Spinning gold into dollars: how BitGold intends to become a new standard - <AUTHOR> http://www.theguardian.com/money/us-money-blog/2015/may/31/bitgold-new-standard-digital-currency <comment><USER2> I think this is a marginally interesting gold trading system, the article rather fluffy, the founders distancing themselves from BitCoin [1] which, being the case, they picked a really stupid name, and they seem to completely ignorant of the whole "Why you aren't allowed by the government to create a currency without all of the money laundering rules in place" which BitCoin exchanges everywhere have been plagued with.

If we've learned anything over the last 5 - 7 years its that 'anonymous monetary transactions' are just as good as 'free porn exchange' in getting rapid growth in the Internet, and generally involve a customer based that you don't want to be associated with.

[1] _But what BitGold is up to is something rather different. Don't let the moniker fool you, says Crumb; he's not trying to turn gold into bitcoins. "We think that's a bad idea."_

</comment><comment><USER3> How is this different from E-Gold?[1]

[1] [http://en.wikipedia.org/wiki/E-gold](http://en.wikipedia.org/wiki/E-gold)

<comment><USER4> Because it has blockchains, and blockchains are magical.

<comment><USER5> They might launch some asset that is tracked via blockchain, but I'm quite sceptical about that - to me it sounds like marketing bullshit. More like running mysql database where people have this digital gold. But of course, since they are professionals they use something like Oracle or DB-2 or some existing legacy software to ledger the clients accounts.</comment></comment></comment>


As venture capital dries up, tech startups discover frugality - <AUTHOR> http://www.latimes.com/business/technology/la-fi-tn-tech-downturn-20160429-story.html <comment><USER2> There's lots of talk in there about office space and perks like ping pong tables and beer on tap and the like.

I wonder however if "frugality" might extend to software development practices - for example, we're not going to rewrite the frontend in ReactJS this month because it's working fine as it is and we need to concentrate developer time on new (profitable) features.

In other words things like "JS fatigue" (not pointing at JS in particular) are symptoms of over-staffed, over-funded teams looking for things to do.

<comment><USER3> I would caution a counter point that this wouldn't be a bad thing if it were reducing technical debt or improving automation. Of course, you did say avoiding it if it were working fine, but sometimes things that work fine still end up having a lot of impact on day to day routines and ability to get work completed.

I'm focusing a bit more on devops so naturally I would defend my point of view and job security but I think if you have some balance in there with regards to rewriting something to reduce technical debt in some fashion would be OK.

But I'd venture a guess that lots of organizations have to find that middle ground between building constantly vs remodeling / improving the foundation.

<comment><USER2> "Rewriting something to reduce technical debt" is the kind of nuclear option you would use if you had money - or developer hours - to burn.

Technical debt is better managed through gradual refactoring as part of the normal development processes. Of course there's still going to be a struggle between taking time to maintain code quality and sales wanting the next feature yesterday, but it's a different argument than "we want to rewrite this in shiny new framework X because someone on Hacker News said so" (not that this _exact_ argument will be used, of course).

Automation I'd see more as a sensible move, if it reduces costs in the long term. Again it may take a back seat to short term priorities, particularly when cash is short.

<comment><USER3> Yes, indeed, I agree with all your points. And in pretty much all cases I would opt for "gradual refactoring" (and hopefully with lots of tests before starting).

</comment></comment></comment></comment><comment><USER4> I was really surprised at how expensive a lot of B2B software tools were considering how easy they were to build. Then I remembered that a lot of these companies have to feed hundreds of idle investors, board members, advertisers, landlords, property managers, etc...

Anyway, so I got together with a co-founder (a big open source contributor like me) and we built a cheap realtime pub/sub (push notification) service: [https://baasil.io/#!/plans](https://baasil.io/#!/plans)

We are like a tenth of the price of some of our competitors but our profit margins are still ridiculously large. I guess it's because we don't have to give our profits to hundreds of idle investors and board members. We just have to feed a couple of hard-working engineers (myself included).

I look forwards to this new age of frugality and restraint with open arms.

<comment><USER5> More accurately, you don't have to pay a bunch of sales people. Sales is the dominant expense of SaaS companies (many SaaS companies in fact have more salespeople than engineers, especially when you consider that most "support" people are in fact sales).

Baasil looks interest. I've also never heard of it, but I have heard of your competitors—thanks to the marketing/sales which their higher fees pay for.

If you're actually planning to grow a business, you need to cover acquisition costs in your pricing. For many businesses, CAC is by far the biggest expense.

<comment><USER4> Yes, true. I do think that generic B2B software services like this should be treated more like commodities. Maybe this will happen as more competitors spawn up.

In my view, paying to advertise such a service is equivalent to a farmer paying to advertise his wheat.

<comment><USER6> A farmer may not have to advertise his wheat to consumers, but he still needs the stores to know about him if he's going to sell anything. I'm not a farmer, but I would imagine this would mean advertising or doing direct sales with stores. Also there is such a thing as commodity advertising. :)

Nobody really wants their product to be a commodity though, as that means low margins. Fortunately, software products tend to be complex enough that even if there are generic product categories (e.g. "email service provider"), there are still ways to stand out. Even the "pub/sub service" market has quite some variety.

</comment></comment></comment></comment><comment><USER7> For real frugality, I'd like to see much more innovation supporting non- collocated teams. The advantages are huge for everyone to work from home: no offices, no commute, recruit from anywhere without relocation. Instant messaging isn't enough. 10 years ago we had always on video phones and such. What is state of the art today?

<comment><USER8> > no offices

Don't forget that, in working from home, you do want to have an office; its just a home office. For a lot of people, that means paying more for a home with an office room. Overall, working from home doesn't save money, it saves time (which is, at least to me, worth more than the extra money is costs to work from home).

<comment><USER3> Yes, having a dedicated working space is very important. I think when you have people that work remote and cover their own working environment costs it is cheaper for the company on the whole.

But if the company is assisting remote work, e.g. paying for coworking space with an allowance that is probably still cheaper. Consider a team of 10... Even at a $200 / mo allowance for coworking that it still only 20~30% of what it would cost per month for a decent space in most major cities and there's no long term commitment.

So I think when you scale it out for small to medium teams it is cheaper and would be cheaper for a lot of startups that weren't already in a shared space.

<comment><USER7> Yep.

Even if every employee worked in their own coworking space, the advantage is that they can choose one within walking distance of their front door.

No-one needs to cause carnage to their family life if they are forced to change jobs multiple times. The idea that to find a job, you have to relocate and separate your children from their friends, clubs and schooling is quite horrifying really.

</comment></comment></comment></comment><comment><USER9> As long as Facebook and Google pay interns and recent college graduates ridiculous salaries, then startups have to match them. As long as they offer crazy working environments with massages and free food and fantasy offices, then startups have to do the same. At least in SV frugality isn't a word.

<comment><USER10> Maybe, just maybe... What a startup lacks in fringe benefits they can make up for in solving real/unique/enjoyable problems ;)

Oh... And escaping corporate BS.

<comment><USER11> But most startups aren't even solving those types of problems. They're building marketing analytics or hr management or food delivery software..

<comment><USER12> I think he means solving these problems in the work environment.

<comment><USER10> Not really... But if you want to interpret it that way it's still a valid point.

I meant not working at the startup doing marketing analytics (although this could be fun if the problem is unique and challenging) hr management or food delivery. Maybe look for the next Pied Piper and work for them :D

</comment></comment></comment></comment></comment><comment><USER13> I might be generalizing, but I get the feeling this is how world-wide start ups have operated for a long time. The reality I've seen (in France and Chile) is quite different from what I've heard of Silicon Valley Startups.

</comment><comment><USER14> Also virtualpascal is good for this, better language than BASIC and the included IDE is very TurboPascal like.

After that there is Free Pascal and the excellent Lazarus IDE which allows much more modern programming for a beginner in a friendly low friction environment.

</comment><comment><USER15> About damn time.

</comment><comment><USER16> Where was this general agreement and skepticism about the industry in the comments for Mims' "tech bubble" article yesterday?</comment>


A military exercise staged 35 years ago almost triggered World War Three - <AUTHOR> http://www.bbc.com/future/story/20181108-the-wargame-that-could-have-ended-the-world <comment><USER2>
      But because their masters in Moscow wanted to hear there
      was potential for a first-strike, to please their bosses,
      that's what the spies delivered.

      "These people were close to the West, they lived in the
      West and knew there were no plans for a first strike but
      they reported what they were told to report," Jones
      explains.
      [...]
      It was a dangerously vicious circle. "It's a failure of
      the Soviet system," says Jones, "Soviet intelligence did
      not act rationally."

Modern western governments will do precisely the same thing; the politicians ask for a dossier saying Iraq has weapons of mass destruction they can launch in 45 minutes? Then that's what they get.

I always assumed this was seen as a feature rather than a bug - i.e. that politicians choose and instruct spy agency bosses to be politically compliant, rather than to produce reports that are unbiased and strictly factual.

<comment><USER3> No, _most_ of the Western governments don't do that. The reason "coalition of the willing" was so thin is that aside the US and the UK few bought that. France have threatened veto in the UN, so it was not put to the vote… that's also how the whole "freedom fries" idiocy took off. And the rest of continental Europe was immensely sceptical.

<comment><USER4> France had no problem supporting the conflicts in Libya and Syria that sought to accomplish similar outcomes as in Iraq (remove & replace Gaddafi and al- Assad). In fact, France has routinely urged Trump and the US to remain engaged in the Syria conflict.

"Emmanuel Macron to urge Donald Trump to keep US in Syria during White House talks"

[https://www.telegraph.co.uk/news/2018/04/23/emmanuel- macron-...](https://www.telegraph.co.uk/news/2018/04/23/emmanuel-macron-urge- donald-trump-keep-us-syria-white-house/)

<comment><USER3> Both Libya and Syria conflicts were started by their respective dictators massacring people.

<comment><USER5> Khaddaffi (not sure about spelling) was a friend of France just a few years before he got killed. He was even invited to put his tent in the gardens of the Élysée by newly elected president Sarkozy, four years before. And back then, Khaddaffi was not especially a benevolent dictator.

And there are tons of counter examples. For example, Eritrea is recognized as one of the worst dictatorship in the world, and we have no troops over here to free the people of Eritrea.

<comment><USER6> Are you referring to Gaddafi?

<comment><USER5> Yep, we call him Kadhafi in French (and this time I checked the spelling).

<comment><USER7> I notice Wikipedia now spells it as Gaddafi. I thought it used to be Khaddafi in English.

Interestingly, Dutch Wikipedia now calls him al-Qadhafi.

<comment><USER8> It's such a mess. We might be better off just _translating_ the damn names (like they did in the remote past)...

<comment><USER9> Yes, but if we did that, the news would get confusing as we tried to sort out which "Grand King King of the Warrior Kings" they were talking about.

</comment></comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER10> And then there was Reagan's "My fellow Americans, I'm pleased to tell you today that I've signed legislation that will outlaw Russia forever. We begin bombing in five minutes."[0] I was in Moscow when that went public. The Soviet government was _not_ amused.

Edit: Also, Charles Stross' _A Colder War_.[1]

0) [https://en.wikipedia.org/wiki/We_begin_bombing_in_five_minut...](https://en.wikipedia.org/wiki/We_begin_bombing_in_five_minutes)

1) [http://www.infinityplus.co.uk/stories/colderwar.htm](http://www.infinityplus.co.uk/stories/colderwar.htm)

<comment><USER11> Removed from that quote is context of course, which is extremely relevant, but that didn't stop the media from making sure they induced a profiteering panic among the people that subscribed to them despite the outcome being possible nuclear death.

<comment><USER10> Well, of course, he was joking. Just a sound check.

I have no clue who leaked it, in what order. From a reprint of contemporaneous coverage, I gather that many technicians heard the remark.[0] And eventual news coverage mainly served to put rumors at rest.

0) [https://web.archive.org/web/20180917150154/https://www.thegu...](https://web.archive.org/web/20180917150154/https://www.theguardian.com/world/2014/aug/14/ronald- reagan-bombing-russia-joke-archive-1984)

<comment><USER12> There's some interesting videos on YouTube from people who used satellite dishes to grab unencrypted transmissions that weren't intended for the public (although I don't know if that was the case here). Things like reporters talking shit about guests during a commercial break (since commercials were spliced in later on), Bill Clinton getting his makeup done, etc. There's an interesting documentary/compilation at [1] although in my opinion it's a little overly dramatic.

[1]: [https://www.youtube.com/watch?v=BdXtIJNNVZM](https://www.youtube.com/watch?v=BdXtIJNNVZM)

<comment><USER10> No, this was routine setup and testing. You had to actually record something, and play it back, to make sure that gear was working properly.

Your link reminds me of Cronenberg's _Videodrome_ :)

</comment></comment></comment></comment></comment><comment><USER13> Deutschland 83 is a fantastic show based on these events.

<comment><USER14> I really enjoyed that too. I was a teenager then and although in the UK I was very aware of the military and world situation. That series was a very good reminder of what the world felt like then.

</comment></comment><comment><USER15> We still have the chance - minor Ukraine/Russia navy conflict yesterday so far resulted in nation wide martial law in Ukraine triggered on today. I'd not put it past Putin to not let the crisis go waste and for example "solve" the Ukraine/Russia Azov sea issues by making the Azov sea outright into an internal Russian sea which would naturally raise the tensions with the NATO/Europe/US and others. (Also, given the extremely low rating (barely above 10% on a good day) of the current Ukraine President just 4 months ahead of the elections, the escalation of the situation with the associated rise of the nationalistic populism is in his political interests too.)

<comment><USER16> I don't see how an incursion on Ukraine would result in a war with NATO. Ukraine's problem is precisely that it's a formerly neutral party and not part of NATO. In fact, from a Russian POV the reason for the annexation of the Crimean peninsula were fears fueled by Ukraine moving closer to NATO and the EU, violating its neutrality and jeopardising Russian military operations within Ukraine.

I'm not justifying the annexation -- it was clearly illegal and the circumstances of the (also illegal) vote suggest fraud -- but Ukraine is not part of NATO and even an all-out undeniable Russian invasion wouldn't trigger a war with NATO.

Is it in NATO's interests if Russia fully invades or goes to war with Ukraine? No, of course not. Is it a violation of international law? Most likely so. But would this trigger any international treaties that would result in WW3? Hell no.

WW1 and WW2 weren't just escalated because The Good Guys were unhappy with the aggressors. They were escalated because of international treaties _forcing_ nations to declare war in retaliation to the aggressors.

In WW2 the invasion of Poland triggered the defensive pact with Britain and France who declared war after setting an ultimatum. As for WW1, I think most people have heard of the complete clusterfuck of international alliances and naivety that resulted in that escalation[1].

Ukraine is not part of the EU. Ukraine is not part of NATO. Strategic position aside, there's little reason for NATO to get involved as long as Russia has no intentions of moving further westwards. Even if the US invaded directly and declared war on Russia this wouldn't trigger NATO as NATO is a defensive pact, not an aggressive pact. It would of course result in a lot of diplomatic tensions with so many US military bases being located in the EU.

[1]: [https://en.wikipedia.org/wiki/July_Crisis](https://en.wikipedia.org/wiki/July_Crisis)

<comment><USER17> While a war might not be triggered in a WW1-esque "if X then Y" sense it may very well happen anyway. Ukraine is as entitled to it's sovereignty as any other nation. Just letting the Russians steamroll Ukraine is not exactly a good solution either. Germany, France, England, etc. are going to (rightfully) have a very, very hard time tolerating (i.e. not coming to the aid of Ukraine) that kind of belligerent behavior in Europe. If there were Russian tanks in Kiev the NATO states east of Germany would all but demand a military reaction because of the dangerous to them precedent that allowing an invasion (even if the invaded nation is not a NATO member) to go unopposed would set.

<comment><USER16> What gives you the idea any military intervention is ever based on protecting a random country's sovereignty? What incentive would NATO or the EU have to join Ukraine if this escalates to a direct military confrontation between Ukraine and Russia?

Yeah, having Ukraine be annexed by Russia would be a pity but if history has taught us anything a) Russia is too clever to do this without some level of deniability (see the "secession" of the Crimean prior to its annexation) and b) other countries are reluctant to get involved as long as the situation is "self-contained" (i.e. as long as it's just Ukraine and similar post-Soviet states with no direct ties to NATO members or the EU).

</comment></comment></comment></comment><comment> m-i-l Not mentioned in the article, and almost certainly not known to NATO authorities at the time, but Able Archer 83 came a few weeks after the "1983 Soviet nuclear false alarm incident"[0]. See also "Stanislav Petrov, a Soviet officer who averted nuclear war, has died"[1].

[0] [https://en.wikipedia.org/wiki/1983_Soviet_nuclear_false_alar...](https://en.wikipedia.org/wiki/1983_Soviet_nuclear_false_alarm_incident)

[1] [https://news.ycombinator.com/item?id=15273228](https://news.ycombinator.com/item?id=15273228)

</comment><comment><USER18> I find calling the potential deployment of nuclear missiles at this point "world war three" slightly misleading. A war has a beginning and an end. There is no end other than the end of the world as we know it on the other side of such strikes.

As the exercise concluded in the article, "Most of the world was destroyed. Billions were dead. Civilisation ended."

<comment><USER19> Sadly a nuclear war is "highly" survivable as long as you know to duck and cover once you see the flash.

I say "sadly" because it's not as big a deterrent as we thought.

You can read how to avoid 90% of the deaths here : [http://www.ki4u.com/goodnews.htm](http://www.ki4u.com/goodnews.htm)

<comment><USER20> This is misleading nonsense. In a real war most targets would be barraged by MIRVs, some of which would be ground bursts specifically designed to maximise the effects of fall out plumes across otherwise survivable areas.

One way or another, your initial duck-and-cover survival won't last long.

<comment><USER18> It's also misleading because it's talking about a bomb 1/10th the size of the Hiroshima nuclear detonation, while today, even just India and Pakistan alone have nuclear capabilities that are a hundred times beyond that. The implications not just from the initial strikes but the infrastructural devastation that would follow are impossible to estimate.

<comment><USER21> I suspect the kind of civil defence training described on that page _would_ probably help with a small scale terrorist level attack. However, I don't think it would achieve very much in a full scale attack and certainly not the scale of attacks likely during the 1980s and on densely populated areas of Europe.

Where I sit now in Scotland is within range of about 5 different high value Cold War targets - I don't think Duck and Cover would achieve very much.

</comment></comment></comment></comment></comment><comment><USER22> One of the best documentaries ever made; "Able Archer: the brink of apocalypse" conveniently on youtube.

[https://www.youtube.com/watch?v=7ciy5R-tLiE](https://www.youtube.com/watch?v=7ciy5R-tLiE)

And yes, this should be a warning to people in current year.

</comment><comment><USER23> 1983\. The screaiming height of the nuclear scare. I remember it all to well. A very clear and present danger, a daily threat we lived under, some of us aware, most people probably not really. I saw _The Day After_ in a Copenhagen cinema at what I believe was its European premiere, also exactly 35 years ago one of these days. Going home, my young impressionable self was even more spooked than usual: The thing was real, might happen any time, would presumably be worse than film, worse than imaginable.

To this day, I actually shiver when I read of _Able Archer_ and realize how closely the shit flew past the fan the very same week.

<comment><AUTHOR> If you want to relive the terror I suggest reading the Pulitzer Prize winner "The Dead Hand: The Untold Story of the Cold War Arms Race and Its Dangerous Legacy". While its focus is on the Cold War it's still relevant today.

[https://www.amazon.com/Dead-Hand-Untold-Dangerous- Legacy/dp/...](https://www.amazon.com/Dead-Hand-Untold-Dangerous- Legacy/dp/0307387844)

</comment></comment><comment><USER24> Mutually assured destruction makes sense if humans and information is perfect .... but it's not so it seems more like it is just a matter of time until it happens.

It is interesting to see how this plays out as the start of an exercise. I remember growing up in North Dakota and when the air force bases would run drills the sky would be filled with planes flying in formation .... no way you could tell if it was real or not (other than there not being any launches from the local ICBMs...).

<comment><USER25> >Mutually assured destruction makes sense if humans and information is perfect .... but it's not so it seems more like it is just a matter of time until it happens.

Or not. If it is chance that prevents our self-destruction then you would expect it to already have happened. Seems like there is 'something' (for lack of a better word) to prevent it. Whatever it is, it seems to work and we're still here.

<comment><USER24> I'm not sure the lack of self destruction in a short time frame means much, the events that have occurred were one decision away from the destruction part.

</comment></comment></comment><comment><USER26> My takeaway from this is that governments do not always act rationally, and therefore MAD doctrine, which assumes that the actors are rational, is a dangerous nonsense.

<comment><USER27> What's the alternative to MAD? We still have it. People have calmed down, but it remains.

I always took it to be a description of the state of play once nukes exist.

<comment><USER26> The alternative to MAD is slow, painstaking process of nuclear disarmament. Mutually-assured disarmament, if you will.

<comment><USER27> How do you do that though? Whoever doesn't disarm has a massive advantage.

</comment></comment></comment></comment><comment><USER28> On a smaller scale, that is, like michaelt pointed out, party of every government that has authoritarian figures in it. When you reel the people around you with fear, you will get inaccurate information. That is one of the reasons why, if you don't build an extensive surveillance state that works really well, such governments usually don't last long.

</comment><comment> orbital-decay What this article fails to mention, is that Able Archer 83 was a response to Zapad-81 exercise held 2 years before. [0]

[0] [https://en.wikipedia.org/wiki/Exercise_Zapad-81](https://en.wikipedia.org/wiki/Exercise_Zapad-81)

</comment><comment><USER29> Everyone really needs to stop with any actions that could be misinterpreted. This is how World War 1 started, a war which no one wanted.

<comment><USER30> > a war which no one wanted

History would like a word with you: [https://www.independent.co.uk/news/world/world- history/first...](https://www.independent.co.uk/news/world/world- history/first-world-war-centenary-powerful-images-that-capture-the-moment- cheering-europe-heralded-the-9646821.html)

</comment></comment><comment><USER31> I find it eerie that the movie _War Games_ came out the same year, actually five months before.

</comment><comment><USER32> > Later that day, the Nato commanders left their building and went home, > congratulating themselves on another successful – albeit sobering – > exercise. What Western governments only discovered later is that Able Archer > 83 came perilously close to instigating a real nuclear war.

You'd think that NATO was just having their quiet simulation and those silly Soviets misinterpreted, right?

What the article fails to acknowledge is the deliberate provocations targeting USSR at the same time as the military exercise - [https://en.wikipedia.org/wiki/Able_Archer_83#Psychological_o...](https://en.wikipedia.org/wiki/Able_Archer_83#Psychological_operations) :

 _" Psychological operations (PSYOP) by the United States began in mid- February 1981 and continued intermittently until 1983. These included a series of clandestine naval operations that stealthily accessed waters near the Greenland–Iceland–United Kingdom (GIUK) gap, and the Barents, Norwegian, Black, and Baltic seas, demonstrating how close NATO ships could get to critical Soviet military bases. American bombers also flew directly towards Soviet airspace, peeling off at the last moment, sometimes several times per week. These near-penetrations were designed to test Soviet radar vulnerability as well as demonstrate US capabilities in a nuclear war"_</comment>


Is it just me or has TechCrunch become FacebookCrunch? - <AUTHOR>

<comment><USER2> It's not just you. I still believe they are mostly "responsible" for inflating Facebook's valuation from $20 billion to $80 in a matter of months, with all their posts about Facebook's valuation increasing, therefore creating a feedback loop, where one more post raised their value higher, and so on.

They are the only site around that uses Facebook comments from what I've noticed, and many people stopped going there because of that. And their stories lately on Facebook do seem extra sensational.

I don't think Techcrunch has any credibility left. They're clearly picking winners and taking sides with certain startups on their site.</comment>


TXJS - June 5th, Austin, TX - <AUTHOR> http://txjs.eventbrite.com/

<comment><USER2> Cool beans, thanks for posting this. Hopefully they determine the exact location soon -- I'd buy a ticket right now, but I'm bike-/bus-bound, so that could turn out to be a bad idea.</comment>


PostgreSQL beginner guide - <AUTHOR> https://knowledgepill.it/posts/postgresql-basics-guide/ <comment><USER2> So this is cool, and can serve as a good cheatsheet for beginners.

However, the question where I struggled the most: how the hell do I set up a secure Postgres instance on some cloud VM or server? (I _really_ love those 2.50 bucks per month instances)

I spent a fair amount of time reading up on it, but it's still really easy to make a mistake in your `pg_hba.conf` or somehwere else. I remember disabling password based login, and just authenticating over SSH, and my server still got compromised after a day or two. 100% my fault - I think it was related to `COPY FROM/TO` being able to run arbitrary commands because I didn't understand that `postgres` is regarded as a superuser by the database.

I've been using managed services like Heroku Postgres and RDS ever since.

Point is: it would be of huge value to have a clear (but complete) overview of how to configure a Postgres instance so that it's secure in the basic sense. If that isn't possible (or very hard) then please let's collectively tell beginners to just use managed instances.

<comment><USER3> I'm not sure where you went wrong; by default, Postgres _is_ secure; the configuration listens on localhost and even if you change that, does not allow network access to the superuser. Distributions may ship with less secure configurations but I'm not aware of any that do.

I'm also pretty sure that the upstream documentation warns against using the superuser for application access, so if you just create a regular database user protected by a reasonable password it will be as secure as any database exposed to a network can be; of course, exposing databases to the internet is something to be avoided in the first place.

non-mobile EDIT:

The above ignores TLS, which is generally a good idea if you want to make something accessible over the network.

A guide for beginners might be useful, but if you work with these things, it may be useful to learn how to approach security in general so that you will be able to learn how to secure anything, or at least know when you don't know enough.

In general, installing services securely requires the administrator to understand how the service is accessed by legitimate users and whether in doing so is potentially exposed to external access. If you just google for how-tos you're quite likely to find lots of bad advice that skips security considerations and takes you from A to B the fastest route.

The effort required is entirely dependent on your requirements; in most cases, avoiding exposure to the internet, patching your software and using strong passwords is enough, as it stops nearly all low-effort automated attacks.

For starters with any network-exposed service, you should understand that not exposing it to the internet in the first place means that the rest of your security measures will be challenged less; so if you can, limit access to internal networks and specific hosts with firewalls and ACLs.

If you have to expose a service to the internet, then you need authentication and authorization; anyone will be able to connect to the service, but the service should challenge them to identify themselves using secure credentials.

Once the user has access to your service, you'll want to limit what they can do with it. This requires reading the manual.

Lastly, you'll generally want to keep your software up-to-date; unpatched software may have bugs that allow attackers to bypass some of the security measures you have set up.

<comment><USER4> > A guide for beginners might be useful, but if you work with these things, it > may be useful to learn how to approach security in general so that you will > be able to learn how to secure anything, or at least know when you don't > know enough.

Any suggestions on how to get started with this?

<comment><USER3> That's a tricky question. Personally, I find that while reading about something is a good way to gain a vague understanding of how something works, to actually integrate it, I need to actually get a system set up and then just dig around and see how things interact.

What could work is something akin to a Wikipedia dive. Pick a system to set up and make note of as many concepts along the way as you can; For example, setting up a Postgres database involves networking (what does a "listen address" actually mean?), different kinds of authentication (eg. pg_hba md5, trust, and peer authentication options), OS users _and_ database users (easy to get those two confused), among other things. One could also wonder why there's a database superuser, and what makes the system such that using it for application access it is a bad idea?

Then try thinking about potential ways of how all these things could interact to break a system. This can give you a lot of insight into how to secure systems against attackers.

For example, setting up Postgres to not authenticate users is not necessarily detrimental to the overall security of a system if everything is local and single-user, but makes the system extremely weak if _any_ component on the host is exploitable from the outside.

So even if you really don't want to use passwords, you should at the very least use peer authentication where the database allows only specified OS users to connect such that any attacker must at least be able to access the system as one of those users.

Lastly, if you put a non-authenticating system on a network, it should not be surprising that anyone who happens to be able to poke at your network address can just waltz in without resistance. You'll at the very least want strong passwords, possibly with brute force detection to detect people trying to guess credentials. The IPv4 internet is only about 4 billion addresses, and automatically scanning through them for listening services is routine for attackers. :)

<comment><USER5> > Then try thinking about potential ways of how all these things could > interact to break a system.

This is where your advice goes south, IMHO. The sysadmin can't think of every possible way his system can get compromised -- they are not paid for that, black-hat hackers are.

Instead of collecting settings from a hundred places that must be set correctly for production, and inventing ways the system can get compromised, the safe settings could be provided in one place: ideally in the default settings so they are impossible to miss, or in a list, such as Django's deployment checklist [1].

Not saying that Postgres doesn't provide such a list, although googling for "checklist site:postgresql.org" only resulted in a mailing list reply [2], with some points not trivial to follow. Please comment below if you know an official one.

[1]: [https://docs.djangoproject.com/en/3.0/howto/deployment/check...](https://docs.djangoproject.com/en/3.0/howto/deployment/checklist/) [2]: [https://www.postgresql.org/message- id/D960CB61B694CF459DCFB4...](https://www.postgresql.org/message- firstname.lastname@example.com)

<comment><USER3> Of course you don't need to think of _every_ possible way to compromise a system; just enough to reasonably protect against your threat model given the resources you have. If you have a complicated system that requires "hundreds of settings", then you just have to put more effort in making sure you don't miss anything.

I'm pretty sure most security breaches are caused by _really_ basic configuration mistakes (or process failures). following a checklist can definitely be effective, but if you don't actually understand why you're configuring things as you are, you're likely to make mistakes elsewhere.

</comment></comment></comment></comment></comment></comment><comment><USER6> The very first sentence: "By default after _instalation_ and _creting_ database cluster PostgreSQL will _listner_ only on localhost."

Bit worried about the quality of the content, based on the quality of the proofreading.

<comment><USER7> >Bit worried about the quality of the content, based on the quality of the proofreading.

I don't know why this feeling persists. The ability to proofread or write free of spellings is a skill completely unrelated to the underlying content. Complaining about the spelling just seems childish at this point. We live in a world full of mistakes and problems. Dealing with life despite of them is a fundamental life skill.

<comment><USER8> There's definitely a middle ground here. I have been in academic contexts where every sentence has to be absolute perfection before we submit for publication. Thats overkill, for sure, but there is merit to proofreading as a sign of legitimacy of the argument itself. Some dude literally wrote this text and didn't even re-read the post before publishing. Clearly, he's either the greatest expert at technological things that it's second nature to him even more than LANGUAGE, or he just did a shoddy job on both sides. Unless I see the name to be Linus Torvalds or something, I'm just going to assume this post is low quality in general.

</comment></comment></comment><comment><USER9> Can anyone recommend an "advanced" PG guide? I'm looking to learn all the ins and outs of Postgres.

<comment><USER10> [http://www.interdb.jp/pg/](http://www.interdb.jp/pg/)

[https://www.postgresql.org/docs/current/internals.html](https://www.postgresql.org/docs/current/internals.html)

</comment></comment><comment><USER11> I get that this is for learning purposes, but doesn't this tutorial start by making your database insecure?

<comment><USER12> If you need remote access to the DB, then you need remote access. Most people in a normal setup would not have the database server ports directly exposed to the Internet, but if you have the perspective that all servers are in the cloud, then you would also be expected to know how to keep them secure.

But making it listen on an external IP does not inherently make it insecure, as long as you also have other firewall and user account controls.

<comment><USER13> I don't know much about Postgres specifically, but what I'm seeing in the tutorial does seem insecure.

> If you need remote access to the DB, then you need remote access

That's not a defence for teaching insecure practices. It's possible to configure Postgres for secure remote access.

Using md5 for password security seems like a red flag, and sure enough, the Postgres docs remind us that md5 should no longer be considered secure. [0] I don't think there's any verification of the server's fingerprint, either.

There's really no excuse here, as there's a quick and easy way to do it: SSH tunnels. [1]

> Most people in a normal setup would not have the database server ports > directly exposed to the Internet

Not a safe assumption. Instances on Linode and, iirc, Digital Ocean, are not behind a cloud firewall, all ports are wide open to the Internet. (I think that's a bad move on the part of Linode and Digital Ocean, but that's not the point.)

> if you have the perspective that all servers are in the cloud, then you > would also be expected to know how to keep them secure

If you already knew how to securely configure Postgres, you wouldn't need the tutorial.

> making it listen on an external IP does not inherently make it insecure, as > long as you also have other firewall and user account controls

You still need to configure the crypto properly.

[0] [https://www.postgresql.org/docs/current/auth- password.html](https://www.postgresql.org/docs/current/auth-password.html)

[1] [https://www.postgresql.org/docs/current/ssh- tunnels.html](https://www.postgresql.org/docs/current/ssh-tunnels.html)

</comment></comment></comment><comment><USER14> This is a good beginners' resource.

For those looking for similar Postgres related resources, I've found this handy Postgres Cheat Sheet [1] to be really useful.

[1] [https://postgrescheatsheet.com](https://postgrescheatsheet.com)

</comment><comment><USER15> Is there a good way to embed postgres in applications? I've preferred sqlite, but would like to just use postgres everywhere, but requiring users to install it as a service and maintain that globally just makes it unreliable for embedding.

<comment><USER16> No.

</comment></comment><comment><USER17> Related side note/question. I was on a project recently where postgres was used with a NodeJS JavaScript server app. It seems a bit backwards. Like you have the flexibility of a loosely typed server app but all the annoyance of a RDBMS. It just made development a nightmare. The 'strictness' if the system was just backwards.

Surely NoSQL + typescript is better for development (and potentially for performance).

Thoughts?

<comment><USER18> I see it the other way around. Code is fluid, data persists. So I would expect more rigor in the design of the schema then anywhere in the code. And hopefully with some fore-sight, you won't have to change it every other day. Migrating the data requires also some reflection.

No amount of work of coding will fix your data, if it is a mountain of inconsistent garbage.

<comment><USER17> I guess with experience comes the ability to correctly design the schema from day one. The project was just getting off the ground so schema was evolving constantly. If only there was such a thing as pgconfig.json which allows me to configure how strict I want the db to be - a sliding scale between NoSQL to SQL.

<comment><USER18> No one gets the schema right from the beginning. Waterfall is out of fashion for a reason. And there are schema migration frameworks out there for that purpose.

If you care for the data you store, you'll have to take care of your data. ACID and the "rigidness" of schemata are tools for that, and to keep the complexity in check. It is much easier than accruing technical debt by having unstructured data and having later to figure out to make heads and tails of what you and your colleagues did at some arbitrary earlier time. (Not that crappy SQL designs don't have that problem).

If you don't care for your data, as you are in the beginning, why don't you create the DB then from scratch? You can use various editors to create the schemata from tools you are more comfortable with.

Don't work against the tool, and find the slider in your head to adjust your way of working.

<comment><USER19> I strongly disagree with this. Getting the schema right, reduces code writing and code maintenance.</comment></comment></comment></comment></comment>


The OS Doesn't Matter… - <AUTHOR> http://www.mondaynote.com/2010/10/03/the-os-doesn%E2%80%99t-matter/ <comment><USER2> This post is amusing because it writes off Windows, but then claims that the UX and the developer tools are the two areas where there's a lot of work to be done on modern UNIX systems.

For those who haven't used them professionally, Microsoft's developer tools are absolutely fantastic. And not just the editors, debuggers, and code assistance -- the profiling, system monitoring, and large project workflow tools are years ahead of anything that you can get off-Windows. Even if you're willing to pay Real Money to IBM, the only other serious tools vendor left, or pre-merger Sun, which had the best non-Windows profiling support in-system. Coming back to XCode, the GNU stack, and Eclipse after years on the MSFT platform was like taking a flying leap back into 1998.

UX is pretty consistent on both the Apple and Windows platforms. Once you learn a couple of apps, you've basically learned them all. I can't say that for the Linux desktop, where apps still seem to be roughly as consistent as architectural patterns across 3rd party Java frameworks. It's hard to imagine something "better" without moving to a new device factor so that you don't alienate your user base.

<comment><USER3> "The profiling, system monitoring, and large project workflow tools are years ahead of anything that you can get off-Windows."

It's patently false that the profiling and system monitoring tools you can get on Windows are _years_ ahead of anything you can get on a different platform. In fact, it's the opposite [1, 2]. And I wont even get into the fact that we're still catching up to 30 year old Lisp machines in the areas of editor integration, debuggers, and code assistance.

[1] <http://en.wikipedia.org/wiki/DTrace>

[2] <http://valgrind.org/>

<comment><USER4> I don't think you've experienced the level of integration Visual Studio brings to this. DTrace and Valgrind are great but they would need to be _seamlessly_ integrated into Eclipse to be comparable.

<comment><USER5> In-application integration is necessary? Higher integration just means that your debugging task is modal instead of allowing you to edit your comments while the debugger is running. It also means your application eats up more memory and takes longer to launch. It _also_ means you can't substitute it as easily for something different.

I'll take my separation + hooks for launching _any_ day over massive integration that means doing what you want is hard / impossible.

<comment><USER6> Actually you get both. I can edit comments while debugging and I can edit code that gets recompiled on the fly while debugging.

<comment><USER5> Depends on the language / framework. ASP.NET 2.0 with VB, for instance, does not. Furthermore, modifying a WebService doesn't inform the web server that it's been updated, so it keeps serving up old versions of your code.

ie, even MS's own products don't play nicely with each other. But you're more stuck with them than you would be with something more atomic and disconnected.

</comment></comment></comment></comment></comment></comment><comment><USER7> To me, this is like a automotive executive saying "the engine doesn't matter, they're all the same anyway". The engine probably _doesn't_ directly matter to most customers and they _are_ mostly the same. However, it's lunacy to say that the heart of your product isn't important. If the engine has problems, your customers have problems. If the OS has problems, your customers have problems too.

Yeah, developer tools and APIs are very important, but they're only as good as the platform they target.

<comment><USER8> The majority of available operating systems provide similar system interfaces. The same is not true for user experience, developer tools and APIs. His point is that these peripheral features will determine the success of operating systems.

Consumers are more concerned with the shape of a car than the engine that's inside.

<comment><USER7> Customers _do_ care about the engine, just not explicitly. They may want a car that goes fast, gets good gas milage, and is reliable. They won't ask about the engine, but it has an effect on those things.

By that same token, customers want a mobile phone that is fast, gets good battery life, and is reliable. Again, they won't ask about the OS, but it has an effect on those things. Thus, customers care about the OS; they just don't know it. Plus, I shouldn't have to tell you that similar interface != the same thing.

</comment></comment></comment><comment><USER9> Actually Windows NT was a completely new kernel that had nothing to do with the old Windows 3.1/95/98/ME stuff.

<comment><USER10> "Actually", his sentence begins with the word "Initially".

> _Initially built on top of DOS, Microsoft painstakingly added version after > version, always striving for backward compatibility while, at the same time, > adding new features._

It was "initially" built on DOS. And over time, Microsoft painstaking strove for backward compatibility, not giving it up even for a major architecture change. NT offered a DOS VM (VDM) / Windows VM (WoW)[1], and Windows 7 offers an XP VM [2].

[1] <http://kb.iu.edu/data/acxn.html> [2] <http://www.microsoft.com/windows/virtual-pc/download.aspx>

<comment><USER4> Yes and "initially" Unix could only run one process at a time. But modern Unix is far in advance, and modern Windows is far in advance of DOS.

<comment><USER11> What are you talking about? Even Multics was multitasking. Heck, that's already in the name.

<comment><USER4> Unix has no code in common with Multics.

In the first Unix, starting a process from the shell did exec, not fork. When the "child" process exited, the kernel would restart the shell. All the process control stuff came when Unix was rewritten in C from the original assembly.

<comment><USER11> I know they have no code in common. I'm talking about the fact that both were multitasking from the beginning. You're talking about specific early shell behavior. Nothing to do with capabilities of kernel which provided multitasking for two terminals at once.

 _Processes (independently executing entities) existed very early in PDP-7 Unix. There were in fact precisely two of them, one for each of the two terminals attached to the machine._

[http://citeseerx.ist.psu.edu/viewdoc/download?doi=10.1.1.156...](http://citeseerx.ist.psu.edu/viewdoc/download?doi=10.1.1.156.4012&rep=rep1&type=pdf)

</comment></comment></comment></comment></comment></comment><comment><USER12> Though this is slightly unrelated, I wish I could send this article to every software company who makes the tools I need, but only makes them windows compatible. I'm all unix on my end, but I'm having to scrape together emergency funds for a windows box that can run ESRI and other GIS systems (my systems are just old enough to prevent a feasible dual boot as well). It's not huge issue, but definitely an inconvenience.

<comment><USER13> I am not familiar with current pricing, but if you need to scrape together funds, I would guess that buying GIS software would be out of the question. Nowadays, most specialized PC software is more expensive than the minimal amount of hardware it needs to run.

<comment><USER12> You're correct about the software- it's brutally priced. But I have access to University copies that, though underpowered, can work for what I'm trying to do right now. I'm extremely lucky though.

<comment><USER13> Aha, now your statement makes sense to me. I did not think of that possibility.

</comment></comment></comment></comment><comment><USER14> "The OS" doesn't matter because it has been decoupled from "the platform", which remains crucial. Developing for Android or iOS, you are exposed only to vague clues that they are implemented on top of Unix. The only reason the OS ever did matter is because virtual machines and complete API abstraction layers have not always been practical.

Also, writing off QNX as just another Unix is a mistake. An RTOS with synchronous IPC baked in to the kernel is potentially game changing technology, though I am skeptical that RIM will manage to fully exploit it.

<comment><USER15> What advantages do you expect those attributes of QNX could bring to RIM and their users? I understand that QNX has more sophisticated real time capabilities than Android's Linux and iOS' Mach/BSD kernel, but what does that make possible/easier for applications and frameworks on top of QNX than on top of those other kernels?

I certainly agree with you that "the OS" doesn't just mean the kernel nor even the basic userland anymore.

<comment><USER14> It's a big topic, but in a nutshell: when you can make calls across processes, simply and efficiently, it opens a world of possibilities for interoperation between applications. You can't fake this with sockets, no matter what you layer on top.

Surprisingly, it was the legacy BlackBerry OS that made me realize this. It has seamless IPC too, but only as a side effect of a horrifically insecure and unstable memory model.

<comment><USER15> Do you have any examples or links? I'm sorry, I'm really interested in what you're saying but I'm just having trouble imagining how it would affect my architecture or what I could do with it that I couldn't feasibly do without. Thanks. And, yeah, things were a whole lot easier back before all this silly security and memory protection, weren't they? :)

<comment><USER14> It takes a bit of imagination, but think about replacing shared libraries, plugins, and socket IPC with _services_ that live in their own process with their own lifecycle and security sandbox, but can still be accessed efficiently. Apps can be built from many such services, and services can be shared between apps.

There have been many attempts to build this sort of capability into mainstream operating systems, but none have become popular due to the inescapable complexity of IPC. A recent example is D-Bus, which is supposed to be "lite" yet still involves XML interface descriptions and serialization. It's enough of a hassle to implement that nobody bothers, unless it's the only option or they are evangelizing the technology.

QNX is built from the ground up to do everything this way. If it makes IPC easy enough, it could bring this type of software architecture to critical mass.

I realize this is still pretty vague, but I can't think of a specific example at the moment. If you're interested, read up on QNX, or Coyotos, which is a more experimental OS that is based fundamentally on IPC.

<comment><USER15> Thanks very much for the reply. Yeah, that's interesting. I wonder how much Blackberry's new OS will leverage that, especially since they seem to be targeting the ability to write apps that run on OS 6 and the new Tablet OS. I suppose that's probably more at the UI level whereas services that can be cleanly separated could still perhaps use a separate service model on the QNX based OSes. And of course there could be some interesting implications for the OS' ability to manage these granular processes for maximizing battery life/etc.

</comment></comment></comment></comment></comment></comment><comment><USER16> I got interested in technology at the time when the mantra was "UNIX is dead, Windows is the future" It's amazing how much things have changed. It's probably a testament to how good Windows actually is that Microsoft has been able to hold onto the desktop computer market while the rest of the technology industry has adopted Linux/UNIX on such a large scale. It's a fun exercise to make a mental note of all the various Linux/UNIX devices you see in a day. SOHO routers, TIVOs, TVs, SmartPhones etc. It's everywhere.

</comment><comment><USER17> > The App Store genre, invented or not in Cupertino, is now part of that loop, > a killer OS component, one that deserves a Monday Note of its own.

There's very little out there that Apple can honestly lay claim to having invented. Refined, improved, made look silky smooth, sure. Invented? No. OSX is built on ... *Step technology. The Mac OS Classic GUI is taken from the Lisa, which is taken from the Xerox Parc. The MP3 Player? Nope, not theirs either.

All of those are great examples of something Apple has taken from elsewhere, refined and improved. The App Store concept had been implemented some time beforehand by Linspire (with Click 'n' Buy for Lindows) which in turn was a front-end to Debian's APT package management tool.

<comment><USER18> The basic idea is from Xerox (bought a paid by Apple stock), but the refinements done by the Mac team are really not given enough credit. I wish Parc had been able to release their stuff, but one should really go search for how their windowing system actually worked. The Mac team did some serious refinements (not to mention an amazing job of getting it to run on such a resource starved system).

Truthfully though, the current Apple is really more of an NeXT takeover of Apple and *Step is a direct legacy.

<comment><USER19> It is fair to say that the Mac team invented the GUI, while Xerox invented the Mouse.

<comment><USER20> That would be fair, except that the mouse was invented at SRI. Also, Xerox did release a commercial GUI product before the introduction of the Mac, as did Three Rivers (PERQ) and AT&T/Teletype (the Blit). So there's that.

<comment><USER21> They did invent overlapped windows, and clipping efficient enough to get away with it. They thought they had seen overlapped windows at PARC, but those were actually just tiled.

Also auto-configured network clients.

</comment></comment></comment></comment></comment><comment><USER22> To me it looked like Apple would scrap OS 9 for BeOS, but after Steve Jobs came back it was forgotten. I remember playing around with BeOS at the time and thought it was pretty fun, though I don't know much about it. Is it UNIX based? Has it gone anywhere since?

<comment><USER23> > To me it looked like Apple would scrap OS 9 for BeOS, but after Steve Jobs > came back it was forgotten.

Erm... Jobs came back because the BeOS deal didn't go through. That was the point: Apple could go on their own, with Be or with NeXTSTEP. NeXTSTEP was Jobs's company.

> Is it UNIX based?

No, though it has a POSIX compatibility layer (and therefore access to BSD CLI utils)

> Has it gone anywhere since?

Be, Inc was sold to Palm for a penny in 2001 and BeOS was killed. Fans are writing an OpenSource BeOS (with no IP-relations to the original one, but goals of being able to run BeOS binaries unmodified for instance) with Haiku: <http://haiku-os.org/>

<comment><USER22> So, now BeOS is owned by HP?

<comment><USER23> Technically yes, though actually BeOS is dead (unless you count Haiku).

</comment></comment></comment></comment><comment><USER24> Let's not forget Lisp OSes like Genera or Xerox's. Plus ca change, plus c'est la meme chose.

</comment><comment><USER25> When many database systems or language implementations rely on os cache, scheduling, threading and eventing implementations among other things then yes, the os matters.

</comment><comment><USER5> > _Windows will live on — in a PC industry now at a plateau._

In America, maybe. Are they claiming the number of PCs will not increase significantly? Especially given their losing ground to OSX, they're most certainly not at a plateau that isn't self-inflicted.

<comment><USER26> Yes, but large parts of the world are explicitly trying to avoid becoming dependent on MS software. While Windows is still growing in other countries, quite a few are subsidizing or requiring the use of other OSes (usually linux), trying to avoid too much lock-in. [Added: OK, I see what you are getting at, I had read the original paper to mean that Windows on PCs was at a plateau; it is pretty common to use PC to mean a PC with Windows. And with iPads, netbooks, smart phones and the like, the PC form factor might actually be at a plateau itself, or approaching one.]

<comment><USER5> Certainly. But that does not imply at _all_ that the _PC industry_ is at a plateau, simply that MS may be.

</comment></comment></comment><comment><USER27> I wish the writer of this article, Jean-Louis Gassée, could have had better luck leading Be Inc and BeOS, as it was my all time favorite OS. I still run it in emulation, from time to time.</comment>


Show HN: Functions as a Service (FaaS) on Docker Swarm - <AUTHOR> http://blog.alexellis.io/functions-as-a-service/ <comment><USER2> This seems like a really interesting approach. Just don't take it too far or you'll end up with something like this ;-) [http://thedailywtf.com/articles/the-inner-json- effect](http://thedailywtf.com/articles/the-inner-json-effect)

</comment><comment><USER3> If you'd like to experiment with an open-source FaaS server that doesn't require Docker, I'd suggest checking out: [https://github.com/stackvana/microcule](https://github.com/stackvana/microcule)

<comment><AUTHOR> Thanks for linking out - having looked at the project, the first thing I would do is to host it in Docker :)

There are some interesting parallels in the examples. One thing which I think is still too hard is getting HTTPs-style web hooks for AWS events. Any privately-hosted/hybrid solution would need a way to make that kind of integration easy.

</comment></comment><comment><USER4> It's an interesting idea. Will it scale down to running all of the functions within a single process though (aka, like a singular monolithic app)?

I admit that I've not done any reading on this, so I am not sure whether I am thinking about it in the right way.

</comment><comment><USER5> I am investigating Variable Assignment as a Service.

Sorry.</comment>


Heroku Dynos Unable to Start - <AUTHOR> https://status.heroku.com/incidents/642

<comment><USER2> I know it's popular to be a "developer-centric" organization these days, but please, please, don't schedule risky maintenance operations for 10 AM on a Monday, when your tools are in heavy usage.

Every SaaS product I've built has analyzed traffic, and performed migrations/deployments at off-hours (generally, after midnight in our dominant time zone). In this case, the outage may have resulted in hundreds (thousands?) of paged administrators across the world, but at least fewer end- users would have been affected.

Also, at scale, it's a good idea to deploy to a single cluster/zone first, and check error rates before deploying to the larger environment.

It's pretty scary that the 'professionals' to whom I've trusted my business aren't more savvy when it comes to high availability...

<comment><USER3> Are you sure that Heroku is peaking 10 AM on a Monday?

I believe they have off-hours, but as an international product it could be interesting to know when. I know a lot of European products with European users that all depend on Heroku.

<comment><USER4> They have a separate EU hosting region that has separate maintenance (and uptime that's actually significantly better then US region): [https://status.heroku.com/uptime?region=EU](https://status.heroku.com/uptime?region=EU)

So yeah, it was a lame time to schedule maintenance.

<comment><USER5> I disagree, strongly.

If you've architected for IAAS you have sufficient redundancy and a plan for graceful degradation. I'd rather be dealing with an outage after lunch than at 4am.

<comment><USER2> This is exactly the "developer-centric" mindset that is, frankly, misguided.

Sure, I would rather deal with an outage during business hours, but that means that many of my _Customers_ are also dealing with an outage. If the outage were at 4 AM, most of my _Customers_ would be asleep, and wouldn't even notice the outage.

<comment><USER5> If you want NASA reliability, build a NASA-grade 24/7 operation across three timezones.

If your plan is just to have the nerds skip sleep periodically, you're an asshole.

<comment><USER2> Exactly! Heroku should be building that 24/7 operation so I don't have to. Isn't that the whole point of PaaS?

<comment><USER5> I'm sure that's the plan. But if you _really_ _really_ _really_ need faultless 24/7 you're looking for something akin to "NASA as a service", and I assume that such a service wouldn't be able to invoice using something as pedestrian as a credit card.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER6> Compounding the issue of irresponsibly scheduling maintenance for US zones mid-day in the US, they ALSO broke ability to scale worker processes to zero, so there was literally NO way to wind your app down and prevent worker jobs from firing off.

When the platform started getting wonky we shut off our worker dynos so the system would not fire off emails while the system is in a known-screwed-up state.

The console said workers were set to zero.

But... in our logs we watched the (supposedly off) workers continue to fire off.

Nice FUBAR all around, Heroku.

</comment><comment><USER7> Started getting tons of emails from end users. Went to investigate and was greeted with this:

! ! Heroku has temporarily disabled this feature, please try again shortly. ! See [http://status.heroku.com](http://status.heroku.com) for current Heroku platform status.

Hopefully they will be backup up soon. Also wonder if we will get any sort of reimbursement? I currently spend around $3k/month with Heroku.

</comment><comment><USER8> Makes zero sense to do an 2 hour update on a Monday at 10 AM PDT.

Horrible horrible timing. I'll likely be getting blamed for this since I recommended Heroku.

<comment><USER5> Do you want to start working night shifts? The people who know how do this stuff command six-figure salaries and are highly in demand.

Every startup is looking for the design/dev/ops unicorn. You want to start trying to find nocturnal unicorns?

<comment><USER9> These don't need to be night shifts. Back when I worked in bigco, we had very competent ops teams around the world - we'd even send developers abroad for 3-12 month periods to train with them and share information.

Smaller companies use Heroku so we don't have to build the same expertise in house. They're able to charge a premium not because their developers have to work crazy hours, but because there's a certain base cost to having these kinds of distributed teams.

</comment></comment></comment><comment><USER10> This was caused by their scheduled maintenance: [https://status.heroku.com/incidents/641](https://status.heroku.com/incidents/641)

I think they jinxed themselves: "Running apps will not be affected."

</comment><comment><USER7> Seems everything is returning to normal now. Here is a New Relic screenshot from the outage: [http://i.imgur.com/WB7U2mz.png](http://i.imgur.com/WB7U2mz.png)

</comment><comment><USER11> Request queueing on New Relic is going haywire on our app right now.

<comment><USER12> We had a similar problem on our app, but were able to restart with more dynos.</comment></comment>


Ask HN: What startups are hiring summer interns? - <AUTHOR> <comment><USER2> Umm, the summer is almost over.

<comment><AUTHOR> For next summer since recruiting for that starts now</comment></comment>


Ask HN: Best startup/tech movies? - <AUTHOR> <comment><USER2> Ghostbusters.

They identified a niche, bootstrapped their company, solved a real pain point for their customers, and spread through word of mouth from their satisfied customers to become the dominant player in their space.

<comment><USER3> I'm not so sure:

* They didn't invest in redundant systems * They had problems at scale * They had high running costs * They took health and safety risks with their employees

</comment></comment><comment><USER4> There is also the TV-series "Halt and Catch Fire".

Slightly related movie suggestions, based on their interruptive theme: "Field of Dreams", "Moneyball", "The Wolfs of Wall Street"

</comment><comment><USER5> This documentary captures the early dotcom era

[https://en.m.wikipedia.org/wiki/Triumph_of_the_Nerds](https://en.m.wikipedia.org/wiki/Triumph_of_the_Nerds)

<comment><AUTHOR> cringeley is the bomb

</comment></comment><comment><USER3> Middle men:

[http://www.imdb.com/title/tt1251757/](http://www.imdb.com/title/tt1251757/)

The bell idea was great.

</comment><comment><USER6> Pirates of Silicon Valley, Sneakers, Primer, Ex Machina

<comment><AUTHOR> primer is a masterpiece

</comment></comment><comment><USER7> Silicon Valley[0] is quite funny if you get the culture references. And sometimes it is also quite spot-on in its critique.

[0]: [http://www.imdb.com/title/tt2575988/?ref_=nv_sr_1](http://www.imdb.com/title/tt2575988/?ref_=nv_sr_1)

</comment><comment><USER8> The Social Network, Middle Men, Silicon Valley(series), Halt and Catch Fire(series), Blow(non-traditional), First 20 Million Is Always the Hardest, How To Make It In America(series), Startup.com, Pirates of Silicon Valley

<comment><USER9> There was also the series Betas on Amazon Prime. Pretty similar to Silicon Valley imho.

</comment></comment><comment><USER10> The social network?

</comment><comment><USER11> e-gold tiger nation is also a good one.</comment>


Realtime KVM - <AUTHOR> http://lwn.net/Articles/656807/ <comment><USER2> Kernel-Based Virtual Machine

If you were thinking of the other KVM.</comment>


College student uses GPT-3 to write fake blogs and ends up top of Hacker News - <AUTHOR> https://www.theverge.com/2020/8/16/21371049/gpt3-hacker-news-ai-blog <comment><USER2> [https://news.ycombinator.com/item?id=24165040](https://news.ycombinator.com/item?id=24165040)

... wherein dang points out that "... the story is bogus and based on false claims."

See also:

[https://news.ycombinator.com/item?id=24063832](https://news.ycombinator.com/item?id=24063832)

 _Added in edit after the first reply to this ..._

Also quoting dang:

 _" They've been trying to manipulate HN with multiple accounts and voting rings—which hasn't worked—and baity titles, which unfortunately has."_

<comment> 0-_-0 Those seem like small technicalities. GPT-3 needs a prompt to write something so a few sentences have to be written by a human. Also, whether 1 or 2 people pointed out that it could be GPT-3 is not a substantative difference. The screenshot shows a greyed out comment which means it was downvoted. Even assuming the screenshot is faked, those comments are still toward the bottom of the thread so weren't ones that many people agreed with. Overall, HN was gamed and I hope this will make people think more about the quality of content they upvote here. [This comment was generated by GPT-3] [just kidding]

</comment></comment><comment> phoe-krk Link to the article: [https://news.ycombinator.com/item?id=23893817](https://news.ycombinator.com/item?id=23893817)

<comment><USER3> [https://news.ycombinator.com/item?id=23894742](https://news.ycombinator.com/item?id=23894742) And the call that it was gpt 3 with the complaint about this being rude

<comment><USER4> Haha! That's hilarious

<comment><USER5> Plot twist: jackkinsella is actually a GPT-3 run account.

<comment><USER4> Plot twist: I'm actually a GPT-3 run account

</comment></comment></comment></comment></comment><comment><USER6> How posts on HN reach #1 is a topic all by itself. To assume it's impossible to game the ranking is foolish. If I were going to try to fool people with an AI generated story, I might also take special steps to help push that post as high up as possible.

Regarding the "content" of the post in question, as TheVerge article notes, "there's a lot of not-great writing on these here internets, so I guess it's possible that this could pass as "content marketing" or some other content".

Indeed; so much of the internet is full of meaningless fluff and re-speak (for SEO gaming, referral link promotion, etc.), that whether the fluff is generated by AI or a human is kind of irrelevant.

</comment><comment><USER7> Funny how someone pointed out that it lacked content and seemed like something written by GPT-3 and got shit for it

<comment><USER8> ahaha classic hacker news, missing the point elevated as an art form.

</comment></comment><comment><USER9> I nearly always read the comments first and in most cases don't read the article. I don't up-vote often, but I'll occasionally up-vote an item which appears to be developing an interesting discussion.

There's also a lot of cases where the article could be an arbitrary choice for an explosive news item. I view HN as more of a forum by news topics than an aggregator of news links.

An article which suggests that HN gets fooled by AI doesn't know how HN works. Though most media articles seem to misunderstand technical topics in general.

<comment><USER10> Good point. The title and topic of an article if interesting generates discussion and input. Does not necessarily have to do with any of the article content.

</comment></comment><comment><USER11> Lots of people don't even bother reading DFA so you don't even need gpt-3 to "fool" HN.

<comment> V-2 What does DFA stand for?

<comment><USER12> Da Fine Article

<comment><USER13> I see that ducking autocorrect hates you, too.

</comment></comment></comment></comment><comment><USER14> How is this not going to turn the internet into a junk box?

<comment><USER15> This is my concern as well. Do we need to create the opposite of this? A service that searches the internet and 'wades' thru information/trash and then reports back with 3 best possible conclusions?

<comment><USER14> Let's hope Google has the antidote? Otherwise they are doomed too

</comment></comment></comment><comment><USER16> I think too much of my HN consumption and upvotes is based on title. I know what will be in the article when I just read "Feeling unproductive? Maybe you should stop overthinking". If I agree with the thesis, upvote based sites like hacker news encourage quick upvotes.

</comment><comment><USER17> I think A.I. chatbots have been in online discussion groups for decades, if not the beginning, e.g. Eliza. They are posts that almost make sense, but are off the mark again and again. A current candidate is Craiglist forum astrophysics frequent poster NumberlineA.</comment>


Show HN: A Failed CRM for WhatsApp - <AUTHOR> https://github.com/giovanialtelino/WhatsappMonitor <comment><AUTHOR> I guess the first section of what I wrote in my blog could show why it failed, at least it was at the very start...

This was supposed to be a personal CRM, after some brainstorming about how to display the data and what was supposed to be the main functionalities of the project, I was disappointed to find, while I built the MVP, that Whatsapp has no easy way to generate a backup of any readable kind from all the contacts, you can only backup a user or a group each time, and with a limit of around 40 thousand messages so there is also a great chance that big and old groups would be lost in the manual backup, and also it doesn't link the media messages to its correct location, media are exported as «media-type»-date- WAxxxx, so I could only know if the message is from that day, and not its correct location in the chat.

The Whatsapp backup which is usually created daily at mid dawn can only be used by the Whatsapp app, amazing! Even Instagram backup allow one to download every single message in JSON, well, Whatsapp does not have persistent online storage, so yeah, I can understand the lack of a full backup functionality, but can't understand why we use Whatsapp so much … well, I guess this is a rant for another day.

But at least I still made it functional so I could try Blazor a little bit.</comment>