Girlfriend's odd complaint about beau's freelance career sparks concerns - <AUTHOR> http://m.washingtonpost.com/lifestyle/style/carolyn-hax-girlfriends-odd-complaint-about-beaus-freelance-career-sparks-concerns/2013/05/21/b33da7f6-b748-11e2-aa9e-a02b765ff0ea_story.html?wpisrc=nl_hax

<comment><USER2> Having just had my boyfriend switch from 24/7 at-home freelance to working at his shop 7 days a week, this woman doesn't seem to understand the benefits she reaps from having someone at home and on-call most of the time (Do they have pets? Does he run errands? Is he there when maintenance shows up?). Not only this, but his mood has lowered and stress levels have skyrocketed, and given that I wake up at 6am and he doesn't get home until 8 or 9pm, we hardly spend time together anymore.

Depending on your drive, you can waste anywhere from 20 minutes to 2 hours+ a day commuting to and from, as oppose to using that time more efficiently or memorably.

Are there benefits to working from some office settings? Sure, but trying to claim he's less of a man for doing so is really the lowest and most absurd claim she could make. If she can't see that him being his own boss is better and more effective for him than having one, she's missing the point, the privilege and the potential.

</comment><comment><USER3> He's going to divorce her eventually, so he might as well break up now while it's free.

<comment><USER4> We're all going to die eventually, might as preempt that as well?

Why can't marriages be phases of our lives? Why try to avert failure by avoiding life?

<comment><USER5> I think the problem is the whole "til death do us part" line. I saw a stand-up comedian the other night who compared marriage to a mobile phone contract. You know, as soon as you buy that new shiny phone, there'll immediately be a newer, shinier model available! At least with a mobile phone contract, you get to choose a new one in 2 years.

I'm the wrong person to comment on this as I've been in a relationship for 16 years now with no marriage in sight. We're happy, we're committed, we require no symbolic ceremony in order to stay happy and committed.

personally, I think that the public perception of marriage is _finally_ swinging around to the reality that over 50% of marriages in western society fail (that's the term used by those that are married, I'd prefer something simpler like "end"), and in a time frame shorter than the relationship I'm currently in.

<comment><USER6> The 50% number is actually horribly exaggerated. It is closer to 30%. I'll dig up sources later, but basically the divorce rate is calculated by dividing the number of new marriages with the number of divorces in a given year.

This doesn't account for repeat offenders (people on their second, third, or tenth divorce) or age or region or any number of factors that can affect your chances of remaining married.

<comment><USER6> After much digging, here is what I have found. It surprised me and I learned a lot in the process. Very excited to share.

The Divorce Rate is not a measure of the chances of your marriage ending in divorce, though many people use it like that.

The Divorce Rate calculation is a measure of the number of divorces in a given year compared to the number of new marriages. If we accept that at face-value, we're okay. I would like to see it broken down by first-time marriages to first-time divorces; second-time marriages to second-time divorces. I have not been able to find this data, but didn't look exceptionally long ... as I need to get back to work. ;)

There are a lot of blog posts about the myth of the 50% divorce rate. They are attacking this statistic as representing something that it does not. (Even though it is not far from the truth.)

Still, I think it would be worthwhile to evaluate the usefulness of this statistic. Sure, it's an easy number to track. But why? Especially when everyone assumes that this is revealing something that it is not.

Now, onto the chances a first-time marriage might actually end in divorce.

Your baseline chances for divorce in a first-time marriage are calculated using a Life Table and the chances vary depending on a variety of factors. Age, region, education, and I am sure there are others. And if you input all your data, you get the chance that a first-time marriage will end in divorce.

Here's a great, simple description of the Life Table: [http://contemporaryfamilies.org/marriage-partnership- divorce...](http://contemporaryfamilies.org/marriage-partnership- divorce/tricky.html)

Ultimately, the chance for divorce remains around 50-60% on average, but can be as low as 20%. According to this article

[http://psychcentral.com/lib/2012/the-myth-of-the-high- rate-o...](http://psychcentral.com/lib/2012/the-myth-of-the-high-rate-of- divorce/all/1/)

"...a woman who is over 25, has a college degree, and an independent income has only a 20 percent probability of her marriage ending in divorce"

The article does not cite a source for this statistic, but it does cite various requisite factors in calculating a first-time marriage chances of ending in divorce.

More reading from the CDC about first-time marriages and divorce: <http://www.cdc.gov/nchs/data/nhsr/nhsr049.pdf>

<comment><USER5> Thankyou! Wow, that's some serious digging.

I managed to hunt down that the chance for divorce in Australia in 2007 was around 30%, down from a peak of around 50% in 2000. It was last around 30% in the early 80s.

I'm still hunting through some more recent papers on the ABS (Australian Bureau of Statistics) site devoted to "Family Formation and Dissolution"[1] but haven't found anything solid yet. I found many sites with unreferenced figures, and the only referenced figures all came back to the ABS, so I figure that their census data matches the marriage and divorce registrars pretty closely.

[1]:[http://www.abs.gov.au/AUSSTATS/abs@.nsf/ViewContent?readform...](http://www.abs.gov.au/AUSSTATS/abs@.nsf/ViewContent?readform&view=ProductsbyTopic&Action=Expand&Num=5.6.7)</comment></comment></comment></comment></comment></comment>


Google Sky launches - <AUTHOR> http://www.google.com/sky/ <comment><USER2> The chunkiness that is tolerable with maps seems quite unnatural with astronomy. I mean, it really should feel like a spaceship.

Also, is there some reason why three people have posted the same link? Here it is again, for those who've missed it:

[http://www.google.com/sky/#latitude=-70.00556654574503&l...](http://www.google.com/sky/#latitude=-70.00556654574503&longitude=-101.07421875&zoom=8&Spitzer=0.00&ChandraXO=0.00&Galex=0.00&IRAS=0.00&WMAP=0.00&Cassini=0.00&slide=16&mI=1&oI=2)

<comment><USER3> They definitely need a more graceful fail for zooming too far in than a gray box in place of the tile that says "No imagery available at this zoom level."

You're scrolling around, looking in on something, and then _bang_ the whole screen is gone, nothing but gray boxes, and you're whole sense of context is lost... This bothered me on maps, doubly so here.

</comment></comment><comment><USER4> I liked the dust cloud [http://www.google.com/sky/#latitude=-70.00556654574503&l...](http://www.google.com/sky/#latitude=-70.00556654574503&longitude=-101.07421875&zoom=8&Spitzer=0.00&ChandraXO=0.00&Galex=0.00&IRAS=0.00&WMAP=0.00&Cassini=0.00&slide=16&mI=1&oI=2)

Almost broken into tears, what about you Scoble?

<comment><AUTHOR> That's no dust cloud; that's a star cloud! :-)

<comment><USER4> Oops, sorry, here is the correct URL [http://www.google.com/sky/#latitude=56.66358551191311&lo...](http://www.google.com/sky/#latitude=56.66358551191311&longitude=-166.7333221435547&zoom=12&Spitzer=0.00&ChandraXO=0.00&Galex=0.00&IRAS=0.00&WMAP=0.00&Cassini=0.00&slide=16&mI=1&oI=2)

Beautiful :)

</comment></comment></comment><comment><USER5> Why, it's the pacman ghost nebula! [http://www.google.com/sky/#latitude=-70.00556654574503&l...](http://www.google.com/sky/#latitude=-70.00556654574503&longitude=-101.07421875&zoom=8&Spitzer=0.00&ChandraXO=0.00&Galex=0.00&IRAS=0.00&WMAP=0.00&Cassini=0.00&slide=16&mI=1&oI=2)

</comment><comment><USER6> It's a nice idea, but I don't think it'll hit home as large as Google Earth and Google Docs has. This is for a niche market.

<comment><USER7> Beware of "niche markets".

</comment></comment><comment><AUTHOR> This is a truly stunning sight:

[http://www.google.com/sky/#latitude=-70.00556654574503&l...](http://www.google.com/sky/#latitude=-70.00556654574503&longitude=-101.07421875&zoom=8&Spitzer=0.00&ChandraXO=0.00&Galex=0.00&IRAS=0.00&WMAP=0.00&Cassini=0.00&slide=16&mI=1&oI=2)

</comment><comment><USER8> These real-world images come as a nice complement to two great Free programs, Celestia - <http://www.shatters.net/celestia/> \- and Stellarium - <http://www.stellarium.org/>

</comment><comment><USER9> We'll know Google is truly awesome if they ever manage to launch a satellite to do their own surveying.

</comment><comment><USER10> You know, I wish I had this tool when I was in astronomy...it would had been a much better class.

<comment><USER4> You seem to have studied Astronomy so I've a question. To me, these are just bunch of some cool pictures? What information can we infer from them? I mean how further work is based on such pictures besides enthusiastic exploration?

<comment><USER11> It's truly amazing the quantity of information in the images you are looking at. Basically, we're trying to explain how galaxies form. The progress that's been made on the problem has been tremendous over the past 10 or 20 years, but we still have a long way to go. My hope, is that we do not figure out how galaxies form, instead, finding some new physics.

Anyhow, one highlight: By counting the same red galaxies you seen in sky's SDSS data, we have been able to measure the universal distribution of matter, and the change in "size" of the universe, through the Baryon Acoustic Oscillation.

<comment><USER4> Thank you, npk. Amazing stuff.

</comment></comment></comment></comment><comment><USER12> When you pull the zoom all the way back you can see the Milky Way as a sine curve.

<comment><USER13> That's just Google Maps doing its standard wraparound (east touches west on a sphere). The shape is more like a U.

</comment></comment><comment><USER14> Where is the moon?</comment>


When Italians chat, hands and fingers do the talking - <AUTHOR> http://www.nytimes.com/2013/07/01/world/europe/when-italians-chat-hands-and-fingers-do-the-talking.html

<comment><USER2> As an Italian who was born and raised in Rome, I can attest the veracity of the article. It is in fact an habit so entrenched in our culture that when I first saw some movie joking about this, I couldn't understand what the fuss was about. Does not everyone gesticulate when he speaks? Yeah, but up to a point. Now I recognize that when it comes to talking we are unique in that it seems like words aren't enough to convey a message, hence the numerous gestures. Since when I became aware of this I also learned that it's actually pretty easy to educate oneself no to resort to gestures to speak his mind, even though they're so part of the language that cannot be completely eliminated. I guess that if one were to quickly spot an Italian his or her hands would be the telltale sign.

<comment><USER3> Thanks very much for adding your perspective. The article itself is very intriguing and points out things I just would not have understood, even from 'watching' spoken Italian, as an intrinsic part of the language as it is actually used in its native culture. Having the extra nudge from someone who's part of the culture makes it even more educational.

<comment><USER4> A warning: this traditional, over-the-top gesturing is particularly common in certain cities and segments of population. (The kind of colourful things that short tourism&culture articles like to talk about.) Elsewhere? Not so much. If you were so careless as to extend this stereotype to —say— the modern urban youth or the well-educated expat, you would likely be mocked as a clueless American tourist, and asked about how many guns you keep at home. :)

For perspective: I was born in northern Italy. Very few people within my social circles ever used any of the traditional gestures; when they did, they deliberately exaggerated the movements for comical effect, or put on a southern accent. Indeed, I have only recently discovered that gesturing is considered to be such a prominent, common feature of Italian culture... by reading English articles about it.

<comment><USER5> Well, those "segments" include most of the (disgraceful) Italian élite, so uhm. Just watch a political debate: you'll never find one without the making- a-point "vertical-OK" or the please-dont-talk-idiocy "join-hands-in-prayer", be it from Northern or Southern politicians, journalists, pundits, scholars or whatnot.

TBH, one of the effects of living abroad for more than a decade has been, for me, the loss of that smug Northern superiority complex. With all due respect to Giorgio Gaber, any pretence of Northern non-Italian-ness died with the first Berlusconi government.

</comment></comment></comment></comment><comment><USER6> The definitive resource for Italian's hand gesture is "Supplement to the italian dictionary" [1] by the great designer Bruno Munari.

It is a semi-serious dictionary of gestures: how to perform them, what they mean, how common they are, when not to use them. It is mostly a work of art, and art for the sake of art, nevertheless I found it very complete and reliable.

[1] [https://duckduckgo.com/?q=%22Supplement+to+the+italian+dicti...](https://duckduckgo.com/?q=%22Supplement+to+the+italian+dictionary%22+bruno+munari)

</comment><comment><USER7> I'm italian and I really think we don't use gesture more than other nationalities... truth is there is fascination about this, and americans in particular love the story... still don't get why

<comment><USER5> It's not just about over-use, it's about codes: us Italians have a wide range of very well-defined nonverbal codes, which is why "others" notice them. Brits, for example, might be gesticulating wildly in some situations, but their hand-waving will be very generic (open-hand, numbers and little else).

I personally put it down to the historical problem of Italians not having an official language until late XIX-century, while being a melting pot of people coming and going from/to the whole of Europe/Africa/Asia for thousands of years. Nonverbal codes were clearly essential, it's not a surprise they're still around.

</comment></comment><comment><USER8> In Italy there is not just a culture. If you move of 50km you actually call stuff with differents names here in Italy.

As Example:

Ciaccino -> Siena

Schiacciata -> Firenze

Siena and Firenze actually are 1 hour away.

It is clear that every sub-italian-culture have different words and gesture.

I want to add that we use the same gesture in an extraordinary range of expression. The same "F __k you " can be a joke or a serious one and we will use the same gesture.

Finally, only 20% of our communication is verbal, the rest is un-spoken communication. I can guess that here in Italy the 30% is verbal+gesture communication, the rest is all about the __tone of the voice __(very important), the position of the body and other stuff.

<comment><USER9> I also found that gesture is much more used in the center and south of Italy.

</comment></comment><comment><USER10> This page is a funny, but extremely accurate, Italian gesture guide.

[http://www.amusingplanet.com/2010/11/illustrated-guide-to- it...](http://www.amusingplanet.com/2010/11/illustrated-guide-to-italian- hand.html)

I'm used to show it to my foreign colleagues to help them to understand me :)

</comment><comment><USER11> Yeah, Italians use gestures when talking; no kidding. In the video, they showed dozens of gestures, most which I had no idea what they meant. I would have found it much more informative and interesting if they explained what all those common gestures actually meant.

<comment><USER12> Well there you go then: [http://www.nytimes.com/interactive/2013/07/01/world/europe/A...](http://www.nytimes.com/interactive/2013/07/01/world/europe/A-Short- Lexicon-of-Italian-Gestures.html?ref=europe)

</comment></comment><comment><USER13> Most of these are pretty easy to pick up even as a foreigner, although you've got to be careful - I once accidentally spilled a drink on my wife while gesticulating when I was telling a story.

</comment><comment><USER14> My Italian girlfriend told me the "Where are you going?" gesture is inaccurate in this video. It's mostly used as a "What the fuck?!" hypothetical question.

<comment><USER15> yes, "where the f*ck are you going?" :)

</comment></comment><comment><USER16> Nice "classic" (2009-2010) English-captioned drawings by Alfredo Cassano about Italian Popular Gestures (click on images for bigger resolution):

[http://www.alfredocassano.com/buyitaliangestures.html](http://www.alfredocassano.com/buyitaliangestures.html)

</comment><comment><USER17> We have a joke around here that Italians can never drown as long as they're speaking.

</comment><comment><USER18> I'm italian and I want to point out that we use gestures without realizing it: we can't reproduce them with the same naturalness as before, and often we don't even know which gesture we made just before.

</comment><comment><USER19> odd - I don't interpret the 'afraid' gesture as they do - I'd use it to indicate a place is full of people</comment>


Show HN: S3io.com – using Amazon S3 for personal storage - <AUTHOR> https://www.s3io.com <comment><USER2> [http://i.imgur.com/2rk7uhU.png](http://i.imgur.com/2rk7uhU.png)

y u do dis? Does S3 not also have the ability to store complex data bits like filenames? Is the server open source? Will the client work without the server? What if your server actually keeps a transaction log along with my IP and other identifying information (seems like logging in would make this readily available). WHAT IF YOU ONLY LOVE ME TO HARVEST MY METADATA?!

<comment><AUTHOR> The server is not open source yet, but it probably will be. The client will not work without the server because the server signs all requests to S3 and otherwise I'll have to expose S3 credentials on the client side.

</comment></comment><comment><USER3> Previous discussion if it's useful for anyone : [https://news.ycombinator.com/item?id=11654155](https://news.ycombinator.com/item?id=11654155)

</comment><comment><AUTHOR> Hello, HN!

I've been using Amazon S3 to store family photos and some other stuff for quite a while, but, as you know, the web interface Amazon offers is not very user-friendly and provides no way to share files except by public links to individual files. Another thing I've always wanted was a place to store miscellaneous snippets and notes not relying on any services that keep my data locked-in in their databases. So I decided to combine the two and built S3io.

S3io is a web-interface app for Amazon S3 buckets (not for all of them, unfortunately, buckets in Frankfurt or buckets with dots in their name will not work for now) that will turn your bucket into a file sharing and note- taking tool. It allows you to post notes (saved as JSON files in your bucket) and upload files directly from the browser while the app server only stores metadata and knows nothing else about your files and notes. It also lets you view uploaded photos in a slideshow kind of a gallery and share your notes, individual files or entire folders.

If you use Amazon S3 for personal storage, you could find S3io useful. It is still an early beta and has not been extensively tested by anyone else except me, so browser support is limited to the latest Chrome for now, although it seems to work fine in Opera and Chromium, not that good in Safari. The situation will get better in the future. If you are interested in testing or using something like that, please sign up for invitation.

Would like your feedback. Thanks!

<comment><USER4> Just curious: why isn't frankfurt supported?

<comment><USER5> Frankfurt allows only signature v4. That version of the signature required including the region, something that v2 did not do.

S3 allows people to essentially ignore the region by using domain style buckets. Except not anymore with v4.

It's a common gotcha.

<comment><AUTHOR> You're right. But with S3io most of the action happens on the client side and it does work with sig. v4 which provides better integrity checking for large files, the problem with Frankfurt is not very big, it's just that I can't automatically detect the region by the bucket name on the back end. But it should be fixable.

<comment><USER5> > it's just that I can't automatically detect the region by the bucket name on > the back end

exactly.

> But it should be fixable.

yep.

</comment></comment></comment></comment></comment><comment><USER6> Great tool. I had a similar idea a while back to build a frontend webapp to store my receipts on S3 or Backblaze.

It works like any receipt app, except the webapp is just a UI for S3/Backblaze.

As opposed to dropbox or google drive, you pay S3 directly for what you use and you own your own data. That way if the webapp goes defunct, you still are the owner to all your data in raw s3 bucket form.

I wanted it to replace my shoebox at home for sensitive data (warranties, gym memberships, utility bills) I don't feel comfortable putting on dropbox or google drive type app.

10 years from now, I don't know if dropbox or google drive will be around. I feel much more comfortable relying on a backend service like S3 than dropbox or google drive.

<comment><AUTHOR> > It works like any receipt app, except the webapp is just a UI for > S3/Backblaze.

That's exactly what S3io is doing!

<comment><USER6> Love the project. Congratulations on shipping. An itch/problem I've been looking to solve or be solved.

I'd love to be able to host it myself as well. Hope you opensource it. If anything for me to geek on with other features. :)

<comment><AUTHOR> Thank you! I will opensource for sure and post about it here on HN, stay tuned :)

</comment></comment></comment></comment><comment><USER7> I've come back to this idea many times, and I think it has a lot of promise. It's all a question of the user experience and the feature set (or making it open and hackable). Cloud storage is a cheap commodity (at least for geeks, who know how to buy it "wholesale") and people will want ownership of their data.

Actually, I don't know what it's all a question of, but in 2016 we have these amazing services and tech stacks for shuttling bits and building UI, and yet I still use the Finder and the command-line and wait for Dropbox to sync my photos and videos. Something's gotta give.

</comment><comment><AUTHOR> Hey, guys! Thank you all very much for your feedback! I'm starting to send out invitations. Please feel free to contact me over email you can find on the web site if you have any questions or problems.

</comment><comment><USER8> Does this tool support end to end encryption?

<comment><AUTHOR> No. But as I said before, most of the action happens on the client side and it should be easy to add some encryption to the mix.

</comment></comment><comment><USER9> Why not use Backblaze B2? It's much cheaper than S3.

<comment><AUTHOR> Yes, it's cheaper, but B2 doesn't allow uploading files larger than 100mb from the browser, you have to use their CLI tool for that. I don't think their web API supports that.

</comment></comment><comment><USER10> Is this open source?

<comment><AUTHOR> Not yet. But I think it will be.

</comment></comment><comment><USER11> been waiting for something like this for a long time, submitted for invite, cant wait to test

</comment><comment><USER12> Does this work with glacier?

<comment><AUTHOR> Not yet.</comment></comment>


CVE-2019-9193: Not a Security Vulnerability - <AUTHOR> https://www.postgresql.org/about/news/1935/ <comment><USER2> I kinda went back and forth on this. The initial comments here made me think that this was basically the reporter saying "person with su can do su things".

Then I looked at the PostgreSQL statement, which said that the report claimed that users with a read-access role could do the su things, and they said that the claim was not true.

And _then_ I looked at the actual report, which stated that you have to have the read-access role, _and_ the execute-access role (or su).

So, what it seems like is that both parties didn't represent the actual situation well, but the root (ha) issue was that it was reported as "IF YOU HAVE READ ACCESS (and execute access) THEN YOU CAN EXECUTE ARBITRARY CODE!!11!!!"

<comment><USER3> allegedly, the reporters only edited their article after publication and widespread criticism.

<comment><USER2> Oh, if that's the case, then the reporters were just wrong about how the software worked. If it only required the read access, then that would be a legitimate vulnerability.

</comment></comment></comment><comment><USER4> "It rather involved being on the other side of this airtight hatchway: Writing to the application directory" (2012)

Raymond Chen on "security vulnerabilities" that depend on already having superuser status.

[https://devblogs.microsoft.com/oldnewthing/20121207-00/?p=58...](https://devblogs.microsoft.com/oldnewthing/20121207-00/?p=5893)

Looks like Microsoft messed up the line breaks on switching to a new blog platform.

<comment><USER5> _> Looks like Microsoft messed up the line breaks on switching to a new blog platform._

One could argue Microsoft has been messing up line breaks since 1981.

</comment></comment><comment><USER6> Direct link to "CVE-2019-9193: Not a Security Vulnerability" [https://www.postgresql.org/about/news/1935/](https://www.postgresql.org/about/news/1935/)

Which is also currently a banner at postgresql.org titled "4th April 2019: CVE-2019-9193: Not a Security Vulnerability"

<comment><USER7> Per the links in the NVC CVE page, the reporter seems to have retracted it too.

It was a bad report. To be fair, it's also a bad feature. But bad features working as intended shouldn't be "vulnerabilities".

<comment><USER8> COPY TO/FROM PROGRAM is not a bad feature. It is in fact an amazing and wonderful thing that makes ETL with Postgres much more powerful. Almost all language runtimes can spawn subprocesses. What is your rational for declaring it "bad" with no explanation?

<comment><USER7> Sigh. We literally went through all this with SQL Server's xp_cmdshell feature already. All the same flame wars apply, I don't have the energy to argue it all again.

The community consensus was the MS should make this thing disabled by default, and they did. Postgres should too.

<comment><USER8> xp_cmdshell can be re-enabled, from SQL, with the same kind of privileged account postgres requires to run COPY...PROGRAM:

[https://docs.microsoft.com/en-us/sql/database- engine/configu...](https://docs.microsoft.com/en-us/sql/database- engine/configure-windows/xp-cmdshell-server-configuration-option?view=sql- server-2017)

</comment></comment></comment></comment></comment><comment><USER9> After reading the discussion, that seems like the entirely right call.

The security researchers did not seem too concerned with the feedback they got from the community prior to releasing this CVE.

<comment><USER10> Yeah, I discovered a flaw in SSH the other day, if my account on the remote server Is listed in the sudoers file I can escalate to root priviliges, as soon as I create a snazzy logo I'm going to get myself a CVE.

Seriously though, security research is starting to drift into bizarro land, security contacts at companies are inundated with port-scans asking for bug bounties because there's an open port and now people are registering CVEs on expected and documented behavior.

<comment><USER11> _security research is starting to drift into bizarro land_

Remember that these people are essentially trying to earn a living by finding vulnerabilities, so it's no surprise that they'll try to spin _anything_ as one, regardless of any other considerations.

I've used the term "security vultures" before in reference to such things. It's unfortunate that a lot of companies misunderstand or obey their requests, and in the process useful features are destroyed and software becomes more user-hostile.

<comment><USER12> Perhaps I'm naive, but I think it is surprising anyone wants to be taken seriously as a researcher in any field and proceeds to publish information that in on its face and with no effort provably false.

<comment><USER13> Throw enough at the wall, some of it might stick.

People who have no reputation tend to worry less about their reputation.

<comment><USER12> I can't reasonably say that doesn't happen. Obviously it does. It may even be a useful tactic in the very short term. It however does not appear to be a very useful decision for a long term career or hobby.

</comment></comment></comment></comment></comment></comment><comment><USER14> The researcher should watch this video [https://www.youtube.com/watch?v=866olNIzbrk](https://www.youtube.com/watch?v=866olNIzbrk)

<comment><USER8> Thank you! Didn't know about that silly Python non-CVE, a great example of the same shallow thinking that created this bogus CVE.

</comment></comment><comment><USER15> Sounds the same as xp_cmdshell scenarios in past. Although worth pointing out Microsoft there did lock down things further to even disable the feature and it has to be turned on explicitly.

That's possibly an improvement Postgress can do to avoid easy pivoting. Its what a less defensive security reply would include, because if hackers use it to pivot it might not look good down the road.

But from a pure argument standpoint Postgres is correct, it's more of a defense in depth strategy.

<comment><USER8> Quoting Andreas Freund from the mailing list:

""" Btw, the xp_cmdshell thing the author references several times? It can be enabled via tsql if you have a privileged account.

[https://docs.microsoft.com/en-us/sql/database- engine/configu...](https://docs.microsoft.com/en-us/sql/database- engine/configure-windows/xp-cmdshell-server-configuration-option?view=sql- server-2017)

and it allows to execute shell code (as a specified user) even when not a sysadmin: [https://docs.microsoft.com/en-us/sql/relational- databases/sy...](https://docs.microsoft.com/en-us/sql/relational- databases/system-stored-procedures/xp-cmdshell-transact-sql?view=sql- server-2017#xp_cmdshell-proxy-account) """

so no MS didn't really "lock down" the feature.

<comment><USER16> If you make a proxy account, AS AN ADMIN. I have personally walked dozens of DBAs through making said proxy account as it was non-trivial to accomplish.

Please stop repeating this FUD.

<comment><USER8> You cannot run COPY...PROGRAM without a permission that can only be granted to you by a superuser and which is not granted by default. I'm failing to see the distinction.

Postgres is just a process that happens to do a lot of I/O. It's no different than any other Unix process: it can spawn children, it can dynamically load libraries on request. It protects these powerful tools with permissions, which is the sane and correct approach taken by many, many other languages and frameworks, all just unix processes, all just trying to get shit done.

<comment><USER17> sudo exists, even though an admin could just log in as root all the time, because it's safer to keep your gun unloaded when you aren't planning to use it immediately. Keeping your gun loaded isn't a security flaw, but it is dangerous.

<comment><USER8> sudo requires being granted permission. If you have it, you can run code as root. It is not granted by default.

COPY...PROGRAM requires being granted permission. If you you have it you can run code as the postgres user. It is not granted by default.

</comment></comment></comment></comment></comment></comment><comment><USER18> Is this the same as somebody executes sudo bash and observes that he got root prompt?

</comment><comment><USER19> [http://cve.mitre.org/cgi- bin/cvename.cgi?name=CVE-2019-9193](http://cve.mitre.org/cgi- bin/cvename.cgi?name=CVE-2019-9193)

</comment><comment><USER20> This is the original blog post by the author who filed the cve. [https://www.trustwave.com/en- us/resources/blogs/spiderlabs-b...](https://www.trustwave.com/en- us/resources/blogs/spiderlabs-blog/authenticated-arbitrary-command-execution- on-postgresql-9-3/)

</comment><comment><USER21> I think this is an argument for not giving root/superuser all possible permissions by default. It's OK that granting the `pg_execute_server_program` permission gives access to this feature, but it should still be something you have to opt in to, instead of making database superuser equivalent to the host user that the database runs as.

For comparison, in CockroachDB (disclosure: I'm a co-founder of Cockroach Labs), we don't have any features that let you execute server programs, but we do have something analogous to `pg_{read,write}_server_files` via the BACKUP, RESTORE, and IMPORT commands. In order to use these commands with a target on the server's filesystem, though, the database `admin` role isn't enough. The server also needs to be started with the `--external-io-dir` flag (and file operations will be limited to that directory). This gives an extra layer of opt-in before filesystem operations are allowed.

<comment><USER22> It's an argument for sure. But there's a significant maintenance cost to every security boundary you impose, especially when it's as counter-intuitive as "root may not do suchandsuch".

</comment></comment><comment><USER23> While the behavior described might be by design, I'm skeptical of any database query that involves accessing user-specified local files or executing system commands. (MySQL also has the infamous LOAD DATA INFILE query.) They look like band-aids designed for people who can't be bothered to import/export their data using standard shell commands, scripts, pipes, and database-specific dump/restore tools. These kinds of features should be disabled by default.

<comment><USER24> > _They look like band-aids designed for people who can 't be bothered_

Also those schmucks who like data to be loaded way way faster.

<comment><USER25> What is way way faster here? Are you only comparing COPY versus individual row INSERT statements?

I prefer using COPY ... STDIN/STDOUT. AFAICT, you get the same bulk table access performance. But, the external file access is via the client, separating DB rights and filesystem rights. When appropriate, you can also SSH to the server and invoke psql as a regular user there, manipulating files under that user's control on the server filesystem.

The psql command also provides built-in \COPY command to make it easy to combine several such commands into one transaction in a SQL script. It looks a little like the SQL COPY command, but accesses files on the client side and executes equivalent COPY ... STDIN/STDOUT statements on the server.

In Python, you can use the copy_expert() method with psycopg2 connections to access the COPY ... STDIN/STDOUT feature for similar bulk ETL. However, Python will become the performance bottleneck if you try to do any real row-level processing rather than just relaying byte buffers to/from the filesystem.

<comment><USER26> You're missing the point.

        COPY TO/FROM PROGRAM is useful e.g. when you already have the data locally on the server (same filesystem, ...).

        COPY FROM STDIN/STDOUT are useful when the data are on some other system (say, on a different server, etc).

Of course, you might write a script that reads the local data and loads it through a regular client, i.e. something like

        COPY t FROM PROGRAM 'gunzip -c /path/to/compressed/data.gz';

might be rewritten like

        gunzip -c /path/to/compressed/data.gz | psql db -c 'copy t from stdin';

but well, that requires some access to the server and ability to execute commands on it (although not as a postgres superuser).

Ultimately it's a tradeoff - don't trust your users? Don't give them superuser access, don't grant them the role. It's possible to restrict that in other ways (e.g. security-definer functions + extra validations).

<comment><USER25> I'm not missing the point. I was responding to a comment about performance. In my experience, COPY ... STDIN/STDOUT are just as fast the other COPY, given the same filesystems. I think many people are unnecessarily conflating bulk COPY advantages with superuser rights here.

We use it all the time via psql authenticated with unix domain socket. In most situations where there are users performing ETL and such, I think it is much safer to have them using a non-superuser role and manipulating files in their own user or group space. You can have all the performance of a bulk COPY without the risk of mangling the service-related files under the postgres user. I think it is better to give regular SSH accounts to these users than to give them elevated DB privileges so they can use server-side file or program COPY.

Also, with psql you can do \copy ... program within your SQL script. It has all the expressive power of a server-side copy but actually runs commands under the invoking user instead of the postgres service.

</comment></comment></comment></comment></comment><comment><USER27> If this is CVE, what is Docker then? :)

Anyone with privileges to run docker image is basically root on your host.

<comment><USER28> This is why you should never add your user to the docker group. Just use `sudo docker` or put your docker commands in a script that can only be edited by root and execute the script via sudo with NOPASSWD.

<comment><USER29> Much better: replace Docker with [https://podman.io/](https://podman.io/), which runs with user privileges, no root.

</comment></comment></comment><comment><USER30> TL;DR Don't grant root to strangers, because they might do something rude with your db.

</comment><comment><USER31> Running a program remotely from a database client is an awful idea. DB client is not a secure remote shell; if you need a shell access, use ssh. Postgres is making a mistake, developers will run postgres as root (because it is the easiest way to solve problem with permissions), they will write apps that connect to postgres server as root and run SQL queries made from user input.

<comment><USER32> You can't run Postgres as root without patching it first. It really wants to run as a low privilege user.</comment></comment>


Zend PHP JIT open sourced - <AUTHOR> https://email@example.com/msg76332.html <comment><USER3> As much as their technological contributions are appreciated, the slow creep of Zend branding (and its own, different licensing) into PHP is not a good thing. Opcache is part of PHP now, yet it's Zend branded everywhere and has a bus factor of one (nobody can understand the source code except a Zend employee - every time anything's changed in the engine, Opcache breaks and he has to go and fix it). Similarly, it's not good that the Zend Engine is marked with a Zend Technologies copyright notice either. It's the core PHP runtime, yet if you read the notices you'd think it was some proprietary product donated by or licensed from them.

<comment><USER4> Pure open source doesn't seem to exist in this decade; all large enough projects seem to die without corporate sponsorship.

<comment><USER5> It was already like that with the projects that hit big.

Linux got lots of contributions from companies that would rather invest into it than paying UNIX licenses.

Eventually it got lots of support from the likes of IBM and Intel, because its existence suited their business.

GCC got lots of support when UNIX vendors started charging for their SDKs and smaller shops invested into it.

Likewise for many other projects.

</comment></comment></comment><comment><USER6> Everyone interested in this needs to read the thread carefully. This is not an actual JIT, and the synthetic benchmark is even more misleading than normal benchmarks.

<comment><USER7> Link to the benchmark in question: [https://gist.github.com/dstogov/12323ad13d3240aee8f1](https://gist.github.com/dstogov/12323ad13d3240aee8f1)

</comment></comment><comment><USER8> This is a good start to the conversation - PHP needs a fast JIT (& it can have a good one too), but it doesn't entirely help that the strict typing RFC has foundered.

About five years ago, I started to work on a basic block PHP JIT using libjit, mostly out of frustration of dealing with the dull progress I was making with pecl APC's speed & concurrency issues.

The JIT started off simple and then went nowhere for four months because the primary requirement for register allocator (and the jit_type_t SSA) is an actual type - the zval_ variables cannot sit on a register.

There's an old sys-con paper[1] by my guru, who found a way to build a direct threaded JIT which could run in partial JIT mode without working out how to handle complex exception handling or making non-inlined function calls out of the JIT (the engine was called CVM).

The reason my PHP JIT failed to do anything relevant was due to the opcode structure of PHP which triggers a halting problem version of type-checking which both JVM and .NET IL avoids. In this context, it should be mentioned that the .NET IL bytecode is actually polymorphic (i.e JVM has iadd/ladd/fadd, while the IL has just add & add.ovf).

The types of the variables on the ->op1 and ->op2 needn't be the same type in PHP, so that each opcode is actually prefixed by a routing to the right binary operator table [2].

This means that the memory bandwidth overheads and branch prediction mechanisms on the JIT generated code would be nearly exactly the same as the regular C implementation of the engine.

HHVM works around the exact same problem by forcing the type specification as a HACK-LANG type system, which allows it to really go ahead and optimize the pointless type-checking.

PHP needn't entirely force strict-typing across the board, but at least needs to prevent different codepaths from ending up at the same opcode with vastly different types.

That one detail is effectively stopping a sane JIT from being built for PHP - because it neither a register machine (like perl6/parrod), nor a stack machine (like JVM, .NET or Python), but an opcode sequence more tied together like a rough DAG connected via ->op1, ->op2, ->result, along with the TMPVAR indexes.

That gets insanely complex to process very quickly as you have to traverse every-path including branch-backs to generate type traces through it - <USER2> loop could execute once where $a is an int and again with $a being a float.

All that said, this is an AOT engine - it does use LLVM, but is mostly entirely compiled before running (like old HipHop C++ compiler) and then does not by-pass the overheads introduced by the lack of type verifiability for an opcode.

[1] - [http://www2.sys- con.com/itsg/virtualcd/dotnet/archives/0103/...](http://www2.sys- con.com/itsg/virtualcd/dotnet/archives/0103/weatherley/index.html) [2] - [https://github.com/php/php- src/blob/master/Zend/zend_vm_gen....](https://github.com/php/php- src/blob/master/Zend/zend_vm_gen.php#L687)

<comment><USER9> What makes PHP different from JS? Given the performance improvements realized in JS with JIT engines it seems the same benefits should be possible in PHP.

<comment><USER10> It took a lot of work to get JS to its current speed. Here the incentive is that for the web to be fast, JS has to be fast.

That incentive breaks on the server where you can use any language you want anyway.</comment></comment></comment>


China is monitoring employees' brain waves and emotions: $315M profit increase - <AUTHOR> https://nordic.businessinsider.com/china-emotional-surveillance-technology-2018-4 <comment><USER2> What more is there to say other than it's just wrong. Whilst interesting technology, can us humans really be trusted to do the right thing with it just yet, if ever?

<comment><USER3> That's why we're going to set up AI to monitor and adjust us.

<comment><USER4> "We're going to set up"

<comment><USER3> ""We're""

</comment></comment></comment></comment><comment><USER5> I wonder when they'll start to give some pills to employees instead of sending them home. After all, they might need just a little bit of "motivation".

</comment><comment><USER6> One key thing is that while a lot of employees work hard, there are others who hide in the office and still manage to glide far at the expense of other honest employees. If such technology can be used to detect dishonest employees who are eating into wages of honest employees, it can prove to be game changer and liberate honest employees from extra burden.

It's never okay for dishonest people to not improve just because other honest people are paying for their mistake.</comment>


Introducing Trello Enterprise - <AUTHOR> http://blog.trello.com/introducing-trello-enterprise/

<comment><AUTHOR> It seems a little wrong and disappointing that Two Factor Authentication (2FA) has been added to Trello as a paid upgrade.

<comment><USER2> 2FA is available for all users, not just Enterprise.

<comment><AUTHOR> Great, it wasn't clear that was true in the initial announcement and when I looked in my Trello account I couldn't find a way to configure it.

<comment><USER2> Here you go: [http://help.trello.com/article/993-enabling-two-factor- authe...](http://help.trello.com/article/993-enabling-two-factor- authentication-for-your-trello-account)

=)</comment></comment></comment></comment>


HN Ask: Please Review My Startup Serkit Messenger - <AUTHOR> Hi,
I have build a new messenger to have both private and public chats simultaneously. With Serkit Messenger, user can make any of its chat conversation private by single click. Also, user can have both private and public conversation simultaneously.
Android: goo.gl/cGGKD9 iOS: goo.gl/d7iUec
I am looking for feedback on which market segment I should target first and how. Please advise.
Really appreciate your help.
Thanks, <comment><USER2> Aside from lack of security design, there is a contrast between putting privacy as a priority aspect of your app and number of permissions it requires!

<comment><AUTHOR> Amir, Thanks for your response.

COuld you please provide little more details on your comment?

What do you mean by lack of security design? Are you suggesting, the app needs to ask for less permissions during install or during the operation?

<comment><USER2> Yes, if private-ness of the conversations is a selling point for your app, your target market includes mostly of people who are concerned about how their data is being collected/used. By asking to access to pretty much everything that you can on Android, I dont see why people might install this app. I hope this helps:)

</comment></comment></comment><comment><USER3> I saw no mention of the security design, so I can only conclude it provides no real privacy.

<comment><AUTHOR> Thank you for your response.

For security design, do you mean encryption? We do TLS encryption of the messages once they leave the device (similar to most other messengers). Do you think we need to somehow provide this information to user?</comment></comment>


Let's be honest about our tech industry privilege - <AUTHOR> http://www.sfexaminer.com/lets-honest-tech-industry-privilege/ <comment><USER2> If the word privilege has a one to one correspondence to the word success, as in high profits and wages, then maybe the people who use the word privilege are asking the wrong questions.

Maybe they should be asking why growth and wages are non-existent in areas outside of the tech industry.

I mean if you had a solution to that it would lift all boats, right?

Otherwise it just looks like the politics of envy to me and that just leaves a sour taste in people's mouths.

I don't think this form of politics can even begin to work because frankly the profits of the tech industry are not high enough to help everybody suffering in this wage stagnation most people are affected by.

To be perfectly honest when I hear the word 'privilege' it is difficult not to notice it nearly always coming from people who are only slightly less fortunate, if that is the right word, than tech sector employees.

The hard truth is that the computer industry (and a small number of other industries, like fracking or solar) is just an oasis of success/privilege, call it what you will, in an ocean of misery and diminished expectations.

This isn't the fault of geeks or venture capitalists. It is a much bigger systemic problem that even generous distribution of wealth cannot solve for.

<comment><USER3> I agree wholeheartedly with your sentiments. Its not like tech industry these days is some oligarchy of exclusion either. The knowledge to learn and break into the industry is literally at the fingertips of billions.

It often feels like the people the people preaching about others privilege fail to see their own good fortune.

</comment></comment><comment><USER4> "Let's be honest" implies people are denying the perks of the jobs or living in the area. I haven't seen any such denial.

</comment><comment> chair-law > _It's pretty clear all of the advantages we can possibly have in the S.F. > tech scene. But what about the techies that don't have it all? No one talks > about the lack of privilege for black men and women, or for women in > general. What about the people who went to state school for undergrad and > never went to grad school? And the people who didn't get into YC and are > trying to raise money?_

I can empathize with this point. Coming from a state school, and parents who don't have a ton of money, I've found it challenging to break into a better paying job. I'm doing an internship with a pretty decent company. They are a giant bank, and our application is used by tens of millions & the work is enjoyable. However, just today I spoke with a new hire, and he only makes $85,000/yr. I am unsure if I should look for full-time work in another city like Raleigh, NC, where $85,000 would not seem like a compromise. I am just worried I won't be able to find as good of people to work with/ as interesting of work.

I would love to get into a startup, but found all of the interviews I had at smaller companies to end with, "We do not feel you would be a good cultural fit." I am unsure if the solution is to just be less ambitious, and settle for what I have worked for.

</comment><comment><USER5> Not sure if gloating or apologising?

<comment><USER6> Maybe just badly written. A lot of words to describe something no one has contested and a mention of those without the privileges as an afterthought.</comment></comment>


How To Tell A Story With Code - <AUTHOR> http://www.twilio.com/blog/2012/08/how-to-tell-a-story-with-code-2.html

<comment><USER2> "This Gist brought to you by Github"

... there's got to be a less annoying and less intrusive way to say that. Maybe a hover-over?

</comment><comment><USER3> Twilio uses Flask framework ? Awesome if yes!!

<comment><USER4> My company's entire backend, both halves of it, are built on

(Redis, MongoDB) <\- Flask -> WSGI -> Apache.

It has treated us very, very well.

<comment><USER5> Why apache and not nginx? Not trying to hate on apache, I'm about to launch a similarly designed product but we're going with nginx due to speed and concurrency concerns.

<comment><AUTHOR> To pile on, check out using nginx as the front HTTP server and use gunicorn for the WSGI serving. Very performant on virtual hosts as a static/dynamic combo.

<comment><USER4> Familiar with it, no thanks. Apache + mod_wsgi is still better for a variety of use-cases.</comment></comment></comment></comment></comment>


Manage AWS costs on non-production environments - <AUTHOR> https://microtica.com/aws-cost/ <comment><USER2> Woah, No! Stop. Their homepage claims _" Grant us least privilege permissions to your AWS account(s)."_

But then their docs [1] give you this admin policy to use.

      {
        "Version": "2012-10-17",
        "Statement": [
            {
                "Effect": "Allow",
                "Action": "*",
                "Resource": "*"
            }
        ]

}

[1] [https://microtica.atlassian.net/servicedesk/customer/portal/...](https://microtica.atlassian.net/servicedesk/customer/portal/1/article/109215872?src=-140889264)

<comment><USER3> Since with Microtica you could provision any kind of AWS service the policy mentioned in the documentation is left to be more open so you can tryout fast and then when you figure out what you need the access could be reduced.

Ultimately, the user has the complete control over what access he will give to Microtica.

Since this policy was primarily intended for DevOps module, and Cost Optimizer needs only a subset of those permissions we will update the documentation to avoid the confusion.

<comment><USER4> No, please just no. Don't give anybody outside of your org full admin permissions. Putting a bad example is bad, and also show their incompetences. At least they can put a red giant box to warn people, not expecting everybody know not to do it.

<comment><USER5> I avoid giving _myself_ admin permissions except when absolutely necessary. I created a "read only role" with no permissions and then started adding permissions to it as I run into issues.

I log into our management account and switch to the read only role for our prod account. If I have to switch to admin role I have the toolbar display as red.

If I'm that paranoid about me making a mistake, why would I trust a third party with those rights?

<comment><USER3> Just realized that the example with CLI in the docs have the right policy with least privileges. Somehow the part with the full access was overlooked. We just updated the documentation.

I completely agree with your approach, we also encourage our users to start with the base permissions and then give more when necessary. Even more, to give an access only on resources provisioned by our system. As we automatically tag all resources, using IAM policy conditions this could be easily done. The control is always on the user's side.

</comment></comment></comment></comment></comment><comment><USER6> Perhaps there's some value in this offering, but it's not hard to configure automatic scheduled startup/shutdown of EC2 instances just using what EC2 offers. You can leverage AWS tagging to single out which instances are to be started up each morning. Shutdown is easy, as any operating-system can be configured to auto-shutdown in the evening.

This isn't as straightforward as it might be - it takes a blog-post to explain it: [https://schen1628.wordpress.com/2014/02/04/auto-start-and- st...](https://schen1628.wordpress.com/2014/02/04/auto-start-and-stop-your- ec2-instances/) , [https://www.thinkforwardmedia.com/automating- ec2-instances-a...](https://www.thinkforwardmedia.com/automating- ec2-instances-aws-lambda/)

My own notes and a relevant AWS Lambda script, in Python: [https://pinboard.in/u:MaxBarraclough/b:f0b059256f32](https://pinboard.in/u:MaxBarraclough/b:f0b059256f32) , [https://gist.github.com/MaxBarraclough/211e569cb57b46c0ddb48...](https://gist.github.com/MaxBarraclough/211e569cb57b46c0ddb481f6adcefdd1)

<comment><USER3> Probably if you have a couple of accounts and infrastructure units then probably you could set up similar configuration which will do the job. We at Microtica also started with that approach but as we started to expand with AWS accounts and multiple infrastructure units it become hard to manage all of it.

Imagine if you have to use different tags as selectors with different schedule times for each. You would have to control each of them through CloudFormation or even manually log into EC2 instance to update the script.

In addition, the solution provides few more benefits: 1\. Auto-tagging 2\. Native integration with infrastructure provisioned with Microtica 3\. Cost and Saving dashboard 4\. You don't need to manage your own infrastructure which will handle start/stop operations for EC2 and RDS 5\. Schedule notifications

<comment><USER5> Why would I trust any company that is reckless enough to recommend giving their service full access to my account - with _any_ access to my account?

</comment></comment></comment><comment><USER7> While I think this is a cool idea, I'm really not sure how it works after reading through the features page and the landing page. I can't tell which resources it spins up and down. The listed supported components like DynamoDB and S3 seem like strange choices here -- I'm guessing S3 shifts objects to Glacier and restores them and DynamoDB changes provisioned capacity, but I've walked away with more questions than answers.

If anyone here is on the team, can you provide a bit more details as to what's happening behind the scenes?

Maybe I am misunderstanding the product and it's really an orchestration tool around when an environment is spun up and down, but then I'm having a hard time seeing the benefit over CloudWatch Events -> Lambda -> Pipeline.

I discuss issues like this with customers regularly, and I'd really love to be able to introduce this into conversations, but I need a bit more to go on :)

<comment><USER3> Hi, I am Rade from Microtica.

The benefit of Microtica Cost Optimizer over using CloudWatch+Lambda comes when you have to manage more different schedules. With CloudWatch+Lambda solution you also have to manage the schedule infrastructure no matter how simple that infrastructure is, this could become an overwhelming repetitive task.

We added additional features like: 1\. automated resource tagging 2\. enable/disable schedule 3\. manual start/stop of resources assigned to a particular scheduler 4\. cost and saving dashboard 5\. notifications

Cost Optimizer is just one feature of the Microtica product. Microtica is a DevOps automation tool that you can use to provision complete cloud infrastructure and deliver applications on Kubernetes using CI/CD.

The components you are referring are ready peaces of infrastructure that you can just pick up, combine and provision in the cloud.

Behind the scenes, we register a schedule in our system and when start/stop event is fired, first we obtain temporary credentials (assume role) for the AWS account where resources to be scheduled reside, then we call AWS APIs to perform scheduling operations over EC2 and RDS.

<comment><USER7> Thanks for the explanation!

</comment></comment></comment><comment><USER5> We just went through an exercise on saving costs by shutting down resources in our development environments. I looked over our bill and found the following:

\- most of our costs for Aurora was data. Shutting down the database didn't save us too much of anything. We were already running some of the smallest instances. Aurora Serverless wasn't an option. It was missing features we needed.

\- We only had a few small T* pet servers in DEV that we could shut down.

\- Most of our greenfield projects are either Lambda (no cost when you aren't using, very cheap when you are) or Fargate (Docker). We could iterate through all of our clusters and set it to 0 at night and spin them back up as needed I guess

\- You can't just shut down your ElasticSearch cluster.

\- Do you really want to deprovision load balancers and your NAT gateway?

Did I mention that we have an entire team that works opposite hours than we do?

-

</comment><comment><USER8> A problem I see with this in big teams is people working different hours and want to use an environment in the middle of the night.

Don't even need a big team actually, just takes 1 person who decides they want to do some work during a 'sleep cycle'. Pretty common where I work, you never know when someone might be interested in picking up some work.

<comment><USER9> For some lab environments, we've simply configured automatic shutdown after hours if and only if nobody is working. If the system is in use, it is not shut down. Then the system is started again on demand. Spin up time is so quick that there is no value in pre-starting.

This is working well. A few guys used to complain about having to wait for that first boot, but in reality, it's almost always the same guy who's first in the office that gets it started, so complaints quickly went away.

<comment><USER8> Yeah this makes sense, better than a system where you have to enter dead hours

</comment></comment></comment><comment><USER10> Why flagged? This is a good service. There is also skeddly that does this, we rolled our own because we needed auto scaling and sleep and then we needed load based auto scaling.

</comment><comment><USER11> How is this different to aws instance scheduler?

<comment><USER3> Hi,

The scheduling part is close to AWS instance scheduler solution. The added value of Microtica Saving Schedules is that it's much easier to manage compared to aws saving schedule where you have to update CloudFormation whenever you would need to change configuration. This could become hard to manage especially when you have multiple accounts and multiple different resource groups with different schedule configs.

On-demand start/stop of resources associated with the schedule is also something that is hard to deal with when solution is done with CloudFormation.

We also added additional features like: 1. automated resource tagging 2. enable/disable schedule 3. cost and saving dashboard 5. notifications

</comment></comment><comment><USER5> How did spam end up on the front page of HN?

<comment><USER6> How is it spam? Do you think their product adds no value? Posting startups isn't just permitted, it's part of the point of HackerNews - [https://news.ycombinator.com/newsguidelines.html](https://news.ycombinator.com/newsguidelines.html)

<comment><USER5> The link was to an uninformative marketing page. I couldn't tell for the life of me what it actually does or how it works and I know the ins and outs of AWS pretty well.

<comment><USER3> We are a startup trying to get more and more feedback and provide a solution that would help the developers community and business. I don't understand how sharing a feature from a product can be considered as a spam.

You can find more information about our cost optimizer in this blog post: [https://microtica.com/reduce-aws-costs-on-non-production- env...](https://microtica.com/reduce-aws-costs-on-non-production- environments/)

<comment><USER5> This page is at least somewhat informative. But, it wasn't until I saw the more granular permissions after you edited the policy did I get some idea of what you are doing.

If you are aiming at a technical audience, the first thing we all did was look at what permissions were required because our first concern was security. Especially if we are handing over cross account permissions.

The second thing I want to know is how you are doing it?

But honestly, if you have a cloud native implementation like we do, just controlling EC2 and RDS only scratches the surface. We have DynamoDB, Fargate services, ElasticSearch clusters, Redshift clusters, etc.

<comment><USER3> Actually, we launched cost optimization when we realized most of our users required simple out of the box solution that will save on infrastructure provisioned by Microtica, they spend mostly EC2 and RDS compute resources. Because it is fully integrated, with couple of clicks they could start saving, no need for additional tools or custom solutions. But we realized it could work for any infrastructure.

We wanted to start with something. There are other aspects of cloud cost optimization like rightsizing, unused resources, use of spot and reserved instances that are as important as instance scheduling. As well as additional supported services you've mentioned that we are planning to support in the future.

The solution is fully serverless, the scheduling as you are already familiar, is based on triggers that initiate calling certain AWS APIs to manage state of the resources. On top of it, we added support for enabling/disabling the schedule, on-demand start/stop of resources in case somebody needs the environment immediately, auto-tagging, cost per schedule etc. all integrated in one solution.

There are tools similar to ours on the market that could solve more complex saving workflows but are also more complicated to manage and are pretty expensive.

If you are interested in how it works, feel free to try it out it's free. Any feedback is welcome.</comment></comment></comment></comment></comment></comment>


Iran general Qassem Suleimani killed in Baghdad drone strike - <AUTHOR> https://www.theguardian.com/world/2020/jan/03/baghdad-airport-iraq-attack-deaths-iran-us-tensions <comment><USER2> Some context here:

This guy was directly responsible for hundreds (maybe over 1,000) U.S. Soldiers killed in Iraq by shaped charge IEDs manufactured by Iran and its Iraqi proxies. He also orchestrated clandestine raids and kidnappings, like the one that happened in Karbala in 2007. [0]

He was also responsible for the deaths of untold numbers of civilians in Iraq and Syria at the hands of Shia death squads and Shia militias/paramilitary forces. These are people who kidnapped innocent Sunni civilians off the streets and drilled holes through their skulls to kill them. (Sorry for the graphic description there, but this was ugly war)

He was in charge of the Quds Force, which is like the American CIA and Special Forces Command combined. But, he's far more important than his Major General (2-star) rank implies. He's probably the second-most powerful person in Iran. Equivalent in strength to a Vice President, but much more behind the scenes. This is huge. Imagine if David Petraeus secretly ran _everything_ that the US did externally and then some nation killed him.

More context here: [https://twitter.com/yashar/status/1212913366492016640](https://twitter.com/yashar/status/1212913366492016640)

[0] [https://en.wikipedia.org/wiki/Karbala_provincial_headquarter...](https://en.wikipedia.org/wiki/Karbala_provincial_headquarters_raid)

<comment><USER3> It's hard to imagine what the response is going to be. I don't think a lot of people realize who this guy was or what this represents. (A lot of people are probably confused about what an Iranian general is doing in Iraq in the first place.)

I can only hope for the best outcome being something like Iraq asking us to leave, and then largely falling into the fold of Iran. And hopefully that not being opposed by the US (unlikely) and it being all the victory Iran needs. Maybe something like that.

The alternative at a minimum is going to be many more lives lost and billions spent. At the other end of the spectrum tens of thousands of US lives, hundreds of thousands of Iraqi and Iranian lives, and trillions more in US dollars thrown on the fire.

<comment><USER4> Why would the best outcome be the specific thing this action was made to prevent - the overtaking of Iraq by Iran?

<comment><USER5> I don't think that's the specific outcome this action was intended to prevent. I think it was intended to prevent this guy from orchestrating any more killing of Americans. I think it was triggered by this guy's people killing an American contractor last week.

</comment></comment></comment></comment><comment><USER6> I feel very conflicted about this. This man has an insane amount of blood on his hands but I cannot help but feel anxious about what happens next. Iran's paramilitary forces have entanglements in Syria, Lebanon and Yemen... this seems to be the type of thing that could spiral into a regional conflict if cooler heads do not prevail.

</comment><comment><USER7> Why are both the Guardian and NBC articles flagged? Is anyone actually questioning the content of those articles? It looks like both Iranian and US officials confirm them.

<comment><USER8> There are quite a few HN readers who consider any political news off-topic.

</comment></comment><comment><USER9> There is something philosophically unsettling about drone strikes. Violence, particularly mortal violence is naturally self-policing in nature. In order to kill something you must be there and risk injury yourself. Technology based distance attacks like drones and missiles remove this doubley: you not only de-risk your person, you are also more emotionally distanced from the attack as well.

It is not a trend that bodes well for humanity in the future.

<comment><USER10> its interesting in that, you can happily hurl big rocks at people in castles via catapults while being unable to see what /who you're hitting and be perfectly safe, yet you might not (I know i dont) have an issue with it like you (and I) do with drones...

its basically the same thing. just an upscale in range, and really safe distance is safe distance... doesn't really change the situation when you add more 00's to the distance.

<comment><USER11> Iran is not sieging our castle, that is the key difference. We are the aggressor, even if the acts of the other side are morally repulsive

<comment><USER12> They were sieging our embassy...

<comment><USER13> In basically their territory. Why do we need a presence or embassy there? Why waste the money? Does Canada have an embassy in every nation? Does France? What about Sweden and Denmark?

If we absolutely need a presence why not have coalition embassies? A single office w/ 1 member from each coalition country, and equal soldiers from all countries and diplomatically making unilateral decisions as a group not based on any country's agenda.</comment></comment></comment></comment></comment>


The challenges of hydrogen for airliners, part 2: ecosystem - <AUTHOR> https://leehamnews.com/2020/07/31/bjorns-corner-the-challenges-of-hydrogen-part-2-echosystem/ <comment><USER2> Two sorts of questions for those who support this idea

1) If is is so workable, then why don't we have hydrogen test planes flying today? Are there any technological problems that remain to be solved?

2) How is hydrogen supposed to be better than synfuel kerosene produced with renewable energy? And note than any argument must include the cost of replacing every current airliner with an all new hydrogen one, as opposed to keeping the present airliners.

</comment><comment><USER3> I like hydrogen and support trying it in aviation (the Soviet Union actually had an airliner that ran on liquid hydrogen, so this isn't really that new of an idea), but I really don't see how hydrogen can compete on economics with fossil fuels.

<comment><USER4> Thus far several companies have experimented with H2 aircraft and come to the conclusion that it doesn't make sense with current technology.

<comment><USER5> New insulation technology changes the balance. Practical aerogel production means that heavy, shape-constrained high-pressure tankage is no longer needed, so that tanks may now be light and have the most convenient shape.

Furthermore, recent advances in catalysts for hydrolysis, some directly from sun exposure with no detour through electric form, make production of hydrogen from water and light practical.

New airframes with lifting-body designs, already better than those used now, have more room for tankage as a side benefit.

The practicality of any idea can change very, very rapidly, as details of solutions to engineering problems change. Recently solar and wind power were impractical. Now they are cheapest, and coal-fired power is impractical.

<comment><USER2> Is anybody building a plane that makes use of these new technologies?

<comment><USER5> No. At least not that they are telling anyone about. But there is plenty of evidence people equipped to do something are thinking about it.

</comment></comment></comment></comment></comment><comment><USER6> Bring back the Zeppelins:) There's lots of missions they can do besides passenger carrying, and they do it better than aircraft.

</comment><comment><USER4> I'm not seeing much advantage of running off of H2 instead of a biofuel like ethanol, especially if we get switchgrass or other less energy intensive forms of biofuel production off of the ground.

H2 has so many storage and handling challenges that are going to be compounded when weight is an issue that its hard to see its future in the airline industry.

<comment><USER7> The problem with biofuels in aviation is that the most common available forms have... problems with storage and weight of the system. Because ethanol evaporates too fast, which is the same reason why aviation still uses leaded gasoline, and why ethanol additives are very limited.

Remember, aviation fuels need to work way above 10km above sea level.

<comment><USER3> I'd assume ethanol would be converted to something like kerosene, since that's what jet engines burn anyways. But without regulation I don't see the incentive to use biofuels. They're significantly more expensive and don't offer any performance benefits. Hydrogen has the same problems btw.

<comment><USER2> One gigantic advantage for synfuel kerosene that is carbon-neutral because it is produced with renewable energy, is you can continue to use the present airliner fleet. With hydrogen you have to spend many trillions of dollars replacing it.

Furthermore, replacing all the planes would take many decades, while synfuel kerosene might go into production much sooner.

Do the hydrogen airliner boosters take all that into account?

<comment><USER8> > Do the hydrogen airliner boosters take all that into account?

Sure, and other things too, like combustion benefits and hazards. But regarding your money worries - they don't need to happen overnight, just like electric cars don't replace gasoline ones suddenly.

Hydrogen fundamentally more potent fuel than kerosene - both by energy density and heat characteristics. Like with other commercial technologies, to be accepted it has to change traditions somewhat, which isn't easy. Safety is another important matter - it remains to be seen if hydrogen can be safely brought onboard to regular commercial liners, though advancements demonstrated by Toyota Mirai remind that progress doesn't stand still.

<comment><USER2> It may well be that hydrogen is the fuel of the future for airlines. The problem is that with the rate global climate change is happening, we can't wait decades for a solution. We need something as soon as possible, and as far as I can tell, synfuel kerosene could replace fossil fuel kerosene decades sooner than hydrogen could. Do the hydrogen boosters address this concern?

</comment></comment></comment></comment></comment></comment><comment><USER9> I realize that this very different, but hydrogen is very negatively associated with aviation.

<comment><USER4> Don't worry, nothing could ever go wrong with pressure vessels filled with heavily compressed explosive gas, especially in an accident.

<comment><USER5> Thus, don't compress it.

<comment><USER4> Bring back Zeppelins?

<comment><USER5> Current discussion focuses on liquifaction, which enables transport without high pressure.</comment></comment></comment></comment></comment>


Recent Site Isolation Improvements - <AUTHOR> https://blog.chromium.org/2019/10/recent-site-isolation-improvements.html <comment><USER2> Side channel attacks sure have the tendency to introduce security vs performance tradeoffs. But it looks like they've made a pretty reasonable decision by turning it on for only capable devices, and by starting with highly-sensitive sites.

I definitely prefer this to the original Spectre fix of simple disabling highly sensitive timers. As far as I know, other browsers are still using that solution.</comment>


What's the best database for an analyst? - <AUTHOR> https://blog.modeanalytics.com/best-database-for-analysts/ <comment><USER2> Clearly TFA is just linkbait for a query tool which costs 249 USD/month/user.

<comment><USER3> This clearly looks like very basic PR and makes me wonder if the upvotes are fake here.

</comment></comment><comment><USER4> What an absurd question. The database should fit the data, not the analyst.

</comment><comment><USER5> What is going on with SQL Server there? I moved from MySQL to SQL Server and there's been a handful of gotchas but for the most part it's been an incredibly simple transition -- SQL Server is as close to MySQL as Postgres is in terms of query language, I should think, certainly closer than Redshift or Vertica are -- but the pairwise comparison doesn't bear it out. The author also talks about SQL Server distinct from MySQL or Postgres, which he kinda lumps together. It's rather baffling to me.

<comment><USER6> I am interested in seeing what Microsoft does with the R integration I to SQL server. Will we able to run models on large tables?

</comment></comment><comment><USER7> So this is analyzing Mode's users queries to make some conclusions about what's best for analysts. How do we know Mode users are representative of a typical analyst for any given SQL variant? Perhaps their Vertica users have complex data and the queries are thus more complex, and the MySQL users are dealing with something more straightforward so use simpler queries. This doesn't necessarily mean that MySQL is better for every analyst just because certain Mode users wrote simpler queries.

As others mentioned this seems like advertising or something. Maybe some VP somewhere will look at this and go "oh man we gotta use a better database, and oh look, let's buy some Mode licenses because I like dashboards."</comment>


Black Hat Python: Python Programming for Hackers and Pentesters - <AUTHOR> https://www.amazon.com/gp/product/1593275900/ref=as_li_qf_sp_asin_il_tl?ie=UTF8&tag=cioreview-20&camp=1789&creative=9325&linkCode=as2&creativeASIN=1593275900&linkId=781b2847dd79498ea6e67b78e64834d6 <comment><USER2> Brilliant! So now we're posting Amazon links as news stories</comment>


Lyndon Johnson's Unsung Role in Sending Americans to the Moon - <AUTHOR> https://www.newyorker.com/news/news-desk/lyndon-johnsons-unsung-role-in-sending-americans-to-the-moon <comment><USER2> Good article, and I agree that Kennedy's speeches are generally associated with the push for the Apollo program ("We choose to go to the Moon..."), but I would hardly say that LBJ's role was "unsung". They did rename the Manned Space Center in Houston to the Lyndon B. Johnson Space Center (JSC) in 1973. All flight control of the Apollo, Space Shuttle, and ISS operations have been, and continue to be conducted there. Kennedy's tragic assassination (56 years ago, yesterday) increased the public focus on "fulfilling Kennedy's dream", a glimmer of hope the American people needed after such a terrible event. True, LBJ isn't the individual most people first associate with the Moon landings, but for Apollo-geeks like me, Johnson's name and role are quite evident.

</comment><comment><USER3> Without LBJ, we wouldn't have had the Space Program, the various civil rights bills of the 60s, or Medicare. He also escalated Vietnam from a minor conflict to a major disaster.

Most impactful President since FDR, easily, yet he doesn't get half the press of Reagan or Nixon.

</comment><comment><USER4> Lyndon Johnson is complicated. The NASA budget was significantly increased, and the civil Rights act was passed. But he also increased the US military presence in Vietnam from around 5000 to a peak of 500,000 in country armed forces, and dramatically escalated the Vietnam war. Hundreds of thousands of fatalities on both sides of the war are directly attributable to his policies.

<comment><USER5> If there's a President that isn't complicated, he probably wasn't a good President.

It's like I always tell people: being a nice guy isn't a prerequisite for the job, and the President usually isn't a nice guy. He's the Commander in Chief of the United States Military.

</comment></comment><comment><USER6> [http://archive.is/BnRD6](http://archive.is/BnRD6)</comment>


Portugal's growing number of young entrepreneurs - <AUTHOR> http://www.bbc.com/news/business-29027462 <comment><USER2> It could be much better if the tax system was sane.

Let's say you want to do some freelance work for someone. In Portugal you have to register your service ("abrir actividade") and use an oficial invoice booklet provided by the government ("recibos verdes") to invoice your customers. You need to pay a substantial amount of social security and income tax ( a designer friend was making around €1000 a month and paying almost €500 per month in taxes ), and if you stop trading and forget to tell the government, even if you have zero income you need to pay the minimum social security ( around €60 per month ) just to be registered as a service provider.

Basically, you are taxed pre-emptively wether you make any money or not. This stops a lot people from even trying to sell their services as freelancers, let alone start a company ( can't imagine the tax labyrinth that must be ). Sometimes I want to hire a friend for a small gig and they refuse because they can't afford the social security bill incurred in being a registered service provider.

This is killing the formal economy, stifling entrepreneurship, and it's also driving more and more people to informal contracts with cash transactions that deprive the state of needed income. I won't even talk about the crazy income tax band system we have...

<comment><USER3> This sounds similar to Spain. I would like try out a few (small scale) business ideas, but the taxation system means that I will have to be fairly sure of a profit before I can start working, otherwise it could be a lot of wasted money just to see if things work or not.

</comment></comment><comment><USER4> (Just a short note on an irksome phrase in that piece:)

 _" This is because in Portugal owning your own house or apartment has always been such a matter of pride that it is the first choice of most people, even young adults."_

That's if "always" means "as far as I can remember", written by a fairly young writer. Fifty years ago renting was the most common mechanism in Portuguese cities, until rent-control (first instituted before 1970's inflation) nearly killed it, and state-subsidized bank mortgages became the norm. Unsurprisingly, forty years of that contributed to the economy crash.

</comment><comment><USER5> In times of economic downturn there is always an uptick in newly minted entrepreneurs. Some of them will make it, most of them will not and will be re-employed in at most a few years. Think of them as the unemployed that refuse to give up, and that alone makes them worth watching, they're fighters, but that doesn't change the stats too much in their favour. Something similar is happening in Spain.

</comment><comment><USER6> When a bunch of people have nothing to lose they can do impressive things. In this case, nothing to lose means that they don't have good employment prospects not because of personal failings but rather macroeconomic or structural problems. When there's little to no opportunity cost to trying to start your own business it shouldn't be surprising that so many do try.

<comment><USER7> There's a flip side to that coin, which is that there are a lot of "incubators" set up to purportedly support Portuguese startups that have delivered (statistically) zero successes - there are exceptions, but as far as I know they're not portrayed in TFA.

Regardless, it bears noting that there are more, standalone, bona fide startups out here trying to make it, and fortunately not all of them are relying on the app bubble keeping up.

<comment><USER8> UPTEC last year accepted 165 new start-ups and 22 managed to gain independence and become self-sustained. A success rate of 13% in the start-up world is not that bad...

[https://translate.google.com/translate?sl=pt&tl=en&js=y&prev...](https://translate.google.com/translate?sl=pt&tl=en&js=y&prev=_t&hl=pt- PT&ie=UTF-8&u=http%3A%2F%2Fuptec.up.pt%2Fnoticia%2Fimpacto-das-empresas-do- uptec-no-pib-chega-aos-32-milhoes-de-euros&edit-text=)

</comment></comment></comment><comment><USER9> Realmente hoje em dia tenho muito pouca idea de como as coisas estejam, mas admira-me que a malta toda (que possa fazer apps) não-se tenha despachado prá Alemanha e a Inglaterra.

<comment><USER10> If you write something in another language (and it is not a right thing to do in a international board that obviously use English as only language) at least translate it to make others understand.

<comment><USER9> I don't really understand this sentiment. I'm clearly targeting fellow portuguese speakers on a low traffic thread. It feels… weird to be policed for my choice of language.

Can you explain why it feels rude to you?

<comment><USER11> Because if everyone starts doing that, no one will understand anything in this community.

<comment><USER12> I wish the bad posters here would start writing in another language. Maybe Klingon.

</comment></comment></comment></comment></comment><comment><USER13> Most of them were totally Mo-Lo-So. Nowadays, I guess they're all So-Lo-Mo. :)

</comment><comment><USER14> I wonder what the social safety net is like in Portugal. It looks like they have national health service, so maybe dealing with employee health insurance is one worry their entrepreneurs would lack.

<comment><USER15> Public health services are sub-par, if you want the best standard of care you'll need to go private. Ironically, government workers qualify for a special health insurance, which allows them to use most private hospitals.

Also, part of your salary goes into paying social welfare, and the employer pays some of it as well (about 11% from the employee and 22% from the employer). No idea how that compares to the US.</comment></comment>


Ask HN: Who will GitHub acquire? - <AUTHOR> In the last couple of months, GitHub has really been called out for no longer innovating, and rightfully so.  This article even suggested innovation will mostly likely not come from within:
http://www.infoworld.com/article/2960468/application-development/githubs-next-big-innovations-wont-come-from-within-github.html
Given the funding they have, it does seem strange they have only acquired two companies in their history.
Is GitHub waiting for the market to tank so they can get companies/technology on the cheap?  Or has GitHub been drinking their own kool-aid for too long and don't see that Bitbucket, GitLab, Gogs, et al. are seriously catching up.
Given the cash they have, it would seem logical for them to look at acquisitions to help them regain that untouchable aura that they once had.
So who do you think GitHub will acquire? <comment><USER2> Probably a good place to start:

[https://github.com/integrations](https://github.com/integrations)

It's an incredibly sparse list though, given GitHub's popularity. Compare this Atlassian's marketplace

[https://marketplace.atlassian.com/plugins/app/bitbucket/popu...](https://marketplace.atlassian.com/plugins/app/bitbucket/popular)

which seems to include everybody, both big and small.

</comment><comment><USER3> Bitbucket (all of Atlassian) UI designers are still living their IBM days. GitLab is the major competitor I see.

</comment><comment><USER4> Maybe what's going on is they're focusing their resources toward paid offerings for large businesses and away from small and FOSS projects.

The most valuable thing Github has is the enormous portfolio of FOSS projects and all the free eyeballs that come with it. Yes, it's not paid, but because its public offerings are so popular, most developers are familiar with it and that gives it a trusted inlet to basically every software organization in existence. After all, in a non-dysfunctional organization, the guy who decides what products to buy to support their developers should give far more weight to what those developers want, than what is said by a vendor salesman whose job it is to convince them to buy a particular product.

Which means it's a mistake to neglect their FOSS users -- it seems self- evident that the biggest, best, most cost-effective way for Github to sell its paid features is word-of-mouth from its free users. It's very hard for a competitor to replicate their enormous network effect, which is also what makes it so effective. Their underwhelming response to the "dear github" letter suggests that their upper management is blind to this. I think there's a serious possibility that, in the next five to ten years, their position will be as marginalized as, say, Sourceforge is today -- long ago it was the "gold standard" in hosting services, but today it's only used by barely-maintained projects who can't even scrape together the resources needed to change their code hosting provider.

<comment><USER5> When I used GitHub Enterprise, it seemed to basically just be regular GitHub for businesses that wanted to keep their code on their own servers. What things would they be focusing on for large businesses that don't show up on the main GitHub site?

<comment><USER6> Enterprise sales. Account managers.</comment></comment></comment>


2048 game with chemical elements - <AUTHOR> http://2048alphabet.com/chemistry/

<comment><USER2> Great idea. Good game.</comment>