Cryptography Discussion: Speculation on "BULLRUN" (2013) - <AUTHOR> http://email@example.com/msg12325.html <comment><USER2> Said it before and will say it again: privacy on internet is a technical problem only up to a certain point. It becomes a political problem at one point.

The power of strong and asymmetric cryptography led a lot of programmers into the belief that this is a political problem that can be solved with technical solutions but it is not.

Whether it is a subtle influence as is described here or as a heavy handed approach like in China, politics trump technological means.

If your government is actively trying to undermine the security and privacy of your technological solution, you need to be outspoken about it.

<comment><USER3> Another point to add to yours is that there are so few people capable of understanding these convoluted protocols and cryptosystems. How many people are actively attempting to find weaknesses in AES, Elliptic Curves, SHA1, DLP, IFP? Also, often times those people currently examining these systems are the same exact people that were performing the state of the art cryptanalysis in the 90's

<comment><USER4> Like, the whole academic field of cryptography?

<comment><USER5> It's impressive how much progress that field has made since the 1990s. I know there are other criticisms of _Applied Cryptography_ , but we understand so much now that we didn't at the time it appeared.

Something I find a bit disturbing is how much of our understanding of particular issues seems to depend on brilliant individuals. This is a bit like the Bernstein monoculture article that was discussed here recently but I'm also thinking of several of the items from Boneh's RSA attack overview paper, or maybe Xiaoyun Wang's hash function stuff.

Clearly all discoveries are going to be made and published by _someone_ , but something about the academic field of cryptography keeps striking me as "wow, we're really lucky to have _that person_ in this field". And that's a bit concerning because this phenomenon seems to suggest either that the field is still pretty small or still pretty immature, and in that sense may still be missing several important discoveries, for all the progress that it's made since the early nineties.

<comment><USER4> That's kind of a strange takeaway from Boneh's RSA attack paper, which is a survey of other researchers; IIRC, no two of the attacks in that paper came from the same researcher.

Bernstein is a bit of an odd duck in this regard, but if you look at some of the other "great personages of cryptography", you'll see that they're minting PhDs who are themselves going on to do important work, so the capacity of the field is expanding, not contracting to a single Bernstein monoculture point.

Bernstein's position in the field of practical cryptography is a product of an almost monomaniacal focus on commodity hardware performance and ease of use. The Bernstein monoculture will pass --- probably soon, after CAESAR finishes, or if people start taking pq crypto more seriously.

<comment><USER5> > That's kind of a strange takeaway from Boneh's RSA attack paper, which is a > survey of other researchers; IIRC, no two of the attacks in that paper came > from the same researcher.

I think I had that sense about _individual_ items there, like Coppersmith's attack.

> if you look at some of the other "great personages of cryptography", you'll > see that they're minting PhDs who are themselves going on to do important > work, so the capacity of the field is expanding, not contracting to a single > Bernstein monoculture point.

That's great news.

</comment></comment></comment></comment></comment></comment><comment><USER4> It's amusing to me that this keeps coming up, because I'm 99.9% sure I know exactly who Gilmore is referring to here, and they're definitely not an NSA operative. Never attribute to state-sponsored malice that which is adequately explained by simple douchebaggery.

Further explanation:

[https://news.ycombinator.com/item?id=13221923#13223326](https://news.ycombinator.com/item?id=13221923#13223326)

<comment><USER6> From your linked comment:

 _I think this is the case, but I haven 't confirmed it_

I kind of feel like your comment here and the one you linked to are a bit of an _appeal to authority_ \- for me anyway, I'm no expert in this area, and you appear to know what you're talking about (generally speaking).

But then you added this gem at the end of the link comment:

 _Enemy action? No. Crypto standards groups don 't need enemy action. They are intrinsically evil, and need to be avoided._

Yep, Design by Committee.

<comment><USER4> I'm not seeing the appeal to authority. I'm saying I looked into Gilmore's claim about the IPSEC working group shenanigans, particularly about CBC IVs, that Gilmore appears to be wrong, and that the reality is komedy gold.

<comment><USER6> I meant insofar as I personally find myself thinking _tptacek_ is usually on the ball. I meant I find myself deferring to the knowledge of HN comments. Probably didn't word it right.

</comment></comment></comment></comment><comment><USER7> There's a reply _in the thread_ that directly refutes all these claims about IPSEC:

[http://www.mail- firstname.lastname@example.com/msg124...](http://www.mail- firstname.lastname@example.com/msg12497.html)

another one: [http://www.mail- email@example.com/msg124...](http://www.mail- email@example.com/msg12411.html)

Reposting spurious allegations years after they've been debunked does not help anyone.

<comment><AUTHOR> > Reposting spurious allegations years after they've been debunked

I had no idea this was the case.

<comment><USER4> Gilmore's IPSEC claims have already assumed urban legend status. Since only 0.000001% of those who see Gilmore's claims will ever see threads like these, we can be assured that the legend will be retold over and over again.

</comment></comment></comment><comment><USER8> And we just experienced a major consequence of the culture of agencies favoring offense over defense. The NSA could have been working with American companies to help secure their systems instead of hoarding exploits. And now civilian organizations are vulnerable to hacking by foreign powers. Election manipulation is what you get when you favor offense over defense. We're now not in control of our own coutry anymore.

Was it worth it? I guess for the stock prices of the contractors and the people the foreign power favors at the time. But everyone else gets screwed.

<comment><USER9> > We're now not in control of our own [country] anymore.

So who is in control of our country "now"?

<comment><USER8> Russia has effectively compromised President Trump, according to the CIA and FBI.

"Intel Chiefs Presented Trump With Claims That Russia Has 'Compromised' Him" \- [http://nymag.com/daily/intelligencer/2017/01/cia- presented-t...](http://nymag.com/daily/intelligencer/2017/01/cia-presented- trump-with-claims-that-russia-compromised-him.html)

<comment><USER6> It's hard to take seriously an article and media outlet that claims the Number 1 "explosive allegation" is this:

 _information allegedly includes a videotape of Trump watching several Russian sex workers urinate on the bed the Obamas slept in at the Ritz Carlton in Moscow._

Really? Who cares.

As to the second point, how _dramatic_. Russia rigged the US election? I far simpler explanation is that US politics really is on the path suggested in the film Idiocracy. You don't need an _external enemy_ to account for your bizarre politics, yourselves will suffice.

<comment><USER10> The allegation in the media was that Russia hacked the DNC email servers to discredit Clinton and allow Trump to win.

<comment><USER6> Right, I got that. I was attempting to draw attention to the fact that the article I was referring to put the erotica _first_ in the enumerated list.

If it's true, that Russia influenced the election, then the major scandal is not that Russia [whatever], rather it's that the US _fell for it_.

Anyway, I still have trouble getting past the idea that the Electoral College system in the US can result in a president who didn't win the popular vote. Before we go blaming anyone else for anything, perhaps we should get our own affairs in order. Generally speaking.

</comment></comment></comment></comment></comment></comment><comment><USER11> While it could be the NSA, I think with things like IPSEC simple over engineering is more likely.

Over engineering is an absolute plague in software. In ordinary cases it just makes things buggy, hard to maintain, and bloated and inefficient. In crypto though the consequences are much more severe since every little ounce of complexity in a cryptosystem exponentially increases the likelihood of exploitable bugs.

DJB's boring crypto talk is worth reading:

[http://cr.yp.to/talks/2015.10.05/slides- djb-20151005-a4.pdf](http://cr.yp.to/talks/2015.10.05/slides- djb-20151005-a4.pdf)

<comment><USER4> It was a combination of over-engineering, a lack at the time of understanding of the field of cryptography and a pervasive belief among IETF types that the field could be understood from first principles by anyone who was good at Unix, and standard-issue bloody-mindedness.

Phil Rogaway is one of the world's great cryptographers; it's from him that we get OCB, OAEP, PSS, UMAC, XTS, SIV, and many others. Even non-cryptographers might be familiar with him for his "Moral Character of Cryptography" paper†.

I finagled a spot next to him at a dinner in Chicago once and asked him why he doesn't participate in IETF crypto standards (even with a recent renaissance of CFRG with Kenny Paterson at the helm, more expertise is badly needed). The impression I got from his answer is that he'd foresworn that kind of work.

If you look at his experience trying to contribute to the IPSEC standard, you can see why: he enters mailing list threads making clear, obvious statements about cryptographic soundness --- for instance, "it's a bad idea to chain CBC IVs". He's immediately attacked --- and attacked personally, for instance by being referred to as a "so-called" cryptographer (or something like that; I'm going from memory) by a clique of standards nerds. Rogaway goes so far as to circulate a petition/critique from other cryptographers --- people like Ron Rivest --- and that's shot down as well. The standard is finalized with things like chained IVs in it.

That's not enemy action. Or, if it is, the enemy is the standards process, not the NSA.

† _[http://web.cs.ucdavis.edu/~rogaway/papers/moral.html*](http://web.cs.ucdavis.edu/~rogaway/papers/moral.html*)

<comment> Ar-Curunir > "so-called" cryptographer

That would be an astoundingly stupid thing to say about Phil Rogaway...

<comment><USER4> I'll find the actual mailing list post, but to get a flavor for what Rogaway dealt with at IPSEC, here's a snippet from a post Pinboard coughed up for a simple [rogaway ipsec] search. This is Perry Metzger, who is just my favorite.

 _It appears that by failing to be as vicious as possible about Phil Rogaway 's lack of understanding of the architecture of IPSP that I have inspired people to take him seriously. It also appears that Phil has been lobbying people to have them comment. I can understand how even an intelligent reader, going through his comments, could become confused about the architectural issues here. However, let me say that I found his comments to be almost completely without merit. Other than a few comments about places where the text used ambiguous language (i.e. textual ambiguity) I found almost nothing of value in what he had to say._

Later:

Found it. It's Bill Simpson:

        > You do not facilitate analysis
        > by saying that Photuris is only required to work when its
        > primitives are drawn from a certain concrete set of possibilities;
        > exactly the opposite-- you render cryptographic analysis impossible.
        >
        Thank you, thank you!

        It gladdens my heart to hear that *self-described cryptographers* find
        that analysis is impossible!

        I was worried that there would be some subtle flaw that would facilitate
        cryptanalysis.  Now that you have assured us that it is not possible,
        that makes Photuris the only protocol that has ever come to perfection!

Emphasis mine.

<comment> Ar-Curunir Wow, this Bill Simpson person does not sound like a nice person, nor a smart one...

<comment><USER4> Here is the problem: Bill Simpson is actually _very_ smart, and well- respected. But IETF-land is an alternative universe that strongly prefers its own norms and processes above any other influences. People get involved in standards work and build social capital within IETF working groups, and feel threatened by and dismissive of outsiders. This happens with, I think, all standards groups.

The irony is that the IETF was created in part as a reaction to these standards group pathologies. But they're too powerful to resist.

<comment><USER11> ... and now we know why most network protocols are over engineered junk.

</comment></comment></comment></comment></comment></comment></comment><comment><USER12> Regarding end-to-end encryption on phone calls, it's pretty much illegal for telcos to deploy in the US or Europe due to lawful intercept requirements. That, not NSA meddling in standards committees, is what keeps carriers from deploying it.

</comment><comment><USER3> Just take for example Elliptic Curves which sit at the crossroads of analytic theory, theory of functions, abstract algebra, algebraic geometry and number theory. It is nearly impossible for a single person to bear the cognitive overhead needed just to understand how might one approach attacking Elliptic Curve systems

<comment> Ar-Curunir Not really, there's a bunch of groups around the world that work on breaking elliptic curve crypto.

It takes only a few years of mathematical training.

<comment><USER4> Seriously. It takes something like seven years, not counting undergraduate studies, to become a practicing physician. And once you achieve that, you can still only handle one physician's worth of case load. It takes _far_ less time to learn enough math to become dangerous to a particular subfield of cryptography --- and once you achieve that, you have a decent shot at changing the state of the art _for the entire world_.

I'm not seeing the legitimate concern here.</comment></comment></comment>


Lessons Learned – 10 years of running a software consultancy - <AUTHOR> https://dockyard.com/blog/2019/12/19/lessons-learned-10-years-of-running-a-software-consultancy <comment><USER2> $200k revenue per employee are dismal numbers for a high-end US based consulting company of any sort. Is it just the problem with competing with India and Uzbekistan (where my developer is from)? My own consultancy of one does $500K/per employee and I have available time to get to $1 million. The Chasm Group told me a decade ago that it was easy for one of their consultants to bill $2 million.

I just can't imagine employing 100 developers who must get at least $150k in salary + $30k in benefits and charging so little for their time. Remind me not to get into softwre development.

<comment><USER3> It's not easy, margins are thin but it's the nature of the beast. We were able to maintain a 20% - 25% margin over the past few years.</comment></comment>


The illusion of control in web design - <AUTHOR> http://alistapart.com/article/the-illusion-of-control-in-web-design <comment><USER3> I wish Web Development would eventually get promoted on eye height with other disciplines like Python or C programming. Of course the hurdle is and also has been low to start it. But to write highly available Web Apps that are snappy what not at the same time, one needs to be aware of various pitfalls and keep up with news.

In Python and C everybody accepts that new versions introduce new features that are not backwards compatible and that errors stops the normal execution flow. For some obscure reason people complain when JS functions stop executing when uncatched errors occur. Or the classic: people complain about surprising result when you add values of different types. They can be happy this produces _anything_ at all! :D

It's a mystery to me why Web Development is treated and evaluated so differently from "normal" Development.

</comment><comment><USER4> Boss tells you the page has to load in one second.

Team works for months getting it down below one second.

App launches, business team loads it up with so much 'analytics' software that page load time is... 4 seconds.

Tear out hair.

<comment><USER5> You forgot the part where the Dev team needs to get it under one second, and like most of the articles telling developers to get their experiences loading under one second, completely forget to give the parameters under which "one second" is measured.

<comment><USER6> Amazing how often that gets forgotten, the internal ERP I develop (inherited) did horrible things, domloaded could be 5-6s on an internal gig network.

It wasn't until I demonstrated what that would be like for a sales rep using a VPN on the road or at a suppliers in India that my boss started to realise why I care about crunching assets, rewriting code to not do stupid things etc.

Speed is nearly always good because of the edge cases.

</comment></comment></comment><comment><USER7> I remember getting asked in a 2006 interview what websites I followed as a web developer and I mentioned AListApart, much to the delight if my interviewer and future boss.

12 years later, I honestly can't remember visiting the site since despite being in the field and owning a web development shop.

I've googled possibly thousands of web dev questions every year and not once has AListApart come up anywhere in the results.

Amazing to see that they're still around and producing content.

<comment><USER8> Same here. A List Apart and Smashing Magazine were my daily readings. I just entered the latter, and I can not understand its new design.

<comment><USER9> For whatever reason, Smashing Magazine decided the first full page of content would be featured stuff from the last couple of months/years rather than the new content people come to a blog/magazine for. It's certainly confusing, especially when the red colour scheme is disabled and the featured content blendes into the new stuff.

</comment></comment></comment><comment><USER10> "We all want to build _robust and engaging web experiences_. We scrutinize every detail of an interaction. We spend hours getting the animation swing just right. We refactor our JavaScript to shave tiny fractions of a second off load times."

"Two hundred of his employer's sites were instantly reduced to _plain old semantic HTML_. No CSS. No images. No JavaScript."

I am an end user. I read the text of the webpage. I believe I recieved the full import of the author's message. To read the webpage, I only utilised "plain old semantic HTML. No CSS. No images. No JavaScript."

Questions: 1. Is the page (in the way I the end user consumed it) "robust"? 2. Did I the end user have an "engaging" experience? 3. Who other than I the end user is able to answer questions 1 and 2? How? 4. Do all webpages need to be vectors for the delivery and automatic execution of (e.g. JavaScript) programs in order to be useful to end-users?

Answers: (speaking only for myself) 1. Yes 2. Yes, enough for me to comment 3. Not sure; seems like a subjective determination only the end user can make 4. No. For example, I read the webpage that is the subject of this comment without using graphical fonts, CSS, images or JavaScript. I focused on the author's words alone. I do not believe I missed anything in the author's communication.

</comment><comment><USER11> Maybe it's because I'm younger (read: under 30, but pushing it), but I simply don't have patience for the attitude expressed in this article.

The author's single main point (as I read it) is that he just wants his content to "keep working" without having to put in any ongoing effort or maintenance, and without keeping up with relevant news.

That's _never_ going to be a reality in an ecosystem like the web, and I'd argue it's probably not a reality in any consumer ecosystem available today (mobile/desktop/server/etc). They all update, and require applications to keep up with at least minor tweaking.

The part I lose patience with is this: he's advocating for a complete loss of user security and privacy in favor of ease of use for HIM, the developer. Because he won't or can't do his damn job, or because he values their (and by extension: mine) privacy and security so little he's not willing to put in the time or effort.

</comment><comment><USER12> As per the article, one of my major clients was dead in the water this week when their IT team rolled out updates to their system which included upgrading Chrome on all PC's in the office.

They are a broker agency for a major financial institution, and all of a sudden, they could not log in to their major vendor's financial transactional system - because it was secured with a GeoTrust cert that didn't have the appropriate root chain and was thus rejected by Chrome. Complete stop. In many ways, much worse than the whole Y2K thing.

The parent financial institution had no idea about the cert, and it wasn't until I sent an email to their IT department that they realised what had happened (because internal tests (with different browsers or older Chrome versions) were still working fine).

It is getting to the stage where we need to have some sort of overriding, holistic approach to managing these sorts of issues and upgrades. It is too easy to think everything is ops normal if you aren't using a particular browser or framework etc. I fully admit that we are guilty of this too - <USER2> only test our web development work on a narrow subset of browsers and hope for the best. That target is getting smaller and smaller every day.

<comment><USER13> Or, don't roll out changes to everyone at once?

There are some benefits to a certain level of heterogeneity.

<comment><USER14> There are other benefits to a rolling restart/reset:

[https://rachelbythebay.com/w/2015/05/02/lockstep/](https://rachelbythebay.com/w/2015/05/02/lockstep/)</comment></comment></comment>


Just how bad are hard drive prices going to get? - <AUTHOR> http://www.extremetech.com/computing/103711-hdd-pricewatch-you-know-where-its-going-we-tell-you-how-much-its-going-to-hurt <comment><USER2> _No one has actually run out of drives yet. Most manufacturers have stated they have drives enough to last them through the end of November_

Actually, the situation looks much worse than that, from where I sit. I work for a major "large account reseller", and my code is what builds the customer catalogs, so I've got an intimate view of this.

As the drives become unavailable, one would expect them to be marked as backordered in the datafeeds we get from the suppliers. But the situation is so dire that two of the three major suppliers (Ingram Micro, Tech Data, and Synnex) have actually removed hard drive products altogether from their feeds.

(my code doesn't appreciate this: it knows the difference between backorders and discontinued products!)

</comment><comment><USER3> What most articles fail to address is that most of the big brands have factories here and that Thailand accounts for a way too large share of the production of hard drive parts, regardless of brands. In other words, Thailand is the SPOF of the hard drive industry.

Also, FYI floodings are expected to last one more month (water just isn't flowing that fast) and factories will need time to recover and reach 100% operation (not to mention the overall infrastructure damage). The one month thing is an optimistic estimation from the government. A practical example: some Pakistanis flooded last year were finally getting back to normal when they got hit by this year's floods. No one really know how long it's going to last in Thailand.

WD, in a statement a few days old, said it expected to get back to full normal in the summer.

Edit: for those who just had no idea: [http://www.boston.com/bigpicture/2011/10/thailand_flood_reac...](http://www.boston.com/bigpicture/2011/10/thailand_flood_reaches_bangkok.html) (I used to live a couple of blocks away from picture 7).

<comment><USER3> I felt a bit bad a about the lack of figures in my assertions.

Regarding supply:

"HDD shipments in the fourth quarter will decline to 125 million units, down 27.7 percent from 173 million in the third quarter [...] Thailand is the world's second-largest producer of HDDs after China."

Regarding parts:

"component makers like Nidec [...] supplies more than 70 percent of all global HDD motors"

In other words, production will likely continue to drop until production resumes.

Source:

[http://www.macworld.com/article/163336/2011/11/thai_floods_h...](http://www.macworld.com/article/163336/2011/11/thai_floods_hit_q4_hard_drive_production.html)

</comment></comment><comment><USER4> >Here's the really bad news. No one has actually run out of drives yet. Most manufacturers have stated they have drives enough to last them through the end of November, meaning that the current price hikes are the result of shipment reductions, supply-side manipulation to reduce demand, and undoubtedly some degree of speculation by the middle men. This last factor has an impact on the total price, but it's not what's causing the problem.

>First off, the so-called "gray" market for hard drives is going to explode....DigiTimes reports that gray market HDD sales are already booming as panicked OEMs have tried to lay in additional inventory to see them through the coming months.

The world must be a scary place when you don't understand basic economics, with a boogeyman man behind every corner.

<comment><USER5> Could you elaborate on your criticism?

I don't understand basic economics. It's something I regret and would like to change.

<comment><USER4> To add to what mkeblx said: what's happening is not only what's to be expected, it almost exactly what you want to happen ideally.

If suddenly the world supply of hard drives is cut to 10% of its normal values by a chance event (and we concentrate on the time period before new compensating production can be started) then those hard drives become more valuable. The price goes up, so that the people who are willing to pay the most for the drives get them. If Bob will only pay $100 for a drive because he's just using it to store his 2TB of cat pictures, but Sam will pay $500 because he needs the drive to run his business, then Sam will get the drive but Bob won't. If you try to hold down prices artificially with legislation (price ceilings) then each is equally likely to get the drive, which most agree is not good.

(Now, there are a million caveats to this naive Econ 101 treatment, especially regarding basic necessities--water, food, shelter--and disaster situations. And any normative "should" statement requires people to agree on a theory of ethics/morality. But in this case, most will agree that the basics of supply and demand lead to the appropriate outcome.)

\</comment></comment></comment><comment></comment><comment>

Incidentally, I was surprised to find that the Khan Academy has a bunch of macroeconomics and finance lectures, but little in the way of basic microeconomics. (This is especially funny because microecon is better understood.) Anyone know a better source for an introduction to supply and demand?

<comment><USER6> Yeah, I can't understand the widespread ignorance of/indifference to micro either. It's like people either think it's less important (because of the name) or that it only applies to people running manufacturing or retail businesses. Macroeconomics is seriously incomplete, so when it fails to predict the future well people dismiss economics as a whole, not realizing how fantastically useful and illuminating micro is. Admittedly micro suffers from not having a good theory of oligopoly, but I venture to suggest that that's a bit like the 3-body problem.

For philosophical types, I recommend 'New Ideas from Dead Economists' by Todd Buckholz. If you just want to get going with the math, I like the Barrons Business Review book on Economics by Peter Eisen. You should be able to find either of these used for a few bucks.

<comment><USER7> I don't think it's an indifference to microeconomics in particular so much as an indifference to anything that doesn't seem like it's especially relevant to one's life at the moment. People are indifferent to structuralist anthropology too, just to pick a random example. I agree that people are probably misinformed as to how useful microeconomics might be to their life though. It's a fantastically useful subject.

The reason macroeconomics is on the Khan Academy and has more general interest these days comes from the fact that people feel like their lives are in turmoil due to the economy, the real estate collapse, and Wall Street, and they don't understand how any of it works. Macroeconomics may be incomplete and perhaps even problematic, but it's the subject that can most shed a light on complex interconnected problems as opposed to local specific ones.

<comment><USER6> Agreed...I just have my doubts about how well one can really understand macro without a firm grasp of micro. Some people reflexively dismiss economics in general as just so much dogma, and it's hard to make the case for economics as a discipline when micro is so poorly understood.

</comment></comment></comment></comment><comment><USER8> why have they added 100% to all the percentage price increases? if something cost $100 and now costs $150 then the price _increase_ was 50%, not 150%. grumble grumble.

<comment><USER9> I don't know if they've updated their chart since your observation, but the math looks right to me at this writing.

The WD10EARS drive (first row) was selling for $60, now sells for $140, and that is indeed an increase of 133%. The MP4 drive (last row) has risen from $50 to $100, and is noted as a 100% increase.

I think the chart would be improved by showing both the old price and the new price, making it more obvious how they arrived (correctly or otherwise) at the percentages. This way, checking the math requires visiting Camelegg oneself.

<comment><USER8> huh. it looks like they fixed it. i didn't take a snapshot, but originally no value was under 100% and several were over 200%. and i checked the disk that was shown in the plot above.

oh, and they actually say so in the table caption: _This graph was updated after publishing to fix the percentages._ (although it's the table that was fixed, not the graph...!)

</comment></comment></comment><comment><USER10> I think the best thing for everyone to do is to calm down and not go running to Costco/Amazon/Newegg to hoard hard drives.

[http://www.npr.org/blogs/thesalt/2011/11/02/141771712/how- fe...](http://www.npr.org/blogs/thesalt/2011/11/02/141771712/how-fear-drove- world-rice-markets-insane)

The perception of scarcity, which leads to hoarding, only makes the scarcity problem worse for everyone.

<comment><USER11> It can be good business to hoard and then, after hoarding drives up scarcity, re-sell at a higher price (the ticket-scalper business model).

<comment><USER12> I couldn't tell if you were being sarcastic since you didn't offer any explanation, but it is true and wuster is wrong.

Hoarders/speculators help by smoothing the scarcity and resulting price increases over time. By buying things up early, they increase the price and scarcity early, which gets people motivated to switch to alternatives when they can (and warns people who weren't paying attention to whatever caused the shortage, the floods in this case, of the problem). When they resell later, their stock keeps the shortage and price increases from being as extreme as they would otherwise get without the hoarders.

<comment><USER13> That certainly can happen under some circumstances, but for it to work, a number of factors have to be true.

For one, the shortage has to be a real one, and not directly caused by hoarders, as happened with toilet paper during the 1973 oil crisis. In this case, the hoarders pretty much hurt everyone (other than providing a very clean and clear example of the Thomas Theorem).

For another, the hoarders actually have to sell around the height of the shortage. If they sell after the shortage is resolved, then they took what they were hoarding off the market only to resell again when it was no longer needed and probably took a loss in the process.

So, hoarders can certainly help smooth out a shortage, especially an unexpected one, but it will not always work out that way.

</comment></comment></comment></comment><comment><USER14> I was going to purchase a new NAS yesterday but they now only allow each customer to have a single hard drive with a purchase.

</comment><comment><USER15> Take a look at <http://camelegg.com> (a Newegg price tracker). Search for a hard drive, say 'Western Digital Caviar Black'.

Click on any of the drives and notice the more than 100% price increase on every single drive.

</comment><comment><USER16> Even though SSD's are still expensive (but well worth it in my opinion), we could see the $$/gb come close enough for them to cross into mainstream much much quicker. Most people honestly don't need 2-3 Tb's of space. It's nice to have, but more often then not it's not used up. And if you need more, you can always buy an external to store your media.

So if the price of a standard 2TB harddrive hits say $300-400, then it would make more sense to throw in a 256Gb SSD drive. Or even a 128Gb drive. It's small, but most people don't honestly use it. Plus it makes the computer feel many many times faster...

<comment><USER17> Isn't there going to be an increase in SSD's too?

<comment><USER18> I would expect an increase in SSDs, especially since they are a "substitute good" for HDDs.

<http://en.wikipedia.org/wiki/Substitute_good>

</comment></comment></comment><comment><USER19> Just give it about two years, the hard drives will go the way of the dinosaurs.

Hard drives? What's that? It'll all be solid state drives.

<comment><USER20> No, a roughly 10x price difference will not be eliminated in two years.

</comment></comment><comment><USER21> I heard this is all because Goldman added hard drives to their commodities index. ;)

</comment><comment><USER22> flash floods?

<comment><USER3> Monsoon floods. Way too much and monsoon rainfall combined with poor governance. Officials got a warning last year but didn't listen. Over 500 death so far.</comment></comment>


Why I wouldn't recommend vim (or emacs) to developers (2014) - <AUTHOR> http://dorinlazar.ro/selling-vim-emacs-to-kids-part2/ <comment><USER2> How many languages does your IDE support? How long will it take to implement a decent support for your new DSL with maximum a dozen of users in your IDE of choice?

After answering these questions you'd understand why Emacs (or vim to a lesser extend) are superior.

</comment><comment><USER3> "My question: Is the time invested in vim worth it? My answer: no, unless you are bound to a console in a way or another. "

Well, a lot of people are bound to a console.</comment>


Mods are moving from bedroom to boardroom - <AUTHOR> http://www.guardian.co.uk/technology/2008/nov/20/mods-modding-valve-corporation

<comment><USER2> I love VALVE so much. If it wasn't for them, good old fashion FPS would be practically dead on the PC. To top it off, STEAM is amazing... so much cash generation.

Even though I've been pinching my pennies, they took my $45 for Left 4 Dead. Haven't had this much fun in a longgggg time. As the recession tightens, $45 goes a long way providing entertainment value... I'll play this game for months.

<comment><USER3> Couldn't agree more, I play CS:S and HL2 whenever I can and am thrilled I don't need discs, CD keys or have to worry about patching my shit (or even 'installing' my games on new machines or reformatted ones). It's awesome for a "grown up gamer" like me who doesn't have a lot of time to play.</comment></comment>


Bee-friendly insecticides closer to reality after breakthrough development - <AUTHOR> http://www.independent.co.uk/environment/insecticides-bee-friendly-not-hurt-crops-plants-development-a8072421.html <comment><USER2> I thought that colony collapse wasn't totally caused by pesticides, but mites [1]. I'm not 100% sure why bees have been more susceptible to mites now, though. Possibly because of some lack of diversity in the environment?

[1] [https://www.livescience.com/20815-honeybee-collapse-mite- vir...](https://www.livescience.com/20815-honeybee-collapse-mite-virus.html)

<comment><USER3> "Like a teensy vampire, a Varroa mite attaches to the body of the bee and sucks out its internal, bloodlike fluid. During this sucking, the mite passes deformed wing virus (DWV) directly into its host's body. Once the bees start to show the resulting deformation, they usually die within 48 hours."

Thats pretty nuts! But it seems like this might have been isolated to Hawaii but possible in locations where varroa and deformed wing virus co-occur. Though lack of biodiversity appears to make bees more susceptible to diseases which lead to colony collapse disorder (CCD) [1].

[1] [https://animals.howstuffworks.com/insects/bee8.htm](https://animals.howstuffworks.com/insects/bee8.htm)</comment></comment>


How to Hack a Turned-Off Computer, or Running Unsigned Code in Intel ME - <AUTHOR> http://blog.ptsecurity.com/2018/01/running-unsigned-code-in-intel-me.html <comment><USER2> This PDF might be news to many; click 'past' to see previous submissions -- last month's got traction:

[dupe] [https://news.ycombinator.com/item?id=16015539](https://news.ycombinator.com/item?id=16015539) (543 points, 107 comments)

HN user saulrh mentioned that the list of requirements "does not seem incredibly unusual" for enterprise setups with AMT on.

Pre-Meltdown/Spectre this was 2017's "big deal" re:Intel; nearly all of the varying degrees of paranoia in the previous discusson seem a lot more reasonable with the benefit of hindsight. (If any more AMT info has become available thanks to Meltdown/Spectre-enhanced reverse engineering I would appreciate a heads-up; example vs SGX: [https://github.com/lsds/spectre- attack-sgx](https://github.com/lsds/spectre-attack-sgx))

<comment><USER3> I thought it's not possible to paste the same link twice in HN, yet this appears for the 3rd time, as far as my memory permits.

</comment></comment><comment><USER4> OK, so the computer and network switch are connected to a UPS power supply. Kill the power for both. System is now down...

Intel needs get their act together or remove this features entirely. Clean it up.

</comment><comment><USER5> I didnt see mention of this in the article but I thought accessing a powered- off machine required usage of the 3G wireless support built in to the vPro line of intel chips.

<comment><USER6> > the 3G wireless support built in to the vPro line of intel chips

Yikes. That's the first I've heard of this. It's terrifying that even exists as an option, given how much of a strategic military benefit it provides to whoever can pull Intel's strings.

<comment><USER5> scary stuff ben_w look it up 3g support has been in the vPro line for the better part of a decade.

call me a conspiracy theorist if you like but i'll bet you dollars to donuts wireless powerless remote management exploits exist in the wild for these intel chips.

and by wild i include state-owned in there

edit: if you have one of these chips you can disable the feature in bios

<comment><USER6> I just did. I agree. And I cannot because I have a mac.

</comment></comment></comment></comment><comment><USER7> Does AMD's PSP have the same security vulnerability?

<comment><USER8> Likely not the same, due to independent implementation, but it'd be foolish to think it didn't have security flaws equally as severe.

<comment><USER9> Can you elaborate?

From what I understand (I'm not well-informed though), those security flaws stem mainly from carelessness by Intel. So this would assume AMD acts equally careless, which may or may not be true.

<comment><USER10> I think the argument is that AMD's implementation is similar in complexity and any sufficiently complex implementation will likely have vulnerabilities, sloppy or not.</comment></comment></comment></comment>


Amazon warehouse workers pee into bottles to avoid bathroom breaks - <AUTHOR> http://uk.businessinsider.com/amazon-warehouse-workers-have-to-pee-into-bottles-2018-4 <comment><USER2> Why don't they load one of those port-a-potties on one of those Kiva robots and drive it over to your work area. It's still in human..but better than a bottle.</comment>


When hardware Kickstarters ship - <AUTHOR> http://engineering.koalasafe.com/when-kickstarters-ship/ <comment><USER4> I've shipped one hardware product on Kickstarter [1] and I'm in the process of fulfilling the second [2]. Lessons I've learned are:

1\. Design with your factory. Finding a good supplier is important but the real work starts once you've shaken hands. Your factory is your greatest resource as a presumably inexperienced hardware designer. It's like having an expert-level consultant work on your project for free, so take advantage of it.

2\. Keep it extremely simple. MVP applies here. Your project will probably fail if it does not have the absolute minimum viable number of hardware features. The majority of your effort should be spent thinking about how to simplify your designs. Avoid moving parts if possible, and design parts that can be produced with simple tooling.

3\. Your margins should be higher than you think. Think long and hard about your pricing before you launch your Kickstarter. Chances are, your MSRP is optimistically low. Bringing a hardware product to market involves lots of expensive rabbit holes. High margins will save you from death.

[1] [https://www.kickstarter.com/projects/rideye/rideye-the- black...](https://www.kickstarter.com/projects/rideye/rideye-the-black-box- camera-for-your-bike)

[2] [https://www.kickstarter.com/projects/voltus/voltus-mobile- po...](https://www.kickstarter.com/projects/voltus/voltus-mobile-power- expansion-for-your-macbook)

<comment><USER5> Yes, I've shipped a hardware project on kickstarter, and (just) on time - <USER2> original article is a tad unfair, as if they were the only ones to ever ship.

And I designed my own hardware ..... the trick is to design your hardware BEFORE you announce your kickstarter, not after ....

<comment><USER6> Yeah, I thought the title was a little exaggerated, too. They aren't the only Kickstarter to ship hardware on time. I shipped my hardware Kickstarter on time, and I did all the hardware and software design, and made the product in the US. [https://www.kickstarter.com/projects/synthino/synthino-xm- po...](https://www.kickstarter.com/projects/synthino/synthino-xm-polyphonic- midi-synthesizer-and-groove)

<comment><AUTHOR> Hehehe, yeah admittedly the "actually" part was exaggerated, but it definitely hit a nerve. There is this sort of tacit understanding hardware kickstarters are often late, but obviously not all, as all the good folk who have posted their own on here have shown.

</comment></comment></comment></comment><comment><USER7> As someone who's now shipped 2 hardware KickStarters on time (both of which were bigger than KoalaSafe), I find it a frustrating when people post up 'hardware KickStarters never ship'. It's just not true.

It's definitely 'buyer beware', and if you back a KickStarter that shows loads of renderings and no working finished product then you may hit trouble - <USER3> many people come to KickStarter with a working product, having already done their homework and made arrangements with a manufacturer. Those people will almost certainly ship, and it's a shame that other failed KickStarter projects make them look less legitimate.

But I totally agree with polar8 on this...

1\. Design with the factory has been true for me. I did one KS in China, one in the UK - and the factories work totally differently. The time it takes to get things arranged is insane, and you absolutely need to not only have a manufacturer, but to have a design that they're happy with and can source parts for before you KickStart if you plan to ship on time (even if you plan on tweaking the design a bit later).

2\. Sourcing - When you order 1000s of something, suddenly lead times matter. Generally you can't just go to Farnell and get things next-day, if they're not in stock, 13 week lead times are not uncommon - and a company can have 4000 items in stock one day, and they'll be gone the next (so checking stock levels is not enough!).

3\. Features - definitely be sensible. Listen to your backers but be very careful about adding their suggestions. Changes really set you back, and the most vocal backers views are almost certainly not those of the majority. Adding features in software after the ship date is easy and people like it, but delaying the ship date for features would rarely be appreciated.

4\. Margins. I think people feel bad about adding a big margin, but you've got to. There are loads of hidden costs, and most backers would prefer to pay a bit extra and have you still making and supporting devices 2 years from now.

<comment><USER8> I completely agree. As a hardware maker (e-watches) with KS experience (2 campaigns), I find it frustrating that hardware projects on KS start with a negative perception from the public. It seems to me that a track record indicator is missing on KS. Like ebay feedback or a star-rating system...something that people can quickly look at and determine the level of reliability of a returning hardware maker. The number of project created is not enough...it does not speak about level of satisfaction.

</comment></comment><comment><USER9> As a hardware maker on Kickstarter who is about to ship [1], I can sort-of agree with what the article is saying. Yes, one of the most important things is to find THE right partner in China, as that can easily make or break your product.

However, if you're afraid to build your own hardware (or at least drastically modify something pre-existent), you're severely limiting your flexibility and the areas where you can innovate. Maybe it worked well for Koalasafe, which sounds like could have very well be built as just a modified version of OpenWRT with a simple installer. But it certainly wouldn't work for more than half of the other hardware projects out there. Look at the most succesful projects - Pebble, Coolest Cooler, The Micro, Dash - none of these could have gotten where they are without custom firmware.

Going back to KoalaSafe - the $100k they raised may sound like a lot of money, but it's certainly not enough to develop the kind of hardware they are using. It's enough maybe for the software part and some prototypes. You have to set your expectations straight too, and I do believe they did the best anyone could do with that money. Congrats on delivering!

[1] [https://www.kickstarter.com/projects/1635386542/anymote- home...](https://www.kickstarter.com/projects/1635386542/anymote-home-your- phone-the-ultimate-universal-rem)

<comment><USER10> I remember reading a postmortem about a failed hardware Kickstarter campaign (some photographic accessory: a flash remote?) and they said they contacted a professional manager from the industry who told them he wouldn't even try developing new hardware without a few million in funding, tens of millions being more common. So there, turns out making new hardware is really expensive.

<comment><USER11> Wow, pretty bad advice they got... The little company I work for does high end microwave equipment (satellite terminals, RF conversion equipment, 5Gbps ultra-low-latency terrestrial links used for high frequency trading, etc.) and only turns over a few million dollars per year...

I would be surprised if a flash remote cost more than two or three hundred thousand to develop and productise, tool up and do a small production run, but that's assuming you have a team with the right skills. If you're paying contract design houses then I guess it would be a lot more expensive.

<comment><USER10> As I understood the advice, that's what kind of budget it usually takes, at least _in the industry of photography_ , to reliably create a new hardware product _with the level of polish_ that the market is used to.

</comment></comment></comment></comment><comment><USER12> As someone with over 30 years in hardware + software + mechanical product design and manufacturing one thing that always bothers me on Kickstarter is the dishonesty of funding goals.

Now, I do realize quite a few project owners come at it without the product manufacturing experience. I definitely get that part. Yet, I don't see it as an excuse. People need to do due diligence and get numbers closer to reality.

I remember one of the first (if not the first) RGB LED light bulb project (don't remember the name), perhaps two years ago. I think they went out with a raise target of $50K. If I remember correctly, they ended-up raising nearly $2MM.

The instant I saw that campaign I knew that if they raised anywhere south of somewhere between $1MM and $2MM there was no way in hell they'd be able to get the project done and delivered. The required iterations covering DFM (Design for Manufacturing), mechanical, electrical, firmware, tooling, environmental testing and regulatory testing would burn cash as if it were free. In hardware, each iteration cost real money --and potentially lots of it. $50K was not going to make a dent.

If they go into it knowing the funding goal will not be sufficient and are banking on exceeding it, they are simply not being honest.

My scam alerts go off immediately when I see such a severe project-to-funding- target mismatch. And that's why I call it "dishonest". It could also be "naive" but, again, it's the old "ignorance of the law isn't an excuse" situation. If you are going to go on Kickstarter with a hardware project and have no prior experience in manufacturing, do everyone a favor, do your homework and set a funding goal that will not have you scam your supporters out of money when you burn through it too quickly and can't deliver.

<comment><AUTHOR> It's probably the number one question we get asked now rebootthesystem, by people in our network who considering KS. It's a catch 22. Aim too low, you can't deliver (unless you get additional capital... which might be the point), aim too high, people don't believe you'll get there, project fails.

It's because of these incompatible goals that projects will keep going to low and keep posting eulogies on HN.

<comment><USER13> I don't understand the "people not believing you'll get there" point. The pledger loses no money if the project doesn't attain its goal so there is no reason to not pledge just because it might fail.

<comment><USER14> It doesn't seem rational, but it's a real effect. The theory is that people don't want to back a loser, and perhaps that they are psychologically purchasing the product at the point they make a pledge.

<comment><USER12> I wonder if anyone has looked at the idea of not showing the funding goal at all until it is funded (or not) or some other metric. For example, show it during the last week of the campaign.

I am trying to think of a way to allow project originators the freedom to set reasonable goals (a million, whatever) without fear of this one number becoming a drag on their campaign despite the fact that they are actually being honest about what it will take to deliver a quality product.

<comment><USER14> I think that'd be worse because a goal does create a rallying point, and is also used as a signal for how realistic funding this project is (keeping in mind that people irrationally want to back a sure thing).

Yes, it's a problem, though not like IndieGoGo's flexible funding. But I don't take it in isolation - determined creators can make a lot happen with a little money, I know.

I look more closely at the level of detail of what has been done and what needs to be done, and judge whether I think these people have few enough unknowns to complete it. But that's not a metric that most people are able to judge themselves, which is why it's a problem, and also where the Kickstarter community of other backers should kick in.

</comment></comment></comment></comment></comment></comment><comment><USER15> Nice clickbait title for advertising their own product concealed as a 3 sentence "retrospective", good thing HN allows submitters to change titles to something more descriptive and less clickbaity than the original...

On the postitive side, the product itself looks quite sleek. I could use some of the features myself to limit my own time on HN, or the time my wife spends on facebook.

<comment><USER16> We're always happy to change baity titles if someone suggests a better one.

The post is a bit lightweight, but that's made up for by the substantive discussion. The author clearly struck a nerve. It's ok for that to be rewarded with a top spot on HN, even if the post is promoting something.

</comment></comment><comment><USER17> Congratulations, the final product looks sleek.

I have a comment about the blog post itself though. Your page took 90 seconds to load on my gigabit internet connection. The two culprits are your high resolution images of the product DSC_0031.jpg and DSC_0014.jpg. Each image is around 3MB. I would strongly recommend recompressing these down to something like 200KB or less.

<comment><USER18> Hacker News should automatically add the size in MB for each submission. This would a) act as a warning for mobile users (the BBC article about dark matter on the front page at the moment killed chrome on my phone because it has too many images) and b) acts as a wall of shame.

</comment></comment><comment><USER19> Hardware fulfillment has improved considerably since kickstarter became a preorder store for established companies[1] with lots of money[2], rather than a place to support individuals with project ideas at the prototype stage.

[1] [https://www.kickstarter.com/projects/597507018/pebble- time-a...](https://www.kickstarter.com/projects/597507018/pebble-time-awesome- smartwatch-no-compromises)

[2] [https://www.kickstarter.com/discover/categories/technology?r...](https://www.kickstarter.com/discover/categories/technology?ref=discover_index)

<comment><AUTHOR> I know what you mean. Around the time of our campaign these guys [1] were on every major news website in Australia (paid ads, not stories). Their marketing budget must have been huge. I've heard Sony launches stuff under different names too just to test the market.

It does have one positive side effect though - more people come to the platform.

[1] [https://www.kickstarter.com/projects/nonda/get-your- macbook-...](https://www.kickstarter.com/projects/nonda/get-your-macbook- ports-back)

</comment></comment><comment><USER20> Of all the kickstarters I've funded (and it has been a lot) only two have failed to deliver, eventually, and only one of those was a hardware project. It was an attempt to make an open-hardware GPU, and when it turned out way more expensive than he imagined, he released all the work he had done on github.

The other failed project was Neil Stephenson's "Clang!" sword fighting game. We all know how that ended >:(

<comment><USER21> Surely Clang! had significant hardware components, too?

<comment><USER20> Oh, yeah, actually forgot about that. It just bothered me that they just seemed to throw everything away. After burning through several million dollars, I think they could have at least just done a Github dump or something.

</comment></comment></comment><comment><USER22> Congrats on shipping! I would be very interested to know more details about what you learned from your experience with selecting a manufacturing partner. A former client of mine had his business destroyed when his manufacturing partner in China basically stole his prototype and cut him out of the picture. What steps did you take to vet the company you partnered with?

<comment><USER11> It may not be practical for everyone, but we make sure not to use turnkey manufacturers. For example, one factory might populate and reflow boards and then assemble it into a case, but they don't have the board or case designs - we have them manufactured by other suppliers and supply them and all the components. That way no one factory can just start manufacturing our products because they don't have enough information.

Yes, they can reverse-engineer but it's harder with four or more layer circuit boards and they don't have the full BOM information.

This is also a good strategy for not getting counterfeit parts (that may not work) on your boards - you can use the suppliers and brokers you trust instead of whoever your factory decides to buy from.

</comment></comment><comment><USER23> How would someone begin the process of finding electronic manufacturers?

<comment><AUTHOR> For us, it started on OpenWRT blogs, scouring Alibaba and seeing who got back to us. Later it was email lists and the network of our accelerator.

If I was going to custom design, i'd be going to maker meetups in your city, or applying to something like Hxlr8. There are also supplier/customer places that do matchmaking with additional services for a fee (HWTrek for example). I didn't use any.

Also, if you can find a Kickstarter of someone who did something at all related, ask who they used. Lots of creators are very happy to tell you!

<comment><USER24> Are there any facilitators (i.e. freelancers or consultants that have a proven track record of having brought projects to production) that are affordable? I assume most of these professionals end up at a larger company faster than you can look.

</comment></comment></comment><comment><USER25> Clicking the green "Learn more" button on [http://koalasafe.com/](http://koalasafe.com/) scrolls the page to the next section in Chrome and Safari, but does nothing in Firefox and IE11. I filed a webcompat bug:

[https://webcompat.com/issues/1570](https://webcompat.com/issues/1570)

<comment><AUTHOR> Thanks mate. Admittedly we don't typically test with those browser when we push changes. :|

<comment><USER26> Selenium is great for this. For this particular case, it won't access an element unless its visible, so you can validate that the scroll happens on button press. Easy to make a quick smoke test that can run in a few browsers

<comment><USER27> While this is a technically true statement Selenium is neither easy to setup nor easy to learn. It's documentation (of at least the libraries I've used, which were the recommended ones) was atrocious and not at all consistent.

</comment></comment></comment></comment><comment><USER28> Is it just me, or are most hardware projects on kickstarter easily replaceable by cheap standard hardware like a mobile phone or a raspberry pi, and the right software?

It seems strange then, that shipping is such a big problem.

<comment><USER29> Most of the ones I've seen are. However, all the Kickstarters I've seen are targetting consumers. If your product is based on something like an RPi, then your parts costs are already much higher that they should be and your profit will be close to zero because B2C prices are typically very low.

If you are targetting commercial/industrial customers, then the added cost of standard hardware is generally not a deterrent IME.

</comment></comment><comment><USER30> Unrelated to the topic of the article. But I find such devices (kid surveillance, it's what it is) heinous.

<comment><USER31> Heinous? If you had a 7 year old, would you let them use a device with unrestricted wifi access?

</comment></comment><comment><USER32> For those commenting here about working with your factory ahead of time, would any of you be willing to talk a little about the process of choosing a factory to partner with? Thanks.

<comment><USER8> I have a 2-step process.

1 - Are communications easy, fast and meaningful? That's the first step. Contact more than one supplier (on a initial round, think 10 to 20). Make small challenges like posting design files on a secure site that requires the supplier to create an account...you'll get rid of a lot of unworthy suppliers that won't bother and therefore are not going to be proactive in the future.

2 - Invest in requesting prototypes (or samples if making more than one prototype does not make sense) from more than one factory ahead of time (top 3 of the step above). The good factories will perform well at this task...bad ones will deliver half-baked stuff.

With time, the very good suppliers that really want to build a business relationship with you will become obvious and you can reuse them in the future...making your life easier. Don't be lazy when looking for suppliers...that's the biggest pitfall. Invest time and money...it's important.

<comment><USER32> This sounds more or less like the process I've gone through. I have yet to explore the option of manufacturing in China....have you done this? Is the process more or less the same?

<comment><USER14> Given the importance of good communication, there are obvious additional challenges to manufacturing in China. Take baby steps and get small components, small orders first to establish trust. Finding an agent who will handle sourcing and communication can be a big help.</comment></comment></comment></comment>


Show HN: How I Spent My Last Few Weekends - <AUTHOR>

My 12-year old son and I are die hard Apple fans. He lives for everything Apple. His life's ambition is to be CEO of Apple someday. Steve Jobs and Bertrand Serlet are his idols. Can anyone else imagine that now-a-days instead of sports heros kids have entrepreneurs as idols? I am stoked.
They also say the best way to learn something new is to do a personal project of interest.
To this effect I spent the last few weekends putting together a new Apple Fan website. There is a lot more to come! Videos, Pictures and so much more. We have about 60gb of raw content to get up to the site.
Currently there are a number of videos broken into categories.
Some things I learned so far: - HTML5 video element is very cool. - Browsers handle video differently. - Video encoding is a very deep and involved topic to learn. - There is a new WebM format I need to work with.
Some Items I am researching to learn: - Ngix vs Apache - CouchDB vs MySQL - Moving to Ruby on Rails. - Google Page Speed - memcachd
I would love feedback so I can learn and enhance.
The website is at: http://6colors.net <comment><USER2> I don't mean to be cynical but it might be more constructive to make your son a fan of technology and design, rather than a corporation. If Woz's or Jobs's ambitions were to be CEO of HP or IBM, we'd never have Apple.

<comment><USER3> As a parent, I'd argue that one can't 'make' a child a fan of anything.

<comment><USER4> For a classic example as to how this statement is completely wrong, I invite you to Google or Wikipedia "Prussian Blue".

Kids are (by design) impressionable and easily indoctrinated into any scheme.

<comment><AUTHOR> Agreed. He loves Apple and entrepreneurship because I do and I always have. He will probably never be an employee of a company because he already wants to do his own thing.

He hires his brother and sister to do his chores for a fraction of what he wants to get paid for them. Pays them and pockets the rest. He saved and bought his own iPad in July and is now saving for a new AppleTV and Mac Mini. Apparently his MacBook Pro is not good enough.. _sigh_

</comment></comment></comment></comment><comment><USER3> Son's homework: find ten sites he thinks look cool. Working with him, pick a single feature from each site then the two of you should detail what makes it look cool, and then devise a plan to implement it on your site.

<comment><AUTHOR> Yes, Very good idea. This is sort of how this whole endeavor got started was he would be searching over and over to find Apple items of interest and he was like I wish there was one place to go....He was very involved in the UI design and testing. Coding is hard for him as he really go back to the design elements first....

</comment></comment><comment><USER5> I guess if learning is your goal, then have at it. But, I think the none of those technologies are really the next step. Next step is to build content/traffic to the point you might need to look at alternative technologies.

<comment><AUTHOR> Good point. Thank for reminding me I might want users first.

</comment></comment><comment><USER4> Apple != Steve Jobs. Has it already been long enough that we don't remember the post/pre-Steve Jobs Apple of the 1990s?

Maybe I'm a pessimist, but I don't look forward to Post-Jobs Apple v2.

<comment><AUTHOR> True. I do recall the days of Michael Spindler and Gil Amelio

</comment></comment><comment><AUTHOR> FYI: There may be some IE issues as I have not tested a single drop with it yet.</comment>


Show HN: Ask Alexa for the prices of over 2000 cryptocoins - jonathan-kosgei https://www.amazon.com/dp/B079KJ4KVN/ <comment><AUTHOR> It seems coinmarketcap.com only has 1511 listed. Wonder where the other 489 are coming from.

<comment> jonathan-kosgei >>> import requests

>>> data = requests.get('[https://www.cryptocompare.com/api/data/coinlist/'](https://www.cryptocompare.com/api/data/coinlist/'))

>>> data = data.json()

>>> len(data['Data'].keys())

2148</comment></comment>


Ask HN: In a world of the link tax, what is the future of HN/other aggregators? - <AUTHOR> Will they be shut down? Become paid to foot the bill? Have to run ads? <comment><USER2> If European news sites don't want links then we don't link to them.

If Europe doesn't want to host aggregators, then they don't need to have any. That way politicians can stop fielding complaints that broadband isn't good enough because Europeans will stop using the internet.</comment>


Docker-slim: Minify your Docker container image without changing anything - <AUTHOR> https://github.com/docker-slim/docker-slim <comment><USER2> Most people would benefit from the distroless base image: [https://github.com/GoogleContainerTools/distroless](https://github.com/GoogleContainerTools/distroless)

It's a base image with binaries from Debian deb package, and with necessary stuff like ca-certificates, and absolutely nothing else, while still glibc- based (unlike Alpine base images).

Example images I built with the base image \- C binary, <10MB [https://hub.docker.com/r/yegle/stubby- dns](https://hub.docker.com/r/yegle/stubby-dns)

\- Python binary, <50MB [https://hub.docker.com/r/yegle/fava](https://hub.docker.com/r/yegle/fava)

\- Go binary, 5MB [https://hub.docker.com/r/yegle/dns-over- https](https://hub.docker.com/r/yegle/dns-over-https)

Another trick I use is to use [https://github.com/wagoodman/dive](https://github.com/wagoodman/dive) to find the deltas between layers and manually remove it in my Dockerfile.

<comment><USER3> What do you do when you need to debug an issue and the container contains no utils?

I expect someone will leave a comment saying "But you shouldn't be entering containers, you should be using Ansible/Kubernetes". Yes, that is how I manage changes but sometimes you just have to log in and see what is going on with htop/etc

<comment><USER4> My dream solution to this issue is a one liner command like:

        docker exec -it --augment=ubuntu my_container bash

Would start bash in the container, but also layer into the filesystem all the rest of a standard ubuntu image _only for my tools, but not affecting the application in the running container_.

I'm pretty sure that's possible with current linux kernel mount namespace/overlayfs infrastructure used by docker - all that's needed is the command line tool to support it.

<comment><USER5> The new ephemeral container support in kubernetes lets you do essentially that. You bring the filesystem from another container image into the PID/network namespace of a running container in a pod.

<comment><USER6> lol, it's fun to imagine going back in time to explain what you just said to my 2004 sysadmin self. back when I used to build servers, and colo them, and physically maintain them.

</comment></comment></comment></comment></comment><comment><USER7> Alternatives if you don't want to risk missing some file that only gets loaded 10 minutes in:

1\. Start with a small base image, e.g. for Python there's "python:3.7-slim". For Python I'm not a fan of Alpine, but for Go that gives you an extra small base image (see [https://pythonspeed.com/articles/base-image-python-docker- im...](https://pythonspeed.com/articles/base-image-python-docker-images/)).

2\. Don't install unnecessary system packages ([https://pythonspeed.com/articles/system-packages- docker/](https://pythonspeed.com/articles/system-packages-docker/)).

3\. Multi-stage builds (in Python context, [https://pythonspeed.com/articles/smaller-python-docker- image...](https://pythonspeed.com/articles/smaller-python-docker-images/)).

You can find similar guides for non-Python as well. Basic idea being "don't install unnecessary stuff, and in final image only include the final build artifacts".

</comment><comment><USER8> I think the importance of small Docker images is generally oversold. I regularly deploy multi-GB images on Google Cloud, and startup even on a fresh node only takes 60 seconds or so. If the node's already hot (i.e. has cached the image), starting a container takes no more than a few seconds.

I think what's more important is layering the Dockerfile in the right order. You should be putting most of your large, infrequently changing assets in the lowest layers. Then put smaller, more frequently changing assets in the top layer. If you have a 4GB image, but only change the top 10MB layer, then it only requires caching 10MB of new data when you update the container. But if you change a lower layer, then it requires re-building and re-caching everything above it.

<comment><USER9> Adding a minute to some deployment process can be fairly significant. The docker push and pull is probably 70% of my deployment process and I already have ~100MB or less images.

I don't think the concern is 'how long does deployment take' but 'how fast can we iterate?'; Building and loading the images on a local dev machine to test a 2 second change would take much longer with larger images. Getting feedback of a PR merge from a CI build agent would take minutes longer.

I don't think the importance has been oversold.

<comment><USER8> > I don't think the concern is 'how long does deployment take' but 'how fast > can we iterate?

And for iteration, the only thing that matters is the size of the top layers that are being iterated on. Not the overall image size itself.

You can put `RUN apt-get [kitchen sink]` at the beginning of the Dockerfile and it pretty much won't matter. When you change anything in the project repository, that bigass giant base layer doesn't get re-pulled because it doesn't change.

To validate that a layer, Docker daemon just compares the hashes. So, for unmodified layers, docker pull is constant time with image size. The Docker daemon only downloads from the registry starting with the bottom-most modified layer relative to its cache.

If anything, throwing the kitchen sink in the base layer is better for fast iteration. When you're being parsimonious about third-party libraries and packages, you'll frequently have to rebuild the base image. If you `RUN apt- get [everything]`, then you'll hardly ever never need to rebuild/re-push/re- pull that layer, because you'll always have whatever you need already available.

<comment><USER10> It depends on the size of project and what you want to optimize. The time spent on push and pull of docker images used to be a real deal breaker once upon a time when I tried to improve the deployment speed of a project by switching from heroku build to docker based solution

</comment></comment></comment></comment><comment><USER11> It seems this is basically analyzing the running application inside the container and only packaging what's needed to make it work, at a more granular level than OS-level packages.

Interesting concept. I wonder how it expected to cover 100% of the app usage if certain things aren't triggered during the analysis phase.

<comment><USER12> I guess the burden is on the app dev to ensure 100% functional coverage? That seems a little "yikes".

<comment><USER13> Is that any different than anything else? Compilers, asset pipelines, and build tools all work the same way: they make assumptions about how a system works and try to optimize on those assumptions. Test your app, run QA, etc. Most licenses make no promises that the software will work, so this tool doesn't seem any different.

<comment><USER12> Wow, that's an oddly defensive response.

My point is merely that this is quite a significant risk. If you fail to exercise 100% of your code paths via functional testing (so you've got to have comprehensive positive and negative functional testing, which is pretty rare in my experience), you risk producing an image with docker-slim that will break. You've got to think about exercising every single possible interaction with every other component running on an OS. That's no small feat.

Think about it. That's not just 100% of _your_ code paths, that's 100% of the code paths that you could possibly ever trigger in any library that you consume, and you have to think about what might influence those circumstances. There's all sorts of angles to consider, e.g. Does latency of DNS response matter? Does time of day matter? Does IPv4 vs IPv6 matter (answer is likely yes in this case, so you might need to think about running the functional tests coming from both address stacks).

docker-slim is a neat idea, but it seems to come with _significant_ risk.

</comment></comment></comment></comment><comment><USER14> It seems like this tool is built upon the assumption that the containerized program will load libraries and read files while this tool is tracing it.

It seems like the biggest FAQ item is missing from the readme: What happens is my container reads a file only every so often and this tool doesn't capture it?

Also, do I need to keep images running for a while for this tool to minimize the files in the rootfs? It seems impractical, especially in headless environments like CI/CD.

<comment><USER15> The temporary containers usually don't run for too long. The probes (http, for now) are there to ensure that the app/services gets to do something useful exercising different code paths. Still, it is possible that something could be missing or you might want to keep something extra. For those cases you can tell docker-slim what else you want to keep in your container image (it has a few flags for that).

</comment></comment><comment><USER16> Their FAQ doesn't answer what it is that they are removing. Can someone shed light on that? As others have said, it seems to watch your application running and then remove anything it doesn't see your application using. Seems like a very high-risk + high-reward method.

<comment><USER17> Yes, this needs a "what is the catch?" section in readme.

<comment><USER15> The main catch is that it targets application container images and not generic base images. This is the most common gotcha many people encounter. There has to be an app/service in the container that does something specific.

And, of course, it is possible that not all artifacts will be identified. There are a couple of ways to mitigate this. First, you can create custom probes for your app/service to make sure the app container can be analyzed much better. Second, you can explicitly tell docker-slim what you want to keep in your container image (you can specify files or executables)

</comment></comment></comment><comment><USER18> Very interesting, but I worry this will just break a lot of applications that are run through it in subtle ways. For example, removing system packages can have negative effects not noticed except in subtle edge cases like DNS resolution.

</comment><comment><USER19> I've done a similar yet simpler hobby scoped project:

[https://github.com/tzickel/docker-trim](https://github.com/tzickel/docker- trim)

Last time I've checked some of their open issues about cases theirs doesn't work, worked on mine.

Also, mine is a few lines in python, if you want to learn how to trim a docker image.

</comment><comment><USER20> Is there somewhere with a good walk though of the constructs that docker containers default to? Not these slim one the default docker one.

As someone who works with docker containers on a somewhat daily basis I only have a vague idea of what they do under the hood and don't have much of a reference point when comparing this slim impl to the default one.

<comment><USER21> I'm not completely sure what it is you want to know, but basically there are two pieces to linux container tech (Docker and others). The first is a set of Linux kernel features that lets us isolate various aspects of processes in separate namespaces. The second is layered images, using filesystem features like overlayfs and copy-on-write to avoid having to duplicated everything. These two features of the Linux kernel are the real "container technology", docker and others are basically just user interfaces for these.

A link about namespaces:

[http://ifeanyi.co/posts/linux-namespaces- part-1/](http://ifeanyi.co/posts/linux-namespaces-part-1/)

A nice little introduction to overlays/etc:

[https://jvns.ca/blog/2019/11/18/how-containers-work-- overlay...](https://jvns.ca/blog/2019/11/18/how-containers-work--overlayfs/)

And if you _really_ want to learn how it all works, write your own "rubber- docker" in Python:

[https://github.com/Fewbytes/rubber- docker](https://github.com/Fewbytes/rubber-docker)

</comment></comment><comment><USER22> Instead of starting with a bulky image and guess and remove unnecessary stuff at the end, I would prefer the opposite: only include necessary packages for the executable in the first place.

I am happy with my current distroless + docker multi-stage build.

</comment><comment><USER23> I wrote something similar but way simpler a while ago: [https://github.com/ak-1/sackman](https://github.com/ak-1/sackman)

</comment><comment><USER15> i'll be happy to answer any questions about the tool (i'm the main author) :-)

<comment><USER24> This looks pretty amazing, thanks for sharing. I've just been playing with this on a couple containers. The first went from 197MB to 71.5MB - not bad! I did some testing and it didn't work without including a few extra pieces but pretty painless.

The second container went from 176MB to 4.7MB!! I've not really tested that so there's a pretty good chance things aren't going to work too well in practice (but we'll see).

If it all continues as well as it's started then we'll definitely be using it.

<comment><USER15> Do you mind sharing a bit of information about your container images? What's the app language for both? What kind of application is it? How do you init your apps in the containers? docker-slim is definitely not perfect and there's lots of room for improvement. Can you ping me offline (on github/gitter, twitter or email, my email is email@example.com)?

</comment></comment></comment><comment> alex-ant Would be nice to add a support for native docker flags (-t for --tag, -f for --from-dockerfile, etc.)

<comment><USER15> This is a great idea! Thank you for your feedback. Using native docker flags as-is will definitely reduce friction and simplify the use. Do you mind creating a Github issue if you have a specific list of flags you'd like to see supported first?

</comment></comment><comment><USER25> Results are interesting. How are Go containers only 1.5MB, and Rust's ones 15MB? I would have expected Rust to be on par with Go (both compiled languages)</comment>


My $0.02 of how dgital marketers can boost productivity - <AUTHOR> http://blog.orgzit.com/story-productivity/ <comment><AUTHOR> Many digital marketers find it difficult when they have to submit the quarterly report for the lumpsum of articles written, approved & published, social media followers increases, adword budgeting and much more.

I think Orgzit is a scalable solution for this. Essentially, it captures all data at one place from the project beginning with all project members (including your boss) on the same platform. Let me know what you think :)</comment>


Booting VMs in under 25 seconds on GCP - <AUTHOR> https://medium.com/@robaboukhalil/move-fast-and-break-the-cloud-b55b899e3683 <comment><AUTHOR> Author here, I ran a benchmark of VM boot times by launching ~5,000 VMs of different sizes on GCP. The code to replicate the benchmark is available open source here: [https://github.com/robertaboukhalil/cloud- benchmarks](https://github.com/robertaboukhalil/cloud-benchmarks)

TL;DR: Boot time is <25s for VMs with ≤32 CPUs, and <1 min for VMs with ≤96 CPUs!</comment>


Scaling PHP Up, Out, and Around - <AUTHOR> http://blog.phpfog.com/2011/03/16/scaling-php-up-out-and-around/

<comment><USER2> This service doesn't seem to be at all like a "Heroku" of PHP" as it was marketed at one time. It seems that each app is simply running on one or more of it's own EC2 instances with the smallest plans (free tier and the smallest paid plan) running on micro instances. Those micro instances are horrible (generally slow, terrible I/O) and for the monthly fee they are charging, there are much better options. That probably explains why they only give one free app for the entire account, it would be too expensive to provide more than one free micro instance for everyone. Though I haven't been impressed by the AWS micro instances, PHP Fog apparently has an option to run on Rackspace cloud which is much better for the low end IMO.

Heroku doesn't put your applications on their own instances. I imagine they are also getting around the problem of crap low end EC2 instances by distributing all apps across clusters of the largest instances.

Not to bag on PHP Fog, they have created a lot of excitement in the PHP space. Personally, I prefer Heroku's model and for PHP I would rather just cut out the middle man and run my own VPS. It's nice not to have to deal with administration, but that's just one benefit of using Heroku, and not the most important for me.

</comment><comment><USER3> _Web servers are limited in the number of concurrent connections they can maintain (tubes aren't big enough)._

This doesn't really make sense -- maintaining a TCP connection requires no "tubes"; the limit comes from finite state storage: a finite state table, a finite number of file descriptors, and a finite amount of RAM in which to store the application-level connection contexts. These numbers turn out to be Really Fucking Big, so this is probably not affecting your application unless you are Google's IMAP servers or something.

<comment><USER4> By "maintain", he likely means that bandwidth to any particular server is constrained. Yes, you may be able to hold 10k connections open on your Wifi'd laptop, but if each connection only gets 1B/s is it really a _useful_ webserver?

<comment><USER5> Any modern web server is going to be able to handle tons of connections, much more than a wifi laptop that can not yet be considered a modern web server. Beyond that, bandwidth is rarely the limiting factor. Framework/language weight, slow db queries, and javascript performance in the user's browser are much more prevalent concerns. In my experience it's always the db that falls over first, well before connection limits are reached.

<comment><USER6> Slow DB queries, yes. If your application does something stupid with SQL, your whole awesome C10K-solving epoll-based framework comes to a halt waiting for the database to read 1M rows off disk. Worst of all, your ORM likely hides the facts from you, producing left joins when you need inner ones, or worse not grouping the results so that a full join'ed result is returned when you only need the first and last tables.

More on topic, scaling web servers is not hard, just tedious. Scaling storage, especially if you need to use RDBMS's is the real trick.

<comment><USER3> _If your application does something stupid with SQL, your whole awesome C10K-solving epoll-based framework comes to a halt waiting for the database to read 1M rows off disk._

No, a database connection is just another socket in your "awesome epoll-based framework".

 _Worst of all, your ORM likely hides the facts from you_

Maybe if you're writing your app in BASIC? A good ORM doesn't hide the query logic from you, and there are plenty of popular languages that have good ORMs. The difference between using an ORM and not using an ORM is that you don't have a bunch of code to map SQL rows to application domain objects in your app. That's it.

(Note: Active Record and Class::DBI from 5 years ago aren't good ORMs. But people have written good ones in the intervening time, like DBIx::Class.)

<comment><USER6> To your first point, at least libmysqlclient blocks and any wrapper around it does too. To your second point, my most recent experience is with sqlalchemy, which is really pretty powerful, but also produces some hideous SQL when using the ORM layer. It does not hide the query logic from you, but conceals it just enough that I have to check every time that it is not lazy-loading 10,000 rows or not returning 10,000 rows when I only need 10.

<comment><USER3> libmysqlclient sucks. :)

</comment></comment></comment></comment></comment></comment></comment><comment><USER7> How about adding hiphop-php from Facebook?

<comment><USER8> I think they'll do this. They spoke to me about adding phc support, so I expect HPHP to be on their roadmap.

</comment></comment><comment><USER9> Thing I don't get about things like PHPFog, is how do you manage dependencies (my app depends on my shared libraries), data storage (postgresql, for instance), Memcached, application configuring, etc?

<comment><USER10> Agreed, i asked on Twitter about these kind of stuff (more specifically about Redis, but that applies to anything), never got an answer. Right now, i have an access to PhpFog, it's "nice", but, without the ability of getting Redis, or Sphinx prevents me to use it as my little laboratory for small apps and stuff. I guess i'll stick with AWS for now...

</comment></comment><comment><USER11> Just a quick note: on the top of the page there is a broken link to "Pricing".

I am looking forward for a service like this, any idea when this will be open to the general public?

<comment><AUTHOR> O(week) [edited, thanks!]

<comment><USER12> Can we ignore the constant factor and say it's O(week)? ;-)

</comment></comment></comment><comment><USER13> Thanks man.... I have ammmo for the arguments now.:-)

<comment><USER14> Who are you arguing with? Ignore the haters and use whatever language you like and are most productive with.</comment></comment>


UNUBO - Consolidate multiple cloud app costs onto one dashboard - <AUTHOR> https://unubo.co <comment><AUTHOR> Hello HN, my company created this. Just wanted to get eyeballs onto this and gather as much feedback as possible.

UNUBO is an app that takes billing data of online services you use and consolidates that data onto a simple, dynamic dashboard.

You can then easily see how much you collectively pay for these services per month, per quarter and per year.

Currently in public beta, free for all to sign up.

Cheers!</comment>


Ask HN: Different investors on a GPL project, and conflict in IP? - <AUTHOR> I have a product licensed AGPL. It's hosted on Github and everyone can install and use it without me. I also provide commercial service for this product and provide extra features, enterprise support for maintenance. One of my customers is an enterprise e-commerce company, they build some e-commerce softwares for a couple of big enterprise retail companies. They offered me a deal: we will fork the man product, change its name and their developers will develop extra features for e-commerce websites.
They will continue to pay me for the extra services that I'm already providing and the new product will be brand new product which is not related it the current one as the claim because we will fork the repository and all the releases and development cycle will be different for this new product. I will take some money for my consultancy and also the relationship will be based on profit partnership, I will take commission for each sale and if I don't allow them to sale the product to a specific customer, they won't be allowed to sell it.
The main problem is that the new product that they're willing to develop won't be open-source, which violates the main rule of GPL. Therefore I need to license the current product just for them in order to be able to work with them.
Our company is also in the process of getting angel investment and I'm wondering if this deal can make some trouble to me later on. If I share my company's IP with another company, I guess the investors won't like it and the valuation of my company will decrease.
On the other hand, my product will be used my many enterprise companies which I can't actually sell myself so it will be widely used and proven software even if the name of other product will be different.
What do you think about my situation? Would the investors really decrease the valuation in this case? What can I do for the licensing of my app in order to avoid any legal issue in the future? <comment><USER2> First of congratulations on your sought after product. As a general remark I don't see any fundamental problem with dual licensing your product. You do need to make sure that the license that you grant to the enterprise e-commerce company restricted so it does not permit the sale and marketing of a product that competes directly with your own but only the specialised e-commerce version. This type of white label product can be very lucrative and I think it is wise of you to go for a sales based license fee instead of a flat fee, especially if you are fairly confident that their product will be successful. Unless you have an opportunity to effectively address their market yourself it sounds like you are just optimising the income your product can generate.

</comment><comment><USER3> Why wouldn't the investors like it? Companies license IP to other companies all the time. It actually is a plus for investors because they will see a faster ROI.

<comment><AUTHOR> Because their product which is based on my base product will have a different name and branding. It won't be affiliated with my product so I'm not sure how it leads to faster ROI. The good thing is that my product will be based by many enterprise companies so will become more stable.

A similar example I can think of is the relation between SQLStream and AWS Kinesis Analytics. Kinesis Analytics is based on SQLStream but people who use AWS don't know it; however SQLStream uses the name of AWS as their client in their website. It's likely that AWS re-branded SQLStream as Kinesis Analytics as a different product and provided it to their user as a managed service.</comment></comment>


Sun Tzu's 'The Art of War': Comic Book Adaptation Now on Android - <AUTHOR> http://www.sfgate.com/cgi-bin/article.cgi?f=/g/a/2011/10/22/prweb8901857.DTL

<comment><USER2> It's also on Kindle, and Apple iOS products. Why is the headline written as if the availability was Android-specific?</comment>


Coronavirus.gov - <AUTHOR> https://www.cdc.gov/coronavirus/2019-ncov/index.html <comment><USER2> This whole virus is one big scam to keep you inside for what is happening out there</comment>