Post-mortem of March 12 Google outage - <AUTHOR> https://status.cloud.google.com/incident/storage/19002 <comment><USER2> > [https://landing.google.com/sre/sre-book/chapters/reliable- > pr...](https://landing.google.com/sre/sre-book/chapters/reliable-product- > launches/)

> Almost all updates to Google's services proceed gradually, according to a > defined process, with appropriate verification steps interspersed. [..] The > first stages of a rollout are usually called "canaries" — an allusion to > canaries carried by miners into a coal mine to detect dangerous gases. Our > canary servers detect dangerous effects from the behavior of the new > software under real user traffic.

> Canary testing is a concept embedded into many of Google's internal tools > used to make automated changes, as well as for systems that change > configuration files. [..] If the change doesn't pass the validation period, > it's automatically rolled back.

Any Googlers around to explain why Canaries didn't catch configuration causing this side effect and stopping the deployment before the issue cascaded globally?

The outage here reminds me of issues CloudFront faced wrt configurations in their earlier years. Here's master presenter Harvo Jones going into a bit more detail: [https://youtube.com/watch?v=n8qQGLJeUYA](https://youtube.com/watch?v=n8qQGLJeUYA)

Kind of vindicates AWS' decision (after major outages to DynamoDB and S3) to not just isolate regions or zones but resources within those regions/zones further into what they call "cells" [https://youtube.com/watch?v=swQbA4zub20](https://youtube.com/watch?v=swQbA4zub20)

Tumblr spoke abt "cells" too in the context of achieving isolation at scale, but in a quite different way: [http://highscalability.com/blog/2012/2/13/tumblr- architectur...](http://highscalability.com/blog/2012/2/13/tumblr- architecture-15-billion-page-views-a-month-and-harder.html)

As these known-knowns (and the Google sre-book is teeming with these) get designed around, it'd be interesting to see why/how future outages would happen.

<comment><USER3> > Any Googlers around to explain why Canaries didn't catch configuration > causing this side effect and stopping the deployment before the issue > cascaded globally?

I'm not (any longer) a Googler, but according to the postmortem this was a load-related incident. Canary changes only have a small amount of traffic directed at them (by definition) and the problem probably didn't become apparent until after the change was promoted from canary.

<comment><USER4> Going further...

Googles 'Canary' system is sub-optimal and risky.

It picks a subset of the system (say 5%), and deploys the change there. It then observes this 5% of the system, and if it's okay, it rolls out to the rest of the system.

Compare that to a continual-canarying system:

* Start deploying the new code gradually (say 1 container/pod/task every second).

* While the above is in progress, continually collect stats from upgraded and non-upgraded systems.

* If the stats differ to any significant level, halt the rollout.

The continual-canarying system is much better because the sample size to see a 'significant' change depends on the size of the change and the amount of natural variation in the sample. The size of the change obviously can't be known beforehand. The variation varies widely depending on the metric of interest (cpu, memory use, request latency, etc.).

It is therefore impossible in googles canarying system to choose a suitable subset size to detect (with a sufficiently high statistical power) small but important changes in a metric while still stopping the rollout early enough for catastrophic changes in a metric.

Continual-canarying effectively solves this issue by gradually increasing the sample size as the rollout goes on.

In reality, neither continual-canarying or google-canarying work well for detecting anomalous metrics because the rollout process itself causes applications to restart, which in itself changes their performance characteristics (cold caches, empty queues, first-use delay, jit optimization, etc.).

The solution to that is to do two simultaneous continuous-canary rollouts - one of the existing version (effectively just a restart) and one of the new version, and use those two groups as input to the logic to decide if any metrics of interest have statistically significant changes.

Please go implement this stuff Google! It won't be hard to do, and will really increase the safety of your rollouts. (Even though I know it wouldn't have helped this time)

<comment><USER5> So you'd think this would be the case. I certainly did when I first joined. In fact, I actually proposed something even more extreme than your suggestion (use thompson sampling to control the rate of task restarts and rollbacks). But in practice such a continual canarying process isn't actually any better than a staged canary (like .1% -> 1% -> 10%).

Consider the types of issues you run into, there are

\- Things that are painful, but not destructive (minor performance regressions)

\- Things that are highly destructive (data gets deleted, major performance regressions, etc.)

The first you can handle being deployed to many people, so if you detect at 7.8% of your users instead of 10% doesn't much matter, you can run it at 10% forever without issue.

The second you'll detect on a smaller population because the changes are catastrophic.

>In reality, neither continual-canarying or google-canarying work well for detecting anomalous metrics because the rollout process itself causes applications to restart, which in itself changes their performance characteristics (cold caches, empty queues, first-use delay, jit optimization, etc.).

The problem here is that most of the time, you don't care about startup behavior, but steady-state behavior. Imagine that a new version introduces a memory leak, so the old behavior was to linearly increase to 1GB of memory over 1 hour and then level off, and the new behavior is to increase unbounded until eventually the system OOMs and restarts or whatever.

A "google style" canary would roll out to 1% of tasks or something, wait a few hours, and notice the difference and roll back. You might even experience 1% of tasks restating, but it's likely that the system can sustain that.

With the continuous canary, you'll release to 1 task per minute or whatever, and only be able to notice any change after you've pushed out to 60 tasks, and the change will likely only be detectable with any confidence once you have a notable difference in 120 or so. At that point, you've released to more than 1% of your tasks (either that, or it takes you 8 days to release a new version).

You can fix that by slowing the rate of releases, but now it takes you 8 weeks to release a new version.

Plus, even worse, you're now in a much more fail-open environment. With a 1% release, you can sustain in the kind of bad state if all of your qualification tooling fails. If you're continuously canarying though, you have to be much more careful to make sure that your tooling won't continue to push if the tooling itself is broken or getting unusual results. It's a more risky set up.

<comment><USER6> You seem to have thought about it in depth and my comments maybe missing some insight

A) Your argument is optimised for a certain type of failure which leaves you open to the others ( issues that are detected after high ratio deployment ) B) You can monitor just the jobs impacted by the canary deployment C) the progressions you discuss seem strawman like. You can have a doubling progression starting at 1 or 5, a tripling progression

D) the point about detecting at 7.5 and living at 10, what if it's detectable at 20 and you've gone all out by then

<comment><USER7> Another thing to keep in mind is that you don't just want problems to be detectable: you want them to be diagnosable and fixable.

If you detect a problem with FooBar frontend at 1pm, the first question anyone's going to ask is, "What changed in FooBar frontend or any of its dependencies at or shortly before 1pm?"

If the answer is, "Bazz backend deployed at 12:50pm" then someone with no understanding of the innards of FooBar or Bazz can roll back Bazz and there's a pretty darn good chance they'll have fixed the problem quickly. This is a scalable approach to fixing things that works well in practice.

If the answer is, "Nothing just changed. Every layer of the system has been gradually changing all day" then your oncall person will need an in-depth understanding of every service involved in the system as well as creativity in guessing where to start looking. It can work, but it's going to be slower and more difficult and fewer people will have the system-specific knowledge and debugging skills do it well and quickly.

</comment></comment></comment></comment></comment></comment><comment><USER8> > On Monday 11 March 2019, Google SREs were alerted to a significant increase > in storage resources for metadata used by the internal blob service. On > Tuesday 12 March, to reduce resource usage, SREs made a configuration change > which had a side effect of overloading a key part of the system for looking > up the location of blob data. The increased load eventually lead to a > cascading failure.

Any idea what this means? What kind of configuration change would reduce storage but overload the system? I imagine turning on compression could do that, but I'd expect it would be easy to reverse. (Edit: Maybe it was the cascading failure that made it more serious?)

<comment><USER9> Two straightforward changes in Bigtable or Spanner are changing tablet compression settings or tuning compaction more aggressively.

Edit: given the mention of a job that got stopped, perhaps they had a tool that manually forced compaction of data in order to adopt new compression settings or purge deleted rows. Normally, compactions would happen on the tablet servers on a cycle of N days.

Another possible explanation is that they tweaked the garbage collector, which runs on the master.

<comment><USER10> These seem really likely. Being a bigtable operator is exactly like being Mickey Mouse in the Sorcerer's Apprentice. You want buckets of water? Okay.

</comment></comment></comment><comment> Pirate-of-SV Nice post-mortem. Being in a smaller engineering org. these write ups feels really premium and something to strive for to provide to our customers when things hit the fan.

</comment><comment><USER11> Google down March 12

Facebook down March 13

Apple(iCloud) down March 14

<comment><USER12> If I were a betting man, I'd say Microsoft (Azure) down March 15 and AWS down March 16.

<comment><USER13> And Pizza Hut's online ordering system is going to fail on April 20th.

<comment><USER14> (°ʖ°)

</comment></comment></comment></comment><comment><USER15> > On Monday 11 March 2019, Google SREs were alerted to a significant increase > in storage resources for metadata used by the internal blob service. On > Tuesday 12 March, to reduce resource usage, SREs made a configuration change > which had a side effect of overloading a key part of the system for looking > up the location of blob data. The increased load eventually lead to a > cascading failure.

Just some guesses (not affiliated):

I wonder if there was something related to Tombstones and deletion of extra data? That can often be a failure of replicated sharded big data systems using sstables and tombstones for deletion.

Another guess might be that some sort of internal shard count was increased resulting in some lookup process needing to check n more shards per call.

<comment><USER4> The root cause of a cascading failure can be really minor - just something tiny that tips the system over the point of no return.

The real question is why don't us systems-designers have better tests for cascading failure? Even Google has very few tests which deliberately overload a system (to cause it to fail), and then verify that it can recover on it's own promptly under typical loads.

Eg. consider a database which serves a web application. If the application times out querying the database, it retries up to 5 times. That is a system with an unrecoverable cascading failure, since if one day we get a small spike in users, the database becomes slow, and a few timeouts occur, some requests will get retried, putting more load on the database, making it slower, causing more timeouts, and the problem gets rapidly worse until a few minutes later all requests are failing. Even when the spike in users is over, the database will remain effectively dead, because it is still failing under load from all those retries.

A load test that didn't push the system over the edge and then test for recovery wouldn't be able to detect that.

Too many people loadtest things to the point of failure and then stop. All it takes is to continue the test for a few minutes longer with a slightly lower load to verify recovery!

<comment><USER16> Because there are unlimited number of failure modes for cascading failures. Going through all postmortems, you'll find it hard to find same kind of failures. Every time it's something unique.

Also it's difficult to get a good coverage by just pushing things to its limit. Let's say you have a system which has this RPC chain: A -> B -> C -> D. And not all requests cost the same and not all requests make way to D. In reality it's interesting that different composition of traffic may overload any of them. For example, some queries may hit expensive ML models while some other queries have a large number of candidates. In this case the former hits predictor service hard while the latter may hit index serving systems. I've actually read an outage happened during superbowl because sports-related queries are particularly expensive for some part of the system.

</comment></comment></comment><comment><USER17> Why are all these high profile services going down in such a short window? Anyone else thing this is odd? Rarely do we see such incidents occur, let alone to pretty much all these companies.

<comment><USER18> [https://en.m.wikipedia.org/wiki/Poisson_clumping](https://en.m.wikipedia.org/wiki/Poisson_clumping)

<comment><USER19> Non-mobile link: [https://en.wikipedia.org/wiki/Poisson_clumping](https://en.wikipedia.org/wiki/Poisson_clumping)

</comment></comment></comment><comment><USER20> > We will make software measures to prevent any configuration changes that > cause overloading of key parts of the system.

If it was possible to know these a priori, why allow them in the first place?

Or are they saying they will be writing software to roll back configuration changes that cause disruption? ("disallowd")

<comment><USER21> I read that as either rate/resource consumption limits, or a hard time-limit for a task to complete before it's aborted (rolled back).

</comment></comment><comment><USER22> 99 cases out of a 100 it's a "configuration change" in a very large system that's so large and complex nobody can comprehend it anymore. Decentralize, folks.

<comment><USER23> Not sure why this gets downvoted. This is an entirely valid comments.

It's getting increasingly obvious that despite being highly _distributed_ , cloud systems run by Google, Amazon and other big cloud companies are inherently _centralized_. If nothing else, they have centralized controls.

A decentralized system can, of course, fail, but it would never have "configuration change" as the root cause.

<comment><USER24> S3 is (for want of a better term) a legacy system in AWS, having been around since pretty much the beginning. A series of choices made when the idea that there would ever be more than two regions, leave them unfortunately stuck having to tie regions together to a limited degree (bucket names are global).

Beyond those bucket mutations, everything else is purely regional scoped.

I'm _really_ surprised to see that GCP has made the same mistakes though and had things tied together. I'm not convinced there's a good excuse. AWS/S3 is understandable. No one knew what things would look like. Not one engineer would have made the same decisions then if they'd known what the future was for the platform. Google came to the cloud market much later. Their engineers should have seen the issues with AWS and the problems that interdependence cause, and specifically architected isolated infrastructure (which from this post-mortem it seems like they didn't). That's both remarkable and disappointing to see.

<comment><USER25> >"A series of choices made when the idea that there would ever be more than two regions, leave them unfortunately stuck having to tie regions together to a limited degree (bucket names are global)."

Could you elaborate on those choices? Also what do you mean by they're "stuck having to tie regions together"?

<comment><USER24> The main thing is that bucket namespace is global. There is only one bucket "foo" worldwide. That means that _every_ bucket mutation event (e.g. bucket deletion or creation) requires co-ordination between regions. When that big us-east-1 region outage occurred a year or so back every other region worked fine _except_ for bucket mutations.

</comment></comment></comment></comment></comment><comment><USER26> Whoever had "Configuration Change" in the betting pool in the other thread wins all the upvotes!

(I believe it was the most upvoted response too, although now I of course can't find the thread)

<comment><USER27> "configuration" is what we call code that has the greatest potential impact and the least amount of static checking.

</comment></comment><comment><USER28> In Firefox I get a blank page with 2 "PARSER.process false" messages in the javascript console...

</comment><comment><USER29> The FB outage yesterday was also apparently caused by a configuration change: [https://twitter.com/facebook/status/1106229690069442560](https://twitter.com/facebook/status/1106229690069442560)

<comment><USER30> LOL at the first reply: "I was hoping that @FBI was raiding your campus and arresting your leadership."

<comment><USER31> Keeping my fingers crossed.

</comment></comment></comment><comment><USER32> "destroy the skynet" john connor

</comment><comment><USER33> When SREs are the reliably problem...

</comment><comment><USER34> Dear Google:

I don't want to sound negative (that's not the purpose of this message), but my belief is that this incident is a heart palpitation on the way to a major coronary, stroke, or heart attack... Let me explain to you why.

You see, as your company has grown, so has the complexity of your codebase and so has the number of people who maintain that code.

The complexity of your code has increased, perhaps asymptotically (since you seem to like Big-O notation and related subject matter, from what I hear, at your interviews), yet I'd be willing to bet that the overall knowledge of the codebase that the average worker there has, has actually diminished (although perhaps not asymptotically, perhaps linearly) over time.

In other words, you've got too many chefs, and a soup with too many ingredients where every chef knows some of them, but not all of them.

Maybe Jeff Dean is the exception to that, but that's what you've got going on, basically.

When something like this happens, your responsibility is to a) Educate your rank-and-file, even at the expense of new product releases, b) Re-delegate, insuring that there aren't too many chefs to soup, c) Reduce the ingredient count (refactor), and perhaps most important d) Make sure there's someone, anyone, who understands _ALL_ of the codebase from top to bottom (difficult when you've got multiple source-code contributors making changes, and multiple layers of people only responsible for some aspects of the system...).

(Oh, and if it were me, I'd go as far as to buffer the entire incoming datastream so as to be able to replicate the problem, and if you can't do that (run a buffered datastream from a point in time against a point-in-time snapshot of all data at that point in time, and see exactly where in code the problem occurs), then your first goal is to be able to do exactly that. But I'm a little extreme in what I feel qualifies as acceptable testing...)

<comment><USER35> >Make sure there's someone, anyone, who understands ALL of the codebase from top to bottom

Either you seriously over estimate the limits of ones understanding, or you severely under estimate the size of Google's codebase/monorepo.

At this point, I'm pretty sure it's impossible to even check it out on a single developers workstation due to its size.

<comment><USER34> [https://www.joelonsoftware.com/2002/11/11/the-law-of- leaky-a...](https://www.joelonsoftware.com/2002/11/11/the-law-of-leaky- abstractions/)

...Also, compare that to the Bible's "Tower Of Babel" story:

[https://en.wikipedia.org/wiki/Tower_of_Babel](https://en.wikipedia.org/wiki/Tower_of_Babel)

The Bible's story is about human language, specifically about how human languages encompass greater degrees of abstraction over time (languages built on top of languages, abstractions built on top of abstractions).

But, when you get to a certain level of abstractions, the abstractions start to "leak". That is why there are communication difficulties in societies (people who are more educated typically speak a different language than people who are less educated; academia and lawyers speak their own language).

This is also when/where/why/how software starts to fail.

Too many levels of abstraction, and those abstractions will "leak".

Don't take my word for it, use your own logic, your own common sense and think about it...

Software problem A exists.

Management Team: "We have a problem, can you fix it?"

Programming Team: "Sure." (fixes it, but this causes problem B, which is not recognized until several weeks later)

Management Team: "Now we have this different problem, can you fix it?"

Programming Team: "Sure." (fixes it, but this cause problem A to resurface, which is not detected for several weeks...)

Management Team: "We have a problem, can you fix it?"

And the cycle repeats...

Was it the programming team's fault?

No, it was the nature of the beast called "complexity". The higher you go in abstractions (and this is especially true for AI), the more you must exercise ENGINEERING DISCIPLINE. You must be able to go BACKWARDS IN TIME (this is accomplished in programming by being able to go back to simpler programs and fully understand / test them before advancing to more complex ones, and PRESERVING THAT CHAIN OF UNDERSTANDING...).

This is probably why advanced societies destroy themselves, too much abstraction, too much "magic" (without understanding of all of the sublevels), and no one has the exact knowledge necessary to pinpoint exactly when/where/why the exact problem occurred...

But again, don't take my word for it. Use your own common sense to determine if what I'm saying has any merit...

</comment></comment></comment><comment><USER36> I've worked in three separate companies that had each hired a ton of ex Google engineers in their early years, and the systems they have are all identical to each other and seem like a poorly recalled-from-memory version of these types of patterns.

It's like a strange simulacrum of some bazel-like build tools but not as mature as bazel but also can't be swapped with real bazel due to tech debt issues, and same with canary deployments, monorepo layouts, etc.

It's become something that I actively seek out information about when I interview for new jobs so I can actively avoid all these Google-but-not-quite- with-enough-resources-to-pull-it-off antipatterns.

Worse yet is that in many of these shops, those early employees who came from Google just stayed long enough to mutate the whole monorepo / homebrewed bazel clone / canary deploys mess into a pile of unmaintainable crap that couldn't be migrated away from without huge business risks, and thenthey mostly all quit and a lot of them even went back to Google!

I call it the Google Borg Syndrome. Same crap monorepo ideas, same crap canary ideas, same crap bazel-like build system ideas just spread like kudzu. It really shows how bad the ideas themselves are, and how if it wasn't for a giant money and labor-hours faucet that Google can shoot at these systems, they would be unmasked as deeply poor ways of solving engineering problems.

<comment><USER4> >they would be unmasked as deeply poor ways of solving engineering problems.

The best technical solution to problems can depend a lot on company size. These people are using a big-company solution in a small-company. And it nearly works, but not quite.

Big companies reinvent pretty much everything internally - You won't find Chef, Jenkins, Slack, Apache, Nginx, or any of that stuff at Google. Yet a small startup would be stupid not to use tooling developed and maintained by someone else almost everywhere.

In turn, the best solution to a problem depends on which tools you have at your disposal.

<comment><USER36> I agree to a large extent. But specifically in the case of

\- using bazel instead of make

\- using a monorepo ever

\- using Google-style canary deployment ever

I think they are just nearly totally objectively bad ways to solve problems whether at Google scale or otherwise, with obvious alternatives that are strictly dominating in the sense of being unilaterally better in all use cases.

These techniques have to be kept afloat with the money faucet. I guess I can agree that if you have enough money that you can offer pay packages that cause people to be willing to endure the hardship of propping bad systems up, then you don't have to care about what systems are effective.

For example, you could shoot lots of holes in a boat and then hire a full time staff on $500k / year to scoop water out fast enough that the boat seems to operate just fine.

Then get the ACM to write a big publicity piece about how hole-filled boats are the best design and anyone not shooting holes in their boat is Doing It Wrong.

This is not even exaggeration to offer as an analogy to Google's combo use of monorepos + bazel.

<comment><USER4> Bazel is designed for big projects and distributed compilation. Unless your company has >500 engineers, it isn't going to make sense.

I like monorepos - and in my experience you don't need special tooling for them until you have thousands of engineers. I just don't really see the point in splitting all my business logic into 50 different repos all of which have 25 branches and then I'm having versioning, dependency, and incompatibility hell between them. One repo, one 'master' branch, lots of tests, and as soon as all tests pass, auto-deploy!

The 'canary deployment server', complete with webUI I think is a mistake, even for Google. If they were using kubernetes, it would have a 'Deployment' object, and canarying should be a feature of that, just like rolling updates are. Actually how that works is an implementation detail of kubernetes and is abstracted away.

<comment><USER37> I've used Unix make for personal projects (during and after school) and bazel at work.

"bazel" is more about type checking the build artifacts, caching and guarantees about hermetic and reproducible builds. The distributed compilation is just supported but not a requirement IIUC. idk if it's the best tool but definitely an upgrade over "make".

Whereas "make" looks like an old pseudo scripting utility which has too many degrees of freedom with not much guarantee and is fragile as a result. I think those who learned its quirks love it but I don't.

I've also liked mono repos at work as long as their operations are not sluggish. They immensely help global refactoring, static analysis and reduce the amount of merge conflicts.</comment></comment></comment></comment></comment>


How to begin touch typing and Why - <AUTHOR> https://medium.com/@nashvail/how-to-begin-touch-typing-and-why-1cbac413a11e

<comment><USER2> I can suggest TypingStudy ([http://www.typingstudy.com](http://www.typingstudy.com))</comment>


Spotify opens its doors to developers - <AUTHOR> http://developer.spotify.com/en/libspotify/overview/ The libspotify C API package allows third party developers to write applications that utilize the Spotify music streaming service. <comment><USER2> That's Interesting. Does anyone know if we can stream the music from anywhere? If I remember, spotify was supported only in UK and some other countries in Europe.

<comment><USER3> It says only premium accounts can request developer keys. So if you're not in a supported country, I guess getting those dev keys will be hard ;)

Guess it's finally time for you US guys to feel left out :P</comment></comment>


Facebook Traffic Tanks - This can't be real? - <AUTHOR> http://gigaom.com/2007/10/10/facebook-users-dip-could-this-be-true/

<comment><USER2> It 'tanked' to where it was over the summer?</comment>


Mikhail Gorbachev: 'It All Looks as If the World Is Preparing for War' - <AUTHOR> http://time.com/4645442/gorbachev-putin-trump/ <comment><USER2> You wonder how the world can sink into war and then you start to understand how it works when you study today's political climate.

It seems like a slow motion inevitability.

People's opinions are just so strong.

To make matters worse, seems like the smartphone revolution has provided quick communication channels that magnify the rhetoric.

Forget more information at your finger tips, smartphones and the internet provide easier means of finding like-minded people to raise pitchforks with.

<comment><USER3> It's not the speed that's the problem, it's that they aren't as well vetted, nor are they diverse. It's easy to avoid uncomfortable facts and opinions. It is necessary to get variety in order to triangulate and assess.

<comment><USER4> The Balkanization of news and opinions is a minor facet of the overall situation that's unfolding.

The biggest thing going on is opinion shapers and propagandists have been given powerful tools the 20th century PR men could have only dreamed about. Growth hacking, sentiment analysis, personal network analysis, and deep learning are all things that allow cunning people to do extraordinary things.

Messages can be tested and fine tuned to see which ideas resonate. Communication channels can be established directly to the recipient of your message by creating Facebook groups and the like.

People simply haven't developed this critical thinking skills to defend themselves from this new onslaught of opinion shaping tech whose efficacy is based on very timely data.

I imagine Boyd's Law of Iteration is going to be a huge factor in deciding who wins the new propaganda wars. [https://blog.codinghorror.com/boyds-law-of- iteration/](https://blog.codinghorror.com/boyds-law-of-iteration/)

Updated: Minor edits for clarity

</comment></comment></comment><comment><USER5> Scary prospect for us all.

I read a Pilger article last year that sent chills down my back:

[http://johnpilger.com/articles/a-world-war-has-begun- break-t...](http://johnpilger.com/articles/a-world-war-has-begun-break-the- silence-)

<comment><USER6> His view of the world is very skewed. I wouldn't take him as an authority.

</comment></comment><comment><USER7> While I'm not discounting the current geo-political climate, but every so often you'll see reports that some calamitous event will occur. When it invariably doesn't occur, no one follows up and says "why did you say that, nothing happened". If it does happen though, they can say "See, I told you so!"

</comment><comment><USER8> Clickbait-y title from Time magazine. No easier way to actually start a war than to talk about it and how the "others" are somehow more prepared.

Very sad to see such article from one of the few still supposedly reputable publishers.

</comment><comment><USER9> Oh no, they are concentrating weapons in Europe!

Maybe we should stop shelling the east of Ukraine and get out of its south (Crimea)?

</comment><comment><USER10> As a former Soviet citizen, I fail to see why anyone would care what this clown has to say. No one in Russia cares, for example. He basically ran a superpower into the ground in 6 years flat, from space shuttle to hunger and abject poverty for most of the population. Not even a CIA puppet regime would be able to do a better job.

<comment><USER11> I wish people wouldn't downvote someone for an alternate opinion. It's interesting to see the Russian view point on these things. I think the parent poster is indoctrinated with the typical anti-western mindset, but it's still valid and adds to the discussion.

> He basically ran a superpower into the ground in 6 years flat, from space > shuttle to hunger and abject poverty

The Soviet Union was in free fall economically long before Gorbachev. It was a systemic failure. To pile the genocidal failings of 3 generations of communist rule onto the first leader to free his people from that oppression is a terrible perversion of history.

<comment><USER12> I lived in Soviet Union as well during the collapse. I think there is a lot of propaganda from the west that makes you think it wasn't Gorbachev's fault.

People were happy, had children and believed in their country and made progress in art and science. Then one person who possibly had good intentions "gave everyone freedom". You can't just do that without consequences. It should have been a very gradual transition similar to how it is in China. Instead the country got completely destroyed. Every single thriving industry collapsed and people's savings were worth nothing basically overnight. Police stopped enforcing laws, gangs appeared all over the place, everyone started doing drugs. It was a disaster.

Gorbachev was almost immediately hated throughout the country.

If USSR economy was in free fall, how come GDP per capita was about 2x smaller in Soviet Union compared to USA in 1989 while income distribution was much more even?

Edit: If you believe propaganda in US doesn't exist, look at this law [https://foreignpolicy.com/2013/07/14/u-s-repeals- propaganda-...](https://foreignpolicy.com/2013/07/14/u-s-repeals-propaganda- ban-spreads-government-made-news-to-americans/)

<comment><USER13> > People were happy

Russians - may be, All the other oppressed and occupied nations - no. Cant vouch for other but almost every Estonian secretly hoped for freedom and despised Russians. When our chance came we acted swiftly. Soviet Union was just another form of Russian Empire and a way to try to control the world.

<comment><USER14> This is a similar tale told by friends from Latvia, Lithuania, Poland, Czech Republic and Slovakia.

<comment><USER15> However, for people in these countries it wasn't a tale. It was a harsh reality...

</comment></comment></comment></comment></comment></comment><comment><USER16> Never made this old schizophrenic, he's always keen to get attention</comment>


Kinect home automation - Questions and Answers - <AUTHOR> http://nitrogen.posterous.com/kinect-home-automation-questions-and-answers <comment><AUTHOR> This is just a followup to the home automation Kinect hack I posted last week, addressing some of the questions people had here and elsewhere.

I'll have something more interesting in the future.</comment>


Twitter Suspends Chinese Virologist Acc Who Claimed Coronavirus Was Made in Lab - <AUTHOR> https://www.newsweek.com/twitter-suspends-dr-li-meng-yan-wuhan-lab-coronavirus-covid19-1532193 <comment><USER2> This is important because it marks the point where we cross the Rubicon into territory where social media companies become arbiters of truth.

It's not so much a question of the actual content in this particular case. What's important is that we're no longer limiting ourselves to censoring harassment, incitement to violence, or posts that damage public health or the democratic process. This kind of censorship steps well into the domain of political speech, and regardless of the merits of this particular decision, the long term effects as this kind of censorship becomes normalized won't be good, especially when it's so easy to silence people with the flick of a switch.

<comment><USER3> I definitely agree, though would you say this is the defining event across that line? It seems there has been so much censorship already in the past few months

<comment><USER4> This person has real credentials, she co-authored paper on COVID-19 that was published in Nature magazine: [https://www.nature.com/articles/s41586-020-2342-5](https://www.nature.com/articles/s41586-020-2342-5)

<comment><USER5> Reposting comment from dup at: [https://news.ycombinator.com/item?id=24501195](https://news.ycombinator.com/item?id=24501195)

You don't have to go back far (author -> paper -> author affiliations -> sponsoring foundation ...) before you literally find Steve Bannon's face staring out of the page at you.

I have no idea whether the arguments in the paper are credible or not (I'm not technically qualified to assess them) but the source seems to have a very clear political agenda. That doesn't invalidate their claims but I can't take them seriously without hearing from a more independent source.

There are some fairly distinct signs of media engineering all over this story. Just little things like the paper downloads with the name "The_Yan_Report.pdf" \- what scientist uploads their paper with that name to Zenodo? That sort of thing.

<comment><USER2> But it still begs the question: Why are they being censored?

Regardless of how much BS this person is spouting or who is ultimately behind it all or what their intentions are, we generally hold that someone has a right to spout as much BS as they want so long as it doesn't put people or the democratic process in danger.

<comment><USER5> If they are being censored it is clearly not working because the story is all over the news.

It is possible they are being censored in some places because they look exactly like an influence operation, and COVID-19 misinformation is a huge problem for online platforms right now.

We have people out in the real world right now protesting about Bill Gates' mind control vaccine - activated by 5G - because they have been "memetically compromised" via social media.

I expect it might have gone a little differently if the claims in the paper had been peer reviewed.</comment></comment></comment></comment></comment></comment>


Hello from 1978 - <AUTHOR> http://www.nycresistor.com/2014/05/15/pdp-11/ <comment><USER2> The 11/34 powered the Schlumberger wireline logging units in the offshore Gulf of Mexico, beginning in about 1980. Schlumberger designed dozens of Unibus cards, one as a controller for each logging tool. So most of the system was a giant slotted cage for sliding the appropriate cards for the job, into. The main peripherals were a TI thermal printer and keyboard, a tape drive, a Tektronix display, and a continuous film recorder unit that captured the scrolling Tektronix image. I found this image: [http://2.bp.blogspot.com/-O6FC- DLQI5w/ThWTeDxv2-I/AAAAAAAAB2...](http://2.bp.blogspot.com/-O6FC- DLQI5w/ThWTeDxv2-I/AAAAAAAAB2E/3C7XrbFekp8/s1600/Logging_unit.jpg) The PDPs are lower left; behind the panel directly in front of the engineer is a whole mess of Unibus cards. The most amazing thing about the system might be the number of cards you could plug into it.

Edit to add: The plugin cards were way more than controllers. They were (analog) computers too, fulfilling signal processing functions, and other computations, the poor little PDP could not hope to keep up with. For example, one device detected, I presume using analog circuitry, the peak of the first arrival of a sound wave transmitted through earth and mud, across a couple of meters. The card would report the time between the click and the peak of that arrival, back to the PDP. Nowadays you'd digitize the signal and write a program to look for the peak. Back then you designed circuits!

</comment><comment><USER3> Fifteen years ago I was handed a Wang ([http://www.computermuseum.li/Testpage/WangVS100.htm](http://www.computermuseum.li/Testpage/WangVS100.htm)) and told to get it working. Apparently some company my employer had acquired used this thing to store its business records, and my employer used PCs so they just wanted to archive what was on the Wang then get rid of it.

The thing booted up but there was no display--the integrated screen was somehow blown. So I got a suitable television and that worked, modulo the TV's overscan clipping off the first character on every line. I then found enough adapters to get it to print, connected a dot matrix printer with continuous forms (just like Wang intended!) and printed every single document on the disk drive. Imagine.

It came to perhaps a thousand pages.

<comment><USER4> Reminds me of something similar I did about 20 years ago as a new and lowly employee in an HR department. Said department was part of a larger organisation which of course kept everything centrally on huge mainframes, access to said mainframe being allowed in the regional office by means of a green-screen terminal connected to a dedicated line.

While the mainframe was of course the ultimate authority of what was what, for everyone, our local department just wanted to do some basic employee management on the then new wave of Windows 3.1-based softwares running on local PCs.

But how to populate the PC data? Obviously retyping it was the only possible way, and I was hired literally to do that and nothing else for a month. First thing I said, naturally, was "why not just export it from the mainframe?"

Not possible, I was assured. The mainframe was a secure device for storing secure data and no talk of exporting would ever get through the layers of bureaucracy. The mainframe terminal had no disc drive or local storage, being a thoroughly secure device with a secure connection through the secure floorboards. And anyway, I was hired as a typist so would I please get on with it for the next month, which was how long they had estimated would be required.

An hour later the job was done - with no retyping at all, thank you very much.

How? Well, I'll admit to feeling rather too pleased with myself for knowing that the terminal's attached dot matrix printer was not the only device that could speak RS232. Connected the secure terminal to an entirely not secure PC, and printed everything I wanted straight to disc. Edited the captured file in Wordstar and fairly quickly had a CSV-type file that went straight into the standalone software.

Although I'd effectively instantly put myself out of a job, they were good enough to keep me around. I ended up staying for years.

</comment></comment><comment><USER5> I took one computer programming class in college. PL/1 with a PL/C compiler using punch cards. Said no way, this is absurd.

Three years later (after graduation) I was introduced to an 11/34\. Then an 11/44 with 1MB on internal memory and removable disk packs. On to a VAX 11/780, an 11/785, an 11/750, clustering, an 8650, a 6310, etc. I even built a MicroVax I from parts purchased used.

There's a ton of us who still remember 30 and _60_ amp power supplies and sequenced spin-up of drive stacks.

And we walked uphill both ways to our jobs with nothing but a TI calculator in our pockets.

<comment><USER6> Surely, you mean an HP 16c?

<comment><USER7> I wish more people used RPN calcs. In my EE course in the UK in the 1990s, I was the only person with an HP calc (HP41c and later a 48S). Everyone else was TI and Casio.

</comment></comment></comment><comment><USER8> Always fun, next up doing a SYSGEN on RSX-11M :-) I'm impressed that the RKO5 worked. The filters on those things would often decay into dust.

<comment><USER9> Oh my glob, I remember doing SYSGEN on RSX-11M+. Haven't thought about that since ... probably since I did it (a few times, don't recall the problem I was having.)

Anybody here remember working on TOPS-20 on a DEC-20? And all the crashes when it was in heavy use late in the evening before some big assignments were due ...

All the DECWriters in the room would simultaneously clatter out "%DECSYSTEM-20 NOT RUNNING", there would be shocked silence for 2 seconds, then all the cries of anguish as everyone realized they hadn't saved the last few hours of work.

Good times.

<comment><USER10> _" Anybody here remember working on TOPS-20 on a DEC-20?"_

Yes, I did a lot of work on DEC-20s in grad school. It was the first machine I used that was connected to ARPANET (precursor to today's internet).

I also spent lots of time on a PDP-11/45, although it was running Unix (Version 7 from Bell Labs), not RSX-11. That machine had the old-style console with a toggle switch for each bit:

[http://devilanse.files.wordpress.com/2009/11/6a00c22525688b8...](http://devilanse.files.wordpress.com/2009/11/6a00c22525688b8fdb0123dde0a34e860d.jpg)

To boot it, you'd have to toggle in the address of the boot ROM into the instruction address register.

</comment></comment></comment><comment><USER11> So old, its capacitors grow hair :) [https://www.flickr.com/photos/osr/13896638498/in/set-7215764...](https://www.flickr.com/photos/osr/13896638498/in/set-72157644327706146/)

<comment><USER12> Or beards.

</comment></comment><comment><USER13> I want to know more about the "digitized monkey brains."

<comment><USER14> [http://en.wikipedia.org/wiki/Scratch_monkey](http://en.wikipedia.org/wiki/Scratch_monkey)

[http://www.catb.org/jargon/html/S/scratch- monkey.html](http://www.catb.org/jargon/html/S/scratch-monkey.html)

[edit. huh - that's been edited to remove the actual story. Here's the story: [http://edp.org/monkey.htm](http://edp.org/monkey.htm)]

The jargon file has lots of great stuff in it (also see "Magic/More Magic"). Some versions have had some dubious stuff added, but that's a big old ball of flame waiting to happen, so I'll say read with caution :-)

<comment><USER15> And here is a picture: [https://www.flickr.com/photos/osr/14043543694/in/set-7215764...](https://www.flickr.com/photos/osr/14043543694/in/set-72157644327706146)

</comment></comment></comment><comment><USER16> Meta-nostalgia is when you find one of your own postings in someone else's nostalgia.

I feel old. :-)

</comment><comment><USER12> I do some work in OpenVMS so the video looks surprisingly like 2014 to me.

<comment><USER17> does it still have EDT? If so then I'm sold!

<comment><USER12> Yes, yes it does.

</comment></comment></comment><comment><USER18> "When faced with the bootup of an unfamiliar OS from the 1970s, "DIR" seems to be the most likely command."

I would think "HELP" :)

<comment><USER19> Most of the disk packs have had the help files deleted to reclaim 100 blocks so HELP results in a "?KMON-F-File not found SY:HELP.SAV". If the files are there, it looks sort of like this: [https://www.flickr.com/photos/osr/14008886427/](https://www.flickr.com/photos/osr/14008886427/)

</comment></comment><comment><USER20> Would love to go to a museum with a chronological tour of computing.

<comment><USER21> HNF, the self-proclaimed world's biggest computer museum is the place to go then: [https://www.hnf.de/en/home.html](https://www.hnf.de/en/home.html)

<comment><USER20> Wife will never allow nerd tourism, sadly.

<comment><USER22> So go with some friends instead? Some things are meant to be shared with your SO, some are not. She probably has some preferences which don't match yours as well after all.

</comment></comment></comment></comment><comment><USER23> If you're into this kind of thing and are in Seattle, I recommend stopping by the Living Computer Museum. You get to sit down and interact with the machines. :-)

[http://www.livingcomputermuseum.org/](http://www.livingcomputermuseum.org/)

(They don't have a PDP-11/34, but they have a lot of mainframes and other machines.)

</comment><comment><USER24> The DIR in the video is such a lovely moment, somehow very touching to me .. I've always believed we should not retire computers, and indeed have my own swelling collection of old stuff that still boots and can be used for some purpose.

Old machines never die - their users do. Keep the Expensive Machine running ..

</comment><comment><USER25> The rapid improvement of technology (even forty years ago) really impresses me, especially considering that commercially available handheld calculators were only available eight years prior (and were very expensive.) (I'm a vintage calculator collector.)

</comment><comment><USER26> Enjoying old hardware like this is one of the reasons I've run a mailing list dedicated to the rescue of old computer hardware for the past sixteen years. It was originally Sun-specific but years ago we changed it to cover any hardware.

[http://www.sunhelp.org/mailman/listinfo/rescue](http://www.sunhelp.org/mailman/listinfo/rescue)

</comment><comment><USER27> Man, it is so amazing to see the dates on those files! Some of those files are older than my wife.

</comment><comment><USER28> Very cool! The last time I saw one of these was approximately twenty years ago. It was covered with dust and lying under a workbench in the back of some machine shop in a little town in Israel.

</comment><comment><USER29> Always mount a scratch monkey.

</comment><comment><USER30> The year I was born :)

</comment><comment><USER31> i need to get myself one of these. nice story!</comment>


Japan's buraku, genetically similar to Japanase, still wait for society's embrace - <AUTHOR> http://www.nytimes.com/2009/01/16/world/asia/16outcasts.html?_r=1&sq=buraku&st=cse&scp=1&pagewanted=all

<comment><AUTHOR> This article is interesting as an example of discrimination that is not race- based, but rather based on the buraku historically doing unclean jobs, like butchering. It's incredible that it's still taken decades to make strides eliminating discrimination against buraku, even through they are genetically indistinguishable from other Japanese.</comment>


YC Summer '11 - <AUTHOR>

Do you know the dates for YC's Summer '11 cycle? <comment><USER2> I believe its the same months every year, that would make it June,11 to August 11 as the months one has to be there in SF for the Summer 2011 cycle.

Regarding the start and end of the application process, assuming it would be started and ended with the same lead time as the winter 2011 cycle, the start and end dates would be: Start - Mid Jan 11 End - Mid Mar 11

These are just guesstimates assuming that YC repeats the same pattern every year. It would wise to keep checking HN to see if they indeed do that.

Good luck. Skowmunk.

</comment><comment><USER3> June through August, like always.</comment>


Google PageRank, Revisited - <AUTHOR> http://www.marketingpilgrim.com/2007/11/google-to-kill-expired-domain-sales.html

<comment><USER2> Is this hacker news or SEO news?

</comment><comment><USER3> Was this story killed?</comment>


Science Festival in DC this weekend - <AUTHOR> http://www.usasciencefestival.org/ The USA Science and Engineering festival is going on in DC this weekend; if you haven't been, there are over 3000 organizations involved in science education, outreach, and/or awareness meeting in one place.  Lockheed Martin is one of the sponsors, and you can see their booths, but on the exhibition floor there are numerous kickstarter projects, robotics groups, universities, authors, educators, and companies with demos from the simple to the amazing, all trying to teach and interest the public in science and engineering.
It's pretty cool.
Find tweets under hashtag #SciFest.
https://twitter.com/search?q=%23scifest
Here's what I've done today:
Eaten a marshmellow frozen in liquid nitrogen, flown an F-35 simulator, talked to 3 different 3d printer makers, learned about bubbles, played educational minecraft, found cracks in equipment using electromagnets, learned about thermally conductive materials, helped teach kids about sugary soft drinks, watched a seatbelt test, and there are many more things to do tomorrow. <comment><AUTHOR> The USA Science and Engineering festival is going on in DC this weekend; if you haven't been, there are over 3000 organizations involved in science education, outreach, and/or awareness meeting in one place. Lockheed Martin is one of the sponsors, and you can see their booths, but on the exhibition floor there are numerous kickstarter projects, robotics groups, universities, authors, educators, and companies with demos from the simple to the amazing, all trying to teach and interest the public in science and engineering.

It's pretty cool.

Find tweets under hashtag #SciFest.

[https://twitter.com/search?q=%23scifest](https://twitter.com/search?q=%23scifest)

Here's what I've done today:

Eaten a marshmellow frozen in liquid nitrogen, flown an F-35 simulator, talked to 3 different 3d printer makers, learned about bubbles, played educational minecraft, found cracks in equipment using electromagnets, learned about thermally conductive materials, helped teach kids about sugary soft drinks, watched a seatbelt test, and there are many more things to do tomorrow.</comment>


Wi-Fi to Beer-Fi - <AUTHOR> http://dsc.discovery.com/gear-gadgets/boost-your-wifi-signal-using-only-a-beer-can.html#mkcpgn=fbdsc8

<comment><USER2> Actually you can use any similar size can (not necessary beer).</comment>


Mistakes You Apparently Just Have to Make Yourself - <AUTHOR> https://medium.com/@mcfunley/mistakes-you-apparently-just-have-to-make-yourself-cc2dd2bfc25c?x#.pjy6ffbdq <comment><USER2> So many submissions, so few comments:

[https://hn.algolia.com/?query=Mistakes+You+Apparently+Just+H...](https://hn.algolia.com/?query=Mistakes+You+Apparently+Just+Have+to+Make+Yourself&sort=byDate)</comment>


Interpreting Rope Channels: The Birth of Greek Monumental Architecture - <AUTHOR> https://www.cambridge.org/core/journals/annual-of-the-british-school-at-athens/article/interpreting-rope-channels-lifting-setting-and-the-birth-of-greek-monumental-architecture/842D9141067E239A94BB72446FA5CA73/core-reader <comment><USER2> "Ashlar masonry is a type of stone masonry which is formed using finely dressed stones of same size, shape, and texture laid together in cement or lime mortar of equal size joints at right angles to each other." - in case someone was wondering.</comment>


Golang dependency hell in Haunts The Manse game  - <AUTHOR> http://www.kickstarter.com/projects/2066438441/haunts-the-manse-macabre/posts/373466

<comment><USER2> "Golang dependency hell in Haunts The Manse game" is not only a very editorialized title for this link, but it's also factually incorrect. Here are some choice quotes about the codebase that have nothing to do with dependencies in Go:

Syntax errors:

      "Firstly, the source simply doesn't compile."

Performance problems:

       "...it's horribly slow."

Bad version control:

      "... the original code [has] ... potentially significant differences"

Those sorts of mistakes seem consistent with the type of coder who wouldn't set aside the 3 minutes it takes to understand Go's dependency system and either use it correctly or build a super-simple makefile to pull the correct versions of code from elsewhere.

Also, pedantic but worth noting: Golang is not the name of the language.

<comment><USER3> I've got 3 minutes. I've spent more than 3 minutes searching, and I can't find a way to specify a version in an import (though you can tag the go version, you still can't tie the import to a specific tag or version or commit). Am I missing something? It seems the only way around this is to check out a point in time release and import that (which would solve the problem the article mentions). However, that's a workaround for a problem that package managers like NPM and RubyGems have trivially solved.

<comment><USER2> You can't. The right way to spend the 3 minutes is to read the docs. [1] [2]

Also, just because it doesn't work the way NPM does doesn't mean it doesn't work.

[1] <http://golang.org/doc/code.html#remote>

[2] <http://golang.org/cmd/go/#hdr-Remote_import_path_syntax> (linked from [1])

<comment><USER3> Neither of those links address the issue the author mentioned, nor do they describe the need to use your own local copy of a package in case the package authors introduce non-backwards compatible changes. Yes, it needn't behave like NPM, or RubyGems, or Aptitude, or Homebrew, or any of the dozen or so systems out there for install remote packages that let you indicate version.

</comment></comment></comment></comment><comment><USER4> This has nothing to do with Go. It sounds like a case of poorly managed dependencies and build rules and likely weak engineering. The fact that they wanted to support the iPad and chose Go also shows this wasn't well thought out.

<comment><USER5> I would say bad engineering:

* Go 1.0 had a terrible GC, especially on 32-bit platforms (their target platform)

* No manual memoray management (and unlikely to ever exist)

* Can't bind to C++, can't cross-compile cgo (gccgo can though)

Go is really cool, and I use it every day, but it doesn't make any sense for games, especially not for their target platform. Maybe in a few years the GC will be more reliable, but I wouldn't try to build a game in Go if I thought I might want to try to sell it.

</comment></comment><comment><USER6> "There is nothing special in Go that makes it particularly well suited to video games, but on the other hand there is nothing inherent in the language that makes it a bad choice, except for the fact that it's new and not well supported."

I would say that "new and not well supported" makes this a potentially bad choice for shipping code. Not to say that it can't be used but the problem with new technologies is that not all warts have been properly exposed and you can open yourself up to major headaches.

</comment><comment><USER7> Previous discussion: <https://news.ycombinator.com/item?id=5707019>

<comment><USER8> And the March 5 update on the Kickstarter page seems to imply the project has been abandoned: [http://www.kickstarter.com/projects/2066438441/haunts-the- ma...](http://www.kickstarter.com/projects/2066438441/haunts-the-manse- macabre/posts/420311)

</comment></comment><comment><USER9> My summary from the last time it was posted.

"Original author didn't localize dependencies, obviously caused problems."

</comment><comment><USER10> "it makes a local copy of that external library. And if you have a local copy, you can edit it. And meanwhile, that person you copied the OpenGL code from? They are also changing their version (fixing bugs, adding features, adding bugs). Therefore there is no guarantee that your version and their version remain compatible: it takes work to maintain compatibility."

Remote packages in Go are like DLLs for other languages. Yes, if you edit a DLL locally, and other people download the public version of that DLL, they won't be the same. DON'T DO THAT.

Make your own copy of the public Go repository, so you can merge in changes from the main branch as you see fit. This is akin to making a copy of the DLL and using that to distribute with your code, rather than just telling people "go download the newest version of the DLL from github".

It's also good practice for go authors to keep any one repository backwards compatible, make it clear when the code is in flux and may have breaking changes... and to make new branches if they have to make significant changes to their code.

</comment><comment><USER11> > and put import ("github.com/go-gl/opengl/gl") directly into your code. > Viola! Thus hilarity ensues.

Of course it does! All they had to do is fork the project (which they have) and reference that it instead. Viola, problem solved!

<comment><USER9> No need to fork, it puts a copy of those libraries under ./src, so you always have a sealed (hermetic) referentially complete copy.

You don't bet your production software on things randomly downloaded from the internet at compile time. This is why go never auto-updates when you do "go get", you have to explicitly use "go get -u".

Always localize what you depend on, you never know when a github repo could be pulled, go offline, be renamed, a lawsuit could break out making the library vanish. There are TONS of reasons you should ALWAYS localize your dependencies for building software.

EDIT: This has the amazingly cool side-effect of meaning even on complex projects, you can just do a git clone and then go build FOO and it just works, no nonsense, no fuss, and it is EXACTLY in the state it was when it was checked in -- no surprises.

<comment><USER11> > No need to fork, it puts a copy of those libraries under ./src, so you > always have a sealed (hermetic) referentially complete copy.

While that is true, it doesn't solve the problem with distributed teams. The library path MUST be pointing to a 'localized' repository to solve the problem the Haunt guys are having.

<comment><USER9> What? It ONLY looks for localized copies.

When you have import "github.com/gorilla/mux"

it will look in

$GOROOT/src/pkg/github.com/gorilla/mux and $GOPATH/src/github.com/gorilla/mux

if it is missing, you can fulfill it with

go get github.com/gorilla/mux which will place it in the first place in $GOPATH

What are you talking about breaking with distributed teams? Since $GOPATH/src/github.com/gorilla/mux is in source control you NEED NOTHING and it will be a known working git clone.

EDIT: Additionally, it will never auto-update those dependencies (and break your build) unless you explicitly tell it to with "go get -u".

<comment><USER11> I know how it works :) I'm not new to Go.

BUT, what you are describing is exactly how the Haunt guys used Go and consequently the issues they have run into. Please re-read the update from Rick and read my comments again, you should then understand the issue and why changing the import path to a fork/clone/localized copy is beneficial (though not required).

<comment><USER9> I don't understand, so explain it to me like I am a child, I am certain I am missing something basic and the developers on the project aren't as dumb as it seems.

Seriously, it seems so goddamn basic. I am going to walk you through step by step how I would add an external library to my Go project.

#1. Switch to the go project directory #2. Fork for the new feature (adding_mux) #3. Run go get github.com/gorilla/mux #4. Add import "github.com/gorilla/mux" to my code, use mux for great goodness #5. Commit my code (this is commit of ./src which includes two things, the addition of the new github.com/gorilla/mux/* and my code using that new library) #6. Merge #7. Push

At this point, the commit that was just checked in doesn't need a change to its import path, will never break and will work as it was committed FOREVER. git clone FOO; go build BAR -- victory!

If at some point I want to update that library (new cool feature!)

#1. Switch to go project directory #2. Fork for updating library (update_mux) #3. Run go get -u github.com/gorilla/mux #4. Write code using new awesome features #5. Commit my code (again, "my code" in this case is both the update to the mux library, and my new usage of it, again committed together for great goodness!) #6. Merge #7. Push!

I feel like one of us is bat shit insane, and at this point, I am just hoping it isn't me.

EDIT: Another cool side effect of this is you end up with localized hermetic copies of your code with references for posterity to where you got it, bonus points!

EDIT 2: For reference, there are various forks of the source he "released" (abandoned? Sold for 28k? whatever) ... I think you can start looking at the github network from here: <https://github.com/runningwild/haunts>

<comment><USER11> So the key part of the update I was referring to was the following:

      Because of course that's not how it really works. Instead, it makes
      a local copy of that external library. And if you have a local copy,
      you can edit it. And meanwhile, that person you copied the OpenGL code
      from? They are also changing their version (fixing bugs, adding features,
      adding bugs).

In short, original developer has the clone of the OpenGL library in their 'src' directory. While working on Haunts his making changes to it and not pulling updates from upstream. All is well, things will always build on his machine because as you say, it won't update unless he does 'go get -u'.

Fast forward to when the community takes over, they clone the Haunts project and attempt to build it. Now they are using the HEAD of the 'github.com/go- gl/opengl/gl' repository, as specified by the imports path and they find that it no longer compiles.

This is where the problem exists.

The simplest way around this problem is to simply fork the OpenGL Go library (like they have), and reference the fork in the import path. That way no matter what happens in the upstream repository, the Haunts project will continue to compile. The original developer could of then just pushed the changes he was making in his local 'src' directory back to the fork and everything would be fine. When they are ready to take updates from upstream, they simply update their fork and then 'go get -u' on all developer machines.

By forking, or maintaining your own copy of library, you get a level of isolation from the upstream developers.

What you are saying is 100% correct, the Go tools automatically give you this when running 'go get', it clones the library into your 'src' directory. What I am saying is that when working in a team/community environment, you need an additional level of isolation (the fork), so that the entire team can be using the exact same version of the library.

      > I feel like one of us is bat shit insane, and at this point, I am just hoping it isn't me.

I don't think (hope) either of us are, just not thinking on the same track :) I hope what I've written is clear enough that you can see what I was saying.

<comment><USER9> > In short, original developer has the clone of the OpenGL library in their > 'src' directory. While working on Haunts his making changes to it and not > pulling updates from upstream. All is well, things will always build on his > machine because as you say, it won't update unless he does 'go get -u'.

The important addition is -- he does not check this clone into his OWN source control, so his source control doesn't have a complete hermetic version of the application, it has a "partial" application... or really "application bits".

> Fast forward to when the community takes over, they clone the Haunts project > and attempt to build it. Now they are using the HEAD of the 'github.com/go- > gl/opengl/gl' repository, as specified by the imports path and they find > that it no longer compiles.

If he had checked it into his version control system (you might call it forking, I call it localizing), they would have had the EXACT same version as him and they would not have had to fulfill that dependency on their own. Also, the same import path would continue to work off this local checked in version.

> By forking, or maintaining your own copy of library, you get a level of > isolation from the upstream developers.

I thought that maintaining your own local copy of libraries under /src was the norm for go developers, as the value of hermetic checkouts goes hand in hand with some other Go'isms like static built binaries.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER12> Sorry, but problem not in Go. Code of external libraries shouldn't be edited (or should be forked before changing).</comment>


White House Considers Joining Publishers To Stamp Out Fair Use At Universities - <AUTHOR> http://www.techdirt.com/articles/20130131/00310621834/obama-administration-considers-joining-publishers-fight-to-stamp-out-fair-use-universities.shtml <comment><USER2> I am puzzled that stories like this surprise people.

Ever since Obama picked Joe Biden as his VP, it was clear what his administration's default stance on copyright issues would be. If you wonder why I say that, <https://www.google.com/search?q=joe+biden+copyright> provides lots of starting places to learn more.

Am I the only one around here who actually researches the candidates that I'm presented with to see what they think about issues that I care about? I thought (and still do) that Obama was the lesser of 2 evils both times. But I'm well aware that I do not agree with this administration on a number of issues, and copyright is one of them.

<comment><USER3> Don't imagine there is or ever was any difference in the positions of Democrats and Republicans on copyright issues. The Copyright Act of 1976 passed 97-0 in the Senate and 316-7 in the House. More recent major copyright legislation, the DMCA and CTEA, passed without even recording individual votes (voice vote or unanomous consent).

The US copyright law has been dictated by the media industry for a long time in something akin to regulatory capture[1]. Their lobbyists and lawyers literally write the law[2]. A revolving door sees former senators heading to cushy jobs at the MPAA pass RIAA litigators headed to the Copyright Office.

This is why the failure of SOPA was so shocking to the political and media establishment. Instead of the general public being fleeced for a few extra dollars every time they bought a movie or album, large businesses like Google had billions of dollars at stake and they wanted their interests to be taken into account.

[1] <http://en.wikipedia.org/wiki/Regulatory_capture>

[2] [http://www.theatlantic.com/technology/archive/2010/10/google...](http://www.theatlantic.com/technology/archive/2010/10/googles- ceo-the-laws-are-written-by-lobbyists/63908/)

<comment><USER2> I don't imagine that there is a difference. Both sides vote for horrible copyright legislation. Both try to keep the horribleness secret from everyone except the lobbyists until the last moment. Both are happy to use secret international treaty negotiations as a way to keep those secrets. There is no difference, which is why it was big news that some on the Republican side considered doing otherwise.

My point was that this is obvious to anyone who does a little research. Therefore seeing the government serving copyright-holders' interests is no surprise.

<comment><USER3> Completely agree. Although he has lots and lots of company, Biden really is one of the worst on many issues of interest, for example privacy[1]. And it's ironic that he often presents copyright as a moral issue, equating copyright violations with theft, when he was caught copying 5 pages out of a law review article in 15 page paper he submitted in law school[2] and then there is the plagiarism in some of his speeches[3].

[1] [http://www.wired.com/dangerroom/2012/12/joe-biden-private- em...](http://www.wired.com/dangerroom/2012/12/joe-biden-private-email/)

[2] [http://www.nytimes.com/1987/09/18/us/biden-admits- plagiarism...](http://www.nytimes.com/1987/09/18/us/biden-admits-plagiarism- in-school-but-says-it-was-not-malevolent.html)

[3] [http://www.slate.com/articles/news_and_politics/history_less...](http://www.slate.com/articles/news_and_politics/history_lesson/2008/08/the_write_stuff.single.html)

<comment><USER2> Yes, they are all the same. Except that some are much more the same than others.

There would have been few you could pick that would have made me less happy than Biden. Unfortunately two on that short list are Sarah Palin and Paul Ryan.

</comment></comment></comment></comment></comment><comment><USER4> Hmmmm...hint of conspiracy theory; xenophobia; out of context quotes from law; no idea how fair use actually works; extreme hyperbole; general cluelessness.

In other words, a typical Mike Masnick piece. I do not understand why anyone takes Techdirt seriously.

<comment><USER5> Yeah, I CANNOT IMAGINE why anyone would assume anything ill of the revolving door between business and government, what a bunch of conspiracists. You also might want to learn what the word "xenophobia" means since at no point in this article does it discuss foreign actors or organizations.

<comment><USER4> > You also might want to learn what the word "xenophobia" means since at no > point in this article does it discuss foreign actors or organizations

"Two out of the three publishers are foreign publishing giants"

"funding some foreign publishers"

"supporting foreign publishers"

<comment><USER5> Yeah but it has nothing to do with the fact that they are specifically foreign but pointing out yet another point of ridiculousness with the administration's position on this matter given this is 2/3rds foreign agents vs American colleges. Xenophobia is just a ridiculous accusation by OP to personally attack the author of this article.

</comment></comment></comment></comment><comment><USER6> > _The very first Copyright Act in the US was actually titled "An Act for the > Encouragement of Learning." Current copyright law is explicit that fair use > covers this sort of situation:_

(the OP links to here:) <http://www.copyright.gov/title17/92chap1.html#107>

> _Notwithstanding the provisions of sections 106 and 106A, the fair use of a > copyrighted work, including such use by reproduction in copies or > phonorecords or by any other means specified by that section, for purposes > such as criticism, comment, news reporting, teaching (including multiple > copies for classroom use), scholarship, or research, is not an infringement > of copyright. In determining whether the use made of a work in any > particular case is a fair use the factors to be considered shall include—_

It appears to me that the OP is misreading the law. From what I can tell, the law says that _if_ a copy/reproduction of a work is _fair use_...including for classroom purposes...then it is not an infringement of copyright.

The OP interprets this as: "If something is reproduced for classroom use, then it is fair use"

That is not at all correct. Check out this primer about fair use and education: [http://fairuse.stanford.edu/Copyright_and_Fair_Use_Overview/...](http://fairuse.stanford.edu/Copyright_and_Fair_Use_Overview/chapter7/7-b.html)

The short summary of it is: You can't just copy whatever you want for purposes of teaching and assume that it is "fair use".

Maybe someone more well-versed in the law can correct me, but from what I can tell (I've had some education in this, but not a formal law degree), the OP is quite a bit wrong in his assumptions.

<comment><USER7> Those appear to be Stanford's own guidelines on the subject. As far as I know, there are no actual hard and fast rules and one has to decide on a case-by- case basis after applying the four factor test. That part of the statute seems to be there because legislators believed that making a bunch of copies of something for classroom use was likely to be fair use and there was enough concern over protecting that use case to mention it explicitly.

Incidentally, there are many sets of guidelines like the one you cite. Here are a couple others:

<http://www.adec.edu/admin/papers/fair10-17.html>

[http://www.ala.org/Template.cfm?Section=copyrightarticle&...](http://www.ala.org/Template.cfm?Section=copyrightarticle&Template=/ContentManagement/ContentDisplay.cfm&ContentID=26700)

<comment><USER6> There are no "hard and fast rules" on fair use, just as there are no "hard and fast rules" about what makes slander, slander. Or what makes police brutality, brutal (in an illegal sense). But yet both are still against the law.

I'm not saying that it's easy to define fair use. I'm saying the OP seems to have a dishonest reading of the law if he's trying to assert that "fair use" means academia can reproduce copyrighted work and consider it "fair" because it's for educational purposes. That is completely missing the entire concept of "fair use".

<comment><USER7> The fact is that a teacher making a bunch of copies of something as hand-outs for their class is so common and benign a use case as to be mentioned in the statute, just to ensure that it could not be precluded by factor #3. Educational use itself is part of factor #1.

In any scenario where a teacher was copying educational materials for a class, I would have a hard time seeing it as anything but fair use barring unusual circumstances. Which was, I think, the point they were trying to make.

</comment></comment></comment></comment><comment><USER8> If Democrats are in favor of expanding rights for copyright holders, why did the Republicans a few months ago back away so far and so fast from their policy memo exploring opposition, to the level of firing the person who wrote it (never mind that it appears that it went through the correct channels to be published with the party's name on it)?

What copyright reform needs is someone with deep enough pockets to be able to b̶r̶i̶b̶e̶ lobby politicians effectively. Or perhaps a general public that understands and cares about the issue...

<comment><USER9> Because they're all part of the same organization?

What copyright reform needs is better software and a healthy mocking of those who think supporting a cartel is hip when it involves iToys.

</comment></comment><comment><USER10> Damnit, Aaron, we still need you.

<comment><USER11> You can start the effort your self. Stop relying on others to do what you feel passionately about.

</comment></comment><comment><USER12> I get that there are decisions in elections, and I get that on the issues YOU care about YOUR party is infinitely better than THEIR party, but when both parties just do the bidding of anti-democratic big business elites it just seems impossible to ever make things better, and the accumulation of these seemingly small steps continues. Stories like this ruin my day, not in isolation, but precisely because of the pattern of behavior in our body politic that they reprsent.

</comment><comment><USER13> America has some of the finest laws that money can buy.

Right there is the issue and America is going to continue to get ridiculous laws while the lobby system exists.

</comment><comment><USER14> Well... think about it. If a professor was allowed to post the textbook --or even just pieces of it, say, the homework problems or example problems-- what use then would a student have for the textbook? Nobody would buy Fundamentals of Chemistry 50th Edition!

Clearly such actions are not fair use.

</comment><comment><USER5> I honestly just assume at this point if there's a way for the Obama administration to dick over the public in favor of their corporate masters, they're going to jump on it. This has become typical and expected behavior from this hypocritical "transparency"-baiting group.

</comment><comment><USER15> America seems to produce the best media content in the world (at least in terms of demand), and the best academic content (at least in terms of citations). Does that indicate that the legal system etc. surrounding media and copyright is probably pretty good?

</comment><comment> mark-r This ties in perfectly with another link presented on HN today: [http://www.schneier.com/blog/archives/2013/01/power_and_the_...](http://www.schneier.com/blog/archives/2013/01/power_and_the_i.html)

</comment><comment><USER16> This is outrageous.</comment>


Jami: GNU end-to-end encrypted alternative to Zoom and Jitsi - <AUTHOR> https://git.jami.net/savoirfairelinux/ring-project/wikis/home <comment><AUTHOR> In comparison to Zoom and Jitsi:

Jami's major advantages are that it's end-to-end encrypted and completely peer-to-peer, requiring no server in-between.

The major disadvantage is that it doesn't support calls from the browser.

See also: [https://jami.net](https://jami.net)

<comment><USER17> Not running in the browser is a major downside. I've used Jitsi this past week with technologically illiterate family members, and being able to just have them enter a URL while talking on the phone is really great.

Also, being able to just use any OS with a modern browser you please.

<comment><USER18> Personally I don't want to have my web browser run applications, I'd rather have native MacOS or Linux apps, but I do see how having at least a version of it available in a browse is handy for potability.

<comment><USER17> Don't get me wrong: I want both to be possible, but being able to just get up and go is really helpful.

For a tool like this though I'm not sure what a native app would add. Most of what it does builds on the functionality of a modern web browser.

<comment><USER19> Modern Web browser don't allow true peer-to-peer, you always need a server.

Jami uses a fully distributed network (DHT) to initiate connections.

<comment><USER20> Webtorrent is a thing though. Is it not true peer-to-peer?

<comment><USER21> webtorrent builds on webrtc, which requires stun and ice servers. so you still send metadata to defined servers for connection handeling and most sadly you can't p2p in an offline LAN.

<comment><USER20> > so you still send metadata to defined servers for connection handeling

This is also true for typical p2p protocols though, isn't it? Normal torrent clients for example have hardcoded servers to start their dht search from.

<comment><USER22> Not necessarily. It does follow that if you submit to a tracker, but there's the DHT option which is advertised locally [0]. The way it seems to do it is the magnet uri includes the contents of a few IPs that might have, at minimum, a more up-to-date DHT with more IPs. At best it also includes some chunks of whatever you're trying to download.

[0]: [https://stackoverflow.com/questions/1332107/how-does-dht- in-...](https://stackoverflow.com/questions/1332107/how-does-dht-in-torrents- work#1746896)

<comment><USER20> [https://superuser.com/questions/592238/](https://superuser.com/questions/592238/) does not seem to agree with that statement.

</comment></comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER23> Looks like GNU Ring changed its name to Jami.

Also, I already have an GNU Ring account saved in my password manager but can't seem to login (or even find a place to). However, if I try to create a new account using my old username it (correctly) states it is taken.

<comment><USER24> I'm having the same issue. Previously created an account, and I'm completely puzzled how to now log in to it! Seem to have options to create a new account or import a backup..

</comment></comment><comment><USER25> Interesting, I haven't tried Jami. If I am understanding it correctly it seems to provide calling features, which Zoom and other typical video conferencing type applications don't.

I'll also through Jitsi out there as a very capable FLOSS alternative to Zoom. If you tried it a few years ago it's changed dramatically in the last while. It's now WebRTC based and runs in browser without any download. It's not quite end to end encryption because the stream needs to be decoded on the server before being re-encoded for the other clients, but since you can easily self host it on a cheap VM I find this acceptable.

<comment><USER26> Can't WebRTC support peer-to-peer video calls without running the stream through a server? I have vague recollection that it can but am not particularly familiar with the protocol.

<comment><USER26> To answer my own question: Yes, WebRTC supports peer-to-peer video calls but does require a "signaling server" to help establish and close the peer-to-peer connection. [1]

[1]: [https://www.html5rocks.com/tutorials/webrtc/basics/](https://www.html5rocks.com/tutorials/webrtc/basics/) "Getting Started With WebRTC"

<comment><USER27> The signaling server is only useful for the connection initialization though, and it never has access to the video stream, only to metadata (like your IP address, the supported encodings of each party, etc.). And it doesn't even really need to _access_ them: it just needs to forward them from one peer to another, so it could be end to end encrypted.

It also needs one or several STUN servers as part of the hole punching scheme, but this one doesn't even exchange anything with anyone, so there aren't many issues here (and you don't need to roll your own: you can use Google's one)

</comment></comment></comment></comment><comment><USER28> This used to be called GNU Ring. Wikipedia has some info on features: [https://en.wikipedia.org/wiki/Jami_(software)](https://en.wikipedia.org/wiki/Jami_\(software\))

I'd be really curious if this is a viable option for videoconferencing for say >10 people.

<comment><USER29> I'd really be interested in this as well! As Jitsi for example isn't really able to handle many participants apparently: [https://community.jitsi.org/t/maximum-number-of- participants...](https://community.jitsi.org/t/maximum-number-of-participants- on-a-meeting-on-meet-jit-si-server/22273/20)

</comment></comment><comment><USER30> I've used this while trying to find open source video conferencing solutions and chat applications in the past. It spends significant amounts of time not finding my friends before timing out.

As an aside, I don't believe in the virtues of P2P anymore. It's clear to me that centralised systems scale further and faster, and what we need are benign organisations to run them. Legal forms like cooperatives and community benefit societies (nonprofits in the US I guess) are the way forward. I'd choose a community instance of Jitsi as being the best approximation of this for now.

<comment><USER31> I share your interest in cooperatives, but not all cooperatives are equal. If we expect cooperatives to provide public interest services that might otherwise be P2P or nonprofit, I think we need a special kind of cooperative.

I belong to cooperatives that are politically partisan, that engage in sharp practice, and that aren't as democratic as I'd like. I'd prefer cooperatives to concentrate on treating stakeholders fairly, representing members equally and effectively, and prudent stewardship of their assets.

Cooperatives might lose their focus on their main purposes and discourage some non-progressives from becoming members/customers by pursuing too wide a range of progressive causes.

<comment><USER30> In the UK we have a legal form called a community interest company. This, owned by a co-op, would probably be the right form.

</comment></comment></comment><comment><USER32> The marketing website itself seems to be a better resource for information: [https://jami.net](https://jami.net)

</comment><comment><USER33> > end-to-end encrypted

O RLY?

[https://git.jami.net/savoirfairelinux/ring-client- android/is...](https://git.jami.net/savoirfairelinux/ring-client- android/issues/604#note_14329)

[https://security.stackexchange.com/a/171461/43688](https://security.stackexchange.com/a/171461/43688)

I looked through their code to see where data is being encrypted/decrypted, and was unable to locate it.

Since their issue indicated they use 4096-bit RSA, I really wanted to see if they were vulnerable to Bleichenbacher's 1998 padding oracle attack.

[https://git.jami.net/savoirfairelinux/ring- project/wikis/tec...](https://git.jami.net/savoirfairelinux/ring- project/wikis/technical/Technical-overview#jami-certificate)

> The SHA-1 fingerprint (160-bits) of this public certificate is the JamiId.

this-is-fine.mp4

<comment><USER34> The code you were looking for is in the OpenDHT project, which simply calls GnuTLS's gnutls_pubkey_encrypt_data(), which is PKCS1v15. OpenDHT doesn't do anything special with errors from decryption. You'd have to actually set up a test environment to say it was vulnerable with any confidence, though.

<comment><USER33> Thanks Thomas!

</comment></comment></comment><comment><USER35> Maybe it got better, but for the past 6 months a friend and I tried to get this app to work with little success. The messages just DONT FREAKING SEND in a timely manner even when in the same room.

Right now we use Briar and are pretty happy with it. There's also signal as a better option.

Either way, IMO, Jami sucks.

</comment><comment><USER36> I haven't tried it myself, but I saw [https://wire.com/](https://wire.com/) linked as an open-source E2E-encrypted alternative during a few of the Zoom articles that have been posted these past few days. I'd love to see if anyone here has any experience self-hosting it, and whether it matches up performance/usability-wise.

<comment><USER28> Note that Wire only supports video conferences for up to 4 parties.

[https://support.wire.com/hc/en- us/articles/360001019225-Star...](https://support.wire.com/hc/en- us/articles/360001019225-Start-a-video-conference-call)

</comment></comment><comment><USER37> Just realised this is Ring . Wonder why they changed their name

<comment><USER38> Possibly to avoid confusion with the company that makes doorbells.

</comment></comment><comment><USER39> C/C++ implemented custom protocols, no webrtc... What explains these security and compatibility compromises?

<comment><USER40> The first commit was in late 2004, which was _well_ before WebRTC was a thing.

</comment></comment><comment><USER41> I tried Jami recently and it just doesn't work, I think it has problems with punching through NAT and routing.

I would love to see a messenger/audio call/video call app built on the zerotier SDK, I never had connection problems with zerotier.

</comment><comment><USER42> Originally discussed here 9 months ago:

[https://news.ycombinator.com/item?id=20311324](https://news.ycombinator.com/item?id=20311324)

</comment><comment><USER43> I just installed on a Debian 10 machine, then on my old Android 6.0.1 junk tablet. No problems on the PC, while the Android one always crashes when attempting to pair with the PC by pointing the camera at the QR code, and adding manually the exported account on the network hangs indefinitely on the "adding account" window.

Not a big issue since I don't carry the tablet around, just to let the developers know if they read here.

<comment><USER44> > just to let the developers know if they read here.

Or, raise the issue with them for investigation, since a comment on an unrelated site isn't a reasonable way to provide feedback

<comment><USER45> But it was most convenient for the user. Maybe it's equally fair to lecture developers on reasonable ways to collect feedback.

<comment><USER44> I didn't lecture anyone. What did you find inconvenient about the existing methods of contact?

</comment></comment></comment></comment><comment><USER46> Obligatory: has anyone used this before?

<comment><USER47> Never even heard of it.

This has been around for a while. Why isn't it in the Ubuntu repository?

<comment><USER48> It's there in 19.10

<comment><USER47> Ah. Running 18.04 LTS here.

</comment></comment></comment></comment><comment><USER49> Does anyone find these names a bit weird?

What happened to 80's glorious days where company and product names were super cool.

      - <USER2>
      - <USER3>
      - <USER4>
      - <USER5>
      - <USER6>
      - <USER7>
      - <USER8>
      - <USER9>
      - <USER10>
      - <USER11>
      - <USER12>
      - <USER13>
      - <USER14>
      - <USER15>
      - <USER16>

Now we have things such as Flikr, Waymo, Skype, Jitsi and this thing... Jamo or Jami. :-/ Human race is regressing.

<comment><USER50> "Jami is inspired by a Swahili word that means "community". The name was chosen as it reflects the vision: to be a service open to all, to be community supported, and to respect the privacy of users." - [https://jami.net/help/](https://jami.net/help/)

<comment><USER49> Why does a product name have to have a "meaning" behind it? Kodachrome was abstract.

<comment><USER51> Kodachrome wasn't abstract. It was Kodak's color film, and thus a pseudo- portmanteau of "Kodak" and "chroma" (i.e. color).

I'm sure there are meanings behind a lot of the other names you listed, too.

<comment><USER49> How about Kodak? I am sure there are many names that are abstract.

<comment><USER52> From [https://petapixel.com/2011/08/03/origin-and-evolution-of- kod...](https://petapixel.com/2011/08/03/origin-and-evolution-of-kodaks-name- and-logo/)

> The letter "K" had been a favorite of Eastman's, he is quoted as saying, "it > seems a strong, incisive sort of letter." He and his mother devised the name > Kodak with an anagram set. He said that there were three principal concepts > he used in creating the name: it should be short, one cannot mispronounce > it, and it could not resemble anything or be associated with anything but > Kodak

</comment></comment></comment></comment></comment></comment><comment><USER53> Ok stop with the E2EE encrypted. Literally if you're running your own hardware, you don't "Need" E2E. You need to understand your attack surface, your vulnerabilities, and your goals. E2EE is not the optimal use case for everyone and everything.

<comment><AUTHOR> \- Zoom does not support self-hosting

\- Self-hosting Jitsi is not the optimal use case for everyone.

People are free to choose between Jami and Jitsi, and it's great to be able to have different options based upon your use case.

<comment><USER54> Most importantly, these one-click-join services are easily accessible by everyone* with a web browser, so switching service providers is a breeze.</comment></comment></comment>


TengineKit – Free Real-Time Face Landmarks 212 Points for Mobile - <AUTHOR> https://github.com/OAID/TengineKit <comment><AUTHOR> TengineKit is an easy-to-integrate face detection and face landmarks SDK

</comment><comment><USER2> You posted the same post 4 days ago.

<comment><USER3> which is completely fine.</comment></comment>


React.js in Real Life at Codecademy - <AUTHOR> http://www.infoq.com/articles/reactjs-codecademy?utm_source=hacker%20news&utm_medium=link&utm_campaign=react_js_article

<comment><USER2> This article kind of comes at a perfect time for me. I just recently started working on a project with a code editor and I've been battling for a while how to communicate changes through react.

I plan to use ace, and require the ability to get and apply patches as the user types into the ace editor, get code when they need to compile, as well as be able to modify other properties of the editor.

At the most complex level, I need to keep two ace editors in-sync, doing this with cure javascript and ace is simple, as you just need to apply a patch from one editor to the other.

Building large and complex applications has always been the big problem for me with React, and the author states it right up front

        we ran into issues finding examples of how React could
        apply to an application as complex as ours, given that
        most tutorials focus on the specifics of toy-sized demo
        apps as opposed to more general discussions of the
        problems specific to larger applications.

This is just something that is going to take time though.

<comment><USER3> This is why they gave the presentation on Flux, which is architecturally how Facebook solves this problem.

Basically the first principal you must learn is to find the lowest common ancestor to store state. ([http://facebook.github.io/react/blog/2013/11/05/thinking- in-...](http://facebook.github.io/react/blog/2013/11/05/thinking-in- react.html)) After realizing this the immediate thing people do is pass call backs through children so grandchildren's actions can communicate with where the state is. This leaks through all the components however, which is why Flux separates actions out into something that all the components have access to.

<comment><USER4> Worth pointing out that you don't need a full Flux implementation to get the benefits of going sideways to an action module:

[https://github.com/ryanflorence/react-training/blob/gh- pages...](https://github.com/ryanflorence/react-training/blob/gh- pages/lessons/04-less-simple-communication.md)

</comment></comment></comment><comment><USER5> Bit of a shameless plug, but you can now get your flux on straight in Plunker [http://plnkr.co/edit/tpl:a3vkhunC1Na5BG6GY2Gf](http://plnkr.co/edit/tpl:a3vkhunC1Na5BG6GY2Gf) in a familiar UX.

I've included minimal starter template for React.js and React.js (with addons) as well as transparent jsx transformation. I'm open to more complete starter examples if anyone better at React.js wants to contribute them!

<comment><USER6> As a matter of fact, I created a really simple react yeoman generator[0]. All other generators are pretty bloated with lots of stuff. Maybe that's ok for new applications, but I was just trying to learn react and they all were heavily bloated.

[0] [https://github.com/luisrudge/generator-simple-react- browseri...](https://github.com/luisrudge/generator-simple-react-browserify)

</comment></comment><comment><USER7> Just started looking into React yesterday. What I've read thus far doesn't discuss your server-side at all. Is it agnostic to what's running on your server ... any JSON-based RESTful back-end will do, or are there benefits to using a specific stack for your back-end?

<comment><USER8> React is indeed agnostic to your server-side stack. Only thing is you'll need a node.js server if you want server-side rendering. (Codecademy runs ours separately from the rails app so we can do server side rendering.)</comment></comment>