Trump Is First to Use Patriot Act to Detain a Man Forever - <AUTHOR> https://www.thedailybeast.com/trump-invokes-patriot-act-to-detain-palestinian-adham-amin-hassoun-forever <comment><USER2> Then wtf was/is Gitmo? This is terrible, but hardly the first except by claiming this particular provision. Beforehand, not even that level of accountability was reached. We knew the powers of the Patriot act went beyond the balance, but have not pushed back. It seems odd to now blame the user of that power, rather than those who errantly put that power in the presidents hands to begin with.

I would posit that the Patriot act is a bigger threat than any single politician, because while electees change, the law still stands, always repugnant in its nature.

<comment><USER3> No one at Gitmo was a US resident. Its use to hold PoWs and others picked in foreign war zones was arguably a violation of the Geneva Conventions, but that is a somewhat different problem, at least from a legal perspective.

</comment></comment><comment><AUTHOR> More background on his Wikipedia page: [https://en.wikipedia.org/wiki/Adham_Hassoun](https://en.wikipedia.org/wiki/Adham_Hassoun)</comment>


Ask HN: Alternative browser to chrome that have good zoom support? - <AUTHOR> I try to switch browser to Firefox, and suddenly discover that Firefox & Safari can't have a global zoom for all pages. I try the recomended extension for firefox (NoSquint Plus) and it can't stick to the global configuration I set.<p>I'm on OSX Sierra. <comment><USER2> Open up Firefox and type 'about:config' into the urlbar. Accept the warning it gives you, then type 'layout.css.devPixelsPerPx' into the config page's search box. Double click on the devPixelsPerPx preference, and type in a value such as 1.5 or 2, then click OK. Now the whole browser will be zoomed by that factor.

</comment><comment><USER3> Vivaldi Browser has a zoom bar in the main interface which is pretty nifty: [http://prntscr.com/ktea6k](http://prntscr.com/ktea6k)

They do use the same chromium engine as Chrome if that is an issue for you.</comment>


Show HN: Gophr – London's smarter, fairer, faster courier service - <AUTHOR> https://uk.gophr.com <comment><AUTHOR> Hey guys, thought Gophr might be relevant to some of the London-based HN users. The industry has had a massive issue with fair wages, including protests inside the Google campus in London - We jut became the first courier company in the UK to pay a London Living Wage, guaranteed and accredited by the living wage foundation. We wrote a bit more about this here:

[https://medium.com/@SebRobert/trying-to-fix-a-broken- industr...](https://medium.com/@SebRobert/trying-to-fix-a-broken-industry-is- hard-here-s-what-we-ve-learned-c897ca09daf2#.ehdrtmybf)

Happy to give out free credit to anyone who wants to take us for a whirl, let me know!

<comment><USER2> What? Is there a "Living Wage Foundation" that says you better not hire anyone than to hire someone paying less than what they call a living wage?</comment></comment>


Time Warner rejects Fox takeover bid - <AUTHOR> http://www.bbc.com/news/business-28327604

<comment><USER2> It's worth remembering that Time Warner is much smaller than it used to be – it has sold off or spun off AOL, Warner Music, Warner Books, TWC, and even Time Inc. in the past few yesrs.

Even then, the size and scope of a combined Fox / Time Warner in the movie/TV market alone would be ludicrous. Even if Fox sold off CNN as they're proposing, they'd own two of the six major movie studios, the Fox broadcast network, HBO, many of the top-rated cable channels (Fox News, FX, TBS, TNT, Cartoon Network / Adult Swim), and plenty of other stuff, and that's just in the U.S.

And of course, Murdoch also still controls the nominally-separate (newspapers- only) "new" News Corp, which is said to be stalking the Tribune group (Chicago Tribune, LA Times, etc.): [http://www.poynter.org/latest-news/business- news/the-biz-blo...](http://www.poynter.org/latest-news/business-news/the-biz- blog/257613/news-corp-rumored-to-be-putting-together-a-new-bid-for-tribune- newspapers/)

</comment><comment><USER3> Wait, I thought Time Warner was already purchased by Comcast. See: [http://money.cnn.com/2014/02/13/technology/comcast-time- warn...](http://money.cnn.com/2014/02/13/technology/comcast-time-warner-cable- deal/index.html)

<comment><USER2> Time Warner Cable was spun off from Time Warner in 2009. What happens with one does not affect the other in any way.

</comment></comment><comment><USER4> "Time Warner's share price jumped some 16.35% higher in the first 20 minutes of trade on the New Stock Exchange to $82.62 per share." Bwahaha. Does this show how happy investors are that TW rejected the offer? :-)

</comment><comment><USER5> I wonder how much of the 16% jump in Time Warner's stock is the willingness of Time Warner to sell CNN.</comment>


Monthly Book Subscription for Entrepreneurs and Techies - <AUTHOR> http://www.startuplit.com/ <comment><AUTHOR> I'm so excited to announce StartupLit, an affordable monthly non-fiction book subscription for entrepreneurs and startup-ers. We're currently building out our platform, so looking forward to your suggestions/feedback.</comment>


Notes from the Unashamed - <AUTHOR> http://sunsetgun.typepad.com/sunsetgun/2016/05/i-am-not-ashamed-barbara-payton.html <comment><AUTHOR> If you want to learn more about the life of Barbara Payton, the brilliant Hollywood history podcast _You Must Remember This_ did an episode on her last year: [http://www.youmustrememberthispodcast.com/episodes/2017/4/3/...](http://www.youmustrememberthispodcast.com/episodes/2017/4/3/barbara- payton-dead-blondes-episode-10)

</comment><comment><USER2> That's an excellent writeup.

The site seems to be devoted to old Hollywood, and has long, deep analyses of films and the people involved in them.

So good to see long-form content that's written for no reason other than a passion for the subject.</comment>


Gitlab phished its own work-from-home staff, and 1 in 5 fell for it - <AUTHOR> https://www.theregister.co.uk/2020/05/21/gitlab_phishing_pentest/ <comment><USER3> It's important to note the nature of the failure.

Opening a phishing email should not be considered a failure. The email client is specifically designed to be able to display untrusted mail.

Even clicking a hyperlink in a phishing email isn't too bad - web browsers are designed to be able to load untrusted content from the internet safely.

It's only entering credentials by hand into a phishing website, or downloading and executing something from a phishing site that is a _real_ failure.

IT departments should probably enforce single sign on and use a password alert to prevent a password being typed into a webpage. They should also prevent downloads of executable files from non-whitelisted origins for most staff.

<comment><USER4> > The email client is specifically designed to be able to display untrusted > mail.

Email clients often do things like load images, which can tell the sender you've read the email, which is an information leak.

Some email clients try not to do this, but that's actually somewhat recent, and I wouldn't say they're 'specifically designed to be able to display untrusted mail', rather 'they try to avoid common exploits when they become known'.

<comment><USER5> What can be done with this information?

Most companies have e-mail addresses that are completely predictable, so you can pretty much assume that this e-mail address exists. If this really was a security risk shouldn't you have UUID emails for everyone?

Also how do you as an attacker know that it was user not a e-mail server checking those images?

<comment><USER4> > What can be done with this information?

It will reveal if they're working right now, what time they work otherwise, their IP address, their approximate physical location, their internet provider. A lot you can do with that.

> Most companies have e-mail addresses that are completely predictable

That's the point. Predict an email address, send it, find out if such a person works there.

If I email firstname.lastname@example.com and they open it then guess what I've worked out?

> Also how do you as an attacker know that it was user not a e-mail server > checking those images?

Agent signatures.

<comment><USER6> >> Also how do you as an attacker know that it was user not a e-mail server checking those images?

> Agent signatures.

Can you Expand? Googling isn't helping me understand what this means/how it works.

<comment><USER4> Also called agent fingerprinting. You can look at exactly how the agent is responding and make educated guesses at what agent it is. You think one HTTP request looks like any other, but there's enough little bits of information here and there to leak info.

The user agent is the simplest example. That can be spoofed, but there's more subtle traces as well, all the way down the stack [https://en.wikipedia.org/wiki/TCP/IP_stack_fingerprinting](https://en.wikipedia.org/wiki/TCP/IP_stack_fingerprinting).

<comment><USER6> Thanks!

</comment></comment></comment></comment></comment></comment></comment><comment><USER7> I'm a web developer with a focus on security and _I_ nearly got phished multiple times. Once was a legitimate-looking email from Linode, which I opened and was fooled by (I didn't check the domain because I trusted my spam filter too much to consider that it might be fake), I was saved by my password manager not auto-filling the credentials because the domain didn't match, which made me look and see that I was on the wrong domain.

The second time, someone was about to steal $30k worth of cryptocurrency from me with a very convincing page on śtellar.org, where I nearly entered my wallet seed (did you notice the accent over the s? I didn't), and was saved by the fact that I keep my cryptocurrency in a hardware wallet, so I had no seed to enter.

Both times, what saved me from being phished wasn't that I'm trained or that I'm more observant (which my parents have no hope of ever being), but that I had used best practices so I didn't _have_ to rely on being trained or observant.

I'm hoping WebAuthn takes off, which will really kill phishing for good, but you can take steps now: Use hardware U2F keys as second factors, use a password manager, don't use SMS auth. Make long, random passwords, etc.

<comment><USER8> Two years ago I was fooled by "colnbase.com" (L instead of i) to the point that I was annoyed that 1Password "wasn't working". Of course, 1Password didn't have a uname/password for a phishing site. I almost opened it to copy the password in manually when I spotted the L. It's sobering.

As for WebAuthn and U2F, unfortunately they chose every trade-off possible away from practical usability. They're doomed. Go look up the impl/ux flow for WebAuthn right now for example.

We need less of that and more good ideas that people would actually implement and use.

<comment><USER7> Really? What do you think is impractical about it? I just tap my USB key and I'm logged in.

Hell, it even supports a mode where you don't have to have a username or password at all (e.g. log in and try adding a key on [https://pastery.net](https://pastery.net), you can then just log in with the key with no username/password at all).

<comment><USER9> Note that to do the latter ("Usernameless login") you need a FIDO2 key. A relatively modern Yubico product can do FIDO2, but cheaper alternatives mostly don't offer this.

The reason it's a cost upgrade? Those credentials have to live somewhere, and that means they're using Flash storage baked inside the FIDO2 key, ordinary FIDO keys don't have close to enough storage.

Next you might wonder: Wait, how does a FIDO key log me into Google if it isn't storing the keys?

Magic. Well, cryptography. When you registered the key it minted a key pair (Elliptic curve most likely) and obviously it gave Google the public key, but it also provides Google a large random-looking "Identifier" which Google must give back each time you authenticate. That identifier could, by the specification, just be some sort of hidden "serial number" but in reality what everybody does is encrypt the _private_ key or its moral equivalent - with an AEAD scheme using a device-specific secret key and then use that as the identifier. So when Google gives you back the "identifier" the FIDO device decrypts it to discover its own private key for the site which it can use to log you in. The FIDO dongle doesn't actually even _know_ you have a Google account, yet it works anyway. Magic!

FIDO2 is a much less clever trick, and that flash storage is too expensive to use it everywhere - but the UX is so seamless it makes username plus password look like they asked you to undergo a cavity search by comparison.

<comment><USER10> I don't think you need a FIDO2 key for usernameless.

try [https://www.passwordless.dev/custom#heroFoot](https://www.passwordless.dev/custom#heroFoot) with the latest Firefox on a recent Android.

You can register and login with just a PIN code (or gesture pattern) from your Android

<comment><USER9> That's fair, there probably are more people with a suitable Android phone than with a FIDO or FIDO2 dongle, and you're correct that the phone (having more than enough storage) offers this feature and unlike a dongle I think you can be comfortable the phone won't "run out" of space if you sign up for frivolous nonsense this way.

</comment></comment></comment></comment></comment></comment><comment><USER11> Maybe this article came about because of my tweet: [https://twitter.com/sytses/status/1263216521175642112?s=20](https://twitter.com/sytses/status/1263216521175642112?s=20) " I'm grateful for the red team at GitLab doing an amazingly realistic phishing attack [https://gitlab.com/gitlab-com/gl-security/gl-redteam/red- tea...](https://gitlab.com/gitlab-com/gl-security/gl-redteam/red-team-tech- notes/-/tree/master/RT-011%20-%20Phishing%20Campaign) with custom domains and realistic web pages. The outcome was that 20% of team-members gave credentials and 12% reported the attack."

I think it is amazing that our res team make [https://gitlab.com/gitlab- com/gl-security/gl-redteam/red-tea...](https://gitlab.com/gitlab-com/gl- security/gl-redteam/red-team-tech- notes/-/tree/master/RT-011%20-%20Phishing%20Campaign) public so other companies can learn from it and they where comfortable with sharing the results.

<comment><USER12> I've seen this a lot in my work where companies hesitate to conduct phishing exercises that are "too convincing" (or, put another way, too realistic) because they fear documenting poor results. Of course that means the exercise and the learning opportunities are much less impactful. I'll concede it's a little different with financial institutions because regulators and auditors will usually see the results at some point but I really admire Gitlab's commitment to transparency.

I try to emphasize to clients that it's not a test but a phishing _exercise_ akin to a fire drill. You don't pass or fail a fire drill - you use it assess how prepared you are for a fire. And if you find that you're totally unprepared, well wouldn't you prefer to figure that out before anything is actually on fire?

</comment></comment><comment><USER13> My company regularly runs internal phishing tests like this, using an outside organization. We apparently have a near-constant 7% failure rate. Personally, I cheat: Long ago I discovered that the outside org puts some identifying headers into the email, so I wrote an email rule that adds "[PHISHME]" to the subject line.

The phishing emails are sometimes very good. They appear to be from senior management and address projects or other internal events everyone knows about. Some emails are very easy to spot, in the Nigerian prince category. It is very interesting that we have that 7% failure rate no matter how good or bad the phishing email is.

In general, I think internal phishing tests are a great way to educate the workforce.

<comment><USER14> > _My company regularly runs internal phishing tests like this... I think > internal phishing tests are a great way to educate the workforce_

Yes and no. I used to report phishing attempts to IT. Then we started running tests like every month, so I'd just delete suspicious messages and move on. Of course, that's when we got a real phishing message.

Frequent company-wide tests are, in my opinion, overboard. Once a year company-wide tests, followed up by more-frequent tests for sensitive groups and/or those who failed previous tests, makes more sense.

<comment><USER15> That's the thing, reporting a phising email in my org excludes you from one month's worth of email... then two months... then four months... I spoke to the guy in charge and he checked (my account is set to not receive for 2 years)

</comment></comment></comment><comment><USER16> I'm not a huge fan of these phishing-test exercises. I run the service at [https://urlscan.io](https://urlscan.io) which a lot of folks use regularly to check out suspicious links in mails / chat messages. I've been approached by some of these phishing-test companies asking me to prevent scanning their domains/IPs. They flat-out told me that they weren't happy about users using my service to check the link, which I always found odd, and I never got an explanation for it. Probably less spectacular findings for these companies if users can figure out a phishing test by themselves...

<comment><USER15> > Probably less spectacular findings for these companies if users can figure > out a phishing test by themselves...

It's the same issue as "ad companies"... if you don't cook the numbers that show your expensive service is worth it, then people will switch to the service that looks worse (this one has 7% fail rate but this one has 50% fail rate)

<comment><USER17> Perhaps they should look at doing integration that shows how much urlscan.io is blocking the phishing test companies?

</comment></comment></comment><comment><USER18> When I worked at Google, orange teams weren't allowed to use phishing tactics because they worked so reliably every single time that they provided no new information about the security of internal systems.

The reality is that humans are hard to secure, so defense in depth generally involves preventing compromised accounts from causing lots of damage, detecting them as early as possible, and controls for shutting them down.

</comment><comment><USER4> I don't understand how working from home is relevant to this?

Do people working in offices have IT staff come by to update their laptops? Would people in an office not open this email if they'd do so at home?

When I worked in an office nobody touched my laptop but me.

<comment><USER19> While in office you're connected to internal network, supposedly within internal domain and IT dept. would have direct access to push updates automatically. When outside you're suppose to connect via a VPN (best case) or communicate via encrypted something (email, ftp etc) but you'll need to enter your credentials somewhere.

Also, please remember, it's not your laptop, it's company's laptop, merely given to you to do your work on it. Anybody within the company with correct credential would have the right to touch that laptop.

<comment><USER4> > While in office you're connected to internal network

Not all companies do it this way. Many use a clear network and make services encrypted.

> Also, please remember, it's not your laptop

It is if you work for a bring-your-own-device company.

<comment><USER19> Bring your own device is bad for companies. Any of them using this approach are just begging to have their talent pool drained. If I do work for company on my own device there absolutely no difference between my personal research and the company research and in eyes of the law these companies will always lose if they try to enforce some "secret sauce" to not go to their competition. Wondered why FAANG companies never did this, those that will lick every penny from whatever corner they can? Exactly because they know too well they'll lose badly. Just look at that guy that got bankrupted by Google after he went to Uber - HN had an article a few weeks back.

<comment><USER5> Shouldn't that exactly be appealing to the talent, not having to worry about the company claiming their side projects as their own?

I very often work on my side projects and it is quite an annoyance having to move around with 2 laptops or paranoidly erasing my personal work from company computer.

Also from my experience working at a fang like company they definitely don't seem to lick every penny. We have company laptops because of security reasons, but phones are bring your own which they pay for. Also they pay for WFH office equipment as long as you can reason it makes you more productive or is good for your health. Basically anything that makes you more productive or sustainable they will pay for.

<comment><USER19> use a VPN to work on your own server/computer from the company issued device. This way there is no need to keep anything of your on their.

</comment></comment></comment></comment></comment></comment><comment><USER20> Our company informed us 2 years ago that they will be attempting to phish us continuously (no frequency specified).

If you fail, the last page is corporate training on the topic.

I was so inspired to not have to do corporate training, that I assume everything is a scam now.

<comment><USER21> > If you fail, the last page is corporate training on the topic.

In my work, the policy is 3 strikes and you are gone. First two fails are trainings with tests and third fail is an instant fireable event. As we work with clients and and their data, this is strictly enforced too.

<comment><USER22> Sounds like a hellhole. That policy is perfectly tailored for corruption and paranoia.

<comment><USER23> concur. I do hope that the "well meaning" security team that thought this up is diligent in investigating and accounting for false positives. "Oh, I clicked the link in the fishing email IN A VM to see what the F* it was" and "I entered 'fakeceo' and 'mrpassword123'".

People have different methods of exploring and learning to decide if something is legit or not. Nor should any "security policy" should be a 3 strikes zero tolerance policy. Everything needs context.

P.S. I'm pretty sure that the mental and behavioral damage done by this 3 strikes policy can easily be weaponized.

Shame.

</comment></comment></comment></comment><comment><USER24> > Hunt said GitLab has implemented multi-factor authentication and that would > have protected employees had the attack not been a simulation.

"Protected employees" is a weird way to put it to say the least. It's not about protecting employees, it's about protecting gitlab company and their customers. And the protection would have failed. The attacker would have needed to use the credentials (including the one-time credential) in real- time. That makes the attack-site logic a bit more difficult, but it would have allowed to break in. I doubt gitlab employees have to reauthenticate very often during a working day.

Well, unless they really use a challenge response system. At least what I use as a gitlab customer is not, it's just standard OTP. I would provide a valid one time password to a phishing site, should I fall for it.

(Edit: reworded. Commenting on the phone is never a good idea...)

<comment><USER25> Gitlab.com has used U2F/WebAuthn for years (not sure which, but they're both isolated by origin anyway).

<comment><USER24> Right, according to [https://en.m.wikipedia.org/wiki/Universal_2nd_Factor](https://en.m.wikipedia.org/wiki/Universal_2nd_Factor) it's U2F. So I would not be surprised if gitlab requires their employees to use the dongle instead of simple OTP which they allow for customers/users. A shortcoming of the article not to mention whether that's the case or not.

</comment></comment></comment><comment><USER26> At a place I worked at they did something similar with the most obviously fake email possible.

Seemed like a pointless box ticking exercise.

Funny enough IT sent out an email about a Windows update rolling out (upgrade to a new version like 1709) that looked ever dodgier than their fake email. That had people reporting that as phishing.

<comment><USER27> > Seemed like a pointless box ticking exercise.

Phishing emails often look pretty obvious - that's part of the program! It filters out people you can't trick and leaves you only with the most gullible ones.

Had the same at a previous company. If you use GMail, IT needs to manually approve the mail to avoid it going into the spam folder. A huge warning saying "this message has been excluded from your spam filter by your IT department" shows up at the top. People still click through...

<comment><USER28> > Phishing emails often look pretty obvious - that's part of the program! It > filters out people you can't trick and leaves you only with the most > gullible ones.

For frauds that requires the attacker to spend time with the victim, sure. For a fully automated phishing attack? There is no reason to lose out on people early on.

And for a targeted attack against a company? Makes even less sense to make it obvious.

<comment><USER29> It could be a strategy to make people less careful : send one or two "obvious" fake phishing email and then the real one a little later when they are confident they can avoid phishing.

</comment></comment></comment></comment><comment><USER30> My company sends phishing emails every few weeks, for like past 5 years

U click it or open attachment, u are automatically enrolled in trainingg u must complete.

Very few people click anything remotely obscure, and are asking manager if the email is from a legitimate company we are dealing with.

Ex: I got a signup confirmation email from a legitimate website, asked our director about it. He looked into it and confirmed with IT we had been signed up and infosec was fine with it.

We then relayed to the whole team that it is legitimate email.

I would say highly successful

</comment><comment><USER31> A better approach is to implement anti-phishing measures way up in the chain -- at the MTA level itself. Simpler ideas like: stripping URLs' from mail, stripping attachments if email origin is outside the organization, converting HTML email to plain-text, disallowing HTML email, yield substantial benefit in stopping phishing.

Basically, don't try to solve a problem by humans when it can be solved more efficiently by technology!

Phishing exercises are absolutely pointless in my experience and contribute zero to increasing the awareness. Shaming does not address the underlying human weaknesses that make us fall for phishing, they simply make the IT Guys look cooler, and increase CISOs' and Red Team budget. :-(

<comment><USER32> The best security is multi-layered. The human layer is the weakest part of any security system, and both technical and human measures must be taken to achieve defense in depth.

Some technical measures used here were requiring 2FA for all internal services, and scoping keys/POLP to limit the damage from one compromised key.

The purpose of exercises like these is not to shame someone who "fell for it", but to educate workers about phishing attacks and strengthen the human security layer.

<comment><USER31> Two decades of experience suggests that "strengthening human security by training" ain't happening, no matter how hard/smart you try. The technical controls have to be beefed up to a point where that human-weak-link is eliminated.

These tests are nothing but CISOs'(and Red Teams, and the whole industry around it) justifying their existence, and potentially doing a song-and-dance about it at the quarterly all-hands. Nothing more, nothing less. We can come back to this thread in another year/two years/five years/decade, and I can bet dollars-to-doughnuts, the industry will still be training humans, and claiming these pointless statistics about phishing. ;-)

On this note, see #6 "Educating Users", in Marcus Ranum's excellent article "The Six Dumbest Ideas in Computer Security": [https://www.ranum.com/security/computer_security/editorials/...](https://www.ranum.com/security/computer_security/editorials/dumb/)

</comment></comment></comment><comment><USER33> We do this a lot where I work and it's fun.

There's a button in the email client for "report phishing link" so I'm always on the lookout.

If you report a test evil message you get immediate feedback that you passed the test.

If you report a real one the security team immediately looks at it and let's you know if it's legitimate or not.

I think it's a good system.

</comment><comment><USER34> Time to send every employee a FIDO compatible security key, implement WebAuthn, and make it mandatory for employee login.

<comment><USER35> Is that meaningfully more secure than something like Auth0 with Duo MFA? (Which doesn't require a dongle hanging off my USB-C port and works seamlessly on virtual machines.)

</comment></comment><comment><USER36> The problem seems to me that companies and orgs want to send emails when it is convenient for them to do so (paystub ready, benefits enrollment open click here, etc.) but distribute the cognitive load to its employees/customers to figure out which emails are trustworthy and which emails are not. You eventually get trained to click on links in emails as a form of legitimate interaction.

[https://www.cl.cam.ac.uk/~rja14/book.html](https://www.cl.cam.ac.uk/~rja14/book.html)

</comment><comment><USER37> If you look at the logs of phishing exercises you can often see employees messing with the red team, like entering invalid creds for CISO or CEO and stuff.

I think phishing exercises should provide much more details, e.g. the following metrics:

(1) # targets opened email

(2) # clicked link

(3) # who entered valid username (must match some identifier in email - <USER2> prevent trolling)

(3) # who entered password

(4) # entered valid(!) password

(5) # entered MFA/code or did Push

(6) # auth cookies stolen (full compromise)

Otherwise it's difficult to compare any of these tests and understand the actual risks and success rates.

</comment><comment><USER38> The company I work at works with and contains a significant amount of PII regularly phishes on our staff. It's usually between 1 in 5 and 1 in 4 that will click on the link. Despite all of the education and quarterly repeated phishes those number really aren't improving much. I think at some point you have to accept that end users will click on things, and add additional protections in place to help mitigate the risk.

</comment><comment><USER39> I regularly perform tests like these. Overall there's a flat 10% 'critical failure' rate across organizations. You send a phishing e-mail pretending to be from the IT department, with some instructions to install the 'anti-virus scanner' or whatever, and 1 out of 10 people will open the e-mail, click the link, give their credentials, follow all instructions, click through all warnings and infect their machines.

If your organization is above a certain size, remote code execution in your network is a given. There's several technical measures you can take to make is _much_ harder to perform these attacks on Windows in general:

* Disable unsigned Office macro execution (if on windows with office)

* Disable mshta.exe or remove the .hta file association

If you can get away with it, productivity wise, enable whitelisting for all software.

Attackers can often times still find weak points in your organization. It's not always the marketing or HR department with Windows that gets phished. I once observed a colleague phish a webdev on a macbook with a recruitment 'challenge'.

</comment><comment><USER40> 100% of people will fall for a good spear-phish, when you fail to accept that you start doing things like punishing people who fail. The point of these tests is to raise awareness and train people so that successful phishing attacks will need that much more targeting precision in addition to accuracy.

It's like combat training, the goal isn't to train your army so they all become elite fighters and martial artists, the goal is to improve their fighting skills so that they fair a good chance at victory against similar ranking enemy troops.

So, if your people fall for an emotet phish,that's bad. If they fell for a pentester's phish where he did background research on his subjects and spoofed email header fields, that's normal, just like a navy seal beating up an airforce sergeant would be normal.

</comment><comment><USER41> All companies should be doing internal penetration/security testing. If you don't do it, someone in China or Russia will do it for you, you just won't know. I hope GitHub is doing this too. Google, for example, has an entire team whose task it is to exploit such attack vectors and close the holes in all sorts of products and processes, often with stunning results. I'm not sure if the rest of FAANG does this, although I'd be surprised if Facebook doesn't do essentially the same. I would not be surprised if Amazon or Apple don't do it, at least not to the extent you'd see at Google (no holds barred, the red team gets to pwn everything). Netflix, I'm not sure, they probably have something. Microsoft probably doesn't do it, since it'd make people look bad, and in their back-stabbing corporate culture people can't afford to look bad.

</comment><comment><USER42> Is this newsworthy? My company does this very regularly, and the phishes are well crafted convincing.

20% seems low if they're reasonably well put together emails. In the wild there's plenty of badly made, easy to spot phishing campaigns but one would hope any decent Red Team could put together a good one.

</comment><comment><USER43> I support this action and wish more companies do it. It would tremendously improve the security in every organization. The people that "bought" the fake login link feel ashamed, I'm sure, and they'd think twice before logging in next time. Kudos for Gitlab.

<comment><USER44> Not really.

Someone told me they did the same thing at his company, send out fishing emails to see who fell for it. Those who did (management was disproportionately represented) had to attend some training lessons.

They resent another phishing email a few months later. Most people who fell for it the first time, fell again, despite the training.

<comment><USER43> I don't think an additional training is needed, at least in an IT company. The fake-phishing success should be enough to make everyone who fall curious enough to at least research the subject.

What company has to make sure to communicate clearly is that the failure in the fake phishing test would not affect the employee's status in the company at all. But eventual failure in a real phishing event would have at least some consequences.

For non-IT companies the training should begin and end with the message above and in between should be short and concise with ideas how and where to learn more about the subject.

</comment></comment></comment><comment><USER45> This is especially concerning considering that GitLab is a technology company consisting of mostly technical staff.

For a crafted spear-phish like the one used in this test, I wonder what the failure rate would be in larger, non-tech organisations?

</comment><comment><USER23> I appreciate the article, gitlabs, and da'reg commenter "Spencer" for pointing out that gitlabs publishes their security handbook: [https://about.gitlab.com/handbook/security/](https://about.gitlab.com/handbook/security/)

As I read through these comments and the linked handbook, it kinda makes me want to work for a company like that. As important as security is, even the security handbook has an appropriate tone vs. treating people (CS talented or not) as idiots who cannot be trusted. Good job gitlabs.

</comment><comment><USER46> I take the point but I also take it with a degree of realism.

I've been at companies where they did this and I usually 'fail the test'.

I received the email, but given the highly targeted nature (wasn't very generic) I get curious. When you can tell it san internal test its fun to see if you can trace it back to a particular person or department. So I created a VM in a secondary clean laptop and opened it.

So based on the test I failed because they detected I followed a link.

I don't for one second believe that 1 in 5 Gitlab employees also did this, but I'm certainly distrustful of test numbers like this.

</comment><comment><USER47> My company does this often. It sends legitimate looking emails and at last I fell for one recently.

I thought about it, then I understood why. My company uses a lot of saas products - for submitting expenses, for giving appreciations etc etc. These saas products regularly sends emails, and they come from other domains.

When my company used all home grown or on premise web apps I never ever opened any emails coming from a different domain or open them very cautiously.

And now I think these saas emails have probably taught my brain to trust emails from other domains.

I am not sure.

</comment><comment><USER48> I worked at a place where they sometimes sent phishing emails to see what people did. They also had mandatory annual training on e-risks, which wasn't in fact too painful.

The fun arose when the company employed third-party service providers that required employees to respond to an external email (infrequent but it did happen). Inevitably there had to be a certain amount of internal comms to let people know that this external email was in fact safe to respond to.

<comment><USER49> That's hilarious but it also highlights that ultimately, there are no 100% inherently safe communications channels. A sufficiently motivated actor can go through extreme lengths to compromise your IT even if it means faking email, voice, letters, physical interaction.

</comment></comment><comment><USER50> This is common in many workplaces, and while a little strange, I think it's a good exercise, especially for less sophisticated folks who get a lot of external mail.

<comment><USER51> It's not that strange. In a talk at last year's CCC someone explained that it's a good learning experience when you educate the people, that clicked on phishing, right in/after the phishing process. He also found that the learning effect only applies to the method the people failed in - so learning from phishing doesnt teach anything about passwords.

While sad, I think it's important to acknowledge and don't be do harsh to people who fail in the first attempt... ... also because my biggest learnings also came from really embarrassing moments or failure too..

</comment></comment><comment><USER52> Man I hate these, and I hate that companies get paid serious real US American Dollars to stage these for other companies.

Every time I see a colleague laid off, and then see one of these stupid phishing tests land in my inbox, I think about losing my job during a pandemic in order to ensure the security team still had the budget to pull this stupid crap.

It doesn't help that our own customers send us stupider looking emails that are actually legitimate.

</comment><comment><USER53> Company runs phishing simulation (they were already remote)...is that news?

One in five isn't bad. As you target them, based on content and recipients, the results can get much worse. And when non-tech companies run these, the results are...scary.

It's no wonder the most sought after entry point into a network, the most reliable and probably the cheapest, is phishing. All it takes is one out of 50,000 to fall for it.

</comment><comment> globular-toast But the little green padlock was there! It must have been OK.

My company has just decided to enable 2FA in order to combat phishing. I'm not sure how this would help. What amazes me is that we allow HTML email at all. That alone would greatly reduce successful phishing attempts. Requiring all emails to have valid signatures doesn't even seem too difficult for an organisation.

</comment><comment><USER54> "While an attacker would be able to easily capture both the username and password entered into the fake site, the Red Team determined that only capturing email addresses or login names was necessary for this exercise."

It says in the article that they never asked for passwords.

I wonder if the statistics would have been different if they did? You usually think twice before entering a password.

</comment><comment><USER55> I'd just note that it seems Google documented that U2F keys were the only tech they'd tried capable of reducing credentials to Google systems being stolen from employees in phishing attacks to zero. Maybe we need more of that going around.

I also don't understand why they keep mentioning that their staff is all- remote. I don't see what difference that makes.

</comment><comment><USER56> There have been studies which suggest that phishing your own staff has significant negative effects. I have trouble finding the study names but the NSCS website has a good article about it: [https://www.ncsc.gov.uk/blog- post/trouble-phishing](https://www.ncsc.gov.uk/blog-post/trouble-phishing)

<comment><USER57> This article is more of an opinion piece. Would be interested in evidence.

It seems logical to me that self phishing is a good way to educate on how to spot phishing/unusual emails, and to realize they are a target

<comment><USER58> > This article is more of an opinion piece

Wouldn't that be legally required to end with something about selfishly self- phishing shellfish?

It does read a bit like SEO copy for a training consultancy that offers an alternative to the intuitive self-phish/reprimand cycle, but it brings up some interesting ideas.

</comment></comment></comment><comment><USER59> Reading this article brought this one to mind: [https://krebsonsecurity.com/2018/07/google-security-keys- neu...](https://krebsonsecurity.com/2018/07/google-security-keys-neutralized- employee-phishing/) (about Google using security keys to deal with phishing)

</comment><comment><USER60> buying a phishing as a service trainer is the single best bang for your buck in the realm of all security. obviously, all computer security is relative to your use-case and threat model, so your mileage will definitely vary. if all your servers are publicly routable with no firewall or antivirus, emails are the least of your worries.

however, spam is not a solved problem. phishing is hard to stop, and spearphishing basically impossible. professionals you know get compromised, upstream toolchains get compromised, etc. the attack effort and risk vs reward is wildy skewed in their favor. it has been a vector of compromise for many highprofile breaches.

find a reputable company, pay them, and whitelist them in your spam filters. they will generate incredible phishing emails (using your domain and corporate info, since you let them) and give you a way to train your users in a way that is irreplaceable.

</comment><comment><USER37> Seems pretty typical for results of phishing campaigns - although they targeted 50 people, which is not very representative to get overall numbers and stats on different disciplines in a larger organization.

Results are largely driven by the kind of phish that is sent and if its click- worthy.

Some companies do these exercises every month.

</comment><comment><USER61> 20% is low for a typical test.

A clever insider can get that to 100%, say with "Benefit Plan Updates." lol

<comment><USER62> We had one earlier this year about staff raises

</comment></comment><comment><USER63> We did a similar phishing attempt in my previous company, which had a bit more technical background than gitlab.

From the 200 people, only one gave up his credentials. from marketing, as expected. We don't let them near anything important anyway.

</comment><comment><USER64> My company (big Valley corp doing robotics) does exactly the same, and it's very good at it: if you get phished, you'll automatically get signed up for a long and tedious training.

</comment><comment><USER65> The most brutal phishing I've seen an enterprise use: "[SPOT BONUS] Your hard work and dedicated efforts are being rewarded!"

</comment><comment><USER66> At work, failing clicking on a test phishing email can result in a dismissal if you do it too many times in a year.

</comment><comment><USER67> Several have noted email rules set up to flag phishing simulation emails. Anyone care to share one of those rules?

</comment><comment><USER68> My company does this but it's somewhat outsourced to phishme.com, so a simple outlook rule finds them all.

</comment><comment><USER69> I wonder if the other 4 out of 5 even read any _other_ (proper) e-mail.

</comment><comment><USER70> Seems irrelevant that they work from home

</comment><comment><USER71> 32 per cent? Is their % key broken?</comment>


The mean streets of San Francisco - <AUTHOR> http://atomicwang.org/motherfucker/Index/Entries/2010/5/23_The_mean_streets_of_San_Francisco.html

<comment><USER2> It's easy to get jaded in SF because there are so many panhandlers. There's also different classes of panhandlers... There's gutter punks, scam artists, drug addicts, mentally ill, and dudes who are just down and out. There was a guy by my house who I felt bad for because he was mentally retarded... until I ran into him at the pizza place and realized it was all an act. There are guys who would ask for weirdly specific amounts of money, like $8.75 or 13 dollars. There are guys who have nicer shoes than me. The gutter punks are aggressive and generally assholes. There was a 20-something girl with a shaved head who offered to give me a blow job for $5... at 7 in the morning.

Anyway, I get what the OP is saying but none of these people besides the gutter punks would be into smokes. It's sort of stupid to buy smokes for homeless people if you don't smoke. Even beyond the homeless, SF is lurker central. Smoking in SF means that everyone on the street will ask you for a cigarette, from homeless people, to drunk yuppies whose wife won't let them buy cigs, to teenage girls up for the weekend from Stockton.

In summary... having cigarettes will actually ensure that you have about 5x as many encounters with people on the street than you normally would.

Really the only way to deal with the panhandlers (and everyone else in SF) is to learn how to say "no." If you want to feel better about yourself volunteer at a shelter or soup kitchen.

</comment><comment><USER3> The disconnect between the world we are living in and the streets is huge. That's why I hesitate to pass judgment on other people - I don't know how they have been shaped by their society, and perhaps if I went through the same process they went through, I would also have their viewpoints.

It's like people who listen to rap passing judgment on country music or vice versa. These represent different lifestyles and approaches to life. None is wrong - brought up in one circumstance, you would sing the one and in another the other.

<comment><USER4> Yes, one shouldn't pass judgement on homeless people, but the music analogy doesn't hold.

I presume that, whether you listen to country or rap, there is _some_ degree of choice in your actions. So many homeless people end up on the streets because of mental illness or domestic violence -- things that are absolutely out of their control.

So instead, at least for me, it is difficult to see and accept homelessness as an alternative lifestyle. It requires a different level of empathy.

</comment></comment><comment><USER5> I had to re-read the part where he skips from

"You might describe my attitude, in the words of the philosopher McCartney, as "live and let die.""

to

"Three weeks after my 18th birthday, I was taken by gunpoint to a Greyhound station in Orlando with a ticket to California and a twenty dollar bill."

I thought I missed a paragraph there or something.

</comment><comment><USER6> > Ignoring the homeless, or begging off, carries its own problems.

Don't do either, then. If you don't want to give money, just give a polite and firm "no". I can't believe that anybody takes such a response personally.

To be honest, it's no wonder this guy is harassed by the homeless if he is handing out $100 to them inside a week.

<comment><USER7> I do think saying "no" has some negative implications as well, even if the person doesn't take it personally. Like the article says the person would probably just think you (and the rest of society) is a prick.

As I read the article, I didn't really interpret it as he was actually giving out $100 a week, but rather saying that if you gave a dollar to everyone that asked, you could spend a lot of money.

We're also talking a specific week here, not at any given moment. I've never been to WWDC or SF during a big conference but if I was a homeless person looking for a place with a lot of people who is sure to have money, I'd look at the WWDC crowd.

<comment> jim-greer You can say 'Sorry, no' or just 'good luck'.

If you have any genuine sympathy that will probably come across to them.

<comment><USER8> In Portland, OR, which has a similar homeless problem to SF's, I learned to always include "sorry" when I turned them down, as when I did so, they almost never were rude to me in response. When I didn't say "sorry," I could never be sure what to expect.

</comment></comment></comment></comment><comment><USER9>
        Give beer to those who are perishing,
          wine to those who are in anguish;
        let them drink and forget their poverty
          and remember their misery no more.

-Proverbs

<comment><USER10> That's good advice in small doses, but when someone is perpetually in anguish you'd be much better off helping them solve that than giving them unlimited wine.

</comment></comment><comment><USER11> I was homeless at the age of 14 and this is quite true. I like the fact that you've mentioned the cigarette as currency. In many cases I've been able to trade a cigarette for food and clothing. At the same time, like money, that cigarette brought troubles at times.

Thanks for the good writeup.

</comment><comment><USER12> I'm not rich but I've begun to give the homeless in SF quite a bit of my money. I used to just give them "spare change" and cigarettes, but you should see their face light up when you hand them a $5 bill + loose change. Try it with an open mind, you might find that it's the best $5 you'll ever spend that day.

I used to think that I'd only make the problem worse by giving them money, but my perspective has changed. At the current rate of our economic collapse, it won't be long before we join their ranks.

      How does it feel
      How does it feel
      To be without a home
      Like a complete unknown
      Like a rolling stone?

<comment><USER13> Your eyes would light up too if you were a crack addict and someone handed you two hits.

<comment><USER12> People are addicted to money. That includes you and me.

</comment></comment></comment><comment><USER14> I would not say the streets of San Francisco are mean. Out of many major cities I've been to, it looks like the nicest city for a homeless person to be. I don't know exactly what city does to help besides regular feedings on the Market str, but they all seem clean, weather is nice, people are tolerant, and many techy tourists spare cash. If there is such a thing as homeless heaven, I'd say SF is it's headquarters.

<comment><USER15> You must be posting from some alternate universe. 'Clean' is not a word I would use to describe the streets of SF.

<comment><USER2> SF is dirty where all the startups are: SOMA/Mission. The tenderloin is also grimy. The rest of SF is as clean as any dense city. The neighborhoods west of Divisidero are no dirtier than say, Cambridge, MA.

</comment></comment></comment><comment><USER2> I'd be interested in learning what brand of cigarettes are available in SF for $5. Certainly not the American Spirits displayed at the top of the article.

</comment><comment><USER16> Anyone hand out food or something else instead? I am not a big can of cigarettes but I bought a big box of Clif Bars the other day and thought that, or something similar/smaller/cheaper, would be a good handout. I'm always weary of handing out money because it just seems very likely that it will be used for alcohol, drugs, etc.

<comment><USER8> A few times, my husband and I got panhandled coming back from a nice restaurant, and happened to have a doggie bag with us. Offering that _never_ went over well and either got outright rejected or grudgingly accepted and quite likely not eaten.

As the article says, homeless people have ample food, due to the missions, et al. A friend of mine who had a brief homeless stint confirmed this, saying that it was easy to get three square meals a day while living on the streets. (It just takes standing in line for hours, which makes pursuing other things, which might help one get off the street, difficult.)

</comment></comment><comment><USER17> Sounds like a case of inner city pressure to me: <http://www.youtube.com/watch?v=7wqfcwgT0Ds>

</comment><comment><USER18> This is just crazy enough, and written with just enough of a sense of world- weary authenticity, that I think I may just be convinced to try it.

<comment><USER12> been there, done that. not crazy.

OTOH, I disagree with the author that cigarettes are less of a problem for the homeless.

</comment></comment><comment><USER19> Ha, ply people with drugs, awesome! (I am not even sure, exactly how I feel about this.)</comment>


Excess Management Is Costing the U.S. $3 Trillion per Year - <AUTHOR> https://hbr.org/2016/09/excess-management-is-costing-the-us-3-trillion-per-year <comment><USER2> I believe.</comment>


High construction costs are killing new Bay Area housing - <AUTHOR> https://www.bizjournals.com/sanfrancisco/news/2018/04/26/construction-costs-killing-new-bay-area-housing.html <comment><USER2> That's crazy, in Russia even in Moscow a cost of building an apartment never went over $50,000, and may be as low as $20,000 in the regions. And these apartment are quite decent, maybe with moderate quality flaws, but these are not ghettos.</comment>


Ask HN: How often do you read academic papers? - <AUTHOR> I don't read academic papers very often, but I have found myself reading them more frequently in the past few years. Mainly these papers are on topics I'm curious about and are sometimes also tangentially related to my work. The topics I'm mainly interested in right now are Databases, Distributed Systems, and Programming Languages.
How often do you read academic papers?
If you do read academic papers, what topics do you read about? <comment><USER2> not often. the titles can be interesting, but the format can be long and difficult to decipher. instead i often default to the executive summaries of industry reports and white papers. it's more operational and less theoretical i find.</comment>


It's Better to Avoid a Toxic Employee Than Hire a Superstar - <AUTHOR> https://hbr.org/2015/12/its-better-to-avoid-a-toxic-employee-than-hire-a-superstar <comment><USER2> At the risk of something it may be wise to not connect to my employment history, I worry about this sometimes. (and selfishly, it's effect on me/people like me.)

Despite what I like to think of as a rather fortuitous career path, I've definitely run up against hiring managers who have told me explicitly such things as "We avoid hiring nonconformists like you" (a verbatim quote from an employee at a F100) and worry that if we start becoming even more vague and sociological with our hiring, we'll merely discriminate more against mental/social diversity.

Seeing many articles that pop up nowadays on this topic makes me worry for younger generations of "Weirdos"(like younger me :) ), that they may not be lucky enough to find someone open and gracious enough to give them an opportunity and teach them how to fit in better, lest they be "toxic". (I really hate that buzzword too, it's become such a catchall for "behavior we don't like", almost a standin for "culture fit". HBR was more constrained in their definition, so I certainly don't want to paint with a broad brush, but the tone of the conversation on the whole makes me raise an eyebrow for where it'll move in the future)

<comment><AUTHOR> Someone saying they "avoid hiring nonconformists" is entirely the opposite of what this tries to achieve; that's another kind of cultural problem, and a good sign of a workplace to avoid.

This is just about selecting for people who treat others decently. That's not an unreasonable criteria, and hopefully not one you'd have a problem with.

Avoiding/removing toxic people is entirely different than avoiding noncomformism and selecting for "culture fit"; if anything, removing the toxic people helps clear the way for _more_ diverse teams and companies, and organizations that are just more fun to work in.</comment></comment>


Ask HN: Current book for advanced postgresql? - <AUTHOR> I am looking to get up to speed with current Postgresql covering 9.0 or later versions.  I know of the jsonb support in the latest versions, but I am looking for someone closer to the Oreilly mastering Oracle SQL.<p>Can someone recommend a good book that provides detailed coverage and best practices for medium to advanced postgresql? <comment><USER2> once you get the basics. the official manual is pretty good.

[https://www.postgresql.org/docs/9.6/static/index.html](https://www.postgresql.org/docs/9.6/static/index.html)

I did not find a very good book on advanced level.

<comment><USER3> I was going to say that. The manual is very comprehensive.</comment></comment>


Perl one-liner for memory leak detection - <AUTHOR> http://gokcehan.github.io/verification/2013/03/17/memory-leak-detection-using-ltrace/#.UWHUHJAW3Zg

<comment><USER2> [http://gokcehan.github.io/verification/2013/03/17/memory- lea...](http://gokcehan.github.io/verification/2013/03/17/memory-leak- detection-using-ltrace/#fn:2)

That sounds like a recipe for trouble... what if it runs for more than a few milliseconds?

<comment><AUTHOR> would it be a problem if it runs for a whole second?</comment></comment>


Things you didn't know about multithreaded programming - <AUTHOR> http://www.ibm.com/developerworks/java/library/j-5things15/index.html?ca=drs-

<comment><USER2> This is a pretty crappy article in my opinion, and certainly won't do anything to help the problem that the author describes - that developers' knowledge of concurrency comes piecemeal without any structure.

I challenge anyone to gain an understanding of volatile variables from his description. His example of volatile vs. synchronised contains an example of incorrect code but not an example of how it should be fixed, and doesn't even contain a particularly clear explanation of why it's bad.

The explanation of the bytecode generated for a synchronised method compared to a synchronised block is curious if you're into bytecode but totally useless for a working programmer, and offers no guidance on choosing between them. Worse, it actually makes it sound like the option you almost certainly don't want (the synchronised method) is somehow more efficient than the almost universally better method (synchronising on a lock object, which provides much better lock granularity, prevents deadlock in the case of some external object claiming your object lock and generally makes lock ownership much clearer and easier to track).

Finally, his example of the AtomicReferenceFieldUpdater ignores the javadoc ( _This class is designed for use in atomic data structures in which several reference fields of the same node are independently subject to atomic updates_ ) and proceeds to show a contrived example of a compareAndSet that is really only a more confusing set, and doesn't actually achieve anything at all.

There are much better sources to learn this stuff if you really need to know it, starting with Java Concurrency In Practice - no Java programmer should be writing concurrent code without having read the first 7 chapters of this.

<comment><USER3> Agreed. It's hard to discern the real value of using synchronized methods vs synchronized blocks when you end up reading: "Creating the synchronized block yielded 16 lines of bytecode, whereas synchronizing the method returned just 5". As you point out, synchronization on a lock object is, as a rule of thumb, a much better option than synchronizing on the intrinsic lock, and thus losing control over it.

The explanation of volatile is woeful, to say the least. He doesn't even mention the main issue that volatile addresses (the only one?): visibility. Anyone really interested in this should read the following article by the author of JCIP: [http://www.ibm.com/developerworks/java/library/j-jtp06197.ht...](http://www.ibm.com/developerworks/java/library/j-jtp06197.html)

I liked the section regarding ThreadLocal though (an example would've helped a bit).

</comment></comment><comment><USER4> ...in Java. Or at least, the JVM.

Does anyone know the limits of the JVM for multithreading? e.g. Max number of cores

<comment><USER5> Any limits depend on the particular JVM that you are using. In practice one needs to experiment.

A few years back I did some comparisons between Java and Erlang with respect to the number of threads the system could handle. Somewhere around a thousand threads was sufficient to make the JVM go very slowly.

<comment><USER2> See Kilim (<http://www.malhar.net/sriram/kilim>) for a lightweight thread solution for Java that easily outpaces Erlang for thread creation and message passing. It's the basis for the Erjang project which runs Erlang bytecode on the JVM. While it's faster at a low level, it obviously doesn't provide everything that Erlang does (supervisor hierarchies etc). It's still pretty impressive that this can be achieved on the JVM though.

<comment><USER6> Well, sure. Erlang processes aren't threads. They're more like pre-empted coroutines, with a scheduler that factors in when they're blocking and waiting to receive a message (among many other things).

<comment><USER5> What would you say the essential difference is betwee pre-empted coroutines with a scheduler and threads?

The only thing I could think of is that with coroutines one can explicitly pass control over to another coroutine, but that is something that Erlang does not provide, so I don't really understand what you mean.

<comment><USER6> Erlang processes are managed by its scheduler, while threads are managed by the OS. Erlang has more info about appropriate stack sizes, garbage collection is done per-process* , it only pre-empts processes that are currently working or recently got a new message, and probably a half dozen other optimizations I'm not aware of. Let me know if you have more questions, I really like Erlang and I've wanted an excuse to research this. :)

* And often doesn't need to be done at all, because the process terminates first.

</comment></comment></comment></comment></comment></comment><comment><USER7> For people actually interested in parallel programming, particularly on Java, Herlihy's _The Art of Multiprocessor Programming_ is a fantastic introduction. On top of the grab-bag of techniques you'd expect, it boasts enough formal treatment to help folks learn to reason about correctness in their own programs.

</comment><comment><USER8> This article should be renamed to "beginners guide to multithreaded programming in Java."

</comment><comment><USER9> Articles like this make me appreciate Go's approach to concurrency (<http://golang.org/doc/effective_go.html#concurrency>).

</comment><comment><USER10> Synchronized methods and blocks generate different bytecode, but according to the spec, have "exactly the same effect".

[http://java.sun.com/docs/books/jls/third_edition/html/classe...](http://java.sun.com/docs/books/jls/third_edition/html/classes.html#220.127.116.11)

[http://stackoverflow.com/questions/417285/equivalent-code- fo...](http://stackoverflow.com/questions/417285/equivalent-code-for-instance- method-synchronization-in-java/417382#417382)

</comment><comment><USER11> The only part I found interesting was the first part, but only because it raises an interesting question that the author (unfortunately) didn't address:

Supposing you want to synchronize only one part of your method, which approach would cause the JVM to do less work: putting that part in a synchronized block (thus generating extra bytecode instructions) or extracting it into a synchronized method (thus generating an additional call)?

Not that it's really important -- micro-optimizations like that are silly -- but it does make me curious.

<comment><USER12> The article really fails here, this is a horrible example and horrible reasoning.

I'm no Java expert, but the reason you'd synchronize a smaller block of code, or use any finer grain lock, rather than a whole method is that you'd have a shorter time to wait if many threads are competing for the lock. You'd increase utilization.

Lines of bytecode doesn't really tell you anything, especially since the synchronized method is a stub that does nothing. Not only that, but the synchronized method does all its synchronization work implicitly; the JVM still has to acquire the lock somehow, it's just not written in the bytecode.

What really matter is what happens when the bytecode is compiled to native code, so you could see the synchronized method call overhead. If the article analyzed _that_ , it would be helpful.

</comment></comment><comment><USER13> Reference field update operations in Java are not thread safe?

<comment><USER14> reference updates are atomic, but without volatile (or more heavyweight synchronization) there may be an arbitrary delay before the change is visible to other threads.

<comment><USER13> Thanks for that.

</comment></comment></comment><comment><USER15> Kernel locking <http://www.linuxjournal.com/article/5833></comment>


If You Pay For Cable, You're A Hostage Of Sports - <AUTHOR> http://www.wbur.org/npr/144959516/if-you-pay-for-cable-youre-a-hostage-of-sports <comment><USER2> "IF"... not!

NetFlix + Amazon is a better experience.</comment>


Memories Form and Fade - <AUTHOR> https://www.caltech.edu/about/news/how-memories-form-and-fade <comment><AUTHOR> Paper: [https://authors.library.caltech.edu/93231/](https://authors.library.caltech.edu/93231/)

I've been waiting for this paper to be published for over two years. It's a fascinating collection of work.</comment>


Show HN: TypeScript to GraphQL conversion tool with type inference - <AUTHOR> https://github.com/acro5piano/typed-graphqlify <comment><USER2> An alternative to this and Apollo codegen is GraphQL Code Generator[1]. Like codegen it takes the opposite approach by generating typescript from graphql. It's similar to codegen, with the main two differences being 1) it's not centered around queries, it will generate types for all schema parts as well as queries defined client-side. This is useful for getting typescript types for all the individual schema parts without being "wrapped" in the type of a query, and 2) it's template based and relatively easy to extend modify how the code is generated.

[1]: [https://github.com/dotansimha/graphql-code- generator](https://github.com/dotansimha/graphql-code-generator)

<comment><USER3> We use graphql-code-generator to make Typescript. We also upload versions of our typescript-query files (written separately from other client TS code) for each published version/branch (e.g. 1.1, 1.2, dev) and then can use an eslint plugin on the graphql server to validate it doesn't break backwards compatibility with existing client-side code (unless intentional). This has definitely saved us more than once.

</comment></comment><comment><USER4> What's the advantage of using this tool instead of apollo-cli/apollo-codegen?

> The main idea is to have only one source of truth by defining the schema > using GraphQL-like object and a bit of helper class.

The source of truth already exists, and it's the schema.

Why do I need to specify the type in every query? What happens if I make a mistake and write the wrong type? What happens if the schema changes after I write the query? Will it somehow fail and force me to update it?

</comment><comment> lf-non This is very interesting.

I have been writing a library [1] to bridge relational databases efficiently to GraphQL APIs, and adopted a similar approach towards eliminating the redundancy in the schema definitions.

I currently rely on io-ts [2] which I also use for runtime verification of configuration options in an attempt to facilitate type verification to both JavaScript and Typescript consumers.

[1] [https://gql-dal.github.io/greldal/](https://gql-dal.github.io/greldal/) [2] [https://lorefnon.tech/2018/03/25/typescript-and- validations-...](https://lorefnon.tech/2018/03/25/typescript-and-validations- at-runtime-boundaries/)

<comment><AUTHOR> GRelDAL is an interesting project! N+1 problem in GraphQL is difficult problem. It remind me Lighthouse PHP [1] which is a GraphQL framework top of Laravel. Lighthouse handles N+1 problem to create a lot of "union all" queries.

[1] [https://github.com/nuwave/lighthouse](https://github.com/nuwave/lighthouse)

</comment></comment><comment><USER5> The solution we use at work is to put all of the GraphQL strings in separate `.graphql.ts` files. A script then scans the code base for such files, requires them, and converts queries/fragments into TypeScript types in a corresponding `.graphql.types.ts` file using apollo-codegen.

The advantage of this over plain .graphql files, or statically extracting queries, is that you can use all of the normal tools of TypeScript for composing queries (mainly imports and template literals), and you don't need to have globally unique names for all your queries and fragments. Having said that, I haven't looked at the recommended Apollo workflow in a little while, so I'm not sure if those issues still exist.

<comment><AUTHOR> I didn't know Apollo codegen also interpret GraphQL in .ts file. Thanks!

</comment></comment><comment><AUTHOR> > What's the advantage of using this tool instead of apollo-cli/apollo- > codegen?

> Unfortunately I'm not yet able see any benefits you'd get over Apollo's > codegen in return

> Doesn't Apollo's Codegen tool already solve this?

I am sorry for my late response.

I add the section to README.md which explains why I created this library even there is Apollo CLI's codegen.

[https://github.com/acro5piano/typed-graphqlify#why-not- use-a...](https://github.com/acro5piano/typed-graphqlify#why-not-use-apollo- clientcodegen)

In short,

\- Simplicity make this tool works as expected

\- Can handle multiple schemas

\- Works without schema file

I wrote a lot there, but I just wanted to try the paradigm TypeScript -> GraphQL conversion, because there are no tools to do that, unlike GraphQL -> TypeScript conversion tools.

However, this is not just a hobby project, cause I use this in my current real world project, and it reduces a lot of boilorplate. So I submit here.

# I thought Apollo codegen needs .graphql extension and webpack loader, but it reads .ts files too... Awesome.

</comment><comment><USER6> This is actually really interesting and mirrors a more general effort that I am pursuing[1] to build runtime representations of type in TypeScript, though my context is not so much GraphQL but rather just a more traditional HTTP API.

It looks like you try to keep it so that the runtime type object itself has the correct TypeScript type? That is, I would expect that under the hood you either have `types.number = 0`, `types.string = ''`, and so on and then you just use `typeof runtimeTypeObject` to derive this, or something more sinister like `types.number = ('number' as any) as number`. Either way that's fairly clever and I like it. I probably won't do it that way in `tasso` because one of my abstract points of power is that `tasso` should be able to validate that a given type object is a valid `tasso` schema, so there should be a metaschema. But it is really nice to have this thing saying just `typeof runtimeTypeObject` and not `ValueOfSingleType<typeof runtimeTypeObject>` to derive, from the schema's type, the instances' type.

I may steal one thing for `tasso` from this library, and that is the way your `constant()` works without specifying type metadata; I was under the impression that even with the `<t extends string>` TypeScript would still say "well `const x = constant('abc')` doesn't say anything else about `'abc'` so I am going to infer that it is a `string` and then string does extend string so `x` has type `string`," much like it does when you just write `const x = 'abc'`. I didn't realize that you can "hint" that you want the more generic type for the thing. In tasso this manifests when you are writing self- recursive schemas, like

        // the following line is a sort of hack
        const refs = tasso.refs<'cell' | 'list'>();
        // but then we can write stuff like this
        const schema = {
          cell: tasso.number,
          list: tasso.maybe(tasso.object({
            head: refs.cell,
            rest: refs.list
          }))
        };

It will be nice to replace that with `tasso.refs('cell')` and `tasso.refs('list')` without that "refs object", I think.

[1]: [https://github.com/crdrost/tasso](https://github.com/crdrost/tasso)

<comment><AUTHOR> Runtime Type Check looks very useful when developing a system which communicate with other systems, cause we cannot perfectly predict other systems output.

I am grad to give you some development hints!

</comment></comment><comment><USER7> Definitely looks interesting. I started with Apollo only a few weeks ago and am already tired of the redundancy and the verbosity.

I wonder how schema information/introspection from the back end could be used to improve this further.

Apollo has the codegen tool which uses the schema to automatically generate the required classes.

<comment><USER8> The first thing that popped in my head was also how this compares to Apollo CLI's type generation ([https://github.com/apollographql/apollo- tooling](https://github.com/apollographql/apollo-tooling), formerly apollo- codegen).

On a cursory glance, it seems like with this tool, you write a JS object in the same shape as the query, manually specifying the type of each field in that object, and then it generates the query for you to pass to graphql clients, as well as the types associated with the result of that query for you to use in your app. Whereas with Apollo's codegen, you write the query in graphql syntax, then run a CLI command to generate the types associated with that query for you to import and use.

It seems with this tool, you'd still have to manually state the type of each field (when that information can be perfectly inferred from the schema as demonstrated by Apollo's codegen), and you'd lose the ability to take advantage of tools that work with the graphql syntax to provide things like autocomplete based on your graphql schema while you're writing the query itself ([https://github.com/apollographql/vscode- graphql](https://github.com/apollographql/vscode-graphql), for instance). Unfortunately I'm not yet able see any benefits you'd get over Apollo's codegen in return. Happy to be enlightened if I'm missing anything.

<comment><USER7> That's my understanding as well. This would help for tools other than Apollo which do not have the codegen capability but as it is I'm not sure what the benefit is for Apollo users.

<comment><USER8> Apollo CLI isn't even coupled to Apollo Client though. You can use it to generate types for any graphql query as long as you can also provide a schema for it to infer types from.

</comment></comment></comment></comment><comment><USER9> Doesn't Apollo's Codegen tool already solve this? Works like a charm [https://github.com/apollographql/apollo- tooling?files=1#apol...](https://github.com/apollographql/apollo- tooling?files=1#apollo-clientcodegen-output)

</comment><comment><USER10> See also [https://github.com/convoyinc/ts2gql](https://github.com/convoyinc/ts2gql)

</comment><comment><USER11> Couldn't `json-schema` play major role in modeling the redundant things? FeathersJS goes this way....

<comment><AUTHOR> As far as I know, json-schema just checks type in runtime right? I don't know how we let TypeScript check json-schema type in compile-time.

</comment></comment><comment><USER12> Is there a similar conversion tool for Flow types?

</comment><comment><USER13> This looks great. Thanks!

<comment><AUTHOR> Thank you!</comment></comment>


Nearby planet is a target in search for life - <AUTHOR> http://www.bbc.co.uk/news/science-environment-41995572 <comment><USER2> And pray that there's intelligent life somewhere up in space cause there's bugger all down here on earth</comment>


Rand Fishkin: Inbound Marketing for Startups - <AUTHOR> http://hackersandfounders.tv/RDmt/rand-fishkin-inbound-marketing-for-startups/ <comment><USER2> The best content came out of the Q&A at ~69m. A guy asked two questions: (1) how do you find the angle about what to publish content about and (2) when do you start publishing content to get inbound traffic?

Rand responded: He goes to topsy top 1000 [1], alltop [2] to find featured blogs that are getting the most buzz, Google Plus popular section, the subreddit most relevant to you, and followerwonk [3] to see what the top 100 twitter accounts in your industry are talking about

Basically, all of the above actions get you immersed in the market you're trying to penetrate and gives you an understanding of what will be of value to them. You can then use this information to generate content that will go viral.

Unfortionately, he didn't answer the second question :(

[1] <http://topsy.com/top1k> [2] <http://alltop.com/> [3] <http://www.followerwonk.com>

<comment><USER3> Hey Dan - at 71:51, the gentleman re-asks the question (after I tackled the first part) and I give an answer :-)

</comment></comment><comment><USER4> Got an email that if I upvote this item on Hacker News I get two free months of SEOMoz. How much of that sort of stuff happens here? How many of the 127+ points this item has are from incentivized SEO?

<comment><USER5> Sorry about that confusion. I misworded that email.

That's not at _all_ what I meant, and I didn't mean to game the system at all. I apologize about the confusion.

For various reasons, I'm not really active on this community any more. So, I asked H&F members if they would be kind enough to do if for me.

I asked H&F members to submit and upvote, tweet, like and Google Plus to give Rand some press.

Rand flew down to SV on his own dime to talk to our H&F members for free. He didn't ask us to promote SEOMoz, and never required anything out of us. He was truly one of the most delightful, genuine and kind speakers that we've had at H&F. I'm more than happy to do whatever I can to help him and his company out.

BizSpark sponsored the event by buying everyone pizza and beer. H&F doesn't get a dime out of this. Hackers & Founders is completely boot strapped ourselves, and do a lot of this for love of the game. And, we're pursuing becoming a for benefit corporation.

When Rand and I first started talking, about speaking to our people a few months ago. I arranged for SEOMoz to give H&F members two free months of SEOMoz for free. I emailed that offer to our people last month, but no one signed up. I figured that after Rand spoke, people would be a bit more interested in trying the SEOMoz service out.

I emailed the link to the free trial out with the link to the video to our Meetup, because I'd received about 20 emails asking for both the video as well as the free trial in the past 24 hours.

The free trial is also publicly available as a sponsor link on our meetup page at <http://www.hackersandfounders.com>.

I apologize if people thought that I was trying to game the system. I'm not. I'm trying to give a friend, and a great entrepreneur a boost. He helped out community out a great deal. His writing has helped me out a great deal in the past.

And, for what it's worth, SEOMOz has an affiliate program. If people sign up for a one month trial, the referrers get $25. It's not really worth that effort for me, and that's not what H&F does. So, we chose to waive the affiliate fee and SEOMoz chipped in the extra month to help everybody out.

<comment><USER4> Clarification much appreciated. Original email (e.g. request for upvote) probably would have been fine if you hadn't presented the 2 months of SEOMoz as a prize for the upvote.

<comment><USER5> That wasn't my intent. I was trying to be funny rather than "pay" for the vote.

</comment></comment></comment></comment><comment><USER6> Rand, why did you choose to use the Hubspot term _Inbound Marketing_? _Inbound Marketing_ is more often used as a replacement for _Market Research_. Your definition really means _Permission Marketing_. <http://en.wikipedia.org/wiki/Inbound_marketing> <http://en.wikipedia.org/wiki/Permission_marketing>

In 2009, Hubspot decided to coin the term _Inbound Marketing_ in a new way so they can claim the space ("first inbound marketing software"). Since then, they changed the entire Google results (starting with Wikipedia) so that they come up on most queries. The rare times I used _Inbound Marketing_ with traditional marketers, they always meant _Market Research_.

<comment><USER3> I was never actually aware of the "market research" definition; this is the first I've heard of it.

At Moz, I've long been looking for a phrase that means "content marketing + white hat SEO + social media + email marketing + conversion rate optimization." Inbound marketing has come to take on that definition, and I like the terminology. Permission marketing always had an association to me with list building (usually email), but never SEO, social, CRO, etc.

If another term/phrase catches on that encompasses all those facets of organic/natural/inbound/white hat/mostly-non-paid web marketing, I'd likely switch to that. In the meantime, it's far easier and more comfortable to go with the prevailing convention.

BTW - Saw your other comment below and am totally flattered. Not sure how I can live up to that, but thank you :-)

</comment></comment><comment><USER7> Find the slides here: [http://www.slideshare.net/randfish/gaining-traction- inbound-...](http://www.slideshare.net/randfish/gaining-traction-inbound- marketing-for-startups)

</comment><comment><USER8> I was there last night. Rand is a supremely talented presenter and did a great job of explaining how early stage startups can gain traction through organic (inbound) marketing.

He explained the basic concepts of online marketing and the basics of marketing strategy in a supremely succinct and inspiring way. It was golden! It was entertaining! Highly recommended!

<comment><USER9> I was there and 100% agree on everything you said.

</comment></comment><comment><USER6> Back when I was doing SEO, Rand Fishkin was my hero. You could not find a more humble person, while delivering tremendous value in the white-hat community. I am glad he still speaks and educates as much as he can.

</comment><comment><USER10> This was a really fantastic summary of why you should do inbound marketing and how you can get started delivered in a lively and entertaining fashion.

Congratulations Rand! Looking forward to seeing more from you on the speaking front.

I can personally attest to the value of "mining the social web". When we first launched decal mockups[1] to get some eyeballs amongst designers my only strategy for getting traffic was to post it on HN.

When it slid off the newest page and into oblivion I was really down in the dumps but I just added a stream in hootsuite for the word "mockups", then anytime someone mentioned mockups I posted a link to the site and got 70 people signing up within the first week.

It's a fantastic way to engage with early adopters (although I would warn against automating it - I think possibly it was the fact that each message was personalised that meant I got very few negative reactions - only one that I can remember which was some guy telling me to "diaf" :)

[1] <http://www.decalcms.com/mockups>

</comment><comment><USER11> When asked about paid marketing. Starts around 74:30

"Holy crazy crap does retargeting work."

"If you do great inbound, the first money you should spend should be on retargeting... people that were sort of interested but left"

"...uses a company called has offers in Seattle - they've been very effective for us".

"would not recommend raw display. It will perform poorly for you."

<comment><USER12> <Shameless plug>

I'm part of a stealth startup that's handling retargeting for about 30 startups now and I can confirm that it is indeed a brutally effective method for acquiring users. We're seeing that on average, retargeted ads perform about 350% better than any other kind of targeted ad. It seems a little crazy until you recalibrate your understanding of what's happening. Instead of trying to push new information on a user (which no one likes), with retargeting, you're _pulling_ people back to something they've already expressed an interest in. It works marvelously.

Example: We're running retargeting for an SaaS startup that gets a lot of airtime on HN, and they're snagging new users at less than $2/head. Once these folks get on board, they spend on average $40/year on the service. Our little team had a "f___ yeah" moment after the 4th day or so when we saw how well it was working. We're now hustling to hire folks to meet the demand coming from word of mouth.

If any HNers on here want to ad retargeting to their startup, web app, side project, mobile app landing page, or whatever the heck you're building, hit me up at the e-mail address in my profile.

We're still building out our actual product so startups and technical people make for the best customers. Less explaining, more appreciation for results, more understanding when we goof up.

</shameless plug>

<comment><USER13> Do you offer anything over Google's boomerang retargeting?

We've already had decent success with that.

<comment><USER12> Massively wider reach for your ads.

My understanding of Google's program is that it runs your ad across its DoubleClick exchange. We run our clients ads across DoubleClick just like them... as well as the rest of the ad networks... plus our publisher partner inventory. Google's DoubleClick inventory is a part of our overall inventory.

<comment><USER13> I was under the impression that Doubleclick was the largest exchange by some distance.

How much wider reach do you get from going to multiple exchanges? It's maybe time I did some research on moving away from boomerang!

<comment><USER12> DoubleClick is very much the largest and awesomest exchange. But there's A LOT of display ads on the web.

The data we have suggests that DoubleClick offers up about 4b daily impressions to retarget against. The overall retargeting ecosphere that folks like us and a few others are retargeting against is in the 10-14b impressions/day range. DoubleClick's massive and have a lot of the best inventory, but it's still just a part of the whole.

NOTE: I'm sure there's other display-heads on HN who might have different data. Either way, Google's exchange is no more than 30-50% of the total exchange inventory out there.

</comment></comment></comment></comment></comment></comment><comment><USER14> Is this video worth watching? Why?

This comments thread contains several comments from people who seem to have got something valuable from this video, but I have not been able to gather what that something is. There also seems to be a lot of SEO fluff here, which should be downvoted.

<comment><USER15> It's definitely worth watching, IMO, especially if you view SEO as "fluff".

Rand does a great job of explaining how SEO and inbound marketing are attractive alternatives to interruption marketing. If you're annoyed by paid advertising and believe that what you build should benefit your users, then I think you'll get a lot out of it.

<comment><USER14> OK, I am convinced that I should take a look.

The "fluff" I was talking about is all the contentless puff comments that appeared, couched in un-HN-ish language: I guess they are a fan club from some SEO social network or another.

</comment></comment></comment><comment><USER16> Rand is a great entrepreneur and one of the world's foremost authorities on inbound marketing.

If you're a startup founder, you should watch this video. It's great content, well delivered.

</comment><comment><USER17> What a great speaker Rand is. Definitely makes me interested in the service. Loved the examples of real marketing such as urbnspoon, dropbox, seomoz, and simply hired.

Also, he gave 2 months of his svc away for free for the talk: <http://www.seomoz.org/partners/hackers> \- Found this in the hackers and founders site.

</comment><comment><USER18> This is a fantastic presentation, it brought me from a "I want to shoot myself" mood to "oh yeah there's hope!"

</comment><comment><USER19> Rand killed it last night! Well balanced talk from story, strategy to tactics...extremely powerful to see the juxtaposition of paid and inbound marketing. Earned media converts so much better on all levels. However he didn't talk about the speed of user acquisition...comparing both channels.

</comment><comment><USER20> I think it's a bit ironic given the nature of the talk that the link on the video page to seomoz.org has rel="nofollow" while comments down below don't have. No link juice for those who provide content(talk) and all the link juice for commenters.

</comment><comment><USER21> My personal favorite is towards the end of the talk when Rand left great tips (the last 15 minutes or so before QnA) The top 10 ways to get in bound traffic are practical and insightful for any early stage startup. It kicks ass!

</comment><comment><USER22> "You can't just do awesome shit in your products"

Amen!</comment>


Skipper – An HTTP router and reverse proxy for service composition - <AUTHOR> https://github.com/zalando/skipper <comment><USER2> Neat! We use a similar Go based proxy for our tier 1 ingress and routing at Walmart Labs (global eCommerce), with Lua/Go plugins for edge/serverless style backends. It is a custom/proprietary codebase but the tech stack has served us very well. Great to see open source projects with similar use cases. I may have to play with this for use in some personal/hobby projects.

</comment><comment><USER3> How does this compare to nginx or haproxy in terms of features and performance?

<comment><USER4> We skipper maintainers don't want to really comment on that, because it is very likely that if you do your own benchmarks you show only the good parts and not the bad parts.

From our benchmarks we can outperform nginx in the pure routing case, while nginx will outperform skipper in the pure sendfile case. HAproxy we did not tested, but I would bet it will be not different from the nginx case. IMO: in general use skipper as microservice router and nginx as streaming router that serves a lot of pictures or videos.

Feature wise we have a lot of things to add as HTTP router that you want to run in front of your microservices, please also see our docs: [https://opensource.zalando.com/skipper/](https://opensource.zalando.com/skipper/) Additionally we build a lot of Kubernetes integrations,for example [https://github.com/zalando-incubator/stackset- controller](https://github.com/zalando-incubator/stackset-controller) which reduces boilerplate and enables you to do automated blue-green deployments and [https://github.com/zalando-incubator/kube-metrics- adapter](https://github.com/zalando-incubator/kube-metrics-adapter) which enables you to do HPAs with custom metrics, for example hpa based on skipper route request per second.

</comment></comment><comment><USER5> We tried this out a year or so ago and found that it's performance wasn't suitable for our use cases, it would increase costs too much.

<comment><USER6> Care to share some details? What's your use case? How would it negatively impact it?

<comment><USER5> The main use case we tested with was for a data analytics pipeline to ingest telemetry events from video games, but would have been generally used across all our services, target was about 1m/RPS for our load test. The CoreOS ALB controller for K8s out performed it significantly (I don't have the exact stats now), albeit it's not as feature rich as Skipper.

<comment><USER6> Got it, very helpful.

We are looking at it to do dynamic routing from our system to the Internet and back. That means terminate the request on a client (server), route it to an exit node where it's more appropriate (for instance to bypass GEO restriction) and then send the response back to the origin.

We are looking at some other alternatives, like envoy + istio + gloo, but skipper seems more contained and less container depended.

<comment><USER7> Did you check out Ambassador by any chance?

<comment><USER6> I did. Its not that far from Gloo. I would like something that doesn't require crazy amount of tooling and does require containers

</comment></comment></comment></comment></comment></comment><comment><USER8> Skipper is now also part of the CNCF Cloud Native Interactive Landscape [https://landscape.cncf.io/category=service- proxy&grouping=ca...](https://landscape.cncf.io/category=service- proxy&grouping=category&selected=skipper)</comment>


Zoom deploys its core videoconferencing service on Oracle Cloud - <AUTHOR> https://www.zdnet.com/article/zoom-deploys-its-core-videoconferencing-service-on-oracle-cloud/ <comment><AUTHOR> Oracle must have cut them one heck of a deal.

<comment><USER2> If Zoom gets all cloud services forever free, it is still a bargain for Oracle.

First time in decades Larry can actually claim a legit cutting edge operation runs on Oracle.</comment></comment>