Measuring the overhead of WebAssembly using libsodium - <AUTHOR> https://00f.net/2019/04/09/benchmarking-webassembly-using-libsodium/ <comment><USER2> > An important point here is that the native code does use SIMD > instructions[...]. Whereas the WebAssembly backend doesn't support these.

I understand the reasoning of the author, still it would have been nice to have a comparison with non-SIMD native code for those of us who don't keep track of how much the SIMD buys you these day for crypto.

> On a surprising number of tests, Cranelift's optimizations produced slightly > slower code than with optimizations disabled.

So how much of this result is WASM and how much is Cranelift? By the sound of it, Cranelift doesn't produce very optimal output yet, so should still be potential for significant gains, no?

<comment><USER3> Right now, a lot of it is Cranelift. We haven't yet done much optimization work on Cranelift yet, so there's a lot of room for improvement.

<comment><USER2> Thanks. A factor 2-4x slower than pure native is totally acceptable for many workloads, and it sounds like that's a realistic goal. Exciting times.

</comment></comment></comment><comment><USER4> > The original, native code is extremely fast. Way faster than most > applications need.

Faster than any _one_ application needs. But virtually anything I do nowadays uses crypto on some level, and wasm isn't only proposed to be used for crypto either. Suddenly, my CPU has to do 2x to 7x the work for the same code, because we collectively decided that using electron and web stuff if the way to go for nearly every mainstream application? I don't think so, really.

WASM seems to me like some people are simply longing for the old days of flash. I don't see why I'd want it.

<comment><USER5> > I don't see why I'd want it.

It lets web devs use languages other than JS on the frontend. That's primarily why I'm excited about it.

As for why electron, the only real explanation I've heard from people that makes sense is the ease with which you can put together custom UI controls and style them. All of the desktop UI systems are great at the simple things, like putting default OS controls in an app, but complex things like creating custom controls, animations and complex styling appear extremely difficult to accomplish. At least, that's the way it seems to me.

<comment><USER6> And here I am just wishing for table cells and list views on the web that have functional mouse selection.

<comment><USER7> I'm launching this as part of an app platform soon-ish. If you'd like to beta test get in touch. Virtual tables and lists, with keyboard and shift/command selection modifiers, click and drag to select, edge scrolling, sorting, etc. All with a couple lines of code!

</comment></comment></comment></comment><comment><USER8> The title of the submission is wrong it should be "Benchmarking WebAssembly using libsodium". This isn't about the overhead, it's about comparing native vs. WASM using a concrete example.

</comment><comment><USER9> Every time an article which invites arguments between "native" vs. "web" is posted, this needs to be said:

What we really need to settle this, is a cross-platform UI framework that compiles to native UI and code on each OS/hardware.

<comment><USER10> Sooo... wxWidgets and Qt? :)

[https://www.wxwidgets.org/](https://www.wxwidgets.org/)

[https://www.qt.io/](https://www.qt.io/)

<comment><USER9> If they really do translate to a fully native experience/look-and-feel on each OS, what's keeping them from being more commonly used?

Not a rhetoric question, because the answer is what needs to be fixed.

<comment><USER11> > what's keeping them from being more commonly used?

One of the reasons is the fact that they're written in C++ and not C, therefor difficult to wrap natively by host languages.

At least, that's my main gripe as someone who doesn't want to touch C++.

<comment><USER9> So if they were C, then one would be able to bridge almost "toll-free" with Swift/Objective-C on the Mac, for example.

</comment></comment></comment></comment></comment><comment><USER12> What is disappointing here is that they did not run on Firefox or Chrome. The independent WASM runtimes are not as mature as the browser based ones, so it would be great to see the difference.

</comment><comment><USER13> Would have been nice to include JS benchmarks to get a better perspective.

</comment><comment><USER14> I would like to see the same results with, say, 1,000 trials and 10,000 trials as well—how much of the slowdown is a fixed overhead, and how much of it is that the code runs X-times slower?

</comment><comment><USER15> Is libsoduim written in a low level language like c or did they compile javascript down to webassembly somehow? It wasn't clear from the article. At least my reading of it.

<comment><USER16> libsodium is written in c. "Pure javascript" is a supported compilation target[0] of the project. Emscripten is used to compile the c to javascript. There's also now a wasm compilation target, again via emscripten.

The c source code is really excellent[1]. It's worth browsing!

[0]-[https://github.com/jedisct1/libsodium.js](https://github.com/jedisct1/libsodium.js) [1]-[https://github.com/jedisct1/libsodium/tree/master/src/libsod...](https://github.com/jedisct1/libsodium/tree/master/src/libsodium)</comment></comment>


Experiment closes gap in weather forecasting - <AUTHOR> https://phys.org/news/2019-12-critical-gap-weather.html <comment><USER2> This would clearly be amazing. 25 days is approximately the amount of time needed to do these things:

* Make travel plans

* Grow a head of lettuce

* Schedule and reroof a home

* Ship goods from China to West Coast, USA

Seems unlikely that we'll suddenly leap from murky, mercurial 10 day forecasts to 25 days, but I'm looking forward to when we can.

<comment><USER3> Better planning of power prices and demand response for power grids with a high fraction of weather dependent renewable energy production.

</comment></comment><comment><USER4> I think I found what it is talking about here: [http://wxmaps.org/subx_custom.php](http://wxmaps.org/subx_custom.php)

The UX is... primitive, but it does produce seemingly plausible results for the location I tried.

</comment><comment><USER5> It's not clear from the article what is novel about subx forecasting beyond its time frame and potential applications. Are there other sources that dive deeper into its mechanics and clarify the distinguishing features that would allow it to produce usefully accurate predictions on these more distant futures?

<comment> semi-extrinsic This is the journal paper:

[https://journals.ametsoc.org/doi/10.1175/BAMS-D-18-0270.1](https://journals.ametsoc.org/doi/10.1175/BAMS-D-18-0270.1)

It looks like they are focusing on "sources of predictability", i.e. weather phenomena on sub-seasonal scale that can be observed and then it can be predicted what will happen next.

So the methodology works better in certain areas of the world where well- defined sub-seasonal oscillations in the weather are found.

They have used an ensemble of different models, and have done predictions on several decades of weather data, as well as one year of "live" predictions and comparison to what actually happens.

From what I can tell, it seems like the best predictions can explain ~16% of the observed variation in weather.

</comment></comment><comment><USER6> >weather conditions 3-to-4 weeks out will soon be as readily available as seven-day forecasts

Get ready for a month of pre-hurricaine coverage before every storm.

</comment><comment><USER7> This could be very valuable data for insurance companies and futures markets.

</comment><comment><USER8> I know this might sound like I'm joining the hype train but has there been new AI models for weather forecasting that NOAA uses? If so, how does it compare to the traditional models?

<comment><USER9> I haven't been too close to this recently, but a common technique is called "Model Output Statistics" where the output from these computationally- intensive physical models are fed into another model, trained on historical observations and tuned to your specific risk profile and timeline. These secondary statistical models can be neural nets, or simpler models.

So you're not going to try to teach a CNN about Coriolis forces or boundary- layer mixing physics, but you can teach it that the physical model is more likely to be wrong in this situation, or that the physical model is consistently wrong in your specific location compared to your observations.</comment></comment>


Zerah Colburn (mental calculator) - <AUTHOR> https://en.wikipedia.org/wiki/Zerah_Colburn_(mental_calculator) <comment><USER2> "In September 1813 Colburn was being exhibited in Dublin. Colburn was pitted against the 8-year-old William Rowan Hamilton in a mental arithmetic contest, with Colburn emerging the clear victor. In reaction to his defeat, Hamilton dedicated less time to studying languages and more time to studying mathematics."

This is the same Hamilton that brought amazing contributions to physics and algebra. I didn't realize Hamilton was also a child prodigy, although it isn't surprising.

</comment><comment><USER3> "solve such problems as the number of seconds in 2,000 years" \- I'm not sure if I can do that correctly, even with a calculator.

What about leap years and leap seconds?

[https://infiniteundo.com/post/25326999628/falsehoods- program...](https://infiniteundo.com/post/25326999628/falsehoods-programmers- believe-about-time)

<comment><USER4> Leap seconds didn't exist then.

Leap years (looking forward) run on a 400 year cycle, and 400 divides 2000

<comment><USER3> Which 2000-year period? Do you mean from the year 0 to 2000, or 20 to 2020, or 1600 to 3600?

The Gregorian calendar wasn't standardised until 1582.</comment></comment></comment>


Coast Guard video of the moment the plane "landed" on the Hudson. - <AUTHOR> http://news.bbc.co.uk/2/hi/video_and_audio/default.stm

<comment><USER2> permalink: <http://news.bbc.co.uk/2/hi/americas/7835762.stm>

<comment><AUTHOR> Thank you - I forgot to do that.</comment></comment>


Apple Admits iTunes Download Cloud Error, Restricting Some Content Downloads - <AUTHOR> http://www.techieapps.com/apple-admits-itunes-download-cloud-error-restricting-some-content-downloads/ If you have been stuck with your Apple TV displaying an error message, each time you try to play iTunes, each time you try to play iTunes in the cloud content, for instance your latest favorite TV show etc, you must know that you are not the only one who has been left stranded. <comment><USER2> That seems to be an inaccurate title, on the account of a misplaced comma: "Apple Admits iTunes Download Cloud Error, Restricting Some Content Downloads" seems to mean "Apple admits that there is an error, _and in response_ is restricting downloads"; you probably meant "Apple Admits iTunes Download Cloud Error Restricting Some Content Downloads" - "Apple admits there is an error _which_ is the cause of restricting downloads".

The story itself is interesting, though.</comment>


Ask HN: What are topics that you want to learn but haven't gotten around to? - <AUTHOR> <comment><USER2> Haskell. I can only do simple things and need to understand more jargon.

Category Theory. I'm actually fixing this right now doing an online course.

3d modelling. Haven't gotten started. Really want to learn it.

Rust / Clojurescript. I've started several times but not really been invested enough in the projects I think up to get very far.

Swimming. I am also starting to make progress here.

Handstand. I have the strength and flexibility but need better technique.

Spanish. I understand when I listen but haven't learned how to speak, need to move to a latin country.

Eye contact. I can do it with some people but with others (people who feel insecure) I empathize too much and break eye contact and start talking to the sky.

Sperm retention. I want to be able to control my ejaculation, I've practiced a little but it's quite hard.

<comment><USER3> What online course are you doing for category theory?

</comment></comment><comment><USER4> Category Theory (and more advanced Set Theory). After taking an undergraduate Set Theory course I want to explore these areas of mathematics further. I'm currently going though Thomas Jech's "Set Theory" on the Set Theory side, but haven't yet found a good, undergraduate accessible, Category Theory text.

<comment><USER5> You should check out "Conceptual mathematics" and then "sets for mathematics", both written by lawvere. They are the amazing

</comment></comment><comment><USER6> A front-end JS framework. Every time I look in to it there's 328 new ones and 5,149 reasons not to use the old one.

<comment><USER7> React? There seems to be a consensus forming that it's the best. You can get started really quickly with create-react-app

<comment><USER8> Even if you don't end up using React itself, alot of libraries are similar in concept. By learning one you can gain the concepts to use many. For example vue.js is really easy to pick up if you already know react.

</comment></comment></comment><comment><USER9> In no particular order:

\- A deep and real understanding of the blockchain.

\- Clojure. I've heard that it is not only fun, but changes the way you approach programming in general. I don't have any professional need for it, though.

\- Truly understanding how neural networks work.

\- Rust, although this is similar to Clojure above; I don't know what I'd actually use it for.

<comment><USER10> > \- Rust, although this is similar to Clojure above; I don't know what I'd > actually use it for.

Not for network applications. It's nearly impossible to make async tcp server right now. But it's promising language. So let it mature.

</comment></comment><comment><USER11> \- elixir pheonix (waiting for the 1.3+ book)

\- C (I have the modern C book, just need to do it. My end goal is to get a PR into the linux kernel)

\- SICP + lisp

\- basic design, so I can have some idea of where to put things/page structure

I keep track this kind of stuff in a trello list. I have a lot in the ToDo column

</comment><comment><USER12> For anyone looking for something to learn, I'd heavily recommend Haskell. It's been an eye opener for me.

<comment><USER13> In what ways did it open your eyes?

</comment></comment><comment><USER14> Mh, there's a bunch of things, but not enough time.

I might want to look at some modern C++ style, but it's tricky to figure out a year to land on, and it's tricky to find a good book. This could be interesting for some gaming projects or simulation projects of mine.

I might want to look at salt/ansible from a professional perspective. I'm a chef guy, but it'd be good to know some of the other tools around. This is mostly a case of lazy and lack of personal project. Containers and orchestration systems as well, but that's planned at work.

Beyond that, electronics and model building. I've gotten myself some lego, an arduino, but I'll need to work more on that to do ... things. I dunno. Make my lego crane automatically pick up bright pink blocks or something. From there, I'd probably venture further into model building, like ships or planes. Or Nerf-Tanks. it sounds really useful to me to have a good basic grasp of low- voltage electronics, and how you'd wire up a home or how you'd fix simple electronic devices. It's something I'd be missing if I was supposed to build my own home from scratch.

And beyond that - but I really want to get going there this summer - get and learn to paddle a folding canoe. I need to work on my work-life balance, and paddling a canoe is a great thing to just ignore the world. It's hard to think about binary deployments if there is a duck racing you.

</comment><comment><USER15> \- Better theories of social interaction patterns online. I don't even know if that body of knowledge is out there outside of facebook/google, but i wish I had a better concrete understanding of how people interact online.

\- Off-the-beaten-path interface design. UI design seems to have converged around a set of principles that are generally pretty sound, but seem to have been optimized for looking good in demos but lead to underwhelming user experiences.

</comment><comment><USER16> Maths, properly.

<comment><USER5> There is no such thing

<comment><USER17> Care to explain?

<comment><USER5> I take properly to mean a structured approach to full understanding. However, the totality of math is beyond any single person. There are multiple approaches that all drift of in to different directions.

In short. There is no final Aha moment for maths at large. There are however a shit load of specific aha moments down the path

</comment></comment></comment></comment><comment><USER18> I'd really like to get into hobby electronics, specifically DIY guitar pedal design.

There's a great subreddit, /r/diypedals, which I've been lurking for a while, I just haven't made the dive into buying my first kit and soldering equipment. Does anyone here on HN have any tips or words of wisdom?

<comment><USER19> I highly suggest spending a few extra dollars to get a nice digital soldering iron w/replaceable tips.

Here is the standard that everyone gets, but sometimes there are deals on other ones: [https://www.amazon.com/Hakko-FX888D-23BY-Digital- Soldering-S...](https://www.amazon.com/Hakko-FX888D-23BY-Digital-Soldering- Station/dp/B00ANZRT4M/ref=sr_1_5?ie=UTF8&qid=1525277784&sr=8-5&keywords=digital+soldering+iron)

</comment></comment><comment><USER20> For me all I can think of when asked this question is all the topics I wish I could learn/study that are not specifically software / programming / information technology related.

Wood frame construction, new ways to run organizations (e.g. Holocracy etc.), how to build solar power systems, how water purification systems work (e.g. Hydrolysis or reverse osmosis), cooking and baking... so many more.

And, probably Tensorflow/Keras, Kubernetes, Angular, VR and maybe a deeper dive into Apache Spark. I didn't really ever get into blockchain. But lately I don't feel as motivated about the latest technology fad. Which is surprising even to me!

Original poster, why do you ask?

</comment><comment><USER21> Russian, better; I've been through the Duolingo course many times over now. I like it's teaching style, but it ends too soon, and I'm struggling to find good learning resources to advance to a higher level.

More mathematics, particularly more degree-level analysis and geometry. It's the area that interests me most, and I feel I missed out on it doing a computer science degree. I'd also like to understand elliptic curve crypto.

Not really a "topic", but I've wanted to get around to learning piano for a while now.

</comment><comment><USER22> On the "Things I Want To Learn But Rarely Get Around To™" list there is Rust and to a lesser degree, Elm (although I am starting to worry about rumblings of dissatisfaction in how Elm is being managed).

I'm also been reading a bit about Event Sourcing application design. I want to play with it, but it seems like I have to get my head around CQRS and Domain- driven design as part of the process...

</comment><comment><USER23> In the general sense, I've found that the best way to learn a new skill is to find an application that you are really interested in. This switches the goal from learning something to doing something interesting/fun. It is this motivation of wanting to use the end result that will sustain you through the grind of learning the skill.

</comment><comment><USER24> Embedded systems, compiler design, Rust, GraphQL. There are too many things I want to learn...

<comment><USER25> Why not Deeo Learning?

<comment><USER24> not very interested

</comment></comment></comment><comment><USER26> I'm totally fine with it, but this post looks a lot like market research to me!

</comment><comment><USER27> A second and third language.

</comment><comment><USER28> In no particular order: 1\. Add Python programming to my arsenal of programming languages. 2\. Project and People management 3\. Data Structures

</comment><comment><USER29> Quantum mechanics. I should have studied it better when I was at university and my math was fresher :)

</comment><comment><USER30> The complete lifecycle of the code I write. I don't delve deeper than breakpoints 99% of the time

</comment><comment><USER31> Control Systems, DSP, RF design

<comment><USER32> Getting into amateur radio is a good way to pursue these activities. GNURadio is popular and well-supported for software-defined-radio systems, and hardware can be a cheap as $10.

If you're talking about kinematic control systems, building a quadcopter or RC plane may be worthwhile. There are tons of self-balancing arduino-powered things out there too.

</comment></comment><comment><USER33> Probability + Undergrad statistics interpretations. Never feel confident.

</comment><comment><USER34> Undergrad-level topology, at least enough to understand what a sheaf is.

</comment><comment><USER10> 3D modeling in Blender3D

<comment><USER35> I started doing this recently, but I want to use a laptop. Blender seems better suited to a full size keyboard and proper mouse. Does anyone use it with a laptop keyboard and trackpad?

<comment><USER23> I would say that in the abstract, if this is a skill you want to learn, don't let the specific tool choices get in the way of the education. Give yourself every opportunity for success, by choosing the recommended tools, as you can afford them. A better way to think of good tools is that they get all of the bullshit out of your way so you can work at maximum efficiency. Thus, until you actually learn the skill, trying to impose your own preconceived notions of the right tools for the job is complete guesswork.

Once you understand the basic logistics, then you are positioned to judge specific characteristics of your tools, and make educated decisions about which accentuate your craft, and which cause you endless grief to just perform their basic tasks.

<comment><USER10> Blender heavily relies on numpad keys and middle mouse button so there is small "hardware" problem to use it on laptops

</comment></comment></comment></comment><comment><USER5> Natural language processing

</comment><comment><USER36> Reinforcement learning

<comment><USER19> OpenAI is throwing a RL (and Transfer Learning) contest right now, I am using it as an opportunity to learn and re-implement the current best RL stuff. [https://contest.openai.com/](https://contest.openai.com/)

If you end up joining the contest, shoot me a message on the discord, I would love to chat about RL (I am `lyons` on the discord).

</comment></comment><comment><USER37> Game theory topics

</comment><comment><USER38> Not blockchain</comment>


The Earn IT Bill Is the Government's Plan to Scan Every Message Online - <AUTHOR> https://www.eff.org/deeplinks/2020/03/earn-it-bill-governments-not-so-secret-plan-scan-every-message-online <comment><USER2> [https://www.congress.gov/bill/116th-congress/senate- bill/339...](https://www.congress.gov/bill/116th-congress/senate- bill/3398?q=%7B%22search%22%3A%5B%22EARN+IT%22%5D%7D&s=1&r=1)</comment>


FedEx feeder plane takes flight without pilot in test for Reliable Robotics - <AUTHOR> https://www.commercialappeal.com/story/money/industries/logistics/2020/08/28/fedex-plane-autonomous-flight-reliable-robotics/5655258002/ <comment><USER2> If FedEx and Amazon set up private airports dedicated to these machines, only put cargo in them, and make their flight routes distinct from other aircraft, I imagine this could be up and running faster than people think.

Edge cases shouldn't result in loss of life, so getting through regulations and insuring should be much easier than other situations.

<comment><USER3> If the system is designed right, they could be even safer than piloted planes in the case of an emergency. Currently, if a pilot is flying and, say, the engines stop and can't be restarted, they're going to be thinking about trying to survive and get to a place where they can land or at least ditch the plane survivably.

An autonomous system doesn't have to do that - if it decides that the situation is unrecoverable, it can spend its remaining time in the air finding and navigating to the most sparsely populated point of impact within its range. Something like "Engines out and won't restart? Find the nearest/largest body of water and ditch into it".

<comment><USER4> This is a great take.

The more we reduce the human survival instinct around these jobs, the better we'll all be.

Humans do dumb shit when we're flooded with chemicals, both internal and external.

<comment><USER5> Computers do some pretty "dumb shit" when they're flooded with data and running bad algorithms. I mean 737MAX didn't need a pilot error in order to do something critically bad.

<comment><USER6> To be fair.. the computer in the 737max was being used to patch over the 737max being bad at flying.

</comment></comment></comment></comment></comment><comment><USER7> We're hiring!

[https://reliable.co/careers/](https://reliable.co/careers/)

We built avionics, software, mechanisms and a comm system that enables automated operation of the plane from a remote command station. The remote operator has a GUI where they can command the aircraft.

This article goes into a bit more detail about how it works: [https://www.flightglobal.com/airframers/with-tesla-and- space...](https://www.flightglobal.com/airframers/with-tesla-and-spacex- credentials-start-up-flies-pilotless-caravan/139905.article)

<comment><USER8> What I haven't seen is any mention of what happens to all the pilots out there. Between COVID and now this, it seems like the path of a great middle/upper middle class job that's lasted for decades is doomed. For UPS/Fedex, I would also guess that the salary of the pilot is effectively a rounding error on all of the total costs of transporting objects around the world.

What are your thoughts on this?

<comment><USER9> I think it's unfair to ask a technology startup to answer a public policy question. Economic forces will drive automation of these sorts of tasks one way or another, which will shift income away from labour and towards capital.

It's up to governments to ensure the winners compensate the losers. In the long term, this may be an UBI, but for now it should take the form of retraining and economic adjustment packages (similar to what might occur when tariffs are repealed). This should be funded by a super-profits tax on heavily automated industries.

<comment><USER8> We all are responsible for our actions on the world. The government doesn't set policy that says pilots should be automated, and I wouldn't necessarily assume this is inevitable at all. Government can only be reactionary, and these things are happening without a larger societal conversation that says yes we want this. So I do believe this is a fair question to ask. It would be unethical to not consider ones actions.

<comment><USER10> One must also consider the ethics of wasting human life and skill on something that can be efficiently automated while other tasks lie undone.

Either way I agree with the parent comment, this is a public policy question about how to make sure people are able to maintain lucrative lives (education policy, monetary policy, social policy) not a question for the business making an existing task more efficient and expecting them to answer what society wants to do with the freed time.

</comment></comment></comment></comment></comment><comment><USER11> Frankly the tech for autonomous aviation has been around for a while now. I expect even strong crosswind landings will soon be better handled by a computer than a pilot. But then here's the problem...

Autonomous systems are great when things are going well, but at the end of the day they fare very poorly in edge cases sometimes with catastrophic results. When you're driving a car you usually follow traffic rules and stop lights to get to your destination safely. In an airplane there's constant communication and things change frequently based on weather, traffic, emergencies, etc. I can't count the number of times ATC has repeated back an incorrect call sign. As a human we know it was probably meant for us and call back to confirm. Would a computer do that? Even if we used datalink communications then ATC would now have a much higher burden. Also human pilots would lose the situational awareness of hearing instructions for other aircraft on frequency.

Then there's the question of— in an emergency situation is the computer going to be able to make the right judgement calls? What if its sensors are iced over/inop?

All in all, while technologically I feel this could have been pulled off yesterday, I doubt we will see fully autonomous aircraft operating long routes in controlled airspace anytime soon.

<comment><USER12> Along these lines, would an autopilot ever think of landing in the Hudson? (Particularly if it hadn't been done before?)

<comment><USER13> Devil's advocate: Would a human pilot be skilled and lucky enough to pull this off a second time?

<comment><USER14> IMO, the critical thing the human crew did in US1549 was the _decision_ to take the Hudson; once they decided that, most crews could pull off the execution of that decision. (Then the presence/absence of boat traffic comes down to luck.)

<comment><USER15> > once they decided that, most crews could pull off the execution of that > decision

That's not correct. Ditching is very hard. Mess up your angle or sink rate or roll even slightly and you'll be in pieces. Same if the water doesn't cooperate.

One interesting thing is that it happened with an Airbus. The flight computers actually modified Sully's inputs on pitch by about 2 degrees, which ensured a softer splashdown than what Sully was commanding.

But that was a very subtle adjustment. Sully was an experienced pilot, with Glider training too.

</comment></comment></comment></comment></comment><comment><USER16> My understanding was that the autonomous part is not really the barrier at this point. After all, military drones fly around the world already (for 10 years) and there are strong analogues in civilian flight/aircraft.

The problem is "airspace integration", i.e. how does an unmanned aircraft communicate with other pilots, ground, etc. and what are the rules (right of way, visual separation, etc) with planes in lower classes of airspace.

That problem has also been around for 10 years, and I would say nearly no progress has been made on that front.

If there were progress on that (some kind of regulatory solution/certainty), it would unlock a whole lot of activity here.

</comment><comment> java-man It's only a matter of time.

However, how will the robotic plances integrate with existing voice-based air traffic control? Would there be a new digital channel, or the planes would it use an on-board voice recognition and synthesizer?

<comment><USER17> If I was doing this I would start with remotely "piloting" (sending instructions to) them and having the remote pilot communicate with ATC via the traditional radio channel.

<comment> java-man Right, but that requires a fairly reliable radio link (that we don't have, e.g. MH370).

Or perhaps a set of dedicated routes, with ATC actively routing other traffic around the robots?

<comment><USER17> So get one. Partner with SpaceX or oneweb and plot courses only where you will have continuous connectivity.

We pilot drones in warzones remotely, the technology exists to pilot then in peace time.

<comment><USER18> > We pilot drones in warzones remotely,

True but we also are ok with those drones getting destroyed.

</comment></comment></comment></comment></comment><comment><USER19> Big congrats to my former SpaceX colleagues! Well done!

</comment><comment><USER20> Very cool! I wonder what the real economic benefit of removing a pilot from an airplane is, and what the dominant factors are? Assuming that a human pilot is better in some emergency scenarios, and might be able to save you from catastrophic loss: these events are exceedingly rare nowadays, and the savings from liability and scheduling constraints must be massive without a human in the pilot seat.

<comment><USER21> CEO of Xwing, the other company developing technology in this space here.

[https://www.youtube.com/watch?v=IDhkwHkBKWo](https://www.youtube.com/watch?v=IDhkwHkBKWo)

Feeder aircraft suffer from poor pilot / aircraft utilization. Once you go with remote operators you can increase operator utilization significantly. A computer can also fly the aircraft much more efficiently than a human can allowing for significant fuel savings. Other benefits include lifting of crew rest time requirements and improved dispatch rates. Some of this allows for better asset utilization. Finally, you can also re-balance a fleet across geographies more easily to address shifting demand.

<comment><USER20> Great answer, thank you very much :)

</comment></comment></comment><comment><USER22> Who do people think will have their jobs replaced first, cargo pilots or truck drivers?

One big factor is it often comes down to which worker group has a stronger union and likewise entrenched political interests at local levels, as we've seen in technological progress elsewhere.

Second to that is probably the safety regulatory process. 'AI' or computer automation has also been used heavily in airplanes for a long time so that regulatory process is probably going to happen much more advanced than cars.

Finally, driving regulations often happen at a much more local level (cities can ban AI drivers in their borders for ex) but flights are divided over much wider geographical lines. And there are far fewer airline companies than truck companies to deal with.

<comment><USER23> The "cost of the pilot" / "cost of the operation" metric gives us this order: urban transportation, inter-city ground transportation, air transportation, water transportation.

The difficulty of automating it metric gives us this order: air transportation, water transportation, inter-city ground transportation, urban transportation.

So I'm personally expecting a mix: air transportation, inter-city ground transportation, water transportation, urban transportation.

<comment><USER24> Why do you believe that water transportation would be harder to automate than air transportation?

<comment><USER23> There is more "noise" to deal with on the water than on the air. For a start, there is the entire ocean floor, that is relevant on many places where ships usually go into, and isn't as simple to map as a runway.

<comment><USER24> That problem can be avoided in the beginning. Ships could pilot themselves in deep waters between ports and leave docking / undocking to local human port pilots.

</comment></comment></comment></comment></comment><comment><USER25> There needs to be a pollution (including noise) tax collected to counterweight the inevitable of potentially non-stop swarm of buzzing that will be making 10,000s to 100,000s of deliveries in cities everyday.

<comment><USER26> This is a cargo plane, not a buzzy quadcopter drone. They already fly these routes; they just use human pilots to do so.

<comment><USER27> And they're already loud. If they proliferate, whether human operated or autonomous, the noise will increase.

+1 vote for heavily regulating noise pollution.

<comment><USER26> Noise pollution from airports _is_ regulated. Many airports have departure patterns that avoid areas sensitive to noise.

Drones are going to need similar regulation, I agree.

<comment><USER28> Shout out SNA, which has a spectacular departure flight path to ensure compliance with back bay NIMBYS who showed up after the airport was already built.

</comment></comment></comment></comment></comment><comment><USER29> As a mid-thirties airline pilot, these articles make me wonder if I should re- skill now or ride it out.

<comment><USER30> It will take long for this to change the industry and there are a lot of planes that will be flown manually for decades to come. But obviously it doesn't hurt to have a plan B.

I actually expect that short term there will be an increased demand for pilots as smaller electrical airplanes start becoming more popular. Most of these will be single pilot operations doing short hops. If there are going to be lots of them, there will be a need for lots of pilots too. This too will ramp up over a few decades and eventually that whole business will be autonomous. But not short term.

</comment></comment><comment><USER29> In response to such events, pilots often write confident yet misinformed sounding articles such as this - [https://liveandletsfly.com/airline- automation/](https://liveandletsfly.com/airline-automation/)

</comment><comment><USER31> Autonomous flight is a great example of the 80/20 rule. We've basically had "self flying" airplanes for decades, but to get them to 100% autonomous we need to spend all of the extra engineering effort into covering the remaining edge-cases + landing.

<comment><USER32> this statement belies a lack of understanding of just how long autoland has existed. Guess which decade autoland was invented... and what decade commercial service flights began making fully autonomous landings...

(you're probably wrong)

[https://en.wikipedia.org/wiki/Autoland#Civil_aviation](https://en.wikipedia.org/wiki/Autoland#Civil_aviation)

It is not, on the whole, that difficult a problem to actually land an aircraft autonomously. Now that planes can autonomously fly the rest of the route too, it makes sense to just take the pilot out of the cockpit.

<comment><USER15> > It is not, on the whole, that difficult a problem to actually land an > aircraft autonomously.

Sure, if you have ILS and it's operational.

Large aircraft will not rely on GPS.

It's a far more difficult problem to integrate such aircraft among the existing traffic. You are underestimating the effort of autonomous flight gate to gate.

</comment></comment></comment><comment><USER33> Can anyone put this in context as a technical achievement? Hasn't pilotless takeoff and landing been demonstrated before?

</comment><comment><USER34> The future value of another career formerly recommended by high school guidance counselors is eliminated.</comment>


Soylent Raises $20M - <AUTHOR> http://robrhinehart.com/?p=1192

<comment><USER2> I just wish they would do a low-carb version. I tried soylent for a couple of weeks and had my annual physical and my blood sugar level was much higher than it has been in the past. So much so that my doctor asked me what I had been doing and what I was eating. He said I was now suddenly "pre-diabetic." I stopped soylent immediately.

As a side note, I now have four boxes of soylent for sale if anyone wants them... :)

<comment><USER3> If you have special nutritional needs, why not try diysoylent? You don't have to spend much time or effort into it, and it ends up being much cheaper.

[http://diy.soylent.me/](http://diy.soylent.me/)

<comment><USER2> Well, the whole point for me was that it's quick and easy. I don't want to make my own. I want to open the bag, shake, and go :)

</comment></comment></comment><comment><USER4> > food focused on function, simplicity, and transparency

I am able to get all of my daily vitamins, minerals, etc from three things: 1.5 cups peanuts, 5 cups broccoli, 3 cups milk. Andreessen Horowitz, my contact info is on my profile.</comment>


Wardrobe Unveils New Peer-To-Peer Digital Marketplace for Fashion Rentals - <AUTHOR> https://www.pressreader.com/usa/wwd-digital-daily/20181214/281603831560292 <comment><USER2> Wardrobe is awesome because it allows you to rent one-of-a-kind items directly from other people like you. The cleaners pick-up process is seamless too. Sure Rent the Runway is in this market but it's super expensive and ordinary stuff that you can get anywhere. It's much better when you can actually know the story behind an item.

</comment><comment><USER3> I'm all for the sharing economy, but I'm not sure if I'd want to put someone else's clothes on my skin. Then again... I do thrift shop. Sounds like a good way to slow fashion pollution, while making a profit - to then spend the income made on rentals. (hair flip emoji.)

</comment><comment><USER4> Seems to tackle the same market as Rent the Runway, but with much more interesting tech background and on the ground operations.

</comment><comment><USER5> Very interesting concept, so is this like an AirBnB for clothes?

<comment><USER6> Job opening for competitor:

[https://angel.co/stylelend/jobs/466268-ceo-co- founder](https://angel.co/stylelend/jobs/466268-ceo-co-founder)</comment></comment>


Amazon's press-to-order Dash buttons are officially discontinued - <AUTHOR> https://www.theverge.com/2019/2/28/18245315/amazon-dash-buttons-discontinued <comment><USER2> Get as many as you can while you can - they're the cheapest IoT buttons on the market currently

<comment><USER3> Can you "root" them to do your bidding?

<comment><USER2> Yes absolutely, the official AWS IoT button is 22GBP, I bought my dash buttons 99p each on Amazon and use them as regular IoT buttons (by monitoring network and catching when they do a curl request).

</comment></comment></comment><comment><USER4> That sucks. Alexa may be a replacement for those who don't mind surveillance in their homes, but the dash button was perfect for making sure the office kitchen never runs out of paper towels.</comment>


LastPass bug leaks credentials from previous site - <AUTHOR> https://www.zdnet.com/article/lastpass-bug-leaks-credentials-from-previous-site/ <comment><USER2> Switched to BitWarden a few months ago from _years_ of using LastPass. Zero regrets... it is in every way better for my use case. Switching wasn't hard either. Even gave BW my money, it is worth supporting them.

<comment><USER3> I'm avoiding the browser extensions, they seem to be a security nightmare. KeePass and similar are a better way to go, if slightly more labor intensive.

<comment><USER4> > KeePass and similar are a better way to go, if slightly more labor > intensive.

Slightly? Just thinking about the synchronization between machines makes this an understatement in my opinion.

<comment><USER5> I store the keepass file in a cloud sync service. The file is encrypted.

The keepass application can perform "auto-type" which works for all sensible applications and websites that have username/password input fields and a log- in button.

Recently, more and more websites split the log-in into two screens, first email and then password. This completely breaks auto-type and is horrible in every way. Please don't do it.

<comment><USER4> This works if your environment allows a) installing applications and b) cloud sync using consumer clouds (dropbox, gdrive, etc

You are right that this is a good approach for many it will certainly break for many as well.

<comment><USER6> > This works if your environment allows a) installing applications and b) > cloud sync using consumer clouds (dropbox, gdrive, etc

Re a) [https://keeweb.info/](https://keeweb.info/) toss this onto any ol' free tier web host you want. No app install necessary. It's not as nice as the apps, but it works.

Re b) Is there an environment that both has a web browser that you want password management with _and_ doesn't let you access any consumer cloud sync service?

<comment><USER4> There sure is. Most big companies work that way I would imagine. I can install browser extensions, no problem but local apps are restricted. Also Dropbox and others are blocked at the corporate firewall level.

<comment><USER7> Surely in such a place, blocking all that access means they care about security and therefore provide you with a password management solution that you also have no choice over.

I mean, installing browser extensions to deliberately get around their security measures seems a little bit counterproductive. They aren't more secure than local apps. Do you take this company's security measures seriously or is it just some hurdle to get around for you?

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER8> The bug report says:

        by iframing popupfilltab.html (i.e. via moz-extension,
        ms-browser-extension, chrome-extension, etc). It's a
        valid web_accessible_resource.
        [...]
        y.src="chrome-extension://hdokiejnpimakedhajhdlcegeplioahd/popupfilltab.html";
        // or y.src="moz-extension://...";

My understanding is that this should not work with the Firefox version of LastPass, since each installation of the extension is given a unique id which can't be guessed by web pages -- that is unless the unique id is made visible to web pages by the extension itself.

<comment><USER9> I have not read the article in detail, but earlier news stories I've seen said that not all platforms were effected. Chrome and I believe Opera were mentioned, but not firefox.

</comment></comment><comment><USER10> It's interesting to note that browser extensions continue to be the primary point of vulnerability for password management solutions. IIRC, it's been quite a long time since vaults themselves were breached.

It is an undeniably more secure option to use password managers without their associated extensions. Certainly less convenient, but ponder carefully your threat model.

<comment><USER11> Unfortunately the browsers persist in not providing the necessary APIs to allow the password managers to work safely.

The Mozilla bug (1344788) has been open for three years with no meaningful action in 2. It's been stuck waiting for security review, with nobody empowered to do it.

</comment></comment><comment><USER12> They listed it as "Security: Minor bug fixes" in their release notes (v4.33.0, [https://lastpass.com/upgrade.php?fromwebsite=1&releasenotes=...](https://lastpass.com/upgrade.php?fromwebsite=1&releasenotes=1))

Leakage of credentials seems like more than a "minor" bug - particularly for software whose whole purpose is to securely store those credentials.

<comment><USER13> well, users already leave passwords in the clipboard as normal usage...

</comment></comment><comment><USER14> This is one reason why I believe that browser based password managers are flawed. I've written about this in the past (link below). These apps are popular with normal people (due to convenience), but long-term, we should not trust web browsers plugins or add-ons as password managers.

[https://github.com/w8rbt/dpg#why-traditional-password- manage...](https://github.com/w8rbt/dpg#why-traditional-password-managers-are- flawed)

<comment><USER15> While in browser password managers have drawbacks, they have the big advantage that they stop fishing / fake domain attacks. I think I'm much mor likely to fall for one of those, than my password manager get hacked.

Also, generating all passwords off one master password deterministicly sounds like an awful, awful idea. If someone manages to get one of my passwords, they can try performing an offline attack against the encoding password. If they succeed, they have everything.

<comment><USER14> It's 2^15 rounds of pbkdf2 with long inputs. There is no master password as nothing is stored. Good luck.

</comment></comment></comment><comment><USER16> Classic LastPass. Shoddiest pw manager out there with history of editing wiki pages to hide their sad track record.

<comment><USER17> Interested in this. Got a link?

<comment><USER16> I've described it here: [https://news.ycombinator.com/item?id=15756044](https://news.ycombinator.com/item?id=15756044)

</comment></comment></comment><comment><USER18> Is that true about LastPass being the most popular password manager?

I just can't imagine it, I'm forced to use it with a client, and it has hands down the worst UI experience I've ever seen.

<comment><USER19> Long time last pass user...what do you recommend?

Team of 15-30 people, need shared username/password credentials for web, FTP, and DB systems. Also other arbitrary secure "notes", e.g. SSH key. Needs 2FA as well.

<comment><USER20> 1Password is quite nice. Migrated a team from LastPass to 1Password recently, the experience was very smooth.

</comment></comment></comment><comment> a-ve I quit LastPass when they were acquired by LogmeIn and doubled their prices to $24 a year, and their constant issues with autofill (atleast for websites in my country).

I switched to Bitwarden and haven't faced an issue since.

<comment><USER21> Even worse, before it was just 12$ and now it is 24$ before taxes so you end up paying 29,52$. A 246% increase.

<comment><USER22> People are really complaining about this, but honestly the features I get from the product absolutely justify paying $2/month. I'd probably pay $3-4 before it wouldn't become worth it for me

<comment><USER23> For me they have tripled the price since I first subscribed and the bugs aren't getting fixed.

I'm tired of the fill problems on iOS and Firefox and the price increases compound my irritation.

</comment></comment></comment></comment><comment><USER24> Was prepared to change all my darn credentials when clicking on that. For those clicking the comments first, the byline is: "LastPass has released a fix last week. Vulnerability details are now public. Users advised to update."

<comment><USER25> For something that has such a long trail of vulnerabilities, I don't recommend LastPass to family friends and business associates. Use 1Password instead, or pass.

Just one example (this one from 2017) of many: [https://bugs.chromium.org/p/project- zero/issues/detail?id=12...](https://bugs.chromium.org/p/project- zero/issues/detail?id=1225). Fundamental architectural flaws.

For more HN references, see [https://hn.algolia.com/?dateRange=all&page=0&prefix=false&qu...](https://hn.algolia.com/?dateRange=all&page=0&prefix=false&query=lastpass%20vulnerability&sort=byDate&type=story)

<comment><USER26> Tavis Ormandy, who discovered the latest and several other Lastpass bugs, has these password manager recommendations:

"KeePass and KeePassX are both good choices. If you really must use an online one, at least LastPass are responsive to researchers and have a competent security team, I would use them."

Asked about the experience he had reporting a 1Password vulnerability, he says:

"Astonishingly bad"

(source: [https://twitter.com/taviso/status/1167311357957435392](https://twitter.com/taviso/status/1167311357957435392))

</comment></comment></comment><comment><USER27> I have been using enpass, and I'm very satisfied. I was a LastPass user once, but never trusted their security model. Then switched to 1password, but the lack of good multiplatform support and their push to a cloud model made me look for alternatives. What I want is support for Mac, Windows, Linux, and Android; possibly one time payment; and local storage (most important). For syncing I use my own nextpass cloud. Bitwarden is close, but enpass fullfills all.

<comment><USER28> I'm still using non-cloud 1password but I cant recommend it to anyone else or my employees because of the forced cloud thing

<comment><USER29> FYI, 1Password doesn't force you to use their cloud service. Even if you subscribe (as opposed to standalone), you still don't have to actually use it. I switched from an older standalone version to the current subscription version, but I'm not using their cloud service to sync my vault.

<comment><USER30> Can you point me to some documentation that describes how to get rid of the subscription cloud service? I just want a one time fee to purchase 1P and then I want to just iCloud sync my 1P vaults.

</comment></comment></comment></comment><comment><USER31> I've been very disappointed with LastPass in the past year or so. I've had multiple instances where it doesn't actually save a password or secure note that I tried to save. This has caused me a lot of stress the few times it happened, including one login permanently.

Sadly I paid for a 10 year plan and have 4 years to go. Saved me some money, but for what product? I use 1Password for work, and it is MUCH better than LastPass.

</comment><comment><USER32> I am seriously considering alternatives to LastPass.

Since they moved to a dedicated app instead of just a plugin on Mac, it is borderline unusable for me.

Almost never actually fills in my passwords (often have to click copy password), often thinks I am on a different website than I am, or just gives me an empty white box when I click the LastPass button.

<comment><USER33> While it's definitely more work to setup, I've been using KeePassXC + NextCloud for syncing. I've got it working on my phone with keepass2android (think that's the name) and also use a yubikey challenge-response key to help ensure that even with a bad password i've got decent protection of my passwords. There's browser extensions for basically every browser out there, and it even supports auto-typing into non-browser based applications (though I can't say I use that feature myself).

<comment><USER34> I've been using something very similar, though I only have a local keyfile that I independently put on my synced machines rather than the yubikey thing. How do you like the yubikey process? Not too much of a pain?

<comment><USER33> Not much of an issue at all, it does mean that when i need to unlock my manager or save the database, i have to have my [physical] keys around but it's otherwise not an issue. I've got two duplicated yubikeys for it, a neo with nfc and a 5 with usb-c. I generally use the neo for everything but needed the usb-c one for laptops with no USB-A ports and my tablet which also has no USB-A or NFC. Just the march of progress.

They get used by KeePassXC in yubico challenge-response mode, which I believe works as follows, take the HMAC(KDF(password), nonce) and use it as the challenge to the yubikey, and the response that's returned is the master key for the database. That's why it needs the yubikey whenever you save the database and open it, as it generates a new nonce each time. It's still vulnerable to a playback attack if someone recorded the interaction and had that exact copy of the database but that's also still true of one protected without it. But with that, they have to get both of them at the same time, an old copy of the database can't be attacked by a different challenge/response than the one it was secured with. I used to use the keys in HOTP mode for this with KeePassX before KeePassXC supported this mode, but that made for an easier to attack setup since there needed to be a copy of things to predict what the OTPs being generated would be. This also made syncing a lot harder because there was an additional state file that was re-generated every time the database was unlocked.

<comment><USER33> Forgot to mention, the syncing is all done via Nextcloud (open source dropbox like system, but also does a lot more).

</comment></comment></comment></comment></comment><comment><USER35> Seems likely that the link will be replaced by a link to Tavis's write-up [https://bugs.chromium.org/p/project- zero/issues/detail?id=19...](https://bugs.chromium.org/p/project- zero/issues/detail?id=1930), but media coverage is interesting on its own, so I'll note the link is currently [https://www.zdnet.com/article/lastpass-bug- leaks-credentials...](https://www.zdnet.com/article/lastpass-bug-leaks- credentials-from-previous-site/) / title "LastPass bug leaks credentials from previous site". I won't quote specific passages, it's just interesting to watch attempts to distill a technical issue into something for the general public's consumption.

</comment><comment><USER26> Password manager recommendations from Tavis Ormandy, who found the bug:

"KeePass and KeePassX are both good choices. If you really must use an online one, at least LastPass are responsive to researchers and have a competent security team, I would use them."

He adds about Lastpass:

"I consider them competent, I've reported some pretty complex issues and found they handle them well. Attack surface is definitely massive, I always recommend KeePass or just use a book if that's too complicated"

(source: [https://twitter.com/taviso/status/1167311357957435392](https://twitter.com/taviso/status/1167311357957435392))

</comment><comment><USER36> I've been just using Chrome's built-in password storage feature, though I see a lot of people are still using extensions. Any reason to prefer an extension or third party over just using the built-in Chrome feature?

<comment><USER37> The cool thing about 1Password and similar is that not only do they work in other browsers (Firefox), they also work outside of the browsers (e.g. in iOS I can autofill login boxes with credentials pulled from 1Password)

<comment><USER38> This feature exists on Android. I can sign in to my chess app with login credentials stored by Chrome (as an example)

</comment></comment></comment><comment><USER39> For anyone who needs to confirm they have updated Lastpass, this link[0] documents reinstallation / updates.

[0] [https://support.logmeininc.com/lastpass/help/how-do-i- enable...](https://support.logmeininc.com/lastpass/help/how-do-i-enable-the- lastpass-web-browser-extension-lp070006)

</comment><comment><USER40> Confused as to why tech people in this thread are giving LastPass flak for a single bug. They've had a pretty good track record for the past half decade or so since I've been using them and they submitted a fix immediately for this bug. Bugs happen, and this is a particularly obscure/esoteric bug. Right?

<comment><USER41> I disagree that they've had a good track record.

[https://www.martinvigo.com/even-the-lastpass-will-be- stolen-...](https://www.martinvigo.com/even-the-lastpass-will-be-stolen-deal- with-it/)

[https://twitter.com/tqbf/status/836619941805764609](https://twitter.com/tqbf/status/836619941805764609)

[https://twitter.com/taviso/status/843965519371812864](https://twitter.com/taviso/status/843965519371812864)

I've seen very few security researchers recommend it, while they will recommend other services.

<comment><USER42> what is the generally recommended service?

</comment></comment></comment><comment><USER43> I hope this fixes the issue I have with one of my banking sites where it propoluates the login with my old username and password which aren't stored in LastPass anymore. Really weird that it seems to have them cached somewhere so I have manually select the bank's credentials in order to log in.

</comment><comment><USER44> I remember my account was locked out completely even though I never did anything. Tried all passwords I knew, but of course you only get limited attempts (Why? If I'm using a brute-forceable password I'm already screwed, I'd rather have unlimited attempts to guess my complex password). I went through all the hoops to get a One-Time Password or whatever it was, tried it on all machines I own, no luck. That's when I decided it wasn't worth it to entrust all of my passwords to an opaque entity like that, it's not ideal, but it's better than losing access to everything I use.

</comment><comment><USER45> I looked into LastPass and similar options a couple years ago, and ultimately decided on the Chrome password manager (with option for the never-transmitted encryption passphrase). Among other reasons, the Google Security Team seemed bigger and better funded, and I already trust them with my e-mail anyway. I supplement this with a text file that I encrypt/decrypt with the OpenSSL command-line utility, since the latter is available on Linux, Mac, and Windows via Cygwin. So far it's been a pleasant experience.

</comment><comment><USER46> I've love to switch away from LastPass. I switched to LastPass Families when it came out due to their "digital contingency plan" so family members (or the trusted family attorney) can get access to passwords rather conveniently if I or another family member passes away. At the time, I didn't see that other offerings made this as easy. Any other good options out there for this use case?

<comment><USER47> 1Password has a Families plan for this.

<comment><USER46> I will look into this. I do trust certain family members with access to my vault password, but the notification of access and ability to give access to a trusted third party (my lawyer) that is available with LP is very compelling.

<comment><USER47> 1Password allows you to add family members with access to specific values either read-only or read/write. The system for adding access is multi-step so unless you add someone to a vault they shouldn't see, you have the flexibility to share as little or as much as you want. Since you can name the vaults you can name them things like "Shared with M Toussant (Attorney)" or "Samir Martha and Paul" which can make it easy to determine where to store what secrets. Have been using Business for a few years with some of my companies and Family with my family and have had good experiences. You can initiate recoveries as the administrator as well which has been helpful in both cases.

</comment></comment></comment></comment><comment><USER48> 1Password is very straightforward after they added cloud vaults. Before that, it was kind of a mess, but it works quite decently now.

<comment><USER49> As far as I know, 1Password has never suffered any hacks or critical vulnerabilities the way that LassPass has. I have used both in the past; I would never, ever recommend LastPass to anyone. 1Password, however? A nearly perfect product (with great support)

<comment><USER48> LastPass support is positively abysmal by comparison, good lord does everything suck about that experience.

</comment></comment></comment><comment><USER50> Haha, lives up to its name. It exposes the _last_ pass used before the current website.

</comment><comment><USER51> This is why I use pass and browserpass. I can't vouch for browserpass extension, but pass is just a wrapper for GnuPG. The encrypted files can be synced using almost any sync solution or even Git. There are apps for mobile too.

<comment><USER52> That makes no sense as the point of attack here is exactly the extension. So wrt this type of bug you gain nothing.

<comment><USER51> You have the option of not using the extension with this method, and the same vulnerability likely doesn't exist with Browserpass due to the communication method.

<comment><USER52> But you have the same option with lastpass.

</comment></comment></comment></comment><comment><USER53> Switched from LastPass to KeePass a couple months ago. Glad that I made the move.

</comment><comment><USER54> When an article states "...the bug relies on executing malicious JavaScript...", why is the bug considered to be in the plugin and not JavaScript?

<comment><USER55> Using a programming language to exploit something doesn't mean the programming language is flawed.

<comment><USER54> So, are they using the phrase "malicious JavaScript" correctly? Shouldn't they remove "malicious"?

<comment><USER56> "malicious code" is code that was written with the express purpose of exploiting a weakness or flaw. they're not saying javascript is malicious. they're saying someone could write malicious javascript code (and then trick a user into executing it) that exploits a flaw in lastpass.

</comment></comment></comment></comment><comment><USER57> I've been using LastPass for a long time, but I don't understand why they don't support FIDO2 as a MFA option.

</comment><comment><USER58> Password managers are great, just don't use the browser extension. Don't even use the Grammarly extension.

<comment><USER59> Care to elaborate?

<comment><USER58> Generally, I don't enjoy sending every keypress to a spellcheck API. Every extension increases the attack surface area. The browser should remain secure, use the native apps.

</comment></comment></comment><comment><USER60> I don't use the browser extensions. I deal with copy paste BS every day, but i rest easier.

</comment><comment><USER61> This is a good time to remind everyone that if you don't have 2-part authentication to a service, that's because you don't care about other people accessing it.</comment>


Ask HN: GitHub censoring porn from GitHub pages. Would that be OK or not OK? - <AUTHOR> In the debate[1] over GitHub's new Code of Conduct[2] and their recent actions to enforce it, a great number if a not majority of HN commenters condemned it as an unconscionable moral betrayal. There was no gray area.
The anti-GitHub sentiment is cropping up in other comment threads, and apparently is driving an exodus from GitHub to Y-Combinator's own GitLab[3].
This is not a troll post. It is a genuine question to understand the value system that seems to dominate tech culture, the very same culture that is experiencing a growing societal backlash.
My hope is that we can have, as dang puts it, a reflective rather than reflexive discussion[4]. Please, comment thoughtfully. Try for "Feynman integrity"[5]. Avoid the knee-jerk. Stay true to HN's own code of conduct[6]. Sorry about all the links.
-
[1] https://news.ycombinator.com/item?id=9966118
[2] https://github.com/blog/2039-adopting-the-open-code-of-conduct
[3] https://news.ycombinator.com/item?id=10003334
[4] https://news.ycombinator.com/item?id=10001153
[5] https://news.ycombinator.com/item?id=9996843
[6] https://news.ycombinator.com/newsguidelines.html <comment><USER2> The main issue IMHO is that the latest developments strongly highlight the fact that GitHub is a private company, running closed-source software and they can do whatever they want. Your code belongs to them.

They decided that 'retard' wasn't ok and closed a repo. Fine, they're allowed to, but then what? What's the next "offensive" term they'll ban? Maybe tomorrow they'll remove all repos that use the widely accepted terms "master/slave" for distributed systems just for good PR.

And that's not even accounting for the inconsistency. There are literally >100k occurrences of 'retard' on GitHub (there was a blog post about that on HN in the past 48 hours), and I'm counting the 'fuck' and co. Are they gonna close 100k repos?

To me, that was the last straw. They want to behave like a private company using their software, and somehow posturing as the white knight of Open Source? I'm done with that and I migrated to Gitlab.

<comment><AUTHOR> > Your code belongs to them.

That is a very false characterization. If they boot you from their servers all you've lost is their hosting of your code. Given that this is built on top of Git, you can migrate your code with full history at any time, for whatever reason.

> Fine, they're allowed to, but then what? What's the next "offensive" term > they'll ban? Maybe tomorrow they'll remove all repos that use the widely > accepted terms "master/slave" for distributed systems just for good PR.

Slippery Slope Fallacy: [http://www.nizkor.org/features/fallacies/slippery- slope.html](http://www.nizkor.org/features/fallacies/slippery-slope.html)

You never answered the question of this post. If someone started hosting porn on GitHub pages, would it be okay for them to ban it?

> And that's not even accounting for the inconsistency. There are literally > >100k occurrences of 'retard' on GitHub (there was a blog post about that on > HN in the past 48 hours), and I'm counting the 'fuck' and co. Are they gonna > close 100k repos?

Another logical fallacy. Just because someone can't do something perfectly doesn't mean it's wrong to try.

> posturing as the white knight of Open Source?

Can you explain how they are posturing?

Whether or not they are posturing, how are they betraying Open Source by enforcing this Code of Conduct? Again, they are not taking over your source when they reject it, they are doing just that, rejecting it. In the same way that FOSS adherents want to reject non-free software.

<comment><USER2> I say "your code belongs to them" in the sense that they are the new LinkedIn- for-developers. The code you put there is your new resume (I kind of disagree with that, but this is a narrative that is very much around). If they ban you you lose access to a big share of the market.

Have fun with your fallacies. (especially the "slippery slope" one has be debunked many times [http://www2.law.ucla.edu/volokh/slippery.pdf](http://www2.law.ucla.edu/volokh/slippery.pdf)) If you don't understand the concept of precedence what do you want me to say? We'll reconvene after their next PR move if you want. I was highlighting the fact that as a private company they can do as they please, yesterday they targeted the 'retard' repo, tomorrow who knows.

"Can you explain how they are posturing?" Really? You are telling me that they're all marketing isn't to represent themselves as _the_ platform for OS? There's nothing wrong with this strategy, but that's what they do.

Funny that you completely ignored my main point: their platform is _not_ open source, it's not hard to see how OS fans may take offense in that.

<comment><USER3> > I say "your code belongs to them" in the sense that they are the new > LinkedIn-for-developers. The code you put there is your new resume (I kind > of disagree with that, but this is a narrative that is very much around). If > they ban you you lose access to a big share of the market.

If you don't have _any_ public share repositories to point to, you lose something.

I don't think not being on GitHub _specifically_ is a problem of the same order of magnitude.

</comment></comment></comment></comment><comment><USER4> Can you explain more about what you mean by "dominate tech culture", and "...experiencing a growing societal backlash". What are you looking at to determine the culture? How are you measuring the growth of any backlash? What backlash are you referring to? Is there a reliable method for detecting when one is in an echo chamber?

</comment><comment><USER5> Their servers, their rules.</comment>


Your agile isn't my agile old man - <AUTHOR> http://designcoderelease.blogspot.com/2016/09/your-agile-isnt-my-agile-old-man.html <comment><USER2> I don't know about the article, I'm going to read it now, but the title is genial.</comment>


Show HN: GNUplot with sixel – Mix images, ANSI colors and plots - <AUTHOR> https://github.com/csdvrx/sixel-gnuplot <comment><USER2> There seems to be desperate demand for graphics output in terminals. Sixels are a rather crude method dating from a time where terminals were optimized for low bandwidth serial connections and very constrained resources in the device that actually renders the content. We have 3D graphic cards now!

This is why right now I'm working on a terminal emulator that implements escape codes that allows a subset of "byte compiled" OpenGL commands to run directly in the terminal window. You now can render a complex 3D scene just by cat'ing a file without any boiler plate code. I think there are many potential use cases for this. It allows for example remote graphics accelerated applications running on another machine via ssh. Once all the textures are uploaded to the GPU RAM the bandwidth required for the display commands is rather low even for interactive games.

<comment><AUTHOR> You should not dismiss "crude" methods so easily: the same output can be rendered inside GNU screen or tmux, which would be complicated otherwise.

And low bandwidth is useful when doing SSH: I posted this quick example of what I use everyday as a reply "ROSshow: ASCII art visualizations for robot sensor data" ([https://news.ycombinator.com/item?id=19519165](https://news.ycombinator.com/item?id=19519165)) by ssh'ing to my remote host (which does not have a GPU) from my laptop (which doesn't have a GPU either).

I wanted to share something that you can use right now, and that works reliably even in non optimal conditions.

Notice how my loadavg is above 10, and how I'm using a mlterm binary downloaded straight from mlterm.sf.net/bin.html

The same will work with a vanilla msys2 installation, or with the in-kernel console of "old powerless machines" as noted on [https://saitoha.github.io/libsixel/#sayaka- chan](https://saitoha.github.io/libsixel/#sayaka-chan)

<comment><USER2> With a serialized GPU commands the remote host does not need a GPU since everything is rendered locally. Only the machine running the terminal emulator needs one. And this would also work within screen or tmux if they don't meddle with unknown escape codes.

<comment><USER3> Even if they don't mess with unknown escape codes, wouldn't they have to know how wide what is being drawn is?

I ran into this issue while writing a shell. All shells use wcwidth() to determine the width of a unicode character. I think all terminals need that information too, and they would also need the analogous information for unknown escapes.

<comment><USER2> It will certainly mess up multi window screen/termux arrangements. The dimensions of the current terminal can be obtained easily. However the position can not. And it will still be possible to draw over other windows.

</comment></comment></comment></comment></comment><comment><USER4> I would love it if all terminals agreed and implemented libsixel or another graphics format.

libsixel is not supported by urxvt, alacritty, any VTE-based terminals as far as I know.

iTerm2 has a custom base64-encodig based image format.

there are even more: [https://github.com/dylanaraps/neofetch/wiki/Image- Backends](https://github.com/dylanaraps/neofetch/wiki/Image-Backends)

<comment><AUTHOR> You're right- more terminals need to implement a common format.

I wish VTE and gnome-terminal would add sixel support

<comment><USER5> While we are at it, let's add Tektronix 4010 graphics. With bright drawing beam and flash screen erase ;-)

It'd be nice to have an agreed-upon simple standard for graphics in terminals. At the same time, Unicode 13 will add 2x3 graphics blocks from ITU T.100 and T.101 standards and a couple fonts will start supporting them from the start, so some lower resolution graphics will be immediately useful.

I'm not sure if sixels will work under tmux or screen - someone mentioned they do, but I'm not sure how: the same problem we have with double-width and double-height (I wanted VTW to support them) and we all agreed it'd make tmux and screen essentially unusable.

<comment><AUTHOR> sixel work under tmux and screen. Check my repository [https://github.com/csdvrx](https://github.com/csdvrx) which is just cloned from existing branch by arakiken

I added screenshots of gnuplot running under both tmux and screen, using msys2 and mlterm

A vectorial support would be nice, but adding svg and a custom format like for iterm may better: Tektronix 4010 graphics is not as widely supported as sixel, and it may be a better start from scratch.

<comment><USER5> How does it account for character width? Isn't a sixel a 1-pixel wide, 6-pixel tall bitmap? Does an actual DEC terminal round them to the next character boundary? Can you write text to a line that started with sixels? Can you write sixels after outputting some characters in the same line? How does a vertical screen partition look like? Are sixel graphics compressed when the terminal is in 132-column mode?

I saw this video of an actual VT-320 terminal displaying sixel graphics: [https://www.youtube.com/watch?v=0SasrQ7pnbA](https://www.youtube.com/watch?v=0SasrQ7pnbA). Someone should check what the behavior is under tmux and screen (at least).

The person also has REGIS and 4014: [https://www.youtube.com/watch?v=afNuDH7QpYA](https://www.youtube.com/watch?v=afNuDH7QpYA) and [https://www.youtube.com/watch?v=kIF0sXQn0RI](https://www.youtube.com/watch?v=kIF0sXQn0RI)

</comment></comment></comment></comment></comment><comment><USER6> prediction: in a few weeks somebody will rediscover the existence of tektronix emulation on xterm and the community will go crazy about it

<comment><USER7> That's not necessarily a bad thing though. Sometimes it's good to revisit some (seemingly) "forgotten" technologies which still have a lot of potential.

<comment><USER6> > That's not necessarily a bad thing though.

I did not say it ironically! Tektronix is super-cool! It could be could be realistically rendered as sgv, and easily extended to add colors and stuff.

</comment></comment></comment><comment><USER8> Sixel is nice (and I use it all the time), but we do have better nowadays.

iterm's image handling [1] is superior: it just encodes a modern and more efficient image format and sends it inbound to be decoded by the terminal. png was always at least equal if not more efficient than sixel at indexed colormaps. You can send jpegs for drastically more efficient true-color images.

The "OSC1337" is not unique to iterm. mlterm also supports it, and I do remember a few others as well. You can use "ranger" to have image previews on a remote server without having to jump through hoops.

[1] [https://iterm2.com/documentation- images.html](https://iterm2.com/documentation-images.html)

<comment><AUTHOR> some terminal emulators support specific formats, but sixel strength is that I don't have to specifically install there emulators.

Also, what if I use an OS where they don't work? (Windows 10?)

<comment><USER8> I have nothing against sixel, of course. But to put things in perspective, Sixel support by itself is not great. Definitely more supported than iterm's, but not universal.

But when developing a new program that wants to output graphics to the terminal, OSC1337 is damn easy (you'll likely not need any new dependency or image handling routines), while for sixel you'd probably need libsixel or write your own encoder.

As a developer, I vastly edge towards iterm's handling. (and to be honest, as a user as well. png encoding is faster too!)

</comment></comment></comment><comment><USER9> Wikipedia article for sixel: [https://en.m.wikipedia.org/wiki/Sixel](https://en.m.wikipedia.org/wiki/Sixel)

</comment><comment><USER10> Doesn't really make sense to me that "cat <jpg>" should render the bitmap to the screen. 'cat' is a concatenation tool. 'cat'ing two JPEGs together isn't the same as 'cat'ing two text files. So why? Use another tool, don't break the idiom.

<comment><AUTHOR> cat /etc/debian_version shows the file

cat /etc/debian_version /etc/debian_version shows the file twice

Shockingly, cat sixel1.six sixel2.six sixel3.six or img2sixel file1.jpg file2.jpg file3.jpg works in the exact same way: cf [https://github.com/csdvrx/sixel- testsuite/blob/master/3-sixe...](https://github.com/csdvrx/sixel- testsuite/blob/master/3-sixels.jpg)

Simply screenshot and edit the result when you are done.

But if you want to create another tool, for example to trim white boarders and concatenate, by all means please do!

Follow the example of [https://github.com/hackerb9/lsix](https://github.com/hackerb9/lsix) who wrote a great tool!

</comment></comment><comment><USER11> NOTE: this repo is only the patch for the debian packages, it appears gnuplot already supports sixel output if it's configured --with-bitmap-terminals

<comment><AUTHOR> Yes that's indicated in the README. Nothing super complicated, I just wanted to show how it was super practical.

</comment></comment><comment><USER12> Where are the sources? If you're releasing modified binaries, you're violating the gnuplot license.

<comment><AUTHOR> Do you understand that I just added one compile flag to debian official sources?

<comment><USER12> Clearly I did not understand this :) Is there any reason to not make this the default? I've never used this feature, but if you think it's generically useful, you can email the debian-science list with the suggestion. The maintainer is generally responsive.

<comment><AUTHOR> :)

Already emailed, unfortunately it's too late to be included in the next release!

</comment></comment></comment></comment><comment> black-tea A github repo full of binaries? What is this?

<comment><AUTHOR> It is just apt-get source gnuplot/testing ; cat debian/rules | sed -e 's/\--with-gd/\--with-gd --with-bitmap-terminals' > debian-rules ; dpkg- buildpackage . (or something approximately like that)

But you are welcome to apt-get build-deb and do that by yourself if you don't trust my binaries or my memory :-)

</comment></comment><comment><USER13> For Matplotlib, checkout this: [https://github.com/daleroberts/itermplot](https://github.com/daleroberts/itermplot)

<comment><USER14> n.b. this only works in iTerm.</comment></comment>


Show HN: Hakkeri for iOS – readable and minimalistic Hacker News - <AUTHOR> https://sampsakuronen.github.io/hakkeri/ <comment><AUTHOR> I created Hakkeri because I wanted a readable and minimalistic way to browse Hacker News. Content is king so I got rid of all the clutter. I wanted to share it for free for those that think that they too want this experience!

For me it's the best way to browse HN on iPhone. It uses the open Hacker News API's. Please see for yourself, give me feedback (firstname.lastname@example.com) and rate the app on the App Store!

Features:

\- List of front page stories

\- Stories open in Safari reader mode (opt-out from this: Settings - Hakkeri)

\- Swipe a story to share a story

\- Swipe a story to go to the comments thread

Codebase can be found at: [https://github.com/sampsakuronen/hakkeri](https://github.com/sampsakuronen/hakkeri)</comment>


Interesting new wearable, thoughts? - <AUTHOR> http://www.nevowatch.com

<comment><USER2> No specs, no details of the "ecosystem".

The Withings activité looks a lot nicer: [http://www.withings.com/activite/en- US](http://www.withings.com/activite/en-US)</comment>


Ask HN: Etsy for hobby electronics hackers? - <AUTHOR>

Hi
I've always been in love with electronics and do small electronics hacks once in a while and wanted to sell some of them. But not finding a dedicated community for hobbyist electronics hackers wanting to sell their stuff online.
So I planned to make an app for this niche audience.
What features would you like to see in an MVP if it was some sort of Etsy for electronics hackers (or indie guys building cool electronics stuff)? <comment><USER2> I'm about to dive into some pretty heavy hardware stuff myself - I have all the equipment, supplies, and reading materials. It's definitely a different beast, and it feels like there are so many possibilities for startups to exploit in the physical world.

I definitely wouldn't mind seeing a place to see some one-off creations.</comment>


Stackoverflow ctrl+C ctrl+v at its best - <AUTHOR> https://imgur.com/gallery/n4ilyLP <comment><USER2> It amazes me how people are tolerant on the crap answers on StackOverflow but think that the toxic culture could somehow be reformed.

Maybe it can, but often when I am programming I want one answer, the right answer, not 20 different answers, some of which are wrong, some are half- right, and the comments may or may not give a clue.

Seems to me that the first thing to do is radical curation of StackOverflow questions and answers: one question, one answer, unless there is some special reason why two or three are competitive.

</comment><comment><USER3> Is this post being a link to a set of Imgur image captures of a Twitter thread a purposeful cut-and-paste joke?</comment>


Elisabeth Kübler-Ross: The rise and fall of the five stages of grief - <AUTHOR> https://www.bbc.com/news/stories-53267505 <comment><USER2> All you need to perform unethical human experiments is a psychologist to say it is okay.

</comment><comment><USER3> This is the typical pop-sci cycle, and it happens over and over again. Someone neatly packages and oversimplifies a concept (power posing, the importance of sleep, even thinking fast & slow), which is swallowed whole and heralded as a wonderful insight by the general public, bringing the individual fame and fortune. The concept is then dismantled over time and found to be at best, 'difficult to replicate', and at worse, just made up.

<comment><USER4> Reading this comment, it felt like you were describing the education system.

I'm waiting for someone to write a best-seller on the "Heat Theory of Education" [ Knowledge, in a given domain, flows from a knowledge-hot person to a knowledge-cool person, proportional to the differential, with some things between them acting as insulator or a conductor ]

It would be a nice bulwark against the pervasive meme that 'teaching is domain-less' aka "if you know how to teach you can teach anything"

<comment><USER5> I've been studying teaching a lot lately, and one of the things all of the books say is that mastery of the material is required but not sufficient to be a good teacher. The other skills, which basically come down to organization and emotional intelligence seem to be universal. In other words teaching as a skill is domainless but being a good teacher requires subject mastery.

</comment></comment></comment><comment><USER6> tl;dr Article mentions a longitudinal study of this theory but the study was criticised for selective data. Article mentions that Ms Kubler-Ross started researching spirit media and the likes which would have contributed to her decline. Nowhere is it clear that the theory itself is flawed or "fallen".

Can someone chime in here please?

</comment><comment><USER7> We need to talk about k8s - [https://twitter.com/lunasorcery/status/1278984875190689798](https://twitter.com/lunasorcery/status/1278984875190689798)

(Just watch it, it's short)

<comment><USER8> Did you mean to put this in a different thread?

<comment><USER9> watch the video. you won't be disappointed. :)

<comment><USER8> Ah. In that case, [https://www.youtube.com/watch?v=ohrjV8hBmC0#t=13](https://www.youtube.com/watch?v=ohrjV8hBmC0#t=13).

<comment><USER10> So, now that's interesting. In this video, the third stage is "fear", whereas in the "standard model" it's "depression"... It's similar, but it's not the same.

</comment></comment></comment></comment></comment><comment><USER11> Obligatory Robot Chicken: [https://youtu.be/6IHhAKnCtKc](https://youtu.be/6IHhAKnCtKc)

</comment><comment><USER12> I'm left wondering wtf was the point of this article. It was a rich tapestry of emotions reading it, and to be fair many of them were positive.</comment>


Alan Turing papers on code breaking released by GCHQ - <AUTHOR> http://www.bbc.com/news/technology-17771962

<comment><USER2> From here: [http://www.zdnet.co.uk/blogs/security- bulletin-10000166/gchq...](http://www.zdnet.co.uk/blogs/security- bulletin-10000166/gchq-releases-two-turing-papers-10025920/)

"The two papers have not been digitised, and only currently exist in handwritten form. People wishing to read the papers need to travel to the National Archives at Kew with the reference numbers of the papers, and two forms of ID — a picture ID, and proof of address. People who do this will probably be given a reader ticket number, which will then allow them to request the papers for viewing."</comment>


This is Why you Should Not Outsource to India - <AUTHOR> http://www.dontoutsource.com/

<comment><USER2> Love this!</comment>


Timelike 2: everything fails all the time - <AUTHOR> http://aphyr.com/posts/278-timelike-2-everything-fails-all-the-time&a <comment><USER2> > Really enjoying @RapGenius's latest mix tape, "I Have No Idea How > Distributed Systems Work".

I guess someone didn't take their history lesson: In the opinion of a lot of people here Heroku was very close to perfect. Then they attempted to scale their approach and expand to different platforms. In this process they created a whole different product that they kept marketing as the original thing.

That is the problem.

Solving it isn't really that hard. As a thought experiment consider: 1.) The system was working nicely. Leaving it that way and adding no further customers would have left rapgenius happy. 2.) Adding a new, completely separate pool could serve more customers with the same needs as rapgenius.

I'm not saying this is an optimal soulution, I'm just pointing out that unless they were loosing money in their previous configuration, Heroku didn't need to change to the new architecture, -they chose to.

<comment><USER3> _Solving it isn't really that hard._

Having spent a fascinating day discussing this problem with Heroku's routing team, I'm inclined to disagree.

<comment><USER2> Thanks for the correction. I guess a more correct wording would be: Given they already had it solved, keeping it... etc

<comment><USER3> When the load on a system increases by two to three orders of magnitude, sometimes it's difficult to preserve the original system's semantics.

<comment><USER4> Sometimes. But I don't understand why they couldn't partition to sidestep those orders of magnitude. Since you have actual knowledge of the system, could you give the 30-second version? It looks from the outside like they just didn't make nonblocking load balancing a priority, rather than that feature being harder than the rest of their work.

<comment><USER5> Same here, I don't understand. The problem is that at a given size they can't use their "intelligent routing" anymore, but afaik no customer of theirs has that size, so why don't they just make as many copies of "old Heroku" as needed? Then they can just use the DNS to select the right shard, and route within shards.

It's like: "Sorry, we're full, go see our competitor. Oh, and by the way, our competitor is us." You're never too large, problem solved.

<comment><USER3> I don't want to reveal specific (and perhaps confidential) information about Heroku's architecture, but I can tell you a few things about working in AWS in general.

One: routing traffic in AWS typically means ELB. ELB doesn't necessarily give you fine-grained control over per-application routing.

Two: Proxies don't always send a single HTTP request per TCP connection.

Three: In streaming-data startups, I think it's pretty common that a customer does something inefficient, scales rapidly over the course of a week or two, and then realizes too late that their initial design is no longer suitable for their traffic load. Sometimes a single customer makes up a shockingly large proportion of your traffic load--and this load is hard to predict.

Four: The routing infrastructure for any given app still requires multiple load balancers in multiple availability zones. That means shards are more expensive--in terms of nodes and cost.

Five: Big systems come with lots of moving parts. It might be impractical to create an isolated, fault-tolerant copy of two hundred services for each reasonably-sized customer. There are... all sorts of issues with distributing state.

<comment><USER5> Thank you for the insight. 3, 4 and 5 are probably the reasons why they don't do it. They could, but it would be harder to operate, a bit more expensive and a lot less elastic. And maybe some customers at some points in time are, in fact, too large for that strategy.

As for 1, they do use ELB now, I don't know if they did during the "intelligent routing" era. It is only possible to create up to 10 different ELBs with a standard AWS account, but something as large as Heroku does not have the same limits.

I don't really understand point 2, could you explain what you mean? I can see how keep-alive can be a problem with some configurations but if you use the DNS to select the shard it shouldn't be a problem (you have one balancer per shard, with ELB it means different CNAME targets).

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER6> I'm now working on my _third_ distributed high performance enterprise storage cluster. SCSI requires a certain (high) level of consistency per LU. And availability... and I'm delivering performance?

What? How could that be possible?

This blog post has so many assumptions about how nodes can and should behave that it's almost unreadable.

Faulty network? Get two fabrics. Nodes going down? RDMA to non volatile ram, and fail the I/O to the other node. This works for all your banks, airlines, governments, etc.

Heroku could do much better, but really: most of these startups should be hiring some ops people and design their own architectures already!

<comment><USER3> You're right: reliable fault-tolerance between two nodes in datacenters with dedicated physical hardware and isolated network links is easier than distributing state over a hundred geographically disparate nodes in in virtualized, multitenant environments backed by unreliable hardware abstractions.

<comment><USER6> My point was to complain about what RapGenius needed by describing an extreme that doesn't exhibit the behaviors your post describes. However you were speaking in terms of Heroku, and my post reads like it's trying to deride that. My comment reads pretty awfully, actually.

I guess I'm just frustrated with how much I hear about cloud services solving the "ops problem" when in reality all I see are people ignoring having a rigorous architecture for their applications.

There are extremes that solve just about any problem RapGenius is facing, because I bet you their traffic, I/O and CPU profiles are not that difficult of a problem to solve for their specific case.

I highly doubt that RapGenious needs over a hundred geographically disparate nodes in a virtualized multitenant environment, (notably because they are the one tenant!), but somehow that's what they're using and they don't understand what it means for them.

I'm sorry that previous comment sucked, and possibly sorry for this one.

<comment><USER3> Heroku operates in EC2, which is an Amazon service providing virtual machines spread across several datacenters. Rapgenius' nodes, as well as all of Heroku's internal infrastructure (e.g. routing) run as EC2 virtual machines. EC2 VMs are multitenant environments because you share them with other virtual machines. The disk, CPU, and network are all virtualized, shared resources, with wildly varying latency, throughput, and reliability characteristics.

RapGenius doesn't need a hundred nodes to do their routing, but Heroku does, because they're responsible for lots of customers pushing a large volume of traffic. Their routing infrastructure needs to share global state about which dynos are available for which applications, (and which _versions of those applications_ ) belong to a given HTTP request, and that routing infrastructure is broadly distributed. I'd phrase their routing TCP load as "nontrivial", in the sense that if I had to build a system like this on physical hardware in, say, Portland, I'd start by buying five floors in the Pittock building.

That's not to say Heroku's architecture is _optimal_ , just that their problem is not as easy as it may appear.

[edit] As for _why_ companies choose to run in a heavily virtualized environment which has so many drawbacks... it comes down to a tradeoff in time, personnel, and costs. Running in EC2 allows for dramatically shorter lead times in hardware acquisition--and when your customers can increase their traffic by an order of magnitude without warning, I think that comes in handy. It also frees them from running their own power, network, physical security, hardware acquisition pipeline, associated vendor contracts, etc. I suspect both Heroku and RapGenius have weighed these costs carefully, but I don't really know their specific constraints.

</comment></comment></comment></comment><comment><USER4> I don't understand this post. It starts off by insulting rapgenius for wanting working intelligent routing, and concludes by showing a way to hook up intelligent routers at scale and maintain performance.

What, exactly, is rapgenius wrong about then?

<comment><USER7> Being meanies to Heroku, basically.

</comment></comment><comment><USER8> aphyr that was a fascinating read. Any thought into testing some more complex routing strategies?

Also, I would love to see this graph: <http://aphyr.com/data/posts/277/bamboo.png> filled out.

How long do the simulations take to run?

<comment><USER3> These simulations take roughly a minute or so each, for the samples I used in the post. I avoided filling in the chart because I was pressed for time. I'm unemployed and already spent ~40 hours on the post, haha.

</comment></comment><comment><USER7> CAP is not applicable here from what I can tell. Glad to know Coda Hale understands it though. Sounds like a real nice guy.

<comment><USER9> Forgive my ignorance, but why isn't CAP applicable here?

<comment><USER7> <http://en.wikipedia.org/wiki/CAP_theorem>

How does consistency apply here for example?

<comment><USER3> Consistency applies because a least-conns load balancer requires state: it needs to know how many connections are open for each node. A distributed least-conns load balancer requires distributed state.

This is problematic because the convergence times for state like "connection counts" between load balancers in different datacenters could be significantly higher than the rate at which that state itself is changing, and the cost to getting that state wrong is significantly higher latencies. That's where you start having to make CAP and latency tradeoffs.

<comment><USER7> Well, sure. Does that make stateless load balancers consistent, though? :) I just don't think the CAP terminology helps.</comment></comment></comment></comment></comment>