NSA statement does not deny 'spying' on members of Congress - <AUTHOR> http://www.theguardian.com/world/2014/jan/04/nsa-spying-bernie-sanders-members-congress <comment><USER2> They wiretapped all of Washington DC, "by accident", in an election year.

[http://www.washingtonpost.com/world/national-security/nsa- br...](http://www.washingtonpost.com/world/national-security/nsa-broke- privacy-rules-thousands-of-times-per-year-audit- finds/2013/08/15/3310e554-05ca-11e3-a07f-49ddc7417125_story.html)

</comment><comment><USER3> "Members of Congress have the same privacy protections as all US persons."

So, yes then.

</comment><comment><USER4> The NSA is one of the most powerful organizations on this planet, and the only people that could actually be kind of a threat to them, are members of congress. So in other words: the only people on this planet, who have the ability to do something against the total surveillance of the world... are exempt from surveillance.

Who the fuck, would believe that?

<comment><USER5> Not only that, but with typical rates of addiction, adultery, domestic violence, pedophilia, drunk-driving, tax cheating, etc. there is huge potential to build a "caucus of the compromised." Perhaps enough to swing any vote that needs swinging.

<comment><USER6> _" caucus of the compromised"_

Nice turn of phrase - some googling suggests it's original?

<comment><USER5> I'll take credit for it if it is in fact original. It did just pop out while writing this.

</comment></comment></comment></comment><comment><USER7> One thing that scares me about the NSA is that they are essentially a part of the executive branch. Imagine what a president from either party could do with that kind of power versus the other party or even just people they want to destroy. Now who can stop this?

<comment><USER8> The American people. Isn't this kind of thing the reason why your constitution gives you guys guns? If a tyrant took over, if all else failed you could always just shoot them.

<comment><USER9> The tree of liberty must be refreshed from time to time with the blood of patriots and tyrants.

Thomas Jefferson

[http://www.brainyquote.com/quotes/quotes/t/thomasjeff109180....](http://www.brainyquote.com/quotes/quotes/t/thomasjeff109180.html#kjOhyeIwa2yo7uuL.99)

<comment><USER6> I recommend everyone read up on the context of that quote - the letter it was from and the events it was regarding - rather than make assumptions.

</comment></comment></comment></comment><comment><USER10> I hope that 'the Merkel effect' will be significant here, in that it was not an issue until those with power were directly and obviously affected.

All too often it feels like 'the people' is a separate set to that of those in positions of executive power, with a bit of luck the smart wording of Bernie Sanders will ingratiate previously unbothered elements of the powers who can actually do something about stuff.

That said, I don't think 'spy on everyone, except the powerful' is a step up, if anything it's worse.

<comment><USER3> Not spying on Congress would be a step up though. Congress has oversite on the NSA, not the other way around.

When the extent of the Snowden leaks became apparent, I called one of my Senators, Udall. As I was speaking to the aide on the phone, I had a sudden, horrible moment of clarity: This communication, _this very phone call_ , this act of democracy being practiced between me and my Senator, was being monitored, cataloged and analyzed by the NSA.

I was furious.

[[And, to the NSA spy reading this: Shame on you. Fucking shame on you.]]

<comment><USER11> Where would you draw the line on spying? Any american citizen is potentially a criminal threatening the republic.

<comment><USER3> The people who wrote the Constitution drew the line at "specific suspicion."

Amendment IV [http://www.law.cornell.edu/constitution/fourth_amendment](http://www.law.cornell.edu/constitution/fourth_amendment)

The right of the people to be secure in their persons, houses, papers, and effects, against unreasonable searches and seizures, shall not be violated, and NO WARRANTS SHALL ISSUE, BUT UPON PROBABLE CAUSE, SUPPORTED BY OATH OR AFFIRMATION, AND PARTICULARLY DESCRIBING THE PLACE TO BE SEARCHED, AND THE PERSONS OR THINGS TO BE SEIZED.

That's where I would draw the line.

</comment></comment></comment></comment><comment><USER12> [http://www.huffingtonpost.com/2013/06/20/russ-tice-nsa- obama...](http://www.huffingtonpost.com/2013/06/20/russ-tice-nsa- obama_n_3473538.html)

"Russ Tice, a former intelligence analyst who in 2005 blew the whistle on what he alleged was massive unconstitutional domestic spying across multiple agencies, claimed Wednesday that the NSA had ordered wiretaps on phones connected to then-Senate candidate Barack Obama in 2004.

Speaking on "The Boiling Frogs Show," Tice claimed the intelligence community had ordered surveillance on a wide range of groups and individuals, including high-ranking military officials, lawmakers and diplomats."

definition of irony

</comment><comment><USER13> I would like my British MP to ask in parliament if GCHQ are spying on members of the U.S. Congress. This is because we already know that the NSA get GCHQ to do little favours for them to get around domestic spying laws.

I was thinking I just need to cut and paste the senator's question and get my MP to ask it, however, does anyone here have any details to wording or other ideas so that a weasel word response isn't all I get?

<comment><USER14> > This is because we already know that the NSA get GCHQ to do little favours > for them to get around domestic spying laws.

It's just as illegal under U.S. law to have GCHQ do it for you as for NSA to do it directly.

This is a well-discussed loophole already and the courts have already made clear it's illegal.

E.g. you have a Fourth Amendment right to avoid having your postal mail (or any other papers or effects) searched unreasonably. You do _not_ have a Fourth Amendment right to avoid having your UPS parcel searched by UPS.

Does this mean that the government can simply tell UPS to open your UPS parcel to evade the Fourth Amendment? It's not UPS's personal property so they have no Fourth Amendment protection to the parcel. And you have no Fourth Amendment protection from UPS.

But as it turns out once UPS acts under the direction and control of the government, they also have to comply with the _strictures_ on the government. So they cannot legally be made to violate the Fourth Amendment on behalf of the government.

The big catch is that a third party may voluntarily divulge information (e.g. if they rip open your parcel by accident while throwing it out the truck on Christmas Eve and a bomb spills out, they can tell the government). But they can't do so on request of the government.

And so it is for GCHQ and NSA. GCHQ could conceivably tip off the NSA if they happen to get evidence of a US person plotting a terrorist act (much like the USA might tip off Germany to a German national, if it were discovered). But the NSA can't ask GCHQ to deliver information on a US person. At least, not legally, but if you're assuming the NSA will just break the law anyways you're already screwed.

<comment><USER15> If the five eyes already have information sharing agreements, doesn't it mean that based on a tip from an NSA agent, a GCHQ agent (or Canadian, Australian, NZ...) could investigate, and then the contents of that investigation could be seen by the NSA under the sharing agreement? And it's okay because it's not your data they're looking at, but the report on the data? Probably wrong here, but it sounds just weasel-wordy enough to pass muster.

<comment><USER14> I would imagine that, at best, a "report" (originated from abroad, mind) would still get you at best something similar to parallel construction: Nothing _really_ useful other than a specific tip to start a real investigation on a specific person, which would require a warrant you can't yet get from FISC due to lack of admissible evidence of probable cause.

Either way it's a very dangerous legal ground to walk on. Whatever else we can say for NSA, they've been listening to their lawyers this time.

</comment></comment></comment></comment><comment><USER16> It can't deny that. It is engaged in mass surveillance of US citizens. Members of Congress use Google Mail just like everyone else. To deny that they may have collected information on a Congressperson just sets them up for yet another scandal.

Presented with that question, NSA gave the only answer it could possibly have given, short of (once again) lying directly to Congress. That's not all that interesting of a result.

<comment><USER17> Out of curiosity; what is the official mail system of the USG?

<comment><USER16> I don't know; I won't work with USG IT. I know the DoD has their own system.

<comment><USER18> > I won't work with USG IT

This may be none of anyone's business, but I'm curious enough to try asking anyway: is this a moral objection of some sort, or something more mundane (i.e. inconvenient regulatory burden)?

<comment><USER16> Moral.

<comment><USER19> What specifically is your moral objection?

<comment><USER16> I wrote a longer response a couple days ago but the outage ate it. :)

<comment><USER18> IIRC (because I think "Moral" is likely to be misinterpreted by people reading into it what they want) your response came down to "the moral landscape when working with DOD and DHS in particular, is forbiddingly difficult to navigate, so I've chosen to avoid them both - EPA et al I'd be happy to work with".

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER20> So let's say that the NSA says they will stop spying on us. Why should we believe them?

<comment><USER21> No, but friends of NSA like Mike Rogers have said in public that "he's not worried about this spying, because NSA doesn't spy on him, because he's not a 'bad guy'".

Of course, I don't think even he believes that, because he knows exactly what NSA is doing, but it's good to know _for a fact_ that NSA _does_ spy on US Congress, too. Maybe this information will make the undecided politicians to take the right side.

</comment></comment><comment><USER22> I really hate that this senator cares about only himself being wiretapped. Rather than caring about his constituents. This is the kind of selfish behavior that is appalling.

<comment><USER23> Actually Sanders is generally one of the less execrable members of that august body. His letter ([http://www.sanders.senate.gov/download/letter-to- nsa](http://www.sanders.senate.gov/download/letter-to-nsa)) makes it abundantly clear that he's very alarmed about NSA spying on all Americans. This letter indicates a _tactic_ meant to stoke other legislators' outrage ahead of the upcoming Congress, as opposed to a _strategy_ of opposing NSA spying specifically on lawmakers.

</comment></comment><comment><USER24> I'd hate to be one of the congress members that this took by surprise (assuming there ARE any that actually did not know) -- you'd be quickly made aware of your lack of power.

</comment><comment><USER25> The way the question was asked by Sanders, the answer would be necessarily YES. Of course, the NSA can not answer YES, because [insert mention of 9/11 and national security argument here, wave a flag, if possible, while doing so], so they did the next best thing, made a lengthy statement that states absolutely nothing.

</comment><comment><USER26> Are you saying that a they would use that for political power and not 'security of the state'?

Shocking, shocking I say /s.

</comment><comment><USER27> > Members of Congress have the same privacy protections as all US persons.

In other words: almost none to zero.

</comment><comment><USER28> The real question is: has an human looked at Congressional metadata, or are they likely to do so? This question was not asked because, given the data protections in place, the answer is likely no.

<comment><USER29> How is that the real question? The potential abuses are enormous even if no human has looked at the metadata yet. What if there is a vote next month to reduce the NSA's funding -- might the metadata be examined _then_ , just to see if any congressmen are having affairs? What if Senator Wyden tries to run for president in 2016 -- might the NSA take a look at who he's been talking to?

The fact that the data is being stored at all is cause for concern.</comment></comment>


Ask HN: How do phone scammers get your name and number? - <AUTHOR> I've received calls in the past alerting me that I have a virus on my computer and that I need their software to clean it.
I've always been disturbed and curious by the fact that the caller knows my full name.
Anybody know where these scammers pull this information from? <comment><USER2> Once they have your mobile ip address, they can buy your phone number, full name, billing home address, and billing email address - among other things.[1]

Of course, there are other more classic ways for them to buy this info but if they can get it from the source, why not?

[1] [https://www.privateinternetaccess.com/blog/2017/10/stop- mobi...](https://www.privateinternetaccess.com/blog/2017/10/stop-mobile-phone- number-location-sold/)</comment>


A simple proof that: 1/2+1/3+1/5+1/7+ = ∞ - <AUTHOR> http://fermatslibrary.com/s/on-the-series-of-prime-reciprocals#email-newsletter <comment><USER2> The paper that is linked to uses the fact that the harmonic series diverges (sums to infinity) to prove that the sum of 1/p diverges where the sum occurs over all primes. The article does not show that the harmonic series diverges. The standard proof of the divergence of the harmonic series is already quite simple.

The paper linked to is nice but the title of the submission is misleading.</comment>


Why I Will Never Return to the USA - <AUTHOR> http://dasmag.nl/why-i-will-never-return-to-the-usa/

<comment><USER2> I was on a bus over from Montreal, we were all in a big room after they had emptied the bus. One guy was born in Cuba and was Canadian now. The border guard asked him how he got to Canada? The guy says 'What do you mean?', and the border guard replies, 'How did you get to Canada, did you swim over?' Another guy had gotten a DUI in '79 in Canada, and the Guard was asking him about it in front of everyone. No joke, these guys may be doing their job, but they are a bunch of assholes, even to US citizens, and they are outside the law - you can be detained indefinitely at a border crossing without any probable cause, US citizen or not.

</comment><comment><USER3> This makes me never want to leave the US. I fear that I will be scrutinized at the border and not be allowed back. Is so ridiculous I drive down the street when a police officer gets behind me I get really anxious and will sometimes go off route just so they're not behind me.

I was born in Germany to two American parents that were in the military. So I'm afraid they may send me back to "where I came from".

<comment><USER4> I'm a little confused. Are you a US citizen? If you're ever refused at the border, there are other channels. One guy at one point of entry doesn't ultimately decide your fate.

<comment><USER5> You can't actually be refused at the border if you are a citizen.

<comment><AUTHOR> You can be detained indefinitely for no reason, even if you're a citizen. Habeas corpus and probable cause don't apply.

<comment><USER5> Are you referring to the 2012 NDAA? Because that specific provision (that denies habeas corpus under the AUMF) has yet to be tested in court, and is unlikely to pass Supreme Court review.

<comment><AUTHOR> From [http://en.wikipedia.org/wiki/Border_search_exception](http://en.wikipedia.org/wiki/Border_search_exception)

> The United States Customs and Border Protection (CBP), ICE-HSI Special > Agents, and Coast Guard officers (E4 grade and above) who are all customs > officers (those tasked with enforcing Title 19 of the United States Code) > with the United States Department of Homeland Security, are permitted to > search travelers and their belongings at the American border without > probable cause or a warrant.

And the "border" isn't just what you might think of as the border ([https://www.aclu.org/technology-and-liberty/fact-sheet-us- co...](https://www.aclu.org/technology-and-liberty/fact-sheet-us-constitution- free-zone)):

> According to the government, it is a 100-mile wide strip that wraps around > the "external boundary" of the United States.

Thus, we have a "constitution-free zone" in the US, where 197 million Americans reside ([https://www.aclu.org/know-your-rights-constitution-free- zone...](https://www.aclu.org/know-your-rights-constitution-free-zone-map)). Within this region, the Fourth Amendment is invalid.

If you Google the term "constitution-free zone", you can find numerous articles detailing the experiences various US citizens have had while traveling within the US (with no intention of crossing any national borders) of being stopped by federal agents from one of the groups listed above (CBP, ICE-HSI, Coast Guard) and being subjected to a search in violation of the Fourth Amendment.

Also: [http://www.wired.com/threatlevel/2013/02/electronics- border-...](http://www.wired.com/threatlevel/2013/02/electronics-border- seizures/)

<comment><USER5> I understand, but none of what you cite refers to indefinite detention.

</comment></comment></comment></comment></comment></comment></comment><comment><USER6> Most customs personal I have encountered are assholes. This isn't much because of policy, it's simply because you're mostly low educated morons who can't deal with the responsibility of authority and will therefore abuse this position at every chance possible.

A lot of these stories crop up in regards to the US but the same thing happens here in Australia and in New Zealand as well.

</comment><comment><USER7> A good read if you are actually concerned:

[https://www.aclu.org/files/kyr/kyr_english_5.pdf](https://www.aclu.org/files/kyr/kyr_english_5.pdf)

<comment><USER8> This is a Know Your Rights pdf from the ACLU, for those who would like to know before clicking.

</comment></comment><comment><USER9> Hey if you need anything in mtl let me know.</comment>


Tuesday's Heroku outage post-mortem - <AUTHOR> http://blog.heroku.com/archives/2010/10/27/tuesday_postmortem/ <comment><USER2> I think it's fascinating that a single engineer, who they had on staff, was able to write a patch in one night that improved performance by their messaging system 5x...

... _and hadn't already done it_.

This isn't meant as a slight against Heroku at all. They've got an incredible team of engineers. But imagine if Ricardo had said "hey, I could write a patch today that would speed up our messaging system 5x, should I do it?" the rest of the team would've said "OF COURSE!"

It reminds me of what happens to your brain when you launch a site. Even before you get feedback, somehow _the knowledge that people can use it_ drastically changes your motivation system. Things that before seemed important are obviously not. Other things that were invisible before become the singular focus of your resources.

Maybe we should do fire drills...

* Your requests are suddently taking 100x as long to complete. Go!

* Your "runway" disappears due to an accounting error and you have 7 days to turn a profit. Go!

* 50% of people visiting the site have no idea how to use it. Go!

How could we achieve the focus and clarity that a crisis brings on, without having the crisis?

<comment><USER3> I understand the gist of your post, but I don't quite understand where you get 1 night from. From what I can tell the 1 night thing was to fix a bug, not improve performance.

Regarding the 5x increase:

> One of our operations engineers, Ricardo Chimal, Jr., has been working for > some time on improving the way we target messages between components of our > platform. We completed internal testing of these changes yesterday and they > were deployed to our production cloud last night at 19:00 PDT (02:00 UTC).

<comment><USER2> Ah, you're right. I was reading too quickly. :) The general point stands, but yeah. Not a good example.

</comment></comment></comment><comment><USER4> I'd like to point out the lesson that other industries can learn from IT infrastructure companies.

Heroku sells a technical product to a technical audience. They're foundational to their clients' products. So when something goes down, there's only one option: explain, in excruciating detail, exactly what happened, why it happened, and how it's going to be fixed in the future.

Why? Because their clients can smell bullshit better than a purebred bloodhound. Too much bullshit means it's time to move on.

Beyond being the right thing to do, being accountable is essential to trust. When you fuck up, it will piss people off. That's just life – everyone makes mistakes. So you need to be the guy where people can say "Okay, there was a fuck up, it was bad, but look at how hard these guys worked to fix it. Check out their plans to prevent it in the future."

Luckily, the incentives are aligned here to make this mostly non-negotiable. When you get medical malpractice, a financial meltdown or an oil spill going on, the cover-your-ass impulses are much more compelling.

Even in those cases though, I insist we need to encourage a culture where accountability and transparency are rewarded. Because, for me, accountable guys are the kind of people I want to do business with.

I dunno much about scaling a Rails server, but for now, at least, I know the Heroku guys are the sort of people I'd trust.

<comment><USER5> _there's only one option: explain, in excruciating detail, exactly what happened, why it happened, and how it's going to be fixed in the future. Why? Because their clients can smell bullshit better than a purebred bloodhound. Too much bullshit means it's time to move on._

Okay. I feel a bit sorry for bashing heroku here, but I'll bite.

If I was a heroku-customer then I'd feel, ahem, a bit washed by their idea of "excruciating detail".

So their "internal messaging system" triggered a bug in their "distributed routing mesh". And they applied a "hot patch".

Great. As far as I am concerned they could as well have written their flux- compensator overheated because the pixie-dust exhaust got clogged with rogue bogomips.

I applaud their willingness to talk to their customers at all. But please... either explain what was going on in a meaningful way - or just leave it at "we screwed up and promise to do our best to prevent it from happening again".

<comment><USER6> > But please... either explain what was going on in a meaningful way

Some of us like a technical breakdown and feel warm fuzzy reassurance. If a few people got confused after the first paragraph, it's less harmful than appearing to bullshit technical users.

<comment><USER7> He's not saying it was too technical, he's saying it wasn't technical enough.

<comment><USER5> Yes, sorry if that was unclear.

In less snarky words: Even facebook told us quite clearly _how_ they screwed up the other day (the config management issue). In contrast this heroku article was disappointing.

</comment></comment></comment></comment></comment><comment><USER8> Will someone at Heroku please describe your QA process?

<comment><USER9> I don't care for Heroku, but this is over the top: distributed systems are _complicated_ , to build and especially to test. Even Google gets it wrong: [http://gmailblog.blogspot.com/2009/09/more-on-todays- gmail-i...](http://gmailblog.blogspot.com/2009/09/more-on-todays-gmail- issue.html) is not entirely dissimilar.

<comment><USER8> How is it over the top? I am genuinely curious about their QA process. I am not judging them.

</comment></comment></comment><comment><USER10> Are they going to remove "rock-solid" from their front page copy?

<comment><USER11> Heroku had 45 minutes of downtime in August, 28 in September, and 45 in October so far. (Source: [http://groups.google.com/group/heroku/browse_thread/thread/f...](http://groups.google.com/group/heroku/browse_thread/thread/fc45c0b5d2a363e))

That's 99.90%, 99.94%, and 99.88% (for the month so far), or simply 99.91% for the entire period.

So, what would you consider "rock-solid"? Personally, I'll echo what was said in the other thread - 99.91% is much better than what I could accomplish on my own, so I'll continue to trust my business to them.

<comment><USER12> They had over an hour of downtime yesterday alone, one 8m outage and one 1h15m outage. (Source: <http://status.heroku.com>)

Regardless, 99.9% is really not special or even acceptable from a high dollar host like Heroku. Cheap shared hosts like HostGator can give you 99.9%.

I'm pulling for them, but they've got some work to do.

<comment><USER13> "cheap shared hosts" don't provide you with the same sort of infrastructure that heroku gives you.

<comment><USER12> Of course, my point was that 99.9% is expected on even the cheapest setups. Premium hosting like Heroku should at least be able to deliver comparable uptime to a cheap shared host like HostGator.

However, Heroku appears to have no SLA, so its a moot point anyway.

</comment></comment></comment></comment></comment><comment><USER14> Does Heroku use anything like 5 Whys to incrementally address organizational- type causes?

</comment><comment><USER15> _After isolating the bug, we attempted to roll back to a previous version of the routing mesh code. While the rollback solved the initial problem, there as an unexpected incompatibility between the routing mesh and our caching service._

To me, it seems like they just needed to apply the "Hot patch", instead they panicked(?) and did a lot of unnecessary version control gymnastics, which delayed the bug fix.

<comment><USER4> I've written mostly client code, and watched server action from the sidelines, but jumping straight to the hotfix only seems obvious in retrospect to me. Rolling back to a known-good state is the safe approach – it just didn't work in this case because of a surprise incompatibility with another system.

If you jump straight to the hotfix, you're basically enlisting the entirety of your userbase to join you in a round of QA, which could be sub-optimal if your hotfix ends up causing some other unintended consequence.

Right?

<comment><USER15> _Rolling back to a known-good state is the safe approach_

Absolutely.

However, they rollback should be atomic, which means all pieces of the infrastructure/code should be rolled back to a known-good-state.

When I said "gymnastics", I meant for rolling back one piece of code, only to find incompatibility with other pieces.

I do not intend to judge them, knowing its difficult not to panic in the difficult emergency situation, but not working effect out on paper (or not knowing, which versions of software components are inter-compatible), before actually doing it on code, look pretty novice to me, for a company of heroku's scale.

I really hope this is not an unfair criticism. (handling emergencies are difficult)

<comment><USER2> The trouble is that they have messaging servers, a routing mesh, and caching servers which are all loosely coupled and deployed on separate boxes. They could take down all dozens of pieces of their infrastructure and roll them all back to wherever they were on that previous date, but this is not better for several reasons:

1) it take much longer than just rebooting the isolated service. Can you imagine Google shutting down every one of their multi-million boxes, rolling them back to a previous state and spinning them up again?

2) they'd still be at risk for incompatibilities with their databases, etc. the problem with unexpected imcomptabilities is that they're unexpected.

<comment><USER15> All I am trying to say, it only makes sense to do/know effect analysis of your changes, before actually doing it.

I fail to see, why they need to revert a piece of code, and then realize, _OMG... this version of code does not fit well with the rest of architecture, now change it back._

1.) I do not expect Google (or even a small shop, like my place) to revert any piece of code which is not affected.

I, HOWEVER, expect to know what changes I am EXACTLY doing, and what to EXPECT after the changes.

(It should not be black magic, for historical code).

2.) I fail to understand this, why should this the case for older code? I can understand some tricky/edge/minor cases, but whether the architecture/database etc. (major compatibility) is compatible or not, should be possible to calculate BEFORE doing the changes.

I hope I am not over-trivializing the issue, but I still cannot get my head over the approach.

</comment></comment></comment></comment></comment><comment><USER16> I think it's really cool that Heroku is so transparent about their outages. A lot of companies try to cover them up or blame them on someone else.

It's refreshing to see a company that not only acknowledges their outages, but even has a list of all past issues and outages. This transparency can only help them to become better in the future.</comment>


The Effects of Marijuana Legalisation: An Update - <AUTHOR> http://slatestarcodex.com/2018/11/07/marijuana-an-update/ <comment><USER2> Some of the conclusions here seem odd, but they follow from the author's (not- infallible) research in the prior post. It's worth reading both if you have the time.

</comment><comment><USER3> Since this is looking at road traffic accidents, it needs to take into account migration as a result of legalization.

More people moving into a locale = more drivers unaware of local driving customs = more total drivers. It stands to reason that there will be more incidents as a result.

Whether that accounts for the 3% or not, I am unsure.</comment>


Tim O'Reilly on paulg on inequality - <AUTHOR> https://medium.com/the-wtf-economy/in-his-essay-on-income-inequality-paul-graham-credited-me-for-pre-publication-feedback-ff8a0b295a1b#.whbom87sz <comment><USER2> Tangentially related, I found this podcast episode on the subject of wealth disparity to be hugely interesting:

[http://freakonomics.com/2013/09/26/would-a-big-bucket-of- cas...](http://freakonomics.com/2013/09/26/would-a-big-bucket-of-cash-really- change-your-life-a-new-freakonomics-radio-podcast/)</comment>


Birds had to relearn flight after meteor wiped out dinosaurs - <AUTHOR> https://www.theguardian.com/environment/2018/may/24/birds-had-to-relearn-flight-after-meteor-that-wiped-out-dinosaurs <comment><USER2> This seems to say that forests were gone, so all tree dwelling birds died out and thus all modern birds are descended from ground dwelling birds. Looking at the paper [1] it seems to only say 'reduced flight capacity' which makes more sense, considering we only know of 4 times flight has only evolved so this would be a big deal if birds had evolved it twice.

1\. [https://www.cell.com/current- biology/fulltext/S0960-9822(18)...](https://www.cell.com/current- biology/fulltext/S0960-9822\(18\)30534-7)

<comment><USER3> Basically, you can't take any science reporting major media at face value. The headlines are written as click-bait, and typically in a non-scientific fashion. Some scientists are also prone to releasing catchy PR that misinterprets their results.

<comment><USER4> Most of us natively write anti-clickbait titles.

Though it is rarely cited, my favorite paper that I've co-authored is:

Indirect Evidence for Lévy Walks in Squeeze Film Damping: [https://arxiv.org/abs/1005.4926](https://arxiv.org/abs/1005.4926)

It could have alternatively been titled: "Holy crap! Did you know that high- vacuum gas particles trapped between two walls follow fractal paths?!"

<comment><USER5> "You won't believe where these high vacuum particles go when they move, or how they get there!"

<comment><USER6> Bait me with how this affects my car insurance and you've got a click.

<comment><USER7> These four tech giants are upending this centuries old industry... with quantum entanglement.

</comment></comment></comment></comment></comment></comment><comment><USER8> I never understood the evolutionary push to develop flight, because I thought of it as an expensive form of transport.

Until this graph, which shows the cost of transport to actually favor flight over terrestrial locomotion.

[http://www.wprize.org/images/TuckerCostGraph.gif](http://www.wprize.org/images/TuckerCostGraph.gif)

<comment><USER9> Any other info or a higher res for that graph? That totally goes against what I would've assumed! (Trains are wildly inefficient?! Swimming is more efficient than flying or running?)

<comment><USER10> I think you're reading that wrong. Trains are nearly the lowest energy/kg per unit distance travelled, as they're in the bottom of the graph. Though it's a bit weird for the x axis to be mass, too.

Basically the y axis is a measure of efficiency. The x axis just spreads out the points so you can compare things of similar mass.

<comment><USER9> Oh I was reading it wrong, thank you. Its hard to see on mobile. Glad to hear trains are efficient again though.

</comment></comment></comment></comment><comment><USER11> What about tons of regular birds that don't need trees? Eagles, condors, gulls, albatrosses, etc.

<comment><USER12> Where do you think eagles nest and raise their young before they can learn to fly?

<comment><USER13> Many species of birds nest on the ground or below ground in treeless places though.

</comment></comment></comment><comment><USER14> Note that ground-dwelling doesn't necessarily mean flightless. The article in Cell only says they were "non-arboreal" and hardly mentions flight.

</comment><comment><USER15> i must have missed that day in Science class..but when did they prove a massive meteor hit and killed Dino?

<comment><USER16> There have been a number of discoveries but the most central one is probably of an Iridium layer by Alvarez in 1980. AFAIK there's still debate around whether the meteorite that landed in the Gulf of Mexico was truly the Dino killer or if it just hastened a process that was well on its way in any case.

<comment><USER17> There's really no serious debate about that anymore. The temporal juxtaposition of this extremely violent event with the extinctions means it would be an incredible coincidence if there weren't a causal connection, and there is little to no evidence anything else was contributing. In particular, there is no good evidence ecosystems were in decline before the impact (previous claims to that effect were just due to sampling problems and logical errors.)

</comment></comment></comment><comment><USER17> BTW, it is now thought that all existing species of placental mammals are descended from a SINGLE species that survived the K-Pg boundary extinction.

</comment><comment><USER18> Given the incompleteness of our fossil records, this makes the old joke about the astrophysicist and the black sheep seem apropos.

</comment><comment><USER19> Nature 0. Nurture +1.</comment>


Ask YC:  Should computer books contain intentional technical errors to keep the reader's attention? - <AUTHOR> The publisher could even have a contest to reward readers who find the most technical errors.<p>Unlike what Knuth has been doing, these technical errors would be intentional. <comment><USER2> Amichail, would you please, _please_ , stop or slow down with your Ask YC posts? I went on to look at your submissions: probably more than 80% of your posts are of the "Ask YC" genre.

Maybe you are trying to initiate a discussion. Maybe you are just trying to get the community attention. Maybe you are just putting your ideas "out there"... I really don't know what it is. But it's annoying as hell!

I even don't think that you are just karma-whoring. It seems that you lose more karma after entering in the discussion than by posting your (usually pretty inane) questions.

If you really want to test your ideas or get the community feedback, I suggest you to keep a blog, write essays, put everything you may think interesting there. The process of writing will probably get you much more valuable information than people here ever will. All you're getting (and we're getting) is noise.

</comment><comment><USER3> No. Should news.yc contain crazy questions to keep the reader's attention? No.

<comment><AUTHOR> You don't believe in learning by debugging?

Computer books can be pretty boring. This would be a way to encourage deeper reading and understanding.

<comment><USER4> If it's boring, it's not what you're meant to be doing. Read up on a subject you actually enjoy.

<comment><AUTHOR> Whether something is boring often depends on whether you need it in your present task.

This means that you are more likely to skim material that does not seem highly relevant.

But that's not a good scenario for expanding your horizons.

<comment><USER5> You're right. This is a great idea.

</comment></comment></comment></comment></comment><comment><USER6> My colleagues and I spent several sleepless nights in grad school tracking down sign errors in our stat mech problem sets, only to find that they arose from typos in the textbook.

I'm very glad you are safely on the other side of the internet, because your suggestion gives me the overwhelming urge to impale you with a mechanical pencil. ;)

</comment><comment><USER7> This is a terrible idea.

While it may be adding some suspense when reading a book sequentially (for the first time), intentional errors are absolutely confusing whenever you intend to use the book as a reference.

</comment><comment><USER8> This is actually a very old tradition.

One notable example in popular culture is in Chaim Potok's novel "The Chosen"

[http://www.amazon.com/Chosen-Chaim- Potok/dp/0449213447/ref=p...](http://www.amazon.com/Chosen-Chaim- Potok/dp/0449213447/ref=pd_bbs_2?ie=UTF8&s=books&qid=1210038016&sr=8-2)

From a review here:

[http://litmed.med.nyu.edu/Annotation?action=view&annid=1...](http://litmed.med.nyu.edu/Annotation?action=view&annid=1311)

"At Reb Saunders's synagogue, he experiences Hasidism in practice, especially the practice whereby the Reb makes an intentional mistake in his sermon every week and challenges Danny to identify the mistake and elucidate it from the Talmud and commentaries."

</comment><comment><USER9> No, theres this idea called "exercises and their solutions", which are designed for provide a mechanism for deepening understanding after reading a text. Beyond that, theres the whole mechanism of in appropriate social or research forums posing questions to one's social peer group, which is at a whole 'nother level!

<comment><AUTHOR> The problem with the exercises is that they are voluntary. But intentional errors will irritate you until you figure out what's going on.

<comment><USER10> Did you know that banging your weenie with a hammer is intensely pleasurable-- when you miss?

</comment></comment></comment><comment><USER11> Similar to this story:

"Now I know some of you have already heard of me, but for the benefit of those who are unfamiliar, let me explain how I teach. Between today until the class right before finals, it is my intention to work into each of my lectures ... one lie. Your job, as students, among other things, is to try and catch me in the Lie of the Day."

<http://www.overcomingbias.com/2008/02/my-favorite-lia.html>

EDIT: Didn't see that someone already posted the essence of this story below.

</comment><comment><USER12> Yes thats a fantastic idea! In fact in my next book "Avionics and Applied Rocket Science" I've added an insidious little snippet that all O-rings should be stored in sub zero temperatures to preserve their integrity, that aught to keep those bongo playing physicist on their toes!

<comment><AUTHOR> The technical error should be something that an alert reader could pick up given what was written elsewhere in the book.

Also, you would tell the reader that errors have been introduced intentionally to encourage a deeper reading.

The reader could perhaps be referred to an online discussion forum where he/she could search for and discuss potential errors.

<comment><USER12> I'm sure nobody could _challenge_ that fact.

<comment><AUTHOR> This approach would work better with computer science and mathematics.

</comment></comment></comment></comment><comment><USER13> I like the thought. I heard about a professor who, on the very first day of class, told his students that in every lecture, there would be one lie. It might even be regarding information on the tests.

It was the job of the class to figure out what the lie was and call him on it and the end of class. This kept the students attentive and on edge.

From what I remember, there were some sessions where the students could not figure out what the lie was, so they went home with a potential error in their notes.

The trick was, the professor was also lying when he said that there would be a lie in _each_ session.

In the end, knowing that there might be a blatant lie in each lecture kept the students paying attention and ultimately getting more out of the class. Doing something like this with books (not even computer books, necessarily) might really help people to pay attention. I'd think something like this would sell well too, just because of the marketing angle it would have.

If anyone knows where the story of the professor came from, please let me know. It was a great story.

<comment><USER14> That is similar to what my AP English teacher used to do. He warned us that he will occasionally start making ridiculous statements and it is our responsibility to call BS on him. Of course, he also warned us to consider the consequences if we happen to call BS while he is making a genuine analysis of a text.

I loved that class (and this is only a small part why).

<comment><USER15> It is also a perfect cover should he ever make a genuine mistake.

<comment><USER14> Absolutely. English isn't the only thing I learned from him ;)

</comment></comment></comment></comment><comment><USER16> <http://www.overcomingbias.com/2008/02/my-favorite-lia.html>

What made Dr. K memorable was a gimmick he employed that began with his introduction at the beginning of his first class:

"Now I know some of you have already heard of me, but for the benefit of those who are unfamiliar, let me explain how I teach. Between today until the class right before finals, it is my intention to work into each of my lectures ... one lie. Your job, as students, among other things, is to try and catch me in the Lie of the Day."

</comment><comment><USER17> Books will contain errors whether you want them to or not. Adding more is insane.

</comment><comment><USER18> No. That would have confused the hell out of me. I mostly learn from computer books the first time, the reading isn't for puzzles, it's for reading and learning.

Giving bad information isn't fun, or a learning style.

</comment><comment><USER19> Sure, because then all the git coders will replicate that same error again and again in production code. You can't assume that all readers are smart enough to spot the error.</comment>


Google Earth Timelapse - <AUTHOR> https://earthengine.google.com/timelapse/ <comment><USER2> Trivia: On the "Construction of the Bay Bridge" one, pan down to the Southeast a little to the Alameda Naval Air Station. In 2001 you can see the construction of the freeway set[1] used for The Matrix Reloaded.

Direct link to view: [https://earthengine.google.com/timelapse#v=37.79184,-122.334...](https://earthengine.google.com/timelapse#v=37.79184,-122.33478,12.026,latLng&t=1.73&ps=50&bt=19840101&et=20181231&startDwell=0&endDwell=0)

[1] - [http://www.filminamerica.com/Movies/TheMatrixReloaded/Freewa...](http://www.filminamerica.com/Movies/TheMatrixReloaded/FreewayChase/)

<comment><USER3> No idea what you are talking about. Sadly, there weren't any follow up movies to The Matrix.

<comment><USER4> The second one was alright. There was a lot of interesting lore in it.

<comment><USER5> The person you're replying to is making a joke. The general meta-structure of said joke is that if something is considered particularly bad, its existence is denied, i.e., "1: SCRUBS only had eight seasons. 2: But what about that one where they were teach-- 1: SCRUBS ONLY HAD EIGHT SEASONS." Etc.

<comment><USER6> I think the person you're replying to got the joke, and responded to the implied claim that the sequels were bad.

<comment><USER7> There'is no person to whom he is replying.

</comment></comment></comment></comment></comment></comment><comment><AUTHOR> Some interesting links:

Beijing and Shenzhen's rapid urbanization: [https://earthengine.google.com/timelapse#v=39.90419,116.4073...](https://earthengine.google.com/timelapse#v=39.90419,116.40739,9.999,latLng&t=3.3&ps=50&bt=19840101&et=20181231&startDwell=0&endDwell=0)

Deforestation in Brazil: [https://earthengine.google.com/timelapse#v=-9.27665,-58.5151...](https://earthengine.google.com/timelapse#v=-9.27665,-58.51513,5.098,latLng&t=3.42&ps=50&bt=19840101&et=20181231&startDwell=0&endDwell=0)

<comment><USER8> Vegas is a really good one in the US since you can see it gobbling up the desert: [https://earthengine.google.com/timelapse#v=36.16451,-115.217...](https://earthengine.google.com/timelapse#v=36.16451,-115.21782,9.737,latLng&t=1.52&ps=50&bt=19840101&et=20181231&startDwell=0&endDwell=0)

<comment><USER9> And also that big lake next to it rapidly disappearing. Isn't that something to worry about?

<comment><USER10> Long term probably, but likely more because of decreased access to snow melt & increased evaporation rather than increased demand.

> Changing rainfall patterns, climate variability, high levels of evaporation, > reduced snow melt runoff, and current water use patterns are putting > pressure on water management resources at Lake Mead as the population > relying on it for water, and the Hoover Dam for electricity, continues to > increase. To lower the minimum lake level necessary to generate electricity > from 1,050 feet (320 m) to 950 feet (290 m), Hoover Dam was retrofitted with > wide-head turbines, designed to work efficiently with less flow in 2015 and > 2016.[40] If water levels continue to drop, Hoover Dam would cease > generating electricity when the water level falls below 950 feet (290 m) and > the lake would stabilize at a level of 895 feet (273 m) when the water > reaches the lowest water outlet of the dam.[41] In order to ensure that the > city of Las Vegas will continue to be able to draw its drinking water from > Lake Mead, nearly $1.5 billion was spent on building a new water intake > tunnel in the middle of the lake at the elevation of 860 feet (260 > m).[42][43] The 3-mile (4.8 km) tunnel took seven years to build under the > lake and was put into operation in late 2015.

[https://en.wikipedia.org/wiki/Lake_Mead#Drought_and_water_us...](https://en.wikipedia.org/wiki/Lake_Mead#Drought_and_water_usage_issues)

Up stream releases 10,150,000 ML per year, Vegas recently upgraded the capacity to consume up to 1,244,000 ML per year.

[https://www.waterworld.com/drinking- water/distribution/artic...](https://www.waterworld.com/drinking- water/distribution/article/14068676/las-vegas-isnt-gambling-with-water-supply)

As per usual the capacity of natural systems is much higher than the first order effects from people.

It's only when we look at second and third order effects or cumulative effects that we start to see real anthropocentric effects

</comment></comment></comment></comment><comment><USER11> Good lord. The "Deforestation" presentation is horrifying.

What an effective use of technology, thank you EarthEngine team.

<comment><USER12> Thanks to the EarthEngine team, but _only_ that team. Youtube is an Alphabet (Google) company.

Youtube contributed to the rise of authoritarians like Trump and Bolsonaro who scoff at environmentalists.

Youtube merrily signal-boosted anti-environmentalist conspiracy theories.

What a fantastic world we _could_ have, through new technology. What a mess we _actually_ have, partly because of leadership failures at Google and the half- dozen usual suspects.

<comment><USER13> No, the problem is that we forgot to teach (or in many cases – deliberately did not teach) people one of the most basic skills (critical thinking) and now we're surprised that this has come back to bite us in the ass.

<comment><USER12> I think _the_ problem, if we have to pick just one, really _is_ the diet of crazy propaganda Youtube relentlessly pumped to the screens of _two billion users_ for a half decade. Granted, the awesome scale is difficult to comprehend.

<comment><USER13> YouTube is crowdsourced. That content wouldn't exist if we actually taught people to think for themselves and not just lap up whatever is thrown at them.

<comment><USER14> I was raised and taught the same as my brothers.

They're conspiracy theorists. I'm not.

I am not alone in this situation.

<comment><USER13> Are you saying there was no difference between you and your brothers until they started watching YouTube?

I find that hard to believe.

</comment></comment></comment></comment></comment></comment></comment><comment><USER15> It's called "infrastructure" in Brazil. I read 30y deforestation effort. (I'm Brazilian, and quite ashamed right now)

<comment><USER16> Brazil is not alone in prioritizing industrialization over the environment. Coal in UK, oil in US, dams in China — just a few of many examples. That shame or sense of responsibility should be shared by many countries.

<comment><USER17> Context is everything. Not every country is at the same point on the industrial timeline. The UK, US, Europe are post-industrial, and have the luxury to focus on greener energy options. Other countries not so much (yet).

<comment><USER18> The only reason why those places mentioned can be said to be "post" industrial is because they moved most of the industry to other countries. You can't do that forever, you're bound to run out of countries at some point. Not all the countries can be "post-industrial", the metal has to be smelted somewhere

<comment><USER17> > the metal has to be smelted somewhere

Well, Mars. Obviously. /s

</comment></comment></comment></comment></comment><comment><USER19> It's a shame, and painful, to see humans behaving exactly the same as a virus killing it's host slowly...

<comment><USER20> It is very painful. We have this beautiful planet in the universe and we are just destroying it. We are just too primitive in too many ways. I am very concerned what will happen in the next 20-30 years. My only hope is that science can save us somehow.

<comment><USER17> > _My only hope is that science can save us somehow._

It's not about us. It's about the planet. Climate change only threatens us as a species. Once we're gone, the planet will recover. It's recovered from eco- collapse before, and it will do it again.

<comment><USER21> Exactly, by saving us, science might do more harm than good. Finding a cure to covid-19 could also be seen as an human intervention into nature's attempt to regulate the human population growth. But in the the end there are only two possible outcomes: either humans will find a way to preserve an habitable environment or face extinction.

<comment><USER22> Honestly, COVID-19 isn't the one that's nature's way of intervention when compared to other diseases. There're 4 times more people dying of cancer and another 4 times as much of heart disease.

COVID-19 is just a way of the Big Pharma to fill their pockets and for politicians to make a power grab (never waste a good crisis)

</comment></comment></comment></comment></comment><comment><USER23> Garzweiler surface mine

[https://earthengine.google.com/timelapse#v=50.91082,6.4249,9...](https://earthengine.google.com/timelapse#v=50.91082,6.4249,9.136,latLng&t=1.34&ps=25&bt=19840101&et=20181231&startDwell=0&endDwell=0)

<comment><USER24> I live in Mönchengladbach and the first thing I thought of, was looking at the Garzweiler mine.

It is worth to take a closer look. Here you can see how the Highway (Autobahn A44) is spared at the beginning until it is destroyed around 2006. It was reconstructed and reopened in 2018. It is frightening to see how the villages get eaten by the mine. At the same time you can also see the construction of the relocated villages Otzenrath, Holz and Spenrath north of the mine.

[https://earthengine.google.com/timelapse#v=51.06266,6.47476,...](https://earthengine.google.com/timelapse#v=51.06266,6.47476,10.796,latLng&t=1.62&ps=25&bt=19840101&et=20181231&startDwell=0&endDwell=0)

</comment></comment><comment><USER25> Well this is the most depressing thing I have seen recently. Was interesting to see the South Australian bushfires one where you can see the land slowly recover after each fire.

</comment><comment><USER26> Mines around Muswellbrook, 200km north of Sydney, NSW, AU.

Our commitment to pulling stuff out of the ground and burning it, in the face of all the science, is impressive.

[https://earthengine.google.com/timelapse#v=-32.3917,150.9078...](https://earthengine.google.com/timelapse#v=-32.3917,150.90785,9.671,latLng&t=3.3&ps=25&bt=19840101&et=20181231&startDwell=0&endDwell=0)

<comment><USER27> I would not argue against that fact. I also expect we'd be chimps staring at a black monolith had we not utilized the resources that abound on this planet.

<comment><USER26> Probably.

Had we not started cooking our food over open fires, incurring significant damage to our health in the process, our societal and technological progress would also have been retarded.

However, that's not a sufficient or satisfactory answer to the question 'Should we still be doing this?'

</comment></comment></comment><comment><USER28> USGS has a vast database of images including aerial, weather satellites, declassified reconnaissance satellites, and other sources.

[https://earthexplorer.usgs.gov/](https://earthexplorer.usgs.gov/)

The datasets you pick from can be a bit confusing unless you click the (!) icon next to the names to figure out what they are.

I'll provide an example for looking at reconnaissance satellite images of Atlanta, Georgia in 1979.

Search Criteria (tab):

Find Atlanta, Georgia on map. Zoom in on Atlanta, Georgia. Click on a building like the "Fulton County Courthouse" or "Atlanta City Hall" (does not really matter, but somewhere near them).

Date Range: 01/01/1970 - 01/01/1980

Data Sets (tab):

Declassified Data -> [check] Declass 3 (2013)

Click "Results".

Click one of the results.

Example image: May 15, 1979 - [https://i.imgur.com/DXYxWXP.jpg](https://i.imgur.com/DXYxWXP.jpg) \- 14,273 x 1,414 px

<comment><USER29> I lived through the madness of Atlanta in the 1970s. The pace of sub urban development seemed to rival 21st century China in its consumption of concrete and steel.

</comment></comment><comment> mr-ron I like what they are doing but do we need a default .5 second for every year while the content is still loading? And seemingly no way to significantly slow it down?

<comment><USER25> Works fine while you are sitting inside the google datacenter

<comment><USER30> I laughed very hard at this comment

</comment></comment></comment><comment><USER31> We need every child to watch and learn about this as they grow up. They will be fighting climate change for the rest of their life.

<comment><USER25> Its like watching a very slow car crash you can't stop

<comment><USER31> It's like watching people who dont care destroy what's left of the unknown on our planet for selfish ends. There is knowledge that humans will never access because of need and greed.

</comment></comment></comment><comment><USER32> Close to home for me, the removal of mountaintops to get at coal seams in Pike county kentucky:

[https://earthengine.google.com/timelapse#v=37.47362,-82.4710...](https://earthengine.google.com/timelapse#v=37.47362,-82.47108,9.543,latLng&t=0.03&ps=25&bt=19840101&et=20181231&startDwell=0&endDwell=0)

The mines are abandoned now

Edit: updated link - zoom out, a lot of kentucky is affected by this.

<comment><USER33> That's not Kentucky you linked to, that's west of Cologne ([https://de.wikipedia.org/wiki/Rheinisches_Braunkohlerevier](https://de.wikipedia.org/wiki/Rheinisches_Braunkohlerevier))

<comment><USER32> oops, I'll edit my link

</comment></comment></comment><comment><USER34> Unfortunately, this is going to be the situation with Himalayan glaciers after new EIA bill India is planning to pass.

[https://theprint.in/theprint-essential/what-modi-govts- eia-d...](https://theprint.in/theprint-essential/what-modi-govts-eia-draft- says-why-environment-experts-think-itll-encourage-violations/470248/)

</comment><comment><USER35> Atatürk Dam is impressive/scary [https://earthengine.google.com/timelapse#v=37.57077,38.47465...](https://earthengine.google.com/timelapse#v=37.57077,38.47465,9.474,latLng&t=3.23&ps=50&bt=19840101&et=20181231&startDwell=0&endDwell=0)

</comment><comment><USER36> To be honest, I was underwhelmed by most of the change. The greatest marvel was urbanization in China. Simply amazing.

<comment><USER37> It is interesting how they expand land, even make "islands" out in the seas(?)

</comment></comment><comment><USER38> It's pretty impressive to see the Chernobyl New Safe Confinement [0] construction beginning around 2010 and its final movement over reactor 4 being completed between 2016 and 2017.

Link: [https://earthengine.google.com/timelapse#v=51.38202,30.09999...](https://earthengine.google.com/timelapse#v=51.38202,30.09999,12.711,latLng&t=3.33&ps=50&bt=19840101&et=20181231&startDwell=0&endDwell=0)

[0] [https://en.wikipedia.org/wiki/Chernobyl_New_Safe_Confinement](https://en.wikipedia.org/wiki/Chernobyl_New_Safe_Confinement)

</comment><comment> maze-le The port of Rotterdam: [https://earthengine.google.com/timelapse/#v=51.9137,4.1106,1...](https://earthengine.google.com/timelapse/#v=51.9137,4.1106,10.171,latLng&t=3.3&ps=25&bt=19840101&et=20181231&startDwell=0&endDwell=0)

It was already impressive in 1984. Also interesting is the slow migration of sand banks on the Haringvilet estuary.

</comment><comment><USER39> Shrinking Aral Sea: [https://earthengine.google.com/timelapse/#v=44.88118,58.7657...](https://earthengine.google.com/timelapse/#v=44.88118,58.7657,5.452,latLng&t=3.04&ps=50&bt=19840101&et=20181231&startDwell=0&endDwell=0)

</comment><comment><USER40> There's also [https://earthtime.org/](https://earthtime.org/) which shows the same satellite imagery PLUS all kinds of additional data layers (disclaimer: I work in the lab that created it)

</comment><comment><USER41> While not as devastating as some shown here, 44.3171003, -91.2593236 will show you one frac sand mine in Wisconsin where they've leveled an entire hill and shipped it out west. They even built a plant and several new railroad tracks for it.

</comment><comment><USER42> I wonder if they can find any timelapses of nature being restored instead of destroyed.

<comment><USER43> [https://earthengine.google.com/timelapse#v=51.4045,30.05423,...](https://earthengine.google.com/timelapse#v=51.4045,30.05423,11.621,latLng&t=0.03&ps=25&bt=19840101&et=20181231&startDwell=0&endDwell=0)

Pripyat (Chernobyl)

</comment></comment><comment><USER44> A street view timelapse would be cool to see. Many places would have 10+ years by now.

</comment><comment><USER45> Now I have the intro music of the Expanse in my head.

</comment><comment><USER46> Check out your local library, or geological survey's website to see if they have historical arial photographs going back even further.

</comment><comment><USER47> Coal Mining in Germany: 50.9121787,6.5066858

51.6423203,14.1907603

</comment><comment><USER48> This is total junk on a 10Mb connection.

</comment><comment><USER49> Wow what an amazing use of technology. Painful to see so many examples of deforestation.

</comment><comment><USER50> Check out Dubai go from sand to city, plus all the man made islands pop up.

</comment><comment><USER51> Berlin airport, haha

</comment><comment><USER37> wow amazed pictures all the way back to 1980's hmm

<comment><USER52> Landsat, I assume: [https://en.m.wikipedia.org/wiki/Landsat_program](https://en.m.wikipedia.org/wiki/Landsat_program)

<comment><USER37> Thanks for that was trying to look around, as early as late 70's I see.

</comment></comment></comment><comment><USER53> The player starts with how a glacier in Alaska, and it would be nice if they linked to content to explain what and why the glaciers are retreating

[https://www.ncdc.noaa.gov/abrupt-climate-change/Glacial- Inte...](https://www.ncdc.noaa.gov/abrupt-climate-change/Glacial- Interglacial%20Cycles)

<comment><USER54> That link explains why the glaciers retreated approx 10kya. It doesn't explain glacial retreat over the past half century. If anything the chart seems to show that past trends would have us on the cusp of exiting the current interglacial period, i.e. we should be seeing glacial advances.

</comment></comment><comment><USER55> Typical cherry picking of data to focus only of the areas which show negative trends, while reforestation is a thing across the world as the NASA has previously demonstrated: [https://earthobservatory.nasa.gov/images/144540/china-and- in...](https://earthobservatory.nasa.gov/images/144540/china-and-india-lead- the-way-in-greening)

<comment><USER56> The thing is, "increasing leaf area" is actually not the aim here. I'm from India and while the deforestation situation is not as bad as (say Brazil for Amazon Rain forest), it is still present in almost every country in the World. Agriculture does NOT mean "restoration". On top of that we should try to increase the restoration of native species of each country or every part of the world and not push non-native species just because they grow fast or take less attention while growing them. That destroys the ecosystem of that area because of something called as Invading Species. I'm not saying that every action taken is wrong or anything, but in this case deforestation outweighs reforestation by a huge margin.

<comment><USER57> How many truly non-invading species there are if you wind back far enough?

<comment><USER58> Given enough time ecosystems can adapt to new invaders.

The problem is that we've dramatically accelerated the movement of flora and fauna around the world, and ecosystems can't keep up with those changes (among many others we've caused).

<comment><USER55> > ecosystems can't keep up with those changes (among many others we've > caused).

You will need to have some sources to back that claim.</comment></comment></comment></comment></comment>


Set Goals. Align Teams. Achieve More - <AUTHOR> http://latticehq.com/ <comment> amar-singh To grow your business. First your need to set up a goal that you want to acheive with a set time frame then according to your goal requirements you need hire a perfect team..Manage the team and motivate them to achieve the goal...A better team is a most imporatant pillar of a company...</comment>


Osmo-FL2K: A TX-Only SDR Hacked from Commodity $5 USB to VGA Adapters - <AUTHOR> https://www.rtl-sdr.com/osmo-fl2k-a-tx-only-sdr-hacked-from-commodity-5-usb-to-vga-adapters-demos-available-for-transmitting-wbfm-gsm-umts-gps/ <comment><USER2> Some cheap "blue" no-brand dongles don't have USB 3.0 traces:

[http://tinyhack.com/2018/05/05/fixing-osmo-fl2k-dongle- that-...](http://tinyhack.com/2018/05/05/fixing-osmo-fl2k-dongle-that-only- works-in-usb-2-0/)

Maiwo KCB003 dongle contains FL2K chip and have USB 3.0 ($15)

[https://www.gearbest.com/cables- connectors/pp_1238337.html?w...](https://www.gearbest.com/cables- connectors/pp_1238337.html?wid=1433363&lkid=13956227)

Source: [https://hackernoon.com/osmo-fl2k-a-15-dtv-transmitter-fm- rad...](https://hackernoon.com/osmo-fl2k-a-15-dtv-transmitter-fm-radio-hijack- and-gps-spoofing-device-68ac08ba7d76)</comment>


Need design feedback on my website - NugoFiber.com - <AUTHOR> http://www.nugofiber.com

<comment><USER2> It looks like a decent site with a nice layout, but lacks personality. Could use more user engagement in my opinion.</comment>


Packing a whole game into a QR code - <AUTHOR> https://youtu.be/ExwqNreocpg <comment><AUTHOR> Link to the QR code game (recommended to check out _after_ watching the video) -- [https://itsmattkc.com/etc/snakeqr/](https://itsmattkc.com/etc/snakeqr/)</comment>


FCC chief says Comcast violated Internet rules in blocking file-sharers - <AUTHOR> http://biz.yahoo.com/ap/080711/internet_regulation.html?.v=5

<comment><USER2> Good, make an example of them. They aren't the only ones doing this, but as far as I can tell they are the worst. I just switched to slower DSL because I couldn't GET to the internet during peak hours because of their filtering. I never had issues getting to comcast.net, but google, facebook and whatnot always seemed to be 'down' from 4-9pm.

<comment><USER3> I wish I could switch, DLS and Fiber are not an option here in MA. Comcast has me by the ... you know.

Yay free market!

<comment><USER4> Do you have line-of-sight to anywhere with better service, and/or some friends who like to tinker and would go in on a t1?

<comment><USER3> T1 in these parts is prohibitively expensive (Cape Cod). Mostly seasonal homes around me so not many uber geeks to share the load (plenty of old people and asshole tourists from CT/NY though!)

</comment></comment></comment></comment><comment><USER5> I think this is important to point out:

Comcast wasn't merely blocking traffic. They were actively sending reset packets. They were creating fraudulent traffic intended to mess up your BitTorrent downloads. I don't think this sets an example/precedent about traffic shaping or throttling. Comcast was pretty blatant here and was actively sending false data.

I guess time will tell whether this is a bigger precedent in the fight for net-neutrality.

<comment><USER6> If a private individual was sending such packets, it would be a felony.

Sucks when your ISP is performing man-in-the-middle attacks against you.</comment></comment>


Rebuilding My Personal Infrastructure With Alpine Linux and Docker - <AUTHOR> https://www.wezm.net/technical/2019/02/alpine-linux-docker-infrastructure/ <comment><USER3> In my experience, "slim" Debian images (like `python:slim`) aren't significantly larger than Alpine-based ones, but save lots of time and headache when something assumes glibc and breaks (or, worse - _subtly_ breaks) with musl (or doesn't have a binary distribution for musl so every time image's built you have to build from source).

Also, I'm not sure what are the benefits going `FROM alpine` and installing nginx, than just starting `FROM nginx:alpine`. The latter has benefit of a more straightforward update logic when a new nginx version is released - `docker build` will "just" detect this. It won't notice that Alpine repos have an upgrade, though, and will reuse cached layers for `RUN apk install nginx`.

Just saying.

<comment><USER4> > In my experience, "slim" Debian images (like `python:slim`) aren't > significantly larger than Alpine-based ones, but save lots of time and > headache.

I came to pretty much the same conclusion too.

For years I was using Alpine but as of about a year ago I've been going with Debian Slim and haven't looked back.

I'd much rather have the confidence of using Debian inside of my images than save 100MB on a base image (which is about what it is in a real web project with lots of dependencies).

<comment><USER3> In my experience, the difference is sometimes even less than 100MiB (which is quite a lot). For the current ("real-world") project I'm working on, it's about 25MiB - something like 325MiB for Alpine and 350MiB for slim Debian base images.

Either way, it's not 1.12GiB I was getting with a fat `FROM python:3` base image.

</comment></comment></comment><comment><USER5> What's the best way to handle updates?

I would like to switch to a dockerized setup, but running everything on Debian/stable has the advantage of unattended-upgrades (which has worked absolutely flawlessly for me for years across dozens of snowflake VMs). Not going back to manual upgrades.

I tried a Registry/Gitea/Drone.io/Watchtower (all on same host, rebuilding themselves too) pipeline and it worked, but felt patched together. Doing it wrong?

<comment><USER6> In-container upgrades seems to be an issue for many, we've had this issue at $work.

From what I've seen, the is no consensus on the "right" way to do it.

You could run the upgrades in the container and lose them when it's re-upped, or, you need to continuously deploy the containers.

This alone is one major reason I'm in favour of statically linked binaries in from-scratch containers, where possible.

</comment></comment><comment><USER7> > An aspect of Docker that I don't really like is that inside the container > you are root by default

PSA: everyone should turn on the userns option in docker daemon settings. It messes with volume mounts but you can turn it off on a per container basis (userns=host) or arrange a manual uid mapping for the mounts.

[https://docs.docker.com/v17.12/engine/security/userns- remap/](https://docs.docker.com/v17.12/engine/security/userns-remap/)

<comment><USER8> I wondered if this is what Unraid already does: yes its mentioned at [https://wiki.unraid.net/UnRAID_6/Overview#Containers](https://wiki.unraid.net/UnRAID_6/Overview#Containers)

> The cornerstone of Docker is in its ability to use Linux control groups, > namespace isolation, and images to create isolated execution environments in > the form of Docker containers.

If you want to run dockers at home, i suggest you give it a try. All you need is an old computer and a USB (it runs in RAM). Unraid basically is Linux with a (happy little) webinterface for NAS shares + apps.

<comment><USER7> The web page doesn't read like it's enabling userns-remap, to me.

</comment></comment></comment><comment><USER9> I'd suggest people looking to do something similar to this to check out Caddy as a reverse proxy for your services. It'll manage grabbing SSL certs for you and some people have already wrapped it into a nice docker container for you [0].

[0] - [https://github.com/wemake-services/caddy- gen](https://github.com/wemake-services/caddy-gen)

<comment><USER10> I recently had the pleasure of using Traefik[0] as my reverse proxy, which similarly handles SSL automatically via LetsEncrypt. Lovely piece of software!

[0]: [https://traefik.io](https://traefik.io)

<comment><USER11> I recently upgraded my simple web facing CV site over to a couple containers and front-ended with Traefik. What's really nice about it is if you run the host as a single-node Swarm you get a lot of freebies with regard to service discovery. I also use Traefik in my internal network to front-end Heimdall [0] in a container. This affords me a very elegant internal network dashboard, bastion host (proxy) and presents all my internal services with LetsEncrypt valid certificates (no more internal self-signed cert warnings).

I've been meaning to start blogging again and use this as a first topic.

[0]: [https://heimdall.site/](https://heimdall.site/)

</comment></comment></comment><comment><USER12> >Note that Alpine Linux doesn't use systemd, it uses OpenRC. This didn't factor into my decision at all. systemd has worked well for me on my Arch Linux systems. [...]

How does systemd, or any init for that matter, come into the picture if you're running everything inside docker? Containers don't use any init, right? They just execute the binary in the host environment (but containerised). Or am I missing something?

Edit: nevermind, OP is using Alpine as the host OS as well.

<comment><USER13> Correct. Docker containers typically only contain one process, and that process runs as PID 1. If you need an init system, tini is very popular, and is now built in to docker itself[1]. Systemd is _way_ heavy and overkill inside docker.

[1] [https://github.com/krallin/tini](https://github.com/krallin/tini)

<comment><USER14> Specifically _why_ is it way heavy though? What does systemd provide which isn't needed?

<comment><USER15> Primarily, you would run an init system in a docker container in order to correctly proxy signals to the one process in question, which would otherwise run as PID 1 - for example, sending SIGTERM to docker run running a PID 1 with no registered handler will result in nothing, because Linux won't use the default handler (killing it).

Secondarily, if you want to be neat and save some pids and kernel memory, you need an init system to wait(3) on orphaned zombie processes.

These are the only two use cases AFAIK, which a small init system such as tini satisfies, without the complexity and size of systemd.

<comment><USER14> That doesn't answer the question: what does systemd provide which isn't needed?

I have multiple network devices. I want some to be controlled by processes running in a container; effectively I want some processes to run under a user account but still provide root (root-like?) access to the specified network device(s). I want to be able to give a specific (containerized) user _full_ control over one or more specific network devices. My (naive?) understanding is that the init daemon takes care of bringing the network online and then subsequent management of it. For systemd, that would be Network Manager? Or do I misunderstand?

</comment></comment></comment></comment></comment><comment><USER16> I haven't really used docker - so here is a dumb question; suppose one makes a setup like the author here, then what does a deployment of new version look like?

Suppose the author updates one of his rails apps and there some database schema modifications.

Is that handled by docker?

How long does a deployment take? (Minutes, seconds ... basically is the tool able to figure out what is changed and only apply the changes or does it remove the old installation and build the new from scratch?)

<comment><USER17> Deployment of a new version would depend upon your setup. Assuming a setup similar to the author, you can have a new Docker images with the new version of your code and run it in parallel. All you have to do after that is point the traffic from the old version to the new version (By just running `docker compose`).

If you have a more complex setup, e.g. if by using Kubernetes, you can do things like run both the version at the same time, person A/B testing or have canary deployments to ensure the new version works .

Time for deployment would be most likely in seconds unless the setup is complex/convoluted.

Schema modifications are another beast. For small use cases, you could run a specialized one time container that performs the modifications, but once you need high availability, you'd have to consider a more complex approach. See [https://queue.acm.org/detail.cfm?id=3300018](https://queue.acm.org/detail.cfm?id=3300018)

</comment></comment><comment><USER18> This article was interesting to me because a lot of my personal infrastructure runs on FreeBSD. While I don't host anything publicly accessible, I do have some similar needs.

The author mentions the Docker port for FreeBSD. According to the FreeBSD Wiki, it's meant to run Linux Docker images and relies on FreeBSD's Linux ABI layer to do so. To me, this is the wrong approach.

FreeBSD already has good container technology, what it really needs are good tools around that. Since the author ended up building his own Docker images, I suspect that he'd be happy with a FreeBSD-equivalent way to declarative build and manage jails.

<comment><USER19> iocage is a decent cli utility for managing jails, automating some common operations, and associated zfs bits for storage

[https://github.com/iocage/iocage](https://github.com/iocage/iocage)

[https://dan.langille.org/2015/03/07/getting-started-with- ioc...](https://dan.langille.org/2015/03/07/getting-started-with-iocage-for- jails-on-freebsd/)

<comment><USER18> This does look to be better than ezjail - I'll have to give it a look! The vnet support is something that will be very useful.

</comment></comment></comment><comment><USER20> Gitlab offers free private docker registry with your non-commercial projects and it's fairly easy to build and deploy containers using their CI when hosting the Dockerfiles there.

<comment><USER21> Thanks for mentioning that. Here's some more info about it, an official doc [https://docs.gitlab.com/ee/user/project/container_registry.h...](https://docs.gitlab.com/ee/user/project/container_registry.html) and a blog post [https://about.gitlab.com/2016/05/23/gitlab-container- registr...](https://about.gitlab.com/2016/05/23/gitlab-container-registry/).

</comment></comment><comment><USER22> I would love to Alpine all the things, it's just so fast to work with, BUT musl makes things hard, especially if you're over in Pythonland - <USER2> with C dependencies, if built, are only built for glibc, so when installing them on Alpine, one has to have a compiler, development headers etc. Makes things too slow and error prone.

Otherwise it's a great distro and I use it for non-Pythonic stuff or for Python with no dependencies.

<comment><USER23> With multi-stage Docker builds nowadays it's easier to have an intermediate builder environment with all the build deps installed.

<comment><USER22> True, but it's still a pain having to do that, all I want is to install a package in an interpreted language, I'm not building a project in a compiled language.

<comment> yjftsjthsd-h > all I want is to install a package in an interpreted language, I'm not > building a project in a compiled language.

I sympathize, but rather sounds like the problem is that you're _not_ using a purely interpreted language anymore.

</comment></comment></comment></comment><comment><USER24> Question for those who have migrated to Kubernetes - at what point did you look for something bigger/better than what Docker Compose (or Mesos) can offer?

<comment><USER9> Once you need more than one machine, more than one engineer, and a desire to use existing tooling.

K8S is a platform to build things. Because of this most of the amazing features you have access to are built by the community (service mesh for example).

Docker Compose is a mess once you have 10+ services with each having different containers backing it.

</comment></comment><comment><USER25> I don't necessarilly agree with his decision to build all images by hand as opposed to using those available on Dockerhub, however it's a personal choice and I respect it.

Given that he's using docker-compose, I wonder why he's chosen to host his images in a repository at all, instead of just specifying the Dockerfile in the yaml and having them locally.

<comment><USER26> He mentions that this way he can more easily upload his docker-compose file to AWS ECR when it's ready for production.

<comment><USER25> Ah, thanks, I missed that comment.

</comment></comment></comment><comment><USER27> It's all fun and games using alpine linux until you run into weird networking issues that are caused by slim images.

I was a big fan of slim images until unsolvable bugs started popping up. Like others have said, not much benefit shaving off a few hundred mbs in the age of fiber.

</comment><comment><USER28> I am in remarkably similar state to this 'prior' state being FreeBSD 11 hosted, with elements of other distributed service.

I also looked to docker and gave up. I like bhyve, and have considered a low- pain migration to bhyve instances to package things into Linux, and then (re)migrate into Docker. A way to avoid pain, and cost of a duplicate site, to build out and integrate.

I wish something as logistically simple as docker compose was in a BSD compatible model, to build packages to. I'd like the functional isolation of moving parts, and the redirection stuff.

Nice write up. I wonder how many other people are in this 'BSD isn't working for me as well' model?

<comment><USER29> I use FreeBSD for my NAS/utility server at home, and am considering switching over to Linux now that ZFS seems pretty stable there. NixOS is my happy place these days.

<comment><USER30> I had not great experiences with ZFS on Linux. Like broken for a month on a standard distros kernel type issues.

For personal it's probably fine but I wouldn't use it in prod again.

<comment><USER28> I'm half-yes half-no on this. I have successfully carried non-root ZFS partitions into Debian. But, I just lost 15TB to an unexpected multipath/iscsid zpool import so now.. I am unsure how I think this story goes.

Debian ZFS is not easy to install as root FS which is .. disappointing. It would be nice if it was integrated into the net install .iso as a legit disk install option.

</comment></comment></comment></comment><comment><USER31> He finds ansible annoying — anybody suggest a good alternative?

I need to re-spin a set of standard utilities on local hardware from time to time so am looking for the best way to manage the config files (bind, Apache, and the like)

<comment><USER32> I have lately been thinking an Ansible-like approach but using compiled code, maybe using Go, could be a way to go. So I went looking for that, and found Sup. It was not what I had in mind but worth a closer look.

[https://news.ycombinator.com/item?id=12183370](https://news.ycombinator.com/item?id=12183370)

Edit: I have not tried it

<comment><USER33> Same here. We should create an efficient compiled version of Ansible, same feature set much faster execution, single configuration file flavor (only yaml)

<comment><USER32> My idea is different. Instead of playbook yaml, playbook go source, that compiles to a fat binary that is transferred over ssh. That decreases the dependencies to ssh only on the target hosts (no python). The framework would include an idempotent API that matches all the tasks that Ansible provides.

<comment><USER33> Yes, you are thinking about the same. I would just use YAML for the things that can be configured.

</comment></comment></comment></comment></comment><comment><USER34> I use a somewhat similar setup, although I kept FreeBSD ala FreeNAS.

I use a FreeNAS server to manage storage pools and the bare metal box, run Ubuntu vms on top of it, and then manage top level applications in Docker in vms via Portainer.

This is nice because the vms get their own ip leases, but can still be controlled and very locked down (or not) depending on their use.

Docker volumes are mounted over NFS from the underlying NAS, and the docker level data is backed up with the rest of the NAS.

</comment><comment><USER35> There is also another option - Consul/Nomad/Vault/Terraform. I only wasn't able[1] to figure how to setup private Docker registry with Terraform/Nomad. The rest, including GitHub organisation, DNS zones, etc - can be defined as code.

[1] [https://github.com/hashicorp/nomad- guides/issues/50](https://github.com/hashicorp/nomad-guides/issues/50)

<comment><USER36> That's an orthogonal option in my opinion. It still allows you to run a full docker setup. It just influences how you run manage everything. That being said, I really like the hashicorp stack and more people should run it.

</comment></comment><comment><USER37> What about performance hit now that all of the services are running on the same server? Might be interesting to monitor and put resource limits on specific services.

<comment><USER38> This is the CPU load on the server right now: [https://imgur.com/a/nuM3CqX](https://imgur.com/a/nuM3CqX)

Being on HN front page has pushed it up from a baseline of 7.5% utilisation to about 12.5%.

<comment><USER39> What kind of instance is that on?

Thanks for the article, very informative.

<comment><USER38> Thanks for reading. It's a 2 CPU 4Gb RAM instance. It's probably over specced...

</comment></comment></comment></comment><comment><USER40> Can use docker-compose up --build with build options in compose.yml to avoid the need for a container registry.

</comment><comment><USER41> This is pretty classic amateur hour. He basically says 'I now know docker and everything looks like a container! Look at how productive I can be by discarding this set piece environment with out of fashion, slow and deliberate provisioning for docker images that I can create once and run forever with auto provisioning and dutch oven magic + an editor!'

</comment><comment><USER42> Virtual machines are supported on most platforms. And gives more freedom then docker.

<comment><USER43> Docker is just setting a few kernel parameters, VMs run a full OS over the host, there's a cost to that. If you don't need the extra flexibility, there's no point.

Mind that you don't need to use Docker to use containers, there's always LXD and others.

<comment><USER42> Many virtualization technologies use hardware acceleration supported on modern server grade CPUs. It's not like running on "bare metal" but pretty close. One use case for VM's is running obsolete software, like some old proprietary OS, it's a weird feeling when the software run 100x faster then the hardware it used to run on.

</comment></comment></comment><comment><USER44> > My sites are already quite compact. Firefox tells me this page and all > resources is 171KB / 54KB transferred

16323 bytes of text, 6933 bytes of vector graphics, 23,256 bytes. 22KB of content, 171KB total, 87% of the transfer total is potential bloat.

It could be worse, but there's almost certainly room for improvement.

</comment><comment><USER45> I applaud the dedication if this really is just for personal infrastructure.

</comment><comment><USER46> This is what existential terror looks like. In the face of something incomprehensible and impersonal, OP decides to spend a while rearranging the deck chairs. Nothing has changed, but perhaps OP felt a little better about himself for a while.

<comment><USER47> What is the "incomprehensible and impersonal" thing that the OP is facing? I skimmed the post and I have no idea what you are talking about. If I was feeling adventurous, I might claim you are projecting a tad :)

</comment></comment><comment><USER48> In sum, zero benefits from using containers.

Still have to decide on a single OS to reduce maintenance problems. Could just have installed all the services (which are all available as packages) and handled the configuration files instead of configuration files+docker file+s3 costs of docker image with nothing but the base os + one package and a configuration file.

<comment><USER49> That's not a fair assessment and I'm surprised this is the top comment. In this case, the huge advantage to a containerized setup is that everything is now easily portable. If his server goes down, or he just decides to move, OP can now deploy all of his websites onto another server instantly. He also quotes the ability to build (and test) locally before shipping images to production, which is a really neat workflow. Improved security comes as an added bonus.

As for the "s3 costs of docker image", it's a few cents per month.

<comment><USER50> Concerns about server going down or changing cloud provider imo is not particularly interesting or even useful advantage to mention for _personal_ infrastructure. Considering that it's likely we might change our personal infrastructure less than one every year and I've never got a case when an unmaintained docker setup can run 6 months later, I'm not sure if the value for portable is that high.

<comment><USER51> > Concerns about server going down or changing cloud provider imo is not > particularly interesting or even useful advantage to mention for personal > infrastructure.

Why? Personal projects aren't more stable or bound to a single provider. If anything, personal projects may benefit more from a deployment strategy that makes it quite trivial to move everything around and automatically restart a service in a way that automatically takes dependencies into account.

> Considering that it's likely we might change our personal infrastructure > less than one every year

In my experience, personal projects tend to be more susceptible to infrastructure changes as they are used to experiment stuff.

> and I've never got a case when an unmaintained docker setup can run 6 months > later,

The relevant point is that the system is easier to maintain when things go wrong and no one is looking or able to react in a moment's notice. It doesn't matter if you decide to shutdown a service 3 or 4 months after you launch it because that's not the usecase.

> I'm not sure if the value for portable is that high.

That assertion is only valid if you compare Docker and docker-compose with an alternative, which you didn't. When compared with manual deployment there is absolutely no question that Docker is by far a better deployment solution, even if we don't take into account the orchestration funtionalities.

</comment></comment></comment></comment><comment><USER30> I blacklist Vultr/choopa in every environment I manage. They make zero effort to deal with botnets and bad actors. They are the first org where I went to the trouble of blacklisting the ASN so new ranges get blocked as soon as maxmind updates.

Everything else matches patterns we use. WebPageTest is probably the most hilariously janky application that's the best at what it does that we use. Standing it up locally so you can test internal stuff is a revolting experience I've had several times.

TBH I found kubernetes easier to use than docker compose. Mainly because I saw little reason to learn the syntax when I was already using kubernetes yamls and kubeadm makes it so easy to stand up. What you have looks pretty simple though so I may take another look at it.

You can actually ship images as tarballs and reimport them. That's what I do on personal stuff instead of standing up an ECR/registry. As long as you version tag your containers it should be fine.

HTTP/2 is pretty much a nonissue for everyone except some janky java clients at this point. We turned it on a couple of years ago with only minimal issues.

<comment><USER52> Out of curiosity, how does one go about blacklisting an ASN?

<comment><USER53> Maxmind (and others probably) regularly publish lists of IP blocks mapped to the owning ASN. Basically geoip but instead of mapping to geographical regions, maps it to ASN. If you want to roll your own, you can probably start from a public route reflector and go from there.

<comment><USER54> whois -h whois.radb.net -- -i origin AS20473 | /usr/bin/egrep '^route' | awk '{print $2}'

</comment></comment></comment></comment><comment><USER55> The real sauce in my infrastructure is simply 'generational' storage. No more clean installs with a backup dir of the system. All my data volumes get mounted into my machine/s as needed. I can swap out all my hard drives with new ones without any downtime too which is nice. I could reinstall my desktop each morning and it would barely set me back 15 minutes. If I also properly stored my general system settings as code (cfengine, puppet, chef, etc) I could practically just launch ephemeral desktop instances and have basically a native experience.

<comment><USER56> Could you elaborate a bit what generational storage means? If you get a brand new machine - how does it get configured in 15 mins?

<comment><USER55> For me a long time ago an upgrade meant buy new hard drives, do a reinstall, and copy either the entire old drive or main data dirs onto the computer.

Now my data volumes are separate from the system. I used raid for redundancy on the physical machine with another drive for differential filesystem level backups (snapshot every day for 60 days with only differential storage cost, see rdiff-backup). When I upgrade I just add new drives, assign them into the raid, wait for them to sync, and remove the old drives. By generational I mean my storage and how I do things aren't going to change when I reset things like they used to. All my data is outside the system I'm using and must be attached.

I can for example, spin up an AWS machine, run the package install commands for the apps I normally use, VPN to my fileserver and mount my home directory and project volumes, and in quite literally about 15-30 minutes have the exact same environment as I do at my house. CFEngine et al would speed that up quite a bit.

<comment><USER56> Thanks for the explanation, super helpful.

<comment><USER55> You are welcome. I'd have to say the biggest benefit for me personally is the distinct separation and permanence leads me to keep it very organized. When I had my files 'in' my system the lines blurred and things got spread all over the place. I still keep my download dir on the base system and only things i really care about make it to the data drive so there isn't much pollution. I'm a bit scatterbrained in that regard and this method accidentally solved that.

<comment><USER57> That sounds like a good setup to keep things where they belong. Thanks.

</comment></comment></comment></comment></comment></comment><comment><USER58> And after all that, RedHat dumps Docker and Docker adopts Kubernetes. He should have stuck with the stability of FreeBSD--which he prefers--and used jails.

<comment><USER59> But Kubernetes still uses Docker, don't they?

<comment><USER60> Kubernetes relies on containerd which works with docker, rkt or anything that works with containerd.

The prefered alternative to docker is rkt.

<comment><USER61> No they don't. Containerd is the code Moby and Docker are built from, developed at Docker Inc.

Kubernetes will take anything that implements CRI.

[https://cri-o.io/](https://cri-o.io/)

[https://kubernetes.io/docs/setup/cri/](https://kubernetes.io/docs/setup/cri/)

<comment><USER60> All right ! Thanks for the heads up, deeply appreciated.

However, I still stand with rkt rather than docker...

<comment><USER61> It can be quite complicated if you use a docker version without containerd's CRI. And you do if you follow the version recommendations (because docker has a lot of regressions). GKE does it, so we do it.

Kubelet actually has a translation layer baked into it that it starts in- process when detecting docker, which provides the gRPC CRI interface on a real filesystem socket.

[https://github.com/kubernetes/kubernetes/tree/master/pkg/kub...](https://github.com/kubernetes/kubernetes/tree/master/pkg/kubelet/dockershim)</comment></comment></comment></comment></comment></comment>


Ask HN: Employers, why do or don't you offer relocation? - <AUTHOR> Those of you who are responsible for finding / hiring candidates, I'm curious what motivated you to seek employees outside of your area.
How far are you willing to relocate someone?
What's stopping you from relocating someone overseas?
I'm seeing a lot of interesting jobs in foreign countries that don't offer any relocation and I'm wondering why! <comment><USER2> As in paying for relocation? Or just as in hiring people who have plans to relocate?

We do the latter (if the person does not require visa sponsorship). We can't afford the former. Hiring someone is risky enough as it is without adding extra up-front expense. And the pool of candidates who are local or have plans to relocate without being subsidized has been sufficient for us.

And visas are extra complexity that we don't have the time resources to devote to — and in some cases (like H1Bs) an additional risk because they're a crapshoot.</comment>


Show HN: Self-host Ghost blog in 5 mins with Docker - <AUTHOR> http://blog.alexellis.io/ghost-on-docker-5mins/ <comment><AUTHOR> Ghost is an elegant and minimal blogging platform that focus on simplicity. One of its most attractive features is its Markdown editor. It's also fully hackable running on Node.js with the Handlebars view-engine.

I've put together three Dockerfiles for Raspberry PI 2/3, PI B/B+/Zero and regular PCs (x86_64). Get your blog up and running in 5 minutes by pulling a pre-built Docker image straight from the Docker Hub.</comment>