Microsoft calls WebGL "harmful" - <AUTHOR> http://blogs.technet.com/b/srd/archive/2011/06/16/webgl-considered-harmful.aspx

<comment><USER2> _I agree with Microsoft's assessment that WebGL is a severe security risk. The gfx driver culture is not the culture of security._

~ <https://twitter.com/ID_AA_Carmack/statuses/81732190949486592>

<comment><USER3> Carmack goes on to say that he prefers NaCl (as in Native Client) for webgl like applications.

Any thoughts from someone who's more informed than me?

<comment><USER4> NaCl bindings to HW accelerated 3d share the same issues (like any other technology using GPU acceleration including Molehill, Silverlight or Unity).

Carmack tweeted the same:

 _"doing GL ES from NaCL is clearly just as dangerous as WebGL"_

<http://twitter.com/#!/ID_AA_Carmack/status/81767700447236096>

In theory, you could do software rendering in NaCl, but that wouldn't produce as good results as GPU, despite NaCl being more powerful than JavaScript (for example SwiftShader DirectX9 SW renderer scores 620 on 3DMark06 on pretty beefed up quadcore [1], my 2 year old notebook GPU scores over 4000).

So the question is not "is WebGL secure?", question is "are benefits of HW accelerated 3d on the web worth the risks?".

To which IMHO the answer is resounding yes. Problems are minor, benefits are major.

[1] <http://transgaming.com/business/swiftshader/faq/>

</comment></comment></comment><comment><USER5> As I said in another thread, aren't these security points all applicable to JOGL running in a Java applet? Therefore if they are exploitable, they probably already are being exploited, and therefore implementing WebGL does not add any new attack vectors. Am I wrong?

An interesting question would be "If all these security concerns were resolved, would Microsoft then implement WebGL?". Then, I guess, the answer is still no, because WebGL is based on OpenGL and not DirectX.

<comment><USER6> Even if JOGL has the same problems, the blame is not theirs anyway as they aren't distributing Java anymore, otherwise you must blame them for allowing OpenGL on Windows too.

         "If all these security concerns were resolved,
          would Microsoft then implement WebGL?"

To me that's irrelevant - Chrome and Firefox combined have enough market share to make WebGL useful.

What is important to me is if they are right, what are the Khronos Group doing about it? Is WebGL really designed for the web?

AND, can it be fixed without relying on companies fixing their drivers or is it a fundamental flaw?

</comment></comment><comment><USER7> Relevant: <http://news.ycombinator.com/item?id=2662632>

</comment><comment><USER8> I've posted in the other threads about this but when I read this: "The security of WebGL as a whole depends on lower levels of the system, including OEM drivers, upholding security guarantees they never really need to worry about before."

I can't help but wonder. If those drivers are so buggy, why isn't this a high priority to fix? It would probably be easier for hackers to attack other things due to the wide range of drivers but if the security issues claims against WebGL are real then escalation of privileges on any OS is a question of breaking the GPU driver.

I find that to be a big issue even with WebGL not in the picture.

<comment><USER4> _"I can't help but wonder. If those drivers are so buggy, why isn't this a high priority to fix?"_

It will come. Raised concerns are not WebGL specific, WebGL is just exposing things about HW-accelerated 3d to more general public that have been here since always and every GPU 3d technology has to face (problems with drivers, fragmentation of market, very wide spread in capabilities).

People will need to get used to update their drivers (the same as they already got used to update their OS and browsers).

Gamers are already doing this since forever, not because of security concerns but for bugfixes / performance improvements.

GPU vendors are actually pretty responsive, I'm aware of driver hotfixes released just to address problems discovered on releases of particular games (in between regular monthly driver updates).

</comment></comment><comment><USER9> Why not use the existing trust model in IE, as applied to ActiveX? Give users the option to trust WebGL on sites like Mr.doob and block it pending the user's explicit permission on untrusted sites.

<comment><USER10> Because uninformed users don't know and don't care about security warning mumbo jumbo if it means they get to watch their cat video.

</comment></comment><comment><USER11> It may well be true, but it's a little odd (to someone who has only ever had one windows computer) to hear them say things like "in a way that we consider to be overly permissive" and "relies too heavily on third parties to secure the web experience". Take out web of this, and it's the exact feelings we had about XP security.

Do they have a non-propriety alternative? The closest thing I can think of is WPF, which is based on Directx.

<comment><USER6>
        it's the exact feelings we had about XP security

Well, actually, Linux or OS X security isn't that much better for the end- user, unless you're a sysadmin with some experience and know how to configure stuff like IPTables and SELinux.

Otherwise when navigating the web, security is as better as its weakest links - the user and its browser.

<comment><USER11> I mean in terms of how many backdoors are left, unpatched, in programs that inevitably have direct access to the internet, and admin rights.

</comment></comment></comment><comment><USER12> maybe if they had a sane security model for the browser this wouldn't be an issue? I have to believe chrome team is thinking this with how the browser puts each renderer into a sandbox process... but maybe MS doesn't want to do that because of how they've HW accel'ed so much?

<comment><USER13> Sandboxing builds on top of existing OS functionality to give each sandbox a separate address space and to guarantee freeing of resources on process exit.

The sandboxing code would have to rely on the video drivers ("the OS running on the card") to similarly manage resources on a video card.

Problem with that is that the video card may not support some required functionality or that the driver may be buggy. Top of the line video hardware has a shelf life of say a year. That puts serious pressure on producing drivers fast. In addition, there is pressure to produce fast drivers, as that is what reviewers look at. You cannot get fast reliable drivers soon, so drivers will be buggy, incomplete, etc.

You cannot build reliable sandboxing on top of buggy drivers.</comment></comment>


Mozilla contains unidentified root certificates - <AUTHOR> https://bugzilla.mozilla.org/show_bug.cgi?id=549701

<comment><USER2> Headline sensationalist much? Two certs are mentioned, both belonging to RSA, one of which doesn't appear to have been covered by their most recent audit and is therefore a candidate for removal.

<comment><USER3> That's not quite what it says - the one that wasn't covered by the most recent audit isn't a candidate for removal until 1/1/2012 at the earliest. The other certificate is completely unknown.

This thread gives more context:

[http://groups.google.com/group/mozilla.dev.security.policy/b...](http://groups.google.com/group/mozilla.dev.security.policy/browse_thread/thread/b6493a285ba79998/26fca75f9aeff1dc)

<comment><USER2> That's a bit more information, but the headline here at HN is still overblown; we're down to one unidentified root certificate that was probably issued by RSA, but for which no records can be found. Most probably attributable to incompetence and poor recordkeeping rather than a malicious compromise of the whole PKI.

<comment><USER4> If I was going to sneak in my own root cert, I would give it a name and date very similar to an existing one.

<comment><USER5> And wasn't there some discussion in the last week or two about how easily you could impersonate anybodies valid ssl cert if you could get hold of a real root cert? (something about browsers not notifying users that a previously seen cert is now authenticating via a different root?)

<comment><USER4> I am not a crypto expert so correct me if I'm wrong, but as I understand it, anyone with a root key necessarily can subvert the entire system in a straightforward way.</comment></comment></comment></comment></comment></comment>


Intergenerational warfare: Who stole the millennials' future? - <AUTHOR> https://www.ft.com/content/0c2a575a-8c4b-11e9-b8cb-26a9caa9d67b <comment><USER2> The UK has a broken housing market.

Literally everything else stems from that.

All of the centralisation, ridiculous conditions, silly commutes, a ton of the work related unhappiness.

There are vast, vast swathes of the country that are just empty or used for farmland or whatever whilst others live in tower blocks.

It's gone way, way beyond anything resembling reasonable. The situation, in pretty much one or two generations, for the population without excessive talent, has gone from 'buy with a partner' to 'move a bit further out' to 'buy an apartment' to 'buy an apartment a bit further out' to 'rent an apartment' to 'rent a room in a house or apartment' and for many it's now at 'curl up and die on the street'.

You may also have the option of moving to a depressed post-industrial town and working in retail until the Government cuts benefits enough that no-one can afford to buy things from your shop any more.

We're a 500+ year old country for christ's sake. This isn't the frontier. We're in a situation in which people can't afford the rent because our governance is thoroughly broken.

</comment><comment><USER3> lol. How about the author, David Willetts? After all, it is he who was cheerleader for the raising of tuition fees from 3k to 9k. It was he that sold the student loan book to a debt collecting agency.

The conclusion really just adds weight to thinking he's part of the problem. A one-off bribe to help onto the housing ladder isn't going to cut it.</comment>


Ask HN: Freelance Web Development - <AUTHOR> I'm thinking of learning PHP/WordPress or Javascript as a way to get my feet wet into Freelancing. What's a more lucrative and easy way to get into Web development as a remote web developer? <comment><USER2> There's no easy way, and when starting out you are competing with many, many other people with the same idea. The bottom of the web development freelancer pool is not lucrative. But here's a couple of starting points.

[http://typicalprogrammer.com/the-things-you-need-to-know- to-...](http://typicalprogrammer.com/the-things-you-need-to-know-to-do-web- development/)

[http://typicalprogrammer.com/tips-for-successful- freelancing...](http://typicalprogrammer.com/tips-for-successful-freelancing/)

</comment><comment><USER3> > What's a more lucrative and easy way to get into Web development as a remote > web developer?

There's no other way than to get online and be noticed. As far as I know, the people being hunted down are 1) The ones that contribute to some open source project and 2) ones that are active in programming communities like Quora or StackOverflow. That's because employers have tangible evidence of your skill level (they see you code).

> I'm thinking of learning PHP/WordPress or Javascript as a way to get my feet > wet into Freelancing.

Every technology has their own niche in the freelance world. Choose one you're comfortable with, and where the action is. If you're still starting off, better learn fast. These freelance things don't start off easy. Half of it is the work, the other half, the paperwork.</comment>


Giving away the company's secret sauce - <AUTHOR> https://rachelbythebay.com/w/2018/04/22/sauce/ <comment><USER2> I used to work at RackShack during these times, and when it was renamed to Ev1Servers, which this article is about. I can answer any questions and clear up any misconceptions.

The company started out pretty much exclusively with Cobalt Raqs at first. They eventually bought their own real datacenter and physically moved all of the servers there and had a lot more room. I remember when they got these machines they're talking about. They sold them as AMD Athlon "white boxes" I believe. I was a little surprised when I noticed they were literally super cheap desktop machines, similar to "emachines" back then. They even had CDROM drives! But it didn't really phase me. Why the hell not? He obviously got a good deal on them. We just made racks, 5 on each row, 4 rows. They ran Linux just fine and had 100mbit network cards in them.

And yeah, no firewalls. That's your job on your server. Most people ran servers on these machines, why would they want a hardware firewall? The networking was simple. Just 5 daisy-chained switches, one mounted on reach rack. 100 servers would share a block of 512 IP addresses. If your subnet ran out of IPs, we would literally move your server to a different subnet.

They also saved money because most support techs were 18-20 and made just above minimum wage. But it was a great opportunity and I learned a lot. And we really did have a lot of really smart people working there.

Someone else in here said that they would require your root password on support forums. No one was stupid enough to request that and customers were generally not stupid enough to post it, but I'm sure it probably happened once or twice. It was a similar situation in the official IRC channel. Some customers didn't grasp the concept and would accidentally paste their root passwords in there.

The story about their fiber connection being down, I remember that I think, but it was before my time. I believe they only had 3 fiber connections, and one of them was severed. They decided that it was because of a dump truck picking up a garbage can. They were pretty open about it and posted pictures on their forums. They kept acquiring fiber connections. I believe they eventually had 10 different 1-gigabit connections at a single DC.

<comment><USER3> Would love to know when that was (more accurate than "late 90s") because at my first workplace we also paid for Cobalt Raqs (and I'm not sure if "random desktop pcs in a DC" were available), but because it was the summer of 2001 iirc it's maybe a bit too late to draw parallels (3 years back then could be a lot more revolutionary in hosting than today).

<comment><USER4> Rackshack had a a few racks of colbalts too. They were fragile, and some what of a mystery to work with. Once they started offering white boxes on bread racks things actually looked up and support could actually help people because it was the same standard tools they already knew.

Later in the days they made big deals with Dell, and even then we were racking dell desktops and office services on bread racks for a long time. I remember when we got our first few lines of real rack mount servers -- they were sooo sexy.

</comment></comment></comment><comment><USER5> Rachael's story aside, I think the idea of commodity PCs for mass storage only became feasible after the software to handle them as a system arose. The popular term was RAIN: Redundant Array of Inexpensive (independent) Nodes - when one box dies, the software spins up another and assigns some load to it. The advancement was that 5 or 10 sketchy PCs could be had for the price of 1 more reliable rackmount box, but you didn't care much about reliability.

This all got some press after the Bigtable paper came out, OSDI 2006, after they'd had it in production for a few years and weren't afraid of anyone catching up.

2006: [https://research.google.com/archive/bigtable.html](https://research.google.com/archive/bigtable.html)

2004: [https://www.networkworld.com/article/2330258/tech- primers/ra...](https://www.networkworld.com/article/2330258/tech-primers/rain- architecture-scales-storage.html)

2004: [https://patents.google.com/patent/US6704730B2/en](https://patents.google.com/patent/US6704730B2/en) (search for RAIN)

<comment><USER6> This is a tangent, because hosting providers didn't really use distributed computing back in 90's. They don't really have to solve any coordination problems because every customer is separate by definition. As far as I understand, their conception of distributed computing was limited to sys admins maintaining NFS and so forth.

But going off on this tangent: I don't think BigTable was a major milestone in terms of fault-tolerant clusters of commodity PCs.

For example here is a write-up paper from 2003 that describes Google's search clusters:

[http://www.eecs.harvard.edu/~dbrooks/cs246-fall2004/google.p...](http://www.eecs.harvard.edu/~dbrooks/cs246-fall2004/google.pdf)

 _Google's racks consist of 40 to 80 x86-based servers mounted on either side of a custom made rack (each side of the rack contains twenty 20u or forty 1u servers). Our focus on price /performance favors servers that resemble mid- range desktop PCs in terms of their components_

This architecture existed for a few years before BigTable did.

Also, Google didn't invent this architecture. I did some research on this several years ago -- it appears that Eric Brewer's work at Inktomi in the 90's had an architecture that was largely similar to Google. I also think there was a name for it other than "RAIN". But I can't recall now.

This isn't the paper I'm thinking of, but it's from 1997 and has a lot of the ideas from Google (which became a company in 1998):

 _Cluster-Based Scalable Network Services_

[https://people.eecs.berkeley.edu/~brewer/papers/TACC- sosp.pd...](https://people.eecs.berkeley.edu/~brewer/papers/TACC-sosp.pdf)

 _We observe that clusters of workstations have some fundamental properties that can be exploited to meet these requirements: using commodity PCs as the unit of scaling allows the service to ride the leading edge of the cost /performance curve, the inherent redundancy of clusters can be used to mask transient failures, and "embarrassingly parallel" network service workloads map well onto networks of workstations._

\----

Ah OK I found it, the term is "Networks of Workstations". From 1994:

 _A Case for NOW (Networks of Workstations)_

[https://scholar.google.com/scholar?cluster=10897873705675337...](https://scholar.google.com/scholar?cluster=1089787370567533783&hl=en&as_sdt=0,5&sciodt=0,5)

I believe this work influenced first Inktomi and then Google... since the last author is Patterson, that's pretty easy to believe.

There are some stories about the Google prototype at Stanford (backrub) using every workstation they could cobble together.

 _In this paper, we argue that because of recent technology advances, networks of workstations (NOWs) are poised to become the primary computing infrastructure for science and engineering, from low end interactive computing to demanding sequential and parallel applications. We identify three opportunities for NOWs that will benefit endusers: dramatically improving virtual memory and file system performance by using the aggregate DRAM of a NOW as a giant cache for disk; achieving cheap, highly available, and scalable file storage by using redundant arrays of workstation disks, using the LAN as the I /O backplane; and finally, multiple CPUs for parallel computing. _

<comment><USER7> Hosting providers still don't really use distributed computing. Cloud hosting providers do, but mainly because they are great at selling the idea that the customer should help the hosting provider save money by accepting increased complexity.

What you're describing, clusters based on commodity PCs, have existed in some form since shortly after commodity PCs were introduced. Clusters in general have existed since 1977. The thing is that most computers were big and expensive, so there was practically no hardware available to make clusters on the cheap until the 90's.

The NOW workstation you reference was the progenitor of Beowulf clusters, developed at NASA in 1994. [[https://www.researchgate.net/publication/24321665_Clustered_...](https://www.researchgate.net/publication/24321665_Clustered_Workstations_and_their_Potential_Role_as_High_Speed_Compute_Processors)] But vendors were making similar clusters at the same time, because they all had to solve the same problem: handle workloads too big for a single machine. The _Tandem Himalayan_ and _IBM S /390 Parallel Sysplex_ were also both introduced in 1994, but those were big commercial products, not commodity clusters. Many other commercial cluster solutions had been produced in the previous 10 years. So it's not exactly some mind-blowing paradigm shift, and more an increased focus on reducing the cost of computing, which has always been the pink elephant in the room.

<comment><USER6> Well, I'd argue that Inktomi and Google are qualitatively different than earlier clusters for 2 of the 3 reasons mentioned in the NOW paper:

\- _dramatically improving virtual memory and file system performance by using the aggregate DRAM of a NOW as a giant cache for disk;_

\- _achieving cheap, highly available, and scalable file storage by using redundant arrays of workstation disks, using the LAN as the I /O backplane; and_

Also:

\- Compute clusters with shared memory are completely different than NOW clusters.

\- Compute clusters existed before, but most were not fault tolerant as far as I understand. Commodity disks have a (much?) higher failure rate than commodity CPUs.

As far as I know, NASA was mainly using compute clusters. As far as I understand, "Beowulf" clusters were mostly about compute. That is, doing a lot of computation on a relatively small amount of data. In contrast, Google and Inktomi were about doing a small amount of computation on huge data, and also operating live services.

Though, I'm interested in any specific examples of earlier systems that unified separate memories and disks from commodity PCs. For example, BigTable definitely unified distributed memory and disk into a single resource, but it came much later.

Also, to be truly called "commodity", the memory/disk should be unified over Ethernet, e.g. using a Unix socket interface and not something custom.

<comment><USER7> The ideas of unifying independent memory, disk and cpu stretch back to at least 1988 with LOCUS, eventually becoming OpenSSI. Single system image clusters were designed to manage tasks running on multiple computers as if they were running inside a single system. There were several SSI cluster solutions as of 1994.

PVM, beginning in 1989, was a popular choice for parallel processing and distributed computing. It extended a virtual machine concept to allow processes to interact between disparate, loosely networked machines, even with different platforms and architectures.

With increased parallel processing came a need for more distributed file systems (around in one form or another since the 1960s). They allowed processes on different nodes to interoperate without care of where the data was actually stored, and also more efficiently than if stored in a single node or array.

PVFS, a parallel filesystem designed by NASA in 1993 to work with PVM, distributed storage and access of an object's parts over multiple nodes. This would later be ported to Linux for use in Beowulf clusters. GPFS, an IBM filesystem also developed in 1993, worked similarly. Google File System was eventually designed by the same researchers who created Coda in 1987, an object data store turned into a distributed [parallel] filesystem.

So distributed filesystems evolved in parallel by different groups that based their work on earlier research projects such as AFS2 and Vesta. Google and Inktomi definitely had success with their implementations, but basically everyone was starting down that path as community computers became more available and parallel processing became more important.

<comment><USER6> Hm, I've heard of PVM but don't know much about it. I don't doubt that there were projects to to unify memory/disk/CPU across distinct machines before Inktomi/Google.

I don't think they used Ethernet and Unix sockets, but I don't know for sure. It's debatable how important that distinction is. Although, to me, commodity clusters also means commodity networking, not just commodity PCs, because otherwise the clusters wouldn't have been as cost effective overall.

Probably the more important distinction is how many nodes are working together, which of course correlates with how many faults there are, and the sophistication of the software that handles the faults.

I imagine earlier systems were in the 10-100 node range. Inktomi and early Google were more in the 1000 node range as far as I understand, and Google's clusters are up to at least 10K nodes and 100K CPUs/disks (probably more by now).

At every order of magnitude there are different engineering challenges. There are always precursors, and the NOW paper cites a couple in section 2.3 (MiLi91, Zho92). A 10 or 100 node cluster is definitely a precursor, but you could still call it qualitatively different than 1K to 10K nodes.

Also one funny thing is that Google/Facebook no longer use "commodity" clusters, if you take that word literally. You can no longer buy what they use in small quantities! e.g. a design from [http://www.opencompute.org/](http://www.opencompute.org/)

They're back to the model of highly engineered, relatively homogeneous, relatively reliable hardware. Not a bunch of PCs cobbled together with clever software!

<comment><USER7> Unix sockets? You mean Unix domain sockets? That only works on a single host. Perhaps you meant Berkeley sockets, the API for both Internet and Unix sockets. This became a POSIX standard and many systems emulate it, even Windows. PVM used them, and built abstractions and new methods on top of the socket APIs to make building distributed parallel-processing applications easier.

And Ethernet was, for a time, much more expensive and slower than other solutions, not to mention buggy. It is still slow in some cases (top supercomputers use InfiniBand). Adopting Ethernet was just something that happened due to a confluence of factors (I believe mostly IBM supporting it, and then everyone else, and it becoming cheaper, faster and more reliable over time). So this was just an industry thing, not really a distributed processing thing.

The number of nodes is less important than the number of systems - that is, if LLNL wants to do grid computing with CalTech, you're talking about parallel processing over two distinct systems. Even at Google, they may have multiple teams, each with a large distributed system on a different network, and they all have to interoperate. For this, you have to use PVM/MPI, or something similar. This was a significant step in distributed systems engineering. Google didn't _need_ to interoperate with _random_ systems, though, so they didn't _need_ to use PVM/MPI, so their systems were simpler.

I think the commodity computing helped them do massive processing cheaper, but at a point there's a lot of waste there, so they engineered out the waste in their new custom systems... which happen to be more expensive and complicated. Everything old is new again.

</comment></comment></comment></comment></comment></comment></comment><comment><USER8> I think she's talking about ev1servers.net. I used to be their client. Yes, it was crappy white-boxes, but it worked okay with the proper setup.

Look what happened with EV1Servers:

EV1servers.net > bought by ThePlanet.com > bought by SoftLayer.com > bought by IBM.

The Softlayer was formed by former ThePlanet employees.

I used to be a client of the Softlayer when they started too. They elevated to the next level the budget servers market, instead of crappy white boxes they used great Supermicro hardware. The secret was everything automated, very well executed by skilled and experienced people.

Today, even Joe's DC is automated and most of them even use branded hardware.

<comment><USER9> > he

Pretty sure that someone called "Rachel" is female, although I cannot find a full name or imprint on the website.

<comment><USER10> She's Rachel Kroll, a very very senior production engineer at Facebook.

<comment><USER11> From her blog recently, I'm 99% sure that's "ex Facebook very very senior production engineer" now?

<comment><USER10> Yeah looks like. Seems like I was on holiday when she left, and i then left shortly thereafter, so I missed it

</comment></comment></comment></comment></comment><comment><USER12> _Apparently, once this made the rounds, other people realized that customers were willing to pay for something so rough and dirty, and so why not create such a service themselves?_

This idea of getting "permission" to do things after seeing someone else do it crops up in my thoughts a lot. A lot of new fads in technology aren't necessarily _that_ novel in any technical sense but are simply people realizing it's OK to cut a corner, "misuse" something, or otherwise take an unorthodox approach.

<comment><USER13> I think this idea might be mimetic theory, possibly one of Peter Thiel's secrets, that people are mimetic and simply copy one another thus leading to competition. Another related idea might be blue ocean strategy which is basically similar to Peter Thiel's zero to one, on innovation.

</comment></comment><comment><USER14> Sorry for the the low res pic but we ran millions of sites on these things [1]. Much cheaper than any hosting we could find.

It was a nice time before the real race to the bottom. We hardly had downtime compared to the massive commercial hosters because we lived in the server cages those days.

I believe much of my tinitus comes from spending too much time there.

[1] [https://picturepush.com/+154WU](https://picturepush.com/+154WU)

<comment><USER15> What is that? Servers? I may be blind but I don't what those are.

<comment><USER16> My guess, having done some things like that at the time, is a motherboard, hard drive, and power supply strapped to a steel tray with no enclosure at all. The sides look like they may be plywood or 2x4s. Noisy and fragile, but easy to work on and dirt cheap to put together.

<comment><USER14> Yep! Exactly that!

</comment></comment></comment></comment><comment><USER17> I once worked with a hosting provider whose battery backup was that every server was actually a second-hand thinkpad.

<comment><USER18> I can't decide if that's horrifying or brilliant. Leaning towards both.

</comment></comment><comment><USER4> > I may never know if this picture and/or article ever happened, but it does > raise an interesting point. If the only thing keeping you the only player in > a certain market is ignorance of how you built your environment, just how > long do you think that will last?

As a note, it lasted long enough for the guys to make a very very healthy exit and for the data centers to eventually transition into the backbone (along with a bunch of other - mostly non profitable data enters) of Soft Layer now owned by IBM.

Edit:

Also here are some pictures of the place.

[http://www.datacenterpics.com/displayimage.php?album=3&pid=6...](http://www.datacenterpics.com/displayimage.php?album=3&pid=614#top_display_media)

Picture in question: [http://www.cloudcomputingexpo.com/node/102155/print](http://www.cloudcomputingexpo.com/node/102155/print) [https://www.bizjournals.com/houston/stories/2006/05/08/story...](https://www.bizjournals.com/houston/stories/2006/05/08/story4.html)

<comment><USER4> Also should note that at the time this strategy allowed the company to host about 1% of the internet at the time.

</comment></comment><comment><USER19> ISP here: bread racks and minitower PCs are still a common thing in low end hosting. In many cheap facilities the limitation is total amount of electricity and cooling available within a low cost facilities budget, so there would be no way to densely populate 44U cabinets with 1U servers anyhow.

</comment><comment><USER20> This kind of "ghetto colo" is prevalent in the cryptocurrency mining space, now (where power consumption is probably 10x higher) -- either using hardware ASIC miners or PCs with many GPUs. Often the hardware has an in-service lifetime of months, vs. ~10 years for some enterprise or networking equipment, and outages cost a lot less (a 75% reliable datacenter would be a joke; a 75% uptime crypto mine that cost $0.01/KWh might be fine -- "turn it off during peak load periods" or otherwise pre-emptable by the grid.

</comment><comment><USER21> I guess it depends, I don't see too much competition for Backblaze. Yet, they show you everything they got and use it as marketing. Link: [https://www.backblaze.com/b2/storage- pod.html](https://www.backblaze.com/b2/storage-pod.html)

<comment><USER22> Because perhaps their "secret sauce" is not in the hardware?

</comment></comment><comment><USER23> This story is possibly about Rackspace. Rachel was a Racker at one point, as was I, and the origin story matches up.

<comment><USER24> Robert Marsh, Head Surfer

[http://web.archive.org/web/20030802132245im_/http://rackshac...](http://web.archive.org/web/20030802132245im_/http://rackshack.net:80/english/images/hs.gif)

<comment><USER19> Bread racks and ordinary atx motherboards in mini/midtower cases are a much, much older idea than 2003... like mid-1999 to 2000 or so.

</comment></comment></comment><comment><USER25> during these days my company was in a data center in Los Angeles next to "Web hosting for life" a company who's business model was based on a single upfront payment that got you hosting for "life". (Whatever that means). Their secret sauce was cages full of 19" Telco racks with shelves filled with motherboards, power supplies, and hard drives. No cases. Some of the hard drives were zip tied to the shelves. We'd tour potential customers through the data center and say "this is what shared hosting gets you, what if your site was bring served from that "server" with it's hard drive hanging by a broken zip tie?" It was a great sales technique.

</comment><comment><USER26> related story including previous HN link: [https://web.archive.org/web/20140121020351/http://www.search...](https://web.archive.org/web/20140121020351/http://www.searchenabler.com/blog/build- your-own-data-center/)

</comment><comment><USER27> A great story... it leads me to ponder the architecture and extent of "ignorance," as used in her writing. It encompasses so much... from security through digital keys to unknown quantum structures to unoptimized algorithms and the obscurity especially of human biology and sunconscious desires.

</comment><comment><USER4> My post was too long so I am breaking it down.

Part 1

So...

This is where I got my start in tech. I worked there and and supported and racked many of said bread rack servers. I guess I could be wrong and they could be speaking of another company but there was only one company I ever knew to do this at it was rackshack, before it became ev1servers, and then later theplanet and now softlayer.

There were a few others in Houston at the time trying to get this working too, namely redhost (I think, or was it alphared or something like that. ) which I had the chance to visit once. This place was much worse they cooled the iles the customers would walk down meanwhile the servers got no AC. They also shimmied servers into parking lot storage rooms. But that is not likely the place the article was about.

While what described in the article sounded horrible it was not all that bad. But then again this was also the early 2000s. While each rack did not have a dedicated firewall they did provide some niceties globally to all servers such as basic dos attack prevention and some interesting but easily avoidable hosting panel exploit prevention.

It really was the wild wild west of hosting. You had the tech support named webtech who was normally off site and basically was a job for anybody who could spell linux. They did in house training to support the most common linux related issues. When I was there there was a guy named Bill Badoux. This guy ran training and had a fairly comprehensive training class for all incoming techs, but none of that really mattered, most of the real work always filtered down to a handful of knowledgeable people. What was important was somebody answered the phone and was there to listen to the customer -- mostly complaining. On the other end of things we had DC techs. They were mostly about rebooting servers as none of the whitebox servers on bread racks supported any sort of remote reboot. At the time you would phone in your reboot, or submit a ticket in this POS software called "pipeline" which was a total shitstorm in house ticketing system, that would more likely get you fired for it doing something different than you thought it might do than actually help you do anything. But us techs made the best of it and often resorted to IRC to actually get the real work done. The NOC was a separate entity -- I think their paychecks even came from a different org. They mostly sat around and watched graphs -- and again would call somebody who knew what to do when "the graphs looked bad". I know one guy nicked named Brain at the time who was one of the knowledgeable guys. He ended up writing some software to be able to display the graphs in real time. This really helped the techs spot things much faster.

I was there about ~4 years. Man there were stories.

One time I saw a DC tech drop a handful of hard drives on the way to a server to replace drives that had just failed. He picked the dropped hard drive up off the floor, dusted it off and proceeded to replace a failed dive with the drive he just dropped. By chance the server booted up and entered a FSCK -- we might be okay! -- but atlas the tech just powered the server off and powered it back one and it never saw the light of day again. Back then and probably still interrupting a FSCK was most defiantly doom to the FS.

Slightly NFSW but a true story. Rackshack hosted 2 things - Porn, and Jesus sites. Neither were all that nice to work with. The Jesus guys would always find out or suspect their server, hard drive, or IP was used to host porn in a previous life and demand we change one or all of the things they suspected had porn on it. This more than often resulted in your request causing your server to be shut down for a few hours and then turned back on and a note updating the ticket from DC stating the hard drive or whatever that had previously had contact with porn was swapped out. In reality the server just sat powered off for a few hours. Request for IP changes did happen and were actually carried out if they could, but again this is was the early days so that often required the customer to migrate their site to a new server in the data center. But back to the porn. One time I got a call from a guy wanting to know if his site was up. He ask me to navigate to a obvious porn site -- sure enough on our network with the less than 1 ms ping time. He proceeded to give me login information and navigate me to a specific video and asked me to click on it. It played instantly. After a few seconds I reported back to the customer and he asked a few question about the speed of the site. Then he proceeded to tell me the video was of him and his wife.... Now at that point I kept good notes in the POS ticketing system named pipeline. Those notes included the login credentials to the site for future testing -- I was a noob for sure. The next day I walk in to work and it was clear everybody had found the login credentials to the site and that was the first time I caused a policy change of do not record such things as the techs will abuse it for their personal pleasure.

<comment><USER4> Part 2

On another occasion I had to calm a customer down who was clearly about to have a aneurysm on the phone -- over a faster reboot request. At the time I was working in webtech. I had no control over reboots and could only forward the request to the DC techs to take care of when they could. At the time it was like 1 hour reboot request. This guy demanded to speak to my supervisor and was yelling and screaming. My supervisor was already listening in on the phone (shout out to Steve!) and had told me in IRC to just get him off the phone, there was nothing we could do and stick to the normal script of "Your server reboot request has been made and will be processed in the order it was received". And of course this was not acceptable. After a few more screams of rage from the guy and me asking him to calm down I told him I could not continue the call and that he should call back once he had a chance to cool off -- and then hung up the phone.

Once when I was working in what was known as DC2 the newest addition at the time to the data centers located in a area of town we lovingly called "guns point" because of the prolific amount of gun violence that accorded at "guns point mall". Side note, I was actually at the mall once when gun shots went off. Side note two, I shook the hand of a man who later washed me car, set a building on fire and then proceeded to go guns point mall to work out, attempt to rape a woman, and then shot the lady and him self. But atlas, we are talking about DC2. Somebody had taken what I can only describe as a "baby sized" dump. By baby sized I mean the size of a new born baby. It towered out of the water with a impressive girth. Nobody wanted to deal with it so the bathroom which happened to be the woman's bathroom sat shut for about two weeks. It was mostly fine but then the complaints form the women in the office started to roll in about the obvious issues; seat left up, pee on the seat, having to wait too long, smells. Being the problem solver type I am I decided I would rectify this issue. The entire office (about 8 people) were all integrated and decided to help me. We grabbed several paper towel rolls from the men's bathroom, and proceeded to wrap me up like a mummy -- head to toe, just tiny slits left for my eyes. Armed with a plunger they opened the door to the woman's bathroom and I shimmied in with them closing the door behind me. I told them not to open the door back until there was a proper flush. I proceeded to battle this baby sized dump for the next few minutes. It took about 6 flushes to get the entire thing to go down without flooding the place. The blame for the baby sized shit always landed on the smallest girl in the office :/ \-- note nobodies feelings were hurt, it was all fun and games, for fucks sake we were making like $7 a hour.

This has gotten much longer and I have only just given a few of the crazy stories about this place, but it is almost lunch time so I will leave you with this one last story.

During the DC2 bring up I volunteered to work on the wiring crew. I thought it would be a good opportunity to learn more about networking and make a little extra money. There I learned how to crimp network cable and the art of zip ties. We were on a super tight deadline so some times corners were cut, or should I say not cut. This one rack me and my coworker were wiring we failed to properly measure the correct cable length. Or goal was to work on both ends at the same time. The end result was we had a HUGE amount of cable left over. So with the art of zip ties we bundled it up, about 20 cables -- in to a big burrito and placed it on the top center of the bread rack -- out of the way and all... Little did I realize this rack was right in view of one of 2 network cameras that broadcast the DC live on the main page of the companies web site. The next day I was called to Pete's desk, the guy running the wiring crew (also know for having a box fan pointed directly at his junk while at his desk, and responsible for ordering copper power cables that would not really work for powering the types of servers we planned on powering.) Pete proceeded to pull up the website and point at the web cam picture (at the time updated once every 1 min) and asked me what was wrong with that picture. I did not see it at first, and said nothing. Pete then asked me about the huge blue burrito on top of the rack :(. I spent that day rewiring that rack.

Of the stories missing are the make shift data recovery operations on failed drives, platter swaps, incompetent employees who refused to use computers and required paper print outs, limo rides, foosball, bike building, tails of hacking, and the FBI.

All and all the the place was a awesome place to work with unlimited freedom to learn or do anything you wanted so long as it appeared to maybe help the business and it did not interfere with your daily duties. This is the place I learned to code, and got serious about computers hardware and software. I often look back at the things I learned here and how they help me do my job today.

Shout out to Brain, David (both of them), Sammy, Steve, Todd shorty pants, Bill, Jason, Curtis, Patrick, Bridget, Phil, Samantha, Cory, Fox, Brandon, Ken, Jen, and many others I am sure I have not forgotten just at a loss for names.

TLDR; Severs on bread racks, people paid crap, fun place to work.

<comment><USER7> Is it possible for you to edit these posts and put the contents in a pastebin.ca or similar link? They take up quite a bit of screen real estate, especially on mobile. Thanks

</comment></comment></comment><comment><USER28> What's the takeaway here?

I would say: there's business to be had by questioning all the conventional wisdom.

And: customers like low prices.</comment>


DDoS Attack on DigitalOcean.com - <AUTHOR> http://digitaloceanstatus.com/

<comment><USER2> These people plague me with condescending adverts on YouTube about how I've been "coding like a beast" and need some "cloud server action".

Perhaps someone finally snapped and DDOS'd them.

<comment><USER3> > These people plague me with condescending adverts on YouTube about how I've > been "coding like a beast" and need some "cloud server action".

Oh please tell me more about how the people helping to support the largest video database in the history of mankind -- available 24/7 at your fingertips for free -- are "plaguing" you with their relevant advertisements that take all of 5 seconds to skip.

If you really want to be a horse's ass, just get adblock and be done with it.

<comment><USER4> To be fair-- and sorry to DigitalOcean guys that are reading this, but this is honest feedback-- that ad really bugs me. It's got the "rockstar-itus." It's hard to pin down why that feels condescending, but it does.

I hear really good things about the service, though, so kudos to DigitalOcean for that.

<comment><USER5> I think the issue is that the ads "read" so unauthentically compared to the very positive experience I've had with DO and their wonderful setup tools, documentation, etc.

<comment><USER6> while the ads are over the top, the core message of "configure how many of those, and how much of that etc" did kind of draw me in.

</comment></comment></comment></comment></comment><comment><USER7> UPDATE: The attack has been resolved and the site and control panel are loading normally. Learn more: [https://status.digitalocean.com/](https://status.digitalocean.com/)

<comment><USER8> Your status page doesn't clearly convey that the issue has been resolved. Perhaps a green bar stating "RESOLVED" at the top in addition to the check mark would make it more clear (in addition to being usable by screen readers).

<comment><USER7> Noted. Thanks for the feedback.

</comment></comment></comment><comment><USER9> I work in a DC and DDOSes happen very frequently. Because everyone can hire a botnet for 50 euros, there will be even more coming.

Should I post to HN every time my company gets hit?

<comment><USER10> Well, it all depends. If it's a major customer affecting outage it should certainly be posted to your guys status page. I imagine you don't work at a HN 'echo-chamber' company like DigitalOcean though, I imagine not many people will be interested in hearing about it here :P.

</comment></comment><comment><USER11> what is digitalocean? These ddos attacks are kind of like free marketing campaigns :)

<comment><USER12> It's an Infrastructure as a Service offering like Amazon's EC2, Linnode, Microsoft Azure, or Rackspace. Digital Ocean[1] has seen a sharp rise in popularity lately from developers due to ease of use and high performance VM's.

[1] - [https://www.digitalocean.com/](https://www.digitalocean.com/)

<comment><USER13> Are their VM's performance on the same level as the others you listed or higher? What do you base the "high performance" comment on?

<comment><USER14> They differentiate themselves by offering SSDs for all instance sizes + offering a very cheap level ($5). While SSDs won't improve _all_ workloads, I think "high performance" claims compared to the typically IO-weak alternative isn't unreasonable.

Also, they're popular enough now that I'm surprised people haven't heard about them (especially after recent funding)...

</comment></comment></comment></comment><comment><USER15> Yea, status seems accurate at this point, my "Droplets" and Hypervisor seem to be working just fine, well done DigitalOcean team.

<comment><USER7> Thanks! :)</comment></comment>


Why I'm so "against" Ethereum - <AUTHOR> https://threadreaderapp.com/thread/1078682801954799617.html <comment><USER2> > state channels (ETH's version of Lightning), but it is unclear whether main- > chain issued ERC20 type tokens will be portable to this environment.

The Raiden project is the closest thing to Lightning, was recently deployed to the main chain, and explicitly supports any ERC20 token.

The article says Plasma is dead because...Peter Todd, a Bitcoin dev, claims they had a similar idea and rejected it? Meanwhile, on Ethereum a bunch of teams are actively working on it and the Loom project has a version up and running.

The article asks why if proof of stake is so great, didn't Ethereum just start with that? Because proof of stake had widely-recognized security flaws (like "nothing-at-stake"), and it took years of research to fix them all.

The entire article is of similar quality.

<comment><USER3> > The entire article is of similar quality.

You cherry-picked some points and rebuffed them, then proceeded to generalize and dismiss all of them.

The reality is that any SQL database would be superior to every blockchain unless your motives are criminal nature.

Disclosure: I sold all of my cryptos in Q1 2018, after buying my first bitcoin in the summer of 2013 and loosing a (luckily) small chunk of it in the infamous MtGox hack.

<comment><USER4> > The reality is that any SQL database would be superior to every blockchain > unless your motives are criminal nature.

People in Venezuela and other political or economically opressed people around the world don't agree [1].

It seems you are wrongly extrapolating the context where you live.

[1] [https://coin.dance/volume/localbitcoins](https://coin.dance/volume/localbitcoins)

<comment><USER5> This is, I suppose, very similar to criminal motive, except that we find them sympathetic. A reminder that not all that is (locally, de facto) illegal is wrong.

One man's terrorist &c.

<comment><USER4> Similar to criminal motives? It seems you never had 0 (zero) dollars and needed to receive a few dollars from your family outside your country with a government fully controlling the flow of capital.

<comment><USER5> The government being in the way of letting you receive a few dollars from your family is what's similar.

</comment></comment></comment></comment></comment></comment><comment><USER6> _By now the Ethereum bloat is so bad that cheaply running an individual node is practically impossible for a lay person._

This is an important yet under-appreciated point. It's now extremely difficult to sync an Ethereum node from scratch. If the processes ever completes on commodity hardware, it takes weeks. And that difficulty will only climb as more and more stuff gets dropped onto the Turing-Complete "world computer."

This situation drives users in ever greater numbers to services that tell them which transactions are valid or not. Verification with a full node, the bedrock of censorship resistance, dies a death of 1,000 cuts as a result.

<comment><USER7> It takes me about a day to sync parity on a consumer desktop with an ssd and a 7 year old i5 Intel cpu

<comment><USER8> I guess you're not doing a full sync. Here's an example of a person trying to do it:

[https://ethereum.stackexchange.com/questions/37348/parity- fu...](https://ethereum.stackexchange.com/questions/37348/parity-full-history- node)

<comment><USER9> An archival node goes beyond a full node and downloads data not needed for full validation.

<comment><USER10> It doesn't download them, the state history is generated from the blockchain locally. The blockchain itself is 68GB (uncompressed, decimal G)

</comment></comment></comment></comment></comment><comment><USER11> When reading this I think of my deep knowledge of TCP (especially the pain points) and yet it is "The Internet" for the past while. Compared to simpler protocols like Delta-T and later/better protocols like XTP, TCP still "won" for a variety of reasons (adoption, good enough, numbers of implementation, hardware implementation, etc)

There are a couple reasons I think Ethereum might prevail over bitcoin:

* Vitalik is young and "all in", god willing he will have many decades to refine and improve Ethereum. Think Linus and Linux versus the cabal of Bitcoin and BSD core leadership.

* Most of the criticism in this article are things that have slipped committed or expected dates. The community is aware of the problems and is looking forward to fixing them despite it taking longer than expected. It's ok to be wrong and off on dates if you get it right "just in time" which is only obvious after the fact.

All in all, Bitcoin might be BSD and Ethereum might be Linux. BSD was technically better for a decade, but Linux had the central leadership of a young Linus and scaled better in adding new developers and corporate users into the mix at the right time. That seemed to matter more than quality, stability, and longevity of governance at least up until now.

It's perfectly valid to point out the technical flaws and remind people they missed their commitments. But I'd caution against making financial decisions with too much weight on that alone, which would be about as effective as making them on the expected good will of the community of a cryptocoin :)

<comment><USER12> I guess BSD and Linux were aiming to take the same position as OS where Bitcoin and Ethereum are not.

No one sane would get Bitcoin staffed with complicated features beyond its simple purpose of keeping a decentralized ledger.

Nothing else would go forward if it isn't for Bitcoin running in a stable way.

Bitcoin would be positioned as TCP whereas Ethereum would be regarded as HTTP protocol ready to run apps on top.

BSD's position is more like Bitcoin Cash (or SV). Similar purpose, different philosophy.

<comment><USER2> Except that HTTP literally does run on top of TCP, while Ethereum doesn't depend on Bitcoin in any way, unless you count price action and the minds of many speculators.

</comment></comment></comment><comment><USER13> He's criticizing Eth for being a " science experiment"? The entire crypto ecosystem _is_ just an experiment, including bitcoin. It's all immature and unstable.

<comment><USER14> I've always tried to tell people that ask me about crypto currencies that not only do they not have any intrinsic value, but the only positive value that they have is entropy. I explained it like this over Christmas dinner, lets say I wanted to start a new commodity, for arguments sake lets say that this new commodity is based on matches. Matches have a value, you light them and they produce a certain amount of energy. You can use them to light candles, clean out that odor from the previous occupant of the toilet, you could even combine a match with a small sterling engine to create motive power. But my commodity isn't the matches, its the energy used as the match is burnt. In my novelty commodity I only trade in matches that have been used, its proof that the match performed work in that it burned a fractional number of BTUs. This proves that the matches are sound. Furthermore, I, as a processor of used match commodities, can charge a nominal transaction fee when people trade spent matches on my Matchchain(TM) platform. Also, while this is a commodity I will call it a currency regardless of the fact that it has no debt instruments, lacks liquidity and is completely unregulated and prone to theft. Would you care to invest?

Now replace spent matches with spent compute.

<comment><USER15> The "valuable" matches would have to do something statistically rare, like make a pattern of Jesus's face or something. And somehow be resistant to counterfeit matches. Then your analogy almost makes sense.

<comment><USER14> Do crypto coins make patterns of Jesus's face? Man there is something I would never have guessed. Also is counterfeit money really that big of a problem that its debasing the value of the dollar enough that we have to abandon all notions of fiat currency and replace it with an entropic commodity that burns energy to no other end? I mean I get, that the "valuable matches" are the ones that "make a coin" of whatever the jargon is but the problem is to make a "coin" takes 215 kWh to create, lets put that back into match terms, assuming one matchstick has one BTU and we convert BTU to kWh that comes to about 733610 matches at a conversion rate of 0.000293071 kWh per BTU that comes to about 2445 boxes of 300 count matches. Amazon sells a 3 pack of 300 count matches for 6.75 which comes out to about $5501.25 for 733610 count of matches. Now be aware that I'm pulling these number out of my ass, butt every match I burn has a 1 in 733610 chance of being a "Jesus Match" that means that I can burn more than that and still not end up with a match that is a Jesus Match because its a statistical argument much like the lottery. In the end what do I have to show for all of this? A huge fucking pile of used matches, and a real sense that maybe just maybe the Emperor's New Currency has value.

<comment><USER15> What you have to show at the end of the day is a digital currency that has no central authority and yet still prevents double spending.

The cycles are not wasted - they secure a digital currency.

Banks and governments use immense resources to secure fiat currency.

<comment><USER14> >The cycles are not wasted - they secure a digital currency.

But why though? Is the USD that insecure? Is fraud so prevalent that its debasing the value of currency? Do we literally need to spend 70TWh per year, and that's just in its current state as a semi novelty currency/commodity, to secure the concept of money? Can you imagine how much it would cost to run bitcoin if it was the primary reserve currency of the world?

</comment></comment></comment></comment></comment></comment><comment><USER16> > 7/ Recently, a team of reputable developers decided to peer review a widely > anticipated Casper / sharding white paper, concluding that it does not live > up to its own claims.

That's rather misleading. The critique was about Casper CBC, which is very different from Casper FFG. Casper FFG is the basis of the Ethereum 2.0 design, and it's not very controversial. Casper CBC may be more controversial, but nobody is suggesting that it be deployed any time soon. It's Vlad's ongoing research project.

</comment><comment><USER17> Lots of misinformation in this article. My favorite one is "Plasma is dead". Meanwhile Plasma MVP was just demoed at Devcon last month...

<comment><USER18> Plasma was also developed by the same guy who created the lightning network

</comment></comment><comment><USER19> This is a very good read from what I call the thought leaders of HN and Silicon Valley. [https://a16zcrypto.com/](https://a16zcrypto.com/)

</comment><comment><USER20> This is bitcoin maximalist dreck, I'm surprised to even see this nonsense upvoted on HN.

<comment><USER21> Perhaps, but its nice to see some discussion in these comments that isn't just taking a dump on all crypto currency like I have seen many times before.

</comment></comment><comment><USER22> I find it extremely disturbing that cryptocurrency discussions sound so much like political debate

<comment><USER23> More like religious debates honestly: "the cryptocurrency I 'invest'* in is the one true future and all the others are shitcoin scams" — like calm down, IMO they're all scams ;)

* It's not an investment as it does not convey ownership interest.

</comment></comment><comment><USER24> >>12/ However, upon closer examination [Plasma] was the recycling of some stale ideas, and the project went nowhere

Past tense? this guy isn't very thorough.

</comment><comment><USER25> TL;DR: A long, insightful, and at least partially correct critique of the "state" of Ethereum as of today.

My humble 0.02 is that what's current is immature and unstable, but there's a decent chance that Ethereum, or Bitcoin, or both, will at some point in the future provide some interesting technical solutions/services.

The fact that Ethereum is not there yet is not a good enough argument for me.

<comment><USER26> Other than making some people really rich, what problems would it solve that aren't better solved by existing solutions which don't burn energy to create secure entropy?

<comment><USER27> Remittances without high fees.

I think as entropy becomes very inefficient to produce (difficulty multipliers increasing on crypto as the network expands...) it will become more clear that the expensive part about sending money internationally is trusting all parties involved.

You pay VISA/MASTERCARD a 3% fee because you trust them to protect your account in the case of fraud. Moneygram takes 2% of all transcations over $900 because you trust them to move money from your account to the recipients account without losing it.

Even in computer security, you have to put your trust in something. Somebody picked cryptography and high numbers of CPU cycles.

Anyway, you asked what problems crypto could solve, and I guess my answer is, maybe it will cost less to send money around the world. As it turns out, there's not necessarily a way to make it free.

<comment><USER26> I don't pay a fee on my credit cards, the merchant does, and in case of fraud I can issue a chargeback to boot. As long as I pay my balance each month, my credit card is free, plus generating rewards. That's almost the opposite of cryptocurrency, where far from being able to tackle fraud, it makes theft or loss nearly impossible to remediate. A credit card is also one of the easiest things to use, and all of the hard work on security is undertaken by merchants and the credit card issuer.

<comment><USER28> > I don't pay a fee on my credit cards, the merchant does

While that may be technically correct, it's ignorant of the fact that costs are always passed down the line in any economic relationship like you're describing.

That fraud protection costs the card issuers, which is the basis for that merchant fee, and the merchant passes the cost on in the form of higher prices. (Merchant accounts with higher fraud rates will pay higher fees!)

So from another perspective, you actually are paying the bill for those unknown percentage of frauds, which you wouldn't be as much on the hook for so directly if only everyone was responsible for their own individual security.

<comment><USER26> If the price of Good N is Value of N+x where x is a markup to cover the costs you're talking about, that cost is passed on to people who pay with any means. If I buy a TV with cash, or credit card, it costs the same. Except of course that I can get cash back on my card, but not with cash (or bitcoin).

So, credit card or not, the cost is there, even if I pay with bitcoin or ether. Except of course for the benefits of the credit card.

<comment><USER29> >" that cost is passed on to people who pay with any means. If I buy a TV with cash, or credit card, it costs the same."

If people start charging less when paid via methods that have less chargeback risk will you reassess?

<comment><USER30> As a matter of fact, this (merchants giving a discount for cash transactions) used to be illegal in Brazil. It recently became legal, but I haven't seen much evidence of changes.

<comment><USER29> Cash is also more easily counterfeited than card transactions. I'm not sure how the risk of a fraudulent transaction works out in the end.

</comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER31> There's a reply to each of the 50 tweets by Vitalik Buterin on Reddit here [https://www.reddit.com/r/ethereum/comments/aac4hr/tuurs_crit...](https://www.reddit.com/r/ethereum/comments/aac4hr/tuurs_criticism_discussion_thread/)

By the way, not much mentioned in the discussion but I'm for Ethereum and kind of anti Bitcoin because of the awful environmental impact of proof or work which the Ethereum folk are at least trying to find a solution to.

<comment><USER32> > awful environmental impact of proof or work

compared to what? you can't have free cheese and environmental (and social) impact of existing fiat systems is far worse.

> Ethereum folk are at least trying to find a solution to

PoS was known long before PoW. PoS is not and cannot be a solution because it doesn't provide _objective_ measure by which competing chains can be compared. only trust in third parties that can be hacked, coerced, etc. oh and ofc "the rich get richer" \- so much for fixing awful impact from fiat systems.

</comment></comment><comment><USER33> >Ethereum is becoming increasingly centralized.

How do people see the forks, the 'closed' meetings, the pivots, the obvious influence that a couple devs have over the entire system - and still walk away with any notion there is decentralization?

<comment><USER34> Because there are several different kinds of decentralization and it's not black and white.

Miner decentralization is important is the whole security model relies on nobody controlling >50% of hashrate.

Developer centralization is another important point. BTC arguably fails at this when a small group, combined with extensive propaganda campaigns, artificially constrains Bitcoin's throughput. There are no valid arguments against raising the blocksize to 2MB for example.

Then there's node centralization, wealth distribution and maybe other types I'm missing.

<comment><USER33> >Developer centralization is another important point. BTC arguably fails at this when a small group, combined with extensive propaganda campaigns, artificially constrains Bitcoin's throughput. There are no valid arguments against raising the blocksize to 2MB for example.

If a handful of people could effectively destroy a "currency" at any point... it's not decentralized in any sense of the word that is important for trustworthyness or longevity.

A government could crash its own money, but there is a strong incentive to not do that. Bitcoin or Eth has nothing tied to it, it's entitely at the whim of some programmers who as I understand it, aren't economics experts.

That's the point I made above. You want to say the blockchain and hashing is decentralized, great. But when people use that word, they're talking about (imo) how it's _"safe"_ to put money into because _"no one owns the crypto coin"_ and if anyone still believes that latter part, well, they probably aren't paying attention.

<comment><USER34> That's not really true though. They didn't "destroy" it. They constrained it's development and hindered adoption.

They didn't do it by themselves either. They got miners and exchanges on board as well.

Also if you disagree and you think there's a better way to develop it you can by creating a fork or sell your coins. There is nothing stopping you.

> they're talking about (imo) how it's "safe" to put money into because "no > one owns the crypto coin" and if anyone still believes that latter part, > well, they probably aren't paying attention.

There's a difference between believing nobody has significant sway over how the cryptocurrency should be developed and you personally having full control over your own coins.

</comment></comment></comment></comment><comment><USER35> There are other projects like Komodoplatform that are make big strides in block chain tech.

</comment><comment><USER36> What about tezos?

</comment><comment><USER37> As a developer, I checked Ethereum's code base. To be honest, it is not that complex in the tech itself.

I know it is not fair to just count code lines to compare the complexity. But the Ethereum python code base has only 30K-40K lines code including test while Linux kernel has 15M lines.

<comment><USER38> Ethereum is predominantly written in C++. The python codebase you are talking about is the Ethereum client / virtual machine of which there are several implementations written in Java, Go etc.

<comment> gamma-male Non of you are right. Go ethereum (geth), the official client is written in Golang

<comment><USER37> I know GETH is the official one now. But that does not matter at all. So a software written in Python is only 30K line with tests, it could become 15M lines once it is rewritten in Go? Of course, it is IMPOSSIBLE!

Btw, there is also a RUST implementation from Gavin Wood, which is much faster than Geth.

<comment> gamma-male I have no idea what python implementation you're talking about. Concepts behind cryptocurrencies are most often not hard, but there are a million implementation details to consider if you want to write a production ready client

</comment></comment></comment></comment></comment><comment><USER39> Vitalik & Co have enough money to hire an army of top developers if they want to try and fix ETH. The fact that they don't is proof that it's unfixable and that they don't care.

<comment><USER18> There aren't enough devs who know how to write/research decentralized apps for them to hire. If you know of them, they will hire those people gladly

<comment><USER37> FB and Aws both have a branch of devs who know P2P and blockchain.

P2P is not that complex, just it is not worth time to work on it at this moment because it goes nowhere.

Actually, P2P research was only hot around 2000-2005.</comment></comment></comment>


Startup Tips for the Early, Early Days - <AUTHOR> http://nusoni.com/blog/5-startup-tips-for-the-early-early-days

<comment><USER2> Looks like this is the original article:

[http://onstartups.com/home/tabid/3339/bid/4245/Startup- Tips-...](http://onstartups.com/home/tabid/3339/bid/4245/Startup-Tips-for-the- Early-Early-Days.aspx)</comment>


The Fire Phone Is Officially a Failure - <AUTHOR> http://www.wired.com/2014/10/fire-phone-a-failure/ <comment><USER2> As innovative as Amazon are in the online commerce space, I think everyone called this from the start as a massive failure. You would think with the trove of information that Amazon have as well as the incredibly smart data scientists they employ they could have analysed their treasure trove of info to see that a phone with restricted access to applications, sub-par hardware and overpriced retail cost would not sell very well. Heck, even without analysing any data, you would have the answer. What makes this situation even weirder is Jeff Bezos is a notorious data-driven decision maker. He is a numbers guy, he does not usually make decisions based on impulse or the need to compete, so I do not know how things got to this point.

Does this mean that Amazon are out of the smartphone business because of one failure? Not necessarily. Amazon have the money, the power and means to release something spectacular, but they will need to learn from their mistakes as well as their competitors and go back to the drawing board. I honestly would not be surprised if they already have a new phone in the works already.

One area Amazon could beat their competitors on is price Even though you can already buy a whole bunch of affordable Android phones, they usually come with horrible hardware and are made of the cheapest materials possible. If they can release a phone with a decent camera, proper unrestricted Android OS, plenty of RAM, removable battery, great GPU/CPU and get the cost low enough that it wipes the floor with Google's offerings and price point, we would have a viable fight on our hands.

<comment><USER3> They started development on this phone during 2010. I think it got super delayed and that was one of the main reasons behind its failure.

<comment><USER4> Having worked for a hw supplier to amazon in the past (though I had no information on the actual products, being in Eng.), I came here to say just that. It made much more sense when they started development.

Lab126 failed to deliver. This is why I respect Samsung, even though I am not fond of their practices. Samsung moves extremely fast and extremely shamelessly. Speed matters a lot, and they've proven it time and time again.

<comment><USER3> I completely agree. I believe in Ship fast and move quick. Anybody can deliver in 6 years but you are a game changer if you can deliver in 6 months.

If Amazon followed iterative approach to fine tune rather than one shot with super delay then it would have been a different story.

</comment></comment></comment></comment><comment><USER5> I can't fathom why Amazon could not find the expertise to see this one coming.

I mean, let's be real here, it's an extremely restricted platform that cuts you off from tons and I mean tons of great content on app stores we already have, content we're already familiar with.

And then it provides you with sub-par hardware at that price level and nothing more than gimmicks.

And one of the big reasons for all of this? To push a feature allowing people to point their phone at something and buy it on Amazon. Surprise, that's a software-based feature you could build for just about any phone.

<comment><USER6> The fire phone (and other failed experiments like the Kin or the various Facebook phones) all seem like they're identifying "locking the buyer into a single corporate ecosystem" as a feature, but consumers are treating it as a bug.

<comment><USER7> I think you're right, but Apple does exactly that, so it's clearly possible to succeed that way. Whether it's possible for anyone but Apple to succeed that way is another question. I think it might be--say a Chinese company with Chinese customers, or a future Google-only ecosystem, or an Amazon that negotiates a huge range of discounted offerings (20% discount at Starbucks and thousands of other brick & mortar restaurants and shops as long as you buy with your Amazon phone through the Amazon retail network, etc.

<comment><USER8> With the iPhone Apple only had to be better than a smart phone, which they did. With Android Google had to be better than a smart phone, cheaper than an iPhone, or at least just as good and they basically did that.

Today if you launch something new you need to be able to compete with the value in the iOS and Android ecosystems to draw people and that's a VERY big hurdle. Microsoft is trying their hardest but can't get it done.

There is no surprise here. Amazon's software ability and follow through is best describe as "exists" and the third party ecosystem is tiny. I'd rather have any $200 Android phone (even a low quality one) than a free Fire Phone and I _like_ Amazon.

"Here's a phone, it has no popular apps, and they'll probably never be available!" Yeah. Same thing that killed the Pre. Same thing that's killing Windows Mobile.

<comment> rational-future You're underestimating Amazon's software muscle, they have some very hard hitting teams. Plenty of PhDs, old-time Lispers, etc.

I have a Kindle Fire HDX 8.9' tablet, the hardware is top notch and there are plenty of apps. From what I know, if an Android app doesn't heavily rely on Google proprietary APIs, like Maps, it's trivial to put it on the Amazon store.

But yeah, the phone needed to be 2-3 times cheaper to sell well.

<comment><USER9> > You're underestimating Amazon's software muscle, they have some very hard > hitting teams. Plenty of PhDs, old-time Lispers, etc.

Call me when they can figure out that $.99 == $.99 100% of the time. [Hint: At least once every few months, this isn't true for at least one of their back end services and I have to clean up after it. This is just one issue of many they have, including the fact their "primary key" for items (ASINs) can be duplicated across multiple products.]

I think many, many people overestimate Amazon's technical capability.

They are competent but they are not _special_.

Hell, they can take up to _8 days_ to ship something from a warehouse sometimes.

</comment></comment></comment></comment></comment></comment><comment><USER10> Honestly this is no surprise. I am a big Amazon fan, but if you are selling a restricted platform item you have to sell it at a loss. I do not know what they were thinking. It was priced higher than comparable flagship phones while being somewhat locked down.

<comment><USER11> Yep. Lack of Google Apps was a complete deal killer for me, even withstanding the price. I felt the same way when I tested out a Kindle Fire tablet (opted for a Nexus 7). You'd have to pry my Kindle reader out of my cold dead hands though.

<comment><USER12> I bought the Fire HD 8.9", rooted and installed Play store. You can run all the apps on play store. It was a better deal that way.

<comment> rational-future But nobody has payed Google for store access in this scenario. They may cut you off any time.

</comment></comment></comment></comment><comment><USER13> > The Fire phone's product page at Amazon lists over 3,000 user reviews, > mostly negative—the average rating is two out of five stars.

This highlights Amazons commitment to their customers. This is why Amazon will be #1 in the customer loyalty game in the long run. NO other company would keep this many bad reviews on their OWN product page.

V2.0 will be sooo much stronger because of this. Tough lesson to learn but invaluable internal motivation & feedback for the team.

Now if v2.0 isn't on AT&T, I will try it ....

<comment><USER4> V2.0 is what I was thinking as well. Many amazon products have terrible version 1.0s (kindle fire tablet anyone?), but improve markedly in the future. Fire phone is terrible now, but I'm not going to let that convince me that it will still be terrible 3-5 years from now.

</comment></comment><comment><USER14> I'm surprised Amazon has doubled down on the idea of screwing their customers out of a good Android experience. That's all this is: Amazon ignored what was good for users (access to the whole Android ecosystem), and instead focused on what was good for Amazon's immediate desire to extract ongoing revenue from their customers.

Instead of making a better phone for consumers, they focused on making a better phone for Amazon. And, it turns out, "Makes Amazon richer", is on nobodies feature wish list for their next phone. Obviously, most folks probably don't mind Amazon making money...but, why would anyone buy a phone for which the _only_ major differentiation is that it sends most of the long term app revenue to Amazon, and by doing so, limits the user to far fewer apps and less freedom to do with the phone what you want?

I'm almost amused at the gall of Amazon thinking they had the marketing and product chops to pull off an Apple-scale consumer-fleecing like this.

</comment><comment><USER15> What I'm really curious about, but probably won't find out anytime soon, is what the internal politics on the development of this were like. Did somebody high up decide that Amazon had to have a phone, no matter how bad the market looked like for it, command that it be done, and the whole hierarchy went along with it, even though most of the company was kinda meh about it? Or did a critical mass of lower-level people inside the company really think that this was a good idea?

Most of the tech press and community had a feeling that it was a bad idea that was unlikely to ever go anywhere, and it's hard to believe that the entire company was unaware of this and of the market facts behind it.

<comment><USER16> I worked on this device. Every day we awaited the news that management had come to senses and cancelled the project. It was to my great surprise that it shipped at all.

</comment></comment><comment><USER17> This iteration is a failure, at least. It remains to be seen if the overall idea of an Amazon phone is dead or not.

I personally wouldn't ever buy one, much like I'd never get a Facebook phone, but it could be that there's people out there who might.

<comment><USER18> This seems like the only logical reason any sane person at Amazon thought this phone would be a good idea. It's such an obvious dud in this stage. These people aren't stupid, yet there is no way this product would ever be successful. It would be fascinating to learn just what they are thinking.

</comment></comment><comment><USER19> I still find it astounding that high-ranking execs at Amazon could have thought that this product had even the slightest chance of being successful.

If the Kindle Fire tablets had all cost the same price as an iPad, I seriously doubt they would be enjoying the popularity that they have today. It would appear that the thought process leading to the existence of that Fire Phone was that the Kindle Fire's success has less to do with price and more to do with Amazon.com ecosystem integration!

</comment><comment><USER20> How did they not see this one coming? Bezos is notoriously a data driven decision maker, I wonder what data prompted them to build the fire phone.

<comment><USER21> failure is a data point. As a scientist, I would say, arguably the more important data are failures. Consider it an exercise in falsification.

<comment><USER20> i agree that failure is an important data point, but i don't understand why that means amazon would want to build the fire phone. their reasoning couldn't have been "well this seems like a good idea, and if it fails, at least we'll have a data point!" I am curious what caused them to think the fire phone was a good idea.

</comment></comment></comment><comment><USER22> I have to wonder if Amazon's failure to recognize the obvious here has anything to do with Bezos' "we are willing to be misunderstood for long periods of time." That statement has always kind of bothered me. I get what he was trying to say but I have to think they believe they can innovate against markets.

</comment><comment><USER23> $83 million in unsold phones is a lot of inventory. I wonder if they'll end up sold on Woot or plowed into a landfill a la E.T.

</comment><comment><USER24> It's a failure because of being associated with AT&T, plain and simple.

<comment><USER13> this is a very large part of it</comment></comment>