Comparison of different concurrency models: Actors, CSP, Disruptor and Threads  - <AUTHOR> http://java-is-the-new-c.blogspot.com/2014/01/comparision-of-different-concurrency.html <comment><USER2> Disagree with the characterization of CSP. CSP as I understand it has channels as the main building block for interprocess communication. Channels can be synchronous or asynchronous, and bounded or unbounded. The important point is that a channel is a value (you can pass it to a method, return it from a method) and usually has a type.

Actors are like a simplified CSP where each (lightweight) thread has a single input channel. In the case of Akka this mean you lose type information because control messages are mingled with data messages and you can't assign any useful type of them.

Disruptor is mainly a pattern and implementation for high efficiency -- big queues, minimum number of threads, and some tricks using CAS operations and the like. I wouldn't call it a model of concurrency -- it's basically a particular implementation of CSP.

<comment><USER3> Yes, authors cited their sources, so we can understand their perspective better.

<comment><USER3> _facepalm_ That should be "authors _should_..." Which is BTW an absurdly trivial observation to post in retrospect, on top of it.

</comment></comment></comment><comment><USER4> Can anyone elaborate on what happens with Akka after 5 cores? In all of the timings, Akka has an equivalent exponential drop to all of the other systems - until it hits 5 cores. At that point, it levels off or goes up. Is there anything inherent in the Akka implementation that would cause this?

</comment><comment><USER5> There should be a rethink of how our multicore computers are architected. Here is what I have to do in order to write a multicore parallel soft real-time application.

1) I have to scrutinize the way I use memory, such that no two threads are going to stomp on the same cache line too often. (False sharing)

2) The above includes the way I use locking primitives and higher level constructs that are built on them! (Lock convoying)

3) If I am using a sophisticated container like a PersistentMap, which is supposed to make it easy to think about concurrency, I still have to think about 1 & 2 above at the level of the container's API/contract, as well as think about how they might interleave contended data within their implementations. (Yes, Concurrency is not Parallelism. Here we see why.)

4) Garbage Collection -- Now I have to think about if the GC is in a separate worker thread and think about how that can result in cache line contention.

5) Even if you do all of the above correctly, the OS can still come along and do something counterproductive, like trying to schedule all your threads on as few cores/sockets as possible. (This is even nicknamed "Stupid Scheduling" in Linux by people who have to contend with it.) This entails yet more work.

6) Profiling all of the above is, as far as I can tell, still a hazy art. Nothing is a smoking gun for one of the pitfalls of multicore parallelism. One is only left with educated guesses, which means that you have to increase data gathering. Is there something like a debugger like QEMU which can simulate multicore machines and provide statistics on cache misses? Apparently, there are ways to get this information from hardware as well.

It would seem that Erlang has an advantage with regards to multicore parallelism, because its model is "distributed by default," so contention is severely limited, which is great for parallelism. However, coordination is severely limited as well! (I need to look at Supervisors and see what they can and cannot do.)

It would also seem like there's room for languages that combine these recently popular advanced concurrency tools with enough low-level power to navigate the above pitfalls, combined with a memory management abstraction that increases productivity without requiring the complications for parallelism entailed by GC. Rust, C++, and Objective-C are the only languages that somewhat fit this bill. (If only Rust were not quite so new!) Go, with its emphasis on pass by value semantics might also work for certain applications, despite its reliance on GC.

<comment> vertex-four What do you mean by coordination being limited in Erlang, exactly?

Supervisors are essentially in charge of one thing, and that's process lifecycle management; starting up processes, restarting them when they die, and bailing out if something goes wrong.

<comment><USER5> _What do you mean by coordination being limited in Erlang, exactly?_

I have an algorithm for an absolute occupancy grid that can handle multicore parallelism. Basically, the grid is subdivided into smaller parts that just do their thing independently, but if they detect that a move takes a player out of their boundaries, they queue it up locally for the global grid. Once all of the subgrid threads are done, they wait while the global grid does its thing. (Aggregating all the local subgrid queues, then processing those moves requiring global coordination.)

I don't see how I can do that in Erlang. The closest thing I'm aware of (and I know almost nothing about Erlang) is that moves are are done optimistically, then collisions can be detected after the fact and rolled back. Maybe that's what I'll need to do: port to Erlang and use rollbacks.

 _Supervisors are essentially in charge of one thing, and that 's process lifecycle management_

I thought they could do more than just that, maybe.

<comment> vertex-four That should be reasonably possible, surely? Your global grid is one process, that sends messages containing the smaller parts to the processing processes, then waits for them to reply with another message, and then aggregates the replies. It's all just message buses, you can push whatever stuff you want around however you want.

Imagine how you'd implement your system if each part of the system had to communicate with the others over a network socket, and you're most of the way to implementing it in Erlang.

It's probably not optimal to do things involving lots of calculations in Erlang, though, as the VM is fairly slow. Akka implements a similar system, but for the JVM (Scala).

<comment><USER5> _waits for them to reply with another message, and then aggregates the replies_

Basically, you are proposing that the world actor aggregate the entire world's data? That wouldn't scale. Or, maybe the world actor just becomes responsible for adjudicating moves between subgrids. Maybe.

<comment><USER6> Isn't the fundamental point of concurrency the players?

Couldn't you have X players moving on a global grid? I have built systems with literally tens of millions of players (Erlang processes) moving on a grid (and doing way more, localized threat detection, decision making, moving away or towards, and coordination with other units in X range).

<comment><USER5> Can you give a high level description of how you implement the global grid? It's really only absolute coordination of a checkerboard-like grid that I'm wrestling with. I've verified that my algorithm works, and is nicely stable. I've also scrutinized it with VisualVM, and on Linux and OS X, the threads are either in wait or running, in the pattern I'd expect. (The subgrid worker- group threads have to wait for the global grid to do its coordinating.) I'm also seeing expected use of the thread pools. However, for some reason I can't seem to scale beyond 250 users.

One complication is that my grid is for a procedurally generated world with 2^120 locations in it. This is why I generate subgrids. A degenerate case is one subgrid per user. However, these subgrids are organized in load-balanced groups, each of which has their own thread pool, caches, and locks.

Also, rollbacks are problematic, though the real problems are arguably corner cases.

Erlang might be a win because each garbage collector only has to deal with its own local memory.

EDIT: It turns out my algorithm is somewhat similar to Pikko:

[http://www.erlang- factory.com/upload/presentations/297/Pikko...](http://www.erlang- factory.com/upload/presentations/297/PikkoServerErlangconference.pdf)

One big difference, is that my algorithm doesn't move or reconfigure masts, instead it dynamically creates subgrids, which are then grouped into "workgroups" each of which is supposed to be processed by a different CPU socket. Instead of there being an API, it's more that the subgrids stop what they are doing and their information is briefly managed by the global grid code. (The procedurally generated map is rigged, so that there are many opportunities for crossing from one subgrid to another.)

<comment><USER6> Going to do my best to put a quick summary (from memory) on something that took us a long time to get right and was a bit convoluted.

Our units actually would report to intermediaries their maximum interaction boundries, which would then be passed to processes to create something somewhat like a mast, someone like a subgrid -- a dynamic interaction zone. All our units had hard constraints (max speed, etc) and worked in global ticks that represented real time. Then, we would talk to global to stretch all the interaction zones to fill empty space and report back boundaries. Then, our units would work in little worlds until they crossed a threshold, we caused a rezoning among them and their neighbors. So initially, the everything would have to be parsed out into interaction zones, but then they could ignore each other for periods of times until a unit strayed across an edge, and then rezoning took place.

Not sure how well it would work with amped up movement (making it have to go all the way up to global more) and not certain how it would work at the scale of 1 undecillion 329 decillion 227 nonillion 995 octillion 784 septillion 915 sextillion 872 quintillion 903 quadrillion 807 trillion 60 billion 280 million 344 thousand 576 points!

<comment><USER5> I woke up with the realization that my problem is probably GC pressure. The system is currently written in idiomatic Clojure so doing everything generates garbage. What's more, the garbage is created in one tick, then released in a subsequent tick, so I'm losing the benefit of generational GC.

I think I can make my subgrids algorithm work, but it will have to be using _mutable_ data structures.

</comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER7> Disruptor is an _application_ of the pre-emptive threading model. It certainly it interesting but to put it in the same pedestal as CSP and Actor model is wrong. (Also the stability of Disruptor approach in face of competing applications on the same machine was an issue last I checked.)

</comment><comment><USER8> It is interesting since in Erlang data structures are functional (immutable) actor mailboxes could as well be implemented to share data instead of copying it. Large binaries are handled that way. They live in a binary memory area and are referenced via pointers. The rest of the messages are not. At some point it was deemed it was better to actually make the copy.

<comment><USER9> Even if everything is immutable, sharing data between threads adds memory management overhead that isn't worth it for most objects. For GC, you have to walk the environment of every thread to free anything in the shared memory. I dunno how big of a difference that makes for fancy concurrent GCs, but for regular ones, you'd have to stop every thread during collection. For reference counting, it's a bit simpler; so long as each thread keeps its own reference count, you can decouple the reference counting from freeing and have a hybrid scheme where you "GC" the shared object heap by scanning for objects with reference counts of 0 in all threads. Still not free, though.

</comment></comment><comment><USER10> > _For maximum performance one would create one large job for each Core of the > CPU used._

Dmitry Vyukov has suggested otherwise in a similar scenario using Go:

> _If you split the image into say 8 equal parts, and then one of the > goroutines /threads/cores accidentally took 2 times more time to complete, > then whole processing is slowed down 2x. The slowdown can be due to OS > scheduling, other processes/interrupts, unfortunate NUMA memory layout, > different amount of processing per part (e.g. ray tracing) and other > reasons. [...] size of a work item must never be dependent on input data > size (in an ideal world), it must be dependent on overheads of > parallelization technology. Currently a reference number is ~100us-1ms per > work item. So you can split the image into blocks of fixed size (say 64x64) > and then distribute them among threads/goroutines. This has advantages of > both locality and good load balancing._

[https://groups.google.com/d/msg/golang- nuts/CZVymHx3LNM/esYk...](https://groups.google.com/d/msg/golang- nuts/CZVymHx3LNM/esYkA_YoB-MJ)

Or to put it this way: imagine that there was zero concurrency overhead. Then splitting out jobs to their minimal size would be the ideal option, as that would allow for the most smoothed out division of labour where every processor does work all the time and they are all doing work until the entire task is completed.</comment>


Indo-European languages - <AUTHOR> https://en.wikipedia.org/wiki/Indo-European_languages <comment><USER2> One country sticks out in this uniform sea of indo-europeans. Ugly detail is that in Finland has ruling class of swedes (%3), who have very special privileges, because of their "unique language and culture".</comment>


Meet the tireless entrepreneur who squatted at AOL - <AUTHOR> http://www.cnet.com/news/meet-the-tireless-entrepreneur-who-squatted-at-aol/

<comment><USER2> Interesting , is that possible and easy to hide yourself, Just wondering to start something like this ;)</comment>


Facebook Look-alike Audience: Use your old customers to find new ones - <AUTHOR> http://themediaforge.ca/facebook-lookalike-audience/

<comment><AUTHOR> Do you think this violates personal privacy?

<comment><USER2> Not if the information is already out there</comment></comment>


Revesiting Backbone.js View Rendering - <AUTHOR> http://elving.me/post/45836034024/revesiting-backbone-js-view-rendering

<comment><USER2> There are numerous benefits to using a presenter, or at least a "renderContext" object. Most conversion, formatting, predicates, and lazy attributes won't come through with toJSON(). The performance penalty is negligible compared to the benefit of testable presenter methods, logic out of the view, etc.

Performance isn't the only thing to consider.

</comment><comment><USER3> I agree that putting all that logic and template vars into a template is confusing. Hard to create mocks of what the HTML should actually be structured like. Im using Jade so I can be terse and pre-compiling the templates. While in my Backbone application, I apply DOM-like rendering with Plates.js.

</comment><comment><USER4> I'm not familiar with Backbone but isn't `model.toJSON()` unnecessarily removing useful data types (like Date) that aren't available in JSON ?

<comment><USER5> You're probably thinking of `JSON.stringify()`. `model.toJSON()` just returns a clone of the models attributes object.

<comment><USER4> So `model.toJSON()` isn't supposed to return a JSON-compatible data structure ?

<comment><USER5> It's supposed to return an object that is suitable for turning into JSON, but it won't convert any of items members. JSON.stringify relies on the toJSON functions of the members to serialize themselves.

</comment></comment></comment></comment><comment><USER6> Why is using 'model.toJSON()' overkill?</comment>


Show HN: My first Ludum Dare entry, online multiplayer game Hide-n-Stab - <AUTHOR> http://188.8.131.52/

<comment><AUTHOR> Last weekend for the Ludum Dare 48 hour game competition "Beneath the Surface," I created an online stealth game. Building even a simple multiplayer game in 48 hours was a very ambitious goal but I'm very pleased that I was able to pull it off.

In Hide-n-Stab, everyone looks alike, but some characters are harmless NPCs while others are fellow players like yourself. Your goal is to find other players and kill them by stabbing them in the back, but whenever you attack, you'll be revealed as a player for a short time.

You can play in your browser, and I'd love to hear your feedback: [http://220.127.116.11](http://18.104.22.168)

The game was created with Haxe, using the HaxePunk game engine, which I'm a contributor to.

<comment><USER2> I like this type of game, reminds me of Spy Party. Suggestion: don't allow the characters to walk through each other. If a player tries to stab you and fails, the fight just becomes walking through each other and trying to turn around fast enough to stab the other guy in the back, which isn't really fun or strategic.

<comment><USER3> Yeah, honestly it reminds me of what spy party had the potential to be. I haven't played it in a while, but it was really a disappointment.

</comment></comment></comment><comment><USER4> It seems like there is no advantage to being stealthy -- sure, a stabbing action gives you away as a real player, but it also allows you to move _faster_ than hidden players who, seeing you revealed, might try to distance themselves from you.

<comment><USER5> Agree that it almost makes more sense to make stealth mode fast and stab mode slow.

</comment></comment><comment><USER6> It sounds fun, but I'm afraid it's not working for me on Chrome 34 on OSX. Just shows the tiles and Score: 0 in the top left.

<comment><USER7> Chrome 34.0.1847.131 m - does not work. Fix it soon as this looks like an amazing idea!

<comment><AUTHOR> I'm moving everything to a more robust EC2 instance, so please bear with me.

</comment></comment></comment><comment><AUTHOR> Thanks for playing, everyone! While my little server didn't stand a chance against the deluge of new players, I was able to fix a lot of bugs and scale things up quite a bit. I'm going to keep working on it and put out a more polished final version soon.

</comment><comment><AUTHOR> Just completed a server upgrade and migration. Sorry for the delay - should've seen that coming. Hopefully there will be no more problems.

<comment><AUTHOR> Still some intermittent problems - I'm going to be constantly monitoring things, but if your game freezes or glitches, just try refreshing.

<comment><USER8> Seems this new server's getting crushed... but the times it's worked, it was a lot of fun!

</comment></comment></comment><comment><USER9> Nice game, very addictive.

As a fellow developer I wrote a quick article on your game ([http://www.uppskattat.se/articles/hide-n- stab](http://www.uppskattat.se/articles/hide-n-stab)). I hope you'll get some visitors.

You should think of having some domain, I think most non-IT people are suspicious against ip-addresses. Hit me up if you want me to add some credits for you or if you change the hostname to something else.

<comment><AUTHOR> Glad you enjoyed it, and thanks for the article! This is just a temporary home for the game. Once the competition is over, I'm planning on polishing it up and posting it on Kongregate or somewhere similar.

<comment><USER9> Cool, when that happens and if you remember and care about it it hit me up and I will update the article.

</comment></comment></comment><comment><USER8> The server is currently getting overloaded, but try reloading your browser a few times before throwing in the towel. It's a lot of fun if you get in.

</comment><comment><USER10> Problems:

You are almost invulnerable running around constantly attacking and when someone decides to kill you in this mode it is very random who dies, usually best connection wins. This could be easily fixed not by improving the lag, but by improving the gameplay.

I think you shouldn't be able to attack again until the reveled mode ends. Otherwise, once revealed, the game become run and attack.

</comment><comment><USER11> For God's sake fix that collision detection. I try to stab someone and someone tries to stab me, we are going through each other and standing on top of each other and still stabbing, and nothing happens.

Edit: It is so frustrating. I stand at exactly (pixel-perfect) the same height as someone else. I stab him so that my knife ends directly in the middle of the other player. It does nothing. I try again, this time going to the right a bit (so move to the right, then look to the left so that I stab towards him). This time the knife ends around where his sprite begins. At the same time he does one stab and I die. Why do I die and never someone else? Is this lag or something and has he stabbed me ten seconds ago? Is anyone getting scores of over 1 or 2?

<comment><AUTHOR> You can only stab from behind, so that might explain the trouble you're having.

<comment><USER11> Oh, that might explain. Let me try.

Edit: yes that's it

</comment></comment></comment><comment><USER12> Great job! Do you have any plans for keeping this up long term?

I managed to play for a while yesterday before it got HN'd (can we say that now instead of slashdotted?) and was looking for a temporary diversion but it does not seem to be functioning properly any more.

<comment><AUTHOR> I'm working on fixing some bugs and adding a few new features, then I'll post it somewhere more permanent like Kongregate. I'll be sure to announce when I do.

</comment></comment><comment><USER11> How do I compile this? I've installed haxe, lime, openfl, renamed openfl version from 1.4.0 to 1.2.3, but every time I install a dependency it gets stuck on another. The one it's currently stuck on is spinehaxe, for which google finds two github repositories, neither of which seem to be of any use. It's not in the lime repositories either.

How do you compile this?

<comment><AUTHOR> You'll need a few of my own libraries:

* spinehaxe: github.com/bendmorris/spinehaxe

* SpinePunk: github.com/bendmorris/SpinePunk

* my fork of HaxePunk: github.com/bendmorris/HaxePunk (use the "all" branch) which has modifications not accepted into the main version yet

To install spinehaxe and SpinePunk, clone the repository, enter that directory, and run the command "haxelib dev <library name> src". For HaxePunk, clone my fork, check out the "all" branch, and run "haxelib dev HaxePunk path/to/haxepunk"

Hopefully installing those should be enough to get it working.

<comment><USER11> Did all you said, modded the openfl version to 1.3.0, then the following:

         - Running command: haxe bin/linux64/cpp/haxe/release.hxml -D HXCPP_M64
        src-client/hidenstab/Client.hx:66: characters 8-21 : sys.net.Socket has no field endian
        src-client/hidenstab/Client.hx:83: characters 15-36 : sys.net.Socket has no field bytesAvailable
        src-client/hidenstab/Client.hx:84: characters 15-36 : sys.net.Socket has no field bytesAvailable
        src-client/hidenstab/Client.hx:89: characters 30-45 : sys.net.Socket has no field readByte
        src-client/hidenstab/Client.hx:90: characters 30-45 : sys.net.Socket has no field readByte
        src-client/hidenstab/Client.hx:98: characters 20-36 : sys.net.Socket has no field readBytes
        src-client/hidenstab/Client.hx:102: characters 20-36 : sys.net.Socket has no field readBytes
        src-client/hidenstab/Client.hx:106: characters 33-54 : sys.net.Socket has no field bytesAvailable
        make: *** [linux] Error 1

Edit: So it's not `make linux` it seems, `make flash` seems to do something... Let's try making the server or something...

Edit2: ./server:

        [...]
        Called from flash/Lib.hx line 191
        Called from /usr/lib/haxe/std/neko/Lib.hx line 30
        Uncaught exception - load.c(237) : Failed to load library : lime.ndll (lime.ndll: cannot open shared object file: No such file or directory)

Edit3: Found lime.ndll in some bin folder somewhere. Copied it over to where ./server is. Now it seems to try to bind to 188.8.131.52 (your server's IP) which of course doesn't work. Server.n is a binary format, that can't be the config file, hmm...

Edit4: Oh there are replies that HN doesn't show in edit mode. Okay. Gonna try this!

<comment><AUTHOR> You'll need to run "lime setup linux" to build the lime.ndll file and then copy it into the hide-n-stab directory.

edit because I can't reply to your comment: yes, the client also uses the values in Defs.hx. It's likely a Flash security issue due to running it locally. Try adding "-Dnetwork-sandbox" to the command in the Makefile which builds the flash client.

<comment><USER11> Okay the server seems to run now, but the client gives a black screen. When using `make flash` (without -final) it does show "Masks", "output:" and "\-- HaxePunk 2.6.0-dev --", but still no game. Does the flash client also use the values in src/hiddenstab/Defs.hx?

<comment><USER13> How's it going?

<comment><USER11> Still not working. It seems to compile, but I don't know what to do with the black screen that the client gives. Compile errors are googleable, but I don't feel like digging into code in some language that I have never used. I wouldn't know how to do console.log nor where to read the console log.

</comment></comment></comment></comment></comment></comment></comment><comment><USER14> Cool concept, but ran into some crazy lag on kill events; another player and I must have stabbed each other 6 or 7 times before I died.

</comment><comment><USER15> It's a fun and interesting idea, but it's loading about one time in three for me. When it does, it frequently crashes, resets, or simply won't let me move. The rest of the time it's various asset loading errors and other problems. I know the HN hug of death is hard to avoid, but there are a lot of other bugs going here also.

<comment><AUTHOR> When the server went down, I was running around with my hair on fire trying to fix it and other bugs that cropped up. Inevitably I ended up introducing even more bugs in the process. Everything is working relatively smoothly right now, and I'm keeping an eye on things.

</comment></comment><comment><AUTHOR> I had to limit the game to 100 simultaneous players. It seems there are always more people who want to play, so I set up a second server at [http://184.108.40.206](http://184.108.40.206) \- this server should have lower latency, but also fewer people. Consider switching!

<comment><USER13> Page doesn't load.

</comment></comment><comment><USER16> Nice, it's like Spy Party, but with an actual release. Nice job.

</comment><comment><USER17> Pretty entertaining. Works well on Firefox 28 on Mac.

</comment><comment><USER18> This did not work on my machine running Chrome on OS X. I can't do anything in the game, I am just staring at the screen loaded.

</comment><comment><USER19> You got front-paged.</comment>


The Evolution of Disk Storage and an Introduction to NVMe - <AUTHOR> https://www.linuxjournal.com/content/data-flash-part-i-evolution-disk-storage-and-introduction-nvme <comment><USER2> My dad had a 256bit memory module on his desk. Made out of sandwich of two pieces of glass and 16 vertical and 12 horizontal wires. Each intersection had a small ferrous ring.

Around that time he was programming and early computer and you could actually hear the memory bits changing. He was excited listening to it, figuring each click was a loop. Then her heard a different sound and realized he as hearing instructions and not loops.

</comment><comment><USER3> Some really early computers stored bits in waves in mercury. A series of waves would be started at one end of a tube full of mercury and they would be read back when they arrived at the other end. The memory of course then had to be refreshed. Core memory was however much more successful.

[https://en.m.wikipedia.org/wiki/Delay_line_memory](https://en.m.wikipedia.org/wiki/Delay_line_memory)

<comment><USER4> Same idea was used between satellite and ground, wave was used as a memory that could be reused when back to station.

<comment><USER5> Holy crap that's so cool. Thanks for that info.

<comment><USER4> Some teacher that worked for the french ministry in the 80s told us that. It makes sense but I never found data on it. I'm not 100% sure it was done because he was a bit of a big mouth but at the same time he was in the field for decades so..

<comment><USER5> ah yeah I haven't found anything. Still a cool idea, however I'd imagine you'd have issues with data loss.

</comment></comment></comment></comment></comment><comment><USER6> I am surprised the article doesn't talk about Optane technology: [https://en.wikipedia.org/wiki/3D_XPoint](https://en.wikipedia.org/wiki/3D_XPoint)

<comment><USER7> Is Optane really 'all that' compared to other PCIe storage?

I know that Intel are positioning it as some sort of system accelerator, and I know it does tend to score well in comparisons... but not "This is in a completely different category" well, AFAICT.

What's special about it compared to, for instance, Samsung's NVMe offerings?

<comment><USER8> Optane is persistent and bit-addressable, with mean latency under 1 microsecond, which is an order of magnitude faster than other SSDs.

I don't think the market has figured out the right use case for Optane yet. The majority of desktop applications won't benefit from lower latency IOPS and it's too expensive to use for general purpose storage on servers. It does make sense for constant write or seek-heavy applications like database journals, but most databases are optimized for doing bulk sequential reads/writes and won't take advantage of Optane's bit addressable storage.

Intel's recently started shipping Optane DIMM modules that act like slow, cheap, high density RAM. This is an interesting option as it allows in-memory databases to be atomically persistent without having to add any code.

<comment><USER9> It is actually significantly faster than traditional flash-based (NVMe/SATA) SSDs for consumer workloads because flash performance falls off drastically at low queue-depths, and almost all consumer workloads have low queue-depths.

A lot of consumer applications are not really optimized around super-fast SSD storage in general. You end up with CPU bottlenecks initializing stuff and so on. So in many cases Optane is not _noticeably_ faster than NVMe because the bottleneck moves to the CPU instead of the SSD.

The real problem is price, of course. I'd gladly replace all my flash with optane at $100/tb, but it's also an order of magnitude more expensive. Not sure if that's just an issue of economies of scale not being there or what, but I got a good deal on a 280 GB 900P (about $200) and that's enough super- fast storage for the things that really matter to me. I use 1 TB EX920s for the rest.

<comment><USER10> What do you use the 280GB 900P for in front of your 1TB drives? You're right the bottleneck is often somewhere else in the system once you have modern SSDs. The 280GB 900P is ~$0.89/GB [1] and 1TB EX920 is ~$0.15/GB [2] these days, so the cost delta is not an order of magnitude (i.e. >10x).

What's funny to me is that the first consumer flash SSDs Intel released were just over 10 years ago, and they were ~$7.44/GB with only 80GB capacities [3]. Things change quickly, eh?

[1] [https://www.newegg.com/Product/Product.aspx?item=N82E1682016...](https://www.newegg.com/Product/Product.aspx?item=N82E16820167439)

[2] [https://www.newegg.com/Product/Product.aspx?Item=N82E1682032...](https://www.newegg.com/Product/Product.aspx?Item=N82E16820326778&Description=ex920&cm_re=ex920-_-20-326-778-_-Product)

[3] [https://www.tomshardware.com/reviews/Intel-x25-m-SSD,2012-15...](https://www.tomshardware.com/reviews/Intel-x25-m-SSD,2012-15.html)

</comment></comment></comment></comment></comment><comment><USER11> I use LVM and have enough storage that all SSD would be a little expensive so for the last few years I've been using the block caching LVM feature with mirrored NVME drives as a writeback cache to my large HDD array. It greatly increases the performance of the storage with little hassle.

If haven't played with gluster for a few years but it has a tiered storage feature so the most recently used files actually get moved onto the high speed storage medium, which depending on your workloads might be even better, assuming gluster is now performent and stable enough.

</comment><comment><USER12> I recently upgraded my laptop to a Thinkpad T470s, which supports M.2 NVMe, and M.2 Sata. I upgraded from a 500gb NVMe drive to a 1TB M.2 sata drive. Why do I say upgraded if it is slower? Well, in a laptop, power usage is hugely important, as is heat. To prevent throttling on the CPU, less heat is better. I did a lot of research, and found that the sata based M.2 drives consume less power, and generate less heat. For my purposes the sata speed is sufficient. :)

</comment><comment><USER13> FWIW, I believe Cray had an SSD option for the X-MP back in the early 80s.

<comment><USER14> From the brochure, it had a few million of 64-bit words worth of RAM that was used as regular RAM ("central memory") and a lot more of ECC DRAM that was used as fast storage ("SSD"). What was the API for the SSD? Was it mapped into virtual memory as RAM, or did the ISA have I/O in,out opcodes for it with word address, or did it use the API for disk storage, or what?

<comment><USER15> Even the Cray-1S supported it! I believe it was connected via a 128-bit wide bus operating at the system clock speed (80 MHz in the case of the Cray-1), which made it a ~10 gbit interface. From a low-level software perspective, it was connected to a pair of DMA "channels" (1 input / 1 output), and there were instructions to do bulk copies from SRAM->CHANNEL or CHANNEL->SRAM. It may have used another slower channel pair as a command interface, but I'm not sure (nor how COS or UNICOS exposed it from a higher level software perspective).

</comment></comment></comment><comment><USER2> Register latency is usually around 4ns (2.5-3.5 Ghz with a pipeline depth of 12-16). The article claims main memory latency is 7x more, which is around 24ns to 45ns. I tried to come up with plausible numbers that fix the 7x ratio they mention.

These days main memory latencies are more around 70-80ns (single sockets) and 80-100 ns (dual sockets).

Being off by so much does make me wonder about the accuracy of the rest of the article.

</comment><comment><USER16> Will the expression "spin up" ever fall out of usage?

<comment><USER17> Contrary to what others said, it will likely fall out of favor the way the floppy icon faded for "Save" functionality in GUIs. It's everywhere until one day you realize you can't find it in any of the apps you use every day.

<comment><USER18> Doing a quick survey of the apps on my machine, it seems like most have just forgone the button altogether. For those that still have the button, the floppy icon seems to still be there.

<comment><USER19> Yeah, purely from memory here but it's not that the save icon went out of fashion, but the concept of an icon bar or ribbon has gone; Microsoft's current UI standard for their native apps still has a ribbon IIRC, but I feel like that's one of the last vestiges. Using real world analogies went out the window after skeuomorphic design was no longer a thing too.

Oddly enough, for me I had trouble adjusting to the 'folder' icon (or referring to folders as folders), we grew up with the term "directory" and I never had an association with anything physical with that.</comment></comment></comment></comment>


SwiftUI Defaults Considered Harmful - <AUTHOR> https://tonsky.me/blog/swiftui/ <comment><USER2> This person has clearly not spent any time programming using SwiftUI.

<comment><USER3> Er... why do you say that?

<comment><USER2> Not one of his criticisms is based on any experience of how they have affected his usage of SwiftUI in practice.</comment></comment></comment>


Spotify-Git Commit Messages - <AUTHOR> https://github.com/primis/gitspot

<comment><AUTHOR> While writing some code, I often found myself listening to Spotify radio. This little script I wrote works with Spotify Linux Beta. It lets you commit your code with your currently playing spotify track as your commit message. Hopefully you'll enjoy it as much as I have!</comment>


Hacker News Instant Search - <AUTHOR> http://instantise.com/#hackernews <comment><USER3> While the new crop of "Instance [website] Search" projects are cool, I feel like most are missing the key feature of Google Instant: predictions. Without predictions, the user never knows what search returned the current results. Instead of instant search, these examples feel like instant filtering.

<comment><AUTHOR> The YouTube Instant implementation did have predictions, though I believe it was just a hack using Google's own API.

</comment></comment><comment><USER4> How about you collaborate with <http://searchyc.com> and use their index with this interface?

<comment><USER5> I'd love that. They'd need to significantly speed Search YC up for that to work though. A search that doesn't require hitting enter but takes 5 seconds to give results isn't very satisfying.

I really love Search YC, but it's _so_ slow. I wonder if we could do some kind of kickstarter campaign to get them better infrastructure (assuming better infrastructure would fix it without significant code optimizations). Or maybe someone could donate servers? Maybe lsc, since he runs a hosting company, though his margins are probably fairly low even without giving away hosting.

And even if it needs optimizations, if they OSSed it, I bet HN users could make that happen too.

<comment><USER6> It is slow sometimes, but their query logs would be useful for query suggestions. Query suggestions should be based on what searches are popular. Not sure if you want to go through the effort of making suggestions yourself though.

</comment></comment></comment><comment><USER7> No offense, but I'm slightly tired of Instant Search Blog'o'News!, etc. headlines.

</comment><comment> mike-cardwell Rather than wiping the results and re-inserting the new ones after each character is added it would look better if individual results were pulled out and inserted in the correct location. Some times the results don't change between key presses yet there is still a momentary flash where they're removed and re-added.

It would also be nice if it degraded gracefully for non-js browsers. Like Google search does.

<comment> mike-cardwell Also, you should try to force the browser vertical scroll bar to be on permanently. When typing using Firefox just now the scrollbar kept appearing and disappearing which made the position of various on screen elements jump from side to side as the viewport size changed.

</comment></comment><comment><USER8> This is awesome. I love seeing what people can build in a short period of time, and you know that this was just a couple of days.

Good job, Tam.

<comment><USER9> 6 Hours actually. :P Thanks for the kind words.

</comment></comment><comment><USER10> This is the best one yet - I can actually see myself using this. It's hard to know what terms people have used on HN when searching for something. The Ask HN archives are a brilliant resource.

<comment><USER11> I like the idea to, but querying searchyc.com for 'ask hn' ends up being much more effective. The concept is great, and I'm sure the execution will keep improving.

The thing I'm most impressed with is the awesome domain name.

</comment></comment><comment><USER12> It doesn't have predictions.

<comment><USER9> I'll be fixing that soon. Should be in within 24 hours.

</comment></comment><comment><USER13> Can I ask where did You get information on all HN submissions? Did You just scrape the web site for all IDs from 0 to 1683584 or so?

<comment><USER14> Have a look at the source code. He just uses Google search.

</comment></comment><comment><USER15> Nice. But, check that some results are repeated. For example, when searching for "android ", <http://news.ycombinator.com/item?id=1506909> and <http://news.ycombinator.com/item?id=1332153> are listed twice.

</comment><comment><USER16> I don't like how the results are refreshed ... it should load the results in a hidden div or something, then swap, and it should put a delta between refreshes ... I would have a second elapsed between 2 result sets displayed.

The indexer doesn't do a very good job, e.g. I searched for "mono" and only 4 results have been shown. Here's the Google index: <http://www.google.ro/search?q=mono+site:news.ycombinator.com>

Also, the address bar should be refreshed with the query searched because the URI has to be a permalink.

Otherwise, it's awesome.

</comment><comment><USER9> Hey guys, author here, thanks all for the kind words. It's nice to see it reaching the front page of HN when someone with decent karma submits it.

Just to let you all know I've only spent about 6 hours on this and plan to polish it up somewhat as it's still quite rough. I've also got a bunch of other developers requesting inclusion into the site swell, which I'll also add.

Things on the todo list are visual polish, adding other services, new menu, adding the suggest feature, perhaps changing from just using the google search to better apis etc.

Thanks for the feedback.

</comment><comment><USER17> Next step, grab a corpus of HN posts and do some text crunching to generate suggestions.

(or you could 'borrow' Feross' code, which is not condoned by Google - <USER2> on the Interwebs say Google Suggest's "API" is not for public use - and not specific to this domain.)

</comment><comment><USER18> Hi. I took two scripts and combined wich give fill-in words and to get direct results (still just 5) on the page with google instant. What do you guys think of the results? url = www.googled.eu

</comment><comment><USER9> <http://bit.ly/ddUj1E> <\-- if anyone finds analytics interesting, HN moved WAY more traffic than TC. A good section of the directs are HN too.

</comment><comment><USER19> My hat is off to you. It works in Opera and now I can get a glimpse of what Google Instant -- and other Instants that don't play nice with Opera -- is like. Thanks.

</comment><comment><USER20> Can you please do a body {height: 100%; margin-bottom: 1px;}

<comment><USER9> I tried this out on a test page, couldnt see a difference, whats it supposed to fix?

</comment></comment><comment><USER21> Cute idea, but it doesn't have predictions and the results are quite bad. Typing in "NoSQL" doesn't come up with the recent Heroku blog post about NoSQL.

</comment><comment><USER22> A new meme? Surprised that it took Google to do it before it got applied to several other sites.

Seems that Google is still pretty darn innovative and forward-thinking.

</comment><comment><USER23> My first impression before clicking the link was that this was using searchyc.com 's index.

I guess its based on a search-engine result after all.

</comment><comment><USER24> you should adjust it so searching for "lisp" does not end up with a chunk of code w/ multiple li tags in it as being more relevant than articles that actually have the word "lisp" in them. I noticed this with a few other phrases too such as "vegan" - there are multiple "vega" chip comments that take precedence over the fully matched word.

</comment><comment><USER25> Love it. Replacing the google search for HN (the search hyperlink at the bottom of this page), with this one would be nice.

</comment><comment><USER26> awesome! I liked the nice and clean UI. Even if the coder himself says it is ugly in his about page :)

</comment><comment><USER27> How come when I click on "reddit" in the top bar of Instantise, it takes me to Google in an iframe?

</comment><comment><USER9> Hey guys just added a bunch more services from other developers. Thanks to all.

</comment><comment><USER28> this is an amazing tool thank you. I would appreciate the presentation of the post date in the results page if possible. Thanks for your hard work.

</comment><comment><USER29> I get only 4 results for node.js

<comment><USER30> You get only 4 results for everything - i think that's the limit.

<comment><USER31> Good call. I thought it was broken only getting 4 results for python. I think this should be clearly stated somewhere on the webpage.

</comment></comment></comment><comment><USER32> this is amazing, the best search tool for HN. Very helpful.

</comment><comment><USER33> So, does the author now get a handsome six-figure job offer from Y Combinator via Twitter?

<comment><USER34> Unlikely. I know you're trying to make a joke but I'd see YC point him to one of their start-ups long before they'd hire him themselves.

And start-ups generally do not offer six figure salaries.

<comment><USER9> And i dont use twitter. :P

<comment><USER34> Good for you :)</comment></comment></comment></comment>


Ask HN: Is there a market for an API development company? - <AUTHOR>

Web Dev Shops (and Creative Agencies) are everywhere, but I am yet to see a company that focuses on developing APIs for clients. Sure, it is most often part of the development of a mobile app, but what about smallish companies that want to make their data (whatever it is) available more programmatically. For example, a large restaurant chain might want to make its menu more accessible; or a non-profit foundation may want to make its data more accessible. Thoughts? <comment><USER2> There probably is a market, but it's a lot smaller than building general web/mobile applications.

The kind of clients that want to build an API 1) already have a main product/website and 2) are likely more technical than average. It's probably something they could do themselves.

<comment><AUTHOR> You're probably right, the market is probably quite small right now. But! I feel as though that might be changing... and quite honestly, I feel like the clients may very well be both businesses that are established and want to have more of an omni-presence, but also the more technical ones.

</comment></comment><comment><USER3> I just got finished building one for a client and I'm getting ready to start another. So there's always a market if you solve the problem well.

Coincidentally, I'm looking for a python coder to work with on this next one. If anyone is interested in learning more, send me an email.

<comment><AUTHOR> Curious about how you approached that? Choose the tools based on what the client is using? Or, use the tools you are an expert in and deploy with those?

<comment><USER3> Both really. The client has a Django project that already had a REST interface for a handful of AJAX calls, and I have python expertise, so they hired me.

The project is using a Django extension called Piston: <https://bitbucket.org/jespern/django-piston/wiki/Home>

Which is really quite nice for building REST APIs with Django.

</comment></comment></comment><comment><USER4> Mashery (<http://mashery.com/>) has done this for Netflix, Rotten Tomatoes, and others. I think they're more about providing useful API access technologies than actually doing contract work to get things set up though.

<comment><AUTHOR> Thanks for the pointer. From what I can tell, it seems like you'd use Mashery if you were building an API for yourself, or for someone else? It seems to be more about the operations of the API that the strategy behind what methods the API should have. Right?

(From their company page, <http://mashery.com/company>: "We help brands... manage (their) API Powered Platforms..."

<comment><USER4> I'm not sure how much of each they do, though I'd imagine it's a bit of both, as obviously they're experienced in taking APIs public so they both have the tech to support it and the past knowledge of what users/developers want. Check out <http://developer.rottentomatoes.com/> to have a look (it says Masher Made at the top)

</comment></comment></comment><comment><USER5> If you're just thinking "a shop that develops APIs", that is the same as "a shop that writes code". You are not offering the client anything tangible they can identify. Unless you restrict your clients to software houses without the time or expertise to write their own APIs, the larger non-developer world of clients has no idea what you are offering.

I write APIs. I specialize in them, but for a specific purpose. I develop 3d animation technologies and then expose them via an API. I then license use of that API to 3rd parties, hosting the servers in both cloud and colocation. That is something tangible they can grasp. This is after spinning my wheels for a while trying to do what you seem to be thinking.

<comment><AUTHOR> Well, by your definition then, "a shop that develops APIs" is the same as "a shop that writes code" is the same as "a shop that makes websites" is the same as "a shop that makes apps". Come on now! Clearly, it would be a shop that writes code. And at that, a shop that's specialized at being excellent at figuring out APIs for clients. I don't think this would be geared towards software houses, or companies with their own dev teams, I think this might be geared towards aspiring businesses who don't necessarily want to be a dominant player in the market, but would rather be more accessible to its users.

It strikes me that quite possibly one of the next channels that businesses might want to exploit are having their data available programmatically. Which is why I'm wondering whether that's one of the next market opportunities.

</comment></comment><comment><USER6> There is a decent market.

While its not our core business, we host content APIS for some large publishers. Because we're ingesting their content anyway (content syndication is our main business) and we already have a robust API, we've productized it to provide APIs as a service back to our content providers.

I think content and ecommerce APIs are where you will see the most traction.

</comment><comment><USER7> Maybe <https://www.parse.com/> although that's more of an API-as-a-service.

</comment><comment><USER8> What value an "API-only company" would offer that a "web dev shop" wouldn't?

Following the same train of thought, why aren't there shops out there that ONLY do "web forms" (not talking about SaaS here), or webdesign agencies that only do "landing pages"?

</comment><comment><USER9> I suspect there could be a huge market if Apple allowed frameworks to be sold on the mac app store on a per seat basis - so framework developers would get some cut of each sale.

</comment><comment><USER10> There is at least a market for an API toolkit where you could choose an API model, security features, the DB to connect to, the language to use and the data model.

<comment><AUTHOR> Sounds like what Mashery does mentioned in the thread.

<comment><USER10> I don't think so (based on what I read). They want to manage your APIs and add functionalities that you're missing, like the extra layers of security. They don't provide you with a way to build your API to publish your data.

</comment></comment></comment><comment><USER11> Another one I came across was mashape.com "A place to easily discover, manage and hack badass APIs". Few examples: NLTK, sentiment analysis, DuckDuckGo.</comment>


Ask HN: Who gets VPN access at your company? - <AUTHOR>

At my current company, VPN access is very hard to get. You have to ask your manager, and fill out a form, and he has to approve it, and then pass the request to systems etc etc. As a result hardly anyone has it.<p>How widespread is VPN access at your company? Does everyone get it, or only a select few? Also what is the size of your company? Mine is around 400 people. <comment><USER2> Pretty much anyone who uses a computer at my workplace has VPN access. No special approval is required. The same ID that gives you access to local network resources (printers, file servers, intranet sites, etc.) gets you on the VPN. The company has several hundred employees, and the VPN can support hundreds of users.

Aside from people whose jobs require a lot of travel (sales, etc.), only a few people work remotely on a regular basis, and some others work remotely a few days a month. But having the infrastructure to have many employees work remotely gives us the ability to keep the business going if there are transportation disruptions like blizzards, hurricanes or transit strikes.

</comment><comment><USER3> At my last job (ClearChannel, now iHeartMedia), it took a form and approvals from my manager and several department heads including IT and HR. There were 10,000+ employees there. At my current job, we've grown from 7 to 35 since I've been here, and everyone has a VPN login, but few people use it.

</comment><comment><USER4> There's about 20 of us in the office, and maybe 5 or so that have VPN access. If you don't need it, you dont get it.

Conversely, I used to work for a big red o, and everyone had VPN, with access cards etc.

Depends on the job/environment. Usually if you need it, you'll be granted it.</comment>


Ask HN: How do I respond to an offer to buy our iPhone app's IP? - <AUTHOR>

Long time reader, first time posting.
I'm the head of IT for a small internet company that has developed a free iPhone app that promotes the use of our product. Due to time constraints, we haven't done anything with it for almost a year, but it still manages 200-300 downloads a week. We in the middle of revamping our entire retail operation, and have envisioned several ways to tightly integrate the app with our shopping experience, though this probably wouldn't happen for another 6-9 months.
Recently, however, a large company in the same product space (not so much a competitor as a co-existor) has approached us about either buying our app or partnering with us in some way, and we're really not sure how to respond.
We've spent considerable amount of money as well as months of our own time in developing the app, so selling is definitely appealing. While I've always thought licensing was better in the long run, we aren't sure what the advantage is for us - we don't have the time to actively develop, and the rebranded app wouldn't drive any traffic to our business.
We also have some brick and mortar retail partners that has expressed low level interest as using our app as a sort of in-store kiosk (which most likely would drive traffic to us), but that's something we haven't even begun to explore either.
I could see us "leasing" the app, where we maintain it for a certain length of time and the other company pays rebranding, our time, and further development. At the end of the lease, we'd have made some money and would also have a better app. I'm not sure if this is feasible, however, because they certain have in house IT resources that I imagine are at least as capable as I am.
My questions, then: What are the pros and cons of selling and licensing? Are there other partnership opportunities that we should explore? Any tips for questions we should be asking ourselves and our suitors?
Thanks. <comment><USER2> Unless you can get an insanely large price, licensing seems to make more sense since you won't lose control of the app. You can relicense, including to those brick and mortar stores, and possibility hold out for a larger sum after initial success.

I would need to know more about your business to see how it fit your larger strategy, but turning internal tools into the core of the business has been a successful pivot point for others. The prime example the comes to mind is 37signals that went from a web-dev consultancy house to making productivity apps.

<comment><AUTHOR> Thanks for the response. Would licensing play out like the "lease" (maybe that's poor wording) I describe? We do have attorneys that would look over any agreements, but we need to know what option we're pursuing first.

As far as our business plan, we've been successfully growing in ecommerce for years, and our retail staff outnumber our IT staff by a large margin. It's funny that you mention pivoting though - we've also been in talks with other small business about providing tech support or web design services. While I don't see us intentionally pivoting, we possibly could continue to organically grow out IT services.

</comment></comment><comment><USER3> Are you familiar with <https://www.apptopia.com/>? The site helps facilitate small scale mobile app acquisitions through our marketplace. Full disclosure- I just joined them team at Apptopia, but our company can provide you with legal protection, security, escrow services, and a transfer specialist if you do decide to go through with the process.

As a side note, we also specialize in app valuation, so no matter what you decide to do I can help you understand how much your app is really worth if you shoot me a quick email with any stats.

In response to your last question, my advice would be to ask yourself how serious you are about integrating the app with your shopping experience. You should assess your future goals relative to mobile and reevaluate once you have an accurate valuation of your app.</comment>


Reducing bad signup emails with mailcheck.js - <AUTHOR> http://andrewberls.com/blog/post/13

<comment><USER2> I was hoping that this did something a bit more worthy of Hacker News, like checking if the A Record exists. Or perhaps speaking SMTP to the domain in question to query if the user actually exists (works on some domains) using web sockets.

[http://www.webdigi.co.uk/blog/2009/how-to-check-if-an- email-...](http://www.webdigi.co.uk/blog/2009/how-to-check-if-an-email- address-exists-without-sending-an-email/)

Maybe I'll build it for fun.

<comment><USER3> Why use the A record, rather than MX?

<comment><USER4> Strictly, you might need to check for _both_. If there are no MX records, mail will be delivered to the @ A record for a domain (e.g. mail to email@example.com will go to the IP for 'example.com').

So if there are no MX records, you need to check @'s A record as well (or vice versa, since not all domains have A records either).

</comment></comment></comment><comment><USER5> Thanks for the excellent write up, Andrew. Glad to see that Mailcheck's working well for you! I'll post up your post on our Github readme in a bit.

As a side note, I'll be releasing version 1.1 shortly, which has a bunch of improvements, including the option to use keyboard-distance based string matching. Look out for it!

<comment><USER6> Why is this better than having users enter their email twice and just confirming they match?

I realize entering email twice might be slightly sub-optimal from a user perspective but if you as a user want a service, it seems like entering one's email twice is not a lot to ask or a major source of friction. Or is it?

Not trolling. Genuine question. We do the type your email address twice on our site so wanted to understand if there any clear benefits of this approach.

<comment><USER7> email@example.com

email@example.com

When people don't even know their email address from a URL or a Twitter handle they're bound to get it wrong exactly the same way.

Plus, confirming an email address is absurd. Why not confirm every other field on the form if you're such a stickler about accuracy?

<comment><USER8> The e-mail address is more important than other fields both because it can be used to verify identity and because it allows a website to send marketing e-mails (which is often the purpose of getting people to sign up.)

<comment><USER7> My address is particularly important when a package is being shipped, but I can't recall ever being asked to type it in twice in a row.

<comment><USER9> Then again, you can do _a lot_ of mistakes when typing your shipping address and it will still get through. It is also easier to spot mistakes since a shipping address contain regular words which isn't as common with email addresses.

One char wrong and your email is completely worthless, and with it your only real link with the service is cut off - often with no way of fixing it.

</comment></comment></comment></comment></comment></comment><comment><USER10> The source is at <https://github.com/kicksend/mailcheck> if you want to check it out.

</comment><comment><USER11> Very cool! Far far better than getting people to enter their email address twice which is a terrible solution to a problem in my opinion.

<comment><USER12> Can you expand on why you feel double entry is a bad solution? I agree having to re-enter data isn't preferable, but it seems that a solution like this isn't perfect either; the user can still enter their address incorrectly quite easily without it being caught. It seems like double entry would catch more mistakes than this (not to dismiss this in any way as I really like it).

<comment><USER13> I'd be surprised if many users type it twice. I always copy from the first to the second and wonder why the form designer has bothered.

</comment></comment></comment><comment><USER14> Random thought: what if you gave users a unique code that they had to email back to the server to identify themselves.

<comment><USER15> It'd probably be quite a barrier to signup, although I guess a 'mailto:email@example.com?subject=signup-for-$uniqid' link might solve some of the hassle.

The major issue I can see with it is that many people might like to use a email alias to signup (I prefer to use shabble+servicename@ for services which aren't too broken to accept a +) which isn't the same as their configured sender.

</comment></comment><comment><USER16> This is awesome. Thanks!</comment>


Researchers Confront an Epidemic of Loneliness - <AUTHOR> http://www.nytimes.com/2016/09/06/health/lonliness-aging-health-effects.html <comment><USER3> I have a feeling that this is all related to the entry of women into the workplace. Don't get me wrong; patriarchy is oppression and it has to go- but I think there were a lot of jobs being done by women which are now being done by nobody, and among those are the jobs of maintaining social cohesion and networking and so forth, which are a lot easier to do if you and your friends are somewhere other than at work at the same time. But if you and your neighbors are not consistently at home and have free time at the same time, how would you get to know them? Also, if the jobs of doing housework and cooking now has to be done after work hours, when is there time to join a bowling league? We are all in debt up to the eyeballs and working too much - the loss of social cohesion is hardly surprising. I mean, patriarchy is a system that has been in place for literally thousands of years, until this generation. And we have nothing to replace it with. What really should be happening is that a) in households with two working people, the total combined hours worked by both should not exceed 40 hours and b) there should be some consistency to when those hours are, so that you and your friends can be home at the same time. If that doesn't happen, then we are going to start looking like Japan - sky high suicide rate, plunging birth rate.. Again, I'm not arguing that sexism or patriarchy was ever a good thing, I'm just saying that our current system of labor might not be sustainable now that it's going away.

<comment><USER4> Except for the fact that Japan actually has a very low rate of workplace participation for women, I agree with your comment.

Feminists actually talk about this a lot, using the term "emotional labor"[0]

It is a bit like how the decline of religiosity in the US has led to a decline in social participation. It's clear to me, at least, that whatever your opinion on these institutions (religion, patriarchy) there needs to be a movement to fix the void in civil society created by their decline.

I think about when I visited the Middle East and how I would often see men on "friend dates", i.e. having a coffee together or relaxing in the park. They would often be sitting close, even holding hands. It made me think about the strange distance men in the US have from each other and how lonely it is.

[0][https://www.theguardian.com/world/2015/nov/08/women- gender-r...](https://www.theguardian.com/world/2015/nov/08/women-gender-roles- sexism-emotional-labor-feminism)

<comment><USER5> Maybe it's just better to go on a date with someone you can see.

</comment></comment></comment><comment><USER6> I'm pretty lonely. After years of moving around and making lots of 'disposable friends' \- mostly work friends, I eventually settled in the burbs. The conversations out here are limited to the most superficial things: kids, weather, new restaurants, landscaping companies, etc. But, since most of us came from different places, took very different paths, there's huge cultural differences to overcome. And, there's almost no overlap in interests - <USER2> nothing to gather around.

Also, being a male seems to make it much more difficult - many of us are raised to be self-reliant, independent, reserved and undaunted. It's a sign of weakness for us to admit to loneliness. Plus, many are by biology competitive and view the other males as potential threats. Lots of the guys I meet are wearing masks, holding their cards close, sizing each other up, and trying to one-up the others. When I go to the coffee shops and see all the men sitting alone, it's depressing.

<comment><USER7> I live a life apart and I've extremely happy. Find something besides social interactions to give your life meaning. Find small ways to be kind and compassionate in the rare interactions you do have. Do things that put you near other people, even if you don't necessarily interact.

Don't think that your life is wanting because you don't socialize. If you strip away the veneers of culture, socialization is just a way to find identity, meaning and pass time. You can do all that on your own terms, and some of the wisest people in history have purposefully separated themselves to do just that.

<comment><USER8> For most, loneliness is not a choice, so whatever you just said is meaningless and will not work. It is not identity they are looking for, but actual socialisation. Most people are hardwired that way.

Being separated sometimes gives perspective, but... How many of those men were actually happy? If it's almost a cliché.

<comment><USER7> Loneliness is a consequence of your beliefs. If you believe that your beliefs cannot be changed, then you certainly won't be able to change. Why you would want to stay unhappy is beyond me, though.

I can tell you from my personal experience, I was lonely in the past, I'm not lonely anymore, and if anything I've become more isolated over time. My total interaction time with other people is on the order of about 2 hours a week. I'm crazy happy, I literally love my life and am excited for every new day. The difference is in my beliefs.

</comment></comment></comment></comment><comment><USER9> 1) I grew up a solitary person in what felt like the middle of nowhere and have always been force-fed that 'humans are social creatures' adage when people can't understand when I say I am not lonely. With the internet and improvements to independent-agency, I think we're beginning to see how anti- social humans really are. Existing alone, I do feel bored once in a while... but not lonely.

2) I believe many-if-not-most people surround themselves with others in order to improve their feelings about themselves. For instance many people jump from one relationship to another and as a result they never spend time with themselves, so they never learn who they are. I imagine that these people really do feel a crippling sense of loneliness... because it's the well they've been pulling self-worth from for their entire lives.

3) The article references how men are unlikely to call into a phone line for a sense of community and theorizes that it is likely because they're shouldering the burden. More likely that it's because talking to a complete stranger and asking about each other's day is superficial and/or vain. The wood shop is a much better/cooler idea... as learning a new hobby is a good way to get with new people.

</comment><comment><USER10> The book "The Lonely American: Drifting Apart in the Twenty-first Century" by Jacqueline Olds explores this topic at length. I recommend it to anyone interested in a thorough (and at times, heart-wrenching) treatment of the topic.

</comment><comment><USER11> Genuinely curious, is there a scientific definition of loneliness, and what parameters does it involve, since it's hardly black or white?

</comment><comment><USER12> A national study released this year showed Sixty-five to 79 is the happiest age group for adults in the UK. Though this declined in the over-80s.

So what happens around the age of 80?

[http://www.bbc.co.uk/news/uk-35471624](http://www.bbc.co.uk/news/uk-35471624)

<comment><USER13> your friends start to die?

</comment></comment><comment><USER14> I used to be lonely\empty before deciding to follow Christ. I tried and did just about anything and everything to fill this void and nothing lasted. Giving my life over to Him literally changed my life. I'm convinced that we are all created to be in a relationship with Him and until we are we will constantly search for other ways to fill that void.

<comment><USER7> We all need to find meaning for our existence. I'm pleased that you've found one that makes you happy. Please consider that meaning is personal, and don't proselytize your way as a privileged one that should apply to all people. Take a moment when you make statements of that sort and ask yourself what your true motivations are.

<comment><USER14> Some people are lonely and looking for help. I've been there and this decision was the best thing that ever happened to me. I've seen it work for countless others. My motivation is simply to help others.

<comment><USER7> I appreciate that you want to help other people, but when you make blanket statements like that, it implies other meanings people have found are somehow inferior.

Through Jesus you gained a feeling that you are loved, that you exist as part of something larger than yourself, and your life has purpose. Those ultimate results are what you should be trying to lead people to. There's nothing wrong with sharing how the teachings of Jesus lead you there. Think of it this way - there are many paths to a destination, which one you should take depends on where you are starting your journey.

</comment></comment></comment></comment><comment><USER15> Article focuses on senior citizens. But loneliness is far from only senior people problem. More and more young and middle age men and women are lonely in western world. Maybe this will be a step towards trying to do something about young people loneliness too, as lonely young people have even worse impact on society than lonely old people.

<comment><USER16> Young people can walk and drive longer distances, and so normally have less reason to remain lonely, I would guess.

Do lonely young people continue to be lonely mainly because they don't know how to initiate social interaction? Or because they don't realize that companionship is what they need?

<comment><USER17> > companionship is what they need

I'm 40ish and married right now, but throughout my life I've alternated between being solitary and living with people. My take on it is that both are psychologically stressful in different ways. I've wondered once or twice whether it would be better to have some kind of drug or therapy that helps a person be content with being alone rather than assuming that companionship is going to be a magic bullet for everyone.

<comment><USER7> Part of the problem is that our culture strongly encourages social contribution and development of identity via social mechanisms. We stigmatize non-contribution and individual identity using labels like crazy, weirdo, freak and degenerate.

Isolating non-conformists wouldn't need medication and therapy if people respected them in the first place.

<comment><USER18> Yeah, that stigma seems to be a relatively recent phenomenon. Reading something like Dickens there's far more tolerance of eccentricity on many axes. (That might be just Dickens himself, of course, but I doubt it.)

</comment></comment></comment></comment></comment><comment><USER19> the TV consensus has been breached. Now suffer the existential pain!

<comment><USER20> What is "the TV consensus?" Google does not turn up anything useful for this term.

<comment><USER21> Perhaps they meant the idealized dollhouse of mutual buddies seen in various shows and sitcoms?

It's hard to make weekly shows about lonely people with only one permanent cast member...</comment></comment></comment>


Group hug of 420 developers at European Rails Conference Railsberry - <AUTHOR> http://vimeo.com/40734575 In other words - Happy Friday by @tenderlove ;) <comment><USER2> WTF this has to hackers? I've tried to search any sane video from this event but found only short pieces with baloons and unicorns.

I know having fun is important but tech event without tech isn't tech event

<comment><AUTHOR> Hey, good point Lucky Gambler...but oh God are we working on it ;) There will be tons of "tech" content from Railsberry, it just took place a few day ago!

<comment><USER3> So, there wasn't time for preparing some video summary of speakers and what they talk about... but there was enough time for making 2 or more videos about songs, piano perf and well, baloons.

It's clear what was more important to organizers. Certainly not Rails :)

</comment></comment></comment><comment><USER4> That was soooo amazing!

</comment><comment><USER5> Awesome <3

</comment><comment><USER6> Awesome :-)</comment>


Ransomware Decryptor - <AUTHOR> https://noransom.kaspersky.com/

<comment><USER2> As a Dutch person, I was confused about the Dutch police logo there (Politie is Police in Dutch). Scrolled to the bottom to find affiliation or anything... turns out it's right there in the first line.

I'm very pleasantly surprised to see our police doing something good! It's the first time I've heard the Dutch digital police actually achieving anything, and that is not exaggerated. Last time we provided an IP address involved in a hack (the IP was from the same town as the company that got hacked, so it wasn't masked), we never heard anything back, even though we know they have the CIOT database with all Dutch IP addresses mapping to names and addresses. But that was 2 years ago and there have been a lot of activities in training policemen for digital investigations.

Although it's not entirely clear what exactly their involvement was, this is nice!

<comment><USER3> That's not uncommon, unfortunately. I've off-and-on bothered to notify various entities about bad behavior for the last 15 years or so. In most cases, it goes completely ignored. Most recently, on April 2, I notified Rackspace's abuse department that they were hosting a major fraud/scam site (websitebackup.com, they send out fraudulent invoices and wait for non-tech- savvy customers to send payment) and never heard back. Rackspace is still hosting them.

It's just one of those facts of life: nobody really cares, not until they're directly affected by it somehow.

<comment><USER2> Hold on, Rackspace is not police. You have no legal right to demand that they cease to host anything and they have no legal obligation to look into anything sent to that email address. The company that got hacked and reported it to the police did: someone violated the law, we provided IP addresses and access logs to make it a clear and simple case, and then they didn't even look into it.

<comment><USER3> Yes, and that's not uncommon, whether police or state agency or otherwise.

<comment><USER4> Just to be crispy clear, did you report the incident to the police or to some other state agency as well? Or only to Rackspace?

<comment><USER3> Naw, that one just went to Rackspace. In the interests of clarity, I have also reported a thing here and there to local law enforcement over the years, but the experience was completely the same.

</comment></comment></comment></comment></comment></comment><comment><USER5> Keep in mind that this only works for people infected with CoinVault, and Kaspersky didn't get all the keys. The title is misleading here. Still, if you are infected by CoinVault or know somebody who is, this is a great thing to try.

</comment><comment><USER6> In the manual[0] they have "Remove CoinVault" as a step to do before you check whether the Kaspersky site has the key that will decrypt your files.

People probably want to keep CoinVault around in case the key isn't known and they want to pay the ransom.

[0] [https://noransom.kaspersky.com/static/convault-decrypt- manua...](https://noransom.kaspersky.com/static/convault-decrypt-manual.pdf)

<comment><USER7> Don't know about Coinvault specifically, but others give you a program along with the key if you pay.

Besides, you can always use Kaspersky's tool with a paid for key.

</comment></comment><comment><USER8> Key distribution is a problem even for ransomware. It looks like the decryption key is a function of the Bitcoin address to which ransom is sent. That should eliminate the need for a server controlled by the ransomware people to return keys.

What does "check payment and receive keys" really do? Does it check the Bitcoin block chain to see if payment has been made, then calculate the decryption key? Is this entirely blockchain-based?

<comment><USER9> I'm guessing that when a cyber criminal is caught they add all retrieved private keys to the police's keychain. Even a symmetrically signed key (passworded) can be brute forced or the arrested can be court compelled to decrypt the key.

<comment><USER10> AES cannot be trivially brute forced. The key phrase is also unlikely to be trivial because the convenience has no value.

<comment><USER11> I don't understand, perhaps I'm misunderstanding the situation.

GP is saying that if the [private] key is password protected, it can be brute forced. Surely if a human is able to type in the password to the private key, you can bute force that password relatively easily?

<comment><USER10> With cooperation, yes, without it, no. A password doesn't need to be too long to grow the key space to large enough all the computers in the world couldn't scratch the surface.

Of course, there are many other factors that can significantly decrease or break the security of AES.

TL;DR xkcd.com/538

</comment></comment></comment></comment></comment><comment><USER7> For how they built it, see [https://securelist.com/blog/69595/challenging- coinvault-its-...](https://securelist.com/blog/69595/challenging-coinvault- its-time-to-free-those-files/)

<comment><USER12> That link does not explain how they're managing to obtain the correct key from the server without paying money.

So they were able to dump a memory segment into a hex editor, and locate references to RijndaelManaged. So what?

In the screenshot, I still see:

      Server.GetKey().Key

So how did they convince the malicious server to cough up the token for free?

<comment><USER13> The article states they "...obtained a database from a CoinVault command & control server (containing IVs, Keys and private Bitcoin wallets)."

Reading between the lines, the police located the server, served a subpoena to the hosting company, and took possession of the server. They then turned it over to Kaspersky who created the site based on the keys on that server.

The screen dumps are just showing how they figured out the decryption routine - the private key alone doesn't do you much good if you don't know the algorithm used.

</comment></comment></comment><comment><USER14> The best Ransomeware Decryptor is the backup you took last night. Which reminds me ... :-)

<comment><USER15> Why assume that no-one who ever got caught by ransomware had any backups? As far as I know, the way most ransomware works is that it not only encrypts your entire drive, but also any network drives it has access to, any external drives, and so on. It's quite possible someone with a backup regiment was still affected because they left a link to their backup system open, encrypting that as well. I think most people mainly care about backups being off-site, not them being "de-linked" and unaccessible.

<comment><USER16> > _I think most people mainly care about backups being off-site, not them > being "de-linked" and unaccessible._

Then they don't understand backups - what's the use of backups if _rm -rf /_ erases them as well because they're permanently mounted at /srv/backup?

</comment></comment></comment><comment><USER17> >During our joint investigation we have been able to obtain data that can help you to decrypt the files being held hostage on your PC.

Obtain data? How? :)

<comment><USER7> [http://www.pcworld.com/article/2909292/files-encrypted-by- co...](http://www.pcworld.com/article/2909292/files-encrypted-by-coinvault- ransomware-new-free-tool-may-decrypt-them.html)

>The National High Tech Crime Unit (NHTCU) of the Dutch police recently obtained a database from a CoinVault command-and-control server containing decryption keys, the Dutch police said in a news release. The information obtained from that database allowed Kaspersky to build a decryption tool.

<comment><USER15> >a CoinVault command-and-control server

So, is there anything stopping them from setting up new servers with new keys and starting the goose chase all over again?

<comment><USER7> No. In fact, this already happened before, see [https://www.decryptcryptolocker.com/](https://www.decryptcryptolocker.com/).

It helps some people already infected.

</comment></comment></comment></comment><comment><USER18> This originally hit the news 10 days ago: [http://techwatching.com/page/there- s-finally-a-tool-to-free-...](http://techwatching.com/page/there-s-finally-a- tool-to-free-you-from-the-ransomware-holding-your-pc-hostage)

<comment><AUTHOR> Yeah, somehow no one on HN upvoted the stories, previously posted, about it. And, for once, I am glad I didn't do my usual search before posting. Otherwise this is a tool that wouldn't have had much exposure among the HN crowd. But this is a different topic altogether. ;)

</comment></comment><comment><USER19> I would suspect that the keys would be different for each infection. But then considering this is software made by criminals, I would not expect even the most sensible or trivial of features and security precautions would be implemented.

<comment><USER13> > I would suspect that the keys would be different for each infection.

They are. CryptoLocker[1], which CoinVault is _loosely_ based on, used per infection keys, and the warnings on the Kaspersky site make it clear they don't believe they got all the keys, which would mean there's more than a few keys.

[1] [http://en.wikipedia.org/wiki/CryptoLocker](http://en.wikipedia.org/wiki/CryptoLocker)

> But then considering this is software made by criminals, I would not expect > even the most sensible or trivial of features and security precautions would > be implemented.

I'd advise against underestimating your enemy in this global age. These aren't petty thieves akin to digital purse snatchers, working haphazardly, but the work of a few motivated individuals, likely with ties to organized crime.

<comment><USER20> In my experience, most malware creators are pretty terrible. Even in 2015 it's common for malware to communicate with C&C servers that have classic SQL injection vulnerabilities.

More specifically on the topic of ransomware, have a look at this gem [1], which uses RSA, but the key is 128 ASCII digits. Very similar to the cryptocat disaster. [2]

[1] [http://blog.cassidiancybersecurity.com/post/2014/02/Bitcrypt...](http://blog.cassidiancybersecurity.com/post/2014/02/Bitcrypt- broken)

[2] [http://tobtu.com/decryptocat.php](http://tobtu.com/decryptocat.php)

<comment><USER7> There's also cryptodefense, which generated the keys locally. (See [https://archive.is/1AGHG](https://archive.is/1AGHG), original source doesn't load for me.)

</comment></comment></comment></comment><comment><USER21> The title appears to have a typo: ransomEware.</comment>