Amazon Leadership Principles - <AUTHOR> https://www.amazon.jobs/en/principles <comment><USER2> I worked at AWS for 8 years. Overall it's a good place to work, and I'd highly recommend it to junior developers just starting out. I left 4 months ago, but it wasn't Amazon's fault. I was treated well, was paid very well, and I liked the work. But I was always going to be working on someone else's terms there, and I realized that wasn't the ideal career path for me. I like working for myself better, but I don't regret my time at Amazon.

——

Edit: Here's my comp progression at Amazon for those curious:

2010: €50K - Joined Amazon in Dublin, Ireland as an SDE-1 (entry level) in the AWS CloudWatch team.

2011: €75K - Still at Amazon, same team.

2012: $120K - Moved to Seattle with the same team. Promoted to SDE-2.

2013: $150K - Still at Amazon, same team.

2014: $185K - Promoted to SDE-3 (senior level), same team.

2015: $230K - Still at Amazon, same team.

2016: $390K - Still at Amazon, same team.

2017: $470K - Still at Amazon, same team.

2018: $511K - Still at Amazon, same team.

2019: Left Amazon last February. You can read more about why here: [https://news.ycombinator.com/item?id=19135399](https://news.ycombinator.com/item?id=19135399)

All figures are gross income as shown in my W2. My last 3 year-end (Dec) paystubs: [http://imgur.com/a/EgIVQln](http://imgur.com/a/EgIVQln)

<comment> alok-g Did the numbers become so high in later years due to AMZN stock price gains? Or some other reason?

<comment><USER2> The jump in 2016 was because I got an offer from Oracle and Amazon matched it. I actually lost a bit from stock depreciation that year because most of my RSUs bested a week after Trump's election.

For 2017 and 2018, yes stock appreciation is the reason for the growth over 2016.

</comment></comment></comment><comment><USER3> I have (successfully) interviewed with Amazon. One of the reasons I turned the job down was my experience in the interview.

My "loop" was done by people who spend an hour with me asking my questions designed to see if I fit into these "principles". After the third interview, I was exhausted by parroting the same damn story multiple times - I mean, how many stories can you come up with?

The bar-raiser was changed at the last minute and I got some random dude on the phone who clearly had no idea what the job was about. He spent his hour interrupting me and peppering me with random questions. I've been a lawyer and am used to this so it was not an issue, but it was an all around weird, cult- like experience.

I did well enough to get an offer, but when I walked out of the interview I'd called up my wife and told her I would never join a company that seems to be more cult and less company.

The whole vibe was just super weird. I mean, I'm used to big tech companies thinking that they are doing world changing work (Msft, Goog. Never interviewed with FB), but this was entirely on a different scale.

<comment><USER4> > My "loop" was done by people who spend an hour with me asking my questions > designed to see if I fit into these "principles". After the third interview, > I was exhausted by parroting the same damn story multiple times - I mean, > how many stories can you come up with?

I'm not sure how long ago this happened, but I'm surprised that your recruiter did not prep you for this. They tell you about the LPs and to prep 1-2 stories to demonstrate that LP, so you don't feel that you overlap.

LPs are used as a determiner of cultural fit and most other companies have their own version of this (e.g., "Googliness"). It may seem more cult-ish, and I thought that too when I joined, but it helps to move the business forward.

FWIW, I left Amazon a while ago for unrelated reasons.

</comment></comment><comment><USER5> _Shrug_ I would take these more seriously if I felt amazon was executing at an impressive level. Honestly though, I feel like AWS (what I consider their flagship, most-profitable product) runs on a windows-95-level interface and is missing the most rudimentary features for over a decade.

If your results aren't successful, then your methodology must not be successful.

<comment><USER6> What features are they missing? Which competitors have these features? Are AWS's results not indicative of success?

<comment><USER5> Here are some example very basic use-cases:

\- Ability to show all EC2 instances by creator (e.g. David quits, what servers did he make?)

\- Ability to sort EC2 instances by date of creation

\- Ability to show instances that seem inactive (< 5% CPU average load).

\- Ability for searches on instance names to support partial matching.

\- Ability to change PEM file associated with a server

\- Option to resize instance HD size and have it immediately extend the FS

\- Status indicator on instances that show when the server is under so much load it may not be responding to SSH

\- I'm seeing a glitch lately where dialogs follow my cursor.

These are just a few very basic things I can think of off the top of my head. I'm sure there are hundreds that other people have come up with.

An organization that cannot successfully direct such requests to the teams to build them, and then make it happen, within a decade is not an organization I would model after.

They may be market successful, because they were the first mover, but they aren't taking basic steps to solidify that dominance imo.

</comment></comment></comment><comment><USER7> Ugh.

"Are Right, A Lot" \- what is this, a magnet for egomaniacs?

"Have Backbone; Disagree and Commit"...

These two mixed feel super toxic. The others are important, but these seem to override the humility necessary for learning...

</comment><comment><USER8> Cult Commandments

</comment><comment><USER9> Also, 1) Work new hires to death, 2) Make employees cry, 3) Pay like sh*t

<comment><USER10> * $108,000 base salary, $120,000 in NYC/SF

* $24,000 signing bonus, $28,000 in NYC/SF (even more if returning intern)

* $7,000 tax-assisted relocation bonus

* $3,000 stock yr 1, $10,500 yr 2, $28,000 yr 2.5/3.0/3.5/4.0

These are not "shit" numbers for a new graduate with only a bachelors degree.

<comment><USER11> Amazon does employ more than tech people which is probably what the person was referring to.</comment></comment></comment>


Step by step guide for installing LAMP stack on AWS EC2 instance - <AUTHOR> http://chiragchamoli.com/2012/07/step-by-step-guide-for-installing-lamp-stack-on-aws-ec2-instance/

<comment><USER2> You should never, ever install EC2 servers like this, unless they're meant for temporary testing. When the EC2 instance terminates (and it will, eventually) your server goes down and all your data stored on the ephemeral disk is gone.

What you need to do instead is setup an auto-scaling group that automatically launches a new EC2 instance to replace the terminated one. You also need to set up boot scripts that automatically configure the newly launched instance to run your app, or alternatively create a custom AMI image that's preconfigured to run it on boot.

And if you store stateful data (like the MySQL in LAMP), you need to setup boot scripts to attach a EBS volume to store the data on. Or alternatively just use RDS which does it for you.

</comment><comment><USER3> Seriously? This needs to be on HN?</comment>


Conventional Commits - <AUTHOR> https://www.conventionalcommits.org/en/v1.0.0/ <comment><USER2> After working on a project that had code commit linters like this, that block you from committing if there's a violation, it's absolutely awful. You cannot work incrementally at all since "inject logger" is not a feature. Since most people aren't comfortable with rebasing (i don't know why), you end up with a ton of nonsense like a whole chain of refactors or feats that aren't actual refactors or features, they're just there to appease the tool since you can't commit (even locally!) without them.

Just stick to squash-before-merge-to-master, thanks.

<comment><USER3> Squash merge and commit linter only on master seems like the way to go here.

Then you can do whatever you want in your feature branch, and then when the feature is ready, create the squashed commit with the proper commit formatting.

<comment><USER4> squash merges to master are terrible for those that want to go looking why a certain change was introduced.

Now a larger change set is hidden behind a squash merge, and why was line 50 in foobar.py updated? Who knows, it was part of this giant merge request which no longer provides context why the developer changed line 50 in foobar.py.

Commit messages should explain why the change was made to the code. The amount of times that I go diving into a codebase only to find that the change was introduced in a larger commit that just says "fix bug" with no further information is maddening.

<comment><USER5> You're describing the wrong use of squash merges, and I agree they suck.

The right use is to allow me to make crappy, random commits on my own feature branch, clean them up those commits when I'm ready to release the change.

And the commit description will describe what's going on.

The key is that my feature branch is _not_ long-lived - only a day or two, long enough for me to make a step forward before merging it back into mainline and then starting on the next step.

<comment><USER4> Even for a short lived feature branch that lasts maybe a day or so there may be a bug you find during testing that you quickly fix, or a change you make in existing code to help support the new feature or something you know is coming down the pipeline, and that information is now lost.

<comment><USER6> Or you could make consideration for tracking that change in source code a priority when making those changes and code appropriately.

The problem you describe is a problem because people are not prioritizing or valuing the commit history as a resource. If you fix that, then people will think about these things differently.

Squash and merge is not the only way to get things into master. You can rebase and squash commits as needed on your branch and then bring multiple commits from your branch onto master. That takes more advanced usage of git, but learning that makes sense once you start really valuing the history.

</comment></comment></comment></comment></comment></comment><comment><USER7> Hey,

I'm the original co-author of the "Conventional Commits" spec. Although, I should give credit where credit is due, and say that it evolves directly from Angular commit conventions.

I started adopting these conventions with the goal of automating releases, both on my open-source and on the services I was working on at npm (I've since brought the practice to my team at Google).

I very much did not want to introduce road blocks to folks committing to their own branches -- which is what the "rewrite the message when you squash" advice grows from.

Here's a post I wrote on how my team uses Conventional Commits in our release process:

[https://dev.to/bcoe/how-my-team-releases- libraries-23el](https://dev.to/bcoe/how-my-team-releases-libraries-23el)

</comment><comment><USER8> > Example: Commit message with both ! and BREAKING CHANGE footer:

> refactor!: drop support for Node 6

From Wikipedia's Code Refactoring:

> In computer programming and software design, code refactoring is the process > of restructuring existing computer code—changing the factoring—without > changing its external behavior.

So if a code change is just a refactor, then its external behavior is unchanged, therefore it is not a breaking change. These two commit labels are incompatible.

<comment><USER9> Once the decision has been made that Node 6 is no longer supported, it is then possible to refactor the code so that it uses appropriate modern idioms, such that the external behaviour is unchanged for Node 6+ but will no longer be parsable by Node 5.

In this specific case, it is both a refactor and a breaking change.

</comment></comment><comment><USER10> The most interesting things about Conventional Commits are that they can be deterministically digested by a process to decide how to bump a SemVer and similarly to create a formatted CHANGELOG file.

<comment><USER11> I really wished we had type systems good enough, and tools smart enough to figure the semver bump by it self. Ideally humans should not come near semver bumping, not even through the commit messages.

<comment><USER12> Elm does have a type-directed version bump tool. Is that what you were thinking of?

</comment></comment></comment><comment><USER12> My take on this is that, all else being equal, it seems the major selling point of Conventional Commits is that their commit summaries can be used to calculate the next version bump. But IMHO, instead of asking everyone to annotate every single commit message with a marker just so a separate tool can process it (possibly to get it wrong), it's better to just update the version directly when making changes. This way the version bump is deliberately and carefully thought out, and doesn't need to pollute all commit messages in the process.</comment>


The hackers teaching old DNA sequencers new tricks - <AUTHOR> https://www.nature.com/articles/d41586-018-05769-8 <comment><USER2> This is actually pretty cool (although the lack of reproducibility from custom instruments is concerning). i think the whole race towards massive amounts of WGS has detracted from quality low-level biochemistry and biophysics research, and these machines are (in principle) incredibly sensitive, programmable experiment managers.</comment>


Jiro Dreams of Sushi - <AUTHOR> http://www.magpictures.com/jirodreamsofsushi/ <comment><USER2> For the uninitiated, the subtext of this movie is pondering whether Jiro's son Yoshikazu will be able to successfully take over the restaurant when Jiro retires. It's the age old question of what does it take for apprentice to finally surpass the master; who is a worthy successor to the master, etc.

This is particularly relevant because the valley's succession story du jour is Apple and whether Tim Cook et al can take the reins in the wake of Steve Jobs. The following quote struck me:

"It's not going to be easy for Yoshikazu to succeed his father at the same restaurant. Even if Yoshikazu makes the same level of sushi it will still be seen as inferior. If Yoshikazu makes sushi that's twice as good as Jiro's, only then will they be seen as equal." (32:06)

This is exactly what Apple has been going through in the last year, exacting a level of polish that is on par if not above what they released last year, but still leaving nagging doubts in the hearts of the faithful. The one thing that would silence critics and quell fears would be that something _twice_ as revolutionary as the original iPhone be straight up imagined, developed, and hoisted by the post-Jobs Apple--just to claim par.

<comment><USER3> Near the end of the documentary it is said by Jiro that his son (Yoshikazu) was the one making the sushi when it was being graded for the three Michelin stars and that being the head chef is the easy job because all the hard preparation work is done by the people under him. I think this somewhat applies to Apple as well — while Jobs was an excellent curator of sorts, he was supported by excellent people like Sir Jonathan Ive and others. So I wouldn't be surprised if they continue to create highly innovative products.

<comment><USER4> The thing I particularly liked was how he picked his vendors based on their expertise. He admitted to knowing less about tuna than his tuna guy, less about rice than his rice guy, etc., and his relationships were long-term and mutually beneficial.

<comment><USER5> Really appreciated this point too. None of his vendors seemed to have a genuine interest in anything outside of the quality of their craft and the honour of their relationships. It was incredibly refreshing, and seems to be part of quite an old set of values for the region that might not pop up as much these days. Or at least, be promoted as widely as more capitalist ethic.

<comment><USER6> That's Japanese Culture for you. Many see their job as their highest life goal and they seek its perfection in order to honour their family/team mates/company/fellow Japanese or whatever their group association is at the moment. This idea then trickles down to even low wage jobs, where you still get an above par work quality. Trying Starbucks (cleanliness) and McDonalds (look and taste) in Japan is an interesting experience.

<comment><USER5> Looking forward to it if I ever have the chance. There's an element of contentment to this approach that I really appreciate.

</comment></comment></comment></comment></comment></comment><comment><USER7> The most memorable part of the movie for me was when the interviewer asked Jiro what it takes to be a master of your craft. He started off mumbling standard old-man stuff about hard work, and then he mentioned something I've never heard before, that you should never complain about your job.

I was thinking about this in the context of my teaching. In general teachers complain about their students three times as much as students complain about their teachers. Here's an example, take a look at the Chronicle of Higher Education's forum on teaching:

<http://chronicle.com/forums/index.php?board=25.0>

The overwhelming majority of the activity there consists of complaints about students, with "the thread of teaching despair" currently at 447 pages. There are even entire websites devoted to the practice, like College Misery.

It's not like I've never vented about my job, but I've also always been a bit uneasy with the practice. After reflecting a bit, I think it's because time focused on what other people are doing wrong isn't spent figuring out what you should be doing right.

So as an experiment I'm going to force myself not to complain about any aspect of my job during the coming semester. If I'm happier and better at my craft by the end I'll adopt it as a long-term practice.

<comment><USER8> A splendidly heroic way to miss the point. Someone who doesn't complain isn't actively trying not to complain, they are content with their lot. Thus, forcing yourself yourself not to complain is as silly an ambition as declaring "I will not think of elephants".

Complaints stem from discontent and/or powerlessness.

It is important that Jiro is largely in control of his own destiny, however small that might be. Most teachers are not really in control of anything significant at their workplace, cetrainly not their destiny. Most students don't yet have a destiny, they are forced to attend and are purely reactive.

Choose the right thing to do, be content doing that.

</comment></comment><comment><USER9> I'll be the dissenter here-- I was not a fan of the movie. It was a boring piece about a man obsessed to the point of craziness about sushi. His kids said to the mother: "Mommy, who is the strange man in our house?"

The man was Jiro, their father. Is that the childhood you want your children to live? For me, the mastery of a craft is not worth this price.

<comment><USER10> IMO, most comments & takeaways around the documentary focused on being passionate and loving your work. But the documentary does make you ponder over whether it is worth the price of not being there for your children.

On a separate note, the scenes of the fish market shows the ugly side of over fishing our seas.

<comment><USER11> _the scenes of the fish market shows the ugly side of over fishing our seas._

What do they show? I can't figure out how one thing could show the other.

<comment><USER12> You have to know some subtext: those tuna take human lifespans to grow. There are dozens of them there, every day.

</comment></comment></comment></comment><comment><USER13> The movie is free for Amazon Prime subscribers.

[http://www.amazon.com/Jiro-Dreams-of- Sushi/dp/B008ODZEQ0/ref...](http://www.amazon.com/Jiro-Dreams-of- Sushi/dp/B008ODZEQ0/ref=sr_1_1?ie=UTF8&qid=1346505272)

</comment><comment><USER14> It's currently streaming on Netflix (in the US at least): <http://movies.netflix.com/WiMovie/70181716>

</comment><comment><USER15> I'm really surprised this managed to get to the front page. Then again, I watched it and liked it, so I guess it comes down to similar preferences in the HN crowd.

Jiro's dedication to his craft is a fitting example for those who aspire to the highest levels of achievement in any field. The film's a paean to putting your life into what you do; it's also about the sacrifices that involves, and the impacts on those close to you.

I came out wishing I could be just half as dedicated as Jiro. Maybe one day I'll dream of code?

</comment><comment><USER16> Best paired with:

[http://www.cookingissues.com/2012/06/08/tokyo- tales-300-of-s...](http://www.cookingissues.com/2012/06/08/tokyo-tales-300-of- sushi-in-30-minutes/)

Dave Arnold from Cooking Issues writing up a trip to Sukiyabashi Jiro.

</comment><comment><USER17> Jiro is a workaholic. Think about it.

[http://www.overcomingbias.com/2012/04/jiro-lives-worth- livin...](http://www.overcomingbias.com/2012/04/jiro-lives-worth-living.html)

<comment><USER16> I'm not sure I agree with your comment, but that is a very provocative article.

I wish he had framed it in terms other than whether these lives were "worth living", though.

</comment></comment><comment><USER18> There's an interesting review of sorts of the restaurant here: [http://www.cookingissues.com/2012/06/08/tokyo- tales-300-of-s...](http://www.cookingissues.com/2012/06/08/tokyo-tales-300-of- sushi-in-30-minutes/)

</comment><comment><USER19> One could probably make 100,000 more documentaries approximately identical to this one at other family owned businesses. The only thing particularly unique about this place is that it came to the attention of Michelin and then a documentarian. I don't mean that as a knock against Jiro's place at all, I just think the filmmaker overplayed the story. That and the combination of Japan and sushi made the situation seem even more exotic and rare than it really is.

It was entertaining though. I especially liked the part when he said something like "Welp. I'm ready to go. Why am I even here [at his parent's shrine]. My parents treated me like crap."

<comment><USER20> I'm not sure there are 100,000 family-owned businesses where the owner has 75 years+ experience, spends 15+ hours a day at work and takes their job so seriously. I've worked in kitchens that were highly-rated in their own cities, but they never approached the exacting all-around level of quality and detail of Jiro's restaurant. If you've ever worked in the food industry, you'd definitely know the care they take in all steps of their process blows away all but the best of the best restaurants and I believe the stars from Michelin reflect that.

</comment></comment><comment><USER21> One of my favorite documentaries of this year. I LOVED this movie.

<comment><USER22> Same here, his passion and work ethic for his craft is inspiring.

<comment><USER23> Definitely a great documentary. It reminded me of the importance of a passion for your craft and a sincere desire to do great work.

</comment></comment></comment><comment><USER24> I don't know what it was but I was in awe of this guy and his family and the whole culture with the whole movie.

</comment><comment><USER25> In the movie, Jiro admitted to giving women smaller portions. The women seated at the bar commented on how clever that was. I wonder if that would fly here in the State. If women are getting less for the same price, i think most Americans would find that fundamentally unfair.

</comment><comment><USER26> I would rank it among a typical Gary Hustwit movie but it did become repetitive at times. Obviously not as thrilling as Man on Wire but when it comes to documentaries about devoting every waking minute to your passion, it's a top pick.

</comment><comment><AUTHOR> If you are really into your craft and/or love sushi, this is a great movie for you.

</comment><comment><USER27> that the full menu costs $300 and you will finish in 30min. also reviews of the his sons restaurant say they get angry if you dont eat everything...

<comment><USER28> Not finishing what you're served in Japan is, approximately, the same comment as a $0 tip is in America, except about food quality rather than service. Culturally, the act of not eating something prepared for you reads like "Your food is inedible and unfit for human consumption" rather than "I wasn't that hungry" or "This particular dish, well, I wasn't quite feeling it." This will generally not endear you to fancy chefs, although you might get a bit of leeway if you look obviously foreign.

(Japanese people get in trouble on the tip thing _all the time_ in the US, so much so that my travel agent helpfully tried to instruct me on "peculiar customs of Americans" when selling me a ticket to my hometown.)

<comment><USER29> _Japanese people get in trouble on the tip thing all the time in the US_

I think it's not just Japan. Here in Sweden, tipping is done at times but it's certainly not something mandatory.

Please do educate me more on US tipping customs. I don't want to be a fool when I go there in future...

<comment><USER30> Simple: American service has a peculiar quirk in that servers are paid (in 95% of the country) around 2 dollars an hour, and are compensated in tips instead. At minimum, 15% is expected as a tip, even for bad service, and good service has an expectation of 20%. Truly bad service should be spoken to with the manager, rather than simply leaving without any tip.

Note that servers expect you to tell them if something is wrong, so that it can be corrected.

If you have a discount, you are still expected to tip on the full amount.

When you look at the price, add about 9% (depending on locale) for sales tax and another 15% on top of that for the tip. (Tip used to be pre-sales tax, but is considered post-sales tax today.)

Many people tip 20%, but it is not required. Fast food has no tipping. Starbucks and other coffee places, a tip is appreciated but not required. Bars expect a dollar per drink.

<comment><USER20> I think the bit about talking to the manager is key here. Many of my friends are servers and customers will sometimes stiff them entirely on tips because they are upset about the quality of the food or some other transgression of the restaurant, but really this only affects the servers and hardly ever goes up the chain to the management. If you are having an issue, you need to talk to the manager or odds are it will never be corrected. Plus, when you've been sitting there an hour and your server might only have four tables, you could end up being a much larger portion of their tables that night than you realize. It's not uncommon to have little old ladies take over a table for a few hours drinking tea resulting in the server walking away with substantially below-average tips that night. I find the system completely unfair but have not yet found a way to protest it that wouldn't directly hurt the servers.

<comment><USER31> If the purpose of the restaurant is to serve the waiters then they should be paid at least a living wage up front, rather than requiring me to vacate my seat as rapidly as possible and be required to supply minimum wage on pain of death.

Don't blame the customers for not tipping enough when there are such problems with labor law and restaurant management.

<comment><USER16> If you object to the system of tipping waiters so strenuously that you're willing to stiff someone who earns a bottom-quartile income to serve you, just don't eat at sit-down restaurants.

Going to sit-down restaurants and refusing to tip is a great recipe for becoming a pariah.

<comment><USER32> _Going to sit-down restaurants and refusing to tip is a great recipe for becoming a pariah._

Quite. I really don't understand the idea of showing one's dissatisfaction with tipping by hurting the guy earning $2/hour _and not the owner of the restaurant_ \- it seems pretty obvious whose bottom line will suffer the most in this instance.</comment></comment></comment></comment></comment></comment></comment></comment>


Why Is Anime Obsessed With Power Lines? - <AUTHOR> https://www.atlasobscura.com/articles/why-power-lines-anime-electrical-infrastructure <comment><USER4> Short Answer: Anno

Until their depiction in _Neon Genesis Evangelion_ in 1995, power lines were virtually non-existent in anime. After all, why draw them when they take up more time and effort during a time-packed production schedule? However, Hideaki Anno, the director of the aforementioned anime, began to implement them in backgrounds, bringing in a new kind of mechanical urban aesthetics. Anno has a certain kind of obsession with mechanical structures, such as power lines and rail tracks, as he likes the way they continue into a distance. He continued depicting them in his later works, such as _Kare Kano_ as well as live action features such as _Shiki-jitsu_ , _Love and Pop_ and his recent blockbuster _Godzilla Resurgence_ [1]. Given how Evangelion revolutionized anime, the industry quickly followed its influence including its aesthetics.

Source: I've interviewed him. [Link]([http://rickyreports.com/archives/annohideaki/](http://rickyreports.com/archives/annohideaki/))

[1] Well, it is rather an essential feature to portray destruction within this long-running monster franchise.

<comment><USER5> I can't believe I found it, or rather, that someone uploaded just it.

[https://www.youtube.com/watch?v=II9GZrKztXQ](https://www.youtube.com/watch?v=II9GZrKztXQ)

When I heard power lines, for some reason one scene from Patlabor came to mind.

It's the quintessential Tokyo city view from the window, and the quintessential view inside a window from the city. Outside there are power lines. You cannot avoid them. And looking in, you see the tatami flooring and dudes in their underwear.

I thought it might have been Patlabor 2, but it was the original movie. So that's 1989. Both movies are staples of Japanese anime.

But power lines can also be found in episode 1 of the TV series.

[https://www.youtube.com/watch?v=OFTs97NpnUo](https://www.youtube.com/watch?v=OFTs97NpnUo)

So my short answer would be Patlabor, but that's just from my own memory.

I think the commonality here is that the power lines are used to portray a sense of scale for the robots. A kid growing up in Tokyo knows exactly how high those lines are.

<comment><USER6> I just checked out Bubblegum Crisis (1987), and that also has multiple shots with crazy power lines in the background. For instance, 11:38 here:

[https://youtu.be/JlFGbBPQGLo?t=698](https://youtu.be/JlFGbBPQGLo?t=698)

<comment><USER7> The shot has power lines in it, but they're not really the focus. It's a busy nightlife scene, and the power lines serve that effect.

In the Patlabor shot, the detailed power infrastructure is a bit more purposeful, adding to the atmosphere of an average suburban neighborhood full of average people. But again, it's not the star of the shot -- it's just one of a handful of choices that create the mood.

In Evangelion, the shots are framed to draw your attention to a wooden pole with a transformer box that was probably designed in the '60s, serving as a stark contrast with all the futuristic technology around it.

</comment></comment></comment></comment><comment><USER8> Because that's what Japan looks like, duh! Any place in Japan has basically power lines all over the place, even in cities like Tokyo.

And also because it's easy to draw and show for 5 seconds in every anime to save on the precious animation budget because it's super static and goes everywhere. Added bonus it can be added into any decor and you would not notice it's the same pattern imported all over again in between animes.

<comment> GuB-42 It is true that it is what Japan looks like but it is still interesting to see how detailed the depiction is.

Compare to the Simpsons for instance. It is set in present day American suburbs, but it doesn't look at all like a photograph. All the small details are missing unless they are relevant to the story.

In the west, even if real life photographs, power lines are commonly seen as a nuisance and avoided, or even edited out.

It is clearly a different approach to animation. I think we can make the parallel the way hands are drawn. 4 fingers for western animation (simplified), 5 for anime (realistic).

The animation budget argument makes sense, and it certainly a good explanation for pylon or railway crossing shots. But I don't think it explains everything, both obscure series and big-budget animation films have their fair share of power lines.

<comment><USER9> Precisely ... because the Simpsons is the epitome of all western animation. /s

<comment><USER10> What is this even supposed to mean?

That's exactly their point. The average-to-low-budget (as well as unpopular) anime still has power line shots all over because that's just what they do. On average, our establishing shots in our (Western) cartoons just aren't as detailed. Obviously popularity and quality are not hand in hand, and The Simpsons is one of, if not the most popular cartoon show of all time.

<comment><USER8> The Simpson has massively better animation than The regular tv anime in Japan. Most animes have very few animated frames and instead revolve on fixed backgrounds, scrolling, voice over and only lips moving now and then. Good animation is expensive to produce and most animes are made with very few resources and time. When a good one makes it, its nothing short of a miracle.

<comment><USER11> Let me introduce you to a concept called "pencil mileage".

Simply put, for a budget of $x, your crew can draw $y miles of lines. How do you use these to fill out the huge number of images you need to produce?

In the West, the solution has historically been to simplify your drawings as much as humanly possible so that you can have a lot of them; we tend to want to have everything constantly moving and changing. Our characters tend to be the barest collection of broad details to distinguish one from another; we are loathe to drop below shooting "on twos"^1.

In the East, they took a different path: They want complicated drawings. So one drawing will linger on the screen a lot longer, pushing up against the moment where a drawing "goes dead"^2 a lot harder. Often you'll build up to a small handful of lavishly animated scenes, where most of the episode's budget is blown at the climax of the episode.

I was raised in the Western tradition^3, and it took a long time to learn to see the craftsmanship and love in Eastern animation. I'm glad I did; I've seen some really powerful and compelling stories that I wouldn't have seen in Western work.

(There are of course broad generalizations, you can find increasing amounts of Western work that's heavily influenced by Eastern animation, and probably vice-versa as well. You can also find expensive shows and cheap shows all over the world.)

\----

1: exposing every drawing twice, for an effective frame rate of 12 (animators still like to think in film's 24fps) 2: If a character is moving, then goes perfectly still, there is this weird moment when your brain stops registering it as "something alive that has stopped moving for a moment" and starts registering it as "a static drawing". It's really creepy to see happen. 3: and even spent most of a decade working in it

<comment><USER12> I couldn't quickly find a link/reference, but I remember reading a couple years ago that, when shown images/photographs, in the West we spend most of our time looking at the foreground objects, while in the East (might have been Chinese specifically who were tested?), they look at the background more than westerners (which is not to say that they look at the background more than the foreground)

<comment><USER13> It was Freakonomics, I think. Or a contemporary book

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER14> In addition to the reasons given here, I'd say that as far as bang-for-buck in terms of visual realism goes, power lines are pretty effective. They look complex but are quite fast to draw with line tools or model in a 3d package and usually can be represented with minimal shading. Creating the impression of modern urban landscapes is largely a question of creating very detail-dense images, and power lines are a pretty cheap way to add a lot of small detail.

</comment><comment><USER15> Lol... I was going to say this exactly. _Evangelion_ and _Lain_ were pretty popular even in the US around the year 2000, so I imagine they were near ubiquitous in Japan. Both were well-animated and the power lines a symbol that was returned to again and again.

Anime/manga also loves to meme/trope things like this because animation studios are cheap and love 30s tracking shots across 2 hand-drawn panel with nothing more to animate than a bit of lens flare. IMO it started as a style thing but quickly became a "this is a cheap way to pad our runtime" thing.

<comment><USER16> One thing I learned about anime (from discussing it with Japanese folks) is that "anime Westerners like" and "anime Japanese like" can be way different. Something may come out in Japan that has only niche appeal, only to blow up in the West. Azumanga Daioh -- Mother of a Thousand 4chan Memes -- comes to mind. Likewise, sometimes a title takes off in Japan only to find rocky soil here.

I think Evangelion was well loved on both sides of the pond but I have no idea about Lain. It seemed a closer fit for Western cyberpunk sensibilities though, and I have no recollection of it turning into a media phenomenon the way Macross, Eva, or One Piece did.

<comment><USER17> If I recall correctly, Lain was fairly popular both in the West and Japan, largely for similar reasons, although it was less big in the West since at the time it came out anime had not really become A Thing yet.

To your point, Cowboy Bebop can probably be considered to be one of the biggest causes for anime to gain so much traction in the US due to being on Adult Swim and having a killer feel and soundtrack, but its lasting power wasn't nearly as strong in Japan.

<comment><USER15> IIRC Cowboy Bebop was developed explicitly with western audiences in mind. It's success informed later shows (in a similar way to how thr Chinese market is influencing Hollywood movies) so it really is a landmark show, even if it wasn't as well received in Japan.

<comment><USER18> I mean they made a Movie spinoff from the show, so it was sufficiently popular at the time. It didn't have mass appeal staying power a la Eva or Geass, but the former is an outlier and the latter was made in an era where the production companies became much more sophisticated about fan cultivation and pre planned media mixing.

<comment><USER17> Oh yeah, I don't mean to suggest it wasn't popular, but it also doesn't seem to have had the same level of sustained popularity that it has here in the West.

</comment></comment></comment></comment></comment></comment><comment><USER19> In that great documentary "Crumb" cartoonist Robert Crumb shows his notebooks in which he keeps pictures of all sorts of mundane infrastructure that he incorporates into his drawings.

It's really effective in this sequence "A Short History of America":

[https://www.youtube.com/watch?v=5IFVUHg_tUc](https://www.youtube.com/watch?v=5IFVUHg_tUc)

That one always gets me...

<comment><USER20> Comments there mention three later 'alternate futures' panels. They can be found through this page: [https://boingboing.net/2009/08/07/r-crumbs-short- histo.html](https://boingboing.net/2009/08/07/r-crumbs-short-histo.html)

</comment></comment><comment><USER21> This makes me wonder about how complex is the world we are living today. The large amount of niches humanity created, unceasingly. On our complex societies, even a micro blog about "power lines in anime" have an audience, and got a journalist's attention to create an interesting article.

</comment><comment><USER22> Even before I read the link, I thought: Serial Experiments Lain.

The power lines are almost an additional character.

Also: I think this is where the X-styled hair tie started. I remember some discussion of it at the time, and so many characters since then have had some reference to it.

<comment><USER23> Me too :) I loved Serial Experiments Lain's foregrounding of things like power lines... many people might find them unattractive, but good art can change how you see things.

</comment></comment><comment><USER24> No one mentioned this specifically, but as someone who's dabbled in animation a bit...

Power lines are fantastic for selling depth / perspective. The poles are long and slender vertically as are the wires horizontally. When you parallax, it's a nice way to have a mid-ground layer that doesn't obscure too much of the background and naturally pokes up above shorter foreground elements.

Not saying the other thoughts re: theme etc aren't valid. Just something else to consider.

</comment><comment><USER16> It isn't just powerlines. Anime -- especially well-done anime -- has a way of focusing on the mundane in order to establish an emotional connection to the setting.

Thr anime movie _Your Name_ is riddled with brief, but sumptuously animated and richly detailed, close-ups of doors opening and closing. These include simple doors on a rustic rural home as well as the automatic sliding doors on a Tokyo railway car.

</comment><comment><USER25> Anime background/setting tropes:

      - <USER2>
      - <USER3>
      - power lines
      - traffic signals
      - artificial riverbanks
      - lush sprawling forests
      - the roof of a building

<comment><USER10> Honestly. I went to Japan just last month and the fact that all of this is everywhere is just crazy.

<comment><USER26> > The fact that traffic "signals, airplanes, and the roof of a building" is > everywhere is just crazy?

What does that mean?

<comment><USER27> Means you've gotta go to Japan, mate!

</comment></comment></comment></comment><comment><USER28> To quote bitwize from this thread: Well-done anime has a way of focusing on the mundane in order to establish an emotional connection to the setting.

For anyone who wants to understand this aesthetic, I strongly recommend watching The Garden of Words (言の葉の庭), which is only 46 minutes long. There is something breathtakingly beautiful about this film and other ones like it. They engender a strong feeling of longing and gentle sadness (nostalgia?) by bringing focus to the little things in life. It's a sentiment that tugs at the human soul.

Look up mono no aware (物の哀れ), which may be translated as 'a gentle sadness at the transience of things', as well as wabi-sabi (侘寂). Both of these are central to Japanese culture and history.

Edit: I also recommend checking out '5 Centimeters Per Second' and 'Your Name', both directed by Makoto Shinkai. To quote Ronnie Scheib's review:

Shinkai has been hailed as the next Miyazaki, and his dreamy mindscapes often equal or surpass the anime maestro in breadth of detail and depth of emotion. Shinkai extends the innate possibilities of the anime dynamic, reapplying its principles of lush effects, inflated background detail and sometimes undernourished character animation to mirror the interiority of the characters in every nuance of their surroundings.

Some images from 5cm/s: [https://www.google.com/search?tbm=isch&q=5+cm+per+second&oq=...](https://www.google.com/search?tbm=isch&q=5+cm+per+second&oq=5+cm+per+second)

</comment><comment><USER29> I propose a more prosaic explanation. Anime artists probably spend a lot of time looking out their windows. Unless they're doing _very_ well for themselves, they probably see a lot of power lines.

So the one thing they look at and study the most, is very likely to be power lines.

</comment><comment><USER30> I thought it's just that in Asia, they don't usually hide lines or make effort to decrease number of individual wires.

That's what you have on street - that's what you get in anime.

<comment><USER31> I was told that at least in Japan, this is done because it's easier to rebuild after an earthquake than digging up and reburying broken power and communication lines.

<comment><USER32> Huh, cool. That's a great illustration of the two general ways to achieve reliability. Either you make it rather hard to break in the first place (bury powerlines underground, write software with strong type systems) or embrace the fact that either way, it will break eventually, so maybe it's just better to focus on making it easy to fix (powerlines in the air, write Erlang-style software that reboots quickly in the face of error.)

</comment></comment></comment><comment><USER33> It's a beautiful trope that immediately ties you to the location. The shots of trains passing is another - you can tell the train type and company being detected often with a scary level of accuracy. (fd - haven't lived in Japan since 2008)

</comment><comment><USER34> I don't see how this is much different from the establishing shots, panoramic shots, still life shots, etc. that exist in other genres as well. That being said, I do see these types of shots less often in modern non-anime film and I appreciate how anime has been carrying this tradition. Lots of classic films also have a taste for the scenic and contemplative, and it's one of the things I love about them.

<comment><USER35> I think anime's predilection for establishing shots may be due in part to its manga roots...

In "Understanding Comics", Scott McCloud analyzed the transitions made between panels in various works, and he found that sequences of transitions between different views of an environment (what he called "aspect-to-aspect") were common in manga but were nearly absent in American or European comics. I believe he attributed this to the fact that manga typically has higher page counts than other comics, allowing the authors to invest more in setting up scenes.

</comment></comment><comment><USER36> My guess is that + all the other reasons given, they just look artsy and pretty especially against the sky as a background

</comment><comment><USER37> Not directly related, but this made me think of general role of power lines in art.

When they are drawn or painted, they are valuable: they obviously carry a message, someone took the time to draw them.

On a photograph, they are considered something to avoid, or an eye sore to erase. Perhaps because often photographers want to convey what they _perceive_ , not what they _see_. I can say that about myself - I tune out all the utilities from a beautiful piece of architecture like banner ads from an interesting website. But when it comes to taking a photograph, they come back with full force, often leaving me hopeless.

I wonder if there exists a way for a photographer to embrace and love the "ugly" signs of civilization. Perhaps give them a compositional role?

</comment><comment><USER38> The best creators will innovate these sorts of flourishes, picking things that are thematically and tonally consistent and have a real purpose. Then other creators will copy them, as an omage to the original work in order to ground themselves in the artistic movement they wish to belong to. This is how we end up with such a distinct anime aesthetic; a slow accretion of unique elements forming a distinct culture as multiple generations of artists influence each other in blatant and subtle way.

</comment><comment><USER39> Brought to mind this post for artists about how to accurately draw power lines: [http://gurneyjourney.blogspot.com/2016/05/what-artists- need-...](http://gurneyjourney.blogspot.com/2016/05/what-artists-need-to-know- about-utility.html)

</comment><comment><USER40> Because that's literally what Japan looks like? I've been to Tokyo and Kyoto, there are power lines/wires hanging everywhere. I don't know for sure, but I assume they don't have this infrastructure hidden underground because of earthquake concerns.

</comment><comment><USER41> Ironically, one theme that is becoming quite popular nowadays in manga/anime/light novels is "isekai" (i.e. main character gets transported to another world, typically a medieval fantasy similar to LoTR)

</comment><comment><USER42> Because they are graphically striking, lush.

Also they are magical objects. A visible shout of power.

Speaking as an artist, it's low hanging mangos on a silver platter. Of course we're gonna do them.

</comment><comment><USER43> To highlight the location using archaic and outdated infrastructure? I mean, a two-prong 115 V outlet would be kinda hard to see in comparison, no? ¯\\_(ツ)_/¯

<comment><USER44> 100v in japan at either 50hz or 60Hz depending on where you are!

</comment></comment><comment><USER45> This is absolutely correct. I am a lover of anime and approve of this statement

</comment><comment><USER46> Really, the conclusion: "There's many powerlines in Tokyo."

Well, no duh.

</comment><comment><USER47> I dont mean to be terse, but why is this article on the front page?

<comment><USER48> Probably because groups of hackers and anime nerds have a fairly large overlap, esp for those who grew up in the 90s/00s. I spent many nights as a teen watching classic anime (Robotech aka macross, etc) on kqed (bay areas pbs station).

</comment></comment><comment><USER49> Power lines are awful. They are an eyesore that destroys an otherwise beautiful landscape. I hope we can start putting these underground soon.

<comment><USER50> I agree but underground lines are often 2-4 times more expensive than above ground - for that reason alone I don't see them going away in our lifetime.

<comment><USER51> Many urban areas in the US have them buried. None of the places I've lived in Boston have visible power lines but most of the surrounding areas do. It's nice to not worry about weather being a threat to your electricity even if it's more expensive to maintain under standard circumstances.</comment></comment></comment>


Serenity OS update (August 2019) [video] - <AUTHOR> https://www.youtube.com/watch?v=h76Ah4oKfKE <comment><AUTHOR> Serenity is a graphical Unix-like OS for x86 computers written from scratch over the last 11 months. It's being developed here: [https://github.com/SerenityOS/serenity](https://github.com/SerenityOS/serenity)

The biggest new thing this month is that we're up and running on real hardware, not just VM's anymore. :)

<comment><USER2> Nice job. It looks so impressive. I wish we could download an OS image to try it in a VM without having to build.</comment></comment>


Ask HN: Remote position with startup - <AUTHOR> I currently work for a very large corporate, but have an introductory meeting with a startup (~2years old and <50 employees) who is looking to expand geographically to work closely with a client.<p>What kinds of question would people here be asking? The opportunity is exciting but being remote from the centre of a startup seems risky? <comment><USER2> First question that comes to mind: do they already have remote workers. Being the first, and only remote employee is a very complicated position. The team will most likely have to change a lot of their workflow to accommodate you. You may feel like you're not really part of the team.</comment>


How To Be Awesome - <AUTHOR> http://chrisguillebeau.com/3x5/how-to-be-awesome/

<comment><USER2>
      Think about this every day:

        "The question isn't who is going to let me; it's who is going to stop me." ~ Ayn Rand

      If you aren't comfortable with this attitude, it's hard to be awesome. Sorry. You can be good enough without being assertive, but to a large extent, being awesome requires that you initiate, take action, and chart your own course through the norms of mediocrity.

It may sound crazy, but I feel bad when getting what I want hurts other people. Research into things like the Ultimatum Game paints the picture that humans care about fairness as well as personal gain.

I stopped reading after the requirement that I subscribe to an antisocial and amoral philosophy in order to be awesome. I'll find some other way.

<comment><USER3> It is a real shame you stopped reading. I have no idea why you consider this blog post "antisocial and amoral" can you please expand upon your reasoning? (I really mean this sincerely as I have read through the post over and over, but can't see why you paint it so. Is it because the quote is from Ayn Rand?)

Because your comment is first, I think a lot of people may not have read the article/post, so I offer up what I took from the post that I think is relevant to startups:

 __* Working your ass off, at least during specific seasons in life, is also a prerequisite for being awesome. This goes at the top, because if you don't like hard work, good luck.

As mentioned, those first two are prerequisites. They also serve as filters, because lots of people give up on self-determination and hard work. Assuming you can stick with it, it gets easier from here on out.

Remember that your goal is to get things done and make other people look good.

Take initiative without taking control

Overdeliver in your personal relationships. Give more than you get.

From time to time, you'll screw up. This is how you apologize: "I'm really sorry. It was completely my fault. I hope you'll forgive me, and here is how I am addressing this in the future."

Never be a critic without presenting an alternative. Remember that no statues are erected to critics, and no one is remembered for shooting down other people's ideas __*

Though I do think some of his advice is simplistic at times, I feel that there are quite a few good points he mentions.

As a side note, I find that it is always good to read something all the way through before dismissing it for a couple of reasons, one being that sometimes (especially on blogs it seems) people like to be confrontational in the beginning to get your attention, and two, I think it is hard to make a judgement on something you haven't read all the way through.</comment></comment>


Coinbase's Custody service wants to store Bitcoin for institutional investors - <AUTHOR> https://techcrunch.com/2017/11/16/coinbases-custody-service-wants-to-store-bitcoin-for-institutional-investors/?ncid=rss&utm_source=tctwreshare&utm_medium=feed&utm_campaign=Feed%3A+Techcrunch+%28TechCrunch%29&sr_share=twitter <comment><USER2> $100k signup fee + 1.2% of AuM per year. And this is for assets you own, not even a fund.

It's infinitely better than directly investing in a hedge fund charging you 2-20, but it still seems rather expensive in the grand scheme of things.</comment>


Show HN: I built a static blog generator in Ruby - <AUTHOR> https://github.com/lbrito1/sane-blog-builder <comment><USER2> Like the minimal setup. Typography could use more contrast, line height and font-size in my mind. I don't find it pleasant to read on my Max iPhone.

<comment><AUTHOR> Thanks for the feedback! I _really_ appreciate any input on front-end stuff.</comment></comment>


Firefox Developer Edition Devtools Update - <AUTHOR> https://hacks.mozilla.org/2017/09/developer-edition-devtools-update-now-with-photon-ui/ <comment><USER2> Still no live javascript editing, like Chrome scripts tab? This is a major setdown that prevents me from using Firefox. Chrome has that since so many years that I can't believe Firefox still hasn't got it.

I think the latest Firefox releases are fast and good as browsers.. but as a developer, that's a showstopper.</comment>


Shiri: 1999 South Korean action blockbuster changed Asian cinema forever - <AUTHOR> https://www.scmp.com/lifestyle/entertainment/article/3002848/shiri-how-1999-south-korean-action-blockbuster-changed <comment><USER2> FYI, you can watch _Shiri_ online for free on Sony's TV and movie site, sonycrackle.com:

[https://www.sonycrackle.com/shiri/2481139](https://www.sonycrackle.com/shiri/2481139)</comment>


Bill to Legalize Marijuana and Opium Cleared for Indian Parliament (2016) - <AUTHOR> https://www.lawyered.in/legal-disrupt/articles/bill-legalize-marijuana-parliament/ <comment><USER2> I wouldn't be so quick to label Opium legalization as 'progressive'. The Chinese experience with Opium in the 1800's was terrible and very damaging to their society.

The nature of opiates is that they are very addictive addicted. Drug addiction is incredibly difficult to shake once it has taken hold. The way to deal with opiates is to never allow someone to become addicted in the first place.

It's time for us to realize that the global opiate crisis is occurring precisely because opiates are more available now than they ever have been. I love Western culture, but its prioritization of instant gratification can be myopic.

<comment><USER3> > The Chinese experience with Opium in the 1800's was terrible and very > damaging to their society.

To play devil's advocate, China had loads of Opium pumped in by the British to pay for their tea debts. The British countered any attempt to regulate it, so they could keep their markets open. Opium is a dangerous substance, but I'd be interested to see what a well regulated opium market looks like. Unrefined opium is in the same ballpark as alcohol for addicitiveness.

<comment><USER2> How does regulation decrease the addictiveness though? Every one of my friends who has become addicted to opiates got started with legal, regulated prescription drugs.

<comment><USER4> We have a serious problem when we conflate plant material with synthesized, concentrated compounds. People call their pills "medication" and the 4 plants I grow every summer in my backyard "drugs."

<comment><USER5> Yet those same plants contain psychoactive drugs just as those pills do. I am all for drug decriminalization/legalization but this is seriously a stupid argument. There's no logical consistency in treating a drug differently just because you can grow it.

<comment><USER6> I _think_ the argument is more around the potency of a thing (although plant strains can become very potent as well). Just like naturally fermented berries have a different effect compared to distilled spirits.

<comment><USER5> That makes more sense, although I would wager the parent probably doesn't have anything against LSD or THC concentrate.

<comment><USER4> That sounds like you are making an unfair assumption about my beliefs and my understanding is that we are supposed to be charitable in our assumptions for the benefit of discussion on HN. I made the distinction about lab synthesis (i.e. LSD) and plant material (i.e. marijuana). Now you have erected a straw man on my behalf where I can't tell the difference between purified plant material, raw plant material, and synthesized compounds. is that your intent?

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER7> The article clearly articulates what I've been thinking for years. It is so sad how many lives are ruined for nothing by the immoral and draconian drug laws.

</comment><comment><USER8> The current BJP government holds absolute majority in the parliament and the prevailing feeling is that the government is very regressive to say the least. I'd be very surprised if this bill ever gets passed.

</comment><comment><USER9> Needs [2016]

(and maybe "neeeever gonna happen".)

</comment><comment><USER10> This is a bill introduced over a year ago by a minority party to Parliament. Its legislative weight is maybe a notch above than that of an op-ed.

</comment><comment><USER11> Linked article at _Hindustan Times_ , [http://www.hindustantimes.com/punjab/aap-mp-gandhi-s-bill- se...](http://www.hindustantimes.com/punjab/aap-mp-gandhi-s-bill-seeking- opium-legalisation-cleared-for-tabling-in-parliament/story- itanKX3vRrhuXJPdgnJD6N.html)

</comment><comment><USER12> This is a private bill introduced by the Aam Aadmi Party. Let's see what happens to it, but kudos for the attempt!

<comment><USER13> What is the difference between a private and non-private bill?

<comment><USER14> private member bill is a bill tabled by any member of parliament (known as MP in India) who is not a part of a executive branch or part of the cabinet of the ruling govt

</comment></comment></comment><comment><USER15> Considering the opioid experience here in the US and the science showing how incredibly addictive it is, even after a few days use ... I find the opium legalization an odd choice.

Marijuana fine by me. Opium, that sounds like it could be terrible.

<comment><USER16> Legalization efforts of hard drugs are not really efforts to stimulate drug use; rather they are intended to make visible addiction which is typically hidden underground. Marijuana is a bit of an odd case as it is generally considered harmless; there's an argument it never should have been illegal in the first place.

</comment></comment><comment><USER17> this is one year old article?

</comment><comment><USER18> Marijuana use is widespread already. You can get passively high just by sitting outside one of the temples in himalayan india. Not too sure what this will change.

<comment><USER19> > Marijuana use is widespread already. You can get passively high just by > sitting outside one of the temples in himalayan india. Not too sure what > this will change.

You can say the same thing about large parts of the US, but that doesn't mean there aren't incredibly strong reasons to formally legalizing it.

</comment></comment><comment><USER20> Is this "legalization" or more like "decriminalization"?

<comment><USER21> Legalization.

> this bill aims to legalize and start regulated supply of traditional > intoxicants such as opium and marijuana (cannabis) as 'soft drugs' in India.

<comment><USER20> Thanks for answering. I read that line but wasn't entirely sure if "soft drug" meant full legal recreational or prescription only etc.

</comment></comment></comment><comment><USER22> This news is from 2016 though.

So what happened? Does anybody know?

<comment><USER23> Kind of curious about that myself. All I can find is that is was cleared to go before Parliament November 2016, and there hasn't been a news story I can find since.</comment></comment>


Programmer under oath admits computers rig elections - <AUTHOR> https://www.youtube.com/watch?v=1thcO_olHas&feature=youtube_gdata_player <comment><USER4> Don't trust computers for voting. Bits are easy to tamper with, specially when the populace doesn't know shit about computers (and rightfully so).

You can envision a system as complicated as you want, but it'll always have some sort of flaw because, well, bits are bits. I've had this discussion with many people and the same solutions arise again and again... but most are useless.

You could get the source code for the voting program... what if your compiler is backdoored? You could compile the compiler yourself, with which compiler? The backdoored one?

And even if the compiler is trustworthy... who's guaranteeing that the real binary is installed in the machine? You could download it in an USB drive and check yourself or get a hash from the machine but... how can you be sure the machine is reporting the binary that's actually running and not just a fake reply? Could you trust the reported MD5/downloaded binary from the machine?

Easy! - you say - You could upload the binary yourself to the machine! But how would you be sure you're running the uploaded binary and not a fake one?

And what if any of the machines inbetween are rigged?

Then cryptoguys come in: you could digitally sign your vote (forget secrecy) with a state-issued certificate (we have those in Spain with our NID). Maybe encrypt it so that only the far end could read it. You'd then check if your vote's been cast fine online. But how'd you be sure you got the real result?

Once the data left the machine you have to trust that everything's fine on the receiving end. What if the vote count just ignores votes and just does whatever it wants?

And the worst of all... how's your granny supposed to check it herself?

There are some advanced cryptographic techniques relevant to e-vote (some are quite clever) but even the best cryptographers will tell you: do not trust electronic voting!

My advice is: keep with pen and paper! It's easy to tamper with too, but more people know how it works and it's easy to see the inner workings compared to bits over the wire.

<comment><USER5> Mostly agree, but paper ballots are expensive to administer and count and we currently don't like to spend very much on our elections. Also, you still need a system for the disabled that ideally also preserves secrecy - not everyone can hold a pen.

<comment><USER4> I prefer trusted to cheap (and I certainly hope everyone else does). Of course the government prefers cheap, but it probably prefers tamperable too :P

Good call about the disabled. What are the current systems doing for them?

<comment><USER5> Secure, anonymous voting for the disabled is a big reason we have so many electronic voting machines. It was a big part of the Help America Votes Act. There are many vendors with solutions. The AutoMark is a popular one -- it can enlarge type or even read you the choices and let you make a selection by blowing in a tube.

There are many systems for the disabled -- it was a big priority of the Help America Votes Act, which is what prompted this wave of computerized voting machines. The Auto

</comment></comment></comment></comment><comment><USER6> I'm utterly opposed to electronic ballots. No touchcreens, no email voting, no internet voting. Elections with electronic ballots (records) cannot be audited. Nor can the voter's privacy be protected. [1]

That said, in my opinion, Clint Curtis is not a credible witness. What he claims is certainly plausible. But he doesn't have the technical chops to pull it off.

For something more reality-based, check out voteraction's lawsuit in New Mexico. <http://voteraction.org/legalaction>

VoterAction proved that Kerry won NM in 2004. What happened in NM certainly happened elsewhere. Especially Ohio, which had so much going on in so many directions, there's no way to summarize other than to say "death by a thousand cuts".

Briefly, in NM, spanish language touchscreens did not count votes cast for Kerry. Further, "faulty" storage devices (memory cards) were sent to back vendor HQ to be fixed, totally mooting the chain of custody, etc.

The whole election integrity thing is like a jumping down the rabbit hole. Things are so ridiculous, it's hard to believe. And when you try to explain to people what's happened, you're dismissed as a "sweaty paranoid kook" (that's a quote).

Speaking for myself, I used to think that I mail my ballot and it gets counted, what could be more simple? The more I learned, the more my confidence was shaken.

I could go on and on and on about this topic...

[1] Yes, I've studied the crypto proposals. They're included. Briefly, crypto schemes rely on a secure one-way hash to hide your ballot in the herd of ballots. Alas, US elections are administered per precincts (1-1000 voters) and typically have a dozen or more issues per ballots. Meaning combinatorially there's no way to hide an individual's ballot. Crypto works for simple ballots with thousands of voters.

<comment><USER7> In Russia, there are ballot boxes that automatically count ballots. No fancy technology here - they just scan ballot, detect mark position, and after the end of the election day these ballot boxes just print resulting report.

These ballot boxes are installed on some small percent of polling stations(like 5% or 10% - I don't remember the exact number). But statistical analysis shows that electoral fraud is commited considerably less often on such polling stations. I don't know, whether it is actually more difficult to cheat on such stations(at least there is a physical limitation - you can't put more than one ballot at a time, because it is needed to be scanned, - <USER2> opposed to normal ballot box where you can easily put 10-20 ballots at once), or whether they decided to install such automated boxes on polling stations where they had no intention to commit fraud. But my point is: 1) "Paper- voting" is no guarantee of fair elections. 2) Sometimes "hi-tech" may even help you, if you use it properly.

You make a fair point about electronic voting(and I wholeheartedly agree with you), but it looks like you overestimate the reliability of old-fashioned methods.

To summarize, I'm calling you "not-enough-paranoid kook". :)

<comment><USER6> I believe you're describing the mark sense style ballot scanners. Because you still have a paper ballot, they are not electronic ballots. (Apologies for not being more clear.)

<http://homepage.cs.uiowa.edu/~jones/voting/optical/>

I agree with your point, and only would add that the consensus among the election integrity experts is that poll-based ballot scanners which tally onsite immediately after the polls close are the most correct answer. This system has the lowest error rate. It is the easiest to audit (eg conduct a manual recount). Tampering with the results would be the most difficult (largest attack surface area).

The crucial trait of paper ballots cast and tabulated at poll sites is that such as system CAN be done correctly. Meaning enable the public vote count while ensuring the secret ballot. No electronic ballot system can make those guarantees, under any circumstances.

PS- I worked as a poll judge and poll inspector for a handful of elections. The jurisdiction where I reside had the same system as you described. It worked fabulously well. It was cheap. We've since moved to all postal ballots (vote by mail). Central count is a sausage factory. I fought against the transition, lost but was able to get some concessions, such as improved accounting (ballot processing) procedures.

</comment></comment></comment><comment><USER8> Neither the description nor the first few minutes of the video state what Court or tribunal or committee or whatever this testimony is for, nor when it is taking place, nor what other witnesses might have testified that contradicted this witness.

Without that context, this is pretty meaningless.

Several comments so far have discussed ways to improve voting. Good cryptographers have already solved this problem. See <http://scantegrity.org>

</comment><comment><USER9> I am Jack's complete lack of surprise.

I think a startup to fix voting would actually be a really cool (anyone here doing that already?), although I imagine it would be fraught with danger.

I think we need to step back to first principles here. In an ideal voting system, we need two properties:

1.) The vote must be anonymous (to remove the possibility of persecution) 2.) There has to be some way to detect if a vote has been tampered with.

Here's the thing... we can solve BOTH those problems with common cryptographic algorithms. Problem #1 can be solved with a hashed identity, problem #2 can be solved with a checksum.

Right now we try to solve that with a "paper trail". That's one solution, but it's very problematic. First, you're putting a lot of trust in the people doing the counting. Second, we can't trace those pieces of paper back to people to ask them "is this really who you voted for?"

I'm not claiming these are /easy/ problems to solve. There are a lot of considerations. But I will claim that we already have the required cryptographic toolset to make it possible, and that simple counting machines are entirely inadequate.

<comment><USER10> Paper ballots satisfy both of those properties. What problem are computerised ballots trying to solve? I've seen cost mentioned but haven't seen any evidence that it's cheaper. I imagine that it's mostly about getting the election results faster but is that really a goal of an election? Speed over accuracy?

<comment><USER11> You can get the speed of e-voting with paper ballots if you tally up the totals twice: once with a scanner when the ballot is put in the box (appropriate design of ballot and box required ofcourse), so you get immediate digital results, and once with manual counting to give the vote legal standing. The fact that only a manually counted result would have legal standing ensures nobody will see the point in tampering with the digital counter.

I would agree that there's no reason to have e-voting instead of paper ballots. The only possible excuse I might imagine for e-voting is that it lets people vote from home which enfranchises more voters, but that would just lead to a wave of vote selling so...

</comment></comment></comment><comment><USER12> What you need is memory that can't be rewritten that will show any tampering. Paper does this cheaply and easily.

</comment><comment><USER13> This wasn't news then, why is it news now?

Less is demanded of our voting system than of our ATM system. The irony is that it is the same system. People vote with their money every day. Western democracy is realized through the market system on a national level. Locally it is still in tact as a function of voting ballots and money.

Governance is largely about the use of limited resources and less about civil liberties. Civil liberties are largely a function of popular majority and politicians just reflect the popular opinion of the day.

<comment><USER5> Voting has radically different requirements than withdrawing money because of ballot secrecy.

</comment></comment><comment><USER14> I've had the following idea for a while and was wondering if anyone can point out the flaw:

Imagine a system where every individual has their own public/private key pair (backed by tying it to their SSN). You then have two SQL tables:

        CREATE TABLE voterVote (
            id           INT,
            category     VARCHAR(255),
            vote         VARCHAR(255),
            PRIMARY KEY (id,category)
        );

        CREATE TABLE voterVoteId (
            voter_id     INT PRIMARY KEY,
            voter_city   VARCHAR(255),
            vote_id      INT FOREIGN KEY REFERENCES voterVote(id)
        );

Both tables are published. The one thing I forgot to mention though is that the vote_id is encrypted with the users public key. This way any individual voter can check that his vote is what is should be and people on the whole can check that votes were tallied properly. Furthermore, we dont need to worry about hacking compilers, etc. because this can be done on the internet. The last thing we need to worry about is that the machine is lying to people when they go to check their vote. The only solution to this is to have the code which decrypts the persons row in the voterVoteId open source, but still since the protocol is open source and the data is open source, we can bet that there exists one honest person to build a tool to check. One more thing: how can we tell that extra rows werent added to VoterVote? We can check that the number of people in a city matches the number of keys issued to every person in that city (which again is backed by SSN).

This will probably fail miserably at something simple I've overlooked, but it was fun to dream up :)

<comment><USER15> Some people don't vote, you can't assume than if the number of votes is lower than the number of citizens then there was no fraud.

Furthermore, voters shouldn't be able to prove how they voted - <USER3> somebody could pay people who can prove having voted for him or threaten people who can't.

<comment><USER14> > voters shouldn't be able to prove how they voted

hmm, thats interesting. I never thought about that.

</comment></comment></comment><comment><USER16> That's a 2011 video. Did it change anything at all in last 2 years ?

<comment><USER17> I actually believe this testimony is from the mid 2000s (Tom Feeney was in congress from 2003-2009).

While in the video, Mr. Curtis has a point that voting code should be reviewed by independent experts... even if the code has been vetted there could be code injection through the operating system or compiler, however unlikely. And that's not even considering anything malicious with the network or databases. There's simply too many moving parts in electronic voting for it to ever ensure 100% honesty. Possibly making it law to require a hand count of all receipts/ballots to ensure a match would catch the fraud afterwards, when time is no longer such a factor. Or better yet, running paper ballots through two separate electronic voting systems by each voter and comparing counts.

But to answer your question, no I don't believe anything has been done.

</comment></comment><comment><USER18> For anybody who is interested in the concept of verifiable voting protocols, and a real life election applying them, I am currently working on the front end of such an application, with the election to be held in November 2014 for our state election.

We are working with academics in Surrey, UK, and elsewhere on the cryptography and verifiability of the election. So I can't answer any of the hard questions, but can point you at some of the documentation that Surrey has developed, shown below.

Using Pret a Voter in Victorian State elections <http://epubs.surrey.ac.uk/726039/1/EVT.pdf>

Software Design for VEC vVote System [http://www.computing.surrey.ac.uk/personal/st/S.Schneider/pa...](http://www.computing.surrey.ac.uk/personal/st/S.Schneider/papers/2013/SDSTechReport.pdf)

</comment><comment><USER19> Very simple solution to the problem:

When you vote, you get a piece of paper saying your name, your vote, voter-id, and the machine's salt.

Whenever a vote is counted, it is added to a public website of HASHES. Thus anybody can verify the totals.

If anybody's recorded vote on the website (taken by hashing their info) doesn't match their receipt, fraud is caught (thus removing votes or changing votes isn't possible). Also, if I didn't vote or am dead, and my info is entered, we can verify no tally appears for my hash.

If the hashes don't match up with all the registered voters via registration forms, then votes have been added. Thus in order to add fake votes, fake voter registration forms must be filled out manually [leaving a paper trail to catch the perpetrator].

<comment><USER20> "your name, your vote"

Then your boss threatens to fire you unless you give him/her a copy of this paper such that he/she can verify that you voted how he/she told you to.

</comment></comment><comment><USER21> Check out the other videos posted by 91177info on YouTube. A huge variety of paranoid fantasies mixed in with lots of half-truths. Their focus seems to be pro-Iran and anti-US and Israel propoganda.

Also it would be nice to know what the forum was where these statements were being made. Just because they are in a fancy looking room does not indicate it is actually meaningful that the statements are "under oath".

That said you can definitely rig almost any large scale election. There are just too many way to attack the process. In theory computers could help make elections more reliable but in practice they just add new and powerful ways to attack the process.

</comment><comment><USER22> Doesn't surprise me the least. Where money is, there is fraud, and where there is fraud, there is money. The US have plenty of both.

The problem is, how can we as programmers/IT field guys react when we are e.g. coerced into rigging systems?

<comment><USER23> _how can we as programmers/IT field guys react when we are e.g. coerced into rigging systems_

Refuse?

<comment><USER24> Forward the request to the nearest newspaper too.

<comment><USER25> I believe this is the kind of request that's usually delivered verbally only.

</comment></comment></comment></comment><comment><USER26> As soon as you use something you did not make yourself, your project could theoretically be compromised. This ranges from drivers, compilers, OSs, hardware, to the text editor you wrote anything and everything with. In the real world, we can protect things with a reasonable expectation of security. We can't exactly have a CCTV camera watch an incredibly small count of bits tamper with every other one in countless server closets and data centers, but we can have CCTV cameras watch an unscrupulous public servant write some extra ballots and put them in a box to be sent to DC (or wherever else).

</comment><comment><USER27> I get the feeling that this guy isn't trustworthy. He starts by saying that he was directly told to build software to fix the election. Then he says that he 'thought' he was told to see if it was possible to build software to fix the election, then finding out that he was supposed to actually build it.

</comment><comment><USER28> Can anyone tell me what are the precautions the election officers are taking so that this does not happen again?

I also saw Hacking Democracy[1] recently that shows about the 2004 elections.

[1] <http://en.wikipedia.org/wiki/Hacking_Democracy>

</comment><comment><USER29> Interesting individual. Wiki on Clint Curtis: <http://en.wikipedia.org/wiki/Clint_Curtis>.</comment>


Jeff Bezos Is Planning to Ship 'Several Metric Tons of Cargo' to the Moon - <AUTHOR> https://motherboard.vice.com/en_us/article/kzjppa/jeff-bezos-planning-to-ship-cargo-to-moon <comment><USER2> Prime delivery in the solar system.</comment>


The Computer, the Consumer and Privacy (1984) - <AUTHOR> http://www.nytimes.com/1984/03/04/weekinreview/the-computer-the-consumer-and-privacy.html

<comment><USER2> Reading historical articles like this is truly fascinating. Thanks!</comment>


Life of a Ticket - <AUTHOR> http://nerds.airbnb.com/life-of-a-ticket/

<comment><USER2> Oh, there is an article on HN saying how much shit of a company we are, should we address the problem, or do a puff piece? Let's do a puff piece, and pretend all is A-OK, those silly nerds won't notice!

The problem with this company is that their core proposition is putting lipstick on a pig. No matter how much PR they sling, the fact that they screw their hosts and guests is always gonna surface.

</comment><comment><USER3> I don't think it says good things about your company if you brag about your customer support directly after you let things fall through the cracks in the most atrocious manner, like that woman whose account was nuked with no explanation whatsoever.

[https://news.ycombinator.com/item?id=10090119](https://news.ycombinator.com/item?id=10090119)

<comment><USER2> FWIW, Kelly Kampen, despite the name, is and always has been a rather manly dude [https://www.youtube.com/watch?v=H-iHjWvhoek](https://www.youtube.com/watch?v=H-iHjWvhoek)

</comment></comment><comment><USER4> I've never experienced shittier customer service, but I guess it's cool how they can make a pretty article and exclaim "our shit tastes pretty good, doesn't it?".</comment>


Ask HN: How to short startups? - <AUTHOR> Say I have a hunch that a particular over-hyped, but not publically-traded startup, is destined for failure. How can I profit from this prediction? Creative answers welcome :) <comment><USER2> Simple, find somebody else that is willing to bet the take the opposite view point and is willing to wager money. Basically, you are referring to pink sheets and you could do it through some brokers but it is hard to find people to actually go through with it.

</comment><comment><USER3> There is an article about how to short uber [https://medium.com/@avishbhama/how-to-short-uber-and- other-p...](https://medium.com/@avishbhama/how-to-short-uber-and-other- private-companies-7754b8fb7de1)</comment>


Ask HN: Review my weekend project (my first coffee-script project) - <AUTHOR>

Basically it's a twitter for your belongings. It help people keep track of things they own and share the ownership online. Most importantly people can tweet, talk and have conversation with other people on things they own.
I built this on weekends during summer days last year. I haven't worked on this for quite a while, it's still unfinished, just a proof-of-concept prototype. Backend code is in Clojure, client-side code is in Coffee-script. Should I continue working on this?
URL: http://beta.holdership.com
Try it out freely! The site is in dev-mode, so it won't post anything to your Twitter.
UPDATE: I deleted the old post, because someone pointed out items he/she added didn't persist. I had a quick fix and posted again. <comment><USER2> I don't understand what the site does? And I don't intend of finding out when you want these permissions to my Twitter account:

      This application will be able to:
      Read Tweets from your timeline.
      See who you follow, and follow new people.
      Update your profile.
      Post Tweets for you.

<comment><AUTHOR> Thanks for pointing out the concern. Some permissions are not needed indeed, I'll change the twitter oauth settings. But my web app really doesn't do anything other than pulling in the basic user info though.

</comment></comment><comment><USER3> Well the site looks good but its hard to sell the idea.

</comment><comment><AUTHOR> clickable: <http://beta.holdership.com></comment>


Kubernetes Security – Best Practice Guide - <AUTHOR> https://github.com/freach/kubernetes-security-best-practice <comment><USER2> It would help a lot to have a _Why_ for each section. For example, why use a private topology? Why block access to the AWS Metadata API?

I'm not saying it's wrong to do those things, but it would help to prioritize changes if you can understand the severity of the security vulnerabilities you're exposed to.

<comment><USER3> This guide really has no audience. If you are responsible for a K8ts cluster you will need a depth of knowledge that requires knowing why. If you are using a hosted K8ts then you only need to know potential issues (why again). No one needs to know only what to do.

<comment><USER4> No need to turn it into a blackhat's roadmap.

Having anybody else being able to enumerate portions of your infrastructure is not good.

</comment></comment></comment><comment><USER5> From my experience of reviewing Kubernetes deployments for security here's where I'd _start_ on securing Kubernetes.

\- Make sure that all the management interfaces require authentication, including the Kubelet, etcd and API Server. some distributions don't do that consistently and from all perspectives. Whilst the API server generally is configured like this, I've seen setups where either etcd and/or the Kubelet are not and that's generally going to lead to compromise of the cluster.

\- Ensure that you've got RBAC turned on and/or stop service tokens being mounted into pods. Having a cluster-admin level token being mounted into pods by default is quite dangerous if an attacker can compromise any app. component running on your cluster.

\- Block access to metadata if your running in the cloud. For example, if you're running your k8s cluster on EC2 VMs any attacker who compromises one container, can use the metadata service to get the IAM token for the EC2 machine, which can be bad for your security :) this is likely to be done with Network Policy, so you can use that to do things like block access from the container network to the Node IP addresses as well.

\- Turn off unauthenticated information APIs like cAdvisor and the read-only kubelet port, if you don't need them.

\- Implement PodSecurityPolicy to reduce the risk of containers compromising the hosts

<comment><USER6> For EC2 Metadata, just use kube2iam or kiam. In a AWS-environment, it is pretty much guaranteed that some of your services will need to use it to get access to some other AWS service, and it will come in handy that time.

</comment></comment><comment><USER7> Some excellent talks on defense in depth with Kubernetes:

\- Hacking and hardening Kubernetes Clusters by Example by Brad Geesaman -> [https://www.youtube.com/watch?v=vTgQLzeBfRU](https://www.youtube.com/watch?v=vTgQLzeBfRU)

\- Shipping in Pirate-Infested Waters: Practical Attack and Defense in Kubernetes by Greg Castle -> [https://www.youtube.com/watch?v=ohTq0no0ZVU](https://www.youtube.com/watch?v=ohTq0no0ZVU)

</comment><comment><USER8> You recommend RBAC but then state that the k8s-dash starts with full permissions. That's not true at all when using RBAC. You need to define which namespaces, resources, etc get accessed. Right now with k8s if you deploy RBAC + k8s-dash (which is basically deprecated anyway) and don't set up its RBAC svc account you won't be able to view things in k8s without putting in your personal admin token because it would use the default service account which has no/very limited permissions.

Definitely suggest adding more RBAC examples to this. And things like ETCD w/SSL, etc.

<comment><USER9> If k8s-dash is deprecated, what's the replacement?

<comment><USER8> I may be wrong on that, or it's in flux. About 6 months ago in one of the changelogs or GKE blogs it was mentioned that the k8s-dash was being deprecated as GKE was launching its own proprietary dashboard (basically the GKE UI now). But sig-UI is still a thing so maybe that changed or I misread. Or it was more specific to GKE users, not entirely sure and having trouble tracking all that down now.. Sorry if misinforming anyone, hopefully a SIG member can chime in.

I don't believe I'm confusing this with kube-ui, which was deprecated for kube-dash.

[https://github.com/kubernetes/community/tree/master/sig- ui](https://github.com/kubernetes/community/tree/master/sig-ui)

</comment></comment></comment><comment><USER10> Another tool that can help here: [https://github.com/aquasecurity/kube- bench](https://github.com/aquasecurity/kube-bench)

<comment><USER11> This looks potentially very useful, thanks for sharing!

There appear to be several of these worth investigating. Ordered by highest to lowest apparent activity level and update frequency:

[https://github.com/aquasecurity/kube- bench](https://github.com/aquasecurity/kube-bench) (Go)

[https://github.com/neuvector/kubernetes-cis- benchmark](https://github.com/neuvector/kubernetes-cis-benchmark) (Bash)

[https://github.com/dev-sec/cis-kubernetes-benchmark](https://github.com/dev- sec/cis-kubernetes-benchmark) (Ruby)

</comment></comment><comment><USER5> If you're interested in Kubernetes security, I'd recommend looking at the CIS benchmark [https://www.cisecurity.org/benchmark/kubernetes/](https://www.cisecurity.org/benchmark/kubernetes/) which is relatively well maintained and has a lot of information about possible Kubernetes security configuration.

<comment><USER6> I've wondered if there is a k8s-native way to run this? Perhaps as a DaemonSet?

</comment></comment><comment><USER12> Best practice: don't roll your own Kubernetes cluster and use a distribution like OpenShift[1].

They take care of providing, among others, a secure default configuration.

[1]: [https://github.com/openshift/origin](https://github.com/openshift/origin)

<comment><USER13> It would be nice to know how OpenShift deviates from vanilla Kubernetes in terms of security and best practices. I used kubeadm to install my K8s PoC cluster and from what I've read it utilizes best practices for a "reasonably secure" installation. [https://kubernetes.io/docs/setup/independent/create- cluster-...](https://kubernetes.io/docs/setup/independent/create-cluster- kubeadm/)

<comment><USER14> Well first of all OpenShift enforces that no pods can run as root. That's a pretty big deviation from vanilla Kubernetes right out of the box.

<comment><USER6> I was wondering how they enforce it.

>OpenShift runs whichever container you want with a random UUID, so unless the Docker image is prepared to work as a non-root user, it probably won't work due to permissions issues.

Source: [https://engineering.bitnami.com/articles/running-non-root- co...](https://engineering.bitnami.com/articles/running-non-root-containers- on-openshift.html)

<comment><USER15> It's not quite random. Every namespace gets assigned a unique block of 10k UIDs and the default container UID is the first in the block for all unprivileged users. Granting access to a higher powered PSP (actually a security context constraint which was the basis for PSP) changes the defaulting.

</comment></comment></comment></comment></comment><comment><USER16> Basics are missing, e.g. don't run privileged containers, don't give all your pods cluster-admin rights, don't allow random hostpath mounting. (You would be surprised how much software couldn't run if this would really be enforced.)

</comment><comment><USER17> Have you seen CIS Kubernetes Benchmark? It has 100+ security check points.

<comment><AUTHOR> Learned about them this morning, it covers almost all of my findings and more. Thanks for sharing!

</comment></comment><comment><USER18> Security guide is for RHEL6? Nobody is actually running K8s on RHEL6 without systemd, are they? Are they?!?!

<comment><USER19> Hahaha, I actually do run production Kubernetes clusters at work on CentOS 6 so I noticed that too. I suspect they're just posting a general Linux security guide rather than specifically targeting RHEL6 because running Kubernetes on CentOS 6 is really an uphill battle and I can't imagine that many other people embark on that journey.

It's entertaining that you singled out systemd as the thing that makes it difficult to run Kubernetes on CentOS 6, the init system is by far the easiest part haha. In a standard Kubernetes deployment, the only daemons you really need to have running are dockerd and kubelet, you could feasibly run it without an init system at all, especially now with cri-o. What makes you consider systemd to be important on kubernetes nodes? (FYI: I actually really like systemd, so this isn't a jab at it, I'm just curious)

For a taste of the battle:

\- It ships with Kernel 2.6 which is pretty unacceptable in the container world:

\-- Supports only a subset of modern namespaces and cgroup controllers

\-- Has terrible bugs like containers getting OOM-killed due to the kernel not flushing buffers/cache to disk when the cgroup is running out of memory.

\-- It doesn't have overlay2 support and aufs dropped support in 2012.

\-- We've been running custom kernels since long before we adopted Kubernetes, so this wasn't a hurdle for us. We currently run a mainline kernel 4.9 with many patches. That said, there are yum repos out there for modern kernels.

\- Docker stopped supporting CentOS 6 long ago at version 1.7. That said, they didn't kill off the CentOS 6 build support until the beginning of the moby split in 1.13 so if you were running a custom kernel and an updated iptables beyond 1.4, everything worked. We run 17.06 now, which was much more painful to get building.

\- Need to build and upgrade util-linux, e2fsprogs, iproute2, libseccomp, and probably a few others.

So once you've done all that, an init script is the least of your problems lol. CentOS 6 also ships both sysvinit and upstart, so you could write an upstart config instead and get similar enough behavior to systemd.

<comment><USER18> Seems like a lot of hoops to have to jump through! Thankfully I managed to avoid having to go through all of these trials by being turned off that it didn't have systemd. Your response makes me glad that my unwarranted dislike for other init systems kept me from going down that path, though.

Thanks for the response, and hats off to you for making lemonade in that situation.

</comment></comment></comment><comment><USER20> Shameless plug: Try Rancher 2.0 (beta announced today and GA coming in a month). With Rancher we enable all the security stuff by default but try to actually make it usable (which is quite hard). So RBAC, PSPs, network policy is all on by default. We give you quite a bit of tools to manage RBAC and PSP.

If you are managing you're own cluster you really need a guide like this. It's very easy to create a very insecure cluster. People are actively targeting poorly configured k8s clusters too. It doesn't take to long before you start mining Bitcoin :)

</comment><comment><USER21> The main kubernetes docs have a good section on this as well.

[https://kubernetes.io/docs/tasks/administer- cluster/securing...](https://kubernetes.io/docs/tasks/administer- cluster/securing-a-cluster/)

</comment><comment><USER22> Not included, but I would like to see how to inject secrets when running an image.

<comment><USER23> Kubernetes has great built-in support for injecting secrets as either environment variables (like API keys) or volume mounts (for things like certs). You can configure them to be encrypted at rest as well.

[https://kubernetes.io/docs/concepts/configuration/secret/](https://kubernetes.io/docs/concepts/configuration/secret/)

[https://kubernetes.io/docs/tasks/administer- cluster/encrypt-...](https://kubernetes.io/docs/tasks/administer- cluster/encrypt-data/)

<comment><USER5> one thing to watch there is that you have to be using a relatively recent version (1.9+ IIRC) to get encrypted at rest for secrets in base Kubernetes</comment></comment></comment>