A Bad Privacy Bug - <AUTHOR> http://blog.pinboard.in/2012/07/a_bad_privacy_bug/

<comment><USER2> As much as anything else, this is another great example of MySQL letting you shoot yourself in the face by default. I also love that you can save "y" to an integer field without complaint. It seems obvious that accurate data validation and comparison would be the cornerstone of a successful relational database, yet MySQL defaults fail to provide any domain-relevant value whatsoever.

<comment><USER3> bin is not an integer field. It's a binary field - it can save anything.

And no, you can not save 'y' to an integer field, so your rant is misplaced.

<comment><USER4> I think tdavis is referring to this example from maciej's post, where inserting 'y' into a tinyint field silently converts it to 0 instead of throwing an error:

         mysql> create table demo(int tinyint(1), bin binary(1));
         mysql> insert into demo(int, bin) values ('y', 'y');
         mysql> select * from demo;

         +</comment></comment></comment><comment>+</comment><comment>+
         | int  | bin  |
         +</comment><comment>+</comment><comment>+
         |    0 | y    |
         +</comment><comment>+</comment><comment>+

<comment><USER3> It's not silent:

        mysql> insert into demo values ('y', 'y');
        Query OK, 1 row affected, 1 warning (0.01 sec)

        mysql> show warnings;
        +</comment></comment><comment>---+</comment><comment>+</comment><comment></comment><comment></comment><comment></comment><comment></comment><comment></comment><comment></comment><comment></comment><comment></comment><comment>+
        | Level   | Code | Message                                              |
        +</comment><comment>---+</comment><comment>+</comment><comment></comment><comment></comment><comment></comment><comment></comment><comment></comment><comment></comment><comment></comment><comment></comment><comment>+
        | Warning | 1366 | Incorrect integer value: 'y' for column 'n' at row 1 |
        +</comment><comment>---+</comment><comment>+</comment><comment></comment><comment></comment><comment></comment><comment></comment><comment></comment><comment></comment><comment></comment><comment></comment><comment>+

If you want this type of warning to be treated as an error then adjust the setting:

        mysql> SET sql_mode = 'TRADITIONAL';
        mysql> insert into demo values ('y', 'y');
        ERROR 1366 (HY000): Incorrect integer value: 'y' for column 'n' at row 1

<comment><USER5> Which brings us right back to what tdavis said in the first place: "As much as anything else, this is another great example of MySQL letting you shoot yourself in the face _by default_."

<comment><USER3> You are aware that this whole thing is theoretical since he set the field to bin (i.e. binary)? No database at all would have prevented this.

MySQL chose to coerce fields to fit the type. You don't like that choice, but other people find it useful. And MySQL gives you a choice to change it if you wish.

Judging by how popular and successful they are I think those chose correctly.

<comment><USER6> It's not theoretical. MySQL by default allowed type coercion out-of-box that is nonsensical. Sure, type coercion can be nice, but I'd prefer none over if it not failing and coercing bin('y') to 0.

Attributing their success to their choice of DB is insulting at best.

<comment><USER3> MySQL chose correctly, not maciej.

The coercing bin('y') to 0 makes no sense though - I agree with you there.

<comment><USER6> Those two statements conflict with each other and I don't see how you reconcile those without placing blame on MySQL.

<comment><USER3> Every product has bugs.

The philosophy of attempting to work when possible (coercion and other things) is good.

They clearly messed up here, but it doesn't mean they should never try to coerce values.

Even the warning when you try it makes no sense (what double?):

       1292: Truncated incorrect DOUBLE value: 'y  '

It's clearly a bug, and not something fundamental to MySQL.

<comment><USER6> Sure, I think we agree. I agree it's a mistake here and should be corrected, I wasn't advocating removing type coercion by any means, nor do I think that this one-off (?) incident is worthy of making broad statements about MySQL.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER7>
      Instead of automated test suites, I use checklists before deploying major changes,
      performing a series of actions (like creating and editing bookmarks)
      to make sure everything works as expected.

Somehow I always shiver when I read stuff like this. Some manual smoke testing is never bad, but I really can't understand how you can feel comportable about not having automated test suites on (larger) projects.

Stuff like this is so easy to catch in a unit or integration test.

<comment><USER8> Genuinely curious - if you find a project in that sort of condition, how do you go about fixing it? Are there respected guides to introducing proper unit and integration tests to established projects (that may not be structured amenably to them)?

<comment><USER9> The first step is to create an empty test suite with at least one test that runs. This will mean that when you go to add a test later you have no barriers — you already have a suite.

You then need to follow two rules. First, write tests for all new features. Second, add a failing test that exposes the bug before you fix any bug.

By doing these two things you will end up testing two very important areas of your code — new code (which will always be buggiest) and code that has recently proven to be buggy.

<comment><USER6> This is so incredibly important. So many people do not spend time upfront getting projects structured and setup for builds, testing, deployment and the appropriate automation for each. I should not be copying and pasting out of date scripts from random folders on a network share to build. Or to package something. Or grabbing an EXE from one place and a DLL from another to run my unit tests.

People don't like writing tests because it's not as fun as writing code, but because it also requires a different setup, configuration and flow to get them executing. Figuring that out and making it easy to execute those tests is important in getting people to want to write them.

<comment><USER9>
      > Figuring that out and making it easy to execute
      > those tests is important in getting people to
      > want to write them.

This is so incredibly important. Anyone on your team should be able to run the test suite from the command line by invoking a single command. The easier and the quicker a test suite runs, the more people will run it.

Also, spending a day to setup a CI server (Jenkins, circleci.com or similar) is a good use of your time. You want to have the CI run the test suite after every commit to your mainline branches in SCM.

Another key aspect to testing is generating clear and concise error output. One thing I find very frustrating is when a CI build fails, but it is not clear why. I find most CI systems are very good at listing all the passing tests, or when a few tests fail in the expected way. When tests fail hard (exceptions thrown, processing not start or not running) I find that I often need to go reading through build logs to find out what went wrong and why.

</comment></comment></comment></comment></comment><comment><USER10>
      But I do this from my own Pinboard account, which has
      superpowers. Specifically, it lets me see private bookmarks
      on all accounts. And since I already see everything, I don't
      notice when everybody else starts to see everything, too.

This is not okay.

<comment><USER11> I'm a drooling Pinboard fanboy, so I'm probably cutting him more slack here than I would for other services. However: it's been obvious to me since the beginning that "private" in Pinboard-context just means, "this bookmark is not publicly available on my account page." I've had absolutely no expectation that it wasn't accessible by a site admin -- although that would be nice too.

I can't think of a way to store retrievable data, like a bookmark, on his servers without leaving some way for him to access the data if he wanted to.

<comment><USER12> Yes, retrievable data is obviously accessible by a site admin _somehow_. But the way he's got things set up:

1) It's trivial for him to inadvertently see something deeply personal to someone just by browsing the 'recent' list or doing a search.

UPDATE: I overstated this one - Maciej let me know by email that he can only access private data on the search / recent page if he intentionally masquerades a user. He can only inadvertently see private data when viewing individual user pages.

2) If his account's ever compromised (let's hope he's not reusing that password elsewhere!) then someone else gets that ability as well, accessible from any browser anywhere.

It's one thing when you have to ssh into a server somewhere and do a SQL query to access someone's private information. It's another thing to set up your admin account so you're casually exposed to it.

I like Pinboard's service too, but this isn't remotely cool.

<comment><USER11> That's a pretty convincing argument you have there. I'll go along with that.

</comment></comment></comment></comment><comment><USER13> The schema should really be:

      private bit not null default 0

If you use something like tinyint and have a range of values that are acceptable, bake this into the database with a check constraint:

      myfield tinyint not null default 0 check (myfield between 0 and 3)

Regardless of how comprehensive your unit tests are, you should prevent as much bad data as you can at the DB layer.

</comment><comment><USER14> I respect maciej more for the candor about this incident. My wife had private bookmarks exposed, but I recommended she continue to use the service. These particular mistakes are not ones I would have made myself, but the important thing is that he's examining them intelligently and taking steps to prevent their recurrence.

</comment><comment><USER15> I don't think I saw it mentioned anywhere, but another thought that occurs to me is it might have been initially useful when he created the table to have the "private" field actually be called "public" instead.

The idea being that if the field is likely to be initialized to a default, you want the safer default. (IE, in that case things would be created as accidentally private, rather than as accidentally public)

Kudos to the author for the transparency. I actually have never used pinboard, but that blog post actually makes me more likely to use it rather then less.

</comment><comment><USER16> > So even though the row has (from our perspective) a non-zero value, MySQL > sees it as matching zero.

What? Why does MySQL return the row with 'y' in it (in a 'binary' column) when you ask for "where row = 0'? wtf is going on here?

That seems to be the real culprit here. I assume it's MySQL's 'helpful' conversion routines again, but I'm just assuming, I don't understand the details.

</comment><comment><USER17> Man, the more I see and experience things like this in MySQL, the more impressed (horrified?) I am at how it ever became popular. So glad I've made the switch to Postgres.

<comment><USER3> This isn't really a MySQL issue though. He used bin instead of int, and MySQL did exactly what he asked - stored the raw binary data as is.

<comment><USER6> Why are rows with 'y' in them being returned when he asked for that value equal to zero?

<comment><USER3> No idea. I would expect it to convert the 0 to a binary format (since that's the format of the column) but it's not.

It does raise warning

       1292: Truncated incorrect DOUBLE value: 'y  '
       1292: Truncated incorrect DOUBLE value: 'y  '

(Yes, twice.)

Which makes no sense to me.

</comment></comment></comment></comment><comment><USER18> If only other companies would handle issues with this level of transparency...

</comment><comment><USER19> So you browse "private" bookmarks of your users on a daily basis...

</comment><comment><USER20> I was affected by this. I received the email notification from Maciej and was offered compensation for the mistake. I declined the compensation and instead upgraded my account to include archival service. I did this partially because I've been considering the upgrade for a while, but mainly because I was so impressed by the way the incident was handled.

Keep in mind that I don't have state secrets bookmarked in Pinboard. I'm just an anti-social type of user as their tag line notes and I appreciate how Maciej runs his business.

</comment><comment><USER21> I recently watched this video which is mostly about Postgres but also pokes some fun at MySQL's weirdness. I didn't realise how scary MySQL can be

<http://vimeo.com/m/43536445>

</comment><comment><USER22> Implicit type conversion can be evil : <http://bhati.livejournal.com/3352.html></comment>


Who Does That Server Really Serve? - <AUTHOR> https://www.gnu.org/philosophy/who-does-that-server-really-serve.html <comment><USER2> Wow, what a lot of hate for RMS in this thread. All I know for sure is that I wouldn't be writing this on the machine I'm using here without him, and a ton of hardware in this house would spontaneously stop working if every line of code he had an (indirect) hand in or influence on disappeared. I'm pretty grateful for that.

Of course you could say the same about Edison or Maxwell, but that's roughly the right magnitude. Hating on Stallman as a person is not very elegant, hating him for the wrong reasons (at a glance, I spot: jealousy, misunderstanding, claims of irrelevancy and so on) is not productive either.

If you're going to criticize criticize the particulars of the linked article rather than the man. Thanks.

On topic: In case you didn't get it: the article (rightly) identifies software-as-a-service as a threat to open source, it allows companies that in the past would have shipped binaries and would have been compelled by the GPL to release their sources to do an end-run around all this so they can charge you for their software without ever having to release anything. That's a valid point and plenty of examples exist in the world today.

How serious this is is not for me to say but I do note an ever increasing trend towards lock-in and a more asymmetric internet which seems to draw a line between the 'haves' (the owners of infrastructure and services) and the 'have nots' (the users, smaller businesses). Ever larger chunks of a business operation are running on hardware and software even the business owners have no control over, stuff they couldn't keep alive even if their business depended on it. This sort of inter-dependency is exactly what we should be trying to avoid because it means that you are simply no longer in control, either because you don't have access to _all_ the code that powers your business or because your code is only a minor extension to a bunch of black box code that you can not review or inspect on a machine that might be running all kinds of nefarious stuff besides what you think it is doing and that might come back to bite you one day.

<comment><USER3> Software as a Service is a huge threat to Free software in particular, and Open Source in general.

This is why I release all my own software under the AGPL.[1][2]

I also try to avoid using SaaS as much as possible. But this is going to remain very difficult until fully decentralized, peer-to-peer communication networks become widespread.

As long as centralized forums like HN, centralized mail services like GMail, and centralized social networks like Facebook dominate, it's going to be hard for you to keep your data out of their hands without refusing to participate in electronic communication at all. While any sort of data, from email to TCP packets, flows from your own machine through others outside your control, this will remain the case.

Complete freedom will require complete isolation. Anything less will be a compromise. Everyone will have to determine where they draw the line for themselves.

[1] - [https://en.wikipedia.org/wiki/Affero_General_Public_License](https://en.wikipedia.org/wiki/Affero_General_Public_License)

[2] - [https://www.gnu.org/licenses/agpl-3.0.html](https://www.gnu.org/licenses/agpl-3.0.html)

<comment><USER2> This should be periodically reposted or sticky somehow:

[http://www.fourmilab.ch/documents/digital- imprimatur/](http://www.fourmilab.ch/documents/digital-imprimatur/)

John Walker was pretty prescient when he wrote that.

(and in case you don't know who he is: he founded Autodesk).

</comment></comment></comment><comment><USER4> I don't really like this argument. (This is a bit different from saying that I disagree.) There's a tradeoff here, and it's more than a cliche in this particular case.

The same argument would imply that you shouldn't do computing on VPSes or similar services that other people own. This might be strictly true, but the alternative for lots of people is that they just won't be doing that computing. At least with free software, we can say that it's usually monetarily cheaper than proprietary software. Buying and running your own server is much more expensive than running an EC2 box for pennies per hour. A lot of people's first introduction to free operating systems, these days, tends to be on a remote server instead of their personal computer. I don't think we should halt that.

The same argument would imply that you shouldn't use the email or shell account from your university, and you should self-host. While I actually do believe that to some extent, I get the feeling that Richard doesn't.

And even if you do end up self-hosting everything, chances are you won't be responding to security issues as quickly as a full-time team of professionals on call. At that point, anyone who wants to take your freedom can do so. This doesn't seem like a win.

I appreciate the goal, but we have a long way to go to the day when this becomes the right advice.

<comment><USER5> At a minimum you should know what you're getting into.

Imagine that that server is controlled by your worst enemy.

Still okay with using it? If so thats good evidence that you can just go ahead. If not, ... well, it gets harder because how do you know your worst enemy doesn't or won't gain control of it? (What? your worst enemy is the neighbour's chihuahua and Amazon doesn't hire dogs?)

WRT the costs there, I'm not sure that really follows. At least on the high end EC2 is phenomenally expensive if your load is predictable, it's interesting when you can't predict it. The large high cpu instances basically pay for the hardware in a couple months worth of use. Small instances are low performing to the point that a $35 quad core arm or $50 atom device is competitive. Surely there are cases where EC2 is cheaper, but "not computing at all" sounds like an exaggeration.

<comment><USER6> "Small instances are low performing to the point that a $35 quad core arm or $50 atom device is competitive"

You're forgetting the "Amazon data center connectivity", "can scale up or down at will", and "someone else's problem if the hardware fails" parts. Those things are not free.

<comment><USER7> Yes but sometimes cheaper than cloud provider make you think.

IMHO, it' a bell curve. Before a certain point and past another threshold the "cloud" is more expansive than it's worth. Adapting your application/system to a IaaS or a PaaS model isn't free either.

</comment></comment></comment></comment><comment><USER8> > Do your text editing with your copy of a free text editor such as GNU Emacs > or a free word processor. Do your photo editing with your copy of free > software such as GIMP. What if there is no free program available? A > proprietary program or SaaSS would take away your freedom, so you shouldn't > use those. You can contribute your time or your money to development of a > free replacement.

There are many kinds of freedom.

If I'm spending hours or days trying to get some inadequate free program to accomplish some task I need, or trying to work around the lack of a free program in that area at all, when there is a proprietary program that will quickly accomplish my task, NOT using the proprietary program takes away freedom. It enslaves me to spending hours on that task when I could be doing something I would enjoy more.

If it is a task that will be ongoing as opposed to a one shot, and so I might have some concern about getting locked into something, freedom maximizing would probably involve a mixed approach: use the proprietary tool, and toss in some monetary support toward some free software project working in that area.

<comment><USER9> In the case of Stallman's free software, the most important of freedoms are four specific forms: The freedom to run the program as you wish, for any purpose (freedom 0). The freedom to study how the program works, and change it so it does your computing as you wish (freedom 1). The freedom to redistribute copies so you can help your neighbor (freedom 2). The freedom to distribute copies of your modified versions to others (freedom 3).

The "freedom to get things done quickly" is a shallow freedom that leads users into a life of helpless servitude and social division. The reason this happens is because there are many people who write proprietary software which will help users do powerful things but the software will also have various restrictions that result in helpless servitude and social division. Stallman teaches that users who choose to accept these proprietary software with the restrictions cannot live in freedom as users are forbidden to control the proprietary software, the control over the software belongs to the owner of the proprietary software.

</comment></comment><comment><USER10> > Thus, SaaSS is equivalent to running proprietary software with spyware and a > universal back door.

I actually agreed with the article up to that point, but this is wheasel- wording and kinda dishonest. Microsoft's backdoor is universal as it has access to your entire system. The described SaaSS backdoor isn't universal - it only pertains to that particular service and no other services (or non- services) can be affected. Thus, given the previous definition of the word, it is not "universal"

This wheasel-wording only detracts from the point being made and may alienate people who would normally agree.

<comment><USER11> I've always disliked Richard Stallman's views on software. While open source is great, its a terrible business model. Closed source has its place - and not all of it is inherently evil.

<comment><USER12> Stallmans ideas on economics make sense when you factor in his $1m grant from the MacArthur foundation, another $1m from the Takeda foundation, and tenure at MIT. If you have all that sure, give software away for free!

<comment><USER13> I've heard speeches by Stallman where he mentions he has enough money that he no longer has to work, but as others have already said (1) he started working full time on GNU before he received that money (and supported himself by selling free software and prioritizing requests by people who sent him money), and (2) he doesn't live an incredibly opulent life, even factoring in the free travel.

<comment><USER3> It doesn't take long for "free" travel to become more of a burden than a benefit, even if you don't consider the hassles of going through customs, immigration, and security lines at airports.

</comment></comment></comment></comment></comment><comment><USER14> Whether you agree with his stated goals/values or not, Stallman does us all a service by elucidating these issues. Because code and the constructs he talks about are "virtual" entities, it isn't readily apparent to most people what the actual consequences are of where and how and why things are done the way they are done. People often think these details don't matter, but they do. They think they don't matter largely because they don't understand how x thing leads to y consequence. Stallman does understand those relationships.

I myself struggle with the question of how I can put something out into the world such that it is freely available to theoretically anyone while also finding a way to pay my own bills. Writing code is not a big part of what I want to do. It is, in fact, probably a fairly small part of what I want to do. But it is a similar problem space. And few other people are writing anything that elucidates for me the details of why this stuff matters, how it matters, what the exact consequences are and so on. I find that very helpful in thinking through my own problem space.

So I will just briefly thank him here (not that I expect him to read this). I read a biography about him some months ago and that was a real step forward for me in my thinking through some of my own challenges. Thank you, Mr. Stallman.

</comment><comment><USER15> Funny, I've been listening to the podcast right now:

[http://bootstrapped.fm/bootstrapped-episode-35-hate-the- saas...](http://bootstrapped.fm/bootstrapped-episode-35-hate-the-saas/)

</comment><comment><USER16> Stallman is basically saying that it's unethical to outsource a software function that it's possible to run on-premises, which is just... a losing argument. Any given user can decide whether the (almost purely abstract) "freedom" of running free software one's own server outweighs the convenience of, say, not having to administer a mail server. I'm not sure what free software buys you versus hosted software with good data export features.

<comment><USER5> He's saying it has ethical implications.

Making that decision in an informed way starts with having some idea of what you're giving up.

In the case of SaaSS, you're often not sure what you're giving up precisely because the operation of the server is so opaque to you. E.g. is the server copying all your email to a hostile foreign government? The operator /says/ it isn't.

Indeed, it can be a bit abstract-- but many other important tradeoffs we weigh also involve abstract implications or effects at a distance.

<comment><USER17> I have huge respect for Stallman and I understand his argument, but he's still stuck in a 1980s mentality where everyone on a computer had to have some level of expertise with actually _running_ software.

The fact is that many people today are incapable of even installing an application on a proprietary desktop OS, much less utilizing the freedom of software they control. 10 years ago I was building websites for people at $1000-$5000 a pop, all with open source software. They have all the benefits of free software available to them, but you know what they don't have? Anyone to maintain their software for a reasonable price. I've been directing them to SaaS providers for a long time because frankly it makes no sense to pay me 100 times as much to a software professional in order to realize this freedom.

Obviously Stallman would say that there's no inherent reason that you can't have a reasonably priced service based on free software, just like there's no reason you can't charge for shrinkwrapped free software. However the mechanics and cost savings of SaaS make this much much more difficult to conceive, and frankly I don't see how it will ever make sense for the laymen who make up the vast vast majority of computer users today.

Stallman is a gem of the computing world, and I would never say anything bad about his ideology, but the primary battle that needs to be fought today is about _data ownership_ , not software freedom. The latter still matters, but only for the computing elites (ie. programmers, sysadmins, etc), the former is what is increasingly going to affect everyone going forward.

<comment><USER18> Yes.

Arguing that paying someone to run the software for you is unethical is like arguing that paying for a well-prepared meal in a restaurant is unethical. You should source all the ingredients and prepare them in your own kitchen.

Except we're paying for the expertise of the chef. In the case of SaaS we're paying for not maintaining our own data center, system administration costs, operations costs, monitoring and security.

But the chef might not use clean food! People will get sick, the chef's reputation will suffer, and he'll go out of business.

As you say, the question is data ownership. Turning that toward the analogy, how do we verify data security such that reputation is affected? Make ethical behavior valuable (reputation) and businesses will behave ethically.

<comment><USER9> Freedom means having control over your own life. If you use a program to carry out activities in your life, your freedom depends on your having control over the program. Nonfree software encourages users to surrender control over their computing to someone else and this is the exact same situation in SAAS. SAAS is not controlled by the user but some other person. This is unethical because this causes an unjust form of power over the user. Users who partake in SAAS or proprietary software do not get all four freedoms of free software that all users need to have freedom. Now if you feel that you don't need all four freedoms of free software, then so be it but beware, your computing will not belong to your hands but it will belong to the hands of other people (who don't necessarily have your best interest in mind).

In a restaurant, there is no unjust power over the customer. In a restaurant, a customer can order some dishes and order the dishes to be prepared a particular way. When the customer gets the meal, the customer is free to do things such as add more things to the food, take the food away for later eating or share the food with friends or even resell the food to anybody. In the case of SAAS, similar freedoms are not available to the user. Users are forbidden to study and modify how the service operates, and users are forbidden to share the computing service with other people. Control over the service belongs to the SAAS company and not the user.

<comment><USER17> Way to repeat the mantra without engaging in the actual argument _at all_.

<comment><USER9> I repeat the mantra because I thought it engaged the ideas of the ethics of SAAS and in food service. Would you care to present a counterargument to what I've presented.

<comment><USER18> If I understand your position, and that of the FSF, rightly then you believe it is both unethical to provide, and unethical to use hosted software that does not carry the AGPL.

I would submit that a SaaS provider could not ethically allow modifications to their running software. So let's exclude that from the discussion.

What if a provider only ran software licensed with the AGPL? It wouldn't fix anything. The license requires accessing a download of the source. How can a customer verify the version of the software is the same as the version of the download, i.e. check for a violation of the license? Short of having access to the operating system on the servers, the customer cannot. No reasonable service provider would allow such access, and no reasonable customer would accept that other customers, including, possibly, competitors, had such access.

You can push the problem around all you like (every customer has their own server with OS-level access, but what about the DB?). It will always end up being cost prohibitive to run a service.

Also, under the AGPL the point is for any user of the system to be able to host and run their own instance. Meaning that any innovations must be given away. Conversely, if the software can only run in the context of the provider's data store, the problem of data ownership is not resolved.

Do I want the keys to the OS on my home computer. Darn right. At work, do I want the keys to Amazon's virtualization layer? Heck no, I don't want those headaches. It's what I'm paying them for.

Stallman's position also fails to address the ethics of contract law. What makes Free Software ethics superior to ethics of contracts?

<comment><USER19> "The ethics of contracts" Gah. Ugh. Wha.

Anyway, to be clear: Stallman actually says that breaking your promise, i.e. breaking a contract is not cool, so you shouldn't ever accept a contract that requires you to give up essential freedoms. He does not advocate breaking contracts, he argues about which contract terms are ethical or unethical. He doesn't say break the unethical ones, he says don't accept them in the first place.

And you could run hosted software that does something that involves networking fundamentally, such as a chat service, and it would not be SaaSS. And you could run any software under a permissive license and still provide the code as though it were AGPL. AGPL isn't a requirement for being ethical, it just helps stop people from being unethical (but they could choose to be ethical regardless).

</comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER20> OR you choose to delegate the burden of running and maintaining this software to someone that will do it in a more cost-effective way than you ever could.

<comment><USER5> Or could close their "beta" you were depending on without notice, could lose your data, could leak it, could give unexplainable corrupt results and leave you looking like a fraud, etc.

There are a lot of opportunities to trade off short term ease for tail risk, and thats a bit hazardous. RMS would probably argue that while you should have the freedom to do such a thing, you really shouldn't both because of the harms to you not being justified if you don't overemphasize the near term, and also because of systemic effects like losing solidarity with other people who would prefer to make another decision( _).

[_e.g. many people who choose to run their own small mail filters find them regularly invisibly black holded by major mail services due to overactive spamfiltering.]

<comment><USER21> > Or could close their "beta" you were depending on without notice, could lose > your data, could leak it, could give unexplainable corrupt results and leave > you looking like a fraud, etc.

I don't have to use SaaS to have these results. I've seen in-house efforts with the same risks. The difference, in my mind, is that with SaaS, the provider has some significant incentives to do a good job. The software is their specialty, and the developer will lose money if you stop using it because their software ends up costing you money. There's much less risk of internal company politics saddling you with a useless or dangerous system. On the contrary, I've seen "self-hosted" company projects promised in response to proposals to use SaaS, and they were usually promised to achieve some political goal rather than being a serious attempt to compete. Because it's an internal project which doesn't generate revenue, it's very easy for the company to promise something and then not deliver, as there's no money tied to it.

Having seen this multiple times, I'm much more inclined to use SaaS. Tail risks don't cost nearly as much money over the mid term as the risk of company politics derailing an otherwise laudable goal.

</comment></comment></comment><comment><USER22> I admire Stallman. He is someone who really made a difference. That said, I find myself slightly disagreeing with him on web services:

It seems like in most cases the criticism of web services mostly are in loss of privacy and digital security. On the other hand to me the point of the (A)GPL is ensuring that computer users have the right to inspect and modify the software running on their own systems.

I understand that there is some overlap: using free software is likely (I think) to increase one's privacy and digital security.

</comment><comment><USER23> To be honest, this is one of the results of accepted and encouraged copyright infringement over the past 15 years.

By taking away the rights of the copyright holders (IE: copying software freely without permission), they were forced to come up with something that can't be copied: software-as-a-service.

</comment><comment><USER24> I love the part where he says that "Cloud computing" = "Be a sucker". LOL

</comment><comment><USER25> The ethics of Stallman's arguments don't matter in the least, and they never have. He's like a guy in 1905 trying to get people to keep using horses. He's been on the wrong side of history for so long that you can no longer even detect that there was a history to be on the wrong side of: he just floats out there in his own strange little bubble of ideals. You have to respect his dedication to those ideas, but there isn't much relevancy left.

<comment><USER26> He's been on the right side of history and the rest of us have been on the wrong side. I think the Snowden leaks solidify that view. After Microsoft Windows how could you disagree with him on concerns of proprietary software lock-in? And he's been spot-on as far as privacy goes: worried about the cloud long before anyone else, and concerned about cell-phone surveillance before it was hip. The mere existence of GNU licenses has done enormous good for the world, and Linux is proof. Linux didn't take off because of his ethics, so you're right in that regard, but his ethics are responsible for the things that people like about free software.

And this being hacker news, you have to admire the great hack that is the GPL.

<comment><USER27> History says that despite the fact that these "wrongs" have taken place, that people largely do not care. So, what does it mean to be "wrong"? Likewise, if a tree falls in the forest and nobody is there...does it really matter?

I could also argue that Linux is generally holding the world back. Just like wrong and right...this whole thing is a matter of opinion and point of view. There are simply no absolutes to measure against.</comment></comment></comment>


Why Groupon Uses FreeBSD [video] - <AUTHOR> https://www.youtube.com/watch?v=yQx_dJIG-sg

<comment><USER2> I feel exceptionally bad even saying this, but the presenter for this video would have been best served implementing the code and avoiding the camera altogether. I cringed the whole time -- it was like watching Joseph Nash discuss .. anything on youtube.

Stop forcing your elites into a role. Stop forcing your anyones into an anything that they aren't. "collaboration" is the mantra, but let them work. Please.

<comment><USER3> I think it's probably just you. I feel no cringe at all or see why anyone would.

What really bugs me is the terrible sound in a lot of these videos. The microphone needs to be near the speaker, not at the back of the room where it picks up crowd noise. Wireless mics for cellphones are around $100. If I were a speaker I would invest in one so my talk had a chance of being understandable.</comment></comment>


The Twitch Statistics Pipeline - <AUTHOR> http://ossareh.posthaven.com/the-twitch-statistics-pipeline <comment><USER2> Of note: Twitch's Data Science team is hiring their 5th engineer [http://science.twitch.tv/](http://science.twitch.tv/)

I'm a designer that worked with Mike on a short project for the science team. The 4 of them are a huge pleasure to work with :) Very scrappy and analytical when it's time to get things done, but playful and generally funny fellows to be around. Interesting problems to work on when they're #4 in US's peak traffic count, after much bigger guys like Netflix, Google, Apple (and an underdog story beating out Hulu, FB, Valve) [1]

Twitch's office is very thoughtfully designed with fan art and game-themed interior and murals. It's a nice testament to the community that they're built around. The office manager, Ashley, has done an equally thoughtful job with amenities -- makes it easy to be productive.

[1] [http://s.jtvnw.net/jtv_user_pictures/hosted_images/wallstree...](http://s.jtvnw.net/jtv_user_pictures/hosted_images/wallstreet_deepfield_graph.jpg)

<comment><USER3> Any love for interns?

<comment><USER2> won't know if you don't ask : ) firstname.lastname@example.com

</comment></comment></comment><comment><USER4> "Our clients send base64 encoded JSON objects to our edge server using HTTP GETs."

Encoded json in get parameters? That's not what GET requests are for. use POST requests for that, or you'll quickly be limited by the max size of a get request, somewhere around 8KB.

<comment><USER5> If you are sending over 8KB of JSON, something is fucked

<comment><USER6> I could see a bulk metric insert [e.g. a modified version of StatsD] being >8KB.

</comment></comment></comment><comment><USER7> The post says that latency is an issue. In this case I would look at using Kinesis (AWS's hosted Kafka equivalent) which can barf data directly into Redshift (as I understand it; haven't used this functionality.)

<comment><AUTHOR> Our latency concerns are "can our product managers make decisions quickly", to that end we're OK with a 24 hour latency for stats. The fact that we're at 5 hour latency gives us a lot of breathing room.

Kinesis looks really interesting, and is definitely something that we're going to look at once we work out our ETL process.

The order of priority for us has been:

1 - Get a pipeline up and running 2 - Make it robust 3 - Make it fast.

Pipeline v3, our current one, satisfies (2). We expect to be working on (3) in the near future. ETL is the latter part of (2). (3) results in powering dashboards, we expect those to contain a lot of joined data and having a robust ETL process is pretty key to that.

<comment><USER8> Yes - Kinesis is awesome. This is already a little out of date but shows how we're now porting our open source event pipeline to on top of Kinesis: [http://snowplowanalytics.com/blog/2014/02/04/snowplow-0.9.0-...](http://snowplowanalytics.com/blog/2014/02/04/snowplow-0.9.0-released- with-beta-kinesis-support/)

</comment></comment></comment><comment><USER8> Nice to see lots of similarities with how we do things at Snowplow ([https://github.com/snowplow/snowplow](https://github.com/snowplow/snowplow))...</comment>


Potential New Particle Shows Up at the LHC, Thrilling and Confounding Physicists - <AUTHOR> http://www.scientificamerican.com/article/potential-new-particle-shows-up-at-the-lhc-thrilling-and-confounding-physicists1/ <comment><USER2> Ugh, god, will this news story not go away? The statistical significance of this finding is _not high enough_ to warrant the hysteria surrounding its reporting. As quoted in the article: "Extraordinary claims require extraordinary evidence, and this is not that".</comment>


MIT 6.824 Distributed Systems labs rewritten in Go - <AUTHOR> http://pdos.csail.mit.edu/6.824/labs/lab-1.html <comment><USER2> I'm currently taking the class. C++ was used before. The main reasons the professor cited for using Go are that it has a very easy to use RPC library and that the labs are designed so that you will spend most of your time working on the distributed systems aspects of the problems, not dealing with the intricacies of the language or libraries used. Apparently he felt Go was better for that than C++, though he didn't spend any time comparing the two.

<comment><USER3> I took 824 last Spring and the labs were often terrible because of the level of debugging necessary (but very informative and well made). In particular it was bad for those without much C++ experience like myself. I think the difficulty of testing and worrying more about small bugs rather than the concepts of distributed systems was a common complaint and it's awesome to see it being changed. This class was also taught by rtm the semester I took it.

<comment><USER4> "Taught by RTM" == "taught by read the manual"?

<comment><USER2> RTM = Robert Tappan Morris, <http://en.wikipedia.org/wiki/Robert_Tappan_Morris>

</comment></comment></comment></comment><comment><USER5> Having been educated only as an undergrad at a college ranked ~100, I have a question for those who've experienced a course like this at MIT or a similar institution. When I was reading the first lab's description I thought "man, that'd be tough to put out in a week, but it's doable." I saw that it appears to be a multi-week lab for graduate students and wanted to find out if this is normal difficulty for a course? Is there more homework outside of labs that's missing, or crazy quizes/tests that deal with much more theory or proof style work? I just recall my undergrad courses having those extra items, but in large part being the case that if you made all your labs pass all the test cases you could get an A in the course. Does this hold true even at the elite schools or is there much more hidden below the surface here?

<comment><USER6> having taken a couple of cs undergrad courses when i was a physics grad student, i can tell you that undergrads seem to get _way_ more in the way of homework and assignments than grad students do (presumably because grad students need to keep up with their research, TA duties, etc.)

<comment><USER7> It is because grad school "classes" are a charade to keep up the pretense that an apprenticeship is a classroom education that merits tuition.

</comment></comment></comment><comment><USER8> CMU's 15-440 Distributed Systems course did this over a year ago. See <http://www.cs.cmu.edu/~dga/15-440/F12/>

The professor, David Andersen, catalogued his experience on Google Plus: [https://plus.google.com/115237092509505721130/posts/DKVcPLbq...](https://plus.google.com/115237092509505721130/posts/DKVcPLbqYX8) [https://plus.google.com/115237092509505721130/posts/AQqe7Xay...](https://plus.google.com/115237092509505721130/posts/AQqe7Xayzjn) [https://plus.google.com/115237092509505721130/posts/d2RE6gbj...](https://plus.google.com/115237092509505721130/posts/d2RE6gbj4gW) [https://plus.google.com/115237092509505721130/posts/3PFz3RUe...](https://plus.google.com/115237092509505721130/posts/3PFz3RUeejy)

</comment><comment><USER9> At CMU, 15-440/640 Distributed Systems is also in Go. One professor does it exclusively in Go and the other gives you the option of Go, C, C++, or Java.

<http://www.cs.cmu.edu/~dga/15-440/F12/>

</comment><comment><USER10> For those wondering where is Go mentioned: <http://pdos.csail.mit.edu/6.824/schedule.html>

<comment><USER11> Also here: <http://pdos.csail.mit.edu/6.824/labs/lab-1.html>

> You'll implement this lab (and all the labs) in Go.

I'm really glad to see this :-)

<comment><USER12> Go seems pretty good for things I might otherwise prototype in Python and then rewrite in C++ in order to get better static guarantees and performance. Does that sound fair?

CSP/Actor concurrency instead of exposing raw threads is a huge win. Focusing on interfaces instead of ancestry is also a huge win. However, it's really tough for me to get over Go's treatment of null and global mutable state.

It seems to me a bit of a waste to design a new statically typed language that intentionally allows the most common type error, as if Tony Hoare's Billion Dollar Mistake wasn't a mistake. One of the smartest things Bjarne Stroustrup did was disallow null in C++'s reference semantics.

It also seems a waste to give a language somewhat Erlang-like CSP/Actor-based concurrency, and then allow direct mutation of global state. This makes it much easier to introduce concurrency bugs, and also hurts garbage collector performance.

Maybe I just tried out Go too early. Does Go still use the Plan9 ABI and come with a copy of kenc so you can recompile your C source to be linkable against your Go code? Are the language creators still the only ones allowed to create generics?

<comment><USER13> Yes and yes. Though you don't need to manually do anything (dunno if you ever did), it still comes with the Plan 9 C compiler for bridging Go with C, and generics are still hardcoded.

</comment></comment></comment></comment><comment><USER14> Can this course be taken/audited online? My degree has a distributed course, but there isn't even a mention of anything like Paxos.

<comment><USER15> Where do you see Paxos? This looks like something simpler. It pretty much has to be as implementing Paxos would be too hard for a class exercise. I don't think it makes sense to do Paxos with 2 servers.

<comment><USER2> It appears that Paxos will be used in the third lab, <http://pdos.csail.mit.edu/6.824/labs/lab-3.html>.

<comment><USER16> In the 2010 version of this course, we implemented paxos on one of the later labs. It was considered one of the hardest I think.

<comment><USER7> How is Paxos hard? Inventing Paxos is hard. Implementing it is implementing a well-specified state machine.

<comment><USER17> If it was so easy papers like this would not exist: <http://research.google.com/archive/paxos_made_live.html>

</comment></comment></comment></comment></comment></comment><comment><USER18> Can we get more details? What did they use before? C++? Is there any code opensourced?

<comment><USER11> Check their site for 2012. It was C++. :-)</comment></comment>


I bought some awful light bulbs so you don't have to (2016) - <AUTHOR> https://mjg59.dreamwidth.org/40397.html <comment><USER2> This is a short article that gives us a glimpse of how bad things currently are in the Internet Of Shit.

The penultimate paragraph: _So, in summary: it 's a device that infringes my copyright, gives you root access in response to trivial credentials, has access control that depends entirely on nobody ever looking at the packets, is sufficiently poorly implemented that you can crash both it and the bulbs, has a cloud access protocol that has no security whatsoever and also acts as an easy mechanism for people to circumvent your network security. This may be the single worst device I've ever bought._

<comment><USER3> Having bought a bunch of IoT stuff since then - these are probably still the single worst device I've ever bought, with the possible exception of the Bluetooth bike lock that had a hardcoded backdoor unlock code.

</comment></comment><comment><USER4> There's a Russian guy who tests lamps. It's in russian, but should be easy enough to figure out.

[http://lamptest.ru/results/](http://lamptest.ru/results/)

<comment><USER5> Not exactly reviews but BigClive 'disassembles' devices, especially lights and investigates the circuits. That said, I don't remember any IOT devices.

[https://www.youtube.com/user/bigclivedotcom](https://www.youtube.com/user/bigclivedotcom)

</comment></comment><comment><USER6> (2016)</comment>


Yes, You Can Run 18 Static Sites on a 64MB VPS - <AUTHOR> http://www.lowendbox.com/blog/yes-you-can-run-18-static-sites-on-a-64mb-link-1-vps/ <comment><USER2> There's no practical limit to the number of static sites you can host on a 64MB VPS. There is a limit to the amount of traffic that a 64MB VPS can serve, but if you want to host 10,000 low-traffic sites then by all means go ahead.

</comment><comment><USER3> Yes you can. We used to run whole webservers on 486DX/2-66's with 8megs memory. Ran just fine.

Kids these days.

<comment><USER4> Pfft - in my day we used to power our web servers using a potato: <http://d116.com/spud/>

<comment><USER3> touché.

</comment></comment></comment><comment><USER5> Why not just 18... why not 48 or 128 or 1024? Questions like this are always loaded. First of all:

\- This assumes the end user is familiar with command line usage. The typical consumer of VPSes aren't, in my experience, and rely on something like cPanel to do all administration. Which is why you can't really run on 64MB.

\- The site itself doesn't take up RAM, just disk space. If you have 1024 static sites the only thing taking up ram is the configuration of the sites sitting in Apache's memory. As long as there isn't a lot of traffic on the site, it doesn't really matter how many there are.

\- You could have 1 static site that has a medium amount of traffic and it would bring the 64MB instance to its knees as soon as you have more than a few concurrent connections.

Anyway, from this hoster's experience, when I get a question like "What can I run on a 64MB VPS" the easy answer is "Not much" because usually the type of person that wants to spend $3/mo on 64MB VPS instead of $7/mo for a 1GB VPS doesn't really have their priorities in place.

<comment><USER6> > If you have 1024 static sites the only thing taking up ram is the > configuration of the sites sitting in Apache's memory. As long as there > isn't a lot of traffic on the site, it doesn't really matter how many there > are.

And if you're smart about the setup, you don't even necessarily have to have a separate configuration for each site. See mod_vhost_alias for Apache, for instance. With that in place, memory is no longer an issue at all.

<comment><USER7> Why would you use apache for static sites? Did you even read the article? It uses lighttpd.

<comment><USER6> By way of example. I'm sure there's equivalent incantations for lighttpd/nginx/flavor-of-the-week, the parent comment just happened to mention Apache. :)

</comment></comment></comment></comment><comment><USER8> Memory is under your control, and if you can keep your content cached will serve you well.

The catch with very small VPS slices for me is disk performance. Small slices means more neighbors, and if a few of your neighbors are high disk use applications your disk latency can get ugly. The nasty bit is you can benchmark and check it all out when you move in, then a month later your site is suddenly a dog.

CPU has the same dynamic, but I think the virtualization platforms do a better job at "fair" for CPU, and if you are using nginx or lighttpd you don't need much so should be treated well by the scheduler.

</comment><comment><USER9> I sell 64MiB VPSs and there has been a lot of internal discussion on the subject; should we continue selling them? As the article says, if you are willing to put in the work, even 64MiB can be useful.

On the other hand, more ram gives you a lot more breathing room. It is _much_ easier to do useful things if you get the 128MiB service instead of the 64MiB service. (I charge $4 per account, and $1 for every 64MiB ram, so 128MiB is only a dollar more a month than 64)

Nick, an employee of mine, points out that the 64MiB guests are still useful because they force people to learn about every process running on the box, and to only run what is absolutely required. And he's right; that is a great thing to learn. But it is also a lot of work.

</comment><comment><USER10> Worth pointing out that the site behind this is itself running Wordpress on a 80MB VPS (plus swap): [http://www.lowendbox.com/blog/quickweb-7-128mb-xen-vps- in-la...](http://www.lowendbox.com/blog/quickweb-7-128mb-xen-vps-in-la- chicago-and-germany/#comment-31158)

That's an old article, but LowEndBox is a fun site for checking out the bottom end of the VPS market, these days it's mostly only postings of very cheap providers ($7/month limit) the blogger has been sent or seen on WebHostingTalk. Then the ensuing discussion of how long until the company behind it goes bankrupt. 64MB VPSes like this don't really get offered anymore, while 128MB and 256MB offers are much more popular, usually in the $15-$20/year range.

<comment><USER11> > $15-$20/year

$15/$20 a YEAR ?

<comment><USER12> Yup. :)

</comment></comment></comment><comment><USER13> I would argue that the most cheapest option for hosting static sites nowadays is on S3.

At $0.14/GB and $1/million requests - I don't think you can get any cheaper. Or reliable, for that matter.

<comment><USER14> Your numbers are wrong, $0.14/GB is only for storage. The thing that will most likely bite you depending on what kind of site you are hosting is the $0.15/GB outbound transfers.

But yes it will still be cheap for most static sites like a jekyll blog or something, if you ever reach more than 130 GB of outbound transfer you have just reached the cost of an entry level linode with transfer of 200gb included.

<comment><USER7> My $3/month VPS has 500gb transfer, and it's not the cheapest around.

<comment><USER14> What provider would that be?

<comment><USER15> Hostigation. Another good one would be BuyVM at $15/y =)

</comment></comment></comment></comment></comment><comment><USER16> I was disappointed that this article didn't have anything about traffic but speculation. I expected it because of the title. There's no point to me in how many static sites it can host if traffic isn't taken into account. As jonknee said, it could host 10,000 low-traffic sites.

I also looked up the VPS mentioned in the article, and noted that it's not really that cheap. There's only two price levels below $20, and $20/mo for 256MB isn't great. I got a tax-day special on Zerigo that amounts to about $20/mo for 640MB, and RackSpace Cloud has 512MB for $21.90/mo. The author of the article also mentioned getting a billing issue resolved, and I expect not to have any billing issues in the first place for web hosting. I'm more willing to give other types of services some slack but I think hosting companies ought to have this one figured out.

<comment><USER17> I found a Windows host with 1GB of RAM for just $8.00 at vpsport.com. That's a heck of deal.

<comment><USER18> Nice try, VPSport.

<comment><USER15> Why must you assume that is spam? It could very well be from the front pages of LEB.

<comment><USER17> Yes, I'm not affiliated with them at all; I just found the deal on LEB and opened a server and I just thought the price was fantastic for 1GB of RAM. In fact, it's the cheapest 1GB of RAM I've ever seen. I think they can manage it because they use Hyper-V dynamic RAM allocation. I've never seen that in practice, it's really interesting to see. A kernel driver actually sucks up the extra RAM you're not using if it's needed somewhere else.

</comment></comment></comment></comment></comment><comment><USER19> As an alternate option, it's more than possible to run a static site on Google App Engine (for free). Obviously, this is for low traffic and resource requirements.

<comment><USER20> Sure you could run dynamic sites as well.

But this isn't a VPS option.

</comment></comment><comment><USER21> _My personal favourite is Nginx (pronounced Engine X)_

I had no idea. I've been calling in "ninks" all this time.

<comment><USER22> I used to call it enjinx.

<comment><USER23> Me too. And I am not going to change it.

</comment></comment></comment><comment><USER24> Many hosts (and users of hosts) - including myself - over at WebHostingTalk use/sell cPanel hosting a fair amount.

And naturally 64 MB of RAM would NOT be enough for a VPS running cPanel (or any other mainstream server control panel, for that matter).

If the user is happy to use command line though then yes, he can run 18 static sites on a 64 MB VPS.

His post doesn't mention whether he's happy to have a no-control panel VPS though, so this entire blog post (well, the basis for it) does seem to be predicated on a fairly big assumption...

Overall it's a good, informative post though.

<comment><USER25> Why the heck do you need a control panel to simply scp or sftp files over to a virtual host?

<comment><USER2> Many people in the market for such entry-level hosting don't have the know-how to setup and manage accounts/virtual hosts.

<comment><USER26> Those people in the market for entry-level hosting don't use a VPS, they use a shared hosting service.

<comment><USER2> They use whatever's cheap and then will ask for help.

</comment></comment></comment></comment></comment><comment><USER27> Just wait until there are several active WP connections and then there is a cache miss.

WordPress can sometimes use 32M to build a page.

That kind of setup is only useful where most of your visitors are NOT logged in, since logged in users often cause cache-misses.

<comment><USER2> The headline says "static sites". That means WordPress isn't being used.

<comment><USER28> But the article talks about installing WordPress. So the confusion is understandable.

<comment><USER15> "Kinda." The article says it might be possible to take it one step further to run a low volume wordpress/basic PHP install.

</comment></comment></comment></comment><comment><USER17> Has any VPS provider thought of building customized Linux distributions specifically to reduce the memory footprint, preconfigured with lightttpd/nginx, php, and mysql, all with pre-configured configuration settings?

I find that most VPS hosts just install a standard distribution and expect the customer to do all the work to reduce the memory footprint, or they install memory hogging Apache + Plesk control panel configurations that are hard to change.

I think one of these providers could make a great offering by having this type of small VPS all pre-configured and ready to run as soon as it's provisioned.

<comment><USER29> I believe that Virtualmin (a YC startup) is currently building[1] a control panel with the ability to configure a low-memory setup.

1\. <http://www.virtualmin.com/node/11831#comment-51928>

</comment></comment><comment><USER30> I'd add that if the site is purely static (the example is a PHP site), you can get away with 2MB to 8MB for Nginx and the rest will be filesystem cache and OS. If you don't have too many files, CPU and network throughput will be your only bottleneck and you can have unlimited domains.

</comment><comment><USER30> This may not seem practical to many who have larger boxes, but much of this advice is extremely useful when you're running a large cluster with millions of hits a day and every spare ounce of memory you save translates into less money for Dell. Great job!!

</comment><comment><USER7> My main VPS has 128mb RAM and is running a MyBB forum which gets 80k pageviews a month. If I dropped the PHP, MySQL, IRC stuff and email server I could run it on 16-32mb except when updating the software on the VPS.

</comment><comment><USER31> "number of sites" isn't a metric you can design against - you know nothing about the app requirements.

"number of static sites" is marginally better - the "number of sites" in that case is meaningless - the limiting factor will be the request rate and desired response time.

</comment><comment><USER32> Pfft - Back in '00, I shifted a million requests a month across 22 static (using SSI though) sites off a circa 1991 SparcStation 2 (weitek 80MHz upgrade) with 64Mb, NetBSD, thttpd and a couple of 4.3Gb SCSI2 disks. It finally gave up in 2002 when the AUI port decided it'd had enough of electrons.

I reckon you could do that with one eye shut on even the crappiest VPS.

</comment><comment><USER33> AGGHHH!!! This is CLEARLY a very well DISGUISED ad-article/spam. Im so angered when I see an article that has "WebHostingTalk", "Discount", "Heres how you..."

Its so painful to see this on HN!

P.S. @spitfire -- Yeah.. thems were the days! ___goes to show you how old_ I am

<comment><USER10> The title and text, etc. are all directly responsive to the linked contemporary WHT thread where someone asked about a 64mb plan on this specific service, and if it would be enough for 18 static sites. The WHT commentators all said no.

I'd be inclined to believe it is _not_ spam. Mainly because sites designed as hosts for ad-articles/spam don't tend to build up communities or stick around this long (this article is over 2 years old).

But also because the site covers multiple providers, not just this one, sometimes favourably, sometimes not, always without any real benefits to the owner. It does provide a (presumably no longer valid) referral code for the particular service discussed in this one article, but it's an extra click away from this page, and the site goes to _very_ large pains to point out it is a referral code: [http://www.lowendbox.com/blog/vpslink-february-sale- and-10-o...](http://www.lowendbox.com/blog/vpslink-february-sale-and-10-off- referral-discount/)

Also, to my knowledge, that is the only time this site has ever used any sort of referral code, and it was fully highlighted and explained. It also wasn't an affiliate code, it could only have been used to cover the site's hosting fees with a service the site owner had been using for the last 5 years.

Basically, it doesn't smell like spam to me. But, I have been enjoying the site for a number of months before it appeared here, so I'm less suspicious.

<comment><USER33> @jack12 Fair- enough. Though, it still doesnt negate the end-effect; and, the rising trend of flamebait titles on HN, and in fact has been discussed continuously ~and~ on nearly daily basis.</comment></comment></comment>


Tell HN: Google cannot tell me Charlie Hebdo address - <AUTHOR>

Hi All,
Ever since the terrorist attack in Paris office of Charlie Hebdo, I have been trying to get their office address because my SIL is curently in Paris as a tourist. I want to see how far the office is from Eiffel Tower.
https://www.google.com/#safe=off&q=charlie+hebdo+paris+address+
All the first 100 results are dominated by news sources. Only when I click on maps, I get two results...and no link to source. There is no way to verify correctness of the addresses Google's shows.
This is an indication that google SERP is dominated by useless news media. Sigh! <comment><USER2> On the Google results page, click "Search Tools > Any time > Custom range..." and enter a custom date range:

[https://www.google.com/search?q=Charlie+Hebdo%2C&rlz=1C5CHFA...](https://www.google.com/search?q=Charlie+Hebdo%2C&rlz=1C5CHFA_enUS579US579&es_sm=119&source=lnt&tbs=cdr%3A1%2Ccd_min%3A1%2F1%2F1990%2Ccd_max%3A1%2F1%2F2015&tbm=#tbs=cdr:1%2Ccd_min:1%2F1%2F1990%2Ccd_max:1%2F1%2F2015&q=Charlie+Hebdo+paris+address)

That leads to a contact page URL, which is currently offline, but can be accessed through Internet Archive's Wayback Machine:

[https://web.archive.org/web/20140210004507/http://www.charli...](https://web.archive.org/web/20140210004507/http://www.charliehebdo.fr/Contact.html)

Which gives the address as:

26 rue Serpollet 75020 Paris

<comment><USER2> Scratch that, the New York Times has published a map diagram:

[http://www.nytimes.com/interactive/2015/01/07/world/europe/c...](http://www.nytimes.com/interactive/2015/01/07/world/europe/charlie- hedbo-shooting-maps.html)

This would appear to match the second address listed in the Yellow Pages as found by informatimago:

10 Rue Nicolas Appert 75011 Paris

</comment></comment><comment><AUTHOR> Thanks Everyone. I was trying to point out that Google needs to change some of its search algorithms to make life easier for us.

Hopefully some responds to PG's request for startups in this area.

</comment><comment><USER3> Use yellow pages: [http://www.pagesjaunes.fr/recherche/paris-75/charlie- hebdo](http://www.pagesjaunes.fr/recherche/paris-75/charlie-hebdo)

There are 3 addresses.</comment>


Twitter CFO's Ascent Creates New Power Center - <AUTHOR> http://www.nasdaq.com/article/twitter-cfos-ascent-creates-new-power-center-20150614-00067 <comment><USER2> As a total outsider basing this on public press, I see this as Noto being the one organized and disciplined person in a madhouse. People who are organized, disciplined and willing to work a tremendous amount of hours tend to get assigned a lot of work because it gets done. And when a firm is very disorganized, those types of people become even more valuable.

The key question I see is can Twitter be run by a non-product guy?

</comment><comment><USER3> Not really sure what Mr. Noto brings to the table besides trying to sell the stock to institutional investors and others on wall street.

I don't want to discount Mr. Noto, however I really don't think he can turn twitter around. They need someone who can think ahead into the future, take bold risk, actually be in the office every day.

Compared to Facebook I just don't see Twitter "Moving Fast and Breaking Things", not because they don't have the talent; but they just lack a clear direction.

<comment><USER4> In which way do you mean "turn twitter around"? Twitter has 302M active users. Twitter, to me at least, seems very much successful from a product perspective. People love it and it's used heavily by the media and just about every large consumer facing company in the world has an active twitter feed they use to reach out to customers.

Financially, yes, it needs some work. Which is perhaps why they feel comfortable putting the CFO at the helm.</comment></comment>


Google Drive: Updates for iOS and Android - <AUTHOR> http://googledocs.blogspot.com/2012/09/google-drive-updates-for-ios-and-android.html <comment><USER2> The real time editing feature is great and definitely overdue. The only downside is it appears you can only edit docs and not other file types. I can live with that for now, but being able to edit spreadsheets would be nice. All in good time I suppose!</comment>


Observable Universe contains 10x more galaxies than previously thought (2016) - <AUTHOR> https://www.spacetelescope.org/news/heic1620/?lang <comment><USER2> And some people _still_ aren't sure if there is other life beyond Earth. :)

That's entire _galaxies._ Not just stars, and that's just the _observable_ universe.

We are still being surprised by the lifeforms we observe here on Earth, and the environments and conditions they can thrive in (including the outer hulls of our spacecraft), and we still have yet to discover and catalog all the life on our planet. Life may even come in the form of "artificial" constructs that build, learn, teach and reproduce on their own, created by "natural" life somewhere then set free into the cosmos.

How, when given the evidence of practically infinite planets out there (considering that almost every star may have at least one planet, and there are even rogue planets [0] that don't orbit any star, and that asteroids and comets or even dense nebulas could also harbor life), can we even consider the possibility that this is the only planet with life?

This game is Big, folks: _Even if 90% of all planets had life there would still be billions if not trillions of them without any life_ , and the incomprehensibly vast distances (including voids, like the one our own galaxy is near or inside of [1]) between them may mean millions of years before life from one planet encounters life from another (which is good I suppose; every species would have some room to expand into at their own pace.)

And of course, not all intelligent civilizations will be "successful."

We will either die out on our home planet or expand.

We may not encounter other life for hundreds or even thousands of year after we develop interstellar travel, or the life that we encounter may turn out to be mundane and eventually unexciting (I mean, imagine being an spacefaring species discovering us; planetlocked and still collectively figuring many basic things out.)

[0] [https://en.wikipedia.org/wiki/Rogue_planet](https://en.wikipedia.org/wiki/Rogue_planet)

[1] [https://en.wikipedia.org/wiki/Milky_Way#Environment](https://en.wikipedia.org/wiki/Milky_Way#Environment)

<comment> V-2 > _How, when given the evidence of practically infinite planets out there > [...] can we even consider the possibility that this is the only planet with > life?_

Human minds aren't good with very large numbers. What seems "practically infinite" to us - isn't, really.

The number of all planets in the universe is said to be in the ballpark of 10^24.

Meaning (obviously) if you keep on dividing it by 10, in just 24 steps you get down to 1.

Meaning if there are 24 factors crucial for life to evolve, and each has a 10% chance of occurring - it's actually quite likely only one planet would win on this lottery. (At a given point in time, that is - that's another aspect of course).

Or 12 factors, but each with a 1% chance. And suddenly it doesn't seem like a number big enough to warrant certainty claims...

Basically it is the "wheat and chessboard" problem in reverse.

You start with a huge pile of planets, but once you start splitting the pile, it shrinks very very fast.

Personally I'm not _sure_ either way, and I think being sure (either way) is just naive.

I _believe_ there is microbial life out there, and I accept a slim chance we may actually discover it - say, over the course of the next few centuries - but I'm sceptical about the existence of intelligent life, and even if it did exist, I see the chances of any contact to ever occur as zero.

<comment><USER3> I agree with you in that we will probably never have contact with another sentient species of extra terrestrial origin. The distances are to vast, the lifetimes of civilisations and even species too short and so on.

However I do think that you vastly underestimate the probability of life. Take a look at [https://en.wikipedia.org/wiki/Earliest_known_life_forms](https://en.wikipedia.org/wiki/Earliest_known_life_forms) . See how quickly life appeared once the earth had cooled down? It's almost immediately!

I'm pretty convinced that almost all star systems have some complex energy conversion cycles that could be classified as life. Let's not make the mistake of assuming all life has to be carbon based.

<comment><USER4> But it's fairly likely to be carbon-based, as carbon is the simplest existing element with the maximum amount of valence electrons. And generally, simpler (= lower ordinal number) means more stable, as well as more likely to arise (as less energy is required, e.g. in stars).

<comment><USER5> There are other theoretical biochemistry possibilities[1]. Silicon, for example, works well in low-pressure environments. It's an immense stretch of the imagination to think about life-forms that use semiconductors to do useful work, but is certainly a fun thought experiment.

[1]: [https://en.wikipedia.org/wiki/Hypothetical_types_of_biochemi...](https://en.wikipedia.org/wiki/Hypothetical_types_of_biochemistry)

<comment><USER4> Yes, it's possible, just less likely. How much less likely is hard to tell, but I if you hear hoofsteps, you first think of horses, not zebras.

</comment></comment></comment></comment></comment></comment><comment><USER6> I think other lifeforms exist in the universe, but the probability that they live in the same timeframe or that the two lifeforms meet each others is ridiculous

<comment><USER7> Vlad the Astrophysicist

[https://www.youtube.com/watch?v=o9kbcGfX35M](https://www.youtube.com/watch?v=o9kbcGfX35M)

</comment></comment><comment><USER8> I don't understand. They say the observable universe contains 10x more galaxies than previously thought, and the reason for that is the concentration of galaxies being greater in the part of the universe that our telescopes can't see?

<comment><USER9> The Observable Universe is the part of the total universe that we can _theoretically_ observe because electromagnetic radiation from it has had time to reach us. In practice, some of this radiation will be detectable with current technology and some of it will be too faint.

The article is about work, using models of galaxy formation, that tries to better estimate the number of galaxies we can't detect due to limits on telescope sensitivity, but which are nevertheless theoretically observable.

It might be useful to describe the detectable part of the observable universe as the "visible universe", but astronomers have a different meaning for that. See [https://en.wikipedia.org/wiki/Observable_universe](https://en.wikipedia.org/wiki/Observable_universe).

<comment><USER8> Yeah, I understand this now, thanks.

</comment></comment></comment><comment><USER10> Like Carl Sagan rightly said - "Cosmos is also within us. We're made of star stuff. We are a way for the cosmos to know itself." We need to study ourselves more to comprehend this vastness.. [1] [https://www.sciencealert.com/physicists-show-that-our- brains...](https://www.sciencealert.com/physicists-show-that-our-brains-s- learning-is-controlled-by-entropy)

<comment><USER11> "Given enough time hydrogen starts to wonder where it came from and where it is going."

</comment></comment><comment><USER12> From 2012: "But even the XDF is not optimized for finding these galaxies; we'd need an infrared space telescope for that, which is what James Webb is going to be. When that comes around, I wouldn't be surprised to find that there are maybe even close to a trillion galaxies in the observable Universe; we just don't have the tools to find them all yet. In the meantime, our best tool—the Hubble Space Telescope—is showing us that the deeper we look, the more we'll continue to be rewarded with new, faint, and distant galaxies, as well as richer details in the already discovered ones.

"It makes me so impatient for a more powerful telescope with the ability to see far into the infrared, because I can't help but wonder what's still invisible to even the XDF. Twice as many galaxies? Four times? Fainter ones, redder ones, more distant ones, or all of them? There's at least 176 billion of them in our Universe, but I can't help wonder, "how many more?""

[http://blogs.discovermagazine.com/crux/2012/10/10/how- many-g...](http://blogs.discovermagazine.com/crux/2012/10/10/how-many- galaxies-are-there-in-the-universe-the-redder-we-look-the-more-we-see/)

"It boggles the mind that over 90% of the galaxies in the Universe have yet to be studied."

Maybe this one's different, but when discussing astronomical terms, a factor of 10 doesn't ever surprise me. What does surprise me, continuously, is how many unimaginably large numbers of factors of 10 are involved in anything related to the size of the universe. There are so many estimated stars in the universe, it would make little difference to my already boggling mind if our estimates were off by a factor of a million.

</comment><comment><USER13> I wonder if this has some impact in our (mis)understarding of dark- matter/dark-energy, and how the universe expands.

</comment><comment><USER14> Staring into those deep field images sometimes gives me an out-of-body sensation. The vastness of it is so over-the-top.

<comment><USER15> If looking at a few images gives you that sensation, then you should try out the Space Engine (traveling through space in 3D):

[http://spaceengine.org/](http://spaceengine.org/)

A demo:

[https://www.youtube.com/watch?v=ve0Bpmx8Fk0](https://www.youtube.com/watch?v=ve0Bpmx8Fk0)

<comment><USER14> Thanks. I've already played with this and it's awesome.

</comment></comment></comment><comment><USER16> "The Universe is a pretty big place. If it's just us, seems like an awful waste of space."

</comment><comment><USER17> I've seen a lot of posts recently discussing humanity's concept of the size of the cosmos throughout history, but never a timeline of discoveries and the prevailing estimate du jour. I would love to see something like that and Wikipedia doesn't do it justice.

</comment><comment><USER18> Just imagine all the stuff that's not giving off light or anything observable by us at this time. Rogue planets and what not should be everywhere no?

</comment><comment><USER19> ... isn't our error margin much larger than this?

</comment><comment><USER20> Need less dark mass and dark energy then.

...

<comment><USER21> No? The data for the makeup of energy in the universe is mostly from CMB anisotropy (plus various measures of how fast the universe is accelerating, like how much supernovae have been redshifted). Finding out that galaxies in the early universe used to be smaller and more numerous than previously thought doesn't much affect any of that. (there's quite a lot of different data sources now all pointing towards an omega_lambda of 0.7).

To be clear, per the article, the new discovery isn't about the early universe being a significantly different density (i.e. anything other than 'approximately flat', total omega ≈ 1) than the current one. Like, it's not that there was more mass-energy in it that's somehow vanished, rather that it's just distributed between more & smaller galaxies</comment></comment>


Most of what we know about coronavirus will change [es] - <AUTHOR> According to this article, most of what has been published about coronavirus hasn't been peer reviewed. https://m.eldiario.es/sociedad/Paciencia-leas-coronavirus-va-cambiar_0_1008249584.html <comment><USER2> Completely true. A preprint has the same value of a post in Wordpress. It depends a lot on who wrote it. If the author is Terence Tao and it is abut math, it is probably true [https://terrytao.wordpress.com/](https://terrytao.wordpress.com/) All other post must been read carefully.

The value of peer review depends a lot on the journal. There are predatory journals that publish any crap if you pay the fee. And there are serious journals. (And there are some journals in between.)

Anyway, the peer review is not a proof that the paper is correct or that the data is real. It's only a check that the article is minimally inteligible and the result makes a minimal sense. People has published fake data. Some articles are just wrong. (Publishing usually involves a few review suggested by the referees and editors. It is not so easy. But a lot of articles slip through the cracks.)

In a good journal the peer review filter the very bad articles and the bad articles, but there are some articles of dubious quality that has been published. (Some get famous, like the arsenic in bacterias, of cold fusion.)

Most bad preprints and bad articles are just ignored. This part of science is protected by obscurity. The problem is that in this emergencies, any preprint or press release is immediately repeated in all major media, forums, facebook, and whatever other platform is out there. So the bad articles have a lot of diffusion.

> _La importancia del cribado periodístico_

Just assume there is no filtering by the journalism. Many just start the article with "According to a recent scientific study" and then they repeat whatever the article says.

<comment><AUTHOR> However, I find it interesting what they say that in desperate times more papers are being printed or at least taken in consideration since one of them might be the key to unlock the situation.

</comment></comment><comment><USER3> That's not what peer review is for.

Honestly it's no different to normal.

You have to look at who is making the claim and if they can back it up.

And if it's outlandish they really really need to back it up.

Maybe there needs to be more of a barrier of entry or a fee paid or a rating system with punishments.

But that's the same problem as peer review.</comment>


Blank Touch Bar on MacBook Pro - <AUTHOR> http://www.joeldare.com/wiki/mac:blank_touch_bar_on_macbook_pro_late_2016 <comment><AUTHOR> Is it just me or are some of the rest of you having this problem?</comment>


I made a Facebook app to keep track of your reading - <AUTHOR> http://apps.facebook.com/my_reading_list/

<comment><USER2> title.prepend("Show HN: ")</comment>


"Installable Web-Apps". Install apps straight from websites– wouldn't it be nice - <AUTHOR> https://medium.com/@berbaquero/installable-web-apps-b48fdbcf5915

<comment><USER3> That was, at one time, the way it was commonly done.

Now we have the App Store.

My gripe about the App Store, is that were I to publish my iOS App there, then for someone to download it from the App Store would be to promote Apple's business interests far, far more than my own.

No doubt you've all seen "Download it at the App Store" or "Get It A Google Play" graphic links. No doubt many of you use such links to promote your own products. No doubt many of you earn some coin by doing so.

But those links are increasing Apple's and Google's link popularity - <USER2> SEO.

While strictly speaking, your pages on the app stores will have links to your own website. How many referrals do you actually get? How much pagerank do you get as a result?

I'm quite close to finishing Warp Life, an iOS App, but I am hesitant to publish it at all for this specific reason. Really what I might do is to publish only the source code, as well as instructions for installing it on your own device.</comment>