By this argument, we shouldn't complain about any abuses of government in the western, because a lot of countries do even worse to their citizens. That's a nice idea, but if it was really applied, the result would be that the western governments would soon be no better than others.

<comment><USER10> I don't think I said we should avoid condemning it. Did I?

<comment><USER8> You said we should be thankful for what you have. That implied disagreement with the criticism of the US govt for this hypocritical stance. I suggest starting the post with something along the lines of "I agree that this stance is hypocritical, but ..." if you want to avoid conveying disagreement. It's less concise, but it gets the message across correctly!

</comment></comment></comment></comment><comment><USER11> this is the first time i can remember when such a headline would appear ironic.

</comment><comment><USER12> When WikiLeaks published the docs, I thought it would be great as it would expose Westerners to how most of the world lives & operates. Clearly it didn't. Which nation would the commenters here recommend as host of WPFD, in place of the US? (Not counting nations too remote/small to have any security concerns at all)

</comment><comment><USER13> 37 votes 2 hours ago. And it isn't in the frontpage.

Isn't something broken in the ranking?

</comment><comment><USER14> How ironic given our actions of wikileaks, crazy.

</comment><comment><USER15> Come on guys, the United States didn't do jack to Julian Assange. It's the Swedish who are pursuing the case against him, and quite possibly the matter is one of internal politics. You might say that the US put pressure on Sweden to have this happen, but here in the civilized world we say innocent until proven guilty right?

On the other hand many many Americans celebrate Wikileaks and what it represents, the government has done extremely little / nothing against wikileaks, and all the antagonists wield only rhetoric. The relative inaction so far is reason for celebration! Obviously there are always going to be people who say sensational stuff, but they don't represent the entire country.

<comment><USER10> And thankfully our laws and the freedom of speech allow them to say all that sensational stuff. As someone once said of Voltaire's attitude: "I disapprove of what you say, but I will defend to the death your right to say it."

<comment><USER13> Are you aware that the US Government wants to accuse him Assange of treason and espionage. I think the reason they haven't formally done it yet is because they are waiting for him to be extradited to Sweden first.

<comment><USER16> also, not that the likes of palin will let little things like the law stop her, but you can't commit treason against the US without being a US citizen...

</comment></comment></comment></comment><comment><USER17> does not compute.

</comment><comment><AUTHOR> Oh come on...

<comment><USER18> haha... the title is an oxymoron</comment></comment>


Why the office isn't a good place to get work done (TEDxMidwest video) - <AUTHOR> http://37signals.com/svn/posts/2671-at-tedxmidwest-jason-explains-why-the-office

<comment><USER2> "meetings are just toxic, terrible, poisonous things"

</comment><comment><USER3> Great 15 minute video I encourage you all to watch.</comment>


Ask HN: Feedback for small Python DB - <AUTHOR>

Hey HN,
I've written a small database in pure Python called TinyDB. Could you give me some feedback on it? I'd really appreciate it.
Docs: http://tinydb.readthedocs.org/
GitHub: https://github.com/msiemens/TinyDB <comment><USER2> i like the DSL query approach where you can combine conditions with &, |, etc.

the github page doesn't seem to link to pypi or provide install instructions (i can't see them!). it should.</comment>


Why are there two possible arcs for the path of MH370? - <AUTHOR>

In all of the reports and images of where MH370 could be (based on Inmarsat data) eg http://www.bbc.co.uk/news/world-asia-26503141, they show two possible (and opposite in direction) arcs where MH370 could be. How come this is the case? Must be something to do with which regions and areas different satellites collect data from? <comment><USER2> The arcs are from a single 'ping' from a single satellite. The satellite knows where it is, and with the 'ping' it was able to determine the distance from the satellite to the aircraft. The satellite is the distance of this arc, the radius is the known distance between the satellite and aircraft. By having the last known radar location near Malaysia, approximate flight speed, and time between radar contact and satellite contact, an approximate distance is predicted along the circle defined by the centre (satellite) and radius/arc.

</comment><comment><USER3> Yes, according to the chart on the page you linked. The satellite that it used to communicate its last info only gets information from that arc of the globe. So it must have been in there somewhere when it sent its last broadcast. That doesn't mean it was travelling along that path the whole time though. It could have turned after that transmission.</comment>


Greenpois0n on github - <AUTHOR> https://github.com/Chronic-Dev/syringe

<comment><USER2> just syringe and others injectors

lots of binary payloads.

but i'm clueless of iStuff anyways.</comment>


My Experiment to Have More Meaningful Conversations - <AUTHOR> http://neiljoglekar.com/experiment-meaningful-conversations/

<comment><USER2> Neil,

I wonder if this really works...... it seems somewhat impractical, but I'm willing to give it a shot.

<comment><USER3> I'm not saying it's going to work for everyone or anyone for that matter. It's really just a reflection of how much I can gain / learn by getting opinions from people that are already in my social circles. The problem is I just don't engage them.</comment></comment>


Why I'm an entrepreneur - <AUTHOR> http://blog.limedaring.com/why-im-an-entrepreneur

<comment><USER3> I never can decide if it's hilarious or sad when 18 year olds proclaim that a life of children + mortgage + work isn't a life of "magic and love". If you're having a boring life with kids around, you're doing it wrong. Sure, people manage it, but don't be like that.

Having a house to do things in and a family to do them with/for has helped breed more creativity and magic in my life than I ever had before when I lived by myself with nothing tying me down.

<comment><USER4> You do realize she is an adult now. She was just writing about how she felt at 18. Don't be a jerk about other peoples ambitions.

</comment></comment><comment><USER5> This should be way more common: "What I want is personal freedom to do what I want to do.

I live on on a $20,000/year salary because I can choose when and where I work. I can take the morning off and work late. I can work in the morning and take the evening off. I can travel for months at a time while working on my startup—like I did on a three month trip through Europe a few years ago, and planning to again this fall."

<comment><USER6> Author here. Some updates: I raised my salary to $25k, and just finished that trip I mentioned — three months living/working in Belgium, Germany, and Prague. Happy to answer any questions about working abroad or anything else!

<comment><USER7> How did you like the Belgian beers? Living in Ghent (but in Berlin atm).

<comment><USER6> Love Belgian beer, love German beer, love American micro-brews, pretty much love every beer. It's rather ridiculous.

</comment></comment></comment></comment><comment><USER8> I have 3 children + mortgage + I plan to work the rest of my life until I die (I find meaning in my work as well as my kids.)

I'm an entrepreneur so I can look anyone who is being an asshole in the face, and tell them to go fuck themselves.

<comment><USER6> Isn't that a bit harsh? I just wrote what I thought at 18 — doesn't mean I still hold the same views. Just that's what I wanted at the time.

<comment><USER8> I didn't mean it has harsh at all, I was outlining my views today at 37.

</comment></comment></comment><comment><USER9> _" Startup life is hard."_

I imagine that depends on who you are and what motivates you. For me, I found the opposite. Physically it's absolutely no harder than any other low-paid, long-hours job. Mentally it's very taxing but only because it's (usually) hugely creative - it's no harder than working in a salaried role where there's an expectation that you'll be creative all day. There's an element of difficulty beyond a normal job that comes from the level of independence - <USER2> _can 't_ slack off because things just won't get done - but that's not very different to having a difficult boss. Essentially you become your own difficult boss. And you always have the awesome incentives that both the short- and long-term rewards are potentially _much_ better (freedom, interesting work, perhaps a huge payday at the end).

I've done career jobs and I've done startups. Startups were easier for me.

<comment><USER6> I'd argue that the most mentally taxing part isn't that it's hugely creative, it's that your decisions can make or break the company. Hiring, firing, what marketing decisions, what development decisions - that makes it a lot more taxing than a job where the decisions you make are largely determined by your superiors (and the results also affecting them more as well.)

</comment></comment><comment><USER10> This is inspiring to me. I've run one reasonably successful business, and two the flopped hard. In between that, I've worked various full time and part time development (and sales, when I want to do something different) jobs.

I've recently found myself at somewhat of a crossroads. I have an idea that I think is going to be able to make decent money. Not FU money, but more than enough to live the way I want.

But I've been looking at going back to full time work for someone else... And I'm unsure on where I should go. I have time, I'm only 23, and I can get away with mistakes (I live in a country with an excellent safety net, and a pretty okay family -- they would prefer I get a "real" job though).

Glad to see someone out there is living my ideal life though :) maybe I'll spend tomorrow crunching some numbers to see how feasible it is.

<comment><USER6> Some people don't recommend it, but you _can_ work a full-time job and start working on your idea in your spare hours, saving as much as you can, quitting when it becomes feasible. I saved $20,000 from my last full time job before striking out on my own, and it made things a lot easier.

<comment><USER10> I've tried that, and it was too much mentally for myself. I was younger then, though, so it might be different this time! That's likely the road I'll go down, or perhaps get off my bum and start consulting again :)

</comment></comment></comment><comment><USER11> Complete aside: The slow fade from fluorescent green to black and back on the "Read This Next" headline at the bottom of the page triggered some kind of disturbance/disruption between my eyes and my brain.

I thought maybe a blood vessel had burst inside my head and my vision was about to go.

<comment><USER6> Huh, thanks for letting me know. Seems to be automatic in Svbtle, I'll try changing the color I choose and maybe that'll help prevent that effect.

<comment><USER11> It looks like maybe it's the fade to darkest black when it contrasts with the bright white background on the screen.

It makes my pupils dilate or something.

Maybe it's just me?

</comment></comment></comment><comment><USER12> Startup life is less appealing when you can make near 6 figures as a software engineer even just after graduating.

<comment><USER6> I've been offered (and turned down) 6 figure salaries. Honestly (as mentioned in the article), the freedom from time-sheets, PTO, HR, rules, and regulations makes startup life a no-brainer for me.

<comment><USER13> And given more time, you can easily grow your business to be a 6 figure income. That is not uncommon.

Good work

</comment></comment></comment><comment><USER14> For me, what's important in life is that you are happy in what you are doing, being contented and grateful for all you currently have and being appreciative even for life's failures, trials and experiences.. Keep it up and enjoy life more!

</comment><comment><USER15> "I live on on a $20,000/year salary"

"I can travel for months at a time while working on my startup—like I did on a three month trip through Europe"

Honestly curious how she manages to do this financially ?</comment>


Upgrade to Windows 10 for free - <AUTHOR> http://www.microsoft.com/en-us/windows/windows-10-upgrade

<comment><USER2> I was under the impression that Windows 10 was going to be free for all (like OSX). I guess not.</comment>


5 Types of people who are disgracing entrepreneurship - <AUTHOR> http://www.2indya.com/2011/01/21/5-types-of-people-who-are-disgracing-entrepreneurship/

<comment><USER2> I don't know about disgracing - they are just mentalities possibly not well suited to entrepreneurship.

The one about "if I had the money" really gets me - I used to say that, but now I _have_ easy access to the money, but no idea what to do with it.

The neat thing is the internet has brought out a market where a single person can both create and sell a product or service globally all on their own, so if you get someone with enough technical, business, and drive, they can be a one- man show - something that was much harder previously.

</comment><comment><USER3> tl;dr 1\. "I am thinking about starting up for last 3 years" 2\. "I have got this great idea, but I cannot share with you" types 3\. "I don't like my job, so I want to become an entrepreneur" types 4\. "I want to make money" types 5\. "If I had the money, I would start my business" types

Nailed it.

I agree, but #3 is not always true. Sometimes, people solve a problem in their workplace by leaving a starting a company. I guess Bhatia and Hotmail make a good example.

<comment><USER4> Dissatisfaction with the way things are is a good motivator for starting a business.

This can be external (Blockbuster's crazy fees = Netflix) or internal (dead end job = working nights/evenings on something compelling).

I think the author would argue that the problem with #3 is people who aren't passionate about becoming an entrepreneur, and could just end the sentence with ", so I want a better job where I make all the rules".

</comment></comment><comment><USER5> How about people who write a blog like this and then plaster it with ads?</comment>


IFrames getting advantage over FBML for Facebook apps - <AUTHOR> http://www.ccheever.com/blog/?p=10 <comment><USER2> Another advantage to IFrames is that it makes porting your app to OpenSocial easier. The two platforms seem to be converging recently: Facebook enhancing their Javascript APIs, and OpenSocial building their REST APIs and working on an equivalent for FBML.

<comment><AUTHOR> Got a link about OpenSocial getting closer to the Facebook model? OpenSocial have always had REST APIs, did they start to call your servers like Facebook does?

</comment></comment><comment><USER3> Outstanding writeup. Thank's a lot; this actually cleared quite a few things up for me.

</comment><comment><AUTHOR> Funny how Facebook drifts toward the architecture OpenSocial used for integrating 3rd party apps from the start: javascript-heavy client making calls to the platform API and (optionally) to the application's own servers.

</comment><comment><USER4> Interesting article. I never really looked at facebook apps but it seems much simpler then I thought (not sure why I assumed it would be complex).

</comment><comment><USER5> The URL thing is kind of a deal breaker if you're working on an application rather than a widget.

</comment><comment><USER6> You've got to be joking. There are so many things that don't work well or at all in iframes:

\- extended permissions

\- resizing so you don't have scrollbars

\- inconsistent behavior in fb-sig params

\- cookie handling issues that are common to all iframes

<comment><USER7> FWIW your first two issues are addressed on the post. <fb:serverfbml> can be used for extended permissions and some other js provided by FB for automagic iframe resizing.

I agree with your point though, I think not requiring FBML apps to reload all the FB chrome would be a better solution. He mentions that this is in the plans at the end.

<comment><USER6> I stand by my statement.

<fb:serverfbml> came out 30 days ago. That's about six _months_ after you could do extended permissions stuff in fbml. In my book, that's a second class citizen.

The resizing code for iFrames is broken. I've talked to Facebook's engineers about it. They know it. The reality is that it is nasty, tricky, hacky code that is hard to get right and harder to keep running. It runs directly into the weakest part of cross-browser javascript wizardry: the DOM and dynamically resizing divs. Their advice was to avoid it.

Look: I built an iframe app. It was the right thing to do for my business. But it is in Facebook's interest for fbml to always be a little more functional and at least a little better.

<comment><AUTHOR> The author of the blog post is a lead engineer working on the Facebook platform. Maybe their priorities are changing.</comment></comment></comment></comment>


A curated directory of resources and tools to help you build your startup - <AUTHOR> http://startupstash.com/ <comment><USER2> There should be a mechanism such that when you click any of the elements on this website there's a small chance of a popup saying "stop reading and start doing".

<comment><USER3> good one, let me think about that ;)

</comment></comment><comment><USER3> What's up HackerNews! I'm surprised to see my creation Startup Stash pop up here, after launching it early 2015. I think I tried to post this here before? (back then)

Those of you who don't know, Startup Stash is the most upvoted product of all time on Product Hunt with 11K+ upvotes ([https://www.producthunt.com/search?q=%2A](https://www.producthunt.com/search?q=%2A)), if you want to know more check out this blogpost I wrote after launching it: [https://medium.com/startup-grind/how-i-launched- the-2-most-u...](https://medium.com/startup-grind/how-i-launched-the-2-most- upvoted-product-of-all-time-on-product-hunt-f3772fb20ad8#.xi5dg41p2)

Right now I'm working on something new: a course to teach anyone how to build a Minimum Viable Product without code: [https://nocodemvp.com](https://nocodemvp.com).

<comment><AUTHOR> You are welcome! :) I use PH a few times per month, so I don't know how I could miss it so far, it was absolutely new for me. Its a great collection by the way! Nice job! :)

</comment></comment><comment><USER4> Very useful directory I added it to my bookmarks a year or two ago. BTW, it would be great to have some rating for the tools.

</comment><comment><USER5> I would pay a decent amount of money, if a tool/service can get me this: drag and drop bootstrap website designer that let's me export the code to plug in to my backend. It's so frustrating to not have something like this for someone who's completely incapable of UI design. Does someone know of a service like this/

<comment><USER6> Bootstrap Studio. There is a one-time charge. Their studio works on mac, linux, and windows. You download to your machine and don't run this from the cloud.

You can host your sites wherever you want without having to use specific vendor servers.

This is very easy to use. I don't have time to spend as a full-stack web developer, when I am already busy with other things.

I'm not affiliated with the author/vendor other than having purchased their product. [https://bootstrapstudio.io/](https://bootstrapstudio.io/)

</comment></comment><comment><USER7> There are a whole bunch of Microsoft resources that aren't mentioned:

Bizspark - All Microsoft software + Azure credits ([https://bizspark.microsoft.com](https://bizspark.microsoft.com))

Azure - Cloud hosting ([https://azure.microsoft.com/free](https://azure.microsoft.com/free))

Team Services - Code repo + CI/CD ([https://www.visualstudio.com/team- services/](https://www.visualstudio.com/team-services/))

Mobile Center - App distribution and analytics ([https://www.visualstudio.com/vs/mobile- center/](https://www.visualstudio.com/vs/mobile-center/))

</comment><comment><USER8> You should add Logodust ([http://logodust.com](http://logodust.com)), a fantastic resource for free logo designs that one could use in mvps and mockups.

<comment><USER3> will check it out!

</comment></comment><comment><USER9> Ok so there are _ten_ different services just to _name_ your startup? Duuude seriously?

<comment><USER10> Here's yet another API for generating startup names (feel free to change the "baseWord" param):

[http://namrly.azurewebsites.net/api/Namrly/RelatedStartupNam...](http://namrly.azurewebsites.net/api/Namrly/RelatedStartupName?baseWord=name)

</comment></comment><comment><USER11> I'd add Logojoy ([https://logojoy.com/](https://logojoy.com/)) for logos. They're not free, but they'll get you started with a logo you need not be embarrassed by.

</comment><comment><USER12> Super helpful list Bram!

+1 for instant search

<comment><USER3> thanks!

</comment></comment><comment><USER13> Oh look this has popped to the top of HackerNews again.

<comment><USER14> Fun fact, with over 11k votes, the all-time most upvoted product on ProductHunt.

<comment><USER3> that is, true ;)

<comment><USER15> Bram, how many emails did you collect to do this?

<comment><USER3> I did not get 11K upvotes on the first day. This is from 2,5 years. After my launch day I was the #2 most upvoted product, 1 week later it was the #1 most upvoted product. I think on the first day it got 1500 upvotes. Check [https://medium.com/startup-grind/how-i-launched- the-2-most-u...](https://medium.com/startup-grind/how-i-launched-the-2-most- upvoted-product-of-all-time-on-product-hunt-f3772fb20ad8) to read how I launched it.</comment></comment></comment></comment></comment>


Interview with Jeremy Howard (Fast.ai) on Future of AI - <AUTHOR> https://scale.com/interviews/jeremy-howard <comment><USER2> Thanks for sharing... will listen.

As an aside, why do they spam that orange/purple gradient in virtually every part of the site... I've noticed color gradients on the rise again but this seems a bit excessive/unnecessary?

Is there an underlying reason behind gradients that I'm not understanding, or is this just yet another trend of websites copying cues from each other?</comment>


Show HN: Zentrade.io – Bitcoin Prediction Markets - <AUTHOR> http://www.zentrade.io/ <comment><USER2> So this has the same flaw that Predictious has. It's building a BTC bank in addition to a prediction market.

That's the easiest thing to build, coming from a world of traditional fiat money banking. But BTC enables something superior - 2of3 transactions between betters. We create a 3 way transaction - Long says "I want the money". Short says "I want the money". When the bet is concluded the arbitrator says "Long won, give me 1%."

The arbitrator can never go insolvent - in fact, the arbitrator _never needs to hold a single bitcoin_.

<comment><USER3> What if the loser refuses to pay? How does the arbitrator get the coins without holding coins?

<comment><USER4> There is no such thing. In a 2 out of 3 transaction, 2 out of 3 parties have to agree for the transaction to happen. Thus, if the winner agrees and the arbitrator also agrees, the transactions is conducted. It's a cryptographically secure agreement.

<comment><USER3> What if the arbitrator is colluding with the loser?

<comment><USER2> This problem is not solved via 2of3 transactions.

It can be partially mitigated by requiring multiple arbitrators (e.g. a 4/5 transaction with 3 hopefluly independent arbitrators).

<comment><USER5> Unfortunately, there's no really good way of establishing that two pseudonyms are _not_ held by the same person, in a decentralized system. Doubly so when legal enforcement isn't available. Of course abuse is harder the more arbitrators you incorporate, but expense and difficulty are higher as well.

</comment></comment></comment></comment></comment></comment><comment><USER6> 1\. How does Zentrade differ from Predictious?

2\. I won't send bitcoin to a site that can't prove it controls the keys for 100% of customer deposits.

3\. Obama vs. Romney?

<comment><AUTHOR> 1\. Predictious uses the more traditional market-making model (as in financial markets). This is fine in more liquid markets, but in markets with habitually sparse bettors as is usual with prediction markets, it is better to have an in-theory infinite liquidity betting pattern (e.g. modified parimutuel, as Zentrade uses) so that you can make your bets at any time rather than waiting for someone to publish a price.

2\. Reliability and trust are big things to us. How would you suggest we implement this to show customers?

3\. 2016? Not sure I'd be betting on either there...

<comment><USER7> 2\. [https://github.com/olalonde/blind-solvency- proof](https://github.com/olalonde/blind-solvency-proof), [https://github.com/ConceptPending/proveit](https://github.com/ConceptPending/proveit)

</comment></comment></comment><comment><USER8> Parimutuel betting pools are less attractive to truly savvy bettors, profit- motivated and deep-pocketed, because there's no way to be sure your advanced insight, at a particular point in time, will have a positive expectation when the betting is done.

</comment><comment><USER9> Just signed up.

One suggestion: two-factor authentication. After so many hacks, 2FA should be available on any site that holds users' bitcoin.

<comment><AUTHOR> Thanks for the suggestion! I'll look into implementing that.

<comment><USER10> Check out Authy.

Coinbase uses it and it's really user friendly.

<comment><USER9> Agreed. Authy is great.

</comment></comment></comment></comment><comment><USER11> No transparency? No thanks.</comment>


Three Rings Design's Steampunk Office Suite - <AUTHOR> http://www.wired.com/culture/design/multimedia/2007/06/gallery_nemo_office <comment><USER2> That's from 2007. I hope the CEO isn't still wearing that Sergeant Pepper's Lonely Hearts Club outfit. Does the office still look like it does in the pics?

<comment><USER3> Yes, the office still looks like that and yes, Daniel James still dresses like that.

<comment><USER4> At the Game Developers Conference, Daniel James is known for giving impressively open and informative presentations. He is also known for serving alcoholic beverages to the audience before his talks begin. This is explicitly forbidden at GDC. Before last year's conference, there was a rumor that he was going to end the tradition because it was becoming controversial. Instead, before his 9AM talk began, he asked that we all thank the general manager of the conference for personally arranging the table full of Bloody Marys for everyone.

</comment></comment></comment><comment><USER5> i've been in the office. it's really awesome.

a lot of the stuff was done on a 2d cutter, so up close there's not a lot of detail.

</comment><comment><USER6> Meh. You're trying too hard, but keep trying...</comment>


Attack of the week: DUHK - <AUTHOR> https://blog.cryptographyengineering.com/2017/10/23/attack-of-the-week-duhk/ <comment><USER2> It's even more absurd than the post draws it. From the paper:

 _The X9.31 random number generator [in FortiOS] is implemented within a kernel module that exports a Linux character device. At boot time, the init process loads the module and replaces /dev/urandom with a node corresponding to the X9.31 character device._

 _We reverse-engineered the kernel module providing the X9.31 implementation [...] and found the hard-coded AES key used for the RNG. The hard-coded key was f3b1666d13607242ed061cabb8d46202. The key used in both the firmware dump and virtual appliance was the same. Although the documentation stated that the key was "generated external to the module", the key is the same one used for the NIST test vectors [14] and appears to have been hard-coded into the source code._

<comment><USER3> I'm pretty sure there's an age-old comment in the source code like:

        // TODO generate key instead of hard-coding it

<comment><USER4> You mean something like this? [https://github.com/nitram509/macaroons.js/blob/master/lib/Cr...](https://github.com/nitram509/macaroons.js/blob/master/lib/CryptoTools.js#L51)

</comment></comment></comment><comment><USER5> Random (no pun intended) thought after reading this: how much of the supposedly secure HTTPS/TLS traffic is terminated by hardware load balancers and such that aren't really open and might have similar vulnerabilities?

<comment><USER6> I will make the opposite bet to sibling comment and say not too much. It's too easy to just install nginx and let it terminate connections to bother with a hardware device that you have to buy, store, and maintain.

And many sites use CDNs or cloud services for connection termination. Cloudflare and Amazon are surely on top of these things.

<comment><USER7> This is true of small shops and cloud operations but every enterprise IT shop I've seen has a router geek who is convinced you need an appliance to terminate traffic, even if it's a decelerator in practice.

</comment></comment></comment><comment><USER8> It's weirdly impressive that you still find wide, systemic misuse of random number generators in professional products. But maybe un-use is a better term for not using one where appropriate. In a Def Con talk Dan Kaminsky described it in a slide as "a drop will do ya". Where even a half assed attempted at using a csprng will result in something that will resist all but very well resourced attackers. Also see OpenBSD who have been banging this drum for probably 10-15 years now.

</comment><comment><USER9> With so many hardcoded passwords there should be a DUHP as well. I wish someone with more time could dig through the mess that is FortiWLC.

[http://www.cve.mitre.org/cgi- bin/cvename.cgi?name=CVE-2016-8...](http://www.cve.mitre.org/cgi- bin/cvename.cgi?name=CVE-2016-8491) [http://www.cve.mitre.org/cgi- bin/cvename.cgi?name=CVE-2017-7...](http://www.cve.mitre.org/cgi- bin/cvename.cgi?name=CVE-2017-7336)

</comment><comment><USER10> This attack would have been avoided if the output of the RNG had been hashed before being used. The root of the problem here is that the function from the state to the output can be inverted, once the key is known; one of the properties of a cryptographic hash is that it cannot be inverted other than by brute force. In the same way, the function from the state to the next state should also not be invertible.

Given Dual-EC, one has to wonder whether this bad RNG design was by accident or on purpose, and how many other bad RNGs are out there. One also has to wonder whether we should all start hashing the outputs of every RNG before using them...

<comment><USER11> This attack would not have been avoided if the output of the RNG had been hashed, since the attack essentially brute-forces all entropy in the system (i.e. the timestamp jitter). No amount of deterministic post-processing can save you if you have no entropy to begin with.

You also don't build backdoors by building bad products.

<comment><USER12> Unless I'm missing something, I think hashing actually would make this attack much harder to pull off. The attack works by AES decrypting the generator output, which gives you V (the state) XOR T (the timestamp). If you can guess the timestamp, you have V and can now run the generator both forwards and backwards as long as you can keep guessing the timestamp for each output.

If the generator output was hashed after being encrypted, it would not be possible to perform the decryption step of the attack. You could still perform a brute force attack by encrypting and then hashing, but now you're brute forcing both the state and the timestamp together (i.e. you have to guess V XOR T, then encrypt, hash, and validate your guess), which will likely be much more difficult if the generator has been running for some amount of time. Without being able to invert the encryption step, an attacker has to basically guess ALL previous timestamps rather than just the one associated with the current output. If the attacker is able to see the first few outputs, the attack would still work, but it would be much harder to just start at an arbitrary point in time.

Edit: I still don't think the addition of a hashing step would make this a great generator design, but it would make it more resilient against this kind of attack.

<comment><USER11> You're right; but the conclusion would still be "this is horrifically broken". A passive attacker _can_ get all random generated since boot, and any internal RNG calls are not secret (neither in theory, nor probably in practice.)

One abstraction level up, hashing the output of a RNG is a bad countermeasure against a possibly-bad RNG. Good countermeasures including mixing the outputs of multiple RNGs and using protocols that don't require entropy.

<comment><USER13> "hashing the output of a RNG is a bad countermeasure against a possibly-bad RNG"

Why? I would think it's a fair suggestion for defense in depth, especially if you need to expose the result as a nonce, and you don't want to leak anything else unwittingly. It's also a good idea if you're not sure whether the entropy is evenly distributed, which is where something like HKDF would also want to hash the entropy source.

"using protocols that don't require entropy"

That rules out most secure protocol handshakes.

<comment><USER14> You could just use a better RNG in the first place.

<comment><USER13> The point is that it's not XOR. You can use a better RNG and also hash entropy before exposing it as a nonce. Why throw out defense in depth?

</comment></comment></comment></comment></comment></comment></comment><comment><USER15> does anybody else find the first comment on the original article to be lame enough? he apparently thought it was a click-bait or something and uses lame- ass arguments to prove his bullshit assumption</comment>


Show HN: UZoom, Marketplace for customized live video experiences - <AUTHOR> https://www.producthunt.com/ <comment><USER2> Link doesn't work. Instead it leads directly to producthunt. Or was that intended?</comment>