TPM–Fail: TPM Meets Timing and Lattice Attacks - <AUTHOR> http://tpm.fail/ <comment><USER2> I think Paul Kocher first published about timing attacks in 1996 ([https://dl.acm.org/citation.cfm?id=706156](https://dl.acm.org/citation.cfm?id=706156)). The fact that industry giants not only sold them, but got them certified says a lot about how much assurance CC and FIPS evaluation buys you...

</comment><comment><USER3> In my view this is some kind of argument as for why you should not (ab)use TPM as general purpose HSM (ie. for something that it is not designed for) and it does not say much about the security when it is used correctly (as a local attacker that has TPM in state where it will sign literally anything I throw at it, what exactly does key recovery attack buy me?)

<comment><USER4> Not sure why you'd say it's not designed for this. They call out the fact that it was specifically certified for such use and to be resistant to such attacks.

</comment></comment><comment><USER5> To me this sounds like exactly the same as Minerva [1][2] but in TPM instead of in smart card.

1 - [https://minerva.crocs.fi.muni.cz/](https://minerva.crocs.fi.muni.cz/)

2 - [https://news.ycombinator.com/item?id=21147865](https://news.ycombinator.com/item?id=21147865)

</comment><comment><USER6> Does this allow users to install custom OSs on devices with verified boot chains like game consoles and phones?

<comment><USER7> If I'm reading this correctly, it means the private key of a certificate is leaked during generation. Boot chains rely on the verification of certificates and signed data, not signing. So no.

<comment><USER6> So this lets you grab the key on your own device which is used to encrypt the storage but not the OEM key used to sign the firmware image?

<comment><USER8> Almost. s/encrypt the storage/sign the remote attestation document/.

Storage would be encrypted with a symmetric AES key, this only leaks asymmetric ECDSA signing keys

</comment></comment></comment></comment><comment><USER9> The PoC mentioned in the ZDNet article ([https://www.zdnet.com/article/tpm- fail-vulnerabilities-impac...](https://www.zdnet.com/article/tpm-fail- vulnerabilities-impact-tpm-chips-in-desktops-laptops-servers/)) seems to be out...

[https://github.com/VernamGroup/TPM-Fail/](https://github.com/VernamGroup/TPM- Fail/)

<comment><USER10> That code is nonsense. It's a perl script that messes around with cowsay and does not make a single tpm command.

<comment><USER11> Yeah, that code is a hoax. The code isn't available yet, but when it is it will be here:

[https://github.com/VernamLab/TPM-Fail](https://github.com/VernamLab/TPM-Fail)

</comment></comment></comment><comment><USER12> Is there a good reason for a security conscious hi value target shop to use VMs or docker when they don't control the whole box?

<comment><USER13> That depends on what you are protecting, but in general if you are high-value enough that it's worth it for somebody to try to attack you through VM instances sharing the physical machine, you should be managing your own hardware and using physical HSM's to protect keys.

</comment></comment><comment><USER14> The link to the paper[1] is a 404. Did anyone manage to grab a copy of the paper? I haven't thought about lattices since gradschool crypto classes, and was excited to see if I could comprehend anything after 10 years. :(

[1]: [http://tpm.fail/TPM-FAIL.pdf](http://tpm.fail/TPM-FAIL.pdf)

<comment><USER11> It appears to be here now: [http://tpm.fail/tpmfail.pdf](http://tpm.fail/tpmfail.pdf)

<comment><USER14> Thanks!

</comment></comment></comment><comment><USER15> Are there many uses of signing with a TPM on consumer hardware? I can see the issue with servers, but not much else.

<comment><USER2> [https://docs.microsoft.com/en- us/windows/security/informatio...](https://docs.microsoft.com/en- us/windows/security/information-protection/tpm/how-windows-uses-the-tpm)

It's used to store th private key of user certificates, but those are PIN protected presumably. But a key that isn't supposed to be extractible may well be so.

</comment></comment><comment><USER16> I have not read the paper, and I could be wrong. However, these appear to be attacks against the crypto implemented inside a TPM/fTPM.

The reference implementation of TPM 2.0 leaves the choice of the crypto library up to the platform vendor. If my suspicions are correct, it sounds like some of the platform vendors decided to use crypto libraries vulnerable to timing attacks. Hmmm...

<comment><USER17> If you look at IBM's TPM 2.0 implementation[1], you can see that they don't use any well tested libraries for crypto primitives, but rather uses what looks like home-cooked crypto implementation.

Microsoft, on the other hand, seems to support OpenSSL and wolfSSL in their simulator[2].

[1] - [http://ibmswtpm.sourceforge.net/ibmswtpm2.html](http://ibmswtpm.sourceforge.net/ibmswtpm2.html) [2] - [https://github.com/microsoft/ms- tpm-20-ref](https://github.com/microsoft/ms-tpm-20-ref)

<comment><USER5> You're not supposed to use the IBM TPM emulator for anything except developing software that talks to a real TPM without using a real TPM.

<comment><USER17> Sure, but what exactly do you think real TPM manufacturers are putting inside them? They must run some crypto code, do you think they won't just reuse IBMs emulator? Or that they will come up with something more secure?

<comment><USER5> I hope that's what happens, yes.</comment></comment></comment></comment></comment>


Hacked vs. Hacker: Game on (NYT) - <AUTHOR> http://bits.blogs.nytimes.com/2014/12/02/hacked-vs-hackers-game-on/?ref=technology&hp&action=click&pgtype=Homepage&module=second-column-region&region=top-news&WT.nav=top-news

<comment><AUTHOR> Are there any laws actually governing what disclosures need to happen if an otherwise non-regulated company loses my data? (meaning not a bank or healthcare)</comment>


Ask HN: How to move up in the career ladder at FAANG? - <AUTHOR> This is a serious question. I work at FAANG. It seems that people who joined circa 2011-13 never left and are now in power positions (sr. management and VPs).
It is incredibly hard to move up at FAANG. Uber is hitting me up, but I am not sure about them.<p>1) How to get better at politics and career management to move up?
2) How to make million dollars? I am on visa, so second job/startup is not an option. <comment><USER2> 1\. Invent a time machine. 2\. Go back in time. 3\. Profit!

Otherwise, you've got some hard work ahead of you.

And by the time you make your first million dollars, if you're still working at FAANG, you may find that is no longer enough.

</comment><comment> BA4gDY-cqjsEPWn IMHO, you (and me) were late for the party. Push for the green card to have more options.</comment>


Ask HN: Sales or Inbound Marketing? - <AUTHOR>

I've got to a stage with Concept Cupboard, an online marketplace connecting biz with student and graduate creative freelancers, where we've had moderate traction so far but I'm really looking to ramp up our business development efforts now.
Based on what we do (check out the site at http://www.conceptcupboard.com), do you think a concerted sales or inbound marketing effort will work better to generate more registrations and subsequently conversions to live creative briefs?
All responses welcome and I look forward to hearing your thoughts. <comment><USER2> Depends what you mean by "concerted sales" versus inbound marketing. Inbound marketing has a sales component.

If you want to know more about inbound marketing, check out Hubspot. They coined the term "inbound marketing". Hubspot is pretty pricey but their software handles all aspects of web marketing from getting visitors, to leads to customers (I.e. they're cheap if they do what's promised). They provide intensive training on all topics too, so there's the maximum chance you'll be following recommended, proven practices rather than wondering how to construct campaigns, landing pages, email marketing campaigns etc.

My email's in my profile if you want to know more.

Btw this probably isn't the best time of day to post this on hn, do a few google searches like "best time to post on hacker news" to figure that one out.

<comment><AUTHOR> Thanks for the reply. I've heard of HubSpot and read their blog frequently. I've got some experience in inbound marketing but was looking to see see if it would be better to get on the phone calling up leads all day rather than writing blog posts, email marketing etc for Concept Cupboard.

</comment></comment><comment><USER3> I'm looking at your website and I'm trying to imagine what a "sales team" would do with it. Here's a good litmus test - seek out a sales professional in your area, pitch him or her on your idea of what you think a sales person would/could do, and get their feedback. You shouldn't have that much trouble finding someone - networking groups, friends, etc should be able to put you in front of a really good salesperson. I think you'll learn a lot by (a) having to come up with a pitch that is focused on selling the idea of bringing a sales person on board, and then (b) I think you'd learn a lot from the feedback the person gives you. It's a no-lose situation for you.

I would think that, because this will be a one-sided benefit (your team will benefit from this meeting but the sales person will not), you should keep it brief and buy them lunch/dinner/drinks. Asking someone to listen to and respond to a 30-minute pitch is a LOT, particularly if they are getting no direct benefit from it. Maybe keep it to 10 minutes with Q&A.

Things you'd want in the pitch:

* The idea

* What you've done so far

* Who is using it

* Why you need a sales team

* How the sales team changes things

* Commission plan

* How much of an opportunity there is for them (inc. any equity you are offering)

* 1yr, 2yr, and 5yr projections on both sales and the size of the sales team

</comment><comment><USER4> My first impression is that you are similar to 99designs. I believe you will be better off with an inbound marketing effort with proper targeting. Sales is resource and effort intensive. Lack of early results may be more demoralizing than inbound marketing.</comment>


Spaces or Tabs? - <AUTHOR>

Do you use real tabs or spaces for tabs when you write code?  If spaces, how many? <comment><USER2> Tabs. It drives me nuts to see people use spaces for everything.

Tabs are there for exactly that purpose. If you want your code to line up properly, just comment on how wide your tabwidth is, and the reader of the code will adjust accordingly. Or indent in a tab-independent fashion.

I like my tabwidth set to 3 or 4. It makes code easier to read for myself. I can't stand it when I open a GNU project and it looks like someone threw up brackets all over my screen. This wouldn't happen if GNU didn't use an awkward mix of previously-assumed-8-spaces-wide tabs and spaces to indent their code.

<comment><AUTHOR> I started this out of a spirited conversation between my boss and I. We've been using tabs for years; the argument being that anyone can adjust their tab width to whatever they prefer. As Daniel said, in theory this works but in reality it never allowed for circumstances where you'd need to indent something an odd (or if your tabwidth was odd, even) number of spaces. For example, check out Google's style guide for C++: [http://google- styleguide.googlecode.com/svn/trunk/cppguide.x...](http://google- styleguide.googlecode.com/svn/trunk/cppguide.xml?showone=Function_Calls#Function_Calls) You can't format those function arguments like that using tabs. This kind of granularity is essential, especially working in a team environment.

<comment><USER2> For lining up arguments like that, (esp with long objc calls), I use spaces after indenting to the level the code is indented. For instance,

      [\t]int val = 0;
      [\t]callSomeFunction(someOtherVal,
      [\t].................val);

Anywho, it's a religious argument with no right answers. I was just justifying my preference.

<comment><USER3> I prefer the same but it's a pain to line it up manually like this. I usually settle for vim's = operator, but that has the frustrating behavior of using as many tabs as possible (according to your tabstop) until using a few spaces. I can't find any way to change this; anyone know of a vim plugin to circumvent it?

</comment></comment></comment></comment><comment><USER4> Tabs...though in a way I don't think code files should have any whitespace in them; in my ideal world the disk file would be packed and the programmer's editor would use your preferred code beautification, just like syntax highlighting. Obviously that would be a hassle if you didn't use a contextual editor but I question the ongoing importance of that option.

</comment><comment><USER5> Four spaces except html/css where I use two.

</comment><comment><USER6> I'd like to use tabs, unfortunately pythons 'significant whitespace' mess makes me have to use spaces instead. To make sure I stay clean I've configured things such that I can actually see the spaces.

Especially with cutting and pasting sample code this is a total pain.

The interesting part is that many samples in python tutorials have their spacing messed up so that the samples don't work the way they're intended.

Python is a great little language, but this really keeps tripping me up.

</comment><comment><USER7> Spaces. 4.

</comment><comment><USER8> python 4 spaces

anything else (php, c++, html, etc.) tabs

</comment><comment><USER9> 4 spaces in python otherwise tab

</comment><comment><USER10> Tabs</comment>


Monks Who Play Punk (2007) - <AUTHOR> http://www.nytimes.com/2007/04/22/nyregion/thecity/22monk.html <comment><USER2> Regarding music in religion, kirtan [1] even for non-Hindus can be really enjoyable and powerful experience (most non-religious people I've met regard it more as a meditation than prayer).

[1] kirtan is a call-and-response style song or chant, set to music, wherein multiple singers recite or describe a legend, or express loving devotion to a deity, or discuss spiritual ideas. It may include dancing or direct expression of bhavas (emotive states) by the singer. Many kirtan performances are structured to engage the audience where they either repeat the chant, or reply to the call of the singer.

[https://en.m.wikipedia.org/wiki/Kirtan](https://en.m.wikipedia.org/wiki/Kirtan)

<comment><USER3> Here's one such beautiful Kirtan: [https://www.youtube.com/watch?v=dpRL0FNAcL8](https://www.youtube.com/watch?v=dpRL0FNAcL8)

<comment><USER2> Great, thank you! I forgot about Om Swami, glad to have been reminded about them.

</comment></comment></comment><comment><USER4> At first I thought this was gonna be about the "Paparokades" (priest-rockers).

Around the same time, in Greece there was a band of monks that played some semi decent rock with motivational and conspiracy theory-ish lyrics [1]. It was at the time when the "Metal music makes you a satanist" fad had arrived in Greece, and the whole ordeal was for some part of the population scandalous, and for the other part, hilarious.

[1] [https://www.youtube.com/watch?v=stuFRRkRhg4](https://www.youtube.com/watch?v=stuFRRkRhg4)

</comment><comment><USER5> Another interesting one that came up recently was a Catholic priest in Kenya who raps.

However, he ended up being suspended from leading mass: [https://www.bbc.com/news/world- africa-44601638](https://www.bbc.com/news/world-africa-44601638)

The article doesn't go into a whole lot of detail, but I'm under the impression that the problem was that his rapping was separate to his liturgical work.

<comment><USER6> Similarly interesting is a fairly recent Polish black metal band that incorporates Catholic hymns/chants in their music. Although in this case I think it's likely done in irony, or with sacriligeous intent.

[https://youtu.be/B7av_o99Pwg?t=238](https://youtu.be/B7av_o99Pwg?t=238)

<comment><USER7> Orthodox, not Catholic. But yeah, Batushka is awesome.

Then there's Reverorum ib Malacht, the Black metal band who studied Catholicism so intently in order to make even more evil, sacreligious music, that they actually ended up converting.

[http://www.invisibleoranges.com/reverorum-ib-malacht- intervi...](http://www.invisibleoranges.com/reverorum-ib-malacht-interview/)

</comment></comment></comment><comment><USER8> Some of the reggae music is also very "religious" to the point where lyrics are quotes from bible or straight up Psalms with little bit of rewording. Specifically "Uk roots" Soundsystem scene could be attributed to be very close to Rastafari worshipping due to lyrics of the songs, chanting of mc and how music is played which sets the tone of the dance. Of course a lot of people are just in to it for the vibes but it's still really hard to not make a comparison.

</comment><comment><USER7> Reading the headline, I expected this to be about Death to the World, a zine put out by former punks (and a founding member of Sleep) in an Orthodox monastic order.

[http://deathtotheworld.com/about/](http://deathtotheworld.com/about/)

</comment><comment><USER9> I thought this would be about the Hare-Krishna movement in 90s hardcore punk.

Might be interesting for someone here: [https://en.wikipedia.org/wiki/Krishnacore](https://en.wikipedia.org/wiki/Krishnacore)

</comment><comment><USER10> One of my friends is an Eastern Orthodox rapper: [https://royalruckus.bandcamp.com/](https://royalruckus.bandcamp.com/)</comment>


Stop Reading "Clients from Hell" - <AUTHOR> http://numerosign.com/notebook/stop-reading-clients-from-hell

<comment><USER2> First off, by all means, keep reading "clients from hell". If you're just starting out, it's a great way to figure out what the red flags are when dealing with prospects. If you've been going at it for a while, it's a massive stress release to see that _it's not just you_.

That being said, whenever I get into discussing this, I tell about how I went to my hairdresser (a fairly outspoken man) a while back, and while he was cutting away, I asked if he could cut it a little more in the back. He replied simply with 'no' (later explaining it). I accepted that in the instant, recognizing the parallel, yet most people (web developers and non-web developers alike) think I should've forced him to cut it as I asked. Some even get angry when I suggest that my hairdresser could do anything he want (within my given requirements), because I am paying him for his expertise. Their reasoning is that because I pay them, they should do anything I tell them to. I suspect therein lies the difference between bad clients and good clients.

<comment><USER3> Well, he could have explained it differently, no? I personally would prefer (and use myself) "I can if you like, but the problem will be..."

</comment></comment><comment><USER4> I'll keep reading it.

Most of the quotes on CFH aren't simple "I want Papyrus font" snark, they're unusual scenarios where clients weasel out of paying or have ludicrous paranoia about hidden messages etc. They're not stories of typical 'roll your eyes' font choice requests, thats why its funny and popular.

</comment><comment><USER5> The writer seems to think that Clients From Hell is a little mean and unhelpful because most clients are merely ignorant of Web design issues.

That's true, but it misses the real pain behind the stories. That is, that most Web designers don't get the respect or autonomy they deserve (or, perhaps, they don't _command_ it.) If I get a plumber round to fix something, I'm not going to tell them what parts to use, what brand of pipes I like, or insist on them using outdated concepts. I trust them to do the work. Most people are that way.

With Web designers (and designers in general, really), people think that since they can see the surface of the finished product, they have as much insight into what works visually as the designer does. This is not true and this ignorance is very hard to work around. There are some good clients out there, but the "bad" ones are just worth ditching IMHO.

<comment><USER6> Plumbers and designers aren't working with even remotely the same constraints. The fact is, Papyrus and Copperplate move bingo card software, kobe burgers, and designer handbags _just fine_. Many normal people even find those designs attractive.

<comment><USER7> Exactly. It all reminds me of the bit where the designer tells American Airlines or Zappos they're idiots, and the company tries to explain that their design is made to move shoes or airline tickets, not win design awards.

<comment><USER8> FWIW, the guy who criticized Zappos is the same person who put up Clients From Hell.

</comment></comment></comment></comment><comment><USER6> My favorite part of this post: even the designer who is trying _so_. _hard_. to empathize with "ignorant" customers still managed to suggest inflicting hundreds of dollars of font licensing costs on the project (go price Mariposa). But hey! At least you're not yet another website using Papyrus.

<comment><USER9> Perhaps we need a "designers from hell". I'd put somewhere up there: typography geek who insists on paying absurd sums for typefaces because they're so _amazing_. But at least "insists on making your whole site in Flash" seems to be on its way out.

<comment><USER6> We just shelled out something sick for FF DIN for our website, because that's what our designers spec'd. I'm not upset about it, because I'm a type geek, but I'm not kidding myself that _any_ of my customers can tell it from Arial.

<comment><USER10> (slightly OT) I was under the impression the DIN was public domain?

<comment><USER6> There's an "open DIN", but FontFont's DIN sure as hell isn't public domain.

</comment></comment></comment></comment></comment><comment><USER11> "and not only that but a tendency to overreact to a client's innocent requests or questions. Knock it off."

Maybe some of the CFH posts are overreactions, but I see way more posts that aren't. For example, "Next time we meet, you might wear something a little more low cut. We'll get more done." I don't think that it is an overreaction to call that a bad client. Complaining about fonts, white space, etc actually seems to be the minority on CFH. Most posts now seem to be utterly absurd examples, like the one I quoted above, or billing disputes.

The writer could have done a nice post reminding designers to be patient with clients lacking design knowledge without even mentioning CFH.

<comment><USER12> But then he wouldn't have made Hacker News.

</comment></comment><comment><USER13> It seems that most of the people replying are "Designers From Hell"

As a techie, I understand the frustration behind web designers not commanding the amount of respect they truly deserve.

But, I agree 100% with this post. The author's very right.

There are many things that can be done to get more respect. Making fun of 'clients' behind their back is not only low, it also does absolutely nothing to better the situation. If anything, it makes it slightly worse.

<comment><USER14> 4 of the 10 posts on the main page are about being ripped off. People see TV and movies and think it works like that in real life, I don't think its a problem you can fix. Having a little site to see other people facing the same issues is nice.

</comment></comment><comment><USER15> Fonts are overrated. As long as the message comes across and it doesn't cause acute eye-strain I think that the only people that really can get upset about fonts are designers.

I've never had an end user complain about any font, but I remember two designers arguing for days on end which font (visually next to indistinguishable) we should use.

It's worse than programmers arguing about editors.

<comment><USER16> I think design in general is overrated. Sure it adds value, but it's rarely pivotal to the success of a project. Take Google for example. Its logo is mediocre. It's the software that adds most of the value.

<comment><USER17> I don't think so. Google's UI is actually a well designed one,the Google's brand too. By design here you're meaning fancy graphics.

<comment><USER16> Yes, you're right. I need to clarify what I meant. Usability can make or break a product; I'm talking about aesthetics.

I'm also talking about designers who are unable to differentiate between (1) the business value of their work and (2) the aesthetic value and artistic skill that it demonstrates.

</comment></comment></comment></comment><comment><USER18> I don't get it. The plumbers and electricians and other such people don't behave any different. Go to your nearest "working mans bar" or union hall or whatnot. You'll hear those guys joking about the same crap, the "diy"ers, and so on. It doesn't happen on a web page, but you can bet when they aren't face- to-face with the customer, they are mocking him.

</comment><comment><USER19> While I agree with the article itself, some clients I had a misfortune to work with, really are from hell. Especially the sort that comes up with criminally bad UI rules and even after I spent days trying to explain why that would be detriment to their business, they keep insisting on it. So I build it and after 6 months they come back "GA tracking shows up that our registration process is completed in less than 10% of cases. This is really low, you need to do something". Yes, I do, I can yank all the shit stuff you made me put there in the first place.

These kind of clients go hand in hand with <http://managersfromhell.com/> which have no idea how to stop them doing that crap from happening.</comment>


Cool URIs Don't Change - <AUTHOR> http://www.w3.org/Provider/Style/uri

<comment><USER2> It's a bit ironic that the link you refer to is actually broken. Thankfully the site suggests a viable alternate url (by adding a file extension), but pretty funny in context of the content.</comment>


Ask HN: How to get comfortable on the OS X command line? - <AUTHOR>

I'm very comfortable on the command line on debian-based distros but when ever I get on the terminal in OS X, things are just not in the right place or I'm not able to do what I want.
Is this because I'm not familiar with BSD Unix or has Apple moved things around?
What are the best resources for learning the OS X flavor of Unix, coming from the perspective of having good Linux knowledge?
Edit:
The motivation behind these questions is that I need to decide what my next dev machine will be: some pc laptop with linux or a macbook with darwin. Either way, I need a workable command line as I spend probably 50% of my time there. <comment><USER2> I have the exact opposite sense of discomfort. I started with System V and BSD 4.3 around the same time, then Solaris and FreeBSD, then OS X. Throughout this, Linux always felt "out in left field". If you look at the UNIX family tree, you'll see why each makes the other feel a little disconnected:

<http://en.wikipedia.org/wiki/File:Unix_history-simple.svg>

<comment><AUTHOR> So in your opinion OS X is _pretty close_ to BSD? What stuff did they change?

<comment><USER2> My comment and link shows Linux is not shared heritage UNIX, it's its own line, not a branch on the tree. I wasn't talking about BSD 4.3 versus OS X.

But if your comment is sincere:

[http://www.bsdatwork.com/2004/08/11/differentiating_among_bs...](http://www.bsdatwork.com/2004/08/11/differentiating_among_bsd_distros/)

As for the OP, this is a nice "BSD for Linux Users" piece:

"BSD is what you get when a bunch of Unix hackers sit down to try to port a Unix system to the PC. Linux is what you get when a bunch of PC hackers sit down and try to write a Unix system for the PC."

<http://www.over-yonder.net/~fullermd/rants/bsd4linux/02>

</comment></comment></comment><comment><USER3> What things are you looking for that aren't where you expect them to be? And where did you expect them to be?

<comment><AUTHOR> Those are great questions which I don't have exact answers for because I've spent the last year exclusively on Linux and all the exact OS X problems are flushed from my brain.

I think I was working with Apache at the time, so I probably had trouble starting and stopping (looking in non-existent /etc/init.d). Also, just browsing '/', I remember stumbling upon /sw which is perhaps a darwin thing? Is it like /opt?

<comment><USER4> /sw is somewhat like /opt, it's usually used by the package management system Fink. You shouldn't need to manipulate any of the files directly.

<http://www.finkproject.org/>

<comment><USER3> That would explain why I couldn't find it on my machine. I use macports, which puts its stuff in /opt.

</comment></comment></comment></comment><comment><USER5> Partially because there is some BSD to it. A lot because apple has moved things around. I found it really weird at first. I just had learn the basics and then time made it simpler.

<comment><AUTHOR> Did you ever find that Apple crippled certain programs or services, or simply just move things around?

<comment><USER5> moved around? yes. crippled? nothing that i came across.

why? have you found things that seem crippled?</comment></comment></comment>


How do you feel about the new Bloomberg? I hate it - <AUTHOR> http://www.bloomberg.com/

<comment><AUTHOR> Also this. [http://www.awwwards.com/web-design-awards/bloomberg- business](http://www.awwwards.com/web-design-awards/bloomberg-business)

</comment><comment><USER2> It just made me sick. Didn't even bother reading.

<comment><AUTHOR> Right? What are they thinking?! I saw it on awwwards and thought it was a joke.</comment></comment>


The Post Correspondence Programming Language: Domino-Oriented Programming - <AUTHOR> https://davidlazar.github.io/PCPL/ <comment><USER2> I was terribly confused because I thought this was referring to Post's Correspondence Principle: [http://citeseerx.ist.psu.edu/viewdoc/summary?doi=10.1.1.380....](http://citeseerx.ist.psu.edu/viewdoc/summary?doi=10.1.1.380.85)

This concerns instead the Post Correspondence Problem: [https://en.wikipedia.org/wiki/Post_correspondence_problem](https://en.wikipedia.org/wiki/Post_correspondence_problem)

Surprising namespace clash!

</comment><comment><USER3> If you find this interesting, take a look at FRACTRAN[1].

[1] [https://en.wikipedia.org/wiki/FRACTRAN](https://en.wikipedia.org/wiki/FRACTRAN)

</comment><comment><USER4> What are the practical implications and applications of this?

<comment><USER5> It shows that there are some problems (eg PCP), that are literally impossible to solve for every case. If you were able to come up with an algorithm that could do so, you would've found a solution to the halting problem, which we know is impossible. Other than that, it's just some person having fun compiling between two different esoteric programming languages.</comment></comment>


Creating a Free VPN Using Google Cloud Platform - <AUTHOR> https://blog.sei.sh/creating-a-free-vpn-using-google-cloud <comment><USER2> These are instructions for installing OpenVPN. Use algo to setup ipsec & WireGuard instead. Algo supports GCE among other providers. By using ipsec, you don't need to install anything extra on most clients. By using WireGuard, you have a state-of-the-art VPN.

[https://github.com/trailofbits/algo](https://github.com/trailofbits/algo)

</comment><comment><USER3> Only problem I see here is that the free tier of GCP limits you to "1 GB network egress" per month. How long before you run through that? (Not long, I think.)

[https://cloud.google.com/free/](https://cloud.google.com/free/)</comment>


How Ad Retargeting Ruined Christmas - <AUTHOR> http://marketingland.com/how-ad-retargeting-ruined-christmas-68708? <comment><USER2> I run a retargeting company and this annoys me too!

The reason this stuff happens is because many players in the space soak up advertiser spend by not immediately opting users out of product retargeting campaigns after a purchase is made. The advertisers don't always know to ask for this and the retargeting companies make more money if they don't suggest it.

These personalized campaigns are so profitable for the advertisers that they don't notice the extra spend being bled out on people who they shouldn't be retargeting.

This tends to happen among the big "enterprise" retargeting companies that serve large online retailers like Macy's. There's so many people involved in the deals and operations of the campaigns that no one person is there to say, hey, let's make sure this doesn't happen.

The takeaway: Only work with retargeting vendors that give you control and visibility into who you're targeting and why! We do this, but so do others. Not everyone is this lame.

</comment><comment><USER3> Wow... so the publicly-advertised use of Incognito Mode of shopping for Christmas presents...

...turns out to be true. It's not just for porn after all.

<comment><USER4> Incognito mode doesn't escape retargeting, at least for adwords / doubleclick. I work in the space and it's truly a pain to see the 'natural' ads.

<comment><USER5> What about multiple "users" in Chrome? If you go to the settings page, you can add additional "users" and then open a window as another "user" using the icon in the upper right corner.

Each user gets their own profile: cache, cookies, history, saved data, extensions, etc. The only thing shared should be IP address and user agent. (Unless the user infects the profile with a url that identifies them.)

I use this for testing, isolating my facebook profile, and isolating all of my banking sessions from my main browsing window. (Just in case they have a CSRF issue.)

<comment><USER6> You can do the same thing with Firefox if you pass the -ProfileManager argument. This functionality goes back all the way to Netscape: [http://www.netfaqs.com/macintosh/mail/Classic/Netscape/4/pro...](http://www.netfaqs.com/macintosh/mail/Classic/Netscape/4/profiles/index.asp)

It's just been hidden (and there's no need to set up email).

</comment></comment></comment></comment><comment><USER7> So, retargeting is the process of focusing all advertising efforts on selling you something that you've already bought?

Marketing people are like aliens.

<comment><USER8> No - it focuses advertising efforts on people who have visited your website. So, you look at a jacket, but then aren't sure you want to buy it, retargeting makes you see that jacket again and again until you change your mind. Then you keep seeing it anyway.

<comment><USER9> You know, I'd almost be willing to give ad companies access to my credit card statements, so they'd _know_ when I bought something and _stop_ telling me to buy it.

And I bet ad companies realize this. This privacy-invasion paradigm is only getting started.

<comment><USER10> Netflix is a big offender here.

</comment></comment></comment></comment><comment><USER11> I find retargeting creepy to the point that I installed an adblocker. The first time I noticed it, was when I booked a holiday to New Zealand and paid a deposit to hire a camper van online. Suddenly started noticing ads for that company everywhere online, where as previously I hadn't noticed any. Even after I came back they persisted for a while but eventually ceased. When in reality I'm unlikely to repurchase something like that for another 1-5 years.

<comment><USER12> It will usually last 30 days.

</comment></comment><comment><USER13> I didn't know retargeting existed until a few years ago when a family member died. I had pulled up the website for a cremation service provider to look up their number, so I could pass it along to the person in the family who was making arrangements.

For the following week, more than half of the Google ad banners I saw all over the web were for the cremation company. Even on things that were _completely_ unrelated, like an Android developer blog. I could reload over and over again and I kept seeing ads for that company. I cleared cookies and it went away, and that's when I realized they were specifically sending me that ad because of an original visit to that website.

To me it really seemed insensitive on the part of the cremation company for them to have bought retargeted ads. You'd have to think that more often than not, people visiting your site have just lost of a loved one. Is it really the best thing to remind them of it on every subsequent website they visit?

</comment><comment><USER14> More reason to justify the use of the AdBlock browser extension.

<comment><USER15> I can't wait for the day Firefox bakes it into the browser.

<comment><USER16> Serious question: What's stopping them from doing so?

<comment><USER17> I'd imagine he only reason adblocking is still as effective as it is is because it's used by so small a number of users. If it would ship by default, advertisers would have a much greater incentive to work around it, and ruin it even for the small minority of people using it now.

</comment></comment></comment></comment><comment><USER18> Interesting, I never considered how that could spoil the surprise. I guess the most straightforward solution is to do private browsing when shopping for gifts. Pretty annoying since it won't have any of your saved data (logins, saved forms, etc.) but you don't have to worry about the ads.

<comment><USER19> Isn't gift shopping one of the first reasons given for the use of incognito mode?

<comment><USER20> That ones gonna go over well.

"Honey, why is your browser on incognito mode?" "Uh, yeah I was shopping for gifts. That's it. "

<comment><USER19> A browser can't be in incognito mode; only a browser window can. You're supposed to close it when you're done.

<comment><USER21> For mobile safari, the browser goes into incognito mode.

</comment></comment></comment></comment></comment><comment><USER22> Seriously, why would you click _inside_ an ad to _turn it off_? That's the kind of behavior that gets you _even more_ "one weird trick" and flashing "millionth visitor this second" ads that follow you around everywhere. I probably would've gone another year or more without knowing what that stupid triangle was for.

<comment><USER23> What do you mean "even more"?

If you turn off targeted ads, then you get more untargeted ads. Is that what you were saying?

<comment><USER22> I mean that if you click on an ad, you tend to get more of that kind of ad. And since ads routinely have misleading UI, I wouldn't expect clicking on an ad to let me turn it off / make it less annoying.

</comment></comment></comment><comment><USER24> Seeing an ad for something doesn't make me assume someone else bought one for me.

<comment><USER25> But if you see lots of ads for that thing [on a shared internet connection] then it might now?

<comment><USER24> No, probably not. Even then, do I remember or notice what ads I am seeing? I think this is more of a fear in the mind of the buyer that will almost never be realized.

</comment></comment></comment><comment><USER26> The crazy thing for me is that i keep getting advertised with my own products. Just a bit of bug-finding on the company site, and voila! that's all I see, no matter where I go.

The funny thing is when people with no clue about how internet advertising works, and they rage at a site for advertising something. Something like 'I cannot believe your site has ads for XYZ! That is outrageous and hypocritical!'. When there is a good chance they have been shopping for XYZ themselves, and that's why the ad popped up.

<comment><USER27> That's not how advertising _works_ , it's how advertising is insane and _broken_.

</comment></comment><comment><USER28> An easy solution is just to use different profiles. Chrome supports having different users on the same browser. I use this feature at work to keep corp and private profiles separate.

</comment><comment><USER29> I recently bought some underwear. A day or so later, I noticed men's underwear ads on Youtube, and declared "damn you, Google!" I eventually had to search for and watch other topics, like Call of Duty, to make them go away faster.

</comment><comment><USER30> "This holiday season is one more reason to cry")</comment>


Ask HN: It seems like the flag mechanism is abused. Is this okay? - <AUTHOR> This story about the events in HK went from #2 of the front page to the bottom of page 2 very quickly:
https://news.ycombinator.com/item?id=20846681
At first I assumed that the HN moderators have moved it to page 2, as they do.. but then the [flagged] attribute showed up.
Is it really healthy that a small number of people, if coordinated, can shut down any story? <comment><USER2> It's a political story and is thus likely to be flagged as off-topic by a large number of people.

Unless a political story has a strong tech slant, expect it to disappear off the front page quickly no mater how many upvotes it gets.

<comment><AUTHOR> It was about the Hong Kong police using a new technology (likely "DNA paint") to mark protestors, likely for future prosecution

<comment><USER2> DNA isn't mentioned anywhere in the linked story. It only says blue dye and there is nothing new or technological about that.

</comment></comment></comment><comment><USER3> Doesn't seem like abuse to me. Nothing particularly new or interesting IMHO, political mainstream topic, people already breaking the rules in the comments, ... are in sum good enough reasons to flag.

</comment><comment><USER4> This might be off topic but I browse on my phone and sometimes I fat thumb and hide or flag things.</comment>


Anonymous Owner, L.L.C.: Why It Has Become So Easy to Hide in the Housing Market - <AUTHOR> https://www.nytimes.com/2018/04/30/upshot/anonymous-owner-llc-why-it-has-become-so-easy-to-hide-in-the-housing-market.html <comment><USER2> If it's foreclosed, is it just a waiting period? After that can't the be assumed by someone or government entity and then just sell it at auction?</comment>


Pipistrel Velis Electro Completes Record Flights - <AUTHOR> https://www.avweb.com/aviation-news/pipistrel-velis-electro-completes-record-flights/ <comment><USER2> This is a pretty low-performance electric airplane. Fairly efficient, from light sport aircraft standards, but really inefficient compared to where you could go if you want to push aerodynamic efficiency to its limits (ala high performance sailplanes).

The chemistry isn't terribly high-performance and neither is the battery weight fraction that high.

Once clean-sheet, ambitious designs like the Eviation Alice get off the ground, we'll see these kinds of records rapidly ripped up.

Even so, I'm glad someone is doing this. Stunts are a good way to show the current state of the art and focus engineers on obvious places for improvement.

<comment><USER3> Yeah agreed, even on the GA market, the eFlyer 2 is a much more aerodynamic design (low wing, wheel pants, lower windshield height) which is already claiming 36kW cruise at 100kts.

<comment><USER2> eFlyer 2 has a shorter wingspan, though, more like a traditional GA aircraft.

Pipistrel's aircraft can actually soar in thermals it has such a long wingspan (I think).

But yeah, I like the eFlyer and I'm looking forward to the 4 person one which you could theoretically use for passenger service.

</comment></comment></comment><comment><USER4> I assume as flight schools using electric aircraft become more common, so will the charging infrastructure.

</comment><comment><USER5> Even though they must have pushing the limits of the plane, 738 km all electric is definitely a significant accomplishment. I wonder just how light their plane is!

<comment><USER6> If I'm reading the article correctly, they had refuelling cars handing them cables while in motion, so that they could recharge the batteries inflight.

It's a stunt.

<comment><USER7> I've been wondering how that kind of thing could be productized.

Like if take-off is the most energy intensive part, can you have a magnetically connected cable that detaches once it get pulled to full length? Of not, what is the problem and can we work around it?

Or auxiliary batteries that detach and return as parachute drones to be recharged for the next takeoff?

Similarly, hydrogen fueling stations in the middle of the ocean seem like an interesting way to decarbonise shipping.

<comment><USER8> I think you'd have better luck with some kind of a glider launch system where you have a stationary motor on the ground and a long cable. It's possible to put 2kft of altitude on in less than a minute this way. If you wanted to do the same with GA electric planes you probably could perhaps with longer runways or more powerful winches esp. if you engineer the airframe to handle a more powerful winch. [https://en.wikipedia.org/wiki/Gliding#Winch_launching](https://en.wikipedia.org/wiki/Gliding#Winch_launching)</comment></comment></comment></comment>


Status.github.com: "We're failing over a data storage system" - <AUTHOR> Updates to gist are getting lost. It accepts them as normal but the next page load for the gist is the previous version. Twitter accounts describe the same sort of problem for git repos.<p>status.github.com reports "We're failing over a data storage system in order to restore access to GitHub.com." <comment><USER2> It's been over 6hrs without update, except the hourly message which states the same. I'm really looking forward this post mortem, but having been in the situation where I've had to deal with large scale outages like this one, I guarantee some engineers are having a bad time right now, and I feel for them.

Github engineers, if you are reading me (probably not), KEEP IT UP, it happens to the best of us! <3

<comment><USER3> Posted at 15:51 Japan Standard Time

"...with the aim of serving fully consistent data within the next 2 hours."

That's somewhat significant

<comment><USER4> Yeah, sounds like a backup restore or a RAID synchronization is in progress.

</comment></comment></comment><comment><USER5> They've just posted an "Incident Report": [https://blog.github.com/2018-10-21-october21-incident- report...](https://blog.github.com/2018-10-21-october21-incident-report/)

> Multiple services on GitHub.com were affected by a network partition and > subsequent database failure resulting in inconsistent information being > presented on our website. Out of an abundance of caution we have taken steps > to ensure the integrity of your data, including pausing webhook events and > other internal processing systems.

[...]

> Information displayed on GitHub.com is likely to appear out of date; however > no data was lost. Once service is fully restored, everything should appear > as expected. Further, this incident only impacted website metadata stored in > our MySQL databases, such as issues and pull requests. Git repository data > remains unaffected and has been available throughout the incident.

</comment><comment><USER6> I don't know if they keep changing the text updates with a slightly different version to

\- prove it's a human that typed it

\- there is code the prevents repeating twice the same message

either way it's entertaining... But it's Monday morning in Australia and we need to release! (yep we do this via pr/tagging etc.)

<comment><USER7> It is to ensure that the updates get mirrored onto twitter, where exact duplicates can't be posted.

<comment><USER8> Isn't it enough to delete the older tweet? Or maybe just add a timestamp to the message.

Off-Topic: If it's not possible to write a twit with the exact text from a deleted twit, then a way to prove someone wrote a twit and then deleted it would be to have them try to write it again.

<comment><USER9> Deleting tweets is a terrible workaround. Once github start tweeting and people start linking to those tweets they can't go ahead and delete them 50 minutes later..

</comment></comment></comment></comment><comment><USER10> Just a few weeks ago my organization was in the position of choosing a version control platform for our repos. I'm so glad we went ahead with self hosted gitlab. We installed it on a CentOS server at our premise, SSL'd via Let's encrypt, I've even set up a dedicated gitlab runner to use Gitlab CI for continuous delivery and so far the testing is progressing pretty smoothly.

All this for $0.

Update:

I agree, gitlab and github will cost the same in the long run. Time costs money and self hosted has a lot of downsides as well.

However, gitlab being self hosted (and not costing anything in terms of separate invoice) makes us feel like we're more in control and are somehow saving some money (as we add more developers as well). This comment here was just sparked by a sigh of relief because this week is an important release for us and had we been on github this monday wouldn't have started too well.

Overall, all the comments listing the trade-offs are true. Time costs $$$ and a paid hosted solution is worth the minimal cost, time and expertise required.

<comment><USER4> What did the server cost? How many hours did you spend on it? What's your SLA? Who will be woken up at night when there's an outage? What's your backup and recovery procedure?

I mean kudos to you for setting it up but it's a bit naive to believe it's better than a hosted solution right away.

<comment><USER11> Git is tool for developers. If developer can't fix broken server, he's doing something wrong. No need to outsource trivial tasks.

<comment><USER12> Might as well have your developers do the support and the testing and answering the phones and cleaning the bathrooms too, eh?

<comment><USER11> Support and testing may be useful. Cleaning bathrooms no.

</comment></comment></comment></comment></comment><comment><USER13> I can't add comments to pull requests("you can't do that right now") and any commits pushed to branches are not updating updating the visible status in the web interface, no are newly created branches showing up. However, if you navigate to a new commit directly with its SHA (so you can share it with someone if you really want), it'll show up (so they're just not being indexed).

EDIT:

Obligatory "that's what happens when the whole world relies on a centralized git repo" and a reference to gitea, which has a very slick github-esque UI and is incredibly easy and light to deploy/run (on an existing server, your own PC, a raspberry pi, a docker vm, or whatever): [https://gitea.io/en- us/](https://gitea.io/en-us/)

<comment><USER14> I'm receiving emails (a lot of duplicates) from comments in PR, but they won't show up in the browser. I guess people are trying to submit multiple times, the email is sent but comment isn't posted.

<comment><USER15> Welcome to eventual consistency.

<comment><USER16> Mañana Consistency(tm)

</comment></comment></comment></comment><comment><USER17> The status updates are bearing a remarkable resemblence to a Windows loading bar.

• We aim to serve fully consistent data within the next 2 hours.

• _45 minutes later_. On track for serving fully consistent data within the next 1.5 hours

• _45 minutes later_. On track to serve consistent data within the hour.

• _One and a half hours later_. We estimate they will be caught up in an hour and a half.

<comment><USER18> I appreciate that they try. As a user I would never rely on those estimates, but it at least gives you a sense of what's going on and what they are doing. I take that over the more common silence or "we are working on it" any day.

<comment><USER19> Exactly. We all know not to trust that those estimates are exact, but they are much better than nothing. When they say nothing we don't know if it's half an hour, half a day or half a week.

<comment><USER20> Well, so they say it is within the hour, but we still don't know if it's half an hour, half a day or half a week.

</comment></comment></comment></comment><comment><USER21> My Jenkins is creating CI Builds like crazy. If your CI is on the pay-as-you- go service, make sure you are not burning money (or credits).

</comment><comment><USER22> My guess at what happened:

They had a split brain when multiple masters were running. Then they were not able to choose a master to keep because the data in both masters was 'corrupted' so they are now restoring from a backup.

So how do they get data corruption from multiple masters running:

1) Performing reads from slaves during an update operation. If you perform a read from a slave then you might get data from the other master. If you update data on one master based on data from another master then you get data corruption. Probably they don't do this much because if you had any slave lag then you would notice this problem during normal operation. However, they might do it for checking permissions. You can imagine because this data almost never changes it would never show up as a problem normally.

2) Data stored outside of the database. This would be the repositories themselves and cookie-session storage. Imagine repos have an incrementing id. Then if you have two masters a repo gets created with the same id on both masters. This is very bad because now two people can see each others data. You have the same problem with cookies. Imagine if you have user id as an incrementing id. The two masters create a user with the same id and an encrypted cookie or another storage system (redis) stores the user id. Now depending on which master you get routed to you appear as a different user.

Weirdly enough this would always be a problem based on how their failover system works. The only safe way i know how to turn a master-slave system into a safe HA system is how joyent does it ([https://github.com/joyent/manatee/blob/master/docs/user- guid...](https://github.com/joyent/manatee/blob/master/docs/user-guide.md) : you basically need a vote at commit time. if you have this then only 1 master can commit). However, I'm guessing most of the time they only have two masters running for < 1 minute but probably this time they had two masters running for a long time.

EDIT: oh. they said it affected issues & pull requests [they have different dbs for different stuff] so repo and authentication stuff wouldn't apply. oh, they said no data was lost as well so presumably that would exclude a split brain running for a long period of time.

<comment><USER23> Split brain can run for a while if the all identifiers are UUIDs and tables are used as append only. Restoration is complex, though.

<comment><USER22> depending on your application logic you can get external inconsistencies. like your typical CRUD app might dump the state of an entity in an edit form, then a user might edit one field, and the whole form is sent to the backend and written over whatever exists there. if you have two different masters then you can get a series of updates where you can't tell if the update is because the user meant to make the change or if it was because the change was incorrectly propagated from the other master. like even if you knew the user read from the other master you can't tell if the user intended the change or not. maybe they saw the value was the value they wanted so they didn't change it.

i guess this is a 'bug' because when you do stuff like this you should include some kind of version identifier to catch a concurrent update in the normal case. this scenario is also 'storing stuff outside the DB' kind of similar to the user_id in the cookie getting out of sync.

</comment></comment></comment><comment><USER24> I'm really looking forward to the post mortem that comes out of this (if it does). I always learn a lot from reading those.

</comment><comment><USER25> I always thought it is silly that we pay for both private repos on github and host our own enterprise github on premise, turns out whoever have set this up knew what they were doing.

</comment><comment><USER3> Local to Tokyo, Github has been down for most of the day. I never realized how much of my day centers around it: pr review, creating / commenting on issues, etc.

Looking forward to the write-up. I'm also curious as to how this significant outage lines up with their SLA for enterprise users.

</comment><comment><USER26> An update has been posted there: [https://blog.github.com/2018-10-21-october21-incident- report...](https://blog.github.com/2018-10-21-october21-incident-report/)

> At 10:52 pm Sunday UTC, multiple services on GitHub.com were affected by a > network partition and subsequent database failure resulting in inconsistent > information being presented on our website. Out of an abundance of caution > we have taken steps to ensure the integrity of your data, including pausing > webhook events and other internal processing systems.

> We are aware of how important our services are to your development workflows > and are actively working to establish an estimated timeframe for full > recovery. We will share this information with you as soon as it is > available. During this time, information displayed on GitHub.com is likely > to appear out of date; however no data was lost. Once service is fully > restored, everything should appear as expected. Further, this incident only > impacted website metadata stored in our MySQL databases, such as issues and > pull requests. Git repository data remains unaffected and has been available > throughout the incident.

> We will continue to provide updates and an estimated time to resolution via > our status page.

<comment><USER26> 1.5 hour later (a couple minutes ago), despite an estimated time of less than an hour:

> We continue to monitor restores which are taking longer than anticipated. We > estimate they will be caught up in an hour and a half.

</comment></comment><comment><USER27> Someone posted a comment on an open issue, I got the mail, but there's nothing on the web interface.

What I don't understand is why they don't set it all to "read only" until the problem is sorted. Looks like any update goes to /dev/null, just let your users know!

(unless they plan to replay those updates, somehow)

<comment><USER9> I don't think it's easy to predict what is going to happen to all updates now. They run a big distributed infrastructure. I doubt they can even predict which updates will be commited and which ones will not.

If replaying is even on the table (which sounds very dangerous to me), that requires a huge coordination and I am pretty sure they are not able to tell right now if that is going to work once the actual issue is fixed.

Better to stay quiet while fixing the issue and only say things that you actually know 100% to be correct.

</comment></comment><comment><USER28> PR comments are also failing with HTTP 405 error code.

Great way to start the week.

<comment><USER6> Well for the poor sods fixing it in the US, it's still Sunday evening...

<comment><USER29> It's when I typically get an hour or two to crank out some open source PRs and issue queue cleanup. Sadly, the outage means I don't get that time to devote this week :(

</comment></comment></comment><comment><USER30> I'm trying to add a new user to my organisation (Monday morning, new joiners...!) and despite getting confirmations I purchased another seat, I cannot invite them. Or when I do, those seats are gone, guess it's down to which data store I'm hitting on each request.

</comment><comment><USER31> They probably moved their storage backends to Windows 10

</comment><comment><USER32> Interesting how everyone uses a tool designed to eliminate SPOF in a way it has a SPOF.

<comment><USER29> GitHub does not equal git; the reason I'm paused is because I use Github's issue queues to organize my OSS work. Much easier than self hosting an issue repository/bug tracker. I am still able to do all my work, run new containers, etc., but GitHub is more tied into business processes than actual code (which is what causes the pain during these outages).

</comment></comment><comment><USER33> Obligatory: to all the people running around like de-headed chickens: this is what happens when you focus on a service not on the dvcs.

Your code and your wiki (if you use it) are already in git repos. If the industry moved forward on issues in dvcs repos, you have another central point of failure removed.

You also have less hassle to work across dvcs hosts, which is exactly why GitHub would never embrace this.

</comment><comment><USER34> Next: "We are restoring tape backups from some of our storage systems"

<comment><USER34> "We are continuing to repair a data storage system for GitHub.com. You may see inconsistent results during this process."

</comment></comment><comment><USER35> Seems like they're on their way back up:

> We are currently in the later stages of a restore operation, with the aim of > serving fully consistent data within the next 2 hours."

</comment><comment><USER36> I created a gist four hours ago, which as of now is not returning and showing a 404. Hopefully the gist did not get lost.

</comment><comment><USER37> They started to replay all webhook events yesterday evening, triggering all kinds of events in our systems, as deployments and the like :-(

</comment><comment><USER38> My issue comments are not being saved, and if I do a tag push I don't see that reflected on the "releases/tags" area of GitHub.

<comment><USER39> I just lost my session.

</comment></comment><comment><USER40> I don't know if someone's mentioned it yet but TravisCI is also not running on the commits that do show up on git, in Houston

</comment><comment><USER41> Earlier GitHub pages was "down for maintenance". Probably not related but might be of note.

(source: my website is hosted on github pages)

</comment><comment><USER42> Seeing a lot of issues with Pull Requests.

</comment><comment><USER43> Before all the trolling about Microsoft starts up, does anyone have current information on what these systems are?

In the enterprise space, a 'data storage system' could be an Array or a SAN or a lightpath etc, with usually quite long failover times. For an org like GitHub I'd think more like an object store (an Array-of-Hosts, if you will) or whatever storage mechanism holds their database files. Do they self host this sort of thing or is it an AWS/GCE/Azure service?

FWIW, all git commands are working fine for me (create a branch, push, colleagues can fetch my branch), but the UI doesn't show my branch & nor can I review/comment on PRs.

<comment><USER44> For storing things other than git repos, GitHub is heavily invested in MySQL. AFAIK all of GitHub is hosted on their own hardware.

[https://githubengineering.com/mysql-high-availability-at- git...](https://githubengineering.com/mysql-high-availability-at-github/)

<comment><USER45> This blog post describes exactly the scenario we were experiencing here. A master (single writer) failure, with missing fail over. You can only guess what went wrong with this plan. Looks good on paper, but some unexpected network or HW or routing problem could have caused the problem to identify the single writer.

</comment></comment></comment><comment><USER46> Is it just me or is that status message wonky? Failing over something to restore access?

<comment><USER47> Sounds like an engineer knee deep in diagnosing the issue.

<comment><USER39> That person needs our support more than anyone else right now.

</comment></comment></comment><comment><USER48> I can access GitHub.com here (Austin,TX), but it's taking forever.

</comment><comment><USER49> What particular services are down? I noticed I can hit the UI.

<comment><USER50> For me: can't fork, can't login (tested incognito), can't clone new repos.

</comment></comment><comment><USER51> Wonder if GitHub is "too useful to fail" at this point. As in, most people and companies won't switch git repo providers unless GitHub is down for many days at a time during the work week.

<comment><USER50> Transition to BitBucket or gilab is one click away. Companies surely will move if incentives are there.

<comment><USER52> Not when you use third party integrations. Like when using Travis for CI, and Travis doing your deploy.

<comment><USER53> Travis supports both Bitbucket and Gitlab

<comment><USER54> No, Travis CI doesn't support any code hosting other than GitHub.

</comment></comment></comment></comment></comment><comment><USER55> GitHub must be migrating to Azure...

<comment><USER56> Actually, they just announced to stay with AWS, as long as things run well. Maybe now they have a reason to.

</comment></comment><comment> ____Sash---701_ What!?

</comment><comment><USER57> What's strange to me is how many hours we've been given the same message. Today is an important day for my organization and not getting any information that hints how long this will last is a huge problem for our planning.

<comment><USER58> Are you a paying customer of GitHub Enterprise? If not, then you're getting your money's worth.

Snark aside, this is a great time to reassess your deployment strategies and look into things like local apt and pypi proxies. I'm confident you can find similar projects that will transparently cache your dependencies.

<comment><USER59> If you're paying for GHE you don't have any trouble. That's delivered as an appliance you host.

<comment><USER60> No it isn't: [https://enterprise.github.com/features#pricing](https://enterprise.github.com/features#pricing)

<comment><USER61> Yes it is. [https://enterprise.github.com/faq#faq-3](https://enterprise.github.com/faq#faq-3)

</comment></comment></comment></comment></comment><comment><USER62> I think it is obvious what happened. They must have moved their backend to Windows 10.

<comment><USER62> It's a joke people. Why downvote?

<comment><USER63> Because it's a boring, obvious joke which wasn't funny even in the 90s?

</comment></comment></comment><comment><USER64> Anyone know if this could be related to the Youtube outage? It's been a while since I've seen these big websites go down.

<comment><USER65> I'm not sure how you could postulate that they're related

<comment><USER66> Targeted attacks on specific aspects/assets of a major websites infrastructure? Eg target a specific service that both sites have in common in their back end?

Not even sure if that's feasible but it's an idea.

<comment><USER64> I figured it was just a coincidence, but the HN network is so well informed I thought I'd just ask the question on the off-chance it wasn't.

I personally don't find a relation likely.

<comment><USER66> Oh I find the relation very unlikely. I was just trying to think up a potential connection for fun/curiosity, as the coincidence is pretty crazy that two huge sites known for very few/little outages had major outages in the same week.

</comment></comment></comment></comment></comment><comment><USER67> This has been super frustrating, as people have deadlines and are working to finish projects before Monday morning.

What are the (good) alternatives to Github? Gitlab supposedly is Google- backed, so I don't want to have my private code there. Is Bitbucket the only one left?

I don't mind paying monthly, which I already do for GitHub.

<comment><USER68> > Gitlab supposedly is Google-backed, so I don't want to have my private code > there.

This strikes me as odd. May I ask why usage of GCP is a deal-breaker for you? While I can understand not wanting to use Google products directly as a consumer, I believe it would be - for lack of a better term - platform suicide for Google to intercept and perform its usual analytical shenanigans on the data content of transmissions to/from their platform.

Either way, Phacility's Phabricator[1] is $20/user/mo.

1\. [https://www.phacility.com/pricing/](https://www.phacility.com/pricing/)

<comment><USER69> Nobody trusts Google for any reason any more as they have proven unworthy of our trust.

<comment><USER70> That's a silly statement. By saying 'nobody' \- a single point of data invalidates your assertion.

I use gmail, I'm quite happy to trust that contract.

<comment><USER71> You're saying that you trust that contract today, or are you saying that you have always trusted that contract?

Its only recently that gmail's contract involved keeping out of your data. I think they also only say they abstain from using your data for targeted advertising, not that they don't use it for other purposes. I haven't read the terms in quite a while though and I could be mistaken.

Great products though. I really do wish I could pay for them in exchange for a real, trustworthy, comprehensive privacy promise.

<comment><USER63> There is a whole world of difference between paid for and not paid for Google services.</comment></comment></comment></comment></comment></comment>


Mangalyaan: a steal at Re.4 per person - <AUTHOR> http://www.thehindu.com/sci-tech/science/mangalyaan-a-steal-at-re4-per-person/article5347627.ece

<comment><USER2> This is a tiring discourse, lets discuss arms and foreign policy budgets as well. I personally think that its too small a package to do anything significant scientifically, however sending the probe to Mars itself is good target practice for next time around.</comment>


777X First Flight Today - <AUTHOR> http://www.boeing.com/commercial/777x/first-flight <comment><USER2> In general I've adopted a policy to just not fly on Boeing planes and see no reason for that to change. Reading this as a potential passenger to me says its too soon.

This craft has to be demonstrated to not only be free of the (underlying) flaws in the 737MAX, but to show that it _didnt_ go through the same design/build/approval/etc process as said craft.

This being released so close to the MAX debacle says that its exceptionally unlikely to benefit from any new process or management changes. So as a potential passenger the burden of proof is not only on Boeing to demonstrate the aircraft is superior in safety, but that the moral corruption which undid their sterling reputation does not apply here.

I don't expect that that to apply here, and based on overall trends, my pessimism leads me to expect a kind of palm-slicking to sell the plane rather actual quality.

</comment><comment><USER3> Not sure why the other commenter got downvoted, I think a heightened level of scrutiny is very appropriate...

</comment><comment><USER4> Called off due to high winds above the limit for first flight.

(2 days in a row)

<comment><USER5> Its been windy and rainy in the area all week.</comment></comment>


Pleasanton USD now blocks all ports except 80 and 443 - <AUTHOR> https://twitter.com/meyer9_/status/964613663146459136 <comment><USER2> Disclaimer: Using the following methods could be seen as bypassing the intent of the port restrictions set by your org.

I commit to github using ssh on port 443.

        # git remote set-url origin git@<host-in-ssh-config>:<username>/<repo>

From ~/.ssh/config

       Hostname ssh.github.com
        Port 443
        User git
        IdentityFile ~/.ssh/.github

Consider using Dovecot on your mail server for port 443. I was not aware that Discord stopped supporting websockets over 443. I run my own Mumble voice chat server so I can put it on 443, but I understand people have a lot of friends on Discord. I am just not happy with their chat logging policy [0].

You could also run a proxy or VPN on port 443. You can also use sslh [1] to have SSH+SSL+Proxy+VPN all on the same port 443. You can do similar things using HAProxy + SNI + SSL, but that is a bigger subject.

For other things that must use other ports or protocols, you can sometimes wrap them using tsocks [2] in your VPN or SSH tunnels to port 443.

[0] - [https://blog.discordapp.com/how-discord-stores-billions- of-m...](https://blog.discordapp.com/how-discord-stores-billions-of- messages-7fa6ec7ee4c7)

[1] - [https://github.com/yrutschle/sslh](https://github.com/yrutschle/sslh)

[2] - [https://www.redpill-linpro.com/sysadvent/2015/12/13/socks- pr...](https://www.redpill-linpro.com/sysadvent/2015/12/13/socks-proxy-as- poor-mans-vpn.html)

<comment><AUTHOR> The school blocks Discord IPs.

Thanks for the tip on using git on port 443. I didn't know it was possible to do that with SSH keys. I have 2FA on my account, so I can't use just HTTPS.

Also, yeah I setup a VPN on port 80, so I can effectively bypass this. I just didn't want to post that on Twitter. I'd probably get suspended for hacking or something.

<comment><USER2> Certainly, bypassing their security controls, or the intent of the controls could cause you grief.

Out of curiosity, how does using https affect 2FA?

<comment><AUTHOR> Generally, with git through http, it is able to prompt you for your github password, but with 2FA, it is not. You have to use an SSH key.

<comment><USER2> Oh I see, if you are on a shared computer, you would have to use a pw vs. an ssh key. I was not connecting the dots. Thankyou for the clarification.</comment></comment></comment></comment></comment>


Ask HN: How much did John Carmack make? - <AUTHOR>

John joined Oculus Rift in August last year in what seems to have been a very smart financial move. Does anyone know how much equity he had in the company? <comment><USER2> Oculus Rift hasn't disclosed how much ownership was transfered in its Series A and Series B funding [1]. Also Carmac's Salary, and possible investment isn't disclosed [2]. John Carmac is estimated to be worth ~4 million [3], source seem to agree.

<pure speculation>

His salary wasn't disclosed, but with 75million being spent in Series B funding it seems unlikely he was a major investor. Any equity he had was likely given partially as compensation for his position.

</pure speculation>

[1] [http://www.oculusvr.com/press/oculus-vr-raises-75m-in- series...](http://www.oculusvr.com/press/oculus-vr-raises-75m-in-series-b-to- make-virtual-reality-a-commercial-reality/)

[2] [http://www.oculusvr.com/press/john-carmack-joins-oculus- vr-a...](http://www.oculusvr.com/press/john-carmack-joins-oculus-vr-as-chief- technology-officer/)

[3] [http://ewallstreeter.com/john-d-carmack-net- worth-2158/](http://ewallstreeter.com/john-d-carmack-net-worth-2158/)

<comment><AUTHOR> I would think that as CTO he would have at least 1% equity [1]. If that's the case then he has increased his net worth by about $20m.

<also pure speculation>

[1] [http://www.askthevc.com/wp/archives/2007/06/what-are- typical...](http://www.askthevc.com/wp/archives/2007/06/what-are-typical- compensation-numbers.html)

<comment><USER3> To jump on the pure speculation band wagon, I've herd from 1-5% for CTO's after 8 digit VC investments. Jason Roberts (Co-host of techzing) once said he was offered >1% <10% (but more towards the low side) equity for a CTO position after series A funding in Uber.</comment></comment></comment>


Ask HN: Hacker News iPad edition: Are there any good clients? - <AUTHOR>

Doing an app store search there seems to be a lot of dead and/or very basic apps whose developers just don't bother updating etc. <comment><USER2> Try news:yc <http://newsyc.me> I love it :-)</comment>


Containerenv – shippable Linux user environments - <AUTHOR> https://github.com/containerenv/containerenv <comment><AUTHOR> probably not a great problem space to enter thanks to the likes of snap and others, but interested to here other peoples thoughts!</comment>


The History of Computer Viruses [Infographic] - <AUTHOR> http://www.f-secure.com/weblog/archives/00002124.html

<comment><USER2> This infographic seems to concentrate on viruses that made a big media splash, and not so much on historically important viruses.

For example: where's the "first virus"? That could be the "Animal" program for Univac, the Elk Cloner virus, or maybe Fred Cohen's 4.2BSD virus that he published about. Any of those are "important", maybe as firsts, maybe as intellectually important.

Where's the '88 Internet Worm? Where's the '88 HEPNet/SPAN Father Xmas worm? Both important as "firsts": first network worm, first non-IP worm. For that matter, where's the Bitnet CHRISMA.EXE mentioned?

One could go on in this vein for a while.</comment>


#UninstallSnapchat is taking off in India - <AUTHOR> http://mashable.com/2017/04/15/uninstall-snapchat-india/#XBTGGjdCIZq1 <comment><AUTHOR> This is a sad irony as to why some founders in exuberant start-ups are not mindful of their statements and actions that could hurt their company's growth as well as hurt sentiments of a lot of people.

Uber's Kalanich and now Snapchat's Evan.</comment>


The American way of using fork and knife is inefficient and inelegant. - <AUTHOR> http://www.slate.com/articles/life/culturebox/2013/06/fork_and_knife_use_americans_need_to_stop_cutting_and_switching.single.html

<comment><USER3> I hate dining etiquette. It's a fancy way of saying " _doing something a specific way because that 's the way everyone else does it_". Groupthink at it's highest. I eat whatever way is best suited for the meal.

<comment><USER4> Fight the power!

Still, I eat with proper European table manners, because it's all we have left. Without that, it would be total anarchy! We might as well wear trousers on our heads and wear baguettes for shoes!

What's next? Wearing a neck tie on a shirt with buttons in the collar or - <USER2> forbid! - with short sleeves?! _gags at the idea_

</comment></comment><comment><USER5> The contrarian in me now says "Cut and then bring the bite to your mouth with your knife, the fork is now a stabilizing tool, also mock every European who doesn't".

</comment><comment><USER6> If you really want efficiency, eat South-East Asian style: spoon in the right, fork in the left. The fork is used to hold onto larger things and to rake food onto your spoon, but it never goes into your mouth; the spoon shovels food into your mouth, and its edge can be used to cut as well. This way you can plow through rice and curry like you wouldn't believe, and it's a surprisingly good way of eating even things like chicken legs doused in sauce without getting your hands dirty.

In much of Asia, knifes are reserved for the kitchen, where it's the cook's job to chop everything up into bite-size pieces before being served.

</comment><comment><USER7> God I hate it when people try to push this stupid line...

I used to live with a British flatmate who was otherwise a nice person, but would constantly harp on me when I was eating "You're using your knife and fork incorrectly."

So for a while, I tried it her way, just to see if I could get used to it, and if it was actually better. After a while, I could kinda do it, but frankly, it always felt awkward and clumsy, and there was no obvious advantage.

Both techniques have their merits—lack of switching -versus- use of primary hand for extra knife power/control—but frankly, both work just fine, neither is obviously superior, and the main difference is _what you 're used to_ (in most cases, over _decades_ ).

If you're eating dinner the the Queen, then yeah, take a cutlery course first, learn how she does it, and try to do that. She probably doesn't care, but hey, you're eating with the Queen, so a little deference to tradition and pomp seems the way to go.

Otherwise, just do what feels natural to you. If someone whines at you, ask them which hand they'd prefer to be stabbed by, and if you're doing it wrong...

</comment><comment><USER8> Interesting. I used to hold the fork in my right the entire time, cutting with knife in my left hand.

Upon being informed that was a faux pas, I cut with the fork in my left, knife in right.

Finding it difficult to lift the food with my left hand, I intuitively adopted cut and switch and would eat with my right.

Noticing that no one around me (in Quebec) seemed to do this, I eventually adopted the European manner.

Now, following the Paleo diet, I frequently end up simply eating with my hands when at home. Feels great.

www.marksdailyapple.com/eat-with-your-hands/

I'm now either incredibly avant garde or a brute.

</comment><comment><USER9> I'm American and I've never done cut-and-switch. Since I was a kid, I've always knifed with my left and forked with my right. Never understood why people feel the need to cut meat with their right hand. So weird to me.

<comment><USER10> Presumably because cutting meat takes more strength and/or control than simply holding the meat still. It seem reasonable to relegate the latter to your non- dominant hand.

<comment><USER11> I find getting the fork into my mouth to require much finer motor skills than the simple sawing motion required for cutting. I'm with GP. I just keep the fork in the right hand and cut with the left.

As a kid, I was a cut-and-switcher, so maybe cutting with the right was more natural, but it definitely didn't seem hard to make the switch.

</comment></comment></comment><comment><USER12> Better still, relegate the knife to food prep.

<comment><USER13> You must be a cuts-steak-with-side-of-fork kind of guy, like me!

</comment></comment><comment><USER14> Rampant, completely unsubstantiated speculation that is probably contradicted by the evidence: I wonder if we'd be even more fat if we didn't switch. Switching slows down your eating, and I know that there is data to show that slower eating means you eat less. I guess the foods we eat too much of that are really bad for you, like snacks, sandwiches, and sodas, don't take a fork and knife at all.

That said, my wife and I are eating out French tonight, so I'll try to put down my guilt and manners and not switch hands!

</comment><comment><USER15> I'm left handed, never been an issue. I also never understood why table settings are the only thing where the world seems to appreciate my left- handedness.

<comment><USER4> I actually think it is supposed to make it a challenge to eat properly, to prove - at least when these manners were invented centuries ago - that one was a well-educated and respected member of the right part of society.

At the same time these rules were invented, you would have been hanged or worse for a good word, because of your left-handedness. Weirdo.

</comment></comment><comment><USER16> I thought this was going to be about using chopsticks.

<comment><USER17> Brutes, using two hands to eat.

</comment></comment><comment><USER18> Because getting food into us faster is a serious efficiency problem plaguing Americans everywhere.

</comment><comment><USER19> It is more common in Europe to hold the fork in your left hand rather than your right. But I think that has more to do with handedness than anything.

I'm right-handed, yet hold the fork in my right hand and often get comments about being 'cack-handed'.

<comment><USER4> Part of being part of human society is to fight your basic instincts, which - as a right-handed person - would make you use the fork with the right hand. Hence why you should use the left hand.

</comment></comment><comment><USER20> Still beats chopsticks.

</comment><comment><USER21> inefficiency can infer</comment>


Amazon Key - <AUTHOR> https://www.youtube.com/watch?v=wn7DBdaUNLA <comment><USER2> Trying to solve the package theft problem by giving Amazon access to your front door.

I won't applaud this; smart locks are not new.

and like this is your front door; once they have physical access to your premises all your previous forms of security have failed and you have absolutely no control over said situation.

> Sure I maybe paranoid but damn it's my front door!</comment>


Ask HN: Twitter Rest API Access - <AUTHOR>

We're working on a social search engine and we're running into the rate limits on their rest API. To up the limits, we've applied for their Certified product Program 3 weeks ago and reached out to our friends there, but there are no signs of it moving forward.<p>Anyone have any good stories for working with Twitter or some wisdom to share? <comment><USER2> Are you requiring that end users wanting to search Twitter content authenticate with their Twitter account? The best way to scale your usage of the API with your user base is to require users to authenticate. 180 search queries per 15 minutes is plenty to work with for most users.</comment>