Senators Demand Google Hand Over Internal Memo Urging Google+ Cover-Up - <AUTHOR> https://www.zdnet.com/article/senators-demand-google-hand-over-internal-memo-urging-google-cover-up/ <comment><USER2> Previously: [https://news.ycombinator.com/item?id=18212759](https://news.ycombinator.com/item?id=18212759).

</comment><comment><USER3> > Three Republican senators have sent a letter to Google today demanding the > company hand over an internal memo based on which Google decided to cover up > a Google+ data leak instead of going public as most companies do.

That's a loaded first sentence. Here's another way of writing it: "Three Republican senators have sent a letter to Google today asking the company to please provide internal memo based on which Google decided to not disclose a Google+ bug that could have leaked data instead of going public as very few companies would."

Or break it up if that's too wordy. ZDNet and the writer of this article should be ashamed of themselves. How much more clearly can you out yourself as biased garbage?

To the contents of the letter itself [0], just answer the 8 questions straight up, and give the memo. Doesn't appear like a witch hunt quite yet. On questions 3, 4, and 5 just make it clear that software bugs are rampant, many have the ability to get bad things when exploited, and on 6 either inundate them with a deluge of security bugs or explain that there are probably thousands. On #7, the answer better be an emphatic "yes" or I will be very disappointed.

If it becomes more political, there needs to be legal requirements for disclosing all security vulns (instead of just exploited ones) or they need to recognize it's untenable to ask for them. Can't have it both ways and just pick a company's vuln because of an article about them and not ask other companies for theirs.

0 (PDF) - [https://www.commerce.senate.gov/public/_cache/files/4852b311...](https://www.commerce.senate.gov/public/_cache/files/4852b311-0953-4ac8-ac43-a91dde229cc1/E300DA0C7659678AE0AE37AEB9746200.thune- wicker-moran-letter-to-google-10.11.18.pdf)

<comment><USER4> > out yourself as biased garbage?

Biased based on your opinion.

I personally think this is a very big deal and I don't see anything wrong in that sentence. If you think Google is innocent, just look at the facts.

1) They had an internal memo discouraging public disclosure. 2) They only came clean with the leak after WSJ reached out for comment before the publication of a story. 3) They buried the "leak" announcement in a gigantic blog post. The blog post was meant to announce a new project, but about halfway through the middle they disclosed a data-leaking bug. I'd say the tone of the article is in response to Google's observed and recorded actions.

Yeah, I'd say the article and letter's tone is just about right.

<comment><USER3> > I personally think this is a very big deal [...] Yeah, I'd say the > article[...]'s tone is just about right.

That an article needs a "tone", and that it's right/wrong based on how big of a deal the reader thinks it is, is the issue. I await robot news that is a bulleted list of facts. We could argue about fact selection/placement, but I'll take that over arguing a particular organization's collective side of the bed they wake up on.

To your point, we disagree there wrt internal discussions of disclosure. What will be real scary is when there is a chilling effect to even performing rational discussion around these things. There is no such thing as disclose all, and when there is no such thing as talking about it either, you'll wish these rules were codified in law instead of applied selectively to issues you are ok with.

<comment><USER5> >I await robot news that is a bulleted list of facts.

Interesting that you mention this, I'm not convinced that this will be a silver bullet. A couple of concerns that come to mind:

1\. Something must bridge the robot to the physical world. The selection of which facts to include and exclude in this data source can create bias.

2\. From the data source, the robot then would make its own decision about to to present facts, presumably performing some filtration of its own. Such a robot can have bias [0].

To be clear, I definitely agree that robojournalism could be an improvement. But we can't forget how it works and how it could be manipulated.

[0] - For example [http://blog.conceptnet.io/posts/2017/how-to-make-a-racist- ai...](http://blog.conceptnet.io/posts/2017/how-to-make-a-racist-ai-without- really-trying/)

</comment></comment></comment></comment><comment><USER6> I have never worked at any company that publishes every security bug discovered internally. This is ridiculous.

<comment><USER7> Depends on the industry. E.g. if you're working in defense or healthcare, then just the possibility of a data leak might be something you're obligated to report on. And a Google- or Facebook-size company might easily fall into the category where even "near miss" events should be disclosed.

Basically you have to conduct an internal risk evaluation and depending on the overall risk assessment, you need or don't need to publicly report on it. Of course the bar is much lower than 'certain data leak'.

<comment><USER6> I have worked in healthcare related systems before that needs to be HIPAA compliant, even for those systems public disclosure of a _vulnerability_ is not a requirement. No software is bug free, and many seemingly benign bugs are security vulnerabilities.

Try and name one company that reports all their bugs (security/non security) discovered internally.

</comment></comment></comment><comment> IX-103 Since the "memo" is part of a discussion between lawyers and execs wouldn't the memo be considered privileged? That doesn't mean that Senators can't ask, but if you set the expectation of handing out privileged information whenever you're asked it kinda makes "privileged" communication not mean anything.

</comment><comment><USER4> Please, do hand over that memo. I'll be watching this closely. I'd love to read the entire thing, not just the parts that WSJ selected.

<comment><USER8> I have found over and over and over that when I read "memos" or "screeds" or whathaveyou coming from the tech industry I inevitably find that a huge portion of the media is pushing a narrative that is so uniform and so disjoint from the actual content I have a hard time imagining how it wasn't coordinated journo-pros-style.

<comment><USER9> James Damore?

<comment><USER8> That's an example, yes.

</comment></comment></comment></comment><comment><USER10> Google admitted that they don't keep any logs around. So in the absence of logs, I am not sure how they are making the claim that their API was not abused. So there is definitely more transparency required about their internal investigation and how they are so certain. Just because Google has a great security team, I would not put my blind faith on them.

<comment><USER11> I don't believe they made that claim? They said they didn't have evidence that the API was abused.

<comment><USER12> They said that they kept logs for only two weeks, because the logs themselves contained private information. Those logs contained no evidence of abuse.

</comment></comment></comment><comment><USER13> Its somewhat a miss-leading title....

Can you cover-up legal activity? No, of course not..non-story here</comment>


The world is not so flat, God of Visas edition - <AUTHOR> http://blog.pmarca.com/2007/12/the-world-is-no.html <comment><USER2> _Praying to the Visa God is actually quite a bit more rational than current US immigration policy._

I think pmarca should stick to giant block quotations from the WSJ and other voice-of-the-elite rags, and away from attempts at wit. As for the Visa God worshippers, Ted Kennedy said this,

 _"The bill will not flood our cities with immigrants. It will not upset the ethnic mix of our society. It will not relax the standards of admission. It will not cause American workers to lose their jobs." (U.S. Senate, Subcommittee on Immigration and Naturalization of the Committee on the Judiciary, Washington, D.C., Feb. 10, 1965. pp. 1-3.)_

He might have added: _It will not cause a rush of mentally touched Pagans into our high technology sectors._

</comment><comment><USER3> If there are hundreds of thousands of educated Indians clamoring for engineering jobs, how aren't they taking over the world yet? What needs to be done to provide them the opportunity? Sounds like there is quite an opportunity for the provider as well as the providees...

<comment><USER4> I am indian, and though I have spent only a small portion of my life in India, I think there are several reasons "why they are not taking over the world". [Disclaimer - I too am an H1-B holder]

1\. India is a country of over 1.3 billion people, and about half are illiterate. So, yes, there are many engineers clamoring, but the number relatively is not as high as it should be.

2\. There is a fairly high degree of corruption, which in this case is the result of a lot of red-tape. Getting anything done means having the resources and or money or both to get anything done, which kills many enterprising ideas

3\. The high population results in the infrastructure bursting at its seams, and often most places other than the big cities to be lacking. This makes places like the US seem extremely attractive alternatives. A lot of the people who graduate from the IITs (Indian Institute of technology), and many engineering school (almost all my friends) are abroad.

There are several other reasons but I hope this puts it in perspective. Though these days (from what I hear, I haven't been back in some time) times are a-changing. I hear a lot more about the startup scene in India, and with the influence of big corporations like Google, the government seeing that India has the potential to be a technical center in the world, the growth of indian firms like Wipro and infosys, the Ambani and Ispat group maybe this can be avoided.

Hope this puts some of this in perspective.

<comment><USER5> This is an off topic question, but what do you think of India's economic competitiveness compared to China's?

According to Fortune, China is supposed to be the big player for this century. If true, this is pretty bad since the Chinese elites view people as a means to the end of Chinese dominance. India, on the other hand, institutionally has a better respect for human dignity. Though the caste system is still alive and kicking, it is a religious institution, and not something the government is pushing on the people.

<comment><USER4> That is a tough question for me to answer, partly because I don't follow any world news... but my impression so far is that China is leaps and bounds ahead of India in terms of economic competitiveness. China has realized the potential of extremely cheap labor, and is fast becoming a black hole, that sucks in raw materials from around the world, and exchanges them for a lot of foreign currency, especially American dollars. India, on the other hand tends to be skewed towards leveraging its technical prowess, though attempting to do what China does (in terms of manufacturing) would definitely be a step in the right direction.

I think India has the potential to create great products at great prices, that can help both raise the standard of living in the country, and bring in foreign exchange. Looking at what the Reliance (and Ispat) group have done in the last 3 decades is a strong reminder of this fact. Over the last decade, India has done some good things, like open up its economy to international companies, which has had both a good and bad effect for the economy itself. On one side, more jobs are created, and the lowest common denominator becomes even lower, but on the other hand, without strict policies, large multinationals have the ability to kill the mom-and-pop businesses (of which there are lot, including the cottage industry within India).

I dont know if this answered your question... Let me know.

<comment><USER5> Thanks, yes that's a good answer.

So, even though India doesn't compete with China industrially, what do you think about it's intellectual competition? Some of the most innovative mathematicians have been Indian, whereas I don't know of any such Chinese innovators.

While industrialization is very important for turning good ideas into products; the good ideas, in my mind, are more important. As Al Queda is showing us, technology isn't the panacea we often think it is.

</comment></comment></comment></comment></comment><comment><USER6> Is it good or bad for India when brighter people leave to go to the U.S.? I suppose they send money home, as most of their extended family remains in India.

</comment><comment><USER7> "Educated" folks praying to a "Visa God..." Mindblowing... Keeping the spirit of "plug and pray" alive!</comment>


Show HN: Jolteon – Babel/Electron/React/Browserify/Sass application stack - <AUTHOR> https://github.com/vulpino/jolteon <comment><USER2> Thanks for putting this together. Feature request: A branch that includes redux. [https://github.com/reactjs/redux](https://github.com/reactjs/redux)

<comment><AUTHOR> I'll look into it, thank you!

<comment><USER3> The reactuate react+redux+stuff stack may provide useful prior art therefore.

</comment></comment></comment><comment><USER4> "Gets the stupid work done so you can actually make something." I really like that line. I hate boilerplates in general but that line just draws me in to use it.

</comment><comment><USER5> I thought all the cool kids were using webpack instead of browserify now?

<comment><USER6> And using npm scripts instead of gulp?

<comment><USER7> You use npm scripts instead of grunt not gulp. ;)

<comment><USER8> The highly popular React Starter Kit disagrees:

[https://github.com/kriasoft/react-starter- kit/commit/ed14145...](https://github.com/kriasoft/react-starter- kit/commit/ed1414567d5a34990873f5d9202b724dabe2ce09)

</comment></comment></comment></comment><comment><USER9> Nice. I built something similar recently, though not as fleshed out. It does use webpack for hot reloading on save: [https://github.com/KevinGrandon/electron- boilerplate](https://github.com/KevinGrandon/electron-boilerplate)

And here is another popular boilerplate: [https://github.com/chentsulin/electron-react- boilerplate](https://github.com/chentsulin/electron-react-boilerplate)

</comment><comment><USER10> Nice - I do a lot of 2-4h small projects and every month I waste time upgrading my boilerplate. I'll test this, but I love the concept.

Feature requests: \- react-router \- optionally, bootstrap \- easy to build & push on github (e.g., default configure with /#/ urls

<comment><AUTHOR> Thanks! I'll definitely look into react-router / bootstrap.

And that's the same reason I built this - I have a lot of electron apps I want to build, but no quick starting point. I'm glad it's something others are finding useful as well!

</comment></comment><comment><USER11> wallpaper: [http://static.simpledesktops.com/uploads/desktops/2015/03/21...](http://static.simpledesktops.com/uploads/desktops/2015/03/21/coffee- pixels.png)

</comment><comment><USER12> I'm not a user of any of those stacks, but I love the name! :)

<comment><USER13> Sounds like a stack Reggie Watts would create.

But then there is the node/js fronted community to one up everyone.

Does your stack manage complexity, or add too it... Why is such a stack necessary. I bet you don't even ARIA bro...

<comment><USER14> The current state of js libraries may be a bit unfortunate and often frustratingly complex to manage. That's no reason to get all snappy though – the rails stack has about the same number of components, they're just integrated more tightly.

</comment></comment></comment><comment><USER15> This looks like a nice OSx app as webapp development stack.</comment>


Google exec: Hell no we're not paying anyone to use Google - <AUTHOR> http://www.alleyinsider.com/2008/5/live_google_execs_at_goldman_sachs_conference

<comment><USER2> How will they compete with microsoft?</comment>


NASA 1981 Space for Women (Narrated by Ricardo Montalban) - <AUTHOR> http://www.youtube.com/watch?v=LgQscL-ialg <comment><AUTHOR> 23:30 "Man needs something to dream about" Anna Lee Fisher.</comment>


Cloud Run – Newest member of our serverless compute stack - <AUTHOR> https://cloud.google.com/blog/products/serverless/announcing-cloud-run-the-newest-member-of-our-serverless-compute-stack <comment><USER2> To Google people, do you have any suggestions for startups how to start using your services for production workloads and: 1) Not having to take the $250 monthly fee per dev that needs to be able to contact you. Just increases the start cost massively for your services.

2) Not having to worry about being hell-banned and not being able to restore your account with Google, such as "guilty-by-association" for devs in PlayStore/gApps etc trickling over to closing down the whole account. We have read so many of those stories here on HN lately that I'm terrified to use Google for anything business related as we run the risk of losing everything.

The Cloud Run product looks great and would love to use it but the above two issues makes it a no go for us.

<comment><USER3> Have you reached out to: [https://cloud.google.com/developers/startups/](https://cloud.google.com/developers/startups/)

They should be able to give you a pretty large chunk of credit (I assume it'll cover support as well). It should also give you folks to contact and help prevent the latter issue.

<comment><USER2> Thanks, however, it seems limited to 12 months only, which is usually the initial prototyping phase of a product prior to launching. Also, feels strange to have to be in some type of program and beg for mercy with a contact person in order to alleviate the extremely strange behavior of permanent cancellation by algorithms. What if the contact person we have gotten to know have moved on to a different business etc? Feels unreliable.

<comment><USER4> I can understand the concern about getting your account banned, but: if after 12 months, your startup can't afford $250/month for support, you probably have bigger problems.

To put it another way: do you think the level of support that Google would be able to provide is less valuable than a few percent of an engineer's salary?

<comment><USER2> Google support seems to charge per person, so suppose you are a few persons, ie at least 3 sharing the support then it's $750/month. Also, you are assuming US salaries, when looking at many other countries $250 is upwards 10% of the salary. Google support is valuable, but, going with AWS for example is a lot cheaper. Now, if you are a VC-backed or otherwise funded company, then this is a non-issue, but there are hundreds of thousands of businesses that have a total spend on infra that would be less than the support fee from Google.

</comment></comment></comment></comment></comment><comment><USER5> I'm so excited about the App Engine updates. I'll be signing up for the Ruby 2.5 run time to replace Heroku in our stack.

> Today, we are announcing support for new second generation runtimes: Node.js > 10, Go 1.11, and PHP 7.2 in general availability and Ruby 2.5 and Java 11 in > alpha. These runtimes provide an idiomatic developer experience, faster > deployments, remove previous API restrictions and come with support for > native modules. The above-mentioned Serverless VPC access also lets you > connect to your existing GCP resources from your App Engine apps in a more > secure manner without exposing them to the internet.

<comment><USER3> Posting here as well in case folks aren't reading the other thread: [https://cloud.withgoogle.com/next/sf/sessions?session=SVR209](https://cloud.withgoogle.com/next/sf/sessions?session=SVR209)

</comment></comment><comment><USER3> Hey folks, one of the Cloud Run PMs (along with @steren, @ryangregg, @lindydonna, @stewart27, and others).

We're super excited to announce Cloud Run and Cloud Run on GKE, both implementing the Knative Serving API. Please let us know if you've got any questions!

<comment><USER6> Hello, I had a question about how Cloud Run handles security between containers being run on the cloud.

I assume my container runs alongside other containers on the same host, how do you prevent privilege escalation exploits?

<comment><USER7> Cloud Run engineer here.

Containers are run in gVisor [https://github.com/google/gvisor](https://github.com/google/gvisor) as the container sandbox.

</comment></comment></comment><comment><USER8> From a developer perspective, deploying a docker container with a plain http server is much more appealing than the hoops you have to jump through to use the lambda custom runtime stuff. I hope this gets AWS to provide a docker on lambda option.

<comment><USER9> > AWS to provide a docker on lambda option

isn't that AWS Fargate?

<comment><USER10> Yes and no--Fargate is a Docker container which runs on an ECS cluster that you don't have to manage, sure, but it doesn't scale down to zero. As far as I know, there's no support for running an HTTP endpoint and then having the container start in response to a request coming in. You could build that yourself (although I suspect it would require running some long-lived infrastructure, defeating the purpose of scaling the Fargate service down to zero) but I think the cold start times for a Fargate container would be prohibitive--maybe it gets better once you've already scaled up, but in my exploration I've seen Fargate take 45-70 seconds to run a new container. I suspect this is due to Fargate running in your VPC and therefore probably requiring a network interface to be created before the container can be ready.

The exciting part of Cloud Run for me is not that I don't have to manage a Kubernetes cluster, but that I don't have to pay for it when my service is sitting idle.

<comment><USER11> Looks like AWS Faragate pricing is per invocation and duration of tasks.

> Pricing is per second with a 1-minute minimum. Duration is calculated from > the time you start to download your container image (docker pull) until the > Task terminates, rounded up to the nearest second.

[https://aws.amazon.com/fargate/pricing/](https://aws.amazon.com/fargate/pricing/)

<comment><USER10> A "task" in ECS means a container. In Fargate, in order to be ready to receive requests 24/7, you have to pay to have a container running 24/7\. In that sense, it feels a lot closer to EC2 than it does to Lambda.

</comment></comment></comment></comment></comment><comment><USER12> [https://cloud.google.com/run/docs/reference/container- contra...](https://cloud.google.com/run/docs/reference/container-contract)

Details the contract your container must meet to run on the service and limitations you might run into

Quite a nice document to be fair.

Would be interested in hearing what use cases people would use this for, over say Cloud Functions or AWS Lambda. I'd imagine the flexibility of being able to run anything that supports HTTP is quite attractive.

One thing I did spot though is the container instance is limited to one vCPU, I wonder if people will hit performance ceilings? For lambda they abstract the CPU allocated based on the memory tiers, I'm not sure if this is the same though

<comment><USER13> Oh! It's great documentation, sucint, clear, to the point...

</comment></comment><comment><USER14> FYI - thread from yesterday around the docs and concept: [https://news.ycombinator.com/item?id=19610830](https://news.ycombinator.com/item?id=19610830)

This appears to be the accompanying blog post. So, not a dupe and explains the higher level goal here. The post from yesterday, was before the product was actually publicly released, if that gives more context as to why this is new news.

<comment><USER14> FYI - I just posted a review video where I walk through Cloud Run doing some demos. Check it out at: [https://sysadmincasts.com/episodes/69-cloud-run-with- knative](https://sysadmincasts.com/episodes/69-cloud-run-with-knative)

</comment></comment><comment><USER15> Serverless with gRPC would be awesome. There's grpc-gateway, but native support would be even better.

Surely it won't take long - the product itself has a gRPC API: [https://cloud.google.com/run/docs/reference/rpc/](https://cloud.google.com/run/docs/reference/rpc/)

<comment><USER3> Streaming HTTP and gRPC support is on our roadmap, but it's still a ways out :(

On the comment about how the control plane APIs support gRPC: the serving infrastructure for the data plane is pretty different from the control plane, so it's unfortunately not a direct map to supporting gRPC on the data plane.

Another possible solution is to run an API gateway that does gRPC to JSON conversion and have that invoke your service.

<comment><USER15> Unary gRPC calls would cover all of my uses cases that would benefit from this product. Is that any closer on the roadmap?

<comment><USER3> My understanding is that the major issue we have is with streaming (sticky sessions to backends that are autoscaling is tricky), so I assume that unary would be easier. I admit that I haven't dived too deeply in to this though.

EDIT: looks like we could do unary gRPC if gRPC wasn't only supported on HTTP/2\. So the current implementation basically requires we solve sticky sessions/streaming.

</comment></comment></comment></comment><comment><USER8> What does "Cloud Run on Google Kubernetes Engine" mean? Is there anything beyond the idea that a plain docker container can run on Cloud Run or on GKE?

<comment><USER16> Product manager for Cloud Run on GKE here.

Cloud Run on GKE brings a managed experience for Knative/serving and Istio that aligns with Cloud Run. We install and manage the Knative version in your cluster and keep it running for you. Above what you get with base Kubernetes ability to deploy a container, Cloud Run on GKE gives you request-based auto- scaling of container instances, network programming with Istio, and Stackdriver integration for logging, monitoring, and metrics. You also get the Cloud Run UI and CLI to deploy, manage, and update your services.

One of our core goals with Cloud Run is to enable serverless portability; not just for workloads, but tooling and developer experiences. By offering Cloud Run in both a hosted and Kubernetes platform, both enabled by Knative, you can leverage compatible serverless tooling and knowledge across the range of platforms from hosted to GKE to k8s anywhere.

<comment><USER17> Does this mean that by using Cloud Run GKE I can also leverage the primitives provided by Istio and Knative Serving?

<comment><USER3> Cloud Run on GKE is Knative (which relies on Istio) installed on your GKE cluster, and updated by us. So yes, you can go and muck around with lower level Istio/K8s primitives, but only to a point (there are places where you can break Cloud Run on GKE if you configure things particular ways). Over time we're working on making those actions more clear and ensuring that you get all the benefits of the Istio mesh built in, plus the ability to reconfigure to suit your needs (e.g. adding Istio RBAC like we have with Cloud IAM on Cloud Run).

<comment><USER17> Gotcha! So, things like adding Knative eventing which uses serving should be fine while using Cloud Run?

</comment></comment></comment></comment></comment><comment><USER18> Thanks Google cloud team this looks really great. Quick question: Is Cloud Run a zonal or regional resource and is there any way to put this behind the global load balancer? Thanks.

<comment><USER3> It's regional (and currently only in `us-central1`, though more regions are on the way). We're working on GCLB integration.

<comment><USER18> Great good to know. Thanks.

</comment></comment></comment><comment><USER19> We at Cloudrun [0] are excited to try Cloud Run for scaling our platform! :)

[0] [https://cloudrun.co/](https://cloudrun.co/)

<comment><USER20> While listening to Cloud Run on Spotify [https://open.spotify.com/artist/4gCabDwZ2AdhrBYYWQT9t2?si=tL...](https://open.spotify.com/artist/4gCabDwZ2AdhrBYYWQT9t2?si=tLvYL0EmRW28ylJ-D2ZU7g)

</comment></comment><comment><USER21> Is there info on cold start times for various languages, or configurations? Lambdas, for example, are pretty slow starting if they need connectivity into a VPC, or use Java.

<comment><USER22> I'm also curious about cold start performance, latency.

<comment><USER3> Wanted to drop in and say that I've seen this and am looking for any data that we're willing/able to share on our internal benchmarks.

</comment></comment></comment><comment><USER23> For hosting a Firebase app, with the hosting rewrites (like: [https://firebase.google.com/docs/hosting/cloud- run](https://firebase.google.com/docs/hosting/cloud-run)), what regions is this available in?

Is it just us-central?

<comment><USER3> Currently just `us-central1` since that's the only region Cloud Run is supported in.

</comment></comment><comment><USER22> Can Cloud Run work with GCP Memorystore (managed cache)? Also, one limitation of GCP cloud functions was the ability to communicate directly to a private network VM, although a solution is in beta I think. Does Cloud Run have this limitation?

<comment><USER3> We'll be adding VPC Connectors to Cloud Run shortly, which will let it talk to Memorystore. As you mentioned, they went Beta for GCF and GAE today.

</comment></comment><comment><USER24> I have so many batch jobs that run on GCE. Can I run some of them on Cloud Run? I can only run HTTP services now. My use case is very similar to AWS batch.

Currently, I use GCE with create-with-container and Cloud scheduler to manage batch loads.

<comment><USER20> Cloud Scheduler can trigger a Cloud Run service. And this Cloud Run service can run anything, including bash scripts. Take a look at the "Shell" tab in [https://cloud.google.com/run/docs/quickstarts/build-and- depl...](https://cloud.google.com/run/docs/quickstarts/build-and-deploy)

</comment></comment><comment><USER25> It would be really really amazing if it allowed a large number of CPU cores. Like 64 cores. That would make it interesting for ML inference workloads.

<comment><USER20> For 64 cores, I recommend leveraging custom machine types with Cloud Run on GKE. We are working on more CPU sizes for Cloud Run, but not in a near future for more than 2 vCPUs.

<comment><USER25> But users want the per-second billing and fast cold start times too.

I understand this is kind of a hard CS problem and is basically rooted in needing to move a lot of data around very quickly, all while making the software low latency as well.

But solving these is kind of the point of a FaaS.

Otherwise we could just run containers on VMs and autoscale ourselves. With terrible cost and cold start times.

Maybe look at how Jelastic does it for a unique take on this. [https://jelastic.com/public-cloud-pricing/](https://jelastic.com/public- cloud-pricing/)

This is probably the model that would make users the happiest.

Having poked a bit at how Jelastic does it, it seems they drop a pool of users on a 32-core machine and load balance the users containers with live migration to less utilized machines.

Imagine GCP doing something similar. Drop a big pool of users onto 96 vCPU instances. If an instance starts to get overutilized, live migrate some user containers to a new instance.

Same type of thinking that is probably behind AWS Lambda: how do you satisfy bursty workloads for a lot of users cost effectively? Pool the users. Assume they won't all burst at once.

That has got to be one of the biggest benefits to large public cloud computing.

<comment><USER26> Pooling already happens, AFAIK. On AWS at least you have to pay extra to not be pooled with other customers (ie. for exclusive use of a physical machine, regardless of your VM type).

</comment></comment></comment></comment><comment><USER22> Is there support or integration for the new GCP web application firewall/security product?

<comment><USER3> I might have missed a product announcement today, but is this Cloud Armor ([https://cloud.google.com/armor/](https://cloud.google.com/armor/))?

If so, no, though we're working on supporting Cloud Armor, CDN, Load Balancing, etc.

<comment><USER22> Yes, thanks, Cloud Armor is what I meant.

</comment></comment></comment><comment><USER27> Finally a serverless technology that is actually serverless to the developer ($0 when idle).

</comment><comment><USER28> Any ETA on being able to access Cloud SQL from Cloud Run containers?

</comment><comment><USER22> Curious if websockets, sticky sessions are supported?

<comment><USER3> Not on Cloud Run, though you can do this on Cloud Run on GKE.

There are some interesting billing implications of persistent connections (e.g. we don't know what's going on in that session [if there's traffic or not]), so we'll likely have to bill you the entire time the connection is open.

</comment></comment><comment> w-m "Traditional serverless offerings come with challenges such as constrained runtime support and vendor lock-in. [...]"

I'm quite aware that there's a technology hype cycle in web development, quickly replacing last year's fad. But whoever came up with the idea of putting the words `traditional` ("following or belonging to the customs or ways of behaving that have continued in a group of people or society for a long time without changing") and `serverless` together is taking this to a new level of ridiculousness.

<comment><USER3> Five years is a long time in a world where front end frameworks seem to change every six months ;)

Kidding aside, how would you suggest we re-phrase this to make it clear that we think that arbitrary Docker containers + conformance to the Knative spec (which you can run anywhere) is a clear differentiator?

<comment><USER15> There's a whole section on "Enabling portability with Knative" and even though I only skimmed the page, I got the message that this is an open standard just like Kubernetes.

As for running regular Docker/OCI containers, I would put more emphasis on how awesome this is for developers:

It's just regular HTTP in Docker containers. You can debug and develop this locally without mocking anything, and it's the same code that runs in production!

And it's all open source. No need to install a Lambda emulator that is almost, but not quite, like the real thing.

I never even considered using AWS Lambda due to the lock in and how annoying it is to work with, but this is something I'll evaluate (by trying it on my local k8s cluster).</comment></comment></comment>


Aerosolve – A machine learning package built for humans - <AUTHOR> http://airbnb.io/aerosolve/

<comment><USER2> The logo is ~= Airbnb logo.

edit: ooops. Went to the repo/noticed the url. Disregard :x</comment>


Data: WSJ's "News Alert" Spam Out of Control Since News Corp Acquisition - <AUTHOR> http://themetricsystem.rjmetrics.com/2009/06/08/the-wall-street-journal-news-alert-swaps-qualty-for-ad-inventory/ Some hard data on the increased frequency of ad-supported "WSJ News Alert" e-mails since the sale of Dow Jones to News Corp.  Are paying subscribers being sold out for e-mail ad inventory? <comment><USER2> Can we please stop pretending that the new WSJ bears any resemblance to the old one?

The top WSJ editor already "resigned" shortly after the acquisition and the shift in content is completely unmistakable. <http://www.reuters.com/article/ousiv/idUSN2245129320080423>

Why do we still give so much weight to the brand even when we know that the management is completely new?

<comment><USER3> Because almost all the reporters and lower level editors remain the same and they're the ones with the greatest impact on the product?

<comment><USER2> Depends what sort of impact we are talking about. Lower level staff cannot make decisions on what stories to follow, where and when the stories are run and under which headlines, or the general editorial bent of the paper. The tone and the quality of the copy writing at WSJ remains impeccable, the content, not so much.

</comment></comment></comment><comment><USER4> Let's not confuse the editorial page with the news reporting. The WSJ is a remarkable paper, one of the best in the world, when it comes to news reporting. This has not changed with the new ownership. The op-ed page has a well-developed political worldview that you may not agree with, but HN is not the forum for political discussions. There are so many sites for that already. Political discussion is the ultimate eternal September, and HN is so good and useful right now. It would be a shame if it were ruined by politics.

</comment><comment><USER5> It's not spam if you're paying for the privilege.</comment>


How We Were Traced On Silk Road's Black Market - <AUTHOR> http://www.forbes.com/sites/andygreenberg/2013/09/05/follow-the-bitcoins-how-we-got-busted-buying-drugs-on-silk-roads-black-market/

<comment><USER2> What a bullshit headline. Fuck you Forbes.

</comment><comment><USER3> The main part is here

"Despite what Meiklejohn was able to prove about Bitcoin's traceability, the experiment also shows the limits of tracing those underground transactions. Once our bitcoins had been mixed up with other users' bitcoins in the Silk Road's 40 bitcoin account, it became impossible to track them further. So even though Meiklejohn could show that we had deposited bitcoins into a Silk Road account, she couldn't see that those bitcoins were later paid to a drug dealer"</comment>


Naming Database Tables: Is It Person, Peoples, Persons or People? - <AUTHOR> https://the.agilesql.club/2019/05/should-i-pluralize-table-names-is-it-person-persons-people-or-people/?ut=hn <comment><USER2> I don't think whether the names are plural or not actually matters. What matters is that a style is chosen and used consistently.

<comment><AUTHOR> Consistency is king :)

</comment></comment><comment><USER3> The only problem with singular nouns for table names is that they occasionally conflict with SQL keywords. The canonical example of this is from the TPC-H benchmark which has tables named REGION, NATION, SUPPLIER, CUSTOMER, PART, PARTSUPP, LINEITEM ... AND ORDERS <\- plural because ORDER is a SQL keyword.

I like the singular guidance for all the reasons given. I like the consistency guidance. But the real world sometimes gets in the way.

<comment><AUTHOR> true but using [] fixes that, and they can be added by tooling

</comment></comment><comment><USER4> The thing that I get annoyed by is when the columns don't match the table names so something like:

create table people(person_id int)

This literally drives me to distraction and I want to throw my computer out of the window :)

<comment><USER5> According to my CS professor it's

      create table person(id int)

According to Rails it's

      create table people(id int)

Both agree on how to name the primary key. Person_id would be redundant.

<comment><AUTHOR> I prefer person and person_id because when joining to to other tables it is easier (in my head) to join person_id to person_id than person_id to id

<comment><USER6> Have you tried creating an alias in your statement(s)? Using `AS` to make this explicit may further help. Just a suggestion.

<comment><AUTHOR> yes but it is still an akwardness i prefer to avoid by using tablename_id like you'd have to do something like

"select id as tablename_id, * from table"

just doesn't feel quite right to me personally

</comment></comment></comment></comment></comment><comment><USER7> The hardest thing in IT is naming things :D

</comment><comment><USER8> it's a people table with person ids.

</comment><comment><USER9> How do you name:

\- an API endpoint

\- an array

\- a computer folder

\- a paper folder

<comment><USER10> Not just api endpoints, what about URLs which are used by laypeople without English fluency?</comment></comment>


What the Fox Knows - <AUTHOR> http://fivethirtyeight.com/features/what-the-fox-knows/ <comment><USER3> Seems like a great blog rollout strategy in general - every section already has several posts (not sure if they are manually backdated or what) - <USER2> could easily spend your whole afternoon on the site, which seems great for "launch day" and way more effective than "The blog is launched! Tune in next week when our actual content starts rolling in".

Just a quick glance seems to indicate this will become a staple in my RSS list and a great complement to my current favorite non-tech blog (Grantland).

<comment><USER4> Hopefully it has a more reliable RSS feed than Grantland, which I've basically stopped getting updates from (I switched to monitoring Twitter for it).

<comment><USER5> Do they even have a feed? I've been trying to find it on their site, and if they have one it must be pretty well hidden...

<comment><USER3> [http://feeds.feedburner.com/Grantland](http://feeds.feedburner.com/Grantland)

<comment><USER6> It's on WordPress.com now, so just find what you want to RSS ingest and add feed/ to the end of it. Case in point; if you want all of Down Goes Brown:

[http://grantland.com/contributors/sean- mcindoe/feed/](http://grantland.com/contributors/sean-mcindoe/feed/)

It might not work for everything, but it should work for a lot of things.

</comment></comment></comment></comment></comment><comment><USER7> It takes a long time to get to the great ending.

 _We are going to screw some things up. We hope our mistakes will be honest ones. We hope you'll gain insight and pleasure from our approach to the news and that you'll visit us from time to time. We hope to demonstrate the value of data journalism as a practical and sustainable proposition.

It's time for us to start making the news a little nerdier._

</comment><comment><USER8> For anybody else in this field, I would caution you against accepting this knowledge as canon:

> And news accounts routinely estimate the number of attendees at political > rallies.

In my experience, news organizations _routinely_ over-estimate the attendance of events to which the reporter sympathizes, and dramatically under-estimates the attendance of events to which the reporter does not.

As someone who attends a lot of rallies encompassing both 'left' and 'right'-leaning movements, I can say that I've witnessed this first hand. I attended an event in Annapolis to oppose some gun control measures last October. The attendance, by my count, was nearly 4,000. I can prove by the testimonial registry that we had over 1400 people not only in attendance, but that provided testimony before the legislature. At the same event, those in favor of the rally were protesting as well. They had, by my count, a few dozen supporters in attendance. Their testimonial registry was exactly 22.

The Baltimore Sun and Washington Times reported attendance for both camps at 'about equal', which a 'few hundred in attendance for either side'.

When protesting in support of the fourth amendment, or in support of free speech rights for the media, those numbers were conversely inflated.

<comment><USER9> These claims don't pass a 3 min google test. Baltimore Sun:

 _The governor 's testimony before the Senate Judicial Proceedings Committee came after at least 1,500 gun-rights advocates rallied outside the State House in opposition to the legislation...

Meanwhile, advocates on either side of the issue packed the hearing room and an overflow room downstairs. Hundreds more stood in a line that extended down a stairway to the floor below.

Legislative aides said they had never seen such an outpouring of people seeking to testify on a bill. By an overwhelming number, they were signing up in opposition to the governor's proposal._

[http://articles.baltimoresun.com/2013-02-06/news/bs-md- omall...](http://articles.baltimoresun.com/2013-02-06/news/bs-md-omalley- guns-20130204_1_assault-weapons-gun-control-gun-buyers)

<comment><USER8> This[1] was the most egregious article I can find with my own 3 minutes of Googling, though I admit that it can be read in a way that presents the information without bias, though I think some of the ambiguity is intended to mislead.

"Hundreds testify for, against proposals on assault weapons, licensing" is a sort of true statement, except that exactly 22 is not hundreds.

I remember more biased reports from the time, but I can't find them now. So while there's some validity to your point, I've seen it happen enough to say confidently that those estimates are best-guess estimates, and those estimates are subject to bias.

[1] [http://www.washingtontimes.com/news/2013/feb/6/gun-rights- ad...](http://www.washingtontimes.com/news/2013/feb/6/gun-rights-advocates- swarm-annapolis-fight-omalley/?page=all)

</comment></comment></comment><comment><USER10> If the NCAA bracket model is an indication, Nate Silver does not intend to disclose the _actual_ model used to make his predictions, just like his election models. He tells you what elements he's mixing but not how.

I expect he will also continue to fail to quantify the performance of his models against other benchmarks. In the case of the NCAA how much value does his more complex model add compared to each of the rankings he uses as inputs alone?

<comment><USER11> He does state he's going to be releasing code on GitHub. We'll see how much that is.

</comment></comment><comment><USER12> > _Our logo depicts a fox (we call him Fox No. 92) as an allusion to a phrase > originally attributed to the Greek poet Archilochus: "The fox knows many > things, but the hedgehog knows one big thing." We take a pluralistic > approach and we hope to contribute to your understanding of the news in a > variety of ways._

As commenters pointed out in an earlier New York Mag article ([http://nymag.com/daily/intelligencer/2014/03/nate-silver- int...](http://nymag.com/daily/intelligencer/2014/03/nate-silver-interview- fivethirtyeight-espn.html)) and that Silver alludes to via hyperlink, the "hedgehog vs. the fox" quote could be interpreted as coming out in _favor_ of the hedgehog:

[http://en.wikiquote.org/wiki/Archilochus](http://en.wikiquote.org/wiki/Archilochus)

> _The fox knows many tricks; and the hedgehog only one; but that is the best > one of all._

I think if 538 had picked a hedgehog as its mascot, it would still make sense: it's the pundits/prognosticators who have "many tricks", whereas Silver is proposing just one _good_ trick -- empirical data analysis -- which happens to be effective and valuable in all contexts.

<comment><USER13> Nate Silver discusses the Fox/Hedgehog division in his excellent "The Signal and the Noise" frequently, and he largely takes on the meaning proposed by Phillip Tetlock in his book on expert political judgement.

The idea that Tetlock puts forward is that pundits divide into two categories, Foxes and Hedgehogs. Hedgehogs explain the world and make predictions according to one large all encompassing principle. Foxes don't, and apply different principles to different circumstances. Tetlock concludes, and Silver endorses this, that Foxes are better at understanding the world than Hedgehogs.

An example might be the (proposed) principle that free markets lead to increased prosperity. A hedgehogy capitalist might state the above as a broadly applicable principle. A foxy capitalist might opt for something like: "yes, many times increased freedom makes us prosper, but sometimes it doesn't, it depends, let's talk about the specifics".

I take this to be an argument about complexity. The fox side of the argument is roughly that the world is more complex than most people allow for, and one principle or world view will usually not cover an area of knowledge well.

<comment><USER14> >I take this to be an argument about complexity. The fox side of the argument is roughly that the world is more complex than most people allow for, and one principle or world view will usually not cover an area of knowledge well.

I don't think there is a clear division between those two. Both, the fox and the hedgehog use only one view– their own to seperate signal from noise. The fox side is just more open to integrating conflicting point of views into their worldview.

What I mean to say is that in the end both use only one trick, one skill- filtering information. This of course doesn't mean that the metaphor is wrong, just that it's wrong to think that the fox doesn't filter information the same way the hedgehog does.

BTW, this reminds me of something from Laozi "Through what do I know the nature of all things? Precisely through them." While the things are many, the principle of understanding them through themself remains singular.

<comment><USER15> I really find this type of verbal meta- rearranging to be incredibly unhelpful. It reminds me strongly of arguments that atheism is a religion, or that abstaining from a choice is a choice. It's a kind of word-lawyering that never improves my understanding, only muddying the meaning in the previous formulation. Perhaps it's just me.

<comment><USER14> Considering the (lack of) alternatives I fear that using language to argue about meaning in language is the best I can do :S.

But seriously, I think talking about what _exactly_ something is meant to represent isn't "lawyering", it's essential for a serious discussion. I got another quote, too: "The boundaries of our language are the boundaries of our thoughts".

Telepathy would propably be better though, I agree.

<comment><USER15> Let's reduce the fox's many points of knowledge down to a single principle, to make him more symmetrical with the hedgehog. Ok, why?

<comment><USER16> Chunky bacon, of course.

</comment></comment></comment></comment></comment></comment></comment><comment><USER17> Google cache version: [http://webcache.googleusercontent.com/search?q=cache:http://...](http://webcache.googleusercontent.com/search?q=cache:http://fivethirtyeight.com/features/what- the-fox-knows/)

</comment><comment><USER18> Is this site working for anybody? It's been down all morning for me despite others seemingly able to access it.

<comment><USER19> I wonder if this is some kind of DNS issue. My coworkers seem to be having no problem with it - but Chrome can't find it on Starbucks wifi.

<comment><USER20> The DNS is a bit... scattered. [https://www.whatsmydns.net/#A/fivethirtyeight.com](https://www.whatsmydns.net/#A/fivethirtyeight.com)

</comment></comment></comment><comment><USER21> His bookcase is organized by color? I'd never be able to find a single book in my library if I did that.

<comment><USER22> I organize mine by size, so I have my own version of crazy.

<comment><USER23> Spine size or cover font size?

<comment><USER24> It could be height (I used to do that as a kid).

<comment><USER25> My bookshelf has adjustable heights and putting all the tall books together means I make the best use of space.

<comment><USER23> Come to think of it I do that too. Ikea Ivar shelves!

</comment></comment></comment></comment></comment></comment><comment><USER26> I've been out of town recently so I've stayed in a few hotels with cable. I don't have cable in my apartment back in DC.

Something I noticed last night while watching ESPN is that they must have mentioned FTE a dozen or so times within an hour. Are they backing FTE? I even saw an interview on ESPN with one of the cofounders.

<comment><USER27> Yes, ESPN's the corporate parent of 538

[http://www.nytimes.com/2013/07/20/business/media/nate- silver...](http://www.nytimes.com/2013/07/20/business/media/nate-silver- blogger-for-new-york-times-is-to-join-espn-staff.html?_r=0)

</comment></comment><comment><USER28> I KNOW what the fox knows.</comment>


Researchers Find Way to Steal Encrypted Data  - <AUTHOR> http://www.nytimes.com/2008/02/22/technology/22chip.html?ex=1361336400&en=5d2aceefa521e4eb&ei=5090&partner=rssuserland&emc=rss&pagewanted=all

<comment><USER2> Good story, but a misleading headline. Note the headline is perfectly correct, researchers did, in fact, find a way to steal encrypted data. . . for certain, particularly structured implementations, without remote access to the machine immediately after its been powered down with the keys in DRAM.

Everybody panic, I guess?

</comment><comment><USER3> _standard memory chips actually retain their data for seconds or even minutes after power is cut off_

Okay, so they have to perform their new technique right after the password enters memory. That is less practical than other methods, for instance recording the sound of someone typing and then decyphering the password based upon keys' sound signatures.

<comment><USER2> Totally agree. There a number of threats that are possible and WILDLY unlikely that are far more tenable concerns than this one.</comment></comment>


Linux Mint Dumps Ubuntu Snap - <AUTHOR> https://www.zdnet.com/article/linux-mint-dumps-ubuntu-snap/ <comment><USER3> I can understand Canonical pushing for snaps. It's their product and they want it to succeed.

That said I hate their dirty ways. I find it even morally wrong. How can "sudo apt install chromium-browser" not install the apt package but install instead a snap? How I, as a user and also as a professional, trust Ubuntu if when I use their package manager I'm being tricked?

I don't use Windows for a reason, more than one actually. I've been using Ubuntu even with all the "weird" stuff Canonical has been doing over the years but I think this is the nail in the coffin.

Right now I'm using 20.04 but as soon as I finish some work I have left I'll install a fresh new distro.

<comment><USER4> What distro? I use Ubuntu because I just want an OS, not a hobby.

<comment><USER5> Just use Debian. Ubuntu is quite literally Debian+bullshit.

<comment><USER6> My issue with Debian that I don't want a rolling release, and Debian Stable feels more like "Debian Obsolete" to me (at least it was years ago, maybe now it is different...)

<comment><USER7> Debian testing is basically my distro of choice: if sid is the rolling release, and stable is the LTS version, testing is roughly equivalent to non- LTS Ubuntu: the packages have been tested so you don't usually get breakage, but they aren't stale.

<comment><USER8> The packages are somewhat tested, but "you are participating in the development of Debian when you are tracking testing or unstable" [1]. My feeling is Debian testing is a little less stable than non-LTS Ubuntu.

See, I'd like to use LXDE, and right now I use Lubuntu. I'm interested in switching to Debian, but then I read someone say Debian testing is "more stable than the name would suggest, as long as you follow a few reasonable best-practices" [2]. Then I look at these best practices [3] and I'm like, I don't really have time for all that...

But maybe that person is just overly cautious. So I look at Debian's page [1] for best practices and it wants me to use btrfs or LVM snapshots in case an update puts the system into an unrecoverable position. I... don't think I have time for that.

Maybe I can use Debian stable and just get software not available in Debian stable via... snap [4]. Ok, they also list Flatpak and docker, but this is getting frustrating... Is that really the best way to go about this? Because other than snap auto-updating on my machines behind my back, Lubuntu's been working great up to now.

So basically, is there a Ubuntu / Lubuntu that just doesn't have snap auto- updates? If anyone knows, I'd really appreciate it!

[1]: [https://wiki.debian.org/DebianUnstable#What_are_some_best_pr...](https://wiki.debian.org/DebianUnstable#What_are_some_best_practices_for_testing.2Fsid_users.3F) [2]: [https://news.ycombinator.com/item?id=23038222](https://news.ycombinator.com/item?id=23038222) [3]: [https://news.ycombinator.com/item?id=23044878](https://news.ycombinator.com/item?id=23044878) [4]: [https://wiki.debian.org/DontBreakDebian#Snap](https://wiki.debian.org/DontBreakDebian#Snap)

<comment><USER9> > My feeling is Debian testing is a little less stable than non-LTS Ubuntu.

At least a few years ago, Ubuntu's LTS releases were derived from Debian Testing, while Ubuntu's standard releases were derived from Debian Unstable.

<comment><USER8> Oh, didn't know that. That gives me a better sense of "how stable" each is. Thanks!

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER10> I dumped Ubuntu over Snap. Maybe I'm just ignorant but it seems like allowing developers to push software updates without any review invites the same sorts of issues we've seen on npm, with very high risks for certain use cases. I don't want that kind of relationship with my OS, forced updates are why I ditched Windows in the first place.

Aside from the philosophical concerns I ran into a lot of glitches with various snap packages, frequently resulting in lost or corrupted data. And the sandbox approach prevented certain filesystem tweaking I previously took for granted. Overall I didn't see the benefit and didn't have time to futz with it.

I'm curious if there are any distros with a recent version of Gnome and also a sane package manager.

<comment><USER11> > forced updates are why I ditched Windows in the first place

Samsung has followed suit w/ Android. Once an update is available, the user can defer it three times before the phone is rebooted. Not even Apple pulls this crap.

<comment><USER12> As a short term solution, you can use netguard and always have it run in lockdown mode. It works on most phones and doesn't require root. You can use it to whitelist app access to the internet (inc. blocking samsung and google play updates). It's also open source.

In the long term, just avoid samsung products that don't respect your authority as the owner.

</comment></comment></comment><comment><USER13> Hundreds of organizations, including ours, rely on Rocket.Chat for their internal messaging. It all went down when a release was pushed and snap decided to auto-update [1] I can imagine it resulted in a huge loss of productivity at all these orgs in the Covid era.

Just learnt from this thread that apt-install will install snap! I'm running Ubuntu 18.04 + i3 (Dell Developer Edition) but will change to Debian.

[1]. [https://github.com/RocketChat/Rocket.Chat/issues/17628](https://github.com/RocketChat/Rocket.Chat/issues/17628)

<comment><USER14> You can control when to update, [https://snapcraft.io/docs/keeping-snaps-up- to-date](https://snapcraft.io/docs/keeping-snaps-up-to-date)

<comment><USER15> Would someone be able to tell me how to plain old turn it off? I still can't tell even after reading the docs

<comment><USER16> You can turn it off by replacing your operating system with another Linux distribution. As of 20.04 you also still have the option of removing Snap outright[1], as long as you don't need the software that is only provided via snap.

Although apparently they are considering[2] adding the option to disable auto- updates.

[1] [https://news.ycombinator.com/item?id=22972661](https://news.ycombinator.com/item?id=22972661) [2] [https://forum.snapcraft.io/t/re-visiting-update-control- on-t...](https://forum.snapcraft.io/t/re-visiting-update-control-on-the- desktop/17170)

<comment><USER15> Thanks, I did this on my 20.04 systems and it worked fine. Simply uninstall snapd. I lost LXD (no way I'd use this now anyway if its distributed via snap), and chromium browser (but discovered the far superior Ungoogled version anyway)

</comment></comment></comment></comment></comment><comment><USER17> This appears to be an unpopular opinion, but I like snaps and Canonical's philosophy in some ways mimics that of Apple's where they care about usability over configurability.

Snaps have been my preferred method of installation for a few years now. I really like how I know where the files are being installed to and if I uninstall the software it will be removed cleanly. I also like how for most software snaps contain the latest release of the software which has not been my experience with distro specific apt repos. I can even install beta, nightly or previous releases very easily using snap store channels. I've never experienced any package manager on any OS that has made it this easy.

I've also developed about a half dozen snaps, some of them were open source contributions to existing software, others were my closed-source projects and one was some contract work for a third party who wanted to snap their existing software for easier distribution. And although there were some pain points, I found the process and YAML based manifest file to be far better than most tools.

My only gripe with snaps at this time is that there is no system like PPAs so if you want to use snaps for your privately distributed app then you need to do it through Canonical and more advanced control features will cost you extra.

<comment> lame-robot-hoax I like the idea of Snap, but Flatpak seems to be a much better implementation.

<comment><USER14> snapd does much more.

<comment><USER18> yeah and it does all of it behind your back without asking

</comment></comment></comment></comment><comment><USER19> The main reason why I use Linux for some of my work is reproducibility. A docker image with the same apt packages installed in it will work the same every time.

Snap breaks this. A snap package can update itself whenever it wants and then you the user are just screwed when things don't work together anymore. So in effect, snap breaks the main benefit of Linux for deployment and the reason why I use Linux in the first place.

Every since they started with ads and affiliate links, I've been sceptical of Ubuntu. But Ubuntu 18 is still used as the base image for many docker deployments. I predict that this will change with Ubuntu 20, exactly because the snaps have made Ubuntu 20 unusable for reliable docker deployments.

I'm glad that mint is stepping in to provide a viable alternative.

<comment><USER14> There are keys to control when these snap updates will happen, [https://snapcraft.io/docs/keeping-snaps-up-to- date](https://snapcraft.io/docs/keeping-snaps-up-to-date)

It is immutable systems that help you with reproducibility.

There is no actual change between the snapd setup in Ubuntu 18.04 and Ubuntu 20.04. Where do you get info on unreliable docker deployments?

It looks to me that the dislike is emotional in nature.

<comment><USER20> Can I stop one snap from updating (for example indefinitely), while letting the rest update?

<comment><USER14> I could not find a key for that, that is, per-package keys.

A dirty workaround would be to get the `.snap` package from the store, then install directly from the local file.

           $ snap download hello-world
           Fetching snap "hello-world"
           Fetching assertions for "hello-world"
           Install the snap with:
              snap ack hello-world_29.assert
              snap install hello-world_29.snap
           $ snap install hello-world_29.snap --dangerous
           hello-world 6.4 installed
           $ hello-world
           Hello World!
           $

No updates.

</comment></comment></comment></comment><comment><USER21> It's interesting how many distros built on top of Ubuntu are explicitly dropping snaps or throwing their support behind flatpaks:

\- Linux Mint

\- ElementaryOS

\- Pop!_OS

Take a hint, Canonical. You guys made some great strides towards being less silo'd by dropping Unity and Mir in favor of vanilla GNOME + Wayland, but you're still all-in on snaps for some reason. Are the handful of proprietary software companies that want an easier installer for Linux really worth it?

<comment><USER14> This polemic attitude is really bad for open-source.

Snap packages are good, and such efforts may help get the Linux desktop rise over the 3%.

Lenovo announced they are fully supporting Ubuntu desktop for two lines of computers.

<comment><USER21> Okay...so? Lenovo also announced they're going to certify some laptops for Fedora as well:

[https://fedoramagazine.org/coming-soon-fedora-on-lenovo- lapt...](https://fedoramagazine.org/coming-soon-fedora-on-lenovo-laptops/)

If you're suggesting that we all need to rally behind everything Canonical does because Ubuntu has the best shot of propelling Linux into the mainstream, I would say that's all the _more_ reason to hold them accountable for decisions that the Linux community finds unpopular. Many don't like snaps. Don't _force_ snaps on us through duplicitous means like the chromium installer. Why is that bad for open source?

<comment><USER14> Lenovo, in their announcement, they start by saying that they made the move because the Linux desktop stands at 2.7%. And they want in, in this 2.7% market. If the Linux desktop becomes a 5% market, or a 8% market, then it will open the floodgates to other companies offering support to desktop Linux.

Source: [https://news.lenovo.com/pressroom/press-releases/lenovo- brin...](https://news.lenovo.com/pressroom/press-releases/lenovo-brings-linux- certification-to-thinkpad-and-thinkstation-workstation-portfolio-easing- deployment-for-developers-data-scientists/)

What I see on HN is perpetual bitching and anti-Ubuntu sentiment. As if the Linux desktop is a zero-sum game. One wins and the rest are gone. In the harsh reality, if the Linux desktop gets like 5% or more, it will signal other companies to start supporting.

The chromium issue has been around since October 2019, [https://snapcraft.io/blog/chromium-in-ubuntu-deb-to-snap- tra...](https://snapcraft.io/blog/chromium-in-ubuntu-deb-to-snap-transition) Ubuntu cannot support a deb package because Chromium is huge in their dependencies and cannot provide timely updates. Therefore, there is only a snap package. And, what happens if the end-user tries the chromium browser? The system transparently installs the snap package instead of presenting an essay to explain the full background.

Is it so difficult to say respectfully, "everyone do your thing to increase the marketshare of desktop Linux so that it eventually opens the floodgates of support".

You cannot increase the Linux desktop marketshare by staying within the 2.7% of the Linux desktop. You just need to attract new Windows users, not steal Ubuntu users.

<comment><USER22> Ubuntu definitely done a lot of good. 6.06 LiveCD and Theme, installation in Windows partition, these we good.

A lot of people recommended Ubuntu and that I believe is a problem. I got it wrong too. Ubuntu does a lot of experiments on its users - Pulse Audio, Unity, now Snaps. Each time a lot of fuss. It means technology is not ready.

It would be fine if rolled in separate distribution Exbuntu (experimental Ubuntu) and rolled to masses once feature becomes popular, but no. Those who listened to my recommendation would see bugs and _that_ is zero-sum game.

But we can easily resolve it - recommend no nonsense distros - Linux Mint, ElementaryOS, Pop!_OS, Debian. And that's already happening on this page. Ubuntu may even encourage that. Everyone would be happy.

So what is wrong with silent snaps Chromium install? Those who use apt are sophisticated enough to chose. And "issue has been around", have you red The Hitchhiker's Guide to the Galaxy? "But the plans were on display…"

> You just need to attract new Windows users, not steal Ubuntu users.

That's gross. Have you red what people say? Those who switched to Linux because of such moves from Microsoft. I'm fine with Ubuntu destroying itself. I do not use it. No one steals Ubuntu users, that's Ubuntu who destroy its userbase.

</comment></comment></comment></comment></comment><comment><USER23> > Mint never shipped snapd, Snap's daemon program or any snaps, but moving > ahead, in Linux Mint 20, "Chromium won't be an empty package which installs > snapd behind your back. It will be an empty package, which tells you why > it's empty and tells you where to look to get Chromium yourself." Further, > APT will forbid snapd from installing.

Can't they just replace the Chromimum package with the one in Debian?

<comment><USER24> Not sure if they could, but:

Then they would need to review all Ubuntu packages for snap injection and overlay them. Sure that might be doable automatically but is a bit brittle.

It also means the user wouldn't learn what is going on.

<comment><USER23> They are already doing a special case for Chromimum to tell the user why its empty and where to get it. Instead they could provide a working copy based on the debian deb package.

<comment><USER24> I understood it so that they are blocking snap generally instead of doing pretty package special handling.

</comment></comment></comment></comment><comment><USER25> snap has problems that exist for years.

It will upgrade a running application without telling the user. Then it will remount all folders in use by the running application in read only mode. As such, your chromium will start misbehaving, crashing, extensions will start failing, it won't save cookies or remember tabs after restart. DBeaver won't be saving your .sql scripts. Snap developers think users are precogs. That users without any foreshadowing will close application before snap silently upgrades it behind the scenes.

Also Snap does really weird things as a container. I run multiple VPNs each within own network namespace. So something as simple as :

as root: ip netns exec myVPN chromium fails with execv failed: Permission denied

Both of these problems exists for years.

<comment><USER14> Snap support is evolving.

There are keys to configure when, and if, you get updates, [https://snapcraft.io/docs/keeping-snaps-up-to- date](https://snapcraft.io/docs/keeping-snaps-up-to-date)

The total Linux desktop installation base is around 2.7%. Without automation, the Linux desktop does not look like it will attract any significant number of Windows users.

<comment><USER26> Please correct me if I'm wrong, but one cannot hold off updating the snaps indefinitely. Thus there is no "if".

One gets a maximum of 60 days, that is all. Through a snap proxy it's possible to hold off longer, but then the proxy needs to talk with the snap store periodically.

Why people are upset is, I believe, that Canonical forces people to accept any and all changes to the installed software, without being able to guarantee perfect backwards compatibility for _all_ upgrades. Obviously, neither Canonical nor anyone else can make that kind of promise for _all_ software out there.

Canonical should not force updates on people; let people take care of backwards compatibility; let users turn the auto-update on and off and allow users also to freeze package versions (and their system configuration), if the users so please.

Also, not sure I understand the point about automation. There is automation already today in Ubuntu through autoupdating .deb packages. It is nothing inherently new in Snaps.

One problem with measuring Linux desktop installation base is that Linux users are often the people who turn off telemetry, call-home, employ DNT, run ad blockers, run third party script blockers, and so on. I wonder how much this skews the results.

<comment><USER14> Lenovo cited NetMarketShare for the stats on the desktop Linux, [https://news.lenovo.com/pressroom/press-releases/lenovo- brin...](https://news.lenovo.com/pressroom/press-releases/lenovo-brings-linux- certification-to-thinkpad-and-thinkstation-workstation-portfolio-easing- deployment-for-developers-data-scientists/)

You can "snap download" and "snap install" to bypass any updates.

</comment></comment></comment></comment><comment><USER27> We've only had problems with snap so far, constantly. Kudos to Mint for doing the right thing for their users.

<comment><AUTHOR> It's actually worked well for me. But, I never want to see a program on my Linux boxes automatically running root over a network connection for any reason without my specific say so, never mind just to install Chromium.

</comment></comment><comment><USER28> Many applications packaged under Snap are still unusable on Fedora and Arch because Snap has a bug that renders tofu characters (□□□) instead of text:

[https://forum.snapcraft.io/t/snapped-app-not-loading- fonts-o...](https://forum.snapcraft.io/t/snapped-app-not-loading-fonts-on- fedora-and-arch/12484)

I'm not sure whether Linux Mint is also affected by this issue, but it's clear that Canonical doesn't perform quality assurance for Snap on any Linux distribution other than Ubuntu.

<comment><USER14> The discussion pinpoints the issue in the fontconfig cache files. It is being worked on. The issue is not "snap packages only show tofu characters" but rather in some cases snap packages cannot access the system fonts, hence the squares.

<comment><USER28> This bug has not been addressed for almost a year, which is completely unacceptable when the Snapcraft homepage advertises that "Snaps work across Linux on any distribution or version."

[https://snapcraft.io/](https://snapcraft.io/)

</comment></comment></comment><comment><USER29> I've been using Mint now for several years and been satisfied with it. I was afraid that the Ubuntu's snap mishegas would force me to move elsewhere, but this is the message I was hoping to hear from the Mint team.

<comment><USER14> The Mint maintainer was really unprofessional in his announcement. It is OK to feel strongly about something, but using words like `backdoor` is really bad.

With snap packages you get companies like Microsoft to deliver a native package for Skype, Jetbrain to deliver their whole developer portfolio, Spotify their music thing, etc. They can do so because they are basing the work in a common, stable runtime.

<comment> yjftsjthsd-h > It is OK to feel strongly about something, but using words like `backdoor` > is really bad.

Okay, but... It _is_ a backdoor. A user trying to install a deb get snap shoved down their throat.

> They can do so because they are basing the work in a common, stable runtime.

And none of that requires taking control from the user.

</comment></comment></comment><comment><USER30> Snap for me means Firefox suddenly says "I won't open a new tab until you update me and I will drop all tabs on restart". It also means cached content and configs in many new obscure places. It doesn't mean any visible improvement so far. So hey, kudos Mint and hey, Ubuntu stop that already.

<comment><USER31> Firefox does that in debian stable. but it's supposed to restore your tabs like they were

<comment><USER32> That should only happen if you update from underneath it by doing an upgrade though, which is entirely at your discretion with apt. The snap equivalent is obligatory.

That said, the update auto-restore almost always works in my experience. I've been running the nightly channel for a while (which updates once or twice a day) and it rarely eats tabs.

</comment></comment></comment><comment><USER33> My number one complaint about Snaps is that they're not portable (despite being labelled "universal packages for Linux"): they start to work less well outside of Ubuntu, and they don't work at all unless you're running systemd. I find this slightly ridiculous given that Flatpaks really do work more universally - they don't require systemd - and they come out of Red Hat - <USER2> home of systemd.

<comment><USER14> snapd is a service, therefore it requires an init system.

<comment><USER33> So? systemd isn't the only daemon-manager.

<comment><USER14> Is the question whether snapd require an init, or whether snapd should be packaged to work with more init systems?

<comment><USER33> The point is that a "universal packages for _Linux_ " system shouldn't have a hard dependency on systemd in particular. systemd isn't Linux.

</comment></comment></comment></comment></comment><comment><USER34> Ubuntu 18.04 LTS is currently super popular for servers. Any thoughts on whether 20.04 is a worthy upgrade for servers, or just a pain? Snaps in particular sound good for desktops but not servers.

<comment><USER35> There are definitely snaps that are useful on servers, like LXD and Nextcloud.

<comment><USER36> Having them auto update and restart _daemon_ services are not good for servers though.

<comment><USER35> I disagree. I like having Nextcloud auto-update, even if it results in a service restart. I just schedule that for a time of day that isn't very disruptive. As for LXD, restarting the LXD daemon doesn't effect the containers (they continue running).

<comment><USER36> It's about having a choice though.

<comment><USER35> Oh hey, I get it. That wasn't the point of the parent to which I was responding, though. I was merely trying to share that snaps are just as useful for server as for desktop, that's all.

</comment></comment></comment></comment></comment></comment><comment><USER37> I personally don't packaging apps in a sandbox, its a violation of the basic idea of writing tools that do one thing well. Still, snap gets lots of flack, but I don't see the same for flatpak. Is there some advantage to flatpak that I am missing, or is it just than Ubuntu has pushed snaps too hard?

<comment><USER38> It sounds like the objection isn't technical -- sandboxed apps are perfectly fine -- but rather to how Canonical is trying to change package behavior alongside the transition. Specifically, they're forcing you to use them for some packages behind the scenes, and restricting what you can do with those packages as a result:

> "In the Ubuntu 20.04 package base, the Chromium package is indeed empty and > acting, without your consent, as a backdoor by connecting your computer to > the Ubuntu Store. Applications in this store cannot be patched, or pinned. > You can't audit them, hold them, modify them, or even point snap to a > different store. You've as much empowerment with this as if you were using > proprietary software, i.e. none. This is in effect similar to a commercial > proprietary solution, but with two major differences: It runs as root, and > it installs itself without asking you."

<comment><USER14> The Mint maintainer went out of his way to react in bad faith.

The chromium transition was announced in October 2019, [https://snapcraft.io/blog/chromium-in-ubuntu-deb-to-snap- tra...](https://snapcraft.io/blog/chromium-in-ubuntu-deb-to-snap-transition)

Ubuntu was not able to maintain chromium as a deb package, and chromium is not the default browser in Ubuntu. Therefore, it has been packaged as a snap package. Since there is no longer an apt package, what should happen when you "sudo apt install chromium-browser"? The usable decision was to install the snap package of Chromium instead, [https://snapcraft.io/blog/chromium-in- ubuntu-deb-to-snap-tra...](https://snapcraft.io/blog/chromium-in-ubuntu-deb- to-snap-transition)

The snap package of Chromium has been in testing for two years already. The snap package page is [https://snapcraft.io/chromium](https://snapcraft.io/chromium) You can view the installation log, with the list of operating systems that have installed it.

</comment></comment></comment><comment><USER39> Pop OS [1] does something similar. Based on Ubuntu, but replaces snap with flatpak. You can apt-get packages like chromium from their PPA [2].

I'm very pleased with their developer centric approach. They also apply very nice UI tweaks, a tiling WM and a useful set of gnome extensions. Loving it.

[1] [https://pop.system76.com/](https://pop.system76.com/)

[2] [https://launchpad.net/~system76/+archive/ubuntu/pop/](https://launchpad.net/~system76/+archive/ubuntu/pop/)

</comment><comment><USER40> From reading the other comments, people just don't like having security updates done automatically - they'd like to have more control when they are performed.

Kind of like in Windows, where your computer suddenly shuts down to apply a service pack while you were in the middle of an important World of Warcraft raid that you were planning for weeks.

There's always a trade-off between keeping your system secure and being available. Most people don't like to trade off availability, and it makes sense.

<comment><USER41> I've seen more than one twitch streamer going into a big stream, get screwed by this. Of course, they _should 've_ known. But we've all made that mistake during a demo or presentation at some point or another.

Worse yet, when you update ahead of time and drivers or other parts of update are incompatible. Stable configurations are important to a lot of people.

<comment><USER40> Completely understandable. It would be great to have more control over how and when the updates are run.

</comment></comment></comment><comment><USER42> While I'm not super up on these newfangled app distribution systems, I've had mostly negative experiences with both Snaps and Flatpaks.

As someone that administrates a small handful of workstations and a server or two, I just don't get what these tools buy me. It seems that usually installing an application via one of these methods has negative externalities (e.g. some things not working out of box, like access to user file, or ability to play audio), or most often the applications simply don't work at all.

If snaps were able to work properly out of the box, they could be good if they reduce the work for the packagers. That said, I've burned enough of my time trying to debug broken snaps that I won't entertain ever using them again.

I guess if it works for someone else's use case though, that's nice. However it sure seems pretty grubby to install a snap when the user clearly intended to install an DEB package via aptitude.

I will say, I've had very positive experiences with AppImage. I haven't really dug into the technical details of how these different approaches work yet, since I haven't had any reason to, but every AppImage I've wanted to use has always worked perfectly.

<comment><USER14> The chromium transition from deb to snap has been discussed here (Note: October 2019)

[https://snapcraft.io/blog/chromium-in-ubuntu-deb-to-snap- tra...](https://snapcraft.io/blog/chromium-in-ubuntu-deb-to-snap-transition)

Ubuntu could not maintain a deb package, and keep it up to date. Therefore, there is only a snap package. When you try to install with `apt`, you get chromium installed transparently instead of getting a message that describes what I already explained. The breakage would be bad if there was nothing installed when you did a "sudo snap install chromium-browser".

AppImages are monolithic images, with no or minimal protection of your computer. I think they are the equivalent of the Windows packages in the 90s and 00s, that were distributed with CDs with little idea where they came from.

</comment></comment><comment><USER43> Users who like both can use both (Mint and Ubuntu any flavor). If you don't want to use Snaps in Ubuntu, you can just uninstall snapd (first thing I did). EOL.

Mint had already pretty-much committed to flatpak years ago, so this came as no surprise. Clem's said there'll be a way to install Chromium. Tempest in a dongle.

</comment><comment><USER44> I noticed that Mint is working on LMDE which uses Debian as its base directly without using Ubuntu; I wonder if this is one of the reasons motivating that project and what the other reasons are.

</comment><comment><USER45> > It's more empowering developers to get their packages into users' hands very > fast. They don't need to worry about the distribution."

And this is why it's a double edged sword. I like packages to be validated by maintainers. I don't want a new Telegram app update every day. Just now it broke and I have to wait until the developer pushes the new build to the snap repo.

It's like it's suddenly okay that everything needs to be rolling release.If I want that, I'll use arch.

</comment><comment><USER46> I have found flatpaks to be much better (they are much faster to startup), except that flatpak doesn't have an unconfined or "classic" mode like snaps. THis is especially annoying if you wanted to install vscode to access the system compiler, python, etc.

<comment><USER47> I am planning to develop a solution to this VSCode issue soon - there are basically two ways to make it work:

1\. Using platform or app flatpak extensions, one can plugin compilers and runtimes so they are available inside the sandbox.

2\. One can add shims that launch programs outside the sandbox using _flatpak- spawn --host_.

</comment></comment><comment><USER48> On that matter: did the snaps finally fix the situation where you had some of your mounts in non-standard places and you could not open files from there due to security settings?

</comment><comment><USER49> Tip: if you're wondering what SNAP apps are already installed in your system:

      ls -l /var/lib/snapd/snaps

<comment><USER14> You can also

        snap list

or have a look into `/snap/`.

The directory `/var/lib/snapd/snaps/` shows the cached .snap packages, including the recent versions in case you want to revert to a previous version.

</comment></comment><comment><USER50> Manjaro with Xmonad is a nice desktop.

</comment><comment><USER51> While I understand the concerns over Snap, you can't blame Canonical for trying, because lets be honest, rpm/deb packages are a mess.

I see in the comments a complaint that you don't want the developers upgrading their apps whenever they want ... really? Because that's my number one complaint for debs/rpms too. You can't install specific versions, you can't install multiple versions side by side and installing a newer version of one package can break your system due to its dependencies. Snaps can't possibly be worse than this and they aren't.

And on the server-side I understand wanting to review each updated package, but on your laptop, how often does one do that anyway?

For the general population automatic upgrades are a net win. The same moaning happened when Firefox switched, following Chrome, to automatic updates and fast releases and people now love that, including me. You trusted the app developers as soon as you installed that app on your computer with full privileges. And most apps don't have reproducible builds, even if the app is open source, trusting the binary you're installing is also a leap of faith. Unless the OS can sandbox that app, installing any app is about trust in a brand and faith. And debs aren't sandboxed.

When I switched to MacOS, 6 years ago, I missed Ubuntu's repository, I hated Homebrew, I hated installing apps by copying them from volumes mounted from .dmg files. But not anymore. I rarely have issues now. Experience could be improved of course, I sometimes want versioning, I want reproducible environments, which is why I'm experimenting with Nix (see [https://nixos.org/](https://nixos.org/)). The first thing I did on a fresh Ubuntu 18.04 LTS box, couple of months back? I searched for "Firefox Developer Edition" and failed to find a PPA for it or a beta channel that seems to be up to date.

Speaking of which, people complain about Snap being insecure, however I've never seen an Ubuntu/Debian workstation that doesn't make use of insecure PPAs.

Also packaging apps via DEB files is hard. I tried building DEBs for my server-side apps, but unless the process is automated via tools that are not language/platform agnostic, I found it hard, with documentation severely lacking.

\---

This is one big reason for why Docker is now the preferred distribution mechanism for self-hosted apps on Linux servers. It's very easy to create a Dockerfile and the result won't infect your system with crap.

I have yet to try out Snaps, maybe some of the critiques are warranted, but it can't possibly be worse than the status quo. The only problem, a major one, is that yet again we've got no agreement between vendors. But that's sadly the Linux ecosystem, a genuine Tower of Babel.

<comment><USER52> > You trusted the app developers as soon as you installed that app on your > computer with full privileges.

No, I don't.

First, most apps' code won't run as root. Only install scripts, written my distribution's maintainers, run as root (except for core applications, of course).

And secondly, I trust app developers to write their app properly (to a certain extent), but not to write install scripts that won't mess with my system, because it's outside their domain of expertise.

<comment><USER53> On a personal computer, you are giving a whole lot of trust to anything you run un-sandboxed as your normal user - it will likely have access to your most interesting files, browser cookies, maybe saved passwords. XKCD covered it years back: [https://xkcd.com/1200/](https://xkcd.com/1200/)

This brings up another drawback of deb/rpm packaging, though: you _need_ root access to install anything. I'm not sure about Snap, but Flatpaks can be installed and used by an individual user.

<comment><USER14> If you first run

          snap login

then you can install snaps without "sudo". I suppose it is the same process with flatpaks.

<comment><USER53> Good to know. Flatpak doesn't have a separate step, but there's a --user option for the install command.

</comment></comment></comment></comment></comment><comment><USER54> down w/ canonical

</comment><comment><USER55> Thank you Mint

</comment><comment><USER56> Snaps are a poor solution for the problem apt already solved years ago.

<comment><USER14> "apt" packages are handmade. And they depend on hand-made dependencies. It becomes increasingly difficult to maintain packages like chromium, because they have too many dependencies, that have to be packaged individually.

The "universe" repository has tens of thousands of packages. Do you know that a majority of them are not maintained because it is too much effort and not many helping hands?

<comment><USER56> So we have an automation problem. Building packages is needlessly inconvenient and the few hands we have are overwhelmed by the number of packages that need maintaining.

And we "solve" it by allowing the inclusion of different, incompatible, versions of packages into even bigger packages. Sorry, but that's not a solution. It's the technical debt equivalent to payday lenders.</comment></comment></comment>


Here is what I do when a prospect will not buy - <AUTHOR> http://www.jslogan.com/heres-what-i-do-when-a-prospect-wont-or-cant-buy/

<comment><AUTHOR> There are no silver bullets to making a sale or growing revenue, but there are best practices and simple things that can make a difference. This post offers something simple and obvious that can turn a loss into a new opportunity and a win. It's happened for me more than once.</comment>


Comparing Kubernetes Service Mesh Tools - <AUTHOR> https://caylent.com/comparing-kubernetes-service-mesh-tools/ <comment><USER2> Not really a comparison on performance or metrics, just a bunch of blurbs on the different tools available. Pass.</comment>


Fear and Loathing at Effective Altruism Global 2017 - <AUTHOR> http://slatestarcodex.com/2017/08/16/fear-and-loathing-at-effective-altruism-global-2017/ <comment><AUTHOR> Wow, the captions, I am laughing so hard right now.

I found this domain in an HN comment, and am _really_ enjoying it. Spending too many hours here!</comment>


Mysterious Magnetic Pulses Discovered on Mars by InSight - <AUTHOR> https://www.nationalgeographic.com/science/2019/09/mars-insight-feels-mysterious-magnetic-pulsations-at-midnight/ <comment><USER2> I am always surprised when an article makes the top 20 without any comments. It helps me realize how much I value the comments.

</comment><comment><USER3> tl;dr: The InSight lander, which touched down in Nov'18 has found that the planet's magnetic field sometimes starts to pulsate in ways that have never before been observed, e.g usually at local midnight. The cause is currently unknown.

If you want to dive deeper here's the paper: [https://meetingorganizer.copernicus.org/EPSC-DPS2019/EPSC- DP...](https://meetingorganizer.copernicus.org/EPSC-DPS2019/EPSC- DPS2019-838-1.pdf)

<comment><USER4> The fact that the phenomenon is associated with local midnight implies that it is not a geophysical effect, but connect to the interaction of the solar wind with the planetary magnetic field.

This is also what the paper you linked said: "We speculate that the observed magnetic pulsations by InSight to date are associated with fluctuations in the induced magnetotail and on the magnetospheric boundary."

So unless a researcher has a bright idea the next step is to run high resolution 3d hybrid-kinetic simulations of the Martian magnetosphere and play with the upstream solar wind conditions to see if they can make the oscillations show up in simulations. But that is not exactly easy or (computationally) cheap. But if we are lucky there will be new insights in time for the AGU meeting in December.

</comment></comment><comment><USER5> TMA-1

<comment><USER6> EPMA, Elysium Planitia Magnetic Anomaly

</comment></comment><comment><USER7> Paywall. But I got as far as to see there are signs of deep subsurface water.

<comment><USER8> "While the team can't yet pinpoint an exact depth, they think it wouldn't be any deeper than 62 miles."

</comment></comment><comment><USER9> Thus Spoke Zarathustra

<comment><USER9> No one else thought of 2001 and the Tycho Magnetic Anomaly?</comment></comment>


Show HN: ownCloud-ready image for RaspberryPi based on Raspbian - <AUTHOR> http://www.owncloudbook.com/owncloud-on-raspberry-pi/

<comment><USER2> Thank you very much for this owncloud-ready image! Unfortunately, this confirmed that OwnCloud has a problem with accentuated characters and Mac OS X (and that my custom installations of OwnCloud where not at fault).

Any upload from a Mac of a file or folder with German or French accents hangs (doesn't matter if done thru web drag'n drop or client software). The file is actually uploaded if one leaves enough time. But one need to kill the process (e.g. force quit the page), as OwnCloud doesn't recognize the end of the process.

As per what I have read, it seems Mac OS has a different handling of UTF-8 (the rest is too technical for me).

I am sure this image will be very helpful for many people (it took literally 1 minute to setup, instead of an hour for a complicated install from scratch). But for someone dealing with non English language and Mac OS X, it seems OwnCloud still has a problem unfortunately. To me, this is still a no go unfortunately (either for me as a private person, or as a potential solution for my SMB).

</comment><comment><USER3> Is ownCloud "ready" for use in an SMB environment?

I have a customer network it would be perfect in (I think): ~15 users, spread across two buildings in two cities with typical broadband connections. There's a definite need to be able to share files between the two offices but Windows filesharing... well, sucks. E-mail ends up being the medium used 95% of the time.

The current plan is to get everyone on the same Windows/AD domain, put in a fileserver at each site and use DFS to take care of everything behind the scenes.

It seems like ownCloud could be a viable candidate to replace that, with the added benefits of giving folks access to their data while out of the office/on the road/travelling/etc.

<comment><AUTHOR> ownCloud would be perfect for this case. Users can share files, have disk quotas to avoid misuse, share contacts and calendar events. If you want you can user ownCloud user management or integrate with AD or OpenLDAP. Both community and commercial support is also available.

</comment></comment><comment><USER4> My experience with using ownCloud on Raspberry Pi was a painful one of ridiculous waiting times and occasional crashes. Admittedly I did no optimisation at all, just defaults. How much performance can one expect out of this?

<comment><AUTHOR> To be honest, I won't say that you can run a lot of users on it and expect amazing performance. It is mostly for evaluation and hobby usage. I suppose that it would be good for 2-3 users. I am thinking of removing certain extra things that are running on it and create a lean image. Hopefully it'll improve the performance.

</comment></comment><comment><USER5> For an alternative cheap, easy owncloud deployment you could use Docker on a low end VPS for a few bucks a month: [https://github.com/Joeboy/dockerfiles](https://github.com/Joeboy/dockerfiles)

</comment><comment><USER6> Its fairly insane to use a setup like PHP under Apache that is slow even on fast hardware on a Pi. At least use something that performs ok, like OpenResty say...

<comment><USER7> Raw PHP performance (the bottleneck for this) isn't different between Apache and nginx. The only thing nginx excels at is handling a higher amount of connections, and lower memory usage. None of those apply here because ownCloud is a small single-user CPU-bound application.</comment></comment>


Power systems company to build world's first 1 GW energy storage project in Utah - <AUTHOR> https://arstechnica.com/science/2019/05/power-systems-company-to-build-worlds-first-1-gw-energy-storage-project-in-utah/ <comment><USER2> This 1 GW claim is nearly useless information. They should share the number of gigawatt hours instead.</comment>


Dean Kamen's High School Robotics competition looking for engineers/mentors - <AUTHOR> http://www.usfirst.org/default.aspx <comment><USER2> I'm a little pissed at my high school for starting a FIRST team the year after I left. I mean, we had sponsors for the years before that, but they would always back out last minute.

Man, this would have saved me a ton of money at WPI (you get a scholarship if you compete), but who knows I might even stay at Northeastern, seeing how much I love it.

</comment><comment><USER3> I did FIRST's smaller sibling in high school. Was a lot of fun.

<http://www.botball.org/></comment>