Amazon EKS – Highly available and scalable Kubernetes service - <AUTHOR> https://aws.amazon.com/eks/ <comment><USER2> I think almost everyone was expecting this, still, it's great to see it happen.

Amazon truly listens to their customers and delivers what they want, even if they have their own competing in-house solution as well. I do think that for new projects, you'll see EKS being the more popular pick over ECS, which never reached quite the same mind-share as Kubernetes.

<comment><USER3> They resisted vehemently for a long time, even when it was painfully obvious it was wrong, and you'd just end up having these totally surreal conversations with their ECS product manager that would make your head spin they made so little sense. Glad that's over.

<comment><USER4> That's cause it'd be way better for them if ECS "won", but it didn't, so they adapted. Similar to how Docker now has had to add Kubernetes support after being combative and dragging their feet for years.

<comment><USER3> It was just pride since google is their rival, didn't make any sense otherwise.

<comment><USER5> I'm glad that I can run Kubernetes on AWS now (again), but I still can't run ECS on my laptop... hello Amazon? Are you home?

<comment><USER4> I thought that's what Blox is for [https://github.com/blox/blox/blob/dev/README.md](https://github.com/blox/blox/blob/dev/README.md)

<comment><USER5> Does this just use a tool that runs on your laptop, to schedule and manage ECS clusters on Amazon? That's really not what I was looking for... I was hoping to prototype ECS-based solutions without spending money on cloud resources.

I have a laptop with 8GB+ RAM and a fast SSD, it doesn't have any trouble running fairly complex constellations on Minikube and I could later rebuild and/or install them on a production Kubernetes cluster, without any changes.

Can I do something like that with Blox, or is this another different way to consume ECS and spend money on EC2 nodes to run containers?

Edit: I would be satisfied if you told me, I still need to consume some AWS services like SNS and CloudWatch to use this toolkit, but that with Blox, I don't actually need to run my containers on ECS unless I want to expose them to the world.

I haven't found any tutorial or guide that indicates this is anything other than a different scheduler for ECS.

</comment></comment></comment></comment></comment></comment></comment><comment><USER6> If you had just convinced your CEO you need to hire a contractor to implement k8s on EC2 for your startup, what would you do now?

<comment><USER7> Having done multiple K8s migrations, I can tell you that many of the problems around migrating to k8s have little to do with actually setting up the cluster. There's dockerizing all your apps, setting up the build->deploy pipeline for each app, and fixing all the hardcoded hacks where your apps aren't properly 12-factor (failing to take config from env vars, assuming you "always" deploy to a specific cloud, etc).

The other main component of my time in a k8s engagement revolves around logging, monitoring, alerting and backups of the k8s cluster, which hopefully EKS handles for you.

All told, actually starting the k8s cluster is probably less than 10% of my time.

<comment><USER8> > All told, actually starting k8s cluster is probably less than 10% of my > time.

+1.

I've found myself (with Azure ACS) re-creating clusters quite often - as they don't support upgrades. This takes minutes with my deploy scripts, replicating the state of the cluster you're copying is the main bit of work.

</comment></comment></comment><comment><USER9> Not surprising ever since AWS joined the CNCF. Glad this is happening... not operating a Kubernetes cluster will be nice and integration with IAM is a nice value add! Most excellent :)

<comment><USER10> RBAC via IAM will be a huge selling point for this.

</comment></comment><comment><USER11> Is there a reason why some of these services are called "AWS <servicename>" and some "Amazon <servicename>"?

<comment><USER12> same reason there's like nine distinct api protocols the various aws services use. teams just aren't coordinated at that level

<comment><USER11> Is it better with GCP or Azure?

<comment><USER13> Azure is about the same, better in some areas and with the new CLI but plenty of confusing and badly named services.

GCP is the best at standardization, but also the slowest at releasing updates and with the fewest services.

<comment><USER11> I see.

Yes, I already saw a tutorial for WebSocket stuff which relies on AWS IoT, whilw SNS sounded more fitting..

</comment></comment></comment></comment></comment><comment><USER8> Happy with Kops but this is awesome. Especially if the controller is not billed for (like Azure and now GCP).

</comment><comment><USER14> How does one set up the workers? None of the announcements, documentation or FAQs explain how that's supposed to happen. It's pretty clear that Amazon manages the masters (any of the latest three public versions), but it's not clear what you'd do next: bring your own instances with kubelet and do TLS bootstrapping or similar?

<comment><USER15> I would guess AMI + userdata to point to the master(s)

<comment><USER14> So you're going to have to use a subset of possible distros/images. Then you have to figure your node update strategy. These are the kind of details I hoped they would discuss.

</comment></comment></comment><comment><USER16> What does this mean for Kops? [https://github.com/kubernetes/kops](https://github.com/kubernetes/kops)

<comment><USER9> Some teams will want custom cluster deployments for whatever reasons but it will probably lose a lot of traction now... which is fine. Kops is a big expansive tool with a little too much surface area for my liking in a infrastructure management tool.

I'll be interested to know if EKS will support custom CNI or if it will use kubenet.

<comment><USER17> They announced they were going to be using their open source cni plugin [https://github.com/aws/amazon-vpc-cni-k8s/](https://github.com/aws/amazon- vpc-cni-k8s/)

</comment></comment></comment><comment><USER18> Brilliant,

We're rolling out a k8s setup right now on AWS - having a managed k8s that we can upgrade nicely would be amazing.

</comment><comment><USER19> Ah okay, here it is. First I thought this other release of a container engine would be it. Yeah that's "gg" for many cluster management providers.

</comment><comment><USER20> Announcement: [https://aws.amazon.com/blogs/aws/amazon-elastic-container- se...](https://aws.amazon.com/blogs/aws/amazon-elastic-container-service-for- kubernetes/)

</comment><comment><USER21> Does anyone know what the implementation(s) are for the Ingress resource? Google uses their own custom implementation, I'm curious if Amazon's version will be more portable. [0]

[0] [https://cloud.google.com/kubernetes- engine/docs/tutorials/ht...](https://cloud.google.com/kubernetes- engine/docs/tutorials/http-balancer#step_3_create_an_ingress_resource)

<comment><USER22> I'm assuming Amazon will also write their own custom implementation that controls elbs.

<comment><USER23> Or something akin to this: [https://github.com/coreos/alb-ingress- controller](https://github.com/coreos/alb-ingress-controller)

And the blog post with a full writeup:

[https://aws.amazon.com/blogs/apn/coreos-and-ticketmaster- col...](https://aws.amazon.com/blogs/apn/coreos-and-ticketmaster-collaborate- to-bring-aws-application-load-balancer-support-to-kubernetes/)

Or for the ELB stuff and not the ALBs:

[https://github.com/sky-uk/feed](https://github.com/sky-uk/feed)

</comment></comment></comment><comment><USER24> Thanks Amazon! Now I can finally drop GCP :-)

<comment><USER25> I'm curious about your reasons for wanting to drop GCP. I am having a grass- is-greener-on-the-other-side moment right now being on AWS.

<comment><USER24> Google's approach to auth is cumbersome and leaves a lot to be desired. Also, there's nothing like cloudformation for configuring supporting services (their equivalent is a pathetic joke).

The only thing I'd use GCP for today is bigquery. For everything else I'd rather use AWS.

<comment><USER26> I work for Google.. Sorry to hear that your experience was poor but thanks for the candid feedback!

Is the equivalent to CloudFormation on GCP supposed to be Deployment Manager? Would you mind elaborating what could have been done better?

I work closely with them so I can at least relay the feedback. If it's easy enough maybe I'll even get to help since I am interested in working on that project =D

<comment><USER24> Yes Deployment Manager. I can't remember now. I looked at it when I needed to automate something and found that I couldn't do it. IIRC it seemed too limited in its capabilities.

The GKE auth thing is so bad to the point we had to roll back from using service accounts to using normal API keys because there was nowhere in stack driver to add a service account key file. So the choice was either lose all our endpoint monitoring or just switch to API keys. When I opened a support ticket about this the support guy seemed incompetent. He literally couldn't understand what I was saying despite repeating myself 3 times in a way I struggled to make any clearer. It wasn't worth the hassle.

I'm running a gRPC/REST service on GKE with Endpoints and to add a new credential I needed to add the key to the service.yml file and update the endpoint. There's no way that scales. I can't wait to use AWS IAM for this instead. We had to backtrack and give out API keys instead of having anything better.

Follow this tutorial for what I was trying to do before going back to just normal API keys: [https://cloud.google.com/endpoints/docs/grpc/authenticating-...](https://cloud.google.com/endpoints/docs/grpc/authenticating- users-grpc)

It's like GCP services weren't designed to work with each other. Just a hodgepodge of services that are fine if you can run CLI commands, but as soon as you want to get an ops team involved who want to do everything through a UI you're screwed.

Oh, and I can't tell you how frustrating it is for the k8s alpha clusters to just vanish on you. I'm a big boy. Let me decide when I want to kill an alpha cluster because, you know, I might know better than whichever engineer put that 30 day limit in.

Sorry for the rant, but as you can imagine I'm done with GCP and can't wait to head back to AWS land.

<comment><USER26> > Sorry for the rant, but as you can imagine I'm done with GCP and can't wait > to head back to AWS land.

Nonsense, the feedback is much appreciated! Thanks for taking the time!

</comment></comment></comment></comment></comment></comment><comment><USER27> Any idea how Kubo or Cloud Foundry Container Runtime(CFCR) fare against solutions like AKS, EKS, GKS, etc

</comment><comment><USER28> Very excited to see this exit preview. I really hope this gets covered under the BAA and available in a HIPAA context.

</comment><comment><USER29> It's not surprising, but this is a _very_ welcome announcement!

</comment><comment><USER30> Finally!!!</comment>


Ruby: Singletons, Threads, and Flexibility - <AUTHOR> http://www.bleonard.com/blog/2013/01/18/singletons/

<comment><USER2> Interesting and useful.

(I have seen so many posts discussing programming stuffs here without a single line of code and you are offering real suggestion and giving back to the opensource community, you've done a great job, thanks.)

</comment><comment><USER3> Wow, the comments were incredibly useful as well.

</comment><comment><USER4> For some reason the portrait on the left made me extremely uneasy, to the point I removed it from the DOM.

<comment><AUTHOR> Ha. The Jekyll theme (changeable) or my face (less changeable)?

<comment><USER5> The "faded out" state actually manages to draw _more_ attention to it, which isn't great when trying to focus on the article.

<comment><USER4> Also, the whole design is flat and minimalist, to the point the portrait just looked uncanny and baroque, with a lot of pop out.

</comment></comment></comment></comment><comment><USER6> Very good post. We started using VCR recently in our tests but somehow have avoided this issue. However as we clean up our old tests I'm sure we'll see this; but now I know to avoid it. Great discussion with the VCR dev too.

</comment><comment><USER7> Great post, really interesting read.

(As a side note, you might want to provide syntax highlighting for all the code snippets on that page it makes it so much easier on the eyes).

<comment><AUTHOR> Done. Thanks for the tip!

</comment></comment><comment><USER8> _Check this out and vote it up on Hacker News if you found this useful._

Ugh.

<comment><AUTHOR> I'm new around here. Not acceptable? Seems like something I've seen before.

<comment><USER9> It is acceptable. Though the wording could be done differently to avoid comments like the one above.

Instead, include the following:

 _Discuss on Hacker News._

When we discuss something here, upvoting/downvoting plays an essential part is controlling where the conversation heads. So asking for people to upvote is not as positive as inviting them into the discussion.

By the way, welcome. Good post.

<comment><AUTHOR> Thanks for taking time to explain some of the etiquette. I appreciate it.

<comment><USER10> I thought your title was fine, the content was dandy, its just that some one was having a bad day. Keep up the useful submissions. BTW - like your site layout, esp the faded sidebar, it makes the content stand out more.

</comment></comment></comment></comment></comment><comment><USER11> Interesting read, Brian!

</comment><comment><USER12> Great post, Brian!</comment>


Show HN: Autoresizing HTML textarea (adds rows as you fill it) - <AUTHOR> http://hifibit.com/contact.html

<comment><AUTHOR> The code is here: [http://www.HiFiBiT.com/hifibit.js](http://www.HiFiBiT.com/hifibit.js)

Functions cursorLineNumber(txtArea) and commentMessageTextAreaHandler() at the bottom of the file.</comment>


Hello Firefox, this is Chrome calling - <AUTHOR> http://blog.chromium.org/2013/02/hello-firefox-this-is-chrome-calling.html <comment><USER2> Yes, please, please, please kill Skype. Kill it mercilessly. Using it has been the _worst_ experience I've ever had with an application.

I've been in a long distance relationship for a few years now and Skype has sadly been our main mode of video communication. The app crashes when I search chat history, can take upwards of 90+% of my CPU, literally forcing me to shut down every other application I have running. The forums are _full_ of complaints, all unanswered. We've tried gChat and the plugin either goes undetected or slows down my machine as well (although not as bad as Skype). I'm running a 2010 MBA, so I've got the resources.

So death to Skype, and open arms to WebRTC.

<comment><USER3> Have you tried Google Hangouts? I've had some success with that lately over Skype.

<comment><USER4> i tried and it's a pain to install the plugin. never works on my debian-sid.

<comment><USER5> It works flawlessly on Ubuntu, Fedora, Arch, etc. I have tried in all these distros myself.

</comment></comment></comment></comment><comment><USER6> I feel like DataChannels are the best part of the WebRTC standard (or would be, if they were usable): a true p2p connection allowing transfer of arbitrary data without plugins or anything. This gives multiplayer games, file transfers, realtime chat and collaborative editors (let your imagination run wild...) and the only thing a server is required for is establishing the connection (and saving state). This functionality is much more exciting than simple video or audio chat.

<comment><USER7> Unfortunately, if this page is accurate, DataChannels don't really work yet:

<http://www.webrtc.org/chrome#TOC-Data-Channels->

A shame, because I have a use in mind for them. :)

<comment><USER8> It works on some alpha release of both Firefox and Chrome. There are already some file transfer apps if you're curious, although I haven't tested myself: <https://github.com/lindstroem/FileTransfer> and <https://github.com/peer5/sharefest> . Also, the folks from easyrtc ( <https://github.com/priologic/easyrtc> ) have already started working on adding DataChannels to their library.

<comment><USER9> A bit-torrent like client in the native browser would be interesting... wonder where Opera is on this one.

</comment></comment></comment></comment><comment><USER10> Note that Chrome (or the application) chooses to reverse the self-view so that it acts like a mirror, whereas Firefox (or its application) chooses to display _what the other person sees_.

It's a hard choice to make.

<comment><USER11> Actually, not really. It's all HTML 5 video elements on the page, so this is all you need:

        .mirrored { transform: scaleX(-1); }

And you can make a button to add/remove that class as needed.

However, I do hope the implementations are consistent as to which way it flips the video.

<comment><USER12> Changing it is easy. Adding options is an easy way to avoid choices.

But Jabbles' point still remains: It's a hard choice to make.

<comment><USER13> I don't think it's a hard choice for the browser to make- send the data as it is captured by the camera. How that is displayed is something else, but as timdorr demonstrates, it's not difficult to toggle.

<comment><USER14> It's a hard choice for the human who has to pick one or the other and justify that decision.

<comment><USER13> In what way? The developer should have no problem justifying the decision. "It's what the camera sensor sees".

I absolutely understand the application in webchat and why you would want it to be mirrored _at a page level_ , but I'm at a loss to understand why the browser implementation would try to reflect that.

<comment><USER15> "reflect" tsk boom!

</comment></comment></comment></comment></comment></comment></comment><comment><USER16> Well, it's encrypted, so that seems like a reasonable alternative to the potential of being spied upon when using Skype.

<comment><USER17> So is Skype. Unless there's evidence that Google couldn't be compelled to comply with US law and honor a legally binding order to intercept a Chrome video call?

<comment><USER18> The intercept service you're talking about is CALEA if I'm not mistaken, and it's not yet clear that CALEA applies to IP communications.

VoIP is covered by CALEA, but it isn't yet clear if Video is covered. There's a bit of a raging debate about this in Telco circles. There are basically two arguments:

1) Companies that do not operate exchanges are not liable for CALEA compliance

2) CALEA compliance is not clear.

For the first argument, many folks interpret the law as only covering companies that have equipment inside of phone exchanges (CLECs and ILECs). There is a 3rd class of operator that is only IP with no equipment in the exchange. It is not yet clear if this 3rd class has CALEA as a requirement (Goolge is all IP).

On the second point, there's no clear documentation about acceptable formats for release. Can I send raw log files? Does it have to be a csv? None of this is clearly defined anywhere.

In short, it's a lot more tangled when it comes to video. I'm not certain the Feds could've gotten access to Skype monitoring without $MSFT buying Skype.

</comment></comment></comment><comment><USER19> Imagine how much more awesome this will be when we also have IPv6. We will have no more need for things like ICE [1], just direct point to point communication. Oh, and multicast for giant video chat sessions.

[1] [http://en.wikipedia.org/wiki/Interactive_Connectivity_Establ...](http://en.wikipedia.org/wiki/Interactive_Connectivity_Establishment)

<comment><USER20> Multicast on the internet is a nice dream. Will it actually happen with IPv6? My understanding is there is a barrier to adoption — basically all routers involved need to be aware of the multicast initiation/join/leave protocol, and basically, there's a bunch of old hardware/software out there that isn't aware. Is all IPv6-capable hardware capable of this (given that IPv6 came out in ... 1998)?

<comment><USER21> I had the impression that the biggest hurdle for multicast to happen on the internet is the insane memory requirements for routers to track all the multicast memberships (as well as being extremely open for abuse -- imagine one client subscribing to every multicast stream out there and never leaving, that would flood the incoming pipes for that ISP)

<comment><USER22> While I don't know anything about how multicast is specified, I would certainly hope that it is possible to implement in such a way that each router only needs to track the memberships of it's direct neighbors. They would then themselves advertise that membership in order to serve their neighbor's request.

As for the abusive client, I say if the ISP has any sense of self preservation, they should be interested to police this themselves. For example, knowing how much bandwidth the client is paying for, they could refuse additional or even cut existing memberships of that client once that limit is reached.

<comment><USER23> The problem is that a router's direct neighbors may be subscribed to millions of multicast groups and nobody has enough TCAM to track those memberships.

</comment></comment></comment></comment></comment><comment><USER24> It's good to see this moving forward. A few questions need to be addressed in order for this to become really useful.

How is XMPP/Jingle supposed to work over WebRTC? I.e. in order for the browser to connect to a standalone VoIP client for example (think of implementing Google Talk plugin in pure JavaScript). From what it looks like, this can require some support for this scenario in XMPP servers (not unlike they need something to support XMPP over WebSockets). So this is really an important piece of the puzzle which needs to be ready.

<comment><USER25> Interoperability with V/VoIP protocols will still require a translation layer somewhere. That can be on the browser, or on the server, but you will still need some server-side component to relay the signaling information through (eg, websocket proxy), or a browser-interoperability mechanism (for xmpp, BOSH). If the remote endpoint doesn't support WebRTC's flavor of SRTP, then you're going to have to relay media through your server.

If SDP offer/answer is still being considered for WebRTC, then that should simplify interop a bit since media negotiation shares a common denominator with most other V/VoIP protocols (which is really the only relevant part when we're talking about WebRTC). Of course, all that is moot if both endpoints can't agree on a codec to support. Opus is brand new, and no one cares about VP8. Hardware devices are not likely to be compatible anytime soon (without a transcoding layer in between), which leaves softphones.

<comment><USER24> That's what I meant - most probably some server support will be required. I hope ejabberd and others will address this. Until that WebRTC won't be useful for building web based XMPP/Jingle clients.

Regarding codecs - most XMPP/Jingle clients support VP8 and Opus is catching up too. It's not like there are many of them around anyway. Farstream supports both if corresponding gstreamer components are present.

<comment><USER25> IIRC, ejabberd is agnostic about the XMPP messages going through, you should be able to use strophe.js to craft the proper Jingle packets from the browser's offer/answer session description.

Given codec and SRTP compatibility with clients, eg GTalk (which I don't know about), you should be good to go.

<comment><USER24> But ejabberd still had to enable support for BOSH or WebSockets first. Without it Strophe was of no use. So I assumed that similar thing has to happen with in this case in order to be able to route the Jingle stream from the browser over WebRTC. If the server modifications won't be needed at all - then of course it'll simplify things. Also, clients don't always use SRTP - there can be other methods like ZRTP for example.

<comment><USER25> ejabberd already supports BOSH. The rest is up to the client since it's P2P.

</comment></comment></comment></comment></comment></comment><comment><USER13> Fantastic news. I feel like the basic videochat model we see in WebRTC demos is only the beginning of the possibilities here.

When all browsers support WebGL and WebRTC I'll be fascinated to see what people more creative than myself can create.

<comment><USER26> Chrome now has WebGL enabled for everyone that supports it, which is a big leap towards getting the majority of users on compatible browsers.

</comment></comment><comment><USER27> I have a terrible confession to make. I can't bring myself to be too excited about this, yet. I can already make a video chat from my Linux box running either Firefox or Chrome to my mother running IE. What, exactly, are the benefits of this?

<comment><USER28> No third party plugin is required to be installed.

<comment><USER27> I get that, though I do not necessarily get what makes that so awesome. Essentially, my browser is already a third party plugin to my computer.

I think I would be more excited if this were distinct plugins running in the respective browsers. Would be much more indicative of a truly free environment, instead of just two of the top contestants doing something.

<comment><USER29> It's so that if you tell your mother to get google chrome, she does not also have to get a separate plugin.

<comment><USER27> You aren't exactly making this sound more free. I would honestly prefer it if I could just buy her a large TV and we could setup video calls with it. (They already have cameras built in nowdays.) Hell, why stop at the TV. Her phone likely has all that is needed for this. Does this go any further to making that happen?

I guess I can see how it does. I mean, the idea is that this protocol can be used to communicate between two vendors. But, that can already be done. It is done, on a regular basis. What, exactly, makes this special?

<comment><USER30> At a technical features level? Absolutely nothing. This provides nothing to an end user that they couldn't already get. The only thing this changes, from an end user perspective, is the number of steps it takes to do things.

tl;dr: This is an evolution of browser standards, not a revolution in consumer software (from an average end-user POV)

From a developer POV, this is pretty cool because now it is (or at least, is well on its way to being) significantly easier to build an app that relies on real-time media shared between peers with only the only onus on the end-user being having an up-to-date browser. The simplest and most obviously useful application of this is a basic VoIP tool.

<comment><USER27> I think this is ultimately my confusion. I'm at the point now where I'm actually usually advising family members on devices that rely less on browsers. Why not show a chat from gmail/whatever in a browser to a regular app on an android/ipad device? Even better, include another app in there. Just to really drive home how "open" this is.

Also, why is this stuff better than SIP related technology from a while back?

<comment><USER31> I believe gchat would do that, google hangouts might integrate with the ios/android app as well (I have not tried this).

The excitement here is that this is a non-flash solution, so technically it will work on any device that can run Chrome, regardless of whether or not it can / wants to run Flash. So in the near future this may make it into Chrome for Android and iOS.

WebRTC is a very necessary step in removing Flash's hooks into the modern internet; after this, there will be very few reasons to support it at all anymore. And that is a very good thing for speed, compatibility, and security.

<comment><USER27> I guess I'm just confused by two points. First, the odd belief that non-flash automatically equals good. Second, that non-flash for some reason necessitated "in browser." Why?

Neither of these automatically grants any additional security. If anything, it is just tying us to fewer vendors that can do this. I guess it doesn't matter, but I can recall a time when I was able to choose which application handled certain content type. We seem to be saying we do not want that for video now.

</comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER32> Awesome technology but christ that conversation was awkward. Can't wait to play with it though.

</comment><comment><USER33> I haven't really been keeping up on WebRTC, so forgive this fairly ignorant question.

Will the framework allow me to create a one to many connection? ie. presentation mode where one person could broadcast their audio / video to many viewers? Or is it simple a 1:1 connection?

</comment><comment><USER34> "Hello, Mike."

"Hello, Joe! System working?"

"Seems to be."

"Okay, fine."

</comment><comment><USER35> Looks neat.

One thing I wonder about tech' like this, is that it is encrypted from you to the service, but there is no assurance of privacy.

Someone who runs a service like this can easy drop in on your calls and ease- drop. Which is a legitimate concern if someone wanted to use this either in a corporate environment or for very private calling (e.g. husband and wife, doctor and patient, etc).

No current video tech' really offers much in the way of assured privacy. Skype used to but it has been largely rolled back since Microsoft took over.

<comment><USER13> My understanding is that it's possible to not have a 'service' and instead form connections from one person directly to another. That decentralization would be a privacy boon.

<comment><USER27> Well, without knowing the details of how they think two computers can reliably form a secure link without foreknowledge of each other, this doesn't exactly sound bullet proof. Self signed certs or something similar can only go so far. Hell, CA verified certs don't exactly go as far as most should be comfortable with.

</comment></comment></comment><comment><USER36> We are in the process of adding persistent chat and conferencing to Twelephone (<http://twelephone.com>). These features, in addition to our existing audio/video calling and presence using Twitter as a directory service, should put our free service near feature parity with Skype. We're using HTML5 WebRTC with encrypted peerconnections and soon datachannels. Stay tuned...

</comment><comment><USER37> Very cool, but there's still a lot that each group needs to do to be truly interoperable. You can see a rundown of the issues on webrtc.org:

<http://www.webrtc.org/interop>

Most of it can be worked around, but for a web developer, there's still a lot of wiring that has to get untangled for it all to work as seamlessly as it appears in the video demos.

Definitely some cool technology, though.

</comment><comment><USER38> What kind of video codec/protocol/format/platform/whatever does it use? I was having a devil of a time trying to get something up that's real time-ish, lately:

[http://stackoverflow.com/questions/14623963/stream-low- laten...](http://stackoverflow.com/questions/14623963/stream-low-latency- video-to-chrome-on-nexus-7)

</comment><comment><USER39> Does this mean direct peer 2 peer connection within browser? Under what conditions can there be direct peer-to-peer connection? For example is it possible to have a chat application that is purely peer-to-peer?

</comment><comment><USER40> I was very amused at how Hugh Fenning just read the script the whole time.

</comment><comment><USER41> I was really looking forward to this! Would it be possible to have more than one person connected in a html5 mmo game?

</comment><comment><USER42> It looks like it works very smoothly and the fact that no account or additional software is needed is great!

</comment><comment><USER43> It is also supposed to work Chrome to Chrome right? It says the room is full. Anybody get same error?

</comment><comment><USER44> Looks great, is the Google Dart team working on getting this integrated?

</comment><comment><USER45> I'm not following what this is. Can someone explain it like I'm five?

<comment><USER46> The first guy is talking to the second guy, even though they're very far apart. We used to have to use a special part of the computer for this, but now we can use the regular part that we use for most of our other stuff.

We also used to have to ask another person every time we wanted to talk to each other this way. Now, some of the time, we can talk to each other without asking him first.

Explaining it like you're ten might be more useful:

You know Skype? Well, now we can do that on the Internet [Ed: I know, but you're ten, so bear with me]. Also, we can send the video straight from one computer to another. We used to have to send it far away, to another computer, and then he would send it to the person we were talking to. We can also hide what we are saying from other people.

Pretend you're mailing a letter to Grandma. Before, we had to mail a postcard to our mean aunt, who would send it to Grandma. Now, we can put it in an envelope and send it straight to Grandma's house.

</comment></comment><comment><USER47> Phew, just restored equilibrium by upvoting only this submission

</comment><comment><USER48> FF is not worried. Chrome has a conflict of interest when it comes to ad blocking. FF will always do it better. And ad networks are a major infection vector, so more users are needing ad blocking than ever before.

<comment><USER49> This has _nothing_ to do with the article. Though, since I just love me some flame bait, Google will never take ad block out of Chrome because someone would just fork Chromium and keep it in.

<comment><USER48> You are saying google is irrelevant to chrome? I disagree.

<comment><USER50> Are you saying google is irrelevant to firefox?

<comment><USER48> I know that Netscape open sourced its code and that become Mozilla/FF.

</comment></comment></comment></comment></comment><comment><USER51> A final good bye to all those crappy flash-based chats.

</comment><comment><USER52> That's cute.

</comment><comment><USER53> Please don't let the DoJ see this video. They will want a backdoor at the protocol layer.</comment>


Clipper: Big Brother's Best Friend? - <AUTHOR> http://www.sfgate.com/cgi-bin/blogs/inthemission/detail?entry_id=79222

<comment><USER2> Even for billing and to detect fraud, it should be sufficient to just record the date and fare and delete them after one billing cycle.</comment>


DNA pioneer James Watson stripped of honours after 'reckless' race remarks - <AUTHOR> https://news.sky.com/story/dna-pioneer-james-watson-stripped-of-honours-after-reckless-race-remarks-11606108 <comment><USER2> Somehow, the rewriting of history bothers me more than one person being bigoted.

 _" Dr Watson's son, Rufus, has since said his father was in a nursing home after a car crash in October. He said the scientist's awareness of his surroundings were "very minimal" and rejected the notion he was a "bigot"_</comment>


Serious Science - <AUTHOR> http://serious-science.org A science popularization site featuring researchers giving video talks about their respective areas of study.<p>(Russian readers of HN might happen to know the site postnauka.ru, of which this is an English-language spin-off.) <comment><USER2> It's called "serious science" but its articles don't even cite sources for their claims. So it's actually less serious than wikipedia. Why should anyone use this over wikipedia?

<comment><USER3> I don't think this is a serious question _here_. On the other hand, I think it's an intriguing question in general.

There is nearly no way for a PI (head scientist) to cite everything that they say. Knowledge at the forefront is cobbled together from little whispers, tastes of failed experiments, hearings-ons from colleagues, intuition, guesses and literally decades of thinking. And so when speaking abstractly (as these videos are), they are often _less wrong_ than anyone else (Clapper, this is how you use that term...). If you were to press them on specifics, they would become _mostly correct_ and dig up where they got that nugget of wisdom, though simultaneously losing much of the power of generalization. In that sense - the generalities are always slightly suspect, but of far greater quality than anyone else's generalities. And usually the generalities you'd like to hear about from the cutting edge are those that there is no consensus about anyway.

So in that respect, I'd say the generalizations of cutting edge scientists are usually the _least wrong_ , rarely perfect, always insightful, and nearly impossible to source. They are the tenuous 'hypothesis' writ large to which their career is attesting. Citation of such is nearly a moot point, as no generalizable experiments yet exist.

On the other hand it'd be a great resource if they listed to the side a paper or review about some of the stuff they just spoke of. It'd be trivial for them to name a paper or two that they find dominating their perspectives here.

<comment><USER4> >it'd be a great resource if they listed to the side a paper or review about some of the stuff they just spoke of.

Great idea! We'll put it unto the to-do list.

<comment><USER3> And as a spur to kick scientists in their own rear, I'd also link to their own lab websites. It might be a bit of a shit-show at first, but we/they really need to get with the times, and this is a good place to start.

<comment><USER4> We will improve this side as well.

</comment></comment></comment></comment></comment><comment><USER5> I kinda want this as a Podcast. Or do you monetize exclusively via YouTube?

PS: Also the "subscribe" page can, for now, just link to the youtube channel. At least I could subscribe there.

<comment><USER6> So do I, and I wonder if there's a more reasonable way to monetize this than youtube (assuming it's meant to make money). I'd much rather sign up for an RSS podcast than set up a cronjob to download the video and rip the audio (which would also mean no money from youtube for them).

<comment><USER4> No, we do not expect to monetize it this way. We will open mp3-podcast later.

</comment></comment></comment><comment><USER7> Just wondering, do you know about [http://edge.org](http://edge.org) ? They also do something similar.

</comment><comment><USER8> My roommate and I are working on a very similar video series. We have a differet angle (short breadth survey => depth on a novel or interesting discovery or inquiry; informed by paper review, but no PIs.)

I'll watch how you guys evolve closely.

Good job.

<comment><USER4> thanx!

</comment></comment><comment><USER9> I don't get the point of videos here, it doesn't seem to bring much benefit and text would be much faster to read..

</comment><comment><USER4> thumbs up!</comment>


Ask HN: Scaling to 100k outgoing transfers per account per hour - <AUTHOR> We're growing quickly and are running into scaling issues. We'd love to get some advice from the hackernews community on our biggest problem:
We're a payments startup that provides APIs to send and receive money. When our customers send an instruction to disburse funds through our API, a few things happen:
1. Acquire lock on customer account
2. Check if customer's balance is sufficient
3. Deduct customer balance
4. Release lock on customer account
5. Disburse the funds through our banking channels
As we continue to grow, this process of checking balance and deducting customer balance is becoming our main bottleneck. We've already implemented parallel processing for transactions in different accounts but the speed of steps 1-4 is impacting performance.
We are now exploring solutions that can combine steps 1-4 together, ideally using a database like MySQL that already has these capabilities.
The constraints we're working under are:
1. Transactions for each account must be processed sequentially, in the same order that they arrived in
2. Transactions for different accounts should be fully parallelized
3. We want to be able to process at least 100k transactions per account per hour
4. We want to be able to process transactions in band with the HTTP request, with latency <10ms
5. ACID
6. Auditable
We think that some flavor of SQL is the right direction but would appreciate your feedback/advice on what you think the best solution to our problem might be. <comment><USER2> I don't know what techs you are using, but I would suggest you looking for:

* Google Spanner (relational) or Datastore (no SQL with ACID)

* NodeJS app running in some instance as gateway with Google Functions, or just Google Functions.</comment>


Today is the Ides of March - <AUTHOR> http://www.infoplease.com/spot/ides1.html

<comment><USER2> I have a weird tic where I double-click words on a page and select paragraphs at random. This page, though, takes a double-click to mean "take me to a new tab, and search for more stuff about this particular word".

It's something the NY Times does as well, and I don't like it very much. Does anybody else notice this?

<comment><USER3> I have the same tic. It drives my boss crazy. I loathe the New York Times for this. Very frustrating! I also tend to draw squares with my mouse on my desktop. I don't know why.

<comment><USER4> Huh, I do this as well. It bothers me a lot if the "wrong" UI element has focus.

</comment></comment></comment><comment><USER5> Wikipedia paraphrasing of a related Shakespeare scene, which is one of my favorite ways to remember an important lesson:

Caesar saw the seer and joked "Well, the Ides of March have come," to which the seer replied "Ay, they have come, but they are not gone."

</comment><comment><USER6> Interesting to know that the Ides of April is actually the 13th, which is too bad, because it's my favorite way of referring to tax day. Although I am prone to pedantry, I think I'll still keep referring to it that way.

</comment><comment><USER7> Very informative, I had learned this long ago but had forgotten what "ides" really meant.

</comment><comment><USER8> Beware.</comment>


Reconsider Being a 'User' - <AUTHOR> http://cmcewen.com/post/56288525069/reconsider-being-a-user

<comment><USER2> I don't like the term user either.

I'm not sure customer is the right term for our service. I can understand e-commerce sites using customer but for a service like Twitter? I would think member would fit better.

What does everyone else think?</comment>


Ask HN: What color do you have set for the top bar? - <AUTHOR> I have a light purple setting as my top bar color: D8BFD8 The purple looks decent but it clashes with the orange of the ycombinator logo. Regardless, I've stuck with it.<p>What do you use for your color? Classic orange or do you switch it up? <comment><USER2> You may be interested in [https://news.ycombinator.com/topcolors](https://news.ycombinator.com/topcolors)</comment>


Malcolm Gladwell's Method - <AUTHOR> http://online.wsj.com/article/SB122671211614230261.html?mod=article-outset-box <comment><USER2> Great interview, I enjoyed both Blink and Tipping Point.

However, I bristle at this: WSJ: Do you worry that you extrapolate too much from too little? MG: No. It's better to err on the side of over-extrapolation.

I definitely disagree. Overextrapolation is a problem in our society. People try so hard to find signal where there's only noise, then find some conclusion and pass it as fact. Eventually someone of consequence believes it and it ultimately pollutes the information landscape.

Most people don't understand science or statistics, so it frightens me that spurious correlations (with terrible r^2 values) seem to become new "facts".

I used to work in a genome sequencing lab. DNA has lots of secrets for us to uncover. DNA might contain clues for discovering genes related to diseases like Alzheimers. One might extrapolate that genetic code contains the possibility of understanding or even curing some disease. The problem is thats a dangerous extrapolation and when it becomes commonplace to believe that human genome research can rid the world of disease (which some people somehow subscribe to), we've overstepped some boundaries.

Overextrapolation, as a rule, is not the way to go.

</comment><comment><USER3> Thanks for submitting this, that's a really good interview.</comment>


The file Clearview AI has been keeping on me - <AUTHOR> https://www.vice.com/en_us/article/5dmkyq/heres-the-file-clearview-ai-has-been-keeping-on-me-and-probably-on-you-too <comment><USER2> It's worth noting (as mentioned they are under security review) that apparently ClearviewAI lost their client database (hopefully that's all) to hackers last week. Along with being sued by the big boys, that's gotta hurt.

[https://nakedsecurity.sophos.com/2020/02/28/clearview-ai- los...](https://nakedsecurity.sophos.com/2020/02/28/clearview-ai-loses-entire- database-of-faceprint-buying-clients-to-hackers/)

</comment><comment><USER3> I don't see it get mentioned much, but Yandex's reverse image search [0] will also match similar facial images. It works surprisingly well.

Other search images can obviously perform this function, but I think most stay away from it because of the creepy factor.

[0] [https://yandex.com/images/](https://yandex.com/images/) \- click on the camera for the reverse image search

<comment><USER4> Just tested it, it returns people with some similar features but that are obvious different persons, different face shape and size , maybe facial hair and glasses confuses it or they could not find any better matches so they returned just something so it is not empty.

<comment><USER5> I tried it with a picture of me and the top half dozen photos were, in fact, pictures of me. I was originally thinking there were also bizarrely a couple of photos of signs and then I realized I was standing next to a sign in the photo and that's what caused the algorithm to stick a couple of signs in there.

</comment></comment></comment><comment><USER6> > "Clearview does not maintain any sort of information other than photos," the > company wrote. "To find your information, we cannot search by name or any > method other than image."

So a police force buys this product, searches for an image, and just gets more images. Really? What use would that be?

<comment><USER7> I think they also provide the origin of the images (example MySpace), and more often than not, the origin ends up with a definitive identity.

The response report on the author, for instance, clearly identifies her

</comment></comment><comment><USER8> Shortcut to the page with data access and opt out request forms: [https://clearview.ai/privacy/requests](https://clearview.ai/privacy/requests)

<comment><USER9> Or send them a CCPA / GDPR erasure request: [https://yourdigitalrights.org/?company=clearview.ai](https://yourdigitalrights.org/?company=clearview.ai)

</comment></comment><comment><USER10> Until our way of governing ourselves doesn't change, everything scientists and engineers do can and will be converted into a weapon or tool of oppression. We should be more vigilant and we should demand better from our elected officials.

<comment><USER11> We should always demand this, yet not count on it happening.

It would be nice to find ways to take these weapons and use them for self- defense as well. I wish I had a clue of what that would look like.

<comment><USER12> Well, the one edge of this sword is essentially being used by wealthy, businesses and those in power to gain additional information on average citizens to leverage for their own advantages and the expense of those folks happiness.

Traditionally, an average person had a tremendous amount of privacy simply by the virtue of being average. It wasn't worth the time/effort/resources to collect data on them. With ubiquitous sensors, it's now far more manageable or even trivial to collect data on people and use it no matter how unimportant or insignificant you are in respect to money/power.

People of great wealth and power also somewhat enjoy this privacy. Unless you're a public facing official or on the top of the wealthy list, you essentially can also disappear in crowds and enjoy a degree of anonymity. Some may recognize Gates or Bezos in a crowd but drop down to say Forbes 400 rank... #144 (picked at random) and you'll find.. (searching) Leonard Sterm.

Prior to that sentence I've never heard that name and certainly wouldn't recognize him in public even though he is estimated to be worth a modest $4.8B. I might (probably not) interact with them in the future and as an average person, I'm at a disadvantage because I can't recognize his net worth and public information which I could potentially leverage to my advantage in the same fashion someone wealthy/powerful may use their resources to leverage me.

Take this a step further and focus on business investors and participants promoting these technologies, pouring money into them. For example, I can't even name the people involved in Cambridge Analytica even though they were in the news and probably wouldn't recognize them either. Sure, I can dig around and find them but that wouldn't be useful in most situations.

For the most part, your average person doesn't have knowledge or resources to access and leverage such data that businesses are starting to use against the average consumer and worker rapidly and in ways that significantly impact their quality of life.

As such, I would propose leveraging these same identification and recognition approaches against those pulling the strings or in public government office positions who should be fighting for citizens rights and developing a targeted dataset for those folks and exposing it in a way your average citizen could use it. Perhaps as a phone app that can pass a few frames of sampled video back to a service that identifies these individuals and gives detailed public information about them. Make _their_ anonymity suffer. Link it to public facing records of their history, etc. Develop network information for _their_ families, friends, business associates.

Obviously, this is worthless against high profile individuals (celebrities, high government officials, etc.), but a lot of wealth and power hides in the shadows of the general public's eyes yet are pulling the strings on these cultural shifts us plebes are dealing with. Turn the tables and make the technology problematic for their daily lives as well--drag them out into the light for the public--maybe then you'll see more regulation and penalties for using these technologies surface. Just a thought.

<comment><USER11> I think you've got something there. This would likely need to leverage decentralized tech (perhaps blockchain could actually be useful for something other than crypto-currency?).

Then there are the challenges of getting people to pay attention and to care about the results.

</comment></comment></comment></comment><comment><USER13> Can anyone chime in on why California's law is necessary to force the deletion of your data? Wouldn't these photos be subject to copyright law?

<comment><USER4> From what someone said in a previous thread the copyright part is not that simple, so as an example the person that takes the picture can claim the copyright not the subject. Probably there is a different law that would prevent others to make money using your image but is not the copyright AFAIK

<comment><USER5> >Probably there is a different law that would prevent others to make money using your image but is not the copyright AFAIK

There is a right of publicity [1] that tends to come into play if I want to use a photo of you for commercial purposes like advertising. However, if I sell a candid photo of you that I took in public to a newspaper or if it's in a book I sell that's OK. (Assume it's straightforward use and nothing that could be misconstrued or deliberately misrepresents you in some way.)

No idea about this case and IANAL. But it seems in general that I would be able to freely use images on the Internet for training models and for other purposes that don't involve republishing those images.

[1] [https://www.nolo.com/legal-encyclopedia/the-right- publicity....](https://www.nolo.com/legal-encyclopedia/the-right- publicity.html)

<comment><USER13> I'm trying to understand where subject release documents fit into this. So I don't have to get those signed to take pictures of people, even in public? What if it's a still from video?

<comment><USER5> A model release form gives the right to use a photo for most purposes* including things like marketing literature, e.g. the classic happy smiling diverse workers found on company websites and in promotional brochures. However, if I just take a photo of you in a public place I can upload it to Flickr, post it on my website/blog, sell it to The New York Times for editorial use, etc. You have fairly limited rights to photos of yourself taken in public.

A video is just a sequence of still frames so I don't know why that would be any different.

IANAL. Added: I'm primarily familiar with the US. Your mileage may vary elsewhere.

*subject possibly to what I wrote earlier about misleading or defamatory purposes, e.g. if I use a photo of you to illustrate an article about neo-nazis.

</comment></comment></comment></comment></comment><comment><USER14> >> "Clearview helps to identify child molesters, murderers, suspected terrorists, and other dangerous people quickly, accurately, and reliably to keep our families and communities safe."

It helps to identify child molesters. "Think of the children".

</comment><comment><USER15> Supposedly any company in the EU that has data on you needs to proactively make you aware of this and allow you to have this data erased or rectified.

I don't think all or even most companies respect this rule yet (I haven't heard of a single company about my data so far) but I think it's a powerful idea that would keep companies like Clearview from being able to build up such large databases without people knowing about it.

I really hope the EU will keep strengthening subject rights as I think it's a very good solution to most problems involving the use of personal data.

</comment><comment><USER16> I like the way they claim it stops "child molesters" but then goes on to say that Macy's uses it, presumably to identify shoplifters before they strike.

</comment><comment><USER17> How do we stop this? Can we sue Clearview through EFF with the grounds of violating copyright or some weird law?

California/GDPR laws are great but they don't _stop_ the data collection, merely allow the user to access it.

We need to make companies like Clearview completely and unquestionably illegal. I am infuriated and don't know what we can do.

<comment><USER18> stop uploading your pics to internet then

<comment><USER19> Exactly! People think the Internet is like Disneyland but it's actually more like the bad parts of Bangkok.

Somewhere between the inter-networked machines and peoples' minds some kind of _magical thinking_ takes over.

Why don't normal people understand that they are being actively fought by organized relentless enemies?

In the old days cities had walls around them, I think we're barely getting to that point on the internet now, despite repeated and continuous raids by all kinds of marauders.

<comment><USER20> Or the digital world is an incredibly huge and complicated place that most people don't even begin to grasp. What is private and public is not obvious, and everything can quickly leak, be accidentally shared, ... And you lose control.

Stop blaming the users for what is systemic and legal faults - and in many cases really an issue not even of laws or of enforcement. Think revenge porn - nothing you can do to stop it, and only so much you can do to contain it once it's out there.

<comment><USER19> Look I'm not saying it's _fair_ , I'm saying that, if you want e.g. control of your own nudie pics, you got to (excuse me) come correct. Don't take them on your phone, and don't ever let them onto a computer that's connected to the internet. Better yet, don't use digital at all, use film and keep it in a safe, like _everyone did_ before pocket computers with radio networking and hi-res camera became ubiquitous.

There are things you can control and things you can't, eh?

I do blame the users. They buy a book of matches and proceed to burn their own house down. Either they're children or just incredibly stupid. That everybody else is doing it too changes nothing IMO.

</comment></comment></comment></comment></comment><comment><USER21> The work of this system does not seem different from what's known of chinese face detection and surveillance systems.

</comment><comment><USER22> Google has all the data and algorithmic chops required for this, too.

Just use their reverse image search feature, as helpfully explained here:

[https://support.google.com/websearch/answer/1325808?co=GENIE...](https://support.google.com/websearch/answer/1325808?co=GENIE.Platform%3DDesktop&hl=en)

They have tons of images from social media sites, too.

<comment><USER23> But image similarity is not the same as face recognition. I just uploaded the photo the author gave to Clearview, and it returned none of the photos Clearview found – just other front-facing flatly-lit mugshots of other people.

Of course Google can do this internally (and FAcebook could do it even better) – but the public-facing image search does not do what Clearview purports to do.

</comment></comment><comment><USER24> Is it just me or are those results clearly based on using her name (from the ID she provided as part of her CCPA request)? To have zero false positives, and multiple different hair colors, etc ... strains credulity that is all based on face matching _only_.</comment>


Ask HN: Do part time tech jobs really exist? - <AUTHOR> I'm trying to help a friend get back into the workforce after an extended medical break. I'd like to get them working, but I'm unsure if they could jump back into full time work. So what Id like to know is: Do part time (and pt remote) tech jobs really exist? Where are they? <comment><USER2> 1\. A few companies offer part-time jobs. They tend to be small and hard to find. Only large exception I know is Amazon, which has a bunch of 30 hour positions.

2\. If your friend wants part-time work as an employee, they can try negotiation. It's harder to negotiate for new position, but can be done. I've negotiated less than full time at multiple companies, for example. E.g. I interviewed someone who has been doing 4 days a week for 15 years now: [https://codewithoutrules.com/2018/01/08/part-time- programmer...](https://codewithoutrules.com/2018/01/08/part-time-programmer/)

3\. There's contract work, where you sign contract for 6 months or whatever. Randstaad and Winter Wyman advertise those. I have no direct knowledge, but my guess is it's easier to negotiate shorter workweek with those, since it's already a staff augmentation kinda thing.

Easiest thing for your friend in particular to do is probably get in touch with previous employers (or previous managers/co-workers who have moved on to other companies). Those companies/managers will already know your friend, and so be willing to give them a try.

Broad overview of options: [https://codewithoutrules.com/2018/07/03/35-hour- workweek/](https://codewithoutrules.com/2018/07/03/35-hour-workweek/)</comment>


What Fictional Food Do You Most Want to Try? - <AUTHOR> https://www.atlasobscura.com/articles/fictional-foods-you-want-to-eat <comment><USER2> Here in Alabama that would be Deep Fried Nose Nuggets. Most people around here just eat them raw, though.

</comment><comment><USER3> That'd probably be either Ambrosia, the food of the Greek gods, or Manna from the Torah.</comment>


Show HN: We launched Pinstagram for iPad - <AUTHOR>

Just over a month ago we built Pinstagram / http://www.pinstagram.co - it's a web viewer for Instagram that uses the waterfall layout to display your photos.
Today we're launching Pinstagram for iPad. It's completely native and exposes the same functionality as the webapp.
Please, let us know what you think: http://bit.ly/pinstapad <comment><USER2> Did someone challenge you to see how many trademarks you can cram into a single name?

</comment><comment><USER3> Pinstagram is a wonderful site and I use it all the time to view my wife's Instagram photos!

But are you guys worried at all that the name infringes on Instagram's trademark? It's one thing to rebrand a website, but it's a lot harder to rebrand an iOS app.

Or maybe you guys are already talking to Instagram and/or Facebook about joining their team, and they're ok with you using the TM in the meantime?

</comment><comment><USER4> awesome! way to go guys. props for shipping something so that you can iterate.

where do you think you are going with this? is this just a hackathon turned into a nighttime hobby? or do you think you can build a real business out of this.

consumer facing stuff always scares me because it always seems like a hail mary to find a business model.

<comment><USER5> Pinstagram pixel pusher here, right now we're just focused on building something useful and solving some pain points that we are hearing from our users.

</comment></comment><comment><AUTHOR> Link: <http://bit.ly/pinstapad>

</comment><comment><USER6> Sent you an email re: tap2print app monetization

</comment><comment><USER7> Why horizontal layout only, I never use that orientation.

The scrolling is a deal breaker for me, no smooth scroll, it's all flicker/jerky. iPad 3. I'm assuming it's just a wrapper around the web view. The buttons to like and comment are too small to hit with any accuracy.

It's still better than the iPhone only app that I have to 2x.

</comment><comment><USER8> What, if any, API are you using to interface with Pinterest?

<comment><USER9> I did some research about automating pinning yesterday. If you take a look at their "Pin it" buttons you'll see it just does a POST request to a URL. Just do the same POST request.

<comment><USER10> Cross-domain POST is not possible with all browsers (I presume IE is the main culprit, as usual).

<comment><AUTHOR> It accepts a GET</comment></comment></comment></comment>


How 1989 Reshaped the Modern World - <AUTHOR> https://www.bbc.com/news/world-europe-50013048 <comment><USER2> I was a young (kindergarten and first grade) navy brat when the wall came down. I remember the sheer sense of joy and relief that the Cold War was ending. My community basically existed to support the nuclear forces of the United States and the knowledge that it had suddenly gotten a lot less likely that we'd all die in a nuclear fireball was clearly liberating.</comment>


Ask HN: Cloud Consultant vs. FAANG Job? - <AUTHOR> I am thinking a lot about my career recently, since I am generalist engineer and getting older and older, thinking if I should make strict move to join FAANG company (I may qualify for Google L5, if I can pass their leetcode interview part) or pursue cloud consultant job (fairly qualified in AWS). Tired of being generalist backend engineer who does everything for any company, who are building some type of CRUD app with some business logic before/after retrieving/storing data.<p>Any recommendations? <comment><USER2> Working for a FAANG almost guarantees you will see yourself become the villain. But you will make the most money there, and probably have a fairly secure position.

A cloud consultant job (not at a FAANG, presumably) allows you to deliver the solution best for your customer, regardless of the source of the services.

<comment><AUTHOR> I am thinking about place where I can do things little bit more right way and relax a little (in case of consultant job, take a rest from time to time for couple more weeks or months), instead of always in a rush, because customer X is asking for feature Y, they need it yesterday.

</comment></comment><comment><USER3> I had that option (AWS L7). My answer was to go independent.

Having done that, I'd strongly advise people to do the opposite unless they have no choice. There's a LOT of stuff inherent to running a business that doesn't map directly back to the thing you're good at / enjoy doing.

<comment><USER4> Can you tell us more about rejecting L7 offer at Amazon? I am trying to start a small software business but I have no experience running a business.

How did you make a decision? What skills you would recommend check for? What is a baseline or must have skills before making such decision?

Thanks.

<comment><USER3> [https://www.lastweekinaws.com/blog/why-i-turned-down-an- aws-...](https://www.lastweekinaws.com/blog/why-i-turned-down-an-aws-job- offer/) goes into it in some depth.

</comment></comment></comment><comment><USER5> FAANG, better pay, more respect, better career prospects, long term growth into management due to the prestige, and everything is becoming a monopoly

</comment><comment><USER6> FAANG, no question. Its more money, huge benefits, and it's easier.</comment>


Grid Style Sheets: Cassowary Constraint Solver Layout Engine for Web Browsers - <AUTHOR> http://gss.github.io/ <comment><AUTHOR> This project claims to implement "the same algorithm Apple uses to compute native layout". For those who haven't built apps for iOS or macOS, Apple's Interface Builder utility lets developers specify constraints on how elements of a UI view should layout and the layout is determined while the app is running by an algorithm so that it can adjust to device rotation or device size.

The most recent commit in the associated GitHub repo was made on September 1, 2016. Does anyone know why? Is anyone aware of continued work on this sort of constraint-based autolayout for the web?

More background on the Cassowary Constraint Solver is at overconstrained.io</comment>


Twitter warns that advertiser demand is falling and the stock is crashing - <AUTHOR> http://www.businessinsider.com/twitter-q2-2016-earnings-2016-7 <comment><USER2> This isn't really surprising, they haven't really done anything yet to make themselves more attractive. One can hope that they have something in the pipe. Though, even if their revenue growth is slowing, they can pull profit out. That could allow them to take their time to pull themselves back together.

</comment><comment><USER3> We all know about these problems of twitter. I think that since they have a huge user base, they're not going to fail. They've just to find a new way, some way to renew the product and that's it</comment>


Show HN: Client-Side Encrypted Gist - <AUTHOR> https://github.com/srpeck/encryptedgist <comment><AUTHOR> I had the same need as SDEES ([https://news.ycombinator.com/item?id=12441302](https://news.ycombinator.com/item?id=12441302)), so I created a zero-install, client-side encrypted, browser-based editor using SJCL+CodeMirror in Vim mode.

Live link to try it out here: [https://srpeck.github.io/encryptedgist/index.html](https://srpeck.github.io/encryptedgist/index.html)

<comment><USER2> This is awesome! Very clever to use Gists. (As SDEES author, I'm also super happy to be able to serve as inspiration.)

Could you add functionality to list available documents? Perhaps its possible to get a list of the documents using Gist API after getting GH credentials so the user doesn't have to copy-paste the Gist ID.

</comment></comment><comment><USER3> Please add a license to your code. As it stands, it is currently proprietary (and nobody except you is allowed to use it, modify or distribute it).

<comment><AUTHOR> Added MIT license.</comment></comment>


Study predicts undecided voters with 70% accuracy - <AUTHOR> http://www.latimes.com/news/nationworld/nation/la-sci-undecided22-2008aug22,0,2284725.story

<comment><USER2> Ah, Freud. It's always fun to ponder what we don't know we don't know. That's how we progress, and it's how visionaries' minds work.</comment>


Rope (data structure) - <AUTHOR> http://en.wikipedia.org/wiki/Rope_%28data_structure%29 <comment><USER2> I made a skip list based rope implementation in C and Javascript. In C, the crossover point when ropes become faster is around 200 bytes. They're an awesome little data structure.

C: [https://github.com/josephg/librope](https://github.com/josephg/librope)

JS: [https://github.com/josephg/jumprope](https://github.com/josephg/jumprope)

<comment><USER3> In the usage example for the C lib, you have

'uint8_t *str = rope_createcstr(rope, NULL);'

Did you mean 'r' instead of 'rope'?

<comment><USER2> Yep - fixed! (Thanks @rymo4 for the pull request)

<comment><USER3> Heh, no problem. Not sure why I decided to post here instead of just doing it there.

Nice lib, though. I'll keep it in mind.

</comment></comment></comment></comment><comment><USER4> In SpiderMonkey, JavaScript strings turn into ropes based on some heuristics (if you append to them a lot, I think). This helps a few benchmarks.

So while you might think a JavaScript string is just a pointer + length, the implementation is actually significantly more complex: the engine will pick different implementations depending on how it thinks you're using it.

<comment><USER5> The whole hierarchy of SpiderMonkey strings is laid out in this comment in the code:

[http://mxr.mozilla.org/mozilla- central/source/js/src/vm/Stri...](http://mxr.mozilla.org/mozilla- central/source/js/src/vm/String.h#88)

</comment></comment><comment><USER6> If you like the idea of ropes, you might also be interested in a somewhat related paper by Charles Crowley called _Data Structures for Text Sequences_ :

[http://www.cs.unm.edu/~crowley/papers/sds.pdf](http://www.cs.unm.edu/~crowley/papers/sds.pdf)

The material about the "piece table" method is particularly interesting IMHO.

</comment><comment><USER7> A while ago, I implemented ropes based on the 1995 paper by Boehm et al in JavaScript. The interface provides methods charAt, charCodeAt, concat and substring, so it functions as a drop-in replacement for JavaScript strings (provided you limit your use to the given supported methods).

[https://github.com/Mortal/ropejs/blob/master/rope.js](https://github.com/Mortal/ropejs/blob/master/rope.js)

</comment><comment><USER8> I'd like to see a rope-variant of the 2-3 finger tree.

2-3 finger trees are immutable/persistent and support access to both ends in amortized constant time and logarithmic concatenation and splitting.

The complicating factor being that for flyweight values, like characters, the interior nodes of the tree would be prohibitive for one leaf per character. Surely there must be a variant of 2-3 finger trees that addresses this.

<comment><USER9> you can implement a rope as a 2-3 finger tree of string literals. i wrote a java implementation of 2-3 finger trees a few months ago and implemented both ropes of bytes and ropes of chars (rope backed by finger tree of java Strings here: [https://github.com/jeffplaisance/fingertree/blob/master/src/...](https://github.com/jeffplaisance/fingertree/blob/master/src/main/java/com/jeffplaisance/util/fingertree/rope/Rope.java)).

</comment></comment><comment><USER10> Interesting, but I'm going to have to have a really huge job before I want to implement something like this rather than something like an array-of- arrays/list-of-lists or something like a DOM tree. That is, find a way to naively partition the text into intuitive chunks (newlines, spaces, tags, whatever as chunk boundaries).

Yes, I'm deliberately being contrarian, as the data structure takes a bit of work to comprehend, and even more work to understand the merge and split operations when you make updates. Not saying that I would never use it, just that the need better justify the effort. (not against going outside the out- of-the-box libraries to do things like tries or radix sort, for example, just want a justification to do the work)

<comment><USER11> A DOM tree is rather a pain to implement in practice. You need fast foo.childNodes[i] and also fast foo.nextChild. And fast inserts and removes. And APIs that use (parent, offset) pairs as their basic concept (like ranges) and other APIs that use (parent, prevSibling) pairs (like node insertion). Oh, and memory use needs to be minimal. And the code needs to have low constants, not just low algorithmic complexity.

<comment><USER10> Good point! Sloth and inertia usually allows me to use the work of others in this case (XML DOM, when appropriate), though, but that doesn't make it internally simply (or efficient).

</comment></comment></comment><comment><USER12> I guess if you have an array of characters and you want to insert into the middle, you could promote the array into a rope as follows:

      1. break the array into two extents (start address / length pairs)
      2. make a rope out of those two extents
      3. do the insert on the resulting rope

this assumes that you're okay with starting with an array of characters and ending up with a rope.

ISTR this pattern was common-ish in erlang last time I looked at erlang, but they call ropes (of bytes) "iolists", and support for iolists goes all the way down into the standard library.

<comment><USER13> > this assumes that you're okay with starting with an array of characters and > ending up with a rope.

Well, in any OO language, I guess both a string and a rope would still be considered a String object, whether it's a character array or a tree-like structure backing it wouldn't really matter to the public interface.

</comment></comment><comment> shawn-butler I became aware of them as SGI proposed extension to C++ standard library.

Good evaluation of them remains

[http://www.sgi.com/tech/stl/Rope.html](http://www.sgi.com/tech/stl/Rope.html)

<comment><USER14> The GNU C++ standard library still includes them as a non-standard extension.

[http://gcc.gnu.org/onlinedocs/libstdc++/latest- doxygen/a0006...](http://gcc.gnu.org/onlinedocs/libstdc++/latest- doxygen/a00066.html)

</comment></comment><comment><USER15> Can someone explain intuitively what this is?

<comment><USER16> A rope stores a long string as a collection (binary tree) of shorter strings. Strings are stored contiguously in memory, so mutation (insertion, deletion, catenation, etc) often involves much copying of data, which could be problematic with long strings. Ropes avoid this problem, but have some additional code complexity and resource overhead associated with data fragmentation.

</comment></comment><comment><USER17> C implementation: [https://github.com/kshulgin/crope](https://github.com/kshulgin/crope)

</comment><comment><USER18> As far as I can tell, all the properties described come because this is a balanced binary tree of strings "with rank".

I'd be curious if there is anything else that makes this different?

(it's fairly easy to adjust any balanced binary tree to allow the "report" function, ie generating a ordered sublist of size me in O(log(n) + m) time )

</comment><comment><USER19> Hmm. Is this the data structure that's used in the "rope" libraries for Python symbol lookup etc?

<comment><USER20> Unless I mistake what you're talking about, that's something very different:

[http://rope.sourceforge.net](http://rope.sourceforge.net)

</comment></comment><comment><USER21> One more resource on Ropes, more Java oriented [http://www.ibm.com/developerworks/library/j-ropes&#x2F](http://www.ibm.com/developerworks/library/j-ropes&#x2F);

</comment><comment><USER22> PSA: a Gap Buffer is a far simpler data structure than a rope that works just as well in most (but not all) circumstances.

</comment><comment><USER23> Our database uses Ropes internally as it deals with large strings and frequently inserts and removes sections.</comment>


Curing the Vulnerable Parser [pdf] - <AUTHOR> https://www.usenix.org/system/files/login/articles/login_spring17_08_bratus.pdf <comment><USER2> It's worth noting that Cloudflare followed this advice (whether or not they knew they were) and did not roll their own parser, and still, there was a bug. I'm pretty sure that parser correctness and program security is mostly unrelated, and you can show this both theoretically and empirically.</comment>


Angular JS Gotcha: HTML5 Mode Routing - <AUTHOR> http://blog.releaseboard.com/2013/12/angular-js-gotcha-2-html5-mode.html

<comment><USER2> This isn't some magic from AngularJS, it is a standard HTML5 API and it's been around for a while. It is designed to allow single page applications to use beautiful URLs. So, this isn't an AngularJS gotcha. Not at all. You can read more about it here: [http://diveintohtml5.info/history.html](http://diveintohtml5.info/history.html)

<comment><USER3> And here...

> The reason why refreshing your browser breaks HTML5 mode is that all the > routes in your AngularJS application are not real. Release[Board] doesn't > have a /releases page. AngularJS is using some clever JavaScript to make it > seem like a /releases page exists. When the user hits refresh, the browser > tries to load a real /releases page, which is non existent. I find this a > completely unacceptable user experience.

...isn't this a case of "Duh. What did you expect to happen?"

<comment><USER4> Yep. and the simple solution is a server-side wildcard route.

</comment></comment></comment><comment><USER5> Here: [https://github.com/angular-ui/ui-router/wiki/Frequently- Aske...](https://github.com/angular-ui/ui-router/wiki/Frequently-Asked- Questions#how-to-configure-your-server-to-work-with-html5mode)

You're welcome.

</comment><comment><USER6> Switching between HTML5 and 'hashbang' URLs lets you run apps in environments which lack support the history API or absolute URLs. Examples include old IE and Cordova. The bit of webserver config necessary is a non-issue, imo.

</comment><comment><USER7> So what you're saying is...when you set the URL to something that no longer points to a Resource, it no longer works?

Who could have guessed that undermining a basic concept of the Web might cause problems.</comment>


Ask HN: Interesting projects not in english? - <AUTHOR> There seems to be a lot more github projects that are in chinese or only have chinese commenters in their github issues. For example this react project with 50k stars: https://github.com/ant-design/ant-design/issues<p>What are some interesting projects that english developers are unaware of? <comment><USER2> [https://github.com/kon9chunkit/GitHub-Chinese-Top- Charts/](https://github.com/kon9chunkit/GitHub-Chinese-Top-Charts/)

Most non-Chinese developers are probably unaware of any project on the list. Whether they're interesting is in the eye of the beholder. Ant Design itself is not linked, but appears as a dependency of several projects. Another such dependency is MyBatis, which also seems to be much more popular in Chinese developer circles than elsewhere.</comment>


Mac Pro Tower Reborn - <AUTHOR> http://www.onerivermedia.com/blog/?p=1572

<comment><USER2> I've always thought that version of the Mac Pro was one of the most beautifully designed towers I've ever seen.

<comment><AUTHOR> I remember the first time I played with one. That thing was unbelievably fast.

Reminded me a bit my first contact with a fully tricked out deskside Sun E450. It was so fast I thought I was doing something wrong.

<comment><USER3> The most amazing thing is how in each case the passage of time saw each machine become slower and slower until eventually they are nothing but a relic.

The weird thing is even a smartphone running basically stock apps and nothing else will still exhibit the same effect. Blistering fast out of the box, frustratingly slow by the time it's replaced. I wonder sometimes if the CPU isn't clocking itself down based on some cycle count, or maybe the flash is literally wearing down and losing IOPS.

<comment><USER4> What about the fact that developers are writing more and more bloated and slow applications ?

</comment></comment></comment></comment><comment><USER5> The writer makes an odd choice opting for 1333Mhz memory. I would have thought if they're already spending that much on this big of an upgrade they would have gone for at least 1600Mhz.

Or can you not get 16000Mhz memory for a Mac Pro?

</comment><comment><USER6> Circa 2009 I did this with a G5 Tower (Purchased on eBay for about $60) which was the same design except for some internal differences in mounting. The trick is you buy a PC motherboard mounter intended to be used to make custom cases and you install it in the G5 case. Bam you have a Mac Pro case that will use off the shelf PC components. I ran it as a Hackintosh for a few years but currently it has Windows 8.1 on it. Processor speed requirements have not moved much in that with two GTX 670s in SLI six years later it can still run pretty much every game out there at max settings.

<comment><AUTHOR> > but currently it has Windows 8.1 on it

You know you will have a place in hell for this. Not only ripping out the guts of an elegant PowerPC machine to replace it with an x86 brain, but making it run Windows... This is so wrong... ;-)

</comment></comment><comment><USER7> This just might inspire me to (finally) upgrade my MacPro 1,1.

<comment><USER8> Mine's in it's box. I can neither use it or let it go. First Xeon, 2006 I think.

</comment></comment><comment><USER9> tl;dr: upgradeability FTW, both on price and performance.</comment>


A history of the Amiga – The demo scene (2013) - <AUTHOR> http://arstechnica.com/gadgets/2013/04/a-history-of-the-amiga-part-9-the-demo-scene/

<comment><AUTHOR> Just a quick reminder. The Amiga, Wild, PC 8k and Demo competitions at Revision (a big demo party going on right now) are coming up in just a few hours if you want to see what the scene is up to.

Schedule (German time) [http://2015.revision- party.net/events/timetable](http://2015.revision-party.net/events/timetable)

Live stream here [http://2015.revision-party.net/live](http://2015.revision- party.net/live)

Live stream with chat [http://salinga.everywebhost.com/sofascener/](http://salinga.everywebhost.com/sofascener/)

 _edit_ Wild compo is ongoing:

demos on a Microcontroller, a Gameboy Advance, Gamecube, and some guy made a digital camera out of a scanner, some lenses and a Rasberry Pi.

And a version of a Rachmaninoff Rhapsody with orchestra provided by several Commodore 64s. This would have been on the forefront of Avant Guarde music not too many decades ago.

<comment><USER2> Also, Revision releases:

[http://www.pouet.net/party.php?which=1550&when=2015](http://www.pouet.net/party.php?which=1550&when=2015)

<comment><USER3> Great compos this year. The PC 64k had some amazing stuff (conspiracy floored me). For anyone checking those out at home, your AV software is wrong.

</comment></comment></comment><comment><USER4> Folks interested in Amiga demos should absolutely check out the Mind Candy volume 2 DVD: [http://www.mindcandydvd.com/2/frames?p=download](http://www.mindcandydvd.com/2/frames?p=download) It's long sold out but now available as a free download from the creator at the link above. The DVD is a great set of classic Amiga demos that were captured and put on DVD at very high quality. Also lots of good extras like commentaries from the creators, short documentaries, etc.

There's also another volume on PC demos and a blu-ray with more modern demos: [http://www.mindcandydvd.com/](http://www.mindcandydvd.com/)

</comment><comment><USER5> I remember switching from my Commodore 64 to the Amiga thinking computers would always keep improving in the same rate as the vast improvement between the Commodore 64 and the Amiga in just a few years.

But they didn't :(

<comment><USER6> I still remember taking the Apple OS emulator on my Amiga 1500 and it worked twice as fast as the fastest Mac. I thought Apple and IBM Clones were dead. Sad to say I was wrong.

It took till 1993 that the Mac even caught up to a Amiga 500.

</comment></comment><comment><AUTHOR> Also, in case you want to see the guts of this machine [https://www.youtube.com/watch?v=HKNVIgsbYrA](https://www.youtube.com/watch?v=HKNVIgsbYrA)

</comment><comment><USER7> In addition to the scene links posted here, I highly recommend reading the Ars articles from the beginning. I have the ToC bookmarked because the entirety of it is like a love letter to the Amiga: [http://arstechnica.com/series/history- of-the-amiga/](http://arstechnica.com/series/history-of-the-amiga/)

<comment><USER8> Notice how the demo scene chapter came 5 years after the others. Caught me off guard. And nearly missed it as i have pretty much abandoned reading anything but the science section of Ars Technica.

Bloddy site is filled with Apple wankery and minutiae about the intersection of tech and US law (i'm not American, for the record).

I really miss Hannibal's detailed articles on CPU internals, but i guess he was right about how there was nothing new to write in that field any longer. These days it seems to be all about cache misses.

</comment></comment><comment><USER9> I remember when I switched from Amiga to PC. Maybe around 1992-1993. The PC took all the fun I had with the Amiga. Assembly programming, games, demos. It was no longer the same on a PC. Eventually, internet + linux + learning CS at university made things fun again.

<comment><USER10> To me, Linux lacked a lot of the aesthetic aspects of the Amiga. It had no games scene, the culture was older, more academic or "heavy industry" and didn't have multimedia in its blood like the Amiga scene did.

One thing that made the Amiga special, that can't really be replicated is that it occupied a sweet spot in the history of computer hardware. You could make like a C64 programmer, kick out the os and write pure ASM to the hardware (which was strange, complex and fascinating, unlike PC hardware), or you could go in the other direction and write object oriented (using BOOPSI) GUI apps in a true multitasking environment. And to top it off, it was a system that one programmer could completely understand, more or less. There was a real feeling of power and elegance when you programmed an Amiga.

I probably spend too long thinking about this :) It was the "Amiga feeling" that got me into computers when I was younger, and I keep trying to replicate it :)

<comment><USER9> > To me, Linux lacked a lot of the aesthetic aspects of the Amiga. It had no > games scene, the culture was older, more academic or "heavy industry" and > didn't have multimedia in its blood like the Amiga scene did.

Sure, nothing comparable with the Amiga. But coming from Windows 95, Linux was at least programmer friendly.

My biggest frustration coming from the Amiga was that I wasn't able to display anything on a PC (at least, not with the limited knowledge I had at that time). With the Amiga, it was easy, no need to worry about system calls, you just wrote at the right place into the RAM et voila. And it wasn't complicated to make things move using the Blitter and the Copper. It was something a kid could do.

EDIT: talking about the aesthetic aspect of the Amiga, I think it was a beautiful computer too. People always praise Apple for making computers beautiful. But to me, my Amiga 500 was much better looking than an Apple II or a mac from that era.

<comment><USER11> > But coming from Windows 95, Linux was at least programmer friendly.

Depends. I came from the ZX 80, Amiga and PC. My first UNIX was Xenix on 1993, followed by DG/UX in 1994 and Slackware 2.0 in 1995.

Never found out an environment similar to Devpac, Amos, Turbo Pascal, Delphi, Borland C++, Turbo Assembler back on those days.

Sure I did learn a lot from UNIX, but the spirit wasn't really the same.

</comment></comment></comment></comment><comment><USER12> I remember when I saw "hardwired" (2disks) on my Amiga 500 and I was like "wow" at the time. Is there a place where I can download these and play them on an emulator?

<comment><AUTHOR> You'll want to find a build of UAE for Amiga emulation.

[https://en.wikipedia.org/wiki/UAE_%28emulator%29](https://en.wikipedia.org/wiki/UAE_%28emulator%29)

</comment></comment><comment><USER13> Man, the Amiga community is so fascinating to me. It still keeps trucking, albeit minimally, after all of these years.

Fun times.</comment>


Car hackers can kill brakes, engine, and more - <AUTHOR> http://www.itworld.com/security/107771/car-hackers-can-kill-brakes-engine-and-more <comment><USER2> News at 11: Physical access allows total control! More on this amazing story...

<comment><USER3> From the article:

 _But as they look at all of the wireless and Internet-enabled systems the auto industry is dreaming up for tomorrow's cars, they see some serious areas for concern._

Yes, it is a bit absurd to be concerned about somebody planting a laptop in your car then gaining control. They could just cut the brake lines without even having to get into the car. The point is that cars in the future will have wireless connections and be able to send diagnostic reports over this connection. That will create some level of connection between the vehicle's sensors and a network outside of the car. In fact, it's almost certain that some vehicle systems will be controlled by inputs from an external connection. Can you imagine every airbag in southern California simultaneously deploying?

The auto industry has never really had to consider this type of network security in their software. I think it's in everyone's best interest if they start thinking about it.

<comment><USER4> Not even the future. I'm pretty sure General Motor's OnStar service does most of this already.

THAT would be an interesting test.

</comment></comment></comment><comment><USER5> Brakes are mechanical systems. Can anyone figure out how the computer could even begin to disable them? I guess one could imagine the ABS module could be used to cut out the brakes permanently instead of pulsing them. (Maybe this is another reason people should learn to brake properly instead of relying on dumbing-down systems... ;-)

<comment><USER6> Just about anything with ABS or traction control has a digital override of the drivers intent. That was the big fact people seemed to overlook during the Toyota-acceleration fiasco.

I wasn't nearly as concerned about the actual problem as I was about the computer deciding a brake instruction from the user should be _ignored_. Modified, certainly. But _ignored_?

It boggles the mind.

<comment><USER4> I don't remember hearing this, mainstream media was so focused on floor mats and sticky accelerators and what not. Are you saying that while the car was accelerating the computer overrode the driver braking and failed to apply any brakes? Source?

</comment></comment></comment><comment><USER7> All new cars have diagnostic ports using open protocols. <http://www.obdii.com/> has some of the details. They use the CAN bus so it would be fairly easy to attach a small microcontroller with CAN support and an 802.11 or GSM module to give you remote access.

I'm not sure how well documented the control protocols are (stopping car, turning off brakes, etc.) but it is apparent from this article that they can be discovered.

<comment><USER8> The control protocols are not well documented at all, starting in 1996, all cars are required to have OBD ports.

The manufacturers don't want people to know the control protocols for various reasons (security, manufacturers make money selling repair materials and codes to repair shops, licensing codes to third parties etc.)

But it is possible to discover the control protocols, a friend and I worked on it for his Toyota Yaris I think by monitoring all the outputs from the OBD and changing a status (locking a door) and watching what bits change. We got a lot of equipment and help from a professor at school. We used a GPS and ended up making a little app that monitored where the car went, its speed, and various car statuses on google maps. There's a lot of info out on the Toyota Prius if you feel like getting started.

</comment></comment><comment><USER9> I yield to no man in the gravity and intensity of my fanboyish appreciation of Stefan Savage, but... people have been hacking engine ECUs (for benefits) for decades. Meanwhile, if I want to kill someone, I'm just going to cut lines inside the car. You know, like they did in Hitchcock movies?

<comment><USER10> You may not be up on the latest car designs, but attaching the ECU to the Internet is indeed a problem. Preemptive response: no a firewall is _not_ the correct answer to this problem.

</comment></comment><comment><USER11> It's called OnStar: remote disable, and more, all at the click of a command key. I've been waiting to see news of a car-theft ring using OnStar to steal cars.

</comment><comment><USER12> "the security researchers say that by connecting to a standard diagnostic computer port included in late-model cars"

If the objective is just to kill brakes/turn off the engine, there are easier techniques.

I remember reading about a $200 handheld EMP weapon that achieve this (can't find the link right now).

<comment><USER13> brick -> windshield works pretty good too

<comment><USER14> How does that kill the brakes or turn off the engine?

</comment></comment></comment><comment><USER15> My carbureted 1970's chevy pickup is looking better and better /s

This is obviously a hit piece. The mechanical systems of a car are more hackable than the computer (bleeder valves anyone?). We might as well be concerned about people bending railroad tracks.

I'll agree at some point there will be a huge news generating security issue that will wake up manufacturers, but people are so paranoid about cars/computers that I doubt it will be a continuing problem.

</comment><comment><USER16> This seems like a little bit of FUD. This isn't any different from hooking up a device to the brakes that receives a mobile signal and stops them from working mechanically.

<comment><USER17> I agree, it'd be nice to know how much easier it is (if at all) to mount an tie in a computer to their car. They do make a good point:

"But as they look at all of the wireless and Internet-enabled systems the auto industry is dreaming up for tomorrow's cars, they see some serious areas for concern."

<comment><USER18> _Hopefully_ , the wireless and Internet-enabled systems will be completely isolated from the CAN-bus.

At first I hoped it would be air-gap isolated, but after I thought about it for a bit I realized that's not possible. In particular, one obvious application for the Internet is playing network MP3s to your car radio, which is also pretty intimately tied into the CAN-bus in modern designs. So while there may not be an "official" path from Internet->CAN-bus, it's one buffer overflow in the car radio away from working, probably. And what are the flerking odds that the car radio is implemented in anything other than ( _spit_ ) C, which in the hands of embedded engineers who haven't had to think about security for decades pretty much guarantees buffer overflows will abound?

And of course if we're going to implement remote condition monitoring in the style of OnStar, there may very well be direct Internet<->CAN-bus interconnects built right in.

I'm sort of regretting having taken the time out to think about this. Now I'm scared.

<comment><USER19> Speaking from a little bit of experience in this area...these networks are often not isolated. It depends on the vehicle and network architecture, but there are valid business reasons for getting at the entire network through Wi- Fi.

Buffer exploits in C aren't the issue. The issue is cracking the weak encryption scheme, and figuring out the unpublished sequence of CAN bits to send that do things like lock/unlock doors or change the powertrain calibrations. OEMs try to hold this info close to the vest for obvious reasons, but there is a large subculture out there reverse engineering it.

</comment></comment></comment></comment><comment><USER20> OBDII has been around for a while. Also, bolt cutters are a far more efficient way to do this.

</comment><comment><USER21> If you're paranoid about this, consider driving a classic car.

</comment><comment><USER13> When I sit in my car I can also apply the brakes, turn the heater on / off, switch to maximum volume, open the windows, heck I can even drive it into a tree !!</comment>