Giving the Behemoths a Leg Up on the Little Guy - <AUTHOR> https://www.nytimes.com/2017/05/03/technology/net-neutrality-fcc-giving-behemoths-leg-up.html <comment><USER2> What's stunning to me is seeing Ajit Pai and conservative interest groups citing the FCC's investigation into ISPs subsidizing certain types of data (a.k.a. zero-rating) as an innovation that burdensome regulation was inhibiting.

There's plenty of room for debate on what constitutes predatory pricing. But I think it's clear that when you drop the price for a product to _zero_ , there's no longer an argument that you are attempting to fairly compete in that market. The only rational reason is to drive your competitors out of business.

Pai isn't interested in a competitive market; he's told us that much explicitly. He's interested in a market where the powerful have a free hand to consolidate that power into full-on monopoly. And he's right, consumers will see certain benefits -- like zero-rating -- while that consolidation is occurring. But then, afterwards, we'll be stuck relearning the lessons of Standard Oil and Pacific Bell all over again.

<comment><USER3> > there's no longer an argument that you are attempting to fairly compete in > that market. The only rational reason is to drive your competitors out of > business.

Wait. "Fairly compete" and "drive your competitors out of business" are opposite things now? How?

Obviously, most businesses, ideally, want to be so successful so that their competitors go out of business - as long as the market is more or less zero- sum game, one always go in hand with the other.

<comment><USER4> > ...as long as the market is more or less zero-sum game, one always go in > hand with the other.

This statement derives from pure propaganda. It has almost never played out that way in history. What almost always actually happens is that once a business gets large enough, it has the power to force all of its competitors into bankruptcy or buy them out and then it gets monopoly power. Once it has monopoly power, anything goes.

There are so many examples of this just in American history up until Teddy Roosevelt busted the trusts. Even after that, there are a ton of examples of businesses being allowed to get way too close before the government got around to breaking them up.

If you want to see the clearest example what happens in an entirely unregulated free market -- look at the internet. The internet has, thus far, been almost entirely unregulated and it has the lowest barrier to entry of almost any business ever. It takes almost no capital to start an internet startup -- just the knowledge and some free time. And yet, Google has near monopoly power over search. Facebook has near monopoly power over social media. Amazon is nearing monopoly power over internet retail. In each case, they haven't wielded their enormous power in the marketplace, largely for fear of public backlash leading to regulation. If there was no threat of regulation, you could sure bet they would.

<comment><USER5> It's worse than that. There is no such thing as an impenetrable firewall between the public and the private sphere.

It's one of the areas where libertarian idealism doesn't quite work in the real world. I can't think of a way to limit the political influence of business without limiting the size and financial leverage of individual businesses. A libertarian society that fails to do this will not remain libertarian for long, since suitably large corporate entities will become the state.

Why compete at all when you can just write your own laws and tap the public treasury?

<comment><USER6> The reason why large corporate entities becoming the state is less of a problem than the actual state is because of competition.

I called the cops three times in my life (Romania), the first two times I was told "not my job" (public drunkness instances), the third time someone's life was actually in danger. They told me they're going to show up... half an hour later, I had to leave the place; they hadn't showed up. (And they never called me back, so they probably never bothered.)

I cannot fire them for that. I cannot tell them "I want to hire another company". That is the problem I have with the state. I actually don't want to bother with defending myself - I am more than willing to pay someone else to do it for me. But if the state claims to do that, I cannot go to the competition when they don't do their job.

<comment><USER5> How do you compete with a corporate entity that has become the state?

Getting back to net neutrality: you also have the concept of a natural monopoly.

A natural monopoly is something where there is an _intrinsic_ barrier to competition. In the case of telecom there is a natural monopoly over last mile connectivity because it makes zero economic sense to create more than one or two redundant last mile connectivity networks. It would also be an eyesore. Imagine huge sprawling bundles of wires or constant digging everywhere.

So for telecoms like Cox, Comcast, etc. you have a double whammy: they are natural monopolies and competition is _also_ restricted by a state over which they have achieved regulatory capture.

These companies are monopolies, plain and simple, and if they can leverage that monopoly they can effectively shut down the Internet as a venue for entrepreneurship.

<comment><USER6> If by "become the state" you mean "is supplying state-like services" (like defense), you compete by creating another company supplying the same services. We have dozens of private defense companies in Romania.

If you mean "is preventing others from supplying the same services"... if it does that by using force, we're no worse off than now. If it does that by enticing people to sign bad agreements... I can't say I like the idea, but I'm not seeing it as a big deal long-term.

> In the case of telecom there is a natural monopoly over last mile > connectivity because it makes zero economic sense to create more than one or > two redundant last mile connectivity networks

And yet, I have one ISP that put up 7 km of fiber optics, that have been stolen several times, in order to get my business. (I live in the country side.) I had another ISP that put up 15 km of regular cable for the same reason. (I no longer use them because at some point I had 3 ISPs and I was trying to cut costs. I honestly regret that now that I'm making a lot more money.)

</comment></comment></comment></comment></comment></comment></comment><comment><USER7> Perhaps it is time to split up companies - FB + WhatsApp, Google + YouTube, Microsoft + LinkedIn and add your own little favorite here.

If the tech sector tends to move towards natural monopolies and cannot generate its own competition, the competition has to be foisted on it. It is a better alternative than the consolidation of so much power into the hands of such a small group of people.

Although, frankly speaking, it is probably a bit too late. At this rate, large tech companies generally, and the megacorps in particular, are probably going to have a "Let them eat cake" [1] moment over the coming months, and the consequences will be worse than the mere breakup into smaller entities.

[1] I have heard that it is an invented anecdote. Necessity is the mother of invention, and there has been a clear need to express how out of touch certain groups of society can become sometimes. Cue the ostrich-like response of company employees to genuinely troubling complaints against privacy issues on these forums.

</comment><comment><USER8> I see the problem being that if net neutrality disappears it gives the internet companies good reason to slow down the internet generally so that the content providers need to purchase the speed ups. Investment in general network throughput will reduce profit from fast lane sales and so big companies will reduce investment in their networks outside of fast lanes. Cost flows down the tree. We are already paying for the internet... does it make sense to pay twice? This is why I think no consumer should be for the axing of the net neutrality rules. In general this is bad for everyone. Its like creating an energy market... It leads to people reducing generation capacity and prices sky rocketing while service/quality reduces. Good for the ownership class bad for humanity.

<comment><USER9> As far as I can see energy markets work well in Europe. It started in Norway as far as I know (not exactly the bastion of free markets) then spread across Scandinavia and down to Continental Europe.

How it works in Norway is that all power producers sell their power on an exchange where before 12 each day they specify the volume they will produce depending on the price for each hour the next day. All bids are compared to see who will produce how much. Price your power too high you don't get to sell any power, price too low you loose profits.

Among the buyers on this market are power resellers that sell to consumers. As a consumer I can buy from any reseller regardless of my grid provider. This makes resellers highly competetive and a consumer only pay a few cents above the exchange price per KWh (depending on contract and the type add ons the manage to sell you)

The grid owner charge a fix connection fee together with a per KWh fee. My guess is that both fees are regulated.

I guess the markets in other parts of Europe work quite similar. It is hard to know what the prices would be if the market was not in place but energy production has in the last few years gone from being very lucrative to be much lower margins.

This is not an argument against net neutrality though. Only wanted to point out that energy markets can and do work.

<comment><USER10> One important thing to note that this is not in any definition a "free" market. IIRC producers cannot directly sell to consumers, grid providers cannot easily set up new power plants, the pricing is done in a VERY regulated way...basically the whole system is set up to be _competitive_ not _free_. This distinction is something which I feel is often lost.

</comment></comment></comment><comment><USER11> If net neutrality dies completely, Apple will take its 1/4 Trillion and buy a cable/phone company. Google likely will too. It's cheaper than having their customers balkanized all over the place and having to pay monopoly rates to be allowed to connect to them.

<comment><USER12> Honestly yes, this is likely to happen, because the alternative of the telecoms making their own android phones that use their own ad networks and web search and bleeding out the internet giants with pure market power is too much of an existential threat without their own carrier for negotiation purposes.

Then we would have massive cash-out days for all the holders of carrier companies. Maybe these new subsidiaries of the frightful 5 would actually compete with each other? Or the ones that don't stumble in the transition at least.

But of course we could have a totally different regulatory environment in 4 years.

</comment></comment><comment><USER13> "Every year, the internet gets a little less fair" might not apply to every locale. USA is not all of the internet, it's important but not even very big.

If ISP BigCo's break it seriously, USA will start to falling behind the world (internet connectivity is already not great), notice that, and probably fix something.

</comment><comment><USER14> Frankly, these journalists are part of the problem. Pulling up their publishing history, all you see them writing about is Amazon, Facebook, Google, and Microsoft.

In that type of PR environment, it is hard to see other startups rising up unless they raise massive amounts of money which gets them PR. Every year the bar gets higher and you never see them writing about new and exciting companies working on interesting projects on a consistent basis. In the end, most of these tech writers are not journalists, but ghostwriters for the big tech titans.

<comment><USER15> So the real problem isn't global corporations using lobbying power to suppress competition, it's journalists who write boring articles.

<comment><USER16> > Frankly, these journalists are part of the problem.

Translate to "So the real problem isn't global corporations"

I probably will be downvoted, but you better refine your way of commenting...

<comment><USER17> Ehh, plenty of blame to go around. I'm happy to see both discussed here.

</comment></comment></comment></comment><comment><USER18> Maybe, as someone previously replied to me[0], Verizon really will become a tech giant on par with the other 5...

[0] [https://news.ycombinator.com/item?id=13855461](https://news.ycombinator.com/item?id=13855461)

</comment><comment> trey-jones I'm big on the free market, laissez faire, and deregulation. As with many topics that incite so much handwringing in congress (health care being another great example), many of the problems would likely solve themselves if regulations protecting giant corporations from competition were done away with. If it were possible for startup telecom companies to compete with the big 3, then the competition in telecom would likely enforce net neutrality on its own.

In other words, we are spending a lot of time and effort debating the wrong problems here.

No system is perfect, but I will always lean towards less is more when it comes to regulation.

<comment><USER19> > If it were possible for startup telecom companies to compete with the big 3

One reason to regulate markets is to preserve a competitive environment where this is possible. Big, dominant players in a market want less competition, not more, and left on their own they find ways to prevent it.

Look at how Microsoft used the Windows monopoly, for example, to eliminate competition in office suites and web browsers. They made it technically difficult for customers to use other products, they pressured vendors into selling Microsoft's products over others', they used their OS monopoly to give them a technical advantage in applications that ran on it, they distorted open standards to lock in their products ('embrace, extend, extinguish'), etc. It took a government lawsuit to open the web browser market and even that was too late for the competition, who were out of business. (The office suite market never again had competition until maybe the online suites now, and I don't know how much market share they have.)

> competition in telecom would likely enforce net neutrality on its own

I don't see why that particular outcome would be likely. Plenty of industries do things, sans regulation, that are bad for consumers and that consumers don't like. Look at the fraud in the financial industry, for example, or the privacy problems in IT products, or all the nightmares of the health insurance industry.

<comment> trey-jones Maybe I shouldn't have been so generally anti-regulation in my initial post; I am specifically referring to regulation that exists solely to protect large corporations and their monopolies - these do seem to be more common at the state and local level.

Your points are taken.

</comment></comment></comment><comment><USER20> A few months ago there was a story about starting an ISP on Hacker News [1] and the comments section was about how hard it is to start one. What if these rules allow someone to build a new ISP and take some of the advertising profit from some of the big companies like Google ? Google can afford to lose some money and perhaps it could improve the ISP competition in the US.

Also reading about the general history of the Internet, even though initial work was done by DARPA, it did not become the world wide network until commercial interests ( and free market capitalism ) took over [2]. This is not the narrative in the featured article.

[1] [https://news.ycombinator.com/item?id=13688595](https://news.ycombinator.com/item?id=13688595)

[2] [https://en.wikipedia.org/wiki/Digital_Revolution](https://en.wikipedia.org/wiki/Digital_Revolution)

<comment><USER19> > it did not become the world wide network until commercial interests ( and > free market capitalism ) took over

It was literally world-wide before that, but if you mean that it boomed: Yes, commercial businesses helped a lot, and so did others:

Free, open source software such as the World Wide Web, the entire protocol stack (IP, TCP/UDP, DNS, etc.), SMTP, POP, IRC, *nix/BSD, Mosaic ... let's give credit where it's due!

The personal computer revolution and all that went into it. Normal people were just getting their first computers in the 1990s. No point in Internet access without a client machine.

Telecommunications innovations such as PPP, modems, etc, which allowed data connections over phone lines.

Also, not all the commercial business was 'free market capitalism'; one big one that helped the Internet starting in 1995 was a predatory monopoly.</comment></comment>


Software Engineer-To-Be, That's Me. You, too? - <AUTHOR> http://kevinfadler.com/post/58493338750/software-engineer-to-be-thats-me

<comment><USER2> Since you mentioned you may need help on syntax errors, here's what I found. You forgot to close the parentheses on your first sentence/line-of-code.

print('"I have no business being in this class."

That's going to bomb if you were to run it, and sadly, depending on the language, it may be entirely too cryptic.

What are you thinking of having as your first language?</comment>


First Amazon Prime Air Delivery Made in UK - <AUTHOR> http://money.cnn.com/2016/12/14/technology/amazon-drone-delivery/index.html <comment><USER2> I'm always on the lookout for moves that everyone knows are a con, but due to how the incentives are set up, can't avoid them.

This drone delivery thing seems like one of them. There seems to be no way this can be scaled out sensibly yet by delivering something to someone living next to their warehouse, Amazon gets their name in the papers, and associated with hi-tech, speedy delivery, even though it's probably boring but interesting to me things they do to automated their warehouses that actually make the difference to their real customers.

I wonder how you'd need to set up incentives so that a news site could say "No, that's obvious PR clickbait" and ignore stories. Obviously they need a business model that itself doesn't rely on clickbait.</comment>


Ask HN: Why doesn't HN have a comment notification system? - <AUTHOR> HackerNews is a platform with very rich content.The Front page contains very interesting topics . Also most of the times discussions are food for thought . I enjoy reading them. Comments are very mature than the ones on sites like Reddit.
My point : Why notifications have not been implemented for comments? And Direct messaging feature will also help the like-minded people to meet on this platform. Is there any philosophy behind not implementing these features? <comment><USER2> [http://www.hnreplies.com/](http://www.hnreplies.com/)

[https://www.hnwatcher.com/](https://www.hnwatcher.com/)

</comment><comment><USER3> I am building notification for HN chrome extension [https://chrome.google.com/webstore/detail/hackernews- theme/n...](https://chrome.google.com/webstore/detail/hackernews- theme/ngjchhmppjcijklbnigfhhjdajkpjhil) Since It is my side project, It will take time. Although you are free to contribute in [https://github.com/jitenbansal/hackernews](https://github.com/jitenbansal/hackernews)

<comment><AUTHOR> I just checked it and it is really good. Good luck with it . Also waiting for the notification version.

</comment></comment><comment><USER4> Related question: Is there a way for me to check replies to my comments? Or my posts?

<comment><USER4> Looks like this one:

[https://news.ycombinator.com/threads?id=boggydepot](https://news.ycombinator.com/threads?id=boggydepot)

<comment><AUTHOR> sarcasm?</comment></comment></comment>


Space Shuttle Discovery's Last Launch, Viewed From the Air [video] - <AUTHOR> http://mashable.com/2011/02/26/discovery-flight/ <comment><USER2> Same film submitted yesterday: <http://news.ycombinator.com/item?id=2265348>

Many, many comments, not all of which are relevant.

However, that was in fact blogspam - here's the original video:

<http://www.youtube.com/watch?v=GE_USPTmYXM></comment>


Defense Department drops exclusive contract for BlackBerry - <AUTHOR> http://news.cnet.com/8301-1035_3-57543397-94/defense-department-drops-exclusive-contract-for-blackberry/ <comment><USER3> It's pretty amazing how much Blackberry has lost the enterprise market in the first world, while retaining the low end "feature phone with a keyboard" market in the third world, over the past few years. It's rare that the enterprise market moves faster than consumers, but that seems to be what's happening.

Unfortunately there's basically no buyout value to the international business (Nokia is even stronger for that, although they lack a good keyboard); Android (and to some extent Windows Phone and iPhone) will eventually win there.

The Enterprise market, particularly the BES and management side, had value to buyout, even just as a best-in-class MDM solution to manage Android, iPhone, etc., but they waited too long to open up their management, and from what I've seen, Airwatch, Zenprise, Good, etc. are all better choices for crossplatform MDM.

<comment><USER4> I do not mean to comment out of point, however, I just want to point out that to me, there seems to be 'something' about branding a part of the world 1st World and another 3rd World.

"Developed countries" and "Developing countries" seem better terms to describe the infrastructural distinctions.

<comment><USER5> Well, it originally came out of the Cold War, so I guess there is definitely something a little weird about it. Personally I don't really care for "developed" either though; it implies to me that those countries have achieved some peak of civilisation and don't need to change any more, which plainly isn't the case.

It's probably more pejorative than "third world", but "rich" and "poor" are probably clearer descriptions for a discussion of cellphone usage patterns than most of these euphemisms. That'd upset people even more, of course :)

<comment><USER6> You could perhaps look at "developing" in terms of economic growth - <USER2> "developed" countries have relatively low growth as their economies are mature.

That's not to say that all countries with low growth have mature economies of course, just that "developed" countries are at the economic forefront, and that "developing" countries need to make an effort to catch up or be forever "developing".

In terms that most people could understand "rich" and "poor" may be more accurate, but in terms of cell phone usage there are quite a few African countries that have widespread mobile phone networks, but few wired telephones.

You could perhaps come to think that the above sort of labels are very generic, but I do think that for a start that talk of a third world/first world split is not useful when the second world - communist russia and its ilk - doesn't exist anymore.

</comment></comment></comment></comment><comment><USER7> What are these people doing with their phones ?! _U.S. Immigration and Customs Enforcement agency ... said the reason was because RIM's smartphone could not keep up with its needs._ Are Apple Business solutions really viable ?

I don't understand if there is a valuable reason for that or if it's just change for the sake of change. My 3 years old Blackberry fulfills all my needs. And it was made in Canada, not in a Foxconn-like plant.

<comment><USER8> BBs suck hard at everything but emails, call, texts and BBM. It's browser and map apps are appalling - and both are completely reasonable to count as "needs" in 2012.

> And it was made in Canada, not in a Foxconn-like plant.

They're not made in Canada anymore.

</comment></comment><comment><USER9> Would this count as the final blow to the zombie that is BlackBerry?

<comment><USER10> Startups news site bashing struggling company? Stay classy HN.

<comment><USER11> Struggling startups get a pass on HN. Struggling companies that were at the top of the food chain and tumbled to the bottom through hubris and a failure to innovate don't.

<comment><USER10> IMHO RIM is really innovative company now.

</comment></comment></comment></comment><comment><USER12> Oh thank god. That's an insane handicap today.</comment>


The Beckoning of the Ice Worlds - <AUTHOR> http://nautil.us/issue/25/water/the-beckoning-of-the-ice-worlds

<comment><USER2> So Star wars had it right (empire strikes back). Funny it took us years to come to this conclusion but heat radiation does not due well with thick atmospheres.

Its also a surprise that we are doing some testing in the South Pole but clearly its a drop in the bucket in the grand scheme of things in terms of future exploration and robots testing and enduring freezing conditions.

</comment><comment><USER3> Check out the movie Europa Report if you want an advance look at what lurks below the ice.</comment>


Dyn Statement on 10/21/2016 DDoS Attack - <AUTHOR> http://hub.dyn.com/dyn-blog/dyn-statement-on-10-21-2016-ddos-attack <comment><USER3> Does anyone know details on the throughput or packets per second?

This smells so much of gross negligence on the part of Dyn executives and all the unicorn web executive teams for single sourcing to me.

I present as a counterexample and encourage people to go research the architecture of Verisign. I attended a talk by Verisign, which runs .com and .org as well as root servers. They are a constant DDOS target. They are necessarily a single entity of failure and appointed by ICANN to perform these services for the most common TLD in the world. If they mess up, they will probably lose that status. They've had over 16 years of uptime.

Every layer of the stack is dual or triple sourced. Two server makers, two generations, two router vendors, two switch vendors, two network architectures, POP diversity, peering diversity. Services and capacity always added in pairs. Two separate NOC and Ops teams. FreeBSD, Linux and Solaris. nsd, bind, and internally developed userspace on Netmap. Code upgrade deployed in halves. Everything is structured for at least a full halving for The Big One zero day I don't think we've really seen yet.

They were doing 10gbps of DNS on a single commodity server 3 years ago. This makes it easy to absorb any DDOS and gradually clamp it at the public peering points.

The above should be standard operations structure for any breakaway success web business. It's not that hard, but you have to claw the charlatans out of the management chain and put in professionals that take the career seriously. Professionals.

What's really appalling is hearing some unicorn web biz uses one cloud vendor, one service provider like Dyn. This is absolutely trivial stuff to multi- source and has almost no effect on OpEx.

Last I heard from a Dyn insider was they were eliminating FreeBSD and had a brain drain a few years ago. Overall pretty unsurprising outcome.

Internet reliability no more complex and certainly much cheaper than analogous critical infrastructure like electrical generation for a region. I am constantly disappointed in this field for its lack of recognizing and installing professionals into management. We've been doing Internet architecture in modern form for 30 years. Get your shit together.

<comment><USER4> Top Management don't care because they do not have a downside. By optimizing the cost they can get additional bonuses. Even if they sink the company, they still walk away rich and ready to screw someone else.

Middle manager are too busy to save their own asses to ask questions. If one off poor guy musters courage to speak up, they are immediately shut down in the name of falling in line. This is the usual response from top management when they don'have an answer.

"This isn't a Democracy."

<comment><USER3> This mirrors my experience. And for public companies, the Board of Directors are not attuned to these outcomes. For the most part B2B customers are in the same boat so everybody feigns an uncomfortable laugh, some moderate outrage or displeasure, put out a silly postmortem without intent to rectify the culture that enabled it, and continue collecting an outsized salary. I adore computers, but I really wish I could lateral into some career like construction management where the layman is much more aware of success and failure, who is good and who is bad at their profession.

</comment></comment></comment><comment><USER5> The style of this post mortem is quite different from a typical post mortem of an attack on a large tech company, such as AWS, heroku or GitHub.

There is very little technical details on the investigation and mitigation process beyond phrases like "the NOC team was able to mitigate the attack and restore service to customers", "...but was mitigated in just over an hour".

Why was this written by a Chief Strategy Officer but not someone with more technical knowledge and insights?

<comment><USER6> Because it's not a post-mortem but a "statement", which they felt like publishing to thank all the actor involved.

</comment></comment><comment><USER7> > We observed 10s of millions of discrete IP addresses associated with the > Mirai botnet that were part of the attack. (linked article)

> ... the Mirai botnet was at about 550,000 nodes, and that approximately 10 > percent were involved in the attack on Dyn (from Level 3 CISO) [0]

Something really doesn't add up there - even if it turned out 100% of infected hosts in the Mirai botnet were targeting dyn (ie: 5.5 million nodes) - <USER2> still is a fraction of the number dyn is claiming.

[0]: [https://threatpost.com/mirai-fueled-iot-botnet-behind- ddos-a...](https://threatpost.com/mirai-fueled-iot-botnet-behind-ddos-attacks- on-dns-providers/121475/)

<comment><USER8> I believe Dyn's numbers are conflating two things:

1\. The number of source IPs seen 2\. The size of the botnet

They are most certainly not equal because of spoofing.

</comment></comment><comment><USER9> I couldn't use twitter or github from noon till 4. If they mitigated the third attack and no customers were affected, why were github and twitter still down for me?

<comment><USER10> Same for us. We're backed by Shopify and it was down until 4pm. Not sure I buy they quashed this by 1pm

<comment><USER11> Can confirm as well. GitHub was inaccessible until about 5PM, and I'm in the southwest. My provider peers with Level3, so it looks like nearly everything gets routed through Los Angeles.

</comment></comment></comment><comment><USER12> > We observed 10s of millions of discrete IP addresses associated with the > Mirai botnet that were part of the attack.

OK, so why don't Dyn staff identify owners of all IP subnets represented, and provide each with a list of participating IP addresses? That's a trivial exercise, right? And maybe they could publicly shame ISPs that didn't act on the information.

<comment><USER13> If they are residential or business IPs, it would be nice for the ISPs to let them know something on their local network is part of a massive botnet.

<comment><USER14> why would they? I mean with how they are charging by the GB these days, it gives them financial incentive to _not_ tell you your refrigerator (or any device) is part of a botnet, that's free money for them.

<comment><USER15> Assuming you mean this seriously and not just as a tongue-in-cheek dig at internet carriers...

Even if every refrigerator were on a pay-as-you-go plan, handling all of the data may ruin throughput for other customers, especially at peak usage.

</comment></comment></comment></comment><comment><USER16> The attack was surely not mitigated by 1 PM ET. We were experiencing issues until well after 3.

<comment><USER17> Dyn states their problems were fixed at 17 UTC, but me and most other people in the Netherlands have been seeing issues for the whole evening. Something about their story does not add up...

</comment></comment><comment><USER18> I would really like it if Dyn could give some credence to the 1.2Tpbs number or if it was higher.

As these attacks grow in scale, it becomes more and more important to know if this was an attack at record capacity or if it was just that Dyn had lower capacity hardware/links in place. If we're already facing, for example, 2Tbps attacks, a lot has to be done to make mitigating these attacks easier, either through hardware or strategic upgrades.

<comment><USER19> no.

what you get then is groups trying to outdo each other trying to get bragging rights for being the largest.

</comment></comment><comment><USER20> Entertainingly, this page 503s currently.

<comment><USER21> [https://web.archive.org/web/20161022220033/http://hub.dyn.co...](https://web.archive.org/web/20161022220033/http://hub.dyn.com/dyn- blog/dyn-statement-on-10-21-2016-ddos-attack)

</comment></comment><comment><USER22> Overall great write up, however:

"Again, at no time was there a network-wide outage, though some customers would have seen extended latency delays during that time."

That can't be true. Here in the west coast, I know of over 10 "name-brand" sites that were absolutely down for over an hour. The east coast was apparently hit even harder and for longer.

<comment> joatmon-snoo Are you sure that it was Dyn that was down, or if there was a break somewhere in the nameserver chain?

I know that the digs I was running periodically were getting SERVFAIL responses from Google DNS even though my local nameservers were actually succeeding.

</comment></comment><comment><USER23> Does anyone here know the actual technical details of the attack? How exactly did the DDoS occur? Just a ton of bots making DNS requests over UDP??

Links to articles with tech details would be greatly appreciated.

</comment><comment><USER24> I was hoping to read a more detailed account of the attack and specific mitigation strategies. Have such details emerged anywhere?

<comment><USER25> The blog post indicates additional details are forthcoming.

<comment><USER24> Sure. But they also say, understandably:

> _It is worth noting that we are unlikely to share all details of the attack > and our mitigation efforts to preserve future defenses._

</comment></comment></comment><comment><USER26> This should be a warning to everyone that was affected by this. Even the dependencies that you don't normally think about go down at some point. For DNS, make sure you are using multiple DNS providers.

<comment><USER27> > For DNS, make sure you are using multiple DNS providers.

In this case, that would have made it worse.

If your domain CNAMEs off another provider (as nearly all SaaS solutions do, as do mapping to AWS servers, etc) then you would have been affected by the attack on Dyn regardless of whether you could change your nameserver in time and have multiple providers at that level.

If you don't have any CNAMEs, then I think the better choice is to go same- origin same-provider for everything.

Which may sound bizarre... my personal sites (a lot of forums) would either be up or down. I would argue that availability having a binary nature is a lot better for end users than a constantly broken half-state that is frustrating or impossible to use at any time even though a graph might show partial availability. A hard sudden failure shows up better in monitoring, triggers end user feedback faster, and is in many ways easier to debug and solve.

With so much CNAME'd, and SaaS still growing, replicating and failing over DNS that sits above those wouldn't buy you anything.

A lot of sites lost Zendesk (their support.), Statuspage (their status.), Pagerduty (hey, they were quiet because no-one could let them know). They couldn't even help the end users having a bad time.

<comment><USER28> > In this case, that would have made it worse.

It might have made little difference depending on the specifics of the records in question but it would not have made things worse.

</comment></comment></comment><comment><USER29> Is Dyn any less vulnerable to this attack than 48 hours ago?

That's kind of the point of retrospection, but I missed the part where they say what they're doing now that they failed to do last week.

</comment><comment><USER30> I haven't seen comment from any IP-transit/peering company that provides service to them. In fact, I haven't seen any infrastructure provider of them comment anything. This is starting to seem more like a marketing campaign or human error (action?) blamed on DDoS.

</comment><comment><USER31> _Why_ might the Mirai botnet attack Dyn? What might their motives be?

</comment><comment><USER32> that's a killer IP list to license out

</comment><comment><USER33> >It is worth noting that we are unlikely to share all details of the attack and our mitigation efforts to preserve future defenses.

Security through obscurity.

<comment><USER34> Obscurity is a valid defense layer, so long as it is not the only layer, and so long as the obscurity is not just a way of covering up garbage.

<comment><USER35> But it can also be substantially more costly than its worth, and a lot of the cost isn't super visible (people finding it marginally harder to get their job done, being unable to learn from informed discussion on HN, &c).</comment></comment></comment>


Ask HN: Any new hacker podcasts? - <AUTHOR>

I like to have something to listen to on my daily commute. So far I've found Mixergy to be the most reliable entertainer, followed by Stack Overflow. Anything I'm missing? I prefer listening for the simple reason that I get sick on the bus if I try to read something. <comment><USER2> Here are a few I listen to:

The Command Line Podcast: <http://thecommandline.net/category/podcast/>

Hacker Medley: <http://hackermedley.org/>

Software Engineering Radio: <http://www.se-radio.net/>

FLOSS Weekly: <http://twit.tv/FLOSS>

</comment><comment><USER3> There's Python411 at <http://www.awaretek.com/python></comment>


What made the 1960s CDC6600 supercomputer fast? - <AUTHOR> https://cpldcpu.wordpress.com/2020/02/14/what-made-the-cdc6600-fast/ <comment><USER2> I used and programmed the 6600, including in assembly language. They were incredibly fast for the time at numerical calculation. I used them for electronics simulations in SPICE, and they were great for that.

However, they had 60 bit words and no way to address data directly within a word. By convention, characters were six bits long, stuffed in 10 characters to a word. So while this machine was incredibly fast for its time for numerical calculation, it was painful to do text manipulation. You had to pack and shift characters into words, and unshift and unpack. You could do interesting things with great cleverness, but it took a lot of work to do simple things.

Thanks for the trip down memory lane.

<comment><USER3> Cool!

This expands on the text processing issues:

[https://www.museumwaalsdorp.nl/en/history/computerhistory- ba...](https://www.museumwaalsdorp.nl/en/history/computerhistory-background- information/6400hwac/)

"There was no byte addressability. If you wanted to store multiple characters in a 60-bit word, you had to shift and mask. Typically, a six-bit character set was used, which meant no lower-case. These systems were meant to be (super)computing engines, not text processors! To signal the end of a text string, e.g. a sentence, two different coding techniques were invented. The so-called 64 character set was the CDC-default. A line end comprised of two (or more) null-"bytes" at the end of a word followed by a full zero word. The 63 character set, quite popular in the Netherlands and the University of Austin, Texas, signalled the line termination by two (or more) null-"bytes" at the end of a 60-bit word.

The Michigan State University (MSU) invented a 12-bit character set, which was basically 7-bit ASCII format with five wasted bits per character. Other sites used special shift/unshift characters in a 6-bit character set to achieve upper/lower case."

<comment><USER4> _"The 63 character set, quite popular in the Netherlands and the University of Austin, Texas, signalled the line termination by two (or more) null-"bytes" at the end of a 60-bit word."_

So, did Dijkstra invent the null-terminated string? (What else links Austin and the Netherlands in computing at that time?)

<comment><USER5> I can safely conclude that the content at the site cannot lead us to conclude that Dijkstra invented the nul-terminated string.

[https://www.museumwaalsdorp.nl/en/history/comphistory/comput...](https://www.museumwaalsdorp.nl/en/history/comphistory/computer- history-the-period-1974-1978/comp742e/) says:

> A Control Data 6400 system was installed in May 1974 ...

> The Laboratory, like all other computer centres in the Netherlands, had > opted for the so-called 63 character set. Control Data only tested systems > with the 64 character set in America. Unsatisfactory code or code from "new" > programmers yielded one or more errors with almost every new release, which > we corrected at the TNO Physics Laboratory and made public with a lot of > misgivings through the Problem Reporting System mechanism (PSR). Every two > weeks a set of microfiches with all complaints and solutions collected > worldwide was sent to all computer centres by Control Data. At every release > level, it was exciting whether the errors we found were the first to report > or that our colleague from the University of Arizona was going to blame

That gives a mismatch between "University of Austin, Texas" and "University of Arizona".

[https://en.wikipedia.org/wiki/Edsger_W._Dijkstra](https://en.wikipedia.org/wiki/Edsger_W._Dijkstra) says he joined the University of Texas at Austin in 1984. In the 1970s he lived in the Netherlands.

[https://en.wikipedia.org/wiki/Null- terminated_string](https://en.wikipedia.org/wiki/Null-terminated_string) says that the PDP-11 in 1970 had NUL-terminated strings ("Null-terminated strings were produced by the .ASCIZ directive of the PDP-11 assembly languages and the ASCIZ directive of the MACRO-10 macro assembly language for the PDP-10.")

This was when Dijkstra was at the Eindhoven University of Technology.

Therefore, whatever is described at the link cannot be used to conclude that Dijkstra had anything to do with nul-terminated strings.

<comment><USER4> Thanks. I searched a bit further, and found [http://www.cs.utexas.edu/users/EWD/transcriptions/EWD04xx/EW...](http://www.cs.utexas.edu/users/EWD/transcriptions/EWD04xx/EWD466.html), where Dijkstra critizises how line endings were stored in the 64 character set:

 _"Niklaus told a terrible story about CDC-software. With 10 six-bit characters (from an alphabet of 63) packed into one word, CDC used the 64th configuration to indicate "end of line"; when for compatibility reasons a 64th character had to be added, they invented the following convention for indicating the end of a line: two successive colons on positions 10k+8 and 10k+9 —a fixed position in the word!— is interpreted as "end of line". The argument was clearly that colons hardly ever occur, let alone two successive ones! Tony was severely shocked "How can one build reliable programs on top of a system with consciously built-in unreliability?". I shared his horror: he suggested that at the next International Conference on Software Reliability a speaker should just mention the above dirty trick and then let the audience think about its consequences for the rest of his time slice!"_

I don't think that

</comment></comment></comment></comment></comment><comment><USER6> The T. J. Watson Jr memo gives a bit of insight into what the competitors thought of the CDC6600 [https://www.computerhistory.org/revolution/supercomputers/10...](https://www.computerhistory.org/revolution/supercomputers/10/33/62)

<comment><USER7> Interesting. It looks typewritten, but it has proportional spacing. I'm not aware of any typewriter of the time that could do that. The Selectric Composer could, but it was released in 66 and the 6600 predates it by two years.

The different weights also make it look like a mechanical typewriter rather than an electric one, which would be an odd choice for the office of TJW.

<comment><USER8> All IBM Executive-series typewriters made after World War II featured proportional spacing.

</comment></comment></comment><comment><USER9> Nice work! Any article that features results from a test PCB is a winner in my book!

> Let me know if you find similar devices.

The Rohm high-frequency BJTs look promising: 2SC3838K is the fastest (fT wise), but there are several others (see page C28 of Rohm's 2019 catalog). I only checked the datasheet for the one, but it's got a very nice Figure 10, showing that it'll probably switch fastest around 20mA collector current, and should be about 3x faster there than the MMBTH10L at 4mA.

<comment><USER10> The thing is that if you want logic to go fast proper you don't use saturation logic (DTL/RTL/TTL), but current steering logic (ECL). That way your usable clocks gets much closer to the fT of the transistors involved, instead of being limited to a tiny fraction of it.

That's how Cray built supercomputers after the CDC6600/7600.

<comment><USER11> At the cost of insane power/heat budgets - although one of the nice things about ECL is the power draw is relatively constant because the transistors don't saturate, and you don't get the spikes and PSU hash you get with TTL etc.

ECL was amazing for its time, but I'm honestly more impressed by modern PC/phone electronics. PCBs and chip designs are mass-produced commodity products _clocked at microwave frequencies_ \- sometimes with battery power.

This is incredibly impressive compared to the state of the art in the 60s and 70s. And it's taken for granted as an everyday thing.

<comment><USER12> I recently found a 1980s Cray installation guide which has a lot more detail on the power, cooling, and other physical requirements. [https://news.ycombinator.com/item?id=22284518](https://news.ycombinator.com/item?id=22284518)

<comment><USER13> One notable thing about the constant power draw of ECL and Cray-1 in particular is that power draw is constant enough that the logic supply is unregulated, just rectified and filtered output of 400Hz transformers (placed physically in the "bench part" of the chasis). What is regulated is the 208V/400Hz supply for the thing (produced by the motor generator shown in the article), but regulation of that IIRC involves manual turning of physical knobs during installation/maintenance and is more about compensating for unstable mains on the input side.

</comment></comment></comment></comment></comment><comment><USER14> "Optimize one basic thing very well, replicate it, and use it as a hierarchical building block."

<comment> mark-r I think Cray kept that basic philosophy with all his subsequent designs.

</comment></comment><comment><USER15> I learned FORTRAN in 1965 on a CDC 3100. Real core memory, tape drives, vacuum drum card reader, Calcomp plotter. Super slick.

I took a computer science course at Dalhousie University in 1970, used a CDC 6400. My professor was obsessed with pseudo-random numbers, the 60-bit word size was a godsend.

</comment><comment><USER16> Oh I love these detailed runs into the past. Also the fact that physics and chemistry where the main driver. Software became the most prominent figure in computing or at least that is how I perceived this growing up. I learned very late what the advances in semi conductor development really meant and how important they were.

<comment><USER17> It was amusing reading that the transistor used int he CDC6600 was gold doped. Turns out that common switching diodes like the 1n4148 are gold doped for the same reason. Increases switching speed. You pay for it though, they leak like a sieve esp at higher temps.

<comment><USER10> 1N4148 are also excellent photodiodes if you don't want that.

</comment></comment></comment><comment><USER18> What I remember about assembly language programming the CDC6600 was how beautifully simple the machine's principles of operation were at the register and instruction level.

In 1974 I learned CDC6600 assembly language in grad school. In comparison to IBM360 assembly language programming I had previously done, the CDC 6600 was so straightforward. It took perhaps one day to learn all of it. I still have the small book that I learned from, _Assembly Language Programming for the Control Data 6000 Series and the Cyber 70 Series_ by Ralph Grishman.

 _Addressing:_ The machine had unusual data layout, it was word, not byte addressable and each word was 60 bits long, not 16 or 32 bits long.

 _Data Format:_ Text was stored in six-bit fields, ten per word and so the characters weren't directly addressable. Furthermore, integers were stored in 1's complement, not the more common 2's complement or sign-magnitude format. There was a single 60-bit floating point format (1-bit sign, 11-bit exponent, and 48-bit coefficient).

 _Speed:_ Floating point multiplication took 1000ns, but the 6600 could do two floating point multiplies, a floating point add, and an integer add simultaneously if coded carefully.

 _Memory:_ The memory of the 6600 was stored in a ferrite core memory and it had a maximum size of 128K words. Later, there were slower, larger memory tiers as options.

 _I /O:_ This was handled by peripheral processors that had access to the main memory and could offload data transfers to devices so that the central processing unit didn't have to handle expensive interrupts (expensive because the out-of-order execution of instructions meant that saving and restoring the state of the CPU was relatively time-consuming).

 _Registers:_ There were 8 X-registers. These are 60-bit registers that are used as the operands in the assembly language instructions. There are also 8 18-bit A-registers that are used for addressing and an additional 8 18-bit B-registers for use as loop indexes, etc.

 _Instructions:_ Opcodes are always 6 bits, there are only 71 instructions (one of the 64 possibilities in the 6-bit op code is further divided into 8 instructions). The instructions were simple:

        IX4 X5+X6   ; Integer sum of X5 plus X6 goes into X4

Such an instruction takes 15 bits, six for the opcode, three each for the three registers.

This was all a lot less to understand than the intricacies of the IBM360 principles of operation. The IBM360 of the time had instructions like TRANSLATE-AND-TEST or the SHIFT-AND-ROUND-DECIMAL. Here for example are the first four paragraphs explaining the TRANSLATE-AND-TEST instruction from the _IBM 360 Principles of Operation_ :

> The eight-bit bytes of the first operand are used as arguments to reference > the list designated by the second operand address. Each eight-bit function > byte thus selected from the list is used to determine the continuation of > the operation. When the function byte is a zero, the operation proceeds by > fetching and translating the next argument byte. When the function byte is > nonzero, the operation is completed by inserting the related argument > address in general register 1, and by inserting the function byte in general > register 2.

> The bytes of the first operand are selected one by one for translation, > proceeding from left to right. The first operand remains unchanged in > storage. Fetching of the function byte from the list is performed as in > TRANSLATE. The function byte retrieved from the list is inspected for the > all-zero combination.

> When the function byte is zero, the operation proceeds with the next operand > byte. When the first operand field is exhausted before a nonzero function > byte is encountered, the operation is completed by setting the condition > code to O. The contents of general register 1 and 2 remain unchanged.

> When the function byte is nonzero, the related argument address is inserted > in the low-order 24 bits of register 1. This address points to the argument > last translated. The high-order eight bits of register 1 remain unchanged. > The function byte is inserted in the low-order eight bits of general > register 2. Bits 0-23 of rcgister 2 remain unchanged. The condition code is > set to 1 when the one or more argument bytes have not been translated. The > condition code is set to 2 if the last function byte is nonzero.

> ... [There's a lot more]

</comment><comment><USER19> Interesting to find this on HN as I'm reading a book on Seymour Cray and his supercomputer adventures (Charles J. Murray's "The Supermen: The Story of Seymour Cray and the Technical Wizards behind the Supercomputer"). Not too much technical intricacies there, but still an interesting read from a general/histori perspective.

</comment><comment><USER20> The article shows us transistor level logic circuits to study, but I think the quick answer is as the architect Seymour Cray gets the credit.

<comment><USER21> Definitely.

For an insight into that great man's life, I highly recommend reading _The Supermen: The Story of Seymour Cray and the Technical Wizards Behind the Supercomputer_ by Charles J. Murray. I remember reading it back when I was in high-school so it's more than twenty years old by now, but it's still an amazing account of how those amazing people built those stunning machines.

<comment><USER22> I hope these people are all dead now so you never have to meet them and accept that they're not as amazing as the book makes you think they are.

<comment> mark-r I met Seymour Cray, and he was definitely as amazing as you can imagine. He's also very much dead.

<comment><USER23> I held a door open for him in 1989. Unfortunately I didn't realize who he was until later.

<comment> mark-r Reminds me of a story I heard on the radio.

A guy went out to eat in a New York restaurant. A couple came in, a pale white dude accompanied by the most beautiful black woman this guy had seen. They were seated close to him. It was immediately obvious to him that they were getting much better service than him - for instance they got their food almost immediately after ordering, while he was still waiting for his. So he started to heckle them.

Fast forward to a year later. David Bowie has died, and his picture is on the front cover of every magazine. This guy finally realizes who it was he'd been heckling.

</comment></comment></comment></comment></comment></comment><comment><USER24> >10 MHz

>1964

That's insane. What's even more insane is that a bit over 20 years later homecomputers reached that frequency. And in the next decade they reached over 100 MHz. - Pure lunacy.

Posted from my 5 GHz homecomputer.

<comment><USER10> ECL logic systems reached effective clock frequencies in excess of 500 MHz in the late 60s or so. It was _extremely fast_ compared to contemporary RTL/TTL logic.

<comment><USER25> Exactly. It was MOS that lagged, not "transistors" or "computers", really. Transistorized microwave circuits (analog, not digital) in the GHz range were operating as early as the 1960's too.

MOS is just hard. It's hard to fabricate, it's hard to design (i.e. you need computers to make computers!), it's hard to scale. It required new chemistries be invented and new circuit design techniques to manage the (really tiny!) components. So for a long time you could have a big circuit in discrete bipolar components which ran fast or a tiny one in MOS which was slow.

But MOS was tiny and MOS was cheap. So by the early 90's it had caught up in speed with all but the fastest discrete technologies (GaAs was "right around the corner" for like two decades as it kept getting lapped by routine process shrinks -- now no one remembers it) and the market abandoned everything else.

<comment><AUTHOR> >MOS is just hard

I think the important point is that "MOS scales". All the bipolar technologies never had anything like Dennard scaling, which was the backbone of Moores Law.

<comment><USER10> Case in point, you could get _bipolar ECL RAM_ in the 80s with access times of around 1-2 ns (which is at least four times faster than the fastest DDR-SDRAM in 2020). Except those things would have a few kilobits at most and burn a Watt or two; an entire 16 GB stick of DDR4 doesn't require much more than that. (This is SRAM of course; you can't build good DRAM on a bipolar process, and MOS SRAM is much faster than DRAM as well. However, MOS SRAM in the 80s would have access times of 20-150 ns; it's typically the suffix of the part number, e.g. 62256-70)

</comment></comment></comment></comment></comment><comment><USER7> > The design of the machine is well documented in a book by James Thornton, > the lead designer

The type on the twin CRTs of the console is very interesting. The cover of the book shows a sample of it and the slight imprecisions of the beam deflection give it a whimsical quality, as if the fastest computer of its time used Comic Sans to communicate with its operator.

</comment><comment><USER26> Does anyone know why 60 bits and not some power of two? How did that work? Or am I just being silly and it doesn't matter? :)

<comment><USER27> At the time, many computers were decimal, or had word lengths like 18, 24, 36 or 48, or even 72 bits. Characters were usually 6 bits. The power-of-two standard based around an 8-bit byte didn't exist yet.

Whoever picked 60 bits (Cray?) was almost certainly thinking in octal, not hex. 60 bits is multiple of 3, it fits in 20 octal digits, and it holds 10 characters. Most importantly, a 60-bit floating point number is precise enough for just about any calculation.

<comment><USER28> IIRC, some early mainframes (IBM and maybe Sperry?) had 36-bit words. 36 bits was enough for 12 (decimal) digits of accuracy with fixed-point arithmetic, or 10 digits for floating point. It was good enough for atomic calculations (where the difference between an atom's mass and the masses of the two atoms it breaks into is a very small fraction of the initial mass).

<comment><USER29> The DEC PDP-10 was a 36-bit machine.

<comment><USER30> With an interesting and functional set of 'byte' instructions where you could specify the number of bits per chunk. IIFRC 6 or 9 bits were typically used for characters, but I think there was a 5 bit character set in use as well.

</comment></comment></comment></comment></comment><comment><USER31> As transistors are getting smaller, it's said that when transistors will approach <10nm gate sizes, RCL may reappear again because at these sizes semiconductors will begin to lean so much, that FET based logic will no longer have advantage in the current draw over current based logic families.

<comment><USER13> I would not expect return to RTL/DTL but iwould not be surprised by use of NMOS-style pull-up transistors/resistors in combination with traditional CMOS logic. You can make NMOS gate in CMOS process quite easily and it comes out significantly smaller. Doing DTL in CMOS process seems somewhat pointless given the fact that simplest way to make diode-like thing in CMOS is transistor. And then there is the issue of small fanout of RTL/DTL.</comment></comment>


Review of 8 Linux file managers to try (2015) - <AUTHOR> https://opensource.com/business/15/4/eight-linux-file-managers <comment><USER3> This is an example of where the ecosystem is extremely inefficient - <USER2> of having one great file manager we have a bunch of defective ones.

<comment><USER4> Are there any good file managers? At least on Linux there is the choice. I find OS X's finder and Windows' explorer pretty awful.

<comment><USER5> On Windows there's Directory Opus which is really powerful, Total Commander is also really great. On OS X there's Pathfinder which is pretty good.

<comment><USER6> Directory Opus is great, but it is expensive. Last time I checked it was 70 dollars for one computer and that doesn't include "major" updates which seem to happen fairly frequently.

</comment></comment></comment></comment><comment><USER7> Both OSX and Linux lack good file managers, unfortunately. Basically the only thing i miss really much. Compared to Total Commander (and FAR for someone) everything else feels really bleak.

P.S. For OSX i recommend CRAX Commander which trying to emulate TC with ~30% success rate :) Much worser than original but better than most alternatives

<comment><USER8> > * Both OSX and Linux lack good file managers, unfortunately.*

I can't recall a single time when I said "man I really wish Finder wasn't missing [this or that feature], I could really use that right about now."

<comment><USER7> See rant above about Lister. Well, technically could be external program but i was unable to find external program either. Of course there are plenty more different features not covered here

</comment></comment></comment><comment><USER9> I've tried a bunch of file managers but I'm not really happy with any of them. I tend to go with the least annoying alternative when I choose among Linux desktop programs (because they are all pretty horrible), in the file manager case my pick is PCManFM, for now... :)

</comment><comment><USER10> No mention for my favourite - Ranger, a terminal-based, keyboard-oriented file manager that I prefer to Midnight Commander.

<comment><USER6> If you use zsh, there is deer[0], which has ranger like navigation and some useful features, but starts up instantaneously, unlike ranger. Great for quickly moving around complex directories structures.

0\. [https://github.com/Vifon/deer](https://github.com/Vifon/deer)

</comment></comment><comment><USER11> I don't recognise the Nautilus I use from the screenshot or the description. For example, I have a completely different sidebar and I have no problem having multiple tabs in a window.

<comment> TD-Linux The screenshot is of a really old Gnome 2 Nautilus.

<comment><USER11> That seems like a very old version to review.

</comment></comment></comment><comment><USER12> Article mentions that Nautilus , default gnome/ubuntu, file manager doesn't have Tabs, which is incorrect as I use it daily and tabs help me get more done in it.

</comment><comment><USER13> Haha, I still just use the ROX filer. It's quite minimal but has some nice keyboard navigation shortcuts.

</comment><comment><USER14> the only time i use the gui is to drag and drop files in os x, i.e. to mail something, or upload.

does anyone know if there is a tool that will allow you to simulate a drag+drop in the gui, and provide a path instead? typing "open ." and then re- arranging windows and dragging and dropping a file is so incredibly cumbersome.

</comment><comment><USER15> Krusader + GNOME Commander + Midnight Commander are my favorites; Double Commander for running under OS X.

</comment><comment><USER16> nemo is also quite good.

</comment><comment><USER17> Vifm !!!</comment>


Show HN: Track your HN post - <AUTHOR> http://s.myezapp.com/apps/demo/hn/example2/item_history.ws?item_id=4386231

<comment><AUTHOR> I made the utility to help you track the rank of your hacker news post. Simply enter item id, or click "back" and select "History"->"View". Feedbacks are welcome.

Note: It only has two days of data, so older news won't work.

</comment><comment><USER2> Very useful~ Thanks!

All the graphs have the same x-axis; how about combining them so you can see all the information at the same time in one screen without scrolling down?</comment>


GNU Mes 0.17: towards bootstrappable builds for GuixSD - <AUTHOR> http://lists.gnu.org/archive/html/info-gnu/2018-08/msg00006.html <comment> dane-pgp This seems to me like a necessary complement to the efforts around making packages build reproducibly.

It has long been accepted that if a piece of software requires a non-Free compiler to build it, then that piece of software is de facto non-Free too. Taking that to its logical extreme, a piece of software isn't Free unless it can be built by a compiler whose recursive sequence of meta-compilers leads back to a minimal, audited binary seed.

Fortunately, once this has been done once (or multiple times independently, producing the same results), all future compilations and software can potentially enjoy the benefits of the process.

<comment><USER3> Assuming that you can trust the computers it's running on.

<comment><USER4> This is basically the argument made in "Reflections on Trusting Trust", the Turing Award Lecture of Ken Thompson.

</comment></comment></comment><comment><USER5> > _It consists of a mutual self-hosting Scheme interpreter written in ~5,000 > LOC of simple C and a Nyacc-based C compiler written in Scheme._

I'm trying to understand how important this part is. Is there a fundamental reason this needed to be a C compiler and Scheme interpreter that each can compile or interpret the other? Or is it just that they needed to support those two languages to bootstrap this particular software distribution?

<comment><USER6> Ultimately, the goal is to compile a trusted copy of the gcc source code with a trusted compiler. This means that you need a trustworthy c compiler binary. In order for the compiler binary to be trustworthy, you have to either:

1\. read and understand the machine code of the compiler's binary, or

2\. have an observable compiler that can compile itself and also gcc (or at least better compilers that can compile gcc).

This project uses approach 2 - an interpreter to interpret a compiler compiling it's own interpreter, and also a better compiler. Because the compiler is interpreted, you can potentially intervene and observe the compilation progress. (To watch a compiled binary of a compiler compiling itself, you would need a trustworthy debugger binary, which you can't bootstrap unless you can already trust some other compiler, or read+understand the debugger's binary.)

Because the interpreted compiler can compile its own interpreter, and the interpreter interprets its own compiler, you can read and understand the source code of each, observe the interpreted compiler compile the interpreter, verify that the result is bit-for-bit identical to what you have been running, and now you have an executable compiler that you can trust.

So, having a mutually co-hosting compiler and interpreter is a neat way of closing the compiler trust loop -- instead of always having to trust some earlier compiler, this allows you to establish trust (or distrust) of a pair of programs by running them on themselves and comparing what you get to what you started with. The fact that the interpreter is written in scheme is incidental to the fact that this project is intended for GuixSD, a linux distribution that uses a package manager written and configured in scheme. I assume scheme was chosen because

1\. people who work on GuixSD like scheme, and are comfortable reading and writing it, and

2\. scheme is a language with a good complexity/power ratio, minimizing the amount of code that has to be written, read, and understood in order to trust the compiler toolchain.

The fact that the compiler is a c compiler is more important, because with a trusted c compiler you can compile (old versions of) gcc. With only a trusted X compiler (where X is not C or C++), you would need to add another step, a C compiler written in X. This would still be feasible, but adds more code to the already-enormous pile that needs to be trusted.

<comment><USER7> Nice explanation, thanks.

"Trusting Trust" makes my head hurt.

Has anyone considered bootstrapping on completely different stacks and then diffing the results?

Maybe even using cross compilers.

I can imagine hostile actors compromising various Intel, AMD, ARM chips. But I can't imagine those compromised targets all behaving the same way. Or going back in time to port their compromises to obsolete architectures.

<comment><USER8> > Has anyone considered bootstrapping on completely different stacks and then > diffing the results?

Yes.

[1] [https://news.ycombinator.com/item?id=12666923](https://news.ycombinator.com/item?id=12666923)

</comment></comment></comment></comment><comment><USER9> This seems like a really neat idea! I think it would be cool to use plain source code to completely bootstrap a system. But, at the same time, this sounds like a maintenance nightmare! Maintaining older or smaller versions of software just to avoid self-hosting is bound to hit all kinds of bugs - <USER2> and small.

At the same time, I'm not convinced this completely solves the problem. Maybe you can trust your C compiler now, but can you trust your Bash interpreter, or your sed command? What stops them from injecting things into your C compiler while it's building. At the end of the day, you have to trust some software, why not include your C compiler in this list?

Anyway, I am much more concerned about much higher places in free software bootstrapping. Lots of software has switched from Autotools to Meson without thinking about how we will bootstrap this stuff. Meson requires you to have Ninja to work, but how can I bootstrap Ninja without Python? Autotools is admittedly bad, but at least you only needed bash & make for it to work.

<comment><USER10> I can't find a reference to it but there was an intentional security bug introduced to a c compiler that would pass through to the compiled code.

<comment><AUTHOR> Reflections on trusting trust, Ken Thompson's Turing award lecture

[https://www.archive.ece.cmu.edu/~ganger/712.fall02/papers/p7...](https://www.archive.ece.cmu.edu/~ganger/712.fall02/papers/p761-thompson.pdf)

</comment></comment></comment><comment><USER11> Really cool.

See also: CakeML [https://cakeml.org/](https://cakeml.org/)

> CakeML is a functional programming language and an ecosystem of proofs and > tools built around the language. The ecosystem includes a proven-correct > compiler that can bootstrap itself.</comment>


A Gazillion-user Comet Server With libevent, Part 0  - <AUTHOR> http://aleccolocco.blogspot.com/2008/10/gazillion-user-comet-server-with.html

<comment><USER2> Ok, but part of what makes Erlang so interesting for this kind of stuff is that you can do long running tasks in the event handlers without locking up the system. Erlang will take care of scheduling it, so that other requests can keep coming in and getting handled, and processing power is divided up between the different Erlang 'processes'. Writing simple select/poll/event/whatever servers in C is obviously going to kick ass in terms of speed, but things become more problematic when you need to start doing some real processing.

<comment><AUTHOR> We'll see... ;)

<comment><USER2> Obviously, anything is _possible_ with C. Erlang is written in C, after all. You can break up processing into small steps that don't bog things down, and even formalize how you do so. But the difference is that in Erlang, that's taken care of for you.

(BTW, not that any of this takes away from your nice article - I voted it up because it's the kind of thing I'd like to see more of!)

</comment></comment></comment><comment><USER3> libevent has wrappers to languages like perl, so this should be doable in a language that isn't brutally low-level. right?

<comment><USER4> Well, yes, but memory footprint will be higher and speed will decrease slightly. You will also want to leave all the protocol handling (HTTP etc) in C to prevent further slowing down.

</comment></comment><comment><USER4> Hey alecco, nice blog! I've been playing with a bit of libevent goodness myself, your code will be very helpful ;)

<comment><AUTHOR> Thanks!

</comment></comment><comment><USER5> Great article, keep the series coming!</comment>


The climate change deniers have won - <AUTHOR> http://www.theguardian.com/commentisfree/2014/mar/22/climate-change-deniers-have-won-global-warming <comment><USER2> I think mother nature laughs at puny human's attempts to change reality with words.

</comment><comment><USER3> hmmm...only 7 paragraphs in i had to invoke Goodwin's law and stop reading his screed.

<comment><USER4> It certainly is a screed - you can practically feel the spittle as the guy expresses indignation that anyone could _possibly_ disagree with the teachings of his own church. Cohen seems to have made no effort to _understand_ what the other side says, but is still sure they must be evil and wrong to say it. In short, he's "projecting".

That said: it's "Godwin's" law, and that law is about comparing one's opponent to _Hitler_ or the _Nazis_. Comparing one's opponent to a _Holocaust denier_ isn't quite the same thing. I agree that invoking Holocaust deniers, just like invoking Hitler, is in this context a sign of desperation and ignorance - it's something one might do when you have no _good_ arguments against their position, as a substitute for actual thought and engagement. So I do agree that people who shout "denier!" probably ought to be shunned and not engaged with, but if we're going to call that principle a law, it needs a different name.

[https://en.wikipedia.org/wiki/Godwin's_law](https://en.wikipedia.org/wiki/Godwin's_law)</comment></comment>


The Wikileaks Persuasion You Missed - <AUTHOR> http://blog.dilbert.com/post/154681238001/the-wikileaks-persuasion-you-missed <comment><USER2> James Corbett said in a video it's always terrible to say you're going to release something big. Just release it and let people decide if it's big.

Scott Adams has gotten a lot of shit for his views this past election and I really think they're unfair. I want to make it clear I support neither Hillary or Trump; they're both equally corrupt. Although I respect Scott Adams, I don't think Trump is anything different. He's just another member of the 1%. He was chosen by the GOP because he could be controlled. You don't get past the presidential primaries in the US without the party letting you be chosen.

The point of the entire election cycle is just to make American angry at one another instead of the people who are actually causing all the problems:

[http://fightthefuture.org/videos/does-voting-make-a- differen...](http://fightthefuture.org/videos/does-voting-make-a-difference/)</comment>


Ask HN: What can I do if someone dupes me into working for free? - <AUTHOR> Hey HN,
 I recently gave an interview and was asked to make a webpage, I can see that the page is live now on the main website but the founder is not replying to my messages. What can I do in this case? <comment><USER2> Treat this like you would any other copyright infringement (presumably you didn't sign anything giving them ownership of the work or you would not be asking HN?).

Find out where the site is being hosted, usually through a WHOIS search, and contact the hosting company's abuse department. Try a web search for a template of a takedown notice appropriate for the jurisdiction. For example, if the site is hosted in the USA you can send the host a standard DMCA takedown notice. Make sure the wording is correct.

You can go to a lawyer for reassurance (and if you can afford one), but for a simple copyright infringement notice sent to a web host, this is not super complicated and you can get it done yourself.

Obviously you are 'burning a bridge' here with the company that interviewed you, and you will never do work for them again, but they are treating you badly and it's OK to get more aggressive in your dealings with them. If they later claim this was a misunderstanding and remove your webpage, go ahead and invoice them at full market rate for the work anyway. They may tell you no but it's worth a try. These are all good skills to have if this happens to you again.

<comment><AUTHOR> Thanks, that was a very practical advise!

</comment></comment><comment><USER3> What terms did you agree to before making the webpage? If you didn't license them to use your code or give them ownership outright, you probably have copyright and they are probably in violation of your copyright if you can prove they misappropriated your code wholesale.

</comment><comment><USER4> Are you entitled to be paid for your work? Yes. Do you have a case against them? Probably yes. Is it worth your time? Probably not.

I'm guessing we're talking about a pretty small code test that took you maybe a day tops, in that case it's really not worth putting yourself through the ringer just to prove a point. Yes, they're assholes for doing this, but as many have said before, the best revenge is your own success without them.

</comment><comment><USER5> We ask candidates to do real technical work for us as part of the interview process. We also pay them for it, and have them sign a contractor agreement which includes transfer of IP. Shitty that these guys didn't seem to offer you that level of respect.

</comment><comment><USER6> How much do you care about it? Options are:

* Let it go.

* Keep contacting the founder hoping this is just a misunderstanding.

* Be proactive.

For option 3 you would want to write down timeline and gather all of the evidence (commit logs, website screenshots, communications with the founder). After that you can let him know that he is using your work without permissions, submit a small claim court case, or talk to a lawyer.

<comment><USER7> I vote for small claims court. Quick to do, cheap (no lawyer needed), and can award enough to cover your costs, and should teach them a lesson.

</comment></comment><comment><USER8> Cheap lesson learned. We have all been burned. You may spend more time trying to recoupe anything from this. Others have advised similar, write it off, he's a bad customer.

Later, if he wants changes you have a few options:

1) Do the work and keep in safe, and send a screen shot.

OR

2) Ask for payment up front, and back pay.

Then collect before giving anything over.

Edit: Call him on the phone, leave a message and be totally honest, "I feel you are dodging my communication to avoid paying me". If he's honest, he will pay up, and even be ashamed and embarrassed. If he's dishonest, you'll get nothing, at least you will know for certain either way.

</comment><comment><USER9> > What can I do in this case?

You can simply Move ON. Lesson learned.

Don't expend any more time/money/energy on these clowns!

<comment><USER10> True to that, but feel a bit violated.

<comment><USER9> I've been there, the PAIN is real. You can handle it.

It's just a little blip in the Grand Scheme of Things.

Utilize this pain as a call to action.

Focus on stuff you can control. Re-Set your priorities.

Now get in gear.

</comment></comment></comment><comment><USER11> They did not pay you for your work, therefore the work is yours and they have stolen it. They are in violation of your copyrighted works. Speak to a lawyer and seek damages.

</comment><comment><USER12> Make sure you screenshot everything and save all communications. Try putting delivery and read receipts on all emails so they can't claim they didn't receive/read them. Make any calls to anyone whose number you have. If this was through a recruiter, contact the recruiter. Yes, the recruiter technically represents the company and not you, but at least you can then make another claim at communication. If you still can't get a response, certified mail or something like that to the business's registered agent address (which they are required to have by law). Then they cannot claim they did not receive communication and will almost certainly be forced to respond in some fashion, even if it is a formal denial.

I also assume you have proof that they either requested this of you or that you have all the raw files used for developing the site that a mere visitor to the site wouldn't have, yes? If so, register that with the copyright office immediately so they cannot do so.

They will probably claim a "misunderstanding" to which you can request that they either produce the paper which you signed granting them the rights to your work (which I assume you didn't sign anything) or the financial record showing that they paid you for it (which they obviously did not do).

The big question is this - did you do this as a project at home as part of the interview? I assume you did since I doubt you would be expected to do it right there on the spot, but I could be wrong. If it was on their computer systems, it becomes much more difficult to lay claim since they own everything done on their computer systems. I assume this was done on your free time at home to go along with a fact to face interview and you submitted the finished product before the in-person interview.

</comment><comment><USER13> If you believe you are legally entitled to money (you agreed upon a payment) or didn't assign copyright, you can sue them. I don't know where you are, but in the UK for example, the small claims court handles cases like this (up to £10,000 of damages), and it's a case of filling out a form and sending it off, you don't need to have a lawyer but it's sometimes advisable. From the Intellectual Property Enterprise Court guide: "The IPEC small claims track is designed to be used by parties who do not have a legal representative acting for them. Accordingly it has more simplified procedures than a standard civil claim...".

I would advise looking at what small claims options your jurisdiction provides.

</comment><comment><USER14> Well if ya have $1200 to burn, you should sue them. It's a good exercise because if you're freelancing, you should get use to it. It's highly effective to be litigious if you're freelancing.

ALWAYS protect yourself and your work or, as you can see, you're worthless.

</comment><comment><USER15> Lots of good advice here.

Assuming it was actually recent (as in a couple of months or less), consider actually _registering_ the copyright on the webpage with the US govt.

If your work ends up enabling a wildly successful funding event, you'll be unable to get much more than the federal filing fee if you sue the company for copyright infringement.

Unless it's a registered copyright, at which point you can take them to the cleaners. I believe it's $200 +/\- to register, and there are restrictions which may or may not apply in your particular case.

</comment><comment><USER16> File a DMCA takedown notice with the webhost, and file a case in small claims court for the amount you should believe you should be paid for the work. small claims filing should cost about $25-100 to file, depending on the county. Small claims court caps the damages to a few thousand, but no lawyers are required and many small claims courts don't even allow parties to bring lawyers.

</comment><comment><USER17> It's a life lesson. You won't make that mistake again. No contract? No recourse really

If it's more than 100 hours work you might think about legal action. Less than 100 hours perhaps pull a face when other people mention the company and tell the story off the record, definitely not recorded. The company's reputation will come back to affect them

</comment><comment><USER18> I would talk to a lawyer.

</comment><comment><USER19> Build the pages on your own servers and use server-side code that would break the page if it wasn't present.

On the plus side, you now know that you _do not_ want to work for that company!

As for what you can do about what has already happened, definitely consult a lawyer if you feel it is work perusing. It may be worth taking to small claims.

<comment><AUTHOR> That's a good idea .. should not have committed the code but hosted on my server. Will keep in mind for future.

</comment></comment><comment><USER20> You could choose to accept payment in the form of a life lesson. This jagoff just taught you that there are jagoffs like him in the world. Maybe this will save you from a much more damaging jagoff in the future.

It might be nice to stop this jagoff from being a jagoff to other people but it's probably not worth the stress.

</comment><comment><USER21> You can sue. I'm not sure where you are but most places have something called small claims court where you can sue for small amounts of money without hiring a lawyer. Most small claims court don't have the authority to make them remove the website though, all they can do is make them pay you.

</comment><comment><USER22> Do you have a contract with said company? What are those terms? Can you prove you made it 100%? The code and graphics? A copyright case is long and expensive so it may not be worth it to chase bad or no money. Pro bono maybe, but I doubt that too. I hope you learned a valuable lesson tho.

</comment><comment><USER23> Send them an invoice.

<comment><USER24> With terms for 30 days before additional fees kick in

</comment></comment><comment><USER25> This guy had a similar experience. I think your options depend on how much you think you can recover.

[https://youtu.be/vtcXBYSSElQ](https://youtu.be/vtcXBYSSElQ)

</comment><comment><USER26> When he inevitably comes back to you wanting changes, refuse to do so until you receive payment for work done so far. Make sure that a suitably solid contract is in place for future work.

<comment><USER6> Or he could dupe someone else into making changes as a take home interview homework...

<comment><USER27> The joke's on him when he gets 5 different UI frameworks on his page that way.

<comment><USER28> That's probably already the case.

</comment></comment></comment></comment><comment><USER29> This doesn't add to the conversation but I'd really like to know the website.

<comment><USER30> We can give it the HN hug of death.

</comment></comment><comment><USER31> Negative review on Glassdoor?

</comment><comment><USER32> That's why your code should have included a backdoor. You missed a golden opportunity here.

<comment><USER33> Don't do this. This is a felony in the states. ( [https://en.wikipedia.org/wiki/Computer_Fraud_and_Abuse_Act](https://en.wikipedia.org/wiki/Computer_Fraud_and_Abuse_Act) )

<comment><USER34> Have some function in the code which will scramble the whole thing at a later date. If you actively maintain the code, keep pushing the date. If they pay you for your work, remove this function.

This is a 'security feature' which you could deploy in future situations. I do not believe this particular implementation would be violation of any laws.

</comment></comment></comment><comment><USER35> wow, you should at least mention the URL and the company name here.

<comment><AUTHOR> I really would do that but right now giving benefit of doubt ... but want to know my options

<comment><USER19> Talk to a lawyer before disclosing that sort of information! You don't want to be hit with slander charges.

<comment><USER36> Slander is oral speech; libel is the one you're looking for. My understanding is that a statement has to be false in order to be libel, but I wouldn't advise the poster to take legal advice from a rando on HN like me.

<comment><USER37> Which I always use [this scene][1] from Spider-Man to remember:

      Peter Parker: Spider-Man wasn't trying to attack the city, he was trying to
                    save it. That's slander.
      J. Jonah Jameson: It is not! I resent that! Slander is spoken. In print,
                        it's libel.

[1]: [https://www.youtube.com/watch?v=vcM1kTZm- nM](https://www.youtube.com/watch?v=vcM1kTZm-nM)

<comment><USER38> Etymology is your friend here: Libel has roots in the latin for "document". Think of "library".

</comment></comment></comment></comment></comment></comment><comment><USER39> Department of labor, "employment fraud"</comment>


How To Build Apps In C#, WinForms and ASP.NET Using Mono In Raspberry Pi - <AUTHOR> http://www.amazedsaint.com/2013/04/hack-raspberry-pi-how-to-build.html

<comment><USER2> Neat. I've been using one of my Pi's for a Perl project. I have a second part of the same project that I'm building in C# using the Nancy[1] framework. Looks like I can host the whole thing on the same Pi.

[1]<http://nancyfx.org></comment>


Meow Hash – An Extremely Fast Non-Cryptographic Hash - <AUTHOR> https://github.com/cmuratori/meow_hash <comment><USER2> I haven't had trouble finding non-cryptographic hashes: [https://cyan4973.github.io/xxHash/](https://cyan4973.github.io/xxHash/)

How does this compare?</comment>