The Cornish beaches where Lego keeps washing up - <AUTHOR> http://www.bbc.co.uk/news/magazine-28367198 <comment><USER2> This happened with MSC Napoli in 2007 - there were stories of people scavenging motorbikes from containers!

[http://en.wikipedia.org/wiki/MSC_Napoli](http://en.wikipedia.org/wiki/MSC_Napoli)

And earlier this year too - cigarettes this time:

[http://www.falmouthpacket.co.uk/news/fpfalmouth/11031368.Cor...](http://www.falmouthpacket.co.uk/news/fpfalmouth/11031368.Cornish_smokers_on_standby__14_tonnes_of_cigarettes_wash_up_on_Devon_coast/)

I'm lucky enough to live in Cornwall and I'd never heard of the lego thing, very interesting!

<comment><USER3> I remember the Napoli too, went and had a look out of curiosity. Also not heard of this Lego incident! Of course shipwrecks, and even wreckers have an illustrious history down here.

<comment><USER4> I've visited Branscombe every year of my life - we've a family connection. It used to be a fairly quiet but known seaside location, but ever since Napoli it has been much busier. I assume it's all those people who went and had a look and decided it was a pretty place to visit...

</comment></comment></comment><comment><USER5> > No-one knows exactly what happened next, or even what was in the other 61 > containers,

WHAT?

I imagined every container to have tracking and identification numbers so the owners could know roughly where it is at all times; and so that various government agencies could prevent import of things not allowed in their countries. A quote a bit later on kind of supports that.

> She says the ship's manifest - a detailed list of everything in the > containers - shows a whole range of Lego items, not all sea-themed. After > all this time "it's the same old things that keep coming in with the tide", > particularly after a bad storm.

I'm surprised about how many containers are lost.

> About 120m containers carried on world's oceans in 2013

> 2011 survey by World Shipping Council estimated an average of 675 containers > lost at sea each year between 2008-10

> 2014 survey says average annual loss between 2011-13 was approximately 2,683 > containers

2,500 containers out of 120m is a small number, but still. How would you design a pinger suitable for shipping containers so that they could be located after being dropped overboard?

 __EDIT __I should have said that this pinger thing is just a thought experiment. Obviously most containers are no lost, and most of the ones that are are not toxic / valuable enough to bother with. (But thanks to the posters below)

<comment><USER6> _pinger suitable for shipping containers_

Locating things underwater is a tremendous pain because it's radio-opaque. So you have to spend a lot of energy on sonar.

Having a power source for such a thing is a tremendous pain: you want a lot of capacity and low self-discharge. Ideally the battery would be chemically or mechanically inactive until underwater. Compare for example the wet cells in the early radar anti-aircraft shells that were inert until fired out of a cannon. Doable, but it's not going to be cheap.

Also, it's going to be expensive to fish up the container, and the contents will generally be destroyed and worthless. Realistically this is only going to be worth it for (a) things too toxic to leave lying around or (b) gold.

<comment><USER7> I think it should ping when it's dropping, before it sinks, kind of like a Macbook does with mechanical hard drives.

Then sonaring it should be simpler, as we know the rough location.

</comment></comment></comment><comment><USER8> _Moby-Duck: The True Story of 28,800 Bath Toys Lost at Sea and of the Beachcombers, Oceanographers, Environmentalists, and Fools, Including the Author, Who Went in Search of Them_ [1] by Donovan Hohn is a great book about a container of toys lost in the Pacific in 1992 and their subsequent travels around the world.

Oceanographers have since learned about currents from tracing them.

[1] [https://en.wikipedia.org/wiki/Moby- Duck](https://en.wikipedia.org/wiki/Moby-Duck)

<comment><USER9> Amazon link for the lazy:

[http://smile.amazon.com/Moby-Duck-Beachcombers- Oceanographer...](http://smile.amazon.com/Moby-Duck-Beachcombers- Oceanographers-Environmentalists-Including/dp/0143120506)

</comment></comment><comment><USER10> This was a surprisingly relevant story for me - I'm just decompressing after a "Marine Hackathon" held over the weekend in Singapore [1]. It was an all-too- brief glimpse into the vast container transshipment business, and the operations of the enormous port here : The quantities of goods that flow through the port is amazing [2]. i.e. more than 1 20 foot container per second 24/7/365.

[1] : [http://www.upsingapore.com/smart-port- hackathon/](http://www.upsingapore.com/smart-port-hackathon/) [2] : [http://www.seatrade-global.com/news/asia/singapore-port- hand...](http://www.seatrade-global.com/news/asia/singapore-port- handles-326m-teu-of-containers-in-2013.html)

</comment><comment><USER11> Was I the only one that thought it was appropriate to place a photo containing a number of Lego life vests at the top of the article?

As a side note: Though a small fraction of the total transported, 675 containers a year floating around the ocean scares the bejesus out of me as an offshore sailor. The fact that many are partially submerged and flow with currents that are unpredictable makes the idea of crossing the channel quite harrowing for anybody without a steel hull.

<comment><USER12> The containers are dangerous. You should watch the film "All is Lost", it's about that exact scenario where it shipwrecks a solo sailing ship.

[http://imdb.com/title/tt2017038/](http://imdb.com/title/tt2017038/)

<comment><USER11> Yup - saw that one in the theaters. Unfortunately for anyone that has sailed before, Redford makes a bunch of incredibly stupid decisions-as-plot-devices. Here's an article that helps put the problem in perspective: [http://www.oceannavigator.com/March- April-2013/A-legendary-o...](http://www.oceannavigator.com/March- April-2013/A-legendary-offshore-danger/)

</comment></comment></comment><comment><USER13> side note: is the title correct grammar? As someone who grew up with "Legos" plural and subsequently had the correct "Lego" plural beat into me by the Internet, now this curveball.

Don't Lego "keep" washing up? Why would Lego "keeps" washing up? Is it an amorphous blob like an oil spill? Seems to me more like fish.

<comment><USER14> Usage seems to vary, but for me:

"Lego" (no preceding article) is a mass-noun for the stuff. It's not _really_ an amorphous blob, of course, but it's being thought of that way. Like "sand" even though sand is made up of grains. "Sand keeps turning up in my shoes after that trip to the beach." "Lego keeps washing up on the shore after that container ship sank."

I call the individual bits "Lego pieces" or "Lego bricks" or "Lego blocks" or whatever.

Some people call them "Legos", whose singular would be "a Lego" or something of the kind. In that case it would be "Legos keep washing up".

I have never seen "Lego" used as an actual plural count-noun: "There are thousands of Lego in that box". Either "thousands of Lego pieces" or "thousands of Legos".

(I confess that using "Lego" as a count-noun makes my inner pedant twitch. But language is defined by usage, and it may well be that by now it's correct.)

<comment><USER15> It's likely a trademark issue. A trademark is suppose to be an adjective (a Google search. A Lego brick.)

This is because a trademark identifies a specific source or producer of an item. If a trademark is used as a noun (Kleenexes, Trampolines) it is a step toward generic usage and loss of the trademark.

Hence, the Lego group would want you to talk about Lego bricks and Lego pieces, but everyone else is fine talking about Legos. (Except my autocorrect, which wants it to be Lego's)

</comment></comment></comment><comment><USER16> It very much reminds me of Glass Beach, near Fort Bragg California...[http://en.wikipedia.org/wiki/Glass_Beach_(Fort_Bragg,_Califo...](http://en.wikipedia.org/wiki/Glass_Beach_\(Fort_Bragg,_California\))

</comment><comment><USER17> Kernow bys verkeyn!

(Sorry I couldn't resist it. I never thought I'd see a story on here about my home.)

I've never heard to Lego story either, plenty of other things get washed up, but I've never seen or heard of Lego.

</comment><comment><USER18> If you thought all the rocks, seashell fragments, and hot sand made walking barefoot on the beach difficult before...

Certain ocean currents make some beaches more likely to accumulate interesting detritus than others, including Asian tsunami debris, lost shipping, and the occasional lonely shoe or boot with human foot remains still inside. That last one happens more often than you might think.

</comment><comment><USER19> Reminds me of when I was a kid on the coast of Maine. Rowed out to a small island and found scattered amongst the rocks over a large area hundreds of GI- Joe parts. Mostly just parts/broken pieces, as if someone put an entire collection inside a box and blew it up. Still to this day have no idea how or why those were there.

</comment><comment><USER20> Reminds me of the Hansa Carrier incident: [http://en.wikipedia.org/wiki/Hansa_Carrier](http://en.wikipedia.org/wiki/Hansa_Carrier)

The idea that a ton of lost sneakers helped to illustrate ocean currents blew my mind as a kid.

</comment><comment><USER21> I have seen plastic degrade significantly when left outside for just a year or so. How long will Legos last floating in the ocean? At least in a usable or recognizable form. Some of those pieces look pristine. And do animals eat them?

<comment><USER22> It depends on the type of plastic. Legos are made of ABS which is one of the most durable plastics, especially when it comes to outdoor conditions.

</comment></comment><comment><USER23> More people should see this as an alternative way of providing a solution.

[http://vimeo.com/58461689](http://vimeo.com/58461689)

</comment><comment><USER24> I thought lego was little rectangular bricks?

<comment><USER25> well yes, but they pieces aren't just bricks now. They have all sorts of special shape pieces, not to mention the Lego character accessories like flippers, swords, mugs etc etc.

<comment><USER26> But they still would mostly have the "universal snapping mount"?[1] I also had the feeling this wasn't legos, since that mount doens't appear.

(Ok, maybe not swords which go in minifigures hands.)

<comment><USER27> Everything pictured on that page can be connected to something else in one way or another. The lifejackets you put on by taking the dude's head off then on again. The "dragons" are missing the top part of their heads.</comment></comment></comment></comment>


The most popular programming languages in 2017 - <AUTHOR> http://www.tiobe.com/tiobe-index/ <comment><USER2> Go moving from 54th to 13th most popular is pretty astonishing.

I'm personally pretty happy with that, because for all its faults it does feel like a fun language to program in, for reasons I can't quite put my finger on.

I'm always a little surprised that Java is number one. I know it has a lot of enterprise support, but is there some bias in the survey here?

<comment><AUTHOR> I'm not sure if there's a bias in the results. But it seems that there shouldn't be any bias towards a particular programming language since they have an algorithm for computing the scores based on search queries on popular search engines like Google, Bing, Yahoo! etc.

> Go moving from 54th to 13th most popular is pretty astonishing. I second > that and although I've done a number of side projects using golang, if I > want to make a presentation of the language , I wouldn't quite know for sure > what are the best selling points.

I know it puts a great emphasis on concurrency and their model is rock solid and easy to reason about, but still, given that most of our work is web related and 95% of the time we have to manipulate various resources that persist to some database, I don't have a clear reason on why to choose go over php for example.

<comment><USER2> Well, php is still hugely popular. I think it's not an unreasonable choice (though I personally don't enjoy using it, I can see the business case).

Go feels like a much smaller, similar language though. For me, one of the key features of Go is that it's easy to refactor.

This comes partly from its lack of OO and other features, which are no doubt useful but often create more dependencies between different parts of a codebase.

In my personal programming style, I end up refactoring at lot, Go seems to make this easy.

It's naturally also possible to program like this in other languages. But Go seems to encourage and somewhat enforce it.

Due to a lack of easily abused language features I can also see it being a language well suited to teams where skill levels vary significantly.</comment></comment></comment>


Nexus One not getting Android 4.0 - <AUTHOR> http://www.marco.org/2011/10/26/no-android-4-for-nexus-one <comment><USER2> This isn't a performance issue. It's a limited storage issue. Of course, all these guys know that, too, but they pretend to not realize it so they can take yet another jab at Android.

But obviously, having only 512 MB of _total_ internal storage at the time was a bad strategic choice, and manufacturers did it to cut corners. And from what I hear iOS5 is running pretty slowly on iPhone 3GS.

<comment><USER3> iOS 5 seems to be running fine on 3GS. [http://9to5mac.com/2011/06/07/how- does-ios-5-run-on-iphone-3...](http://9to5mac.com/2011/06/07/how-does- ios-5-run-on-iphone-3gs-video/)

<comment><USER4> But they did have to cut features right? That's the whole point of the video you linked to (which I can't view for some reason). So they got some things, but didn't get others. Just like the Nexus One doesn't get the ICS launcher, clock widget, support for dual-cores & NFC chips (that it doesn't even have) or the new font but does get the very latest improvements to Google Maps, Youtube, and all these Google provided apps (most of which are available to 97.5% of Androids that visit the market, Maps to 98.9%, Google Translate 100% as it supports Android 1.5+):

<https://market.android.com/developer?pub=Google+Inc>.

And if the past is any guide, there will be newer and better apps added to that list shortly after they are previewed in the latest Android release, sometimes announced with very strict requirements but then later relaxed as features are backported e.g. the new Market that at first was 2.2+ only:

[http://androidcommunity.com/silent-update- brings-2-2-feature...](http://androidcommunity.com/silent-update- brings-2-2-features-to-android-market-on-eclair-devices-20101009/)</comment></comment></comment>


What should we teach new software developers? Why? - <AUTHOR> http://delivery.acm.org/10.1145/1630000/1629192/p40-stroustrup.html?key1=1629192&key2=1190626821&coll=portal&dl=ACM&CFID=104402275&CFTOKEN=58956171

<comment><USER2> Honestly, I'm not really sure what to make of this. As a CS student I definitely feel that there's a huge gap between the industry needs and what the academia supplies. However, discussing basic algorithms and data structures with my 'self-taught' friends makes me feel like I'm listening to a Wikipedia page that can't simply answer the question, "So how does it work?"

I feel that it's this basic understanding of 'quantitative and algorithmic thinking' that schooling instills in you that will allow you to think of new concepts instead of dwelling in the old.

However, I can't deny that there are times where my professors' downright frustrate me with their lack of simple programming skills, such as small syntactical things that anyone who actually programs would know like second nature. I guess it is true that I'm going to school to learn advanced concepts and not syntax, but that doesn't mean it doesn't make me doubt my schooling just a touch.

<comment><USER3> That's funny, I went to college just for the paperwork. I watched them teach the absolute fundamentals of programming but not how to -think-. The people that graduated with me couldn't come up with new ideas if their life depended on it. One guy even dropped out when he wasn't able to write a simple poll application.

On the other hand, I taught myself and I -can-. In fact, most of time I -was-. Turns out some of the ideas were really good and I'm just starting to see other people use them, and others weren't so good and I ended up scrapping them.

As far as syntax errors go, all programmers make them sometimes. Mistakes or typos, it doesn't really matter. A decent IDE will catch most of them, and proper unit testing will catch the rest.

<comment><USER4> _On the other hand, I taught myself and I -can-._

I suspect you have this reversed: you _can_ , so you teach yourself. In my experience this is true of most competent people. At best, high-level schooling can be a guide, and an excellent teacher can save us some time gaining insight. But by-and-large it's up to us to learn.</comment></comment></comment>


Ask HN: Where do you go for freelancers? - <AUTHOR> I've been asked to find an embedded software engineer for a short (4-6 weeks) project. Trying to weigh up getting a contractor through a recruitment agency to work in the office vs finding someone who can do the work remotely. Any good experiences with remote freelancers out there? <comment><USER2> Feel free to email me at tyler at Memfault dot com.

We have a list of contractors we've enjoyed working with. I can try to help pair you up based on the project description.

</comment><comment><USER3> Linkedin might work.

</comment><comment><USER4> upstack.co</comment>


John Carmack on Functional Programming - <AUTHOR> http://gamasutra.com/view/news/169296/Indepth_Functional_programming_in_C.php <comment><AUTHOR> Two quotes here that are really good:

 _A large fraction of the flaws in software development are due to programmers not fully understanding all the possible states their code may execute in._

 _No matter what language you work in, programming in a functional style provides benefits. You should do it whenever it is convenient, and you should think hard about the decision when it isn 't convenient_

</comment><comment><USER2> It's from 2012, should be in the title. Good read though.</comment>


Show HN: One click personal VPN server on DigitalOcean - <AUTHOR> https://github.com/dan-v/dosxvpn <comment><AUTHOR> This is a weekend project I started in light of the news that ISPs are now able to sell your browsing history. I'm not a huge fan of random VPN providers, and have been using a private VPS to run a VPN for a while now. I decided to turn it into an app that deploys a VPN server on DigitalOcean with automated OSX setup. The deployed VPN server includes automated updates of both the OS and VPN software, so you don't need to worry about managing a server. If you have OSX and a DigitalOcean account, grab the latest release here and try it out: [https://github.com/dan-v/dosxvpn/releases](https://github.com/dan-v/dosxvpn/releases)

</comment><comment><USER2> This is only for OSX right?

<comment><AUTHOR> Yes indeed. The majority of it could run on any system as it's written in Go, but the last portion dealing with VPN setup is OSX specific.</comment></comment>


Docker Is Raising Funding at $1.3B Valuation - <AUTHOR> https://www.bloomberg.com/news/articles/2017-08-09/docker-is-said-to-be-raising-funding-at-1-3-billion-valuation <comment><USER2> I feel like this is one of those valuations which makes sense contextually, but not based on any sort of business reality.

Docker reminds me a lot of the PKZIP utilities. For those who don't remember, back in the late 80s the PKZIP utilities became a kind of defacto standard on non Unixes for file compression and decompression. The creator of the utilities was a guy named Phil Katz who meant to make money off of the tools, but as was the fashion at the time released them as basically feature complete shareware.

Some people did register, and quite a few companies registered to maintain compliance so PKWare (the company) did make a bit of money, but most people didn't bother. Eventually the core functionality was simply built into modern Operating Systems and various compatible clones were released for everything under the sun.

Amazingly the company is still around (and even selling PKZIP!) [https://www.pkware.com/pkzip](https://www.pkware.com/pkzip)

Katz turned out to be a tragic figure [http://www.bbsdocumentary.com/library/CONTROVERSY/LAWSUITS/S...](http://www.bbsdocumentary.com/library/CONTROVERSY/LAWSUITS/SEA/katzbio.txt)

But my point is, I know of many many (MANY) people using Docker in development and deployment and I know of nobody at all who's paying them money. I'm sure they exist, the make revenue from somewhere presumably, but they're basically just critical infrastructure at this point and just becoming an expected part of the OS, not a company.

<comment><USER3> A nice selling point for me is the registry. If you have a public image, it's totally free. If it's private, you can pay to use it privately in a team. Of course, you can mount your own (it's a docker image, after all), or you can use Google or Amazon to host it, but it is much easier to pay them to host, and you don't need to bother with storage, backups, or authentication. Setting up team permissions is as easy as sending an invitation from the panel.

<comment><USER4> Where I work we've (relatively) recently migrated to using GitLab EE which comes with its own container registry[1]. I have no idea how much work it is behind the scenes from my perspective it has been flawless and much more convenient.

[1] [https://docs.gitlab.com/ce/user/project/container_registry.h...](https://docs.gitlab.com/ce/user/project/container_registry.html)

<comment><USER5> We've been using it where I work for a few months and have recently moved to Artifactory. Mainly because GitLab's registry makes it very very painful to remove old images, (you have to remove them from the UI one by one), especially when the number of registries and images grows.

<comment><USER6> We know that this is a real problem for many users. We plan to resolve it as soon as possible. For now you can use our custom tool that removes old revisions, see [https://gitlab.com/gitlab-org/docker-distribution- pruner](https://gitlab.com/gitlab-org/docker-distribution-pruner).

We also have a few issues about this, see [https://gitlab.com/gitlab- org/gitlab-ce/issues/25322](https://gitlab.com/gitlab-org/gitlab- ce/issues/25322) and [https://gitlab.com/gitlab-org/gitlab- ce/issues/20247](https://gitlab.com/gitlab-org/gitlab-ce/issues/20247).

I hope it helps!

</comment></comment></comment></comment></comment><comment><USER7> I'm so curious to understand how you pitch Docker at a 1.3BUSD valuation. With I assume a potential valuation of ~10BUSD to give the investors a decent exit?

Does anyone have an insight into this?

Looks like Github's last valuation was at 2BUSD. That also seems high, but I can understand this somewhat better as they have revenue, and seem to be much more widely used/accepted than Docker. In addition to that I can see how Github's social features are valuable, and how they might grow into other markets. I don't see this for Docker...

<comment><USER8> In 2007 we used to rack hardware. Like physically open boxes, rack hardware with Ethernet cables. In 2014 I don't think a startup existed trying to use physical machines - it was all aws,etc. We then would use all this BS like puppet, salt, chef, etc to manage all the chaos (devops). Now 2017+, I am starting to see containers become the defacto. I see the future as running a docker file on your laptop, running it through a ci system, then pushing it to a container service. Docker is the clear standard.

<comment><USER9> Except you don't need Docker Inc. for that. Many container runtimes exist now, the user experience is very easy to replicate. Plus, their cloud doesn't seem to be making any money. So I too have trouble understanding where this valuation is coming from.

<comment><USER10> I think you are underestimating the power of a name brand. Docker is synonymous with containers to a lot of people, and if they want to pay for container support they'll pay Docker. Similar to, as other commenters have said, people pay Red Hat just so they can have someone to complain to when there's a problem.

<comment><USER11> This. I've been working in Government recently, it's all containers and it's all Docker.

If anything I'm surprised that their valuation isn't higher.

<comment><USER12> Are they paying Docker (the company) for anything? Or just using containers as a part of a wider software infrastructure?

I've been using Docker since early 2014 and they haven't gotten a dime from me. If you count the storage and bandwidth on the public registry I've _cost_ them money.

</comment></comment></comment></comment></comment></comment><comment><USER13> My first reaction was that I was surprised it wasn't higher.

My second reaction was incredulity at how ridiculous my first reaction was.

<comment><USER14> Redhat has a market cap of around 15 billion, that gives a rough idea of what kind of value Docker could build with a purely service based model for an open source product.

<comment><USER15> Redhat has a vast product suite now - they do a heck of a lot more than just RHEL, and a lot of it is "enterprise" stuff with juicy support contracts. Docker is a one-trick pony in comparison.

<comment><USER16> Wasn't RedHat a one trick pony at one point? I don't think it's insane to be that they'll be as successful as RedHat one day and it seems these investors would like to bet on it.

<comment><USER17> I think (with the exception of OpenShift), most of RH products are acquisitions. I can think of plenty of acquisitions Docker can make to take a similar path; Portainer, Kotena, some CI software (Drone, etc.) All that would kind of make Docker Inc a one-stop shop for startups (definitely) or whoever else wants everything from one company.

<comment><USER18> OpenShift is also an acquisition (OpenStack is not). [1]

What you say makes sense, but then Docker is also coming 10-12 years late to the game, and until it's profitable and has money in the bank it's hard to do many expensive acquisitions.

[1] [https://www.redhat.com/en/about/press- releases/makara](https://www.redhat.com/en/about/press-releases/makara)

<comment><USER19> OpenShift started before Makara with a simple code base called "OpenShift Express". The code acquired with Makara was never used in the hosted service or what became the open source project, although some ideas crossed over.

OpenShift 3 (current) has no code in common with any of the older space. It was a totally new platform built on top of Kubernetes and docker.

</comment></comment></comment></comment></comment></comment></comment><comment><USER20> Docker still has a long way to go in terms of local development ergonomics. Recently, I finally had my chance to on board a bunch of new devs and have them create their local environment using Docker Compose (we're working on a pretty standard Rails application).

We were able to get the environments set up and the app running, but the networking is so slow to be pretty much unusable. Something is wrong with syncing the FS between docker and the host OS. We were using the latest Docker for Mac. If the out of the box experience is this bad, it's unsuitable for local development. I was actually embarrassed.

<comment><USER21> Have you tried [https://github.com/EugenMayer/docker- sync](https://github.com/EugenMayer/docker-sync) ? I've had slow FS issues with docker on mac. Integrating docker-sync doesn't take long and should help you out.

<comment><USER20> I haven't, but I recommended it to one of the devs and he claimed it 'crashed' docker. Need more investigation, but we shouldn't need tools like this; it should work by default.

<comment><USER21> Agreed, and to my knowledge this is a known issue (I'm sure I've seen chatter regarding the problem on the docker forums/github). Nonetheless, with docker- sync I've been able to leverage all the benefits of docker-compose whilest mitigating those slow mounted fs issues, so for now I'm happy with it. At least you can configure it directly into your compose set up, so you don't need to spend time explaining it immediately when onboarding those new developers.

</comment></comment></comment></comment><comment><USER22> Monetizing open source directly is a bit challenging because you end up stuck in the same service model as everyone else. Which is basically to sell various support contracts to the fortune 100-500.

Forking a project into a enterprise (paid for) version and limiting those features in the original open source version, creates tension in the community, and usually isn't a model that leads to success.

Converting an open source project directly into a paid for software or SaaS model is definitely the best route as it reduces head count and allows you to be a software company instead of a service company.

Perhaps best captured by Github warpping git with an interface and community and then directly selling a SaaS subscription and eventually an enterprise hosted version that is still delivered on a subscription basis just behind the corporate firewall.

Also of note is that Github didn't create git itself, and instead was done on the direct need that developers saw themselves, which means they thought what is the product I want, rather than, we built and maintain git, so let's do that and eventually monetize it.

</comment><comment><USER23> I used docker for a while last year and attended Dockercon. I was really excited about it and thought it was going to solve many of my problems.

But with how complicated my stack is, it just didn't make sense to use ultimately. I loved the idea of it, but in the end good old virtual machines and configuration management can basically do most of the same stuff.

I guess if you want to pack your servers to the brim with processes and shave off whatever performance hit you get from KVM or XEN, I get it.

But the idea of the filesystem layers and immutable images just kindof turned to a nightmare for me when I asked myself "how the hell am I going to update/patch this thing"

Maybe I'm crazy, but after a lot of excitement it seemed more like an extra layer of tools to deal with more than anything.

<comment><USER24> This is unfortunately the conclusion I came to. Virtual machines locally and in the cloud just don't seem to be that much worse in any facet, and Docker (containers in general) seem to be far more complicated.

I dunno.

<comment><USER23> Learning Ansible really well proved far more valuable to my work life. I integrate lots stuff, stuff like OpenVPN, Asterisk, Freeswitch, stuff that can hardly be "contained" and still even work. Some stuff does not work in containers, and even if it does work, dealing with the weird filesystem mounts, "statelessness", locations of logs and other persistent data, and the ethos of just using 1 process per container and so on and so forth.

Then think about deploying some complex legacy apps that have upgrade paths that involve changing database schemas and running shell scripts to migrate data. How are you going to reasonably do that with docker? It just hurt my brain to think about it.

If you have the luxury of designing your app from the ground up and its not too complicated of a stack then I see how it is cool. But mostly if it saves you money on AWS bills or something...

</comment></comment></comment><comment><USER25> I dont understand containers. First you go to through great pain sharing and reusing libraries. Then you make a copy of all the libraries _and_ the rest of the system for each program !?

<comment><USER15> An interview question I asked recently: what are the advantages of Docker over an application deployed as a statically linked binary?

<comment><USER16> What kind of answers do you expect/would like to hear?

<comment><USER15> I intend it to be a starting point for a conversation, someone who really understands it will be able to convince the skeptic that I play, someone who is just typing the commands because it's trendy won't. Also it helps if they know what a statically linked binary is.

<comment><USER26> It is obvious from your comments that nobody will convince you of any merit Docker has. You are not "playing a skeptic".

<comment><USER15> I like containers as a concept, and I like the Docker commands for building them and running them locally. I am less convinced by Docker Swarm as a Prod- grade runtime environment, and skeptical that Docker the company can build a viable business out of something that will rapidly become a commodity, I expect the file format will long outlive the company that created it. But those are nothing to do with the question really, which can be answered purely technically.

<comment><USER27> Curious--how do you feel about Mesosphere and Kubernetes vs. Docker Swarm?

<comment><USER15> Big fan of DC/OS. Ambivalent about k8s, but maybe it's just not for my use cases.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER28> Docker generated value from the LXC project, aufs, overlay, btrfs and a ton of open source projects yet few people know about these projects, their authors and in the case of the extremely poorly marketed LXC project even what it is thanks to negative marketing by the Docker ecosystem hellbent on 'owning containers'.

Who is the author of aufs or overlayfs? Should these projects work with no recognition while VC funded companies with marketing funds swoop down and extract market value without giving anything back. How has Docker contributed back to all the projects it is critically dependent on?

This does not seem like a sustainable open source model. A lot of critical problems around containers exist in places like layers, the kernel and these will not get fixed by Docker but aufs or overlayfs and kernel subsystems but given most don't even know the authors of these projects how will this work?

There has been a lot of misleading marketing on Linux containers right from 2013 here on HN itself and one wishes there was more informed discussion that would correct some of this misinformation, which didn't happen.

<comment><USER29> I was always amazed/impressed/annoyed that when Docker exploded in popularity it was a _tiny_ pile of code, and a bunch of other mature and mostly mature pieces from the OSS community, and yet "Docker" was what everyone recognized from that equation...even though 95% of the code was something else. Possibly the most amazing thing was that Docker was so successful while doing _less_ than LXC.

It was incredibly impressive marketing, no matter what else we might say about it. And, since then, of course, they've leveraged that early success into a real platform and they've since built a much bigger pile of things (some are even really good). It's kind of a testament to the wildly over-optimistic approach of Silicon Valley product-building, and maybe also kinda damning of the sort of pillaging that the process often involves.

I had my reservations about Docker in the beginning, for all the reasons I mentioned above, but I'd be unlikely to bet against them, honestly. And, they have contributed quite a bit to OSS. I've been poking around in golang, lately, and have found a lot of libraries in my area of interest created by the Docker folks. They're seemingly doing good things, though not on par with Red Hat, which is entirely an OSS company.

<comment><USER30> > Possibly the most amazing thing was that Docker was so successful while > doing _less_ than LXC.

This is where I agree with Peter Thiel's very succinct (although somewhat philosophical) definition of the term _technology_ in _" Zero To One"_: it allows us to do _more with less_.

Sometimes, merely re-imagining a better way to use existing tech could unlock new kinds of productivity previously unimagined. One of the best examples of this is the iPhone.

</comment></comment></comment><comment><USER31> There's a couple of things in this article that I don't think are true. I don't think Ben Golub was a co-founder of Docker. Maybe he counts as a co- founder of Docker but not of Dotcloud? That seems a bit weird though. I also am pretty sure Docker's headquarters are in San Francisco, not Palo Alto.

<comment><USER32> Cofounder is a title, like any other. It doesn't just refer to "I was there at the start of the corporate entity". If they're calling Ben a cofounder, then they certainly mean it. You're right that he wasn't there at the start of Dotcloud, but that doesn't mean that he didn't have (or didn't earn) the title of cofounder of Docker. Ben's linkedin has "co-founder" of on it, so it certainly wasn't the article making a mistake.

<comment><USER33> Cofounder is sort of nebulous, it doesn't carry any official legal authority and isn't an "officer" of the corporation in most senses, though it has a lot of cachet in SV.

I view it as a relatively cheap bargaining chip that can burnish a person's reputation, but has little descriptive value in terms of what someone actually did to move the business forward.

<comment><USER32> I disagree. You're not exactly handing the title out willy-nilly. If they're calling Ben a cofounder, I'll be that has significant meaning to them.

<comment><USER33> Sure, but it's a lot different from being a CEO, shareholder, member of the board, or high-level corporate officer. "Founder" is something you can bestow retroactively, not so much with "CEO".

And I'm seeing all sorts of companies hand out titles like "Founding Engineer", "Founding Developer", etc. with the same chump-change 100k/0.1% option packages as before.

</comment></comment></comment></comment></comment><comment><USER34> I worked with LXC since 2009, then personally built a cloud provider agnostic workflow interface superior in scope to Docker in feature set[1] between about 2013-2014 as a _side project_ to assist with my work (managing multi-DC, multi-jurisdiction, high security and availability infrastructure and CI/CD for a major cryptocurrency exchange). (Unfortunately I was not able to release that code because my employer wanted to keep it closed source, but the documentation[2] and early conception[3] has been online since early days.) I was also an early stage contributor to docker, providing security related issues and resolutions based upon my early LXC experience.

Based upon the above experience, I firmly believe that Docker could be rewritten by a small team of programmers (~1-3) within a few month timeframe.

[1] Docker has grown to add some of this now, but back then had none of it: multiple infrastructure providers (physical bare metal, external cloud providers, own cloud/cluster), normalized CI/CD workflow, pluggable FS layers (eg. use ZFS or LVM2 snapshots instead of AUFS - most development was done on ZFS), inter-service functional dependency, guaranteed-repeatable platform and service package builds (network fetches during package build process are cached)...

[2] [http://stani.sh/walter/cims/](http://stani.sh/walter/cims/)

[3] [http://stani.sh/walter/pfcts/](http://stani.sh/walter/pfcts/)

<comment><USER35> It effectively has been.

Oracle, Sun, FreeBSD, RunC, OCI

None are _as popular_ as docker. But many offer more features, or a flatly superior product.

Docker _isnt good_. Docker is popular. Actually their constant breaking of compatibility makes me wonder why everyone continues to tolerate it.

<comment><USER34> _Docker _isnt good_. Docker is popular._

Which means a popularity-based valuation is a house of cards.

<comment><USER36> Maybe. But there's also something to be said for generating popularity and mind share intentionally. It seems Docker has been very good at that part (and pretty good at the technical side too).

Many wonderful, technically-superior-than-alternatives projects languish and die in obscurity, while its inferior counterpart wins the popularity/marketing contest.

<comment><USER34> The businesses that win in that way (VHS vs beta) do so because there is money flowing.

It is unclear that with docker they really have much income, and enterprise software projects that perhaps make up most of their income are frequently rewritten with new toolsets.

Therefore, it is uncertain there will be commercial traction in 5 years... particularly because docker has (according to this thread) already lost the open source feature set battle (targeting a demographic which, incidentally, tends to shun marketing).

Hence, house of cards.

</comment></comment></comment></comment></comment><comment><USER33> I wish people would stop talking about valuation this way, emphasizing the bullshit headline valuation.

The reality is that (speculating), they probably issued a new class of stock, at $x/share, and that class of stock has all kinds of rights, provisions, protections, etc. that the others don't, and may or may not have any bearing whatsoever on what the other classes of shares are worth.

</comment><comment><USER37> The guy who came up with chroot in the first place is kicking himself.

<comment><USER38> By analogy, there's a lot more to a Model T than an internal combustion engine.

</comment></comment><comment><USER39> Do they actually have any significant revenue? I love developer tools companies, but there are several tools upstarts that have no proven business model. They look like really bad gambles in terms of VC investment, unless you can get in early enough to unload to other fools.

<comment><USER27> I don't know their numbers, but it has been reported that their 2016 revenue was north of $10m, and that their 2017 revenue is more than 2x that. This is just a guess, but I'd guess that they are seeing >300% year-over-year revenue growth, and that they're projected to see >$50m in 2017. I would guess 20x current revenue, so a $1.3b valuation would mean roughly $10m per month in July 2017 (starting from $2-3m in Jan 2017). If this is accurate, I'd be glad to invest in Docker at a $1.3b valuation.

<comment><USER39> That sounds very pie in the sky, I can't imagine them cleaning 10m a month.

</comment></comment></comment><comment><USER40> Check out Chef's [https://habitat.sh](https://habitat.sh) for one fresher take on all this. It moves the containerization approach closer to something that feels like Arch Linux packaging, with a pinch of Nix-style reproducibility. Looks very promising at this point, even if a bit rough on the edges still.

</comment><comment><USER41> As someone who witnessed the 2000 tech bubble pop, I feel like Bill Murray in Groundhog's day, except unfortunately this time its not just tech. Its going to end very badly.

</comment><comment><USER42> Docker is funded by In-Q-Tel

<comment><USER27> I'm very curious what your concern is in this? I understand the CIA interest and value in PayPal, Facebook, and Google. But what do they gain from Docker, other than as a simple investment? Backdoors or something?

<comment><USER43> I have no idea if the parent is correct or what, but just for the sake of argument I can see one issue here.

Docker Hub is a massive centralized store of software. If Docker becomes The Way to deploy infrastructure and services, Docker Hub could theoretically trojanize the world.

It would be a way of getting the kind of leverage over the Linux world that MS and Apple offer for their respective ecosystems.

<comment><USER44> You can run a private registry and build your own images.

</comment></comment></comment></comment><comment><USER45> Unikernels are a much better solution to the problems that Docker solves.

<comment><USER44> Im not sure unikernels are a better solution. The texhnology has a lot of promise but the tools are not there yet. For instance running MySQL as a unikernel is possible but it's much more difficult than a container.

So "better" is quite subjective... more secure? Sure, easier to deploy and build not even close.

</comment></comment><comment><USER46> That's a lot of money for a static compiler.

</comment><comment><USER47> why are they called Software Maker?

<comment><USER48> Non-tech people have no idea what Docker is. Still even a lot of the less up- to-date people know what it is and I suspect vanishingly few people (relative to something like GitHub) really understand it beyond the mechanics of the commands.

Also the intentional re-use of shipping verbiage demands disambiguation.

<comment><USER49> I've had to use Docker before, and I still have no idea what it is. It's true that they love to say "virtualization" and "containerize" the same way the media loves "disavow" and "recuse".

<comment><USER50> In the case of Docker, containers = prepackaged ready-to-use out of the box software. Basically, you run some software (e.g. mysql) inside a docker container and it comes with everything it needs preconfigured and installed (e.g. libraries, configurations,...). This makes it easy to:

\- Deploy to many places having the same environment

\- Update these programs easily (you just need to download and run a new container image)

\- Clean up easily by discarding the container

I should probably also add that Docker is also a community to share these application images (containers).

</comment></comment></comment></comment><comment><USER51> they should file for an ICO, dockercoin or containotoken would sell like hotcakes. /s

</comment><comment><USER52> It's time for the cash grabs before the economy implodes

</comment><comment><USER53> Gosh, how did the Internet, services, etc every work without containers?

Oh, that's right, perfectly.

<comment><USER54> That may be true, but should we then stop trying to evolve technology? The idea of any advance is to either keep quality and reduce costs (time and money investment), or to improve quality.

Since by your opinion, the Internet already works perfectly, the good Docker brings to the table is to _keep_ it working perfectly, but requiring less resources (time and money) to do so.

<comment><USER55> Heh. I am always amazed to see comments like muppetman's. Why get into technology if you don't like to see things improved?

It reminds me of this bit from Douglas Adams:

"1\. Anything that is in the world when you're born is normal and ordinary and is just a natural part of the way the world works.

2\. Anything that's invented between when you're fifteen and thirty-five is new and exciting and revolutionary and you can probably get a career in it.

3\. Anything invented after you're thirty-five is against the natural order of things."

<comment><USER53> My point was I don't see how containers have improved anything. Of course tech should be advanced. There's many things that have advanced tech. But I fail to see how containers are one of those things. But you're right, I guess I am just old and grumpy.

</comment></comment></comment></comment><comment><USER56> Imagine the "value" investors could make if they cordoned off every useful composition of Linux kernel features into a "product" like this.

<comment><USER57> As someone who did containers with LXC before docker, I think your characterization is off. The value in Docker isn't in the kernel features, but instead in the user space. Ever try Openshift 1/2, as painful as that was it was still better then rolling your own.

Docker's big problem isn't what's below them, it's whats above them. Their monetizing strategy has to involve the fortune 500, and right now, all of the momentum in that area is being eaten by Google with Kubernetes. Kubernetes has a very vocal faction that wants nothing to do with Docker, and replace it with something else.

Docker has plenty of challenges, but they have delivered significant value, most of which is still open source.

<comment><USER58> Indeed, especially as a company that has a reputation for producing unstable APIs that break between minor versions.

This is a team that seems to think it is acceptable to return ASCII art and backspaces in their container management APIs: [https://github.com/docker/swarm/issues/1214](https://github.com/docker/swarm/issues/1214)

So, you're right, but they have a tainted reputation. I wish them all the best, but I don't have high hopes.

<comment><USER59> I see the backspaces (as per that issue) but where's the ASCII art?

EDIT: nevermind, found it via one of the linked issues: [https://github.com/docker/swarm/issues/1237](https://github.com/docker/swarm/issues/1237)</comment></comment></comment></comment>


Ask HN: Should me and my girlfriend apply for YC? - <AUTHOR> We've been together for 5 years now. She's an architectural engineer and I'm currently studying for a bachelor of computer science. I'm the one who comes up with the business ideas and she comments on them. She's actually my advisor. She doesn't know any programming, but is great at math. I know a few programming languages, but haven't really build anything (except for my website). The reason I ask this is that there's so much focus on having a good team. Are lovers also being considered as good teams? We're both from Belgium by the way. <comment><USER2> Obviously applying can't hurt. I've met several husband/wife teams in the past that worked very well together and clearly would be good candidates.

On the other hand, in California, everyone is going to have the recent Los Angeles Dodgers fiasco in mind ([http://bleacherreport.com/articles/922673-frank-mccourt- sell...](http://bleacherreport.com/articles/922673-frank-mccourt-selling-la- dodgers-the-key-moments-of-the-ugly-divorce)).

I could see someone asking you to at least think about what would happen to the startup if you break up, but I can't see it being any more than a very small red flag.

</comment><comment><USER3> I'd be less worried about the fact you're a couple and more about the skills you bring to the team.

Lanyrd (YC W11) was founded by a couple, but more importantly they were a great team (Simon is a developer and previously the founder of Django, his wife Nat is a designer who was previously at a UX consultancy).

Just because you're in a relationship it doesn't mean you should form a startup together unless both of you can add significant value to the business.

</comment><comment><USER4> Of course. What's the worst that can happen?

<comment><AUTHOR> Lacking knowledge or experience.

<comment><USER5> A lot of people who apply lack both. Do your best.

</comment></comment></comment><comment><USER6> "my girlfriend and I"

<comment><USER7> I find it difficult to take you seriously when you make egregious errors in English grammar.</comment></comment>


Ask HN: Is it better to centralize authentication at a security service? - <AUTHOR> https://medium.com/@justinjsmith/hatin-on-microservice-passwords-4f8f0c0143ec#.rmxrg2h9l
Justin's argument is summarized thus "It's true that a client must still authenticate with the security service, but the security service provides a central place to focus on and to harden. As I mentioned previously, it's less about how the client authenticates, and more about where the client authenticates". Do you think this argument holds up? It sounds a bit like throwing up our hands and saying that instead of trying to solve the problem we'll just shift responsibility for failure. <comment><USER2> I don't see one of the critical pieces mentioned here of having a centralized authentication structure which is revocation. If everyone is using a central point for authentication if you ever have to remove someone it is a stable amount of work, but also if you have to change one individual's access in response to policy or a true need it is also the same place.

A security policy is much easier to prove correct if authorization and authentication stem from the same place. You don't have to aggregate many systems and then try to fold that data down before analysis.

I prefer this centralized authentication to be restricted to a particular realm (like a particular website/company) and not universal though.

<comment><USER3> This was my experience as well. We built a decentralized authz/authn system that used signed tokens had a lot of trouble with revocations. In the end, we had to give up decentralization to get quick revocation right.

<comment><USER4> What exactly is hard about revocations in a distributed authentication system?

You have an "owner" that is authenticated (in whatever way) with the distributed system. They have a private key and a certificate, say.

Now, you have a "conversation" or some other activity, which is a growing append-only merkle tree, ie everyone can "append to" a node on their copy of the tree, signed with their HMAC / certificate, and broadcast the result to whoever they want to know about it. It's a merkle tree because if I append to node X, I can prove what state the tree was in when I appended.

So now, one of the operations can be granting/revoking access. The owner starts with the root of the tree and can grant access to others who get the tree to perform some operations. Later on, the owner can revoke some access in any given subtree, by posting this revoke operation on the appropriate node.

It is true that a group can fork the tree and disrespect the owner, and go rogue. This is like forking the blockchain in Bitcoin. This is by design. But if all clients have a dispute resolution procedure (eg use the longest blockchain, or in this case, don't ignore the wishes of owner of the tree) then the rules are enforced. A particular conversation participant may perform an operation "after" its access has been revoked, but when it tries to broadcast it, the other clients will see its vector clock is "later" than the owner's, and reject that operation (something the rogue client will discover itself when it tries to pull updates to the conversation).

An even easier way is to have each conversation have a centralized authority that must be consulted for every action. The authority can have mirrors in case it goes down. But that doesn't mean the AUTHENTICATION has to be centralized, only the authorization to post TO A PARTICULAR CONVERSATION.

<comment><USER3> This is all new to me. Can you recommend some further reading?

<comment><USER4> I am not sure about the scholarly works... the main ideas are:

In a distributed environment, the concept of "after" changes from a linear one to a tree one. The idea that a client can't post "after" you revoked their permission needs to be revised.

If you want to maintain linear order of messages, each node in the tree has to be owned by someone. So for example I own my own comment and if someone responds to my comment I have to accept it and broadcast in what order that happened.

But that doesn't require the authentication to be centralized, nor the publishing. However, there is a central authority for each node in a tree.

In addition, you now have to solve the byzantine generals problem so that the servers don't say different things to different people. To be honest this same problem exists with a centralized authority, and distributed servers can be held to account better, because they don't have a monopoly.

</comment></comment></comment></comment></comment><comment><USER5> From a user interface standpoint I think centralized authentication is one of the most important things.

Consider an intranet. If you have one password to log into all of your enterprise applications you are going to know how to log in and you will use all those applications.

If you have 20 different applications you use at work and you have 20 different logins, probably some of those services will end up in a state where you have to bug IT people to get a password reset when you ever need to use them. There will be others you just don't use at all, and maybe that suits management because they'd rather you didn't take time off from work anyway. (ex. application you use to claim time off from work)

<comment><USER6> It's not only user interface, it's also security. A password is something that you have to remember. If you need 20 (distinct?) passwords, there's no way you can remember all of them, thus you'll resort to other ways to "remember" them. In most situations, this is actually lowering the security of the system.

</comment></comment><comment><USER7> I very much think auth should be centralized.

It gives you a lot of benefits.

\- Easier to scale securely. Adding 100 auth'ed services that may or may not work differently is a recipe for disaster. Ad-hoc security by people who aren't security experts generally does not work...And maintaining it will not be easy....

\- One way to auth. Developers make fewer auth mistakes this way. For example, if you are a Go shop, you have a company wide auth package that can be used by everyone. Mistakes are limited this way. Fewer vulnerabilities. Less developer friction and more productivity, not having to have developers worry about auth themselves.

\- Control. Revocation and adding new permissions is hard if it is not central. How many services have to restart when someone quits or a service is hacked. How do you even know how to revoke something if some auth scheme is built where one service can talk to several services with the same auth token? As complexity is added, the process is more unclear. This leads to mistakes.

There are more but these three bullet points came to mind first.

</comment><comment><USER8>
      There's an argument to be made that some datacenter
      topologies have segmented their networks such that there's
      no reason for clients to authenticate. I'm generally not a
      fan of this approach because over the years I've come to
      believe there is untrusted code running "in the perimeter"

So I don't think this statement on it's own is necessarily egregiously bad, but I think there are some excellent general take-a-ways that should apply to anyone who's running a SaaS business:

1\. "Certain Network Topologies" should be "Most", or at least "Your" network topology. And this statement doesn't need to be confusing: You're going to run sensitive services on your network, you're going to run databases, and those services really shouldn't be exposed to the outside world. Even your applications should ideally not be exposed directly to the outside world, they should be proxied by a load balancer / network gateway that forwards only expected traffic to your service. Make your LBs default to not allowing traffic so that you can confirm this. Use services like ELB and VPC if you're in Amazon.

2\. "Untrusted code running in the perimeter" is a situation that you should A) control, and B) aggressively be defensive about.

3\. If you're going to go all the way with service auth, you need to think about how safe your secrets are. If your code is shipping with the secrets, then you're really gunning for security by obscurity. Keeping secrets on disk is a security hole. Heck, even keeping plaintext secrets in memory is not fool-proof.

I liked the article, but generally speaking, you really do need a comprehensive solution to service-to-service auth if you want to go down that road, because taking shortcuts is going to just expose you to a ton of downsides without even attaining the upshot. And regardless of if you set up service-to-service auth, you really should be segmenting networks anyways for a host of reasons, and layering auth on top of that. So these two things are inter-related on some levels, but form a layered security approach together :-).

</comment><comment><USER9> > _It sounds a bit like throwing up our hands and saying that instead of > trying to solve the problem we 'll just shift responsibility for failure._

To me it sounds like recognizing a good solution to the problem and implementing it. Unless you have a good counter-reason to offer why a centralized authentication service is a bigger problem?

(Note there is a sliding scale on how often you need to hit the security service. You can have every single request going there, or you can have it give out tokens with varying permissions your services then can validate themselves. Cloudflare's blog recently described how they use internal CAs to authenticate services against each other, basically only requiring a service to once get a certificate, there are concepts like Google Macaroons, ...)

<comment><USER10> The primary( and really, only ) recommendation against central authentication is that the provider becomes an _extremely_ juicy attack target.

We live in a world of asymmetric warfare in which attackers can screw up thousands of times, but defenders only need to screw up once. Dramatically increase the payoff of compromise, and the risk increases accordingly.

I know this smacks of security by obscurity, but in the real world, incentives for attackers are absolutely part of the risk calculation.

</comment></comment><comment><USER11> >There was mutually-authenticated SSL, but the required key distribution seemed too hard, especially at scale.

>There are several open source security services out there. Use them!

Something like [https://www.vaultproject.io/](https://www.vaultproject.io/) would be a solid foundation for either running your own CA with narrowly scoped / time limited TLS client certs, or managing secrets for generating signed identity assertions, e.g. a JWT.

</comment><comment><USER12> My worry would be if you end up on bad terms with said security service. Does this mean your site/app loses the ability to get sign ups till you move somewhere else? If so, that's a pretty big problem, especially if you do something controversial or the government has a hand in things.

That's one of the reasons I've always been skeptical of centralised anything. It's another potential group to fall out with or point of weakness.

<comment><USER13> "Centralized" doesn't mean you rely on Github or Google or Microsoft or whoever, although you can. It means you handle authentication and authorization with a service that does that job, instead of shared secrets or "well, it's on this VLAN, it must be OK". You can run your own OAuth2 (or whatever) provider pretty easily these days.

</comment></comment><comment><USER14> Google login option is getting close to being "table stakes" for startup SaaS services. We also use it for our internal admin and it's actually kinda nice there, too. I haven't seen any problems so far but I do worry about everything being Google.

</comment><comment><USER15> Isn't the whole point of Kerberos to secure (micro)services like this?

</comment><comment><USER16> Read the NIST 800 series identity materials.

If you're worried about infrastructure being online, issue certificates and trust certificates signed by your CA.

</comment><comment><USER4> I'm going to take the opposite tack and say _decentralized_ produces a better result. It's waaay harder to implement, but then the result is better.

Centralized has the fundamental problem of power and choice: witness how facebook, amazon, twitter, Apple, etc. can do whatever they want in their ecosystem. Facebook's users aren't going anywhere, they're essentially trapped if they want to get updates from their "friends", so they'll have to put up with whatever choices the social network makes.

But the biggest power imabance is with developers / publishers. Facebook, Twitter, Amazon, Apple, etc. have all been known to push around their third party publishers, compete with them, and even simply disconnect them whenever they want. Those publishers cannot connect directly with their users without a decentralized login.

And if you're into privacy, you might want to consider how much easier it is for state actors (and hackers) to have backdoors into just _one_ server farm that has _everyone 's_ auth information rather than if profiles were stored like the web -- each person could choose their own host.

Distributed auth is possible. What you need is a distributed protocol and reference implementations. Something like OpenID or oAuth is a good start. You can sign up with network X and then use X to auth with other networks. Sadly, xauth was discontinued and everyone assumes Facebook, Twitter et al can be the only OpenID or oAuth providers.

What we need is a new protocol, and that's something we've been working hard on, and have successfully designed.

It doesn't even require you to share your user id, name, etc. with the consumer sites you visit. They can be instantly personalized for you and show you all your friends _without_ knowing who you are. When you are ready, you use oAuth (or something essentially similar) to start building up your profiles in other communities.

No third party can know that user A in community CA authenticated as user B in community CB, unless you sharethat information. You know that thing, "Your friend FooBar is on Instagram as Baz?" That's stuff I might not want everyone to know if Instagram is, say, a porn site. A few years ago, there was a huge uproar about Facebook's "instant personalization" with "trusted partners". Today, it came back and no one cares.

Truth is, we are giving up our power as consumers, and even more so as producers who eventually build our own communities on the back of large, entrenched, centralized communities. Do we really want to centralize power when we see all the bad stuff it can lead to? (Internet 2.0 in India because FB is the only option, Net Neutrality fight because telcos are too centralized, etc.)

I say, once we get the tech right, it can be replicated. After all, bitcoin distributed money. The Web, Email, Git, etc are all distributed. Why not social??</comment>


Scale (YC S16) Bounding Box API – Image Annotations by Humans via API - <AUTHOR> https://blog.scaleapi.com/introducing-our-bounding-box-endpoint-7f2b1d07f7a7 <comment><USER2> Your demo is awesome, nice job. Do you guarantee a certain response time?

Also, I'm curious how people use your API if it takes 30 seconds+ to get a response -- ie can I use this for time-sensitive annotations, and also, wouldn't my code hang waiting for your response or do you offer webhooks?

<comment><AUTHOR> Thanks! We try to have cool demos :) We're working on having faster and faster guarantees, but for now we'll guarantee responses within 20 minutes. It's definitely much faster normally.

By default, Scale is built using webhooks/callbacks to return responses. We definitely don't want our API to be blocking, and so we designed it intentionally not to block.</comment></comment>


Self-storage: The men who got rich selling empty space - <AUTHOR> http://www.bbc.co.uk/news/business-26921870 <comment><USER2> This article misses the entire point of the self storage game, in that it's all about real estate. I'm not sure of the structure they have over in the UK but I'm quite sure it's the same type of thing, considering that land over there is much more valuable.

Here in the US you'll find a vast majority of the land used for self-storage is owned by either investment firms specializing in commercial/self-storage real estate, MLP's (Master Limited Partnerships), or REIT's (Real Estate Investment Trusts). There are a lot of nuances to it, but essentially these are tax vehicles that buy up a bunch of not particularly sexy land, but in an industrious location that has long term potential. The issue then becomes what to do with the land while you sit on it, and the answer to that is self- storage. Self-storage warehouses are incredibly cheap to build and operate, often times the largest cost is insurance (although that's not saying much nowadays). Many MLP's/REIT's either own their own self-storage company, own a controlling share in one, or at least own a good percentage of one, or the self-storage company in and of itself is an investment firm wrapped in a thin veneer of self-storage. Thus, on top of the rent you can get a nice cut of the storage profits. It's a fantastic racket if you can get momentum, after a certain point the money essentially prints itself and you still have control of a massive chunk of land to boot. The self-storage business is also very predictable, and highly tuned, so the investment returns on both the land and the storage business are very conducive to long term wealth building.

<comment><USER3> I'd be curious where you are getting that narrative from. It differs from what I am familiar with for sure in terms of knowledge of this industry. Not that that's not the play of some REIT's (or what they say they are doing but not really doing) of course but I wonder how many of the locations fall into that category vs. just "after a certain point the money essentially prints itself". Which sounds pretty good. [1]

(What you are saying is typically done though with parking lots in cities for sure for various reasons.)

"and you still have control of a massive chunk of land to boot"

Unless you have land in a particularly valuable location the fact that there is a building on it is going to contradict having someone purchase it for development purposes. It's being used. In other words "nothing to see here move along". And if it was in a super valuable upcoming area that would already be priced into the land cost and might be prohibitive.

I'd also would like to know what the time frame is for something like this to actually happen and _how many times it has actually been done_. That is, out of the entire self storage industry, how many locations (multi level for example - those larger buildings) have been raised for a higher use (with every tenant thrown out)? And something else built on the land which generates more revenue. Where a comparable piece of empty land was not available?

Of course it might be something that the REIT says marketing wise in order to enhance the appearance of the value of their properties. But to me it seems that the reality of whether that would actually happen (and how often) might be entirely different.

That said any links to this would be nice if you can pass along.

[1] For self storage that I am also familiar with they predictably raise the price every year. And it's not easy to move things out (you need a truck or you need to dispose of something.)

<comment><USER4> I've seen one self storage facility in my town removed in favor of a commercial medical plaza recently.

Self storage buildings around here are just cheaply built steel buildings. They are easy to dismantle.

<comment><USER3> There are those for sure. Separately I know of a 155 unit residential condo complex in Florida that is being torn down to build a high rise (resulting in 4x value to unit owners the market is so hot right now).

But then there are these examples which seem highly unlikely as the investment play involved. Browse the links on this (a typical larger storage company site) and you will see nobody is putting up a building multi story (with elevators) and hundreds of tenants with the intent of holding it to tear down. Not that like anything it couldn't be torn down if the right opportunity came along.

[http://www.publicstorage.com/](http://www.publicstorage.com/)

[http://ir.extraspace.com/phoenix.zhtml?c=180054&p=irol- irhom...](http://ir.extraspace.com/phoenix.zhtml?c=180054&p=irol-irhome)

But hard to believe that is actually the business model they are relying on although it could of course be a future upside.

</comment></comment></comment></comment><comment><USER5> "Danny Dorling, professor of geography at Oxford University, says we have six times more "stuff" than the generation before us."

I run a storage business and I can say that this is no longer the case with the younger generation. We used to store boxes of CDs, Videos, 14" Colour TVs, Desktop Computers, Hifis. Now all this is in a laptop and mobile phone, which people just take with them. We now insist on up-front payment as the items people store are worthless to sell.

90% of what we store is now boxes/suitcases of clothes and books.

<comment><USER6> "We now insist on up-front payment as the items people store are worthless to sell."

Was this ever different? Boxes of CD's, videos and tube TV's don't sound that valuable. But reading into your comment, it seems it wasn't always like this...

<comment><USER7> It might now seem that way, but when you can put those things into a second hand shop for $1-$5 a piece someone's DVD, or CD collection can become quite valuable when its abandoned. Some people did/do store hundreds of cd's, dvds, and the like. A unit could have a thousand dollars(in real secondhand market value) of merch very easily.

<comment><USER6> Do CD's/DVD's not have this value anymore? I could CD's being phased out, but DVD's are still entrenched. Maybe with online streaming (Netflix) DVD's too are going away? I would think this would be a lagging indicator though as I can see many storing their DVD's now that streaming is an option.

<comment><USER8> CD's don't and never really did. If you bring in an early CD (like from the 80s) you can get a nominal amount because CDs were rare then. If you bring in a CD from the last 10-15 years they are nearly worthless. Most shops ended up shredding the extra.

DVDs have a bit of crazy market. Some distributors (Disney and Criterion especially) do a short limited run. The 2nd hand stores rely on these gems in a big box of junk to make profit.

</comment></comment></comment></comment></comment><comment><USER9> From the article:

        But there is one clear lesson from the storage story.

        If you want to be a millionaire, you'd be well advised
        to look beyond what's sexy.

Quoting from Paul Graham:

        There are great startup ideas lying around unexploited
        right under our noses. One reason we don't see them is
        a phenomenon I call "schlep blindness." "Schlep" was
        originally a Yiddish word but has passed into general
        use in the US. It means a tedious, unpleasant task.

\-- [http://paulgraham.com/schlep.html](http://paulgraham.com/schlep.html)

<comment><USER10> It's also a great example of the general principle that it's good business to try and figure out how to disproportionately leverage public resources.

Say police protection and property enforcement was privatized. Under such circumstances, the cost of security for a storage facility would be substantial. But in a society where the public pays for security, it's "free" to create a business that presents an outsized target for thieves.

<comment><USER11> Hardly. Physical security at self-storage facilities is comparable to that at non-classified government installations - at least the ones I've seen in Canada: Perimeter fencing with logged access control, CCTVs and live monitoring, individual locks on storage areas, etc.

Add the cost of insurance, bonding, etc., and there is absolutely no "free" involved.

<comment><USER10> That's the security expenditure assuming the backdrop of government enforcement of property rights. Imagine running a storage facility in a place like Somalia. You'd need way more than a perimeter fence and monitoring!

When my family lived in Bangladesh, we once had a band of thieves (in a van/bus with guns) try to break down our gate. One of those would roll through the security at your typical storage facility.

<comment><USER11> Not to be belabour the point, but in a place like Somalia, gun toting labour is cheap. You'd need two or three "shift supervisors" (overseers who keep the labour in line, really), and you'd pay them more, but overall, the teens with AKs and the tough-as-nails-and-mean-as-hell overseers would likely end up costing less than one pays in taxes.

Now add the cut to the local warlord, who "respects" your area so long as you "respect" his due.

Oh, wait, that's starting to look a lot like taxation, police services, rights enforcement. Just without the actual rule of law, good governance, and an independent judiciary.

Really, I do not understand this notion that police services, etc., are free. We pay for them with every dollar we earn and every dollar we spend.

As the man said, I like paying taxes, with them I buy civilization.

</comment></comment></comment></comment></comment><comment><USER12> If you have to rent a storage unit get the smallest unit, and get rid of it quick. I used to work for this thieving industry. The owners know once you move your stuff in; they have a customer for life. As you get older you will accumulate some good stuff, but make sure it can all fit in a closet sized unit. Keep tools of your trade. Keep valuable jewelry, and silver. As for books, it's my sore spot--I have a small library. If I needed to part with them, and I just might ave too, I'd keep a valuable first editions, and two milk crates full of must have refrence books. The indusrtry is a slimy business. The owners take advantage of hoarders, sedimental types, and the desperate. They literally have industry seminars where they discuss making more money on late fees. The also ask for your S.S. number when renting(I think that is illegial?). Don't take your frustrations out on the country guy --he's just a low paid worker. If you do plan on skipping out on the highest per square foot rent in the world--get your stuff out before the lock goes on. Use their dumpster and throw 90 percent of your garbage out. Yes--most of you store garbage. Women store to many linens, books, and Chinese made furniture, and the inherited sewing machine(keep the machine, throw away the cabinet). Men store too many redundant tools, or huge tools they never use. Keep the suitcase Tig/stick welder. You don't need three welders. Keep the Snap-on tools, but sell the huge cabinet. Sell all antiques, and give away the cheap furniture including the matress. Everyone seems to cling to there matress? My final thought--sit down and roughly figure out how much your stuff is worth. Figure out how many months if rent will replace your possessions? For 95 percent of you it's a couple of months rent. Good luck. Oh yea, I would like to see all rents due on the first of the month. They prorate on the date you move in. Why--so you will forget to ake you payment, and have to pay a late charge. Forgo the rental insurance. Sue the mini storage in small claims court if they slip up in any fashion( I.e. have video cameras, but don't have the tape of your unit being broken into. As to the mini storage owners--yes--you are extorting people at a very stressful time in their lives; you are just like pawn Shop Owners. When you filthy Lookers are counting your ill gotten gains, keep Sundays open, and drop by a local church--you might hear something interesting.

</comment><comment><USER13> I never understood friends who put things in storage. It was their used furniture and things they never used. But they'd gladly play $100/month to store it away for 2-3 years at a time. You're better off just selling it and buy new (used) things in a year or two.

Not to mention the hassle of moving things to and from the storage unit!

<comment><USER14> I've only rented a storage unit a couple of times but for me there were two factors: one was knowing the history of everything that was in it. And the other was that I had chosen those items.

I liked knowing that nothing was damaged in ways that weren't easily visible, like something you bought used might be.

And I don't enjoy shopping so trying to get something just like what I had is/was difficult. And it's getting harder: manufacturers change models at an incredible rate. You have to read reviews all over again, etc.

</comment></comment><comment><USER15> Coincidentally, this is something I have researched just last week for my area. I would love to store boxes upon boxes of things that I will need in another two years (eg. baby clothes), will sell eventually, or plain don't want around[0].

Unfortunately, I have come to the conclusion that the concept of self-storage presented here, quite similar in spirit to my local self-storage providers (henceforth: SSPs), is not reconcilable with my use-cases and fundamental needs.

To wit: All SSPs that I found were located on the outskirts of town. "Industrial estate" would describe it well. This calls for car ownership (or rental, at least) and huge transfer volumes.

But I want to spirit away a smallish box every month or so. I would like to carry it (perhaps in a bicycle trailer) around the corner. In short: I want those SSPs to be as ubiquitous as libraries.

Now, are there cities were a system not unlike to the one outlined above exists? If so, are hacker/maker spaces similarly well-distributed?

[0] Books, chiefly by virtue of their _tactility_ , belong solidly into the latter category, as non-intuitive as it may sound: these cellulose blighters are _everywhere_ and frankly cumbersome to circumnavigate by now.

<comment><USER16> Hope you don't mind me asking if you live in Texas? I'd love to ask feedback about my storage on demand startup remotegarage.com, as it sounds like it would serve your needs better than traditional self-storage?

<comment><USER15> I don't want to sound overly enthusiastic, but I do think that this fits the bill 90% of the way. Great presentation[0]; pricing _explicit_ and almost exactly what I would have imagined; and, of course, sane pick-up and delivery. I even hunted around for a spelling mistake to have something on the opposite side of the ledger. No such luck.

Alas, I'm a few thousand miles short of becoming a valued customer.

Now, hopefully, you're wondering about that last 10%: It's point 2 in your "How it works":

> Pack your things carefully and take pictures of the contents.

I'm sure legal would have a word or two to say about that, but: how much would it set me back if _you_ did that, together with providing a rough description of the box' contents? This, then, would appear on my account page's List of Boxes.

The details are devilish, of course, and supreme caution is indicated: you don't want a prominent "take-a-peek" option to adversely affect the trust of your more privacy-conscious clients.

[0] Which, incidentally, doesn't appeal to me, as I am solidly in the tarsnap aesthetics camp, but we both know what to make of that.

<comment><USER16> Happy to hear you like the 90% so much - thank you for the feedback!

As for the 10%, we have indeed found that quite a few customers end up not taking pictures, even though it's a requirement to qualify for the protection plan.

We would be happy to take those pictures, but I wonder if there's a way to do it so that it doesn't interfere with the customer's privacy. Drivers taking the pictures upon pickup comes to mind.

</comment></comment></comment></comment><comment><USER17> I spent 2 years living in rural Central and South America, and of all the things that shocked me on my return to North America, the sheer amount of _stuff_ people have was by far the biggest.

People have multiple cars, boats, quads, kayaks, tvs, couches, RVs, snowboards, skis... the list is endless.

I was dumbfounded that people have so much _stuff_ , they pay money to put that stuff someplace.

</comment><comment><USER18> Whether it's for economic (less spending money), technological (mp3s are a lot smaller than CDs), or simply cultural reasons, the younger generation seems to have less stuff.

I see an opportunity in 5-10 years...microapartments in former self-storage space?

<comment><USER19> Some people already run mail-order businesses from self-storage units:

[http://www.bbc.co.uk/news/business-25336446](http://www.bbc.co.uk/news/business-25336446)

<comment><USER20> This seems like a more likely outcome than living spaces. If for no other reason than a lack of water/electric outlets for home use. Air-conditioned storage units could make decent (depending on location) store fronts as well, in a sort of industrial mall sort of way.

</comment></comment></comment><comment><USER21> I don't know if they're international or not yet (I doubt it), but an Austin startup is trying to professionalize this unsexy market:

[http://www.sparefoot.com/](http://www.sparefoot.com/)

<comment><USER22> The web-enabled home-delivery version of storage: [http://www.storrage.com/](http://www.storrage.com/)

You don't get your own storage unit; instead, they pick up labeled tubs from your house, and when you want them again you can request a specific one to be delivered. They don't take furniture and such.

(Disclaimer: I'm not connected to this company in any way, not even as a customer.0

</comment></comment><comment><USER23> Self-storage is quite an interesting phenomenon. The total self storage rentable space in the US is now 2.3 billion square feet.[1] That's enough space for every American to have over 7 square feet in which to stand. In fact, that's probably enough to lay down.

To be sure, a lot of other men and women got rich before the storage men, in order for us to have more stuff than will fit in our houses.

1\. [http://www.selfstorage.org/ssa/content/navigationmenu/abouts...](http://www.selfstorage.org/ssa/content/navigationmenu/aboutssa/factsheet/)

</comment><comment><USER24> Tyler Durden says: "The things you own, end up owning you."

</comment><comment><USER25> What a silly headline. All housing is empty space when sold too.

</comment><comment><USER26> Any post about storage units should reference this George Carlin routine [http://youtu.be/4x_QkGPCL18](http://youtu.be/4x_QkGPCL18)

</comment><comment><USER27> I read most of the article but I'm still not sure: What is self-storage? How is it different from just selling storage space?

</comment><comment><USER28> The title is lame. He didn't get rich selling empty space. He got rich selling what's enclosing that empty space.

<comment><USER23> I thought so too.

You could call undeveloped, beach-front property empty space too, but it would be disingenuous.</comment></comment>


The Heroku API was down - <AUTHOR> https://status.heroku.com/incidents/543

<comment><USER2> The title of this story, "Apps are down" is a complete mischaracterization of this incident. "Heroku Dashboard/API" would be more appropriate.

Nobody's app stopped running because of this.

Edit: Thanks for correcting it!

<comment><AUTHOR> my apologies, I was referring to the "apps" dashboard page, which was inaccessible during the outage. thanks for the quick resolution!

</comment></comment><comment><AUTHOR> CLI tool is also down, heroku engineers have acknowledged the issue:

[https://status.heroku.com/incidents/543](https://status.heroku.com/incidents/543)

</comment><comment><USER3> Uptime has never really been Heroku's strong suit. I wonder why we've never heard a meta-analysis from them as far as what they could do to improve it.

<comment><USER2> To clarify, this incident did not impact running applications. It only affected the ability to make changes to running apps. AKA, this incident did not affect application uptime.

Feel free to view Heroku's 12-month historical uptime data here: [https://status.heroku.com/uptime](https://status.heroku.com/uptime)

<comment><USER3> It affected my ability to run commands on production applications. The fact that the status was degraded only for 'development' was, in my mind, disingenuous. Production should should have been orange, not green.

<comment><USER2> I interpreted your original comment, "Uptime has never really been Heroku's strong suit", to refer to _application uptime_. I guess you're actually referring to something different.

AFAIK, when any other provider speaks about "uptime", they're referring to whether or not the service they're selling is up and running. For AWS, that'd be whether your instance or ELB is up and running as expected. For Heroku, it's whether your app is up and running.

Issues in the control plane that affect your ability to make changes to your resources are generally outside the scope of any "service uptime" numbers you see published (unless that uptime is specific to the API/control plane).

Edit: We do our best to publish info for both the service, and for its control plane. I would agree that our status site categories ("production" vs. "development") might not be the best way to label this split. Previously we used "app operations" and "tools". We may yet change it again.

<comment><USER3> My impression was that development meant apps not in the production env. Now it's much more clear. I'd definitely change the wording.

<comment><AUTHOR> Agreed, this was confusing to me as well, especially since there is no real concept of "development" on the heroku platform. you can't separate your dev/test apps from your production instances in heroku, they are all just treated as "production". might be helpful to clarify this on the status page at some point.

<comment><USER2> The detailed explanation is here, linked from the status site: [https://devcenter.heroku.com/articles/heroku- status#status-i...](https://devcenter.heroku.com/articles/heroku- status#status-information)

</comment></comment></comment></comment></comment></comment></comment><comment><USER4> Update: "We lost the primary database for the Heroku API. Our engineers are failing over to a replacement."

[https://status.heroku.com/incidents/543](https://status.heroku.com/incidents/543)

</comment><comment><USER5> They're back!</comment>


Send any image through Snapchat - <AUTHOR> http://snapurl.me/

<comment><USER2> This isn't OAuth, you're just handing over your credentials to this site in plaintext.

And there's no SSL either.

What's not to love?

<comment><USER3> credentials aren't stored anywhere, only your auth key from snapchat.</comment></comment>


Banks and WikiLeaks - <AUTHOR> http://www.nytimes.com/2010/12/26/opinion/26sun3.html <comment><USER2> <http://www.nytimes.com/2010/12/26/opinion/26sun3.html>

</comment><comment><USER2> this article proves how full of shit traditional media is</comment>


Where did all of the MySQL Developers Go? - <AUTHOR> http://krow.livejournal.com/687521.html

<comment><USER2> hopefully to postgresql! I've been using postgresql as my main database since 2003. In the past if my client was using mysql, I would highly recommend that they switch to postgresql (almost 100% did). <http://www.postgresql.org/>

<comment><USER3> The article is about what happened to the core developers of MySQL, not its users.

<comment><USER4> I thought a lot of them went to work on Drizzle (now part of Rackspace)</comment></comment></comment>