Weapons of Mass Assignment: Patio11 on Diaspora  - <AUTHOR> http://queue.acm.org/detail.cfm?id=1964843

<comment><USER2> Oh, I had forgotten about this. It is also getting published in Communications of the ACM in Mayish I think. (Yep, here we go: [http://cacm.acm.org/magazines/2011/5/107701-weapons-of- mass-...](http://cacm.acm.org/magazines/2011/5/107701-weapons-of-mass- assignment/fulltext) . You want that one, the formatting is better.)

I was honestly surprised when I got asked to edit this for the ACM, but couldn't say no to Achievement Unlocked: Journal Publication. Content-wise it is virtually identical to the blog post I did after Diaspora patched the issues I reported to them. The tone got radically altered from my Internet voice to my academic voice, which is rather rusty, so I apologize if it reads poorly.

<comment><AUTHOR> Thanks for the CACM link; that's how I found it, actually, but I'm a subscriber so I only had the "subscribers-only" link (which is very nicely formatted.)

In any event: congratulations on the CACM publication-- that's a quite impressive academic credential, if those things matter to you.

<comment><USER2> Thanks.

It scratches one thing off the bucket list, and many members of my family who expected me to go get a PhD will be tickled by it. In terms of actual utility, it is highly unlikely I'll ever have a CV again, _but_ it makes a nice thing to have for e.g. visa applications. "Published in a prestigious academic journal" matters more to the Ministry of Justice than "has a whole lot of HN karma."

Now all I need is to find someone to cite it in Japanese...

<comment><AUTHOR> Now _there's_ a startup idea: citation arbitrage.

Personally, there are a lot of things I value more highly than their actual utility, but then again, I'm fairly close to entering a PhD program in Buddhist Philosophy, so I'm pretty well acquainted with the notion.

<comment><USER3> Classic Usenet joke: a parody of the old-fashioned "MAKE MONEY FAST" email chain letter.

<http://www.netfunny.com/rhf/jokes/94q1/maketenure.html>

</comment></comment></comment></comment></comment><comment><USER4> Good article, the only place I disagree is with this:

> * For example, Rails could default to mass assignment being available in > development environments, but disabled in production environments (which > are, typically, the ones that are accessible by malicious users).*

That is a really bad idea. All it would do is create broken code in production that could not be debugged in development mode.

</comment><comment><USER5> _"This is easy to do: simply call ActiveRecord::Base.attr_accessible(nil) in an initializer, and all Rails models will automatically have mass assignment disabled until they have it explicitly enabled by attr_accessible."_

I may be way wrong here, but: didn't this particular suggestion come from an HN comment? I seem to remember when there was a flurry of Diaspora articles, that a comment mentioned this as a good example of Ruby monkey patching, and one of my "heroes" (so, patio11, or maybe tpatacek?) acknowledged it as a simple and beautiful solution.

Hmm... off to see if I can find what I'm thinking of.

edit: oh, ha! Found the link: <http://news.ycombinator.com/item?id=1718422> . I was sort of right, sort of wrong. It was an HN comment, but it was actually patio11's own comment to tpatacek, who thought it was a great idea!

<comment><USER6> The approach has been around for a years (see my comment in that thread, for example), but very few of us use it.

The thing you'll run into with that approach is that no authors of gems and plugins that include AR models declare attributes as accessible, effectively assuming that mass assignment is enabled and resulting in the gem/plugin not saving properly. I've had to fork and submit patches for every hugely popular gem with AR models I've used, so it appears practically no one else follows this approach in production apps.

I strongly suspect that leaving all attributes mass assignable on all models other than generated user models is extremely common in Rails apps and it's very likely that this vulnerability is ubiquitous.

<comment><USER2> Yep, this indeed caused some "fun" issues with Appointment Reminder. Off the top of my head, it broke DelayedJob and one other gem that I am forgetting.

Edited to add: Now I remember. The second gem was actually A/Bingo (a plugin). I fixed this back in January.

<comment><USER6> Yeah, DJ is actually the only one I'm still using via a fork ([https://github.com/alphabetum/delayed_job/commit/9637a4418ad...](https://github.com/alphabetum/delayed_job/commit/9637a4418ad19a0e0cd96ae50811bf4d096bc054)). I haven't had time to put the change in a topic branch and do a pull request.

</comment></comment></comment></comment><comment><USER7> "Since Rails is not threadsafe, typically several processes will run in parallel on a machine, behind a threaded Web server such as Apache or nginx."

This is incorrect. Rails 3 (and 2.3) are thread-safe. They typically run in multiple processes because of Ruby's GIL.

<comment><USER8> It has a threadsafe _mode._ It is disabled by default and to my knowledge hardly anyone uses it because you would need to audit all your dependencies to make sure they were threadsafe as well.

<comment><USER7> So, what the "thread-safe mode" does is enable threads in Rails. (i.e. one thread per request.) To my knowledge, it does not switch out thread-unsafe code for thread-safe code.

Moreover, it's irrelevant. As I mentioned, this is unrelated to why Rails apps are typically run as multiple processes.

<comment><USER9> As with Twitter, I don't think Rails, nor Ruby, is the issue. Whatever you do with a framework, or a language, is mostly your fault. Ruby on Rails can only be as good as the people use it are, and while I realise the Rails aggressive marketing gives people the impression that RoR is a bullet-proof solution, it isn't, and shouldn't be blamed if a developer doesn't understand the tools he's using.

</comment></comment></comment></comment><comment><USER10> FWIW, there's a gem for Rails that is intended to solve a related problem (multitenant applications) -- could conceivably be used to assist with the authorization problem as well. [http://blog.codecrate.com/2011/03/multitenant- locking-down-y...](http://blog.codecrate.com/2011/03/multitenant-locking-down- your-app-and.html)

</comment><comment><USER11> We all seem very happy to complain about Diaspora, but where are the people patching it and/or offering a replacement project with the same, highly desired goals?

<comment><USER12> Hello, there!

<http://opensource.appleseedproject.org>

</comment></comment><comment><USER13> This is an old article. Most issues were already fixed. Many issues, bytheway, were known and simply TODO's.

Wether it is a good idea to publish an alpha with demo that contains many known -TODO- security holes and -issues is another idea. But it is unfair to start calling Diaspora "a failure" or "an amateurish piece of xxx" (not my words, but heard them said after this article) because of not-yet-implemented security features (such as authorisation).

By now, the entire Diaspora is/was rewritten in My/PostgreSQL, most of mentioned issues are already dealt with, or are under contstruction.

<comment><AUTHOR> I don't think it's unfair at all. Security and privacy were, after all, Diaspora's _raison d'etre_. And, as we all know (and Diaspora demonstrated, yet again) security is not something that can be bolted on afterwards, but has to be baked in from the start; otherwise you are looking at a rewrite.

"Amateurish failure" pretty much nails it, if you ask me, and if the Diaspora guys were working for me, I'd be showing them the door as quickly as I could manage it. That may sound harsh, but it's the voice of hard-earned experience.

<comment><USER9> > Security and privacy were, after all, Diaspora's raison d'etre.

The irony of its all is that Facebook's privacy issues has nothing to do with open/closed source. They can open they're entire source-tree tomorrow, it wouldn't make them more privacy-oriented than now. It's not how they collect the information or how they store it, but what they do with it and with whom they share it.

>"Amateurish failure" pretty much nails it

I think part of the problem here is, as much as those guys have good intention, the whole affair was ill-handled from the start. From the get-go, asking for money _before_ showing any effort made me sceptical of the whole affair. The amount of exposure and money they got, without anything even resembling code, or implementation details was absurd. And then, what they initially came up with could've been done by a few software devs working on their free time, and was riddled by security issues. My advice to those guys is to use the money and hire some good programmers, which is what most startup guys do.

</comment></comment></comment><comment><USER14> One thing that always bugged me about the criticism of the Diaspora release was that people criticize it like it is production software when they clearly stated it was a "pre-alpha developer preview". Who cares if they didn't have security checks? They could have been just waiting till later to add them all in.

I know when I build I like getting the scaffold/mvp up as quickly as possible ignoring security because hey, this thing isn't out in the wild, and do my due diligence on security after I am happy with the prototype.

<comment><USER15> It was getting deployed as a production service in many places, so it was effectively "out in the wild". Labeling something a "pre-alpha developer preview" does not remove the responsibility of protecting users' data.</comment></comment>


Show HN: Filmtypes – Explore the world of analog film - <AUTHOR> https://filmtypes.com <comment><USER2> Wow. Thanks for making this! As an analog photographer, this is what I've been looking for. I've bookmarked it for future reference.

Here are some points I noticed (no dealbreakers):

\- On the landing page, it would be nice to be able to simply scroll down to see some content. Now the call-to-action button is there but why not show the main content below the "hero" image?

\- On the page with the film rolls: would be nice to have the specs of the film rolls on this page if you hover over a particular roll. E.g. replace the image of the roll with the technical specs. If not the technical specs, then at least the short description that you have on their individual pages.

\- The pages for a specific film roll are tagged (e.g. "street", "General purpose", etc.) but they are not clickable. It would be nice to click on the tags and see what other film rolls are available with that tag.

\- For the example images: add arrow-key navigation (I noticed Esc key works, which is nice)

\- Not all pictures scale to full screen (e.g. the first image here [https://filmtypes.com/films/ilford- delta-100](https://filmtypes.com/films/ilford-delta-100)). Is the resolution too low of the original image?

\- I realize you want feedback, but the chatbox in the lower left (edit: lower right) annoys me a bit. It is easy to dismiss with a large X to close, so it boils down to personal preference. Have you gotten good feedback from it? If not, maybe consider making your feedback email address more prominent.

edit to add:

\- Consider making an "info" icon and place it next to "Specs" on each individual film roll page. When clicked, a small pop-up can be shown that explains what you mean by contrast, color tone etc.

<comment><AUTHOR> Thank you so much for the feedback. Absolutely appreciate it!

You are spot on with your feature requests and assumptions. I had the clickable tag feature in mind but the others are new and really valuable!

Also a good point with the feedback chatbox. I did get some feedback but in contrast to how annoying/prominent it actually is I will adjust it. I checked some sessions on hotjar and basically everyones first action is to dismiss the chatbox. I guess it makes much more sense on dedicated locations.

<comment><USER3> What's the deal with the tags? There's really nothing that makes a given film good or bad for "street" photography, for example. I also don't really understand the "nature" tag. What are these tags meant to imply about the film?

<comment><AUTHOR> The tags serve as an additional way of showing what the given film is used for the most. It does not indicate if it is good or bad.

</comment></comment></comment></comment><comment><USER4> This is pretty rad. I considered making something similar for lens comparisons. I always use the "customer photos" sections on Amazon or B&H. It'd be a good way to make some affiliate cash, if you had a similar setup as this, but included affiliate link. Maybe your next lateral move. :)

<comment><USER5> For example photos by lens type, see [https://pixelpeeper.com/](https://pixelpeeper.com/) and [https://www.flickriver.com/lenses/](https://www.flickriver.com/lenses/)

For examples by camera type, see [https://www.flickr.com/cameras](https://www.flickr.com/cameras)

</comment></comment><comment><USER6> This is a really fun and great site! The resurgence of popularity with analog processes is exciting. While I've been fortunate to have grown up around film (and through the consumer switch to digital) I know the learning curve is much more difficult for those getting into it now.

Personally I view it as a fantastic alternative to both the process of taking photos and the results. I really enjoy working with mechanical cameras and really "seeing" a photo in my minds eye before I capture a scene in reality - a discipline that I find more difficult to practice with digital workflows. Something peaceful and soul feeding about having only a handful of potential photographs (say three 4x5 film holders on a day hike) which forces you to really slow down and focus on each shot.

</comment><comment><USER3> I think this is a neat idea and has some valuable information in it, _except_ for the images. I've been working with film for a long time. I've shot a ridiculous number of films from 35mm to 4x5, scanned them on everything from roll-film scanners to Flextight to drum scanners, and printed on many different papers. My conclusion after going really deep down this rabbit hole is that, except for a very small number of films with really unique characteristics (most of them no longer made), you just can't tell much of anything from a digital image because of the lack of standardization across:

A) Setting/Exposure

B) Film Developer

C) Scanner/calibration/profile

D) Whether the image is a film scan or a print scan

<comment><AUTHOR> I waited for this comment for quite a while, hah. Yes, I agree with you on those assumptions to the most extent! It is really difficult to find out the exact characteristics given only the photos since the outcome can be altered by so many factors.

However, even though I was aware of this - I still tended to look at example photos on tumblr because at least from my experience the sum of all viewed images do give you a good overview imho.

The reason why I handpicked the first six photos by hand is actually because of this. When picking the images I tried to pick the ones that most match with the given characteristic. Off course it is still a very subjective matter.

<comment><USER3> I think at the end of the day, the right conclusion is that an image is exemplary of the _process_ used to create it. If you agree with that, then I hope you'll consider including information about the process along with the image. Without that context, I don't think you can reasonably attribute a "look" to the film itself. Minimally, I think you'd need to know:

A) What's the film format/size?

B) Was it shot and processed normally? (i.e. not pushed, pulled, cross- processed, or developed with a staining developer)

C) Is this image a scan of a negative or a scan of a print?

<comment><AUTHOR> Well, while this approach would make it much clearer it is unfortunately also very unfeasible to do. Neither a photo api would give those details nor would it be possible to aggregate all those information by hand for each film. Thanks for your input!

</comment></comment></comment></comment><comment><USER7> After a few years in the digital photography, what I miss the most is the quality of my B&W photo done with my second-hand Nikon F5!

I'm thinking of using that again but I fear the lack of film in shops and the lack of a good labo to develop my pictures...

<comment><USER8> Most decent size cities will still have labs, and there's always the option to develop by mail.

If you still have the F5 and want to do B&W, pick up a roll of Ilford SFX. It's easier to find a lab that processes C-41 chemistry than anything else, and it's easier to scan than traditional B&W.

<comment><USER3> In what way is it easier to scan? Every scanner has settings for both black and white and color neg. Plus, scanning "black and white" shot on C41 introduces a host of issues into post-processing.

<comment><USER8> C-41 is easier to scan because you can use IR cleaning with C-41. This technique is impossible with traditional B&W film.

> Every scanner has settings for both black and white and color neg.

The fact that your scanner "has a setting" just means that people want to use the scanner for this purpose. It does not inform you which alternative you should choose.

> Plus, scanning "black and white" shot on C41 introduces a host of issues > into post-processing.

I can't imagine even one issue in post-processing. Once you scan it the film, you get a monochrome image. With C-41, the post-processing is easier because you don't have to do as much manual cleanup (due to IR cleaning, above).

Speaking as someone who has an entire shelf dedicated to binders of film—B&W is much worse to scan than C-41. I personally shoot mostly traditional B&W but I recognize that my use case is different from most.

<comment><USER3> Suffice it to say I disagree, but even if what you're saying is true, I don't really see it as a good enough reason to shoot black and white on C-41 film.

<comment><USER8> Ok, I guess it's okay for you to disagree but it would be nice if you articulated the reasons for your disagreement, if you're going to bother replying.

Personally I prefer to shoot B&W over monochrome C-41, but if you are not sure how much effort you want to spend on film and are going to scan, then it makes sense to go C-41.

<comment><USER3> Looking back over this I'm actually not sure we're talking about the same film. I like SFX a lot. It's a traditional black and white film (in terms of development chemistry, there's no mention of C-41 chemistry on the technical sheet). Did you mean XP2?

Anyway, here's my take on "black and white" C-41 films: I just don't see the point. Traditional black and white film is a beautiful thing. From an aesthetic and technical standpoint it's far and away better than C-41. The only advantage C-41 has is the ability to drop it off at a corner lab, and those are becoming more rare by the day. I'd much rather just shoot a high quality true color negative film and convert it. I don't do that very often but I'd be kind of surprised if you couldn't get a better looking image from converting, say, Portra, than shooting a "black and white" color negative film. Every time I've tried films like XP2 an whatever the Kodak equivalent was, the results have been resoundingly underwhelming.

</comment></comment></comment></comment></comment></comment></comment><comment><AUTHOR> When I first got into film photography, I had a hard time figuring out which film stocks I should shoot. The beauty of film is that each emulsion has its very own characteristics which make it stand apart from the others.

While scrolling through endless blog articles and example photos on tumblr (which took me ages) I decided to aggregate the most useful data, pick the six most fitting example photos by hand (yes by hand) and create a place for you to easily explore the beautiful variety of analog film.

The tech stack is a nuxt static generated site hosted on firebase.

</comment><comment><USER9> Really cool, see a few missing film types (Superia 800 and 1600, Cinestill 800T/Vision3 500T) would also be really interesting if there was listings for cross-processing, especially of slide film in C-41. Each stock has its own set of casts and color crossing and it can be pretty difficult to figure out what that is for each film stock.

Also completely unknown how you'd do it, but giving any kind of data for pushing the B/W films would be really interesting too

<comment><AUTHOR> Thanks! I will take a look at it!

</comment></comment><comment><USER10> This is very cool.

I have a question for the community. A few years back I stumbled on a website that had really cheap prices for film, near but not expired. $2 (or $1?) for a roll of 24 run of the mill Kodak-200. I bought a dozen various rolls and I've now run out. I think it might have been one of the three big photo shops (Adorama, ect)

Where do you buy film cheaply?

<comment><USER11> I live in Portland, and eBay and Craigslist are the best ways I've found to get cheap film, either because someone's done shooting film, or because it's old and expired. Blue Moon Camera, in St. John's, also sells expired film in a mixed basket. I would trust their stock.

You have to be very careful with old Polaroid film. It's common to get ripped off. Unless you can test expired Polaroid film, it is risky to buy. I'm talking about old stuff, like before 2000/2010\. I bought two packs of 4x5 Polaroid film. One dried up, the other still seems usable.

In my experience, shooting old 35mm film is perfectly fine, but different stocks will have different degradation. And depending on the color shifts or type of work you shoot, some expired film will look better.

Experiment with some different films at different expiration dates.

I've found that older film requires more light. Otherwise, everything is lost in shadow and grain.

</comment></comment><comment><USER12> Great project! There are lots of resources online for analog photography but few are clean, simple, well designed, etc. – nice work. Also, it's a great demonstration of static site / "JAM stack" technology (Nuxt + Flicker API + Firebase). A simple setup leaves more time to spend crafting a polished experience.

<comment><AUTHOR> I could not put it into better words :) Thanks!

</comment></comment><comment><USER13> Are you trying to keep it to just currently available films? I think Fuji Neopan films are discontinued, but rumors of its return have been floated. Likewise Ilford doesn't list Pan 100 and Pan 400 on its website. And of course, Agfa APX 100 has been out of production for years, but old stock still floats around.

<comment><AUTHOR> As of now, I am trying to list all the film stocks that are currently still available/still floating around. I will take a closer look at the actuality of the films.

</comment></comment><comment><USER14> This is definitely a good start and I look forward to seeing it grow. The example photos section is nice, it tells you more than the spec sheet can about how it will look.

</comment><comment><USER15> Why use positive but not chrome for the film type? It really takes me a few seconds and several scrolls to make sure what the positive means.

<comment><AUTHOR> Thanks for the hint! You are right. Positive made sense to me but actually slide or chrome film is much more common and easily understandable.

<comment><USER3> But not all positives are chromes. Some copy films produce interpositives, for example. Or like Scala-- is/was it a chrome? I'm not sure, tbh.

</comment></comment></comment><comment><USER16> It be great if you added 120 film as well, and if the amazon links showed if the film was actually in stock, which is often an issue...

<comment><USER16> Oh and filtering by ISO 1000 return ISO 100 as well

<comment><AUTHOR> Thanks for the bug hint! I currently undecided on how I want to implement different film sizes. As of now each film shows in the details section the other available formats and I might make them filterable. Most of 120 films are also available as 35mm but I am aware of some exceptions. What do you think?

<comment><USER16> Adding it as a filter would be fine: some of the other info in the sidebar could be useful as filters as well, like the use cases. Also, comment from a friend who is more pro than me would be to add reciprocity compensation information.

<comment><AUTHOR> Love it. Those are actually also on my feature roadmap! :)

</comment></comment></comment></comment></comment><comment><USER17> I only have vague memories of shooting with film, with permissions from elder members of the family. Browsing through the photographs, I couldn't help but get somewhat nostalgic.

Just a small suggestion, you could remove the "Explore Now" button on the homepage, and take visitors straight to the films.

<comment><AUTHOR> Happy to hear that I could revive some memories!

</comment></comment><comment><USER18> This is so cool! Man I really miss developing B&W film in a darkroom in high school. Probably super toxic but man was it fun.

<comment><USER8> It was toxic a hundred years ago. There have been vast improvements in safety over the years.

<comment><AUTHOR> True that. Unless you try to drink from the trays you should be pretty fine.

</comment></comment></comment><comment><USER19> I love this site - would you share the details about the technology behind it? What's it written in, database, etc?

<comment><AUTHOR> Thanks! Sure. Actually @katabasis summed it up perfectly: "... Also, it's a great demonstration of static site / "JAM stack" technology (Nuxt + Flicker API + Firebase). A simple setup leaves more time to spend crafting a polished experience."

Additionally, I am also using youtube's api for the videos and an airtable sheet where I store all the information about the films. When I update the airtable sheet it automatically updates firebase and generates the static site from nuxt. I could probably also use the airtable api but I have not looked into it yet.

<comment><USER19> Thanks for sharing, I really love it.

</comment></comment></comment><comment><USER20> nice clean presentation. Where are you sourcing your images from? Also, based on the samples I looked at, it would be nice to have larger images.

<comment><AUTHOR> thanks, I will take a look at it! I am sourcing CC BY 2.0 images from the flickr api.

<comment><USER20> I'm assuming that you are querying tags to find the images? I did notice a image that shows up under "Kodak Gold 200", but when you visit the flickr page it is clearly "Kodak Colorplus 200" (yes apparently they are different film stocks.) Unfortunately there is limited consistency in tagging film stocks.

<comment><AUTHOR> Yes, that's right. The querying based on tags has its limitations considering the consistency. Some people even post b/w pictures and take color films. I have currently not found a better way to query it but I will def think about it.</comment></comment></comment></comment>


Show HN: In response to the new EU copyright laws, an API to filter user uploads - Max-20 https://filteruploads.com/ <comment><AUTHOR> I appreciate the attempt, but honestly, I'm not really sure how you would build something like this. You'd have to be able to filter audio, video, images and text.

I'm not even sure if there exists a corpus of copyrighted content anywhere to compare against. You're probably going to have to build it yourself. And keep it up to date with not just newly generated content, but also content whose copyrights expired.

Frankly, even for companies of the FAANG scale, this is a tough challenge, and I don't think a startup is going to be able to handle this.

<comment> Max-20 There is a trivial way to just analyze the metadata of pictures and videos. If you take a picture and upload it, it has a lot of information that comes along with it vs. if you just download it from a random website and re-upload it. That would catch only the most obvious attempts, for more advanced filtering I would use machine learning.

You are correct that its a big task, but if one would take it step by step and start with pictures only I am pretty sure you could come up with a decent success rate.

</comment></comment><comment><USER2> It's not an API. It's a website which asks for your email address and says that it "wants" to offer an API.

<comment> Max-20 Yeah it is about a website that is about an API. To make it easier to read and comprehend I compressed the info in the title. Thanks for the clarification though!

</comment></comment><comment><USER3> Interesting idea, but I think many file upload sites will soon shift to encryption before uploading (like Firefox Send), making filters impossible.</comment>


Save the internet - <AUTHOR> http://www.savetheinternet.in/?HN

<comment><USER2> Nice work posting this here.. Others plz plz open the link and click "send response" to defend the internet.

more info ([http://www.medianama.com/2014/11/223-net-neutrality- simple-e...](http://www.medianama.com/2014/11/223-net-neutrality-simple- explanation/))</comment>


AWS API Performance Comparison: Serverless vs. Containers - <AUTHOR> https://www.alexdebrie.com/posts/aws-api-performance-comparison/ <comment><USER3> Perhaps I misread, but it sounds like the author never managed to get Fargate to run without even a minimum of 3% failures?

That to me sounds like an astoundingly high number, especially for the amount of resources dedicated to the test (400GB of memory and 200 CPUs). Hell, if you're monitoring uptime, that's one nine (97% success).

I can't believe that this is a well-configured setup. Running 50 instances with four CPUs each at a total of ~100rps means that half of the CPUs are probably doing exactly nothing (and if my understanding is correct and they're using Flask in a single-threaded way, 150 of the 200 CPUs are going to be idle).

Triggering SNS is an API call. Assuming that's all the test application is doing, you hardly need one server to do this. I'd bet that you could make 100 simultaneous API calls from a stock Macbook Pro with a small handful of Node or Go processes without even making your CPU spin up.

If Fargate can't handle 100rps (to make a single API call per request) with <10 instances, it's a useless product. But I find it hard to believe that Amazon would put something so absolutely incapable into the wild. With the specs the author put up, that's the equivalent of ~$10/hr (if I'm reading their pricing page correctly). You could run 380 A1 instances, 58 t3.xl instances, or two m5a.24xlarge instances for that price.

<comment><USER4> > If Fargate can't handle 100rps (to make a single API call per request) with > <10 instances,

It can. Easily. I've done it.

> I can't believe that this is a well-configured setup.

It's not.

The author hasn't provided anywhere near enough information to gather any useful information from this. I don't know why there were errors (the other doesn't give any precise information), I don't know how long the tests were run, the state of instances before the tests were run, what operations were being performed, how the testing was being performed, or numerous other things.

Simply put, it's not useful.

</comment></comment><comment><USER5> I tend to think of these services as fulfilling different use cases.

For Fargate, the ideal scenario in my workloads is async background processing. Add tasks to SQS, Fargate pulls tasks off and does the job. Elastically scales up or down and lots of flexibility on machine specs. Ok with some failure rate.

For AWS Lambda, recently I like the combo of adding a Cloudflare worker in front and using it as an API gateway. More flexibility on routing, faster performance, and reverse proxy for free which can be good for SEO. And you get all the goodies of Cloudflare like DDOS protection and CDN.

<comment><USER6> Do you have any details about using Cloudflare Workers as an API gateway?

<comment><USER5> Check out the boilerplate here for workers:

[https://github.com/detroitenglish/cloudflare-worker- webpack-...](https://github.com/detroitenglish/cloudflare-worker-webpack- boilerplate/blob/master/README.MD)

Then invoke lambda with this:

[https://github.com/mhart/aws4fetch](https://github.com/mhart/aws4fetch)

Important to note that workers have a 15s timeout, so this is really only good for routing. You probably don't want this to manage tasks that could potentially take longer.

<comment><USER7> > Important to note that workers have a 15s timeout

Not true -- the timeout on outgoing HTTP requests is (I think) 100 seconds (or unlimited as long as data is streaming).

The 15-second limit you may be thinking of is that Workers used to not let you start new outgoing HTTP requests 15 seconds into the event, but already- started requests could continue. This limit was recently removed -- instead, Workers now cancels outgoing requests if the client disconnects, but as long as the client is connected, you can keep making new requests. This was changed to support streaming video use cases where a stream is being assembled out of smaller chunks.

(I'm the tech lead for Workers.)

<comment><USER5> Didn't know that! Thanks for chiming in.

</comment></comment></comment></comment></comment><comment><USER8> This benchmark is all over the place; there are way too many variables changing to make any sorts of conclusions. You have flask-gunicorn-meinheld stack on the fargate side, all bits that might impact performance. Then there are the failing requests that alone would disqualify the comparison. I would also assume ApiGW to be slower than plain ELB, although I don't know for sure and this comparison certainly did give any information about that. No comparison of different lambda/fargate instance types, nor any mention about costs. Obviously just throwing more money should get better perf, so perf/$ is sort of important.

</comment><comment><USER9> Unless I misread the article, but the writer makes a claim of having to support 100 req/sec with about 50 instances. "For Fargate, this meant deploying 50 instances of my container with pretty beefy settings — 8 GB of memory and 4 full CPU units per container instance.". If the api service was just returning some data with a few manupilations, then that is quite inefficient. At NodeChef ( [https://www.nodechef.com](https://www.nodechef.com) ), there are users running over 1000 req/sec with just around 12 containers each with 512 MB ram and 2 CPUs.

<comment><AUTHOR> Original author here.

The two sentences right before what you quoted are helpful:

"I'm not a Docker or Flask performance expert, and that's not the goal of this exercise. To remedy this, I decided to bump the specs on my deployments.

The general goal for this bakeoff is to get a best-case outcome for each of these architectures, rather than an apples-to-apples comparison of cost vs performance."

I wasn't trying to squeeze out every ounce of performance and determine the minimum number of instances to handle 100 req/sec. I was trying to normalize across the three patterns as much as possible to see best-case performance. I didn't want resource constraints to be an excuse.

<comment><USER10> I think there's a pretty big flaw in your benchmark because that failure rate is _insane_ and you shouldn't need anywhere near that hardware to accomplish this. I don't think your data is credible as a result.

</comment></comment></comment><comment><USER11> As usual with such benchmarks, I miss performance comparisons over time. Did Fargate outperform the other two solutions because it's generally faster or because API Gateway was just slow during the few minutes that benchmark took?

What'd also be interesting here would be a price comparison. Without having done the math I'd expect Fargate to be significantly more expensive than the other solutions, which'd make a nice trade-off of cost vs. performance: If performance matters choose Fargate, if cost matters choose API Gateway as service proxy.

<comment><AUTHOR> Author here. I'd say this was about in line with what I'd see from using API Gateway and Lambda.

I thought about doing a price comparison, but that gets really tricky. At some point, you're testing the skills of the tester more than the services themselves.

Agree with your expectations though. I think Fargate is naturally faster and can be moreso given the number of knobs you can tune. This will likely cost you more, both in direct resource costs and in engineering time trying to fine-tune the knobs. Whether that's worth it depends on your business needs.

</comment></comment><comment><USER12> Hmmm what about Application Load Balancer to Lambda??? Cut api gateway out..

<comment><USER13> This is possible?!

<comment><USER12> Yup, means your requests aren't limited to 29 seconds that API Gateway enforces. And you don't have to deal with fiddly config. So if you're using something like ASP.NET Core its insanely easy to setup a website in a lambda now.

<comment><USER14> There's something I don't quite get. If you set up a website with asp.Net core or node, and you're using async io everywhere. Doesn't lambda restrict the process to one request at a time? If it's like that, doesn't lambda underutilize resources?

<comment><USER12> I guess resource allocation would be under utilized, but being able to respond to web requests allows for a single lambda to execute for any number of different requests. For example we had a client who wanted a SOAP service to interface with our system, so instead of creating a WCF service or something and hosting it in IIS, we used SoapCore which is just middleware for accepting a soap action or sending the wsdl information back. So we have a small lambda (it's like 500kb) in a Lambda accepting ~1-10 requests during monday-friday for this client. And since Lambda only charges for duration of execution time it ends up costing nothing as it falls into the free tier. So even if the resources are underutilized I don't see an issue. (sorry for wall of text I'm on my phone)

</comment></comment></comment></comment></comment><comment><USER15> im confused how the author thinks it's ok that 10% of requests to fargate are failing because they don't know how to configure docker / flask?

</comment><comment><USER16> Helpful analysis. Thanks. I was planning to do something like this soon. I'm interested in the performance difference between the same docker image running on fargate vs ECS with a c5.large EC2 backing instance. My initial tests ( a few months ago before they started using firecracker for fargate) have showed at least a 200% performance increase. I also noticed fargate performance really depends on the processor AWS allocates to the fargate task. And the processor is not always the same between identical tasks. Would be worth checking if there are significant differences between fargate with different underlying CPU types.

</comment><comment><USER17> only one of these has a reasonable local testing story

<comment><USER18> of course you wouldn't rely on local testing so that's is moot.

</comment></comment><comment><USER19> This was so bad, I'm not even sure where to start. As a general advice when you see 4cores/8GB doing 100rps~~ there is some serious problem somewhere, every dev should know that this kind of instance doing that kind of benchmark ( simple REST calls ) should be in the ballpark of 4-5 digits not 3.

</comment><comment><USER20> I think people are overly concerned with 'performance'.

So long as the approaches meet real world thresholds for specific things, particularly the speed of certain time-sensitive requests - then the technology is 'viable'.

(And let's also assume 'reliability' as a key component of 'viability')

Once the tech is 'viable' \- it's really a whole host of other concerns that we want to look at.

#1 I think would be the ability of the tech to support dynamic and changing needs of product development.

Something that is easy, fewer moving parts, smaller API, requires less interference and support from Devops - this is worth a lot. Strategically - <USER2> may be the most valuable thing for most growing companies.

'Complexity' in all it's various forms represent a kind of constant barrier, a force that the company is going to have to fight against to make customers happy. This is the thing we want to minimize.

Obviously, issues such as switching costs and the 'proprietary trap' are an issue, and of course 'total cost of operations' i.e. the cost of the services are important basis of comparison, but even the later is an issue later on for the company, once it reachers maturity. (i.e. A 'Dropbox' type company should definitely start in the cloud, and not until they have the kind of scale that warrants unit-cost scrutiny would they consider building their own ifra)

In the big picture of 'total cost of ownership' \- it's the ability of the system to meet the needs of product development, now 'how fast or cheap' it is, that's really the point.

Something that is 2x the cost, and 10% 'less performant' \- but is very easy to use, requires minimal devops focus, and can enable feature iteration and easy scale - this is what most growing companies need.

Unless performance or cost are key attributes and differentiators of the product or service - then 'take the easy path'.

<comment><USER21> > For Fargate, this meant deploying 50 instances of my container with pretty > beefy settings — 8 GB of memory and 4 full CPU units per container instance.

This is for hello world application. This is insane. Single EC2 HVM instance would have better performance.

> Something that is 2x the cost, and 10% 'less performant' \- but is very easy > to use, requires minimal devops focus, and can enable feature iteration and > easy scale - this is what most growing companies need.

Cost is close to 50x and Fargate is not necessarily lower overhead. Terraform + Packer + EC2 vs ECS + Docker + Fargate is pretty the same for me. You still need to build images and manage the deployment lifecycle.

<comment><USER20> Why would you use " Terraform + Packer + EC2 vs ECS + Docker + Fargate" if you can just use AWS Lambda?

<comment><USER22> Because it's never just Lambda. It's the toolchain you use for deployment and orchestration, routing, etc. (eg, "Serverless Framework + Lambda + API Gateway")

<comment><USER20> Well 'serverless framework' really is just node.js or java. That's likely going to be used anyhow.

Lambda itself doesn't really take maintenance.

Routing can be done in the app, you only need one - or a small number of 'endpoints' so messing with API gateway can be minimized.

You can run any sized app with a single API Gateway endpoint, and a single lambda, on a simple node.js setup.

I can't see any reason to use containers on EC2 or containers on Amazon's container service until an app gains quite a degree of sophistication.

<comment><USER21> CloudFormation, API gateway, AIM, Secret Manager. Production application requires much more than just a lambda. It is better to start from something more structured than shell scripts.

</comment></comment></comment></comment></comment></comment><comment><USER23> Great article. I'm interested in how the performance between the same docker image running on fargate vs a c5.large EC2 instance.

</comment><comment><USER24> > First, I ran a small sample of 2000 requests to check the performance of new > deploys. This was running at around 40 requests per second.

...

> When I ran my initial Fargate warmup, I got the following results. Around > 10% of my requests were failing altogether!

....

> To remedy this, I decided to bump the specs on my deployments.

> The general goal for this bakeoff is to get a best-case outcome for each of > these architectures, rather than an apples-to-apples comparison of cost vs > performance.

> For Fargate, this meant deploying 50 instances of my container with pretty > beefy settings — 8 GB of memory and 4 full CPU units per container instance.

<comment><USER25> This is what caught my eye too. I'm not familiar with the guts of Fargate, but this seems like very poor performance?

<comment><USER26> I sort of suspect the error wasn't just about resources, since it continued after given gobs of resources.

<comment><USER27> Having run a service on Fargate in prod before I can almost guarantee that the errors he was seeing were 504s which are caused by the server code and the ALB not having their request-timeouts set to to the same value.

<comment><USER28> It's my understanding that you want to set the timeout in the server code to be higher than the idle connection timeout in the ALB. With them set to the same value, timeout errors will look different depending on whether the application or the ALB dropped the connection.</comment></comment></comment></comment></comment>


Show HN: Create a single link for someone to by multiple items from amazon - <AUTHOR> http://sendacart.com/ <comment><USER2> Would be useful for us as we have to build a cart and get our Accounts dept to purchase it. We're in the UK though.

</comment><comment><USER3> Neat idea.

</comment><comment><USER4> s/by/buy?

<comment><AUTHOR> yeah should be buy, I was half asleep when I posted</comment></comment>


Ask PG: How popular has Startup School become? - <AUTHOR>

Based on previous years, it looks like maximum attendee capacity is set at 600 people for Kresge Auditorium.  Have the number of applications been drastically increasing every year?  What percentage of applications do you anticipate accepting this year? <comment><USER3> The number of applicants has increased every year. It looks like there were about 1300 last year. Presumably more this year. Which means statistically the chance of being accepted would be a bit less than 50%. However, the odds would be better for anyone who's reading this, because most people reading this are probably hackers.

We hate having to turn people down. (Among other things, it's a lot of work to read all the applications.) We'd get a bigger venue if we could, but there just isn't one.

<comment><USER4> _the chance of being accepted would be a bit less than 50%_

Typo?

 _the odds would be better for anyone who's reading this_

By how much? Can you say how many applicants have >10 karma? Or better - <USER2> you publish a list of karma scores of everyone who has applied?

<comment><USER5> There's no place to put karma score in. My karma score is currently 1956, and I got turned down last year. I'm hoping I can get in this year.

<comment><USER4> _there's no place to put karma score in_

But there's a place for your user name(s). Since Arc is so expressive, I'm sure it would only take one line of code to get the list ;)

<comment><USER6> There's a place for the yc username on the app? Where?

<comment><USER3> There isn't. But: <http://news.ycombinator.com/item?id=110672>

<comment><USER7> I got an expired link when I clicked submit, and when I backtracked, the form no longer contained my data. I successfully submitted a new instance of a blank application a few times (it accepted blank input.) Then I submitted my real application. Will that confuse the system?

<comment><USER3> It's already possible. I just forgot to do it there. Will fix. Edit: fixed.

<comment><USER7> Sorry, I must have changed my question while you were editing. But I do see using the back-button on the form has been fixed.

</comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER8> yea i have a feeling the applicant pool is going to be huge this time around.</comment>


World Vegetarian Day - <AUTHOR> http://en.wikipedia.org/wiki/World_Vegetarian_Day

<comment><USER2> I fail to see what this has to do with HN. A celebration made up by a bunch of self-contradicting folks?</comment>


The Fc.exe command does not work when files differ every 128th byte - <AUTHOR> http://support.microsoft.com/kb/953929 <comment><USER2> I'd hate to have been the guy who discovered this. That sounds like a heap of frustration.

</comment><comment><USER3> I would love to see the code that produces this bug.

<comment><USER4> Probably something like loading the 128 bytes into a byte array, then doing something to it that requires it to be \0 terminated and then the last byte is overwritten.

EDIT: The suggested workaround is to run it in binary mode. As binary doesn't have a concept of \0-terminated strings, this seems to back up my theory.

<comment><USER5> If it's something that simple then how on earth could MS ship it? What tests would they have run that could miss this - I'd think that a test on a file comparison program would include cycling through a single bit alteration and checking that it was captured up to some arbitrary number of bytes (and I'd think you'd let it run > 128 bytes too).

I'm not a coder, does this sort of assumption seem reasonable. If you can't get the basics right ...?

<comment><USER6> Your test suite seems broken (which is why test suites are hard to write in the first place). What if there is a bug when you have two bits changed -- one in the 128th byte and one in the 256th byte? Here's a possible test suite that could catch those bugs.

Take two files. Generate all possible combinations of byte-differences between the two files up to a length of 256 bytes and flag invalid comparisons.

Now, what is the running time of this test case? I'll give you a hint: this test case is unlikely to finish before the heat-death of the universe.

In general it's very hard to right comprehensive test suites and the only thing this proves is that Microsoft developers are humans, not gods. In fact, this is _exactly_ the type of weird corner-case bug that I would expect to find in code written by good developers.

<comment><USER7> He didn't suggest that the test suite should account for all possible combinations of byte differences. He suggested that the test suite should account for all possible combinations of SINGLE byte differences. I.E., the test suite should have checked two files with only the first byte different, with only the second byte different, etc. Such a test suite would be linearly complex, not exponentially, and could easily be run before the heat death of anything.

(However, to play my own devil's advocate, I'd have to say it's easy in retrospect to say "yes! there is an easy test for this that should have been written!" when in fact often the number of possible tests is astronomically large and it can be hard to pick the right ones. What if the bug was that FC.EXE didn't correctly register a difference when both the 127th and 128th bytes were the only differences? The proposed test suite would not have caught it.)

<comment><USER6> Your devil's advocate argument seems to be just my post. I was trying to show that, while the parent's test suite was linear running time, the number of tests in a comprehensive test suite is exponential, therefore the runtime of any completely comprehensive test suite is exponential. Choosing the correct tests to use resources on is a very difficult problem.

</comment></comment></comment></comment></comment></comment><comment><USER8> It sounds like it compares blocks of 128 bytes, & there's an off-by-one error in the code.

</comment><comment><USER9> Nothing as satisfying as really really occasional bugs. (When they aren't yours)

<comment><USER10> At least it's reproducable...

</comment></comment><comment><USER11> _"This article applies to a different operating system than the one you are using. Article content that may not be relevant to you is disabled."_

If I don't use Windows, they hide some content.

<comment><USER12> I think thats just to warn vista/7 users that it doesn't effect them.

</comment></comment><comment><USER13> In Windows XP, which is two generations outdated.

</comment><comment><USER14> In what kind of real-world situations would this bug impact results?

<comment><USER15> The most common case: any situation in which only one character in a file is different. For one in every 128 pairs of these files, more or less, fc.exe will say "no differences found".

Are you asking why anyone would ever change only one character in a file? Typo corrections come to mind, or mild file corruption. I recovered a ton of files from a failing drive a few years ago, and quite a few of the text files had just a character or two corrupted.

I'm not sure what people generally use fc for -- I don't -- so it's hard to say how serious the impact might be when it fails.

</comment></comment><comment><USER16> _You must restart the computer after you apply this hotfix._

Really Microsoft?

<comment><USER6> This was from XP before they re-architected the DLL management. I'm not sure blaming Microsoft for a mistake made more than 9 years ago in OS design is relevant or helpful.

<comment><USER16> fc.exe doesn't use any DLLs. It's a trivial console application, deployed as a single .exe that can be overwritten as long as it's not currently running.

<comment><USER6> The hotfix seems to modify ulib.dll.

<comment><USER16> If fc.exe depends on DLLs for its core functionality, then the whole scenario is even goofier.

<comment><USER6> /usr/bin/diff depends on the following shared libraries for operation:

linux-gate.so.1 => (0xb7f31000) librt.so.1 => /lib/tls/i686/cmov/librt.so.1 (0xb7f18000) libc.so.6 => /lib/tls/i686/cmov/libc.so.6 (0xb7dc9000) libpthread.so.0 => /lib/tls/i686/cmov/libpthread.so.0 (0xb7db0000) /lib/ld- linux.so.2 (0xb7f32000)

Did you look any of this information up before making your statements? It looks like ulib.dll is a DLL for file utilities, which would perform an analogous purpose as librt and libc in any UNIX system.

<comment><USER17> But, you don't need to reboot a Linux machine after updating a shared library.

<comment><USER6> _This was from XP before they re-architected the DLL management. I'm not sure blaming Microsoft for a mistake made more than 9 years ago in OS design is relevant or helpful._

\-- Me, about 4 comments ago

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER18> Microsoft's single purpose 'File-Compare' utility actually fails to do the one thing that it was designed for? It boggles the mind. (Sorry for the lack of content, but OMG and WTF!)</comment>


Ask HN: At what Karma Cliff can you down-vote a post? - <AUTHOR>

I'm not really the down-voter type and always feel there ought to be a reason behind everything. Nonetheless, there are times when you need to down-vote a post. <comment><USER3> HN does not support post down-voting. You can however down-vote comments - <USER2> long as they are not replies to a comment of your own. Even then, the number of down votes is limited.

With a certain Karma threshold (the value changes over time) you can flag inappropriate posts and comments for moderation and I understand that a certain number of such flags set before a post reaches a minimum up-vote value will cause that post to be deleted.

Personally I see no need for down voting.

<comment><USER4> And what is the karma threshold for seeing the down-vote option?</comment></comment>


West Midlands cyclist with helmet cam helped to prosecute 325 drivers in a year - <AUTHOR> https://road.cc/content/news/261826-west-midlands-helmet-cam-cyclist-shops-325-drivers-year <comment><USER2> Now I would like to see it done the other way around. The cyclists in my neck of the woods don't stop at stop signs. They ride about 3 feet out in the road and sometimes have a fiberglass pole that sticks 3+ feet out in the road with an LED on it. They will ride side by side in packs of 4 going up windy roads. They hill-bomb and crash into my neighbors all the time. The tricky part is, they don't have a license plate.

<comment><USER3> They're also the most likely people to be injured by their unsafe behavior, whereas car drivers injuring vulnerable road users (pedestrians, cyclists, motorcyclists) would most likely be harming others only.

<comment><USER2> Yeah, its a tricky situation. If a cyclist runs into a car, the driver of the car will survive and feel the guilt of taking out the cyclist. I really hope I never meet one of the hill-bombers that way. They are not just playing with their own life, they are affecting others.

</comment></comment></comment><comment><USER4> If you want more solid evidence of unsafe driving, you could mount an ultrasonic distance sensor to your bike: [http://codaxus.com/c3ft/c3ft-v3/](http://codaxus.com/c3ft/c3ft-v3/)</comment>


Economics Nobel Prize Winner Sees No Singularity on the Horizon - <AUTHOR> https://spectrum.ieee.org/tech-talk/computing/hardware/abc-is-a-very-nice-alphabet <comment><USER2> Singularity would be a kind of scientific and technological network effect across different technologies. Each advance speeds up another.

It's now clear that humans are the bottlenecks in this scenario. We learn new stuff at very low rate. Groups of people learn new methods and technologies even slower rate.

There is huge increase of possibilities in statistical methodology. You can do causal discovery, probabilistic programming, machine learning... All these advances are adopted into different fields at very slow pace while many fields still struggle with p-values.</comment>


Why Facebook is the New Yahoo - <AUTHOR> http://www.datamation.com/networks/why-facebook-is-the-new-yahoo-1.html

<comment><USER2> Listen, I'm no fan of Facebook but this article is pure flame-bait.

Death by a thousand paper cuts may be a fun way to look at how Facebook could eventually bite the dust, but I think it's simpler. Eventually companies are going to figure out that they need to stop turning things inside out and technology will carry human social interaction _instead_ of human social interaction carrying technology.

The distinction can be subtle, but consider a world where you don't think about the company and technology enabling you to share a moment with a loved one. Do you think about which phone network is carrying your phone call (until it drops)? In the future you probably won't think about checking Twitterbook+, it will all just _happen_.

<comment><USER3> > consider a world where you don't think about the company and technology > enabling you to [...]

And yet people (at least here in the US) have a tendency to apply brand names as generic technology (i.e., "to xerox a paper", "google a term").

So the counterbalance to your argument is that sometimes when a brand is so pervasive, it is synonymous with the technology.

Not sure that's the case for Facebook, but the possibility exists it might be.

</comment></comment><comment><USER4> This article is just one eye-roller after another, but if I had to pick out one that really made my jaw drop:

> _The company's engineering isn't especially impressive._

Buddy, your writing isn't especially impressive, and your armchair engineering is impressive only in its astronomical ignorance. The scale at which Facebook operates, volume of data and requests, and cacheability profile of its page views, and its development velocity makes it possibly the _most_ impressive web company in terms of engineering. Granted Google and a handful of other companies are up there as well doing different, and possibly slightly more impressive stuff depending on who you ask, but to suggest Facebook's engineering is middling just paints you as a giant tech buffoon.

<comment><USER5> Great engineering to _support success_ does not equate to engineering to _create_ success in the first place.

<comment><USER4> Engineering does not create success, it prevents failure.

</comment></comment></comment><comment><USER6> I don't think Facebook has launched any successful feature or product since the Like button. Even the Facebook commenting system has failed. Techcrunch is the only site I've seen using, and it's actually the reason why I dramatically lowered my visits to their site in the beginning (other reasons came later). Fred Wilson has said this, too, in a recent post.

<comment><USER7> Clue me in about Facebook comments (I'm considering using them on a current project).

Why do you consider them a failure?

I thought Like + comments was pretty damned brilliant, because they make FB part of the infrastructure of so many sites. Plus, anecdotally, every time I turn around another site is rolling out the comments in a big way (like the LA Times recently did).

</comment></comment><comment><USER8> Trolling journo on a deadline. I worked at Yahoo for 4 years, off and on. I have worked at FB for almost 2. The companies are almost nothing alike, inside or out.

And does he really think that Facebook and Skype slapped together an integration in one week in response to G+?

<comment><USER9> Groups and lists also existed months before the first G+ announcement. Hard to copy something you don't know about.

<comment><USER10> FB groups are totally different to G+ groups. For a start, they're a misnomer: it's not a tool for you to group your social network with. Instead, it's this really horrid kind of "interest group" idea, except it revolves around you, and instead of people joining, you include them. Yuck.

FB lists are kind of like G+ groups except they're a PITA to setup and you have to go out of your way to use them when sharing something.

Another thing I hate about FB is the way the entire service is about sharing everything. You have to be really really careful not to overshare anything. In G+ I know exactly what I'm sharing and with whom.

Screw you FB. I hope you die in a fire.

<comment><USER9> I was referring to this claim in the article: "Knowing that Google+ would use "circles" to segment actual social networks ("Family," "Friends," "People I Secretly Despise," etc.), Facebook launched Groups and Lists, which hardly anyone used." FB couldn't have copied G+ for Groups and Lists because G+ hadn't been announced when those features launched.

</comment></comment></comment></comment><comment><USER11> I wrote a similar article back in April but from a financial perspective [http://johnstanderfer.com/2011/04/25/is-facebook-the-next- ya...](http://johnstanderfer.com/2011/04/25/is-facebook-the-next-yahoo/)

I don't have any strong opinions on Facebook's current and future technology plans. What I do know is that what is publicly known about Facebook user numbers and finances makes them far more similar to Yahoo than Google.

</comment><comment><USER12> >Now Facebook's desperate new strategy appears to be: Just copy Google+.

oh, really. Because Google+ is successful??

<comment><USER13> In a way, yes. There was lots of public validation for some of G+ features.

<comment><USER14> Don't know why you're getting downvoted. Lot of people really _do_ like G+ features (circles, followers etc). And you didn't say that G+ is successful.

</comment></comment></comment><comment><USER15> I really hate when people so casually write off a company as a failure.</comment>


Ask HN: Start-up Equity For UX co-founder - <AUTHOR>

I am currently building a mobile app with the help of two friends (One UX guy and one coder). These guys are working on deferred payment basis and will help me transition to an in-house team. (They will not transition to a full time position)<p>Plan is to get a working prototype and initial customers + seed funding from a known angel. Then bring on a UX person as a co-founder. How much equity should I be giving out to this person? P.S : There will be no salary initially. <comment><USER2> If you've developed it to the point of product and seed funding, then you can justify holding out equity pretty easily. I would suggest that you offer a third. You need to be generous because if they're going to be a co-founder then you're going to need them to have a honest stake in the company otherwise they won't take it seriously.

It might suck because you feel that you did all the work, but you're going to need a long term view.

I had a hard time accepting this in my past experience partnering with people so the venture eventually failed.

<comment><AUTHOR> Thanks for your views formosa.

What if this person comes on board just for UI/UX? How much would you give him?

My problem is that this UX person will come through references. And its risky to make someone co-founder (i.e. give a reasonable stake in the company) without having worked with them in the past.

Thanks Arjun</comment></comment>