Star Trek: The Next Generation Was the Last Sci-Fi Show Hopeful About the Future - <AUTHOR> http://www.esquire.com/blogs/culture/star-trek-the-next-generation-future <comment><USER2> The most fantastic aspect of Star Trek isn't warp drive, teleportation, or replicators. It's a competent bureaucracy.

Starfleet seems to be just that: competent, usually very trustworthy, fair, and honest. Almost equally unbelievable is a society that isn't incredibly emotionally dysfunctional. There is little in the way of psychopathy, narcissism, addiction, unhealthy ideological fanaticism, or depression on display among the protagonists.

Cyberpunk has proven to be the most prophetic of the sci-fi genres by far. It's done that by being technologically optimistic and socially pessimistic. So far it seems right on-- technology continues to advance, but globally it looks as if the normal arc of society is from freedom to despotism followed by a decay into syndicated criminality. The mafia state -- almost exactly as depicted in the common cyberpunk setting -- looks like the ascendant future. If there are warp-driven starships in the future they will likely be flown by the various factions of the Russian mob, the American criminal overworld, Los Zetas, Chinese Triads, and of course the Yakuza. If they look like contemporary business and governmental organizations, the captain will be a narcissist/psychopath and his immediate subordinates fawning codependents.

<comment><USER3> I watched "Star Trek: Into Darkness". At first I was like "Kirk should be fired." Then I was like "Everyone on the Enterprise should be fired." Then I was like "Everyone in Starfleet should be fired." Then I was like, "Wow, I've never wanted to fire an entire civilization before, and this movie has given me a new appreciation for the importance of rules and regulations in real life."

<comment><USER2> The competent bureaucracy part is really the lynchpin. Because bureaucracies are so incompetent, criminal syndicates just run circles around them. This is why the mafia state looks like the logical endpoint-- basically anarcho- syndicalism, and it's not a utopia. I think this is also why the most bureaucratic states -- the USSR and Communist China -- have been the first into this brave new future. The criminal mammals triumphed easily over those byzantine dinosaurs.

The bottom line is that we have the scientific method and we have the discipline of engineering, and those together can reliably produce progress in the technical realm. We have _no_ set of tools or techniques that reliably produces progress in the human realm. There are no institutions charged with understanding and healing us psychologically. The closest we come is to pop pills, and even that is poorly done -- diagnosis is incredibly unscientific and haphazard.

I personally blame -- directly and indirectly -- the war on drugs. I am not one of those people who thinks that dosing everyone with LSD would create some kind of utopia. I've known too many drug users to think that. But beneath the pop culture misuse of those substances, there was some _really_ visionary research into genuinely understanding and even changing deep human psychology at work back in those days. The ridiculous moral panic that followed had the effect of shutting down almost all of that research, even some of the non- psychedlics-related stuff, and leaving us with nothing but talk-talk psychotherapy and the ham fisted pill pushing approach. To this day attempting to delve deeply into human psychology in an active way immediately leads into realms since declared utterly taboo.

<comment><USER4> There is a point of view that Stalin and Mao were essentially criminal in a way that national leaders have not been since the 19th Century. So a Putin and whatever they have in China actually represents a modicum of progress. Russia's history at the level of empire is pretty nasty.

We may never be able to get out of our own way. Who knows? Not a big pill fan ( although they've absolutely gotten better for people with real brain- chemistry problems ) but these days, it's easier than ever to identify bad sources of information and understand what's gone wrong. My parents' (Silent) generation had no idea why there was a Depression; mine actually has a few theories.

The emphasis on LSD as "better living through chemistry" was as much about advertising-propaganda as anything else. Regardless of any War on Drugs, that went badly.

</comment></comment></comment></comment><comment><USER5> I watched most of TNG, but I don't consider myself to be really into the series. One of the things that I found odd about it was how externally-focused it was - everything seemed to be about various alien species and unknown astronomical phenomenon, with almost nothing about what this Federation that they all serve is and how it really works. All I remember is drips and drabs of that, which is a shame, when there are so many ideas that could stand to be explored.

Like what exactly is a replicator, and how does it work? The fine details of that would all have massive effects on what the society as a whole looks like. Can anybody replicate anything on them? Including weapons and drugs? If not, who decides what they can make, and how do they enforce it? They presumably require energy, and where does that come from? Is there a limit to how much stuff a person can make?

This also gets into the rather odd and poorly fleshed-out idea of a society without money. Exactly how does this society work without money? Books can and have be written on ideas around this, but it's just kind of casually thrown out there, with no exploration of the implications on how the greater society functions.

<comment><USER6> >Like what exactly is a replicator, and how does it work?

It takes matter, and rearranges it into something else less boring. Using science. Ish. Things. Lasers.

>Can anybody replicate anything on them?

Depends on the episode.

>Including weapons and drugs?

I think certain weapons were impossible to replicate but you certainly could crank out as many guns and knives as you liked. But of course, being a utopian society, such things would be unthinkable, so it's not an issue.

>If not, who decides what they can make, and how do they enforce it?

Nobody. It's a perfect society. Everyone is nice and peaceful because they choose to be. No wars (with other humans - aliens are fine), no famine (except for that one thing in the original series), no money (or something). They just use the replicators and holodecks for aggressive but entirely wholesome and not at all sexual sports and research and interactive fiction, because the humans of the future have evolved beyond the need to be interesting. Except for Barclay. And La Forge, because one time he created a holodeck model of this girl he had a crush on. Which was awkward when she showed up and he had forgotten to close his porn folder.

>They presumably require energy, and where does that come from?

...subspace or something. Dilithium. Quantums. Shut up.

>Is there a limit to how much stuff a person can make?

Probably just the size of the replicator console thing. And energy. By Voyager they had entire starships made up of holograms so who knows?

Like a lot of post-scarcity ideas, to me, Star Trek essentially ran on magic. A lot of that had more to do with the necessities of sci-fi on a low budget (the only reason transporters existed, for instance, was to they didn't have to spend effects money on shuttlecraft) than thinking hard about actually making it work. It just _did._ The holodeck, literally, could create self- aware sentient beings if you asked it to. Riker got cloned when a transporter beam reflected off the clouds of a planet or something. The Enterprise got pregnant and had a space baby. That was a thing that happened.

No one cared enough about science fictional speculation to actually try fleshing things out, because that would take time, cost money, and potentially mean taking dramatic risks. Rather, they just came up with a new particle, or kind of energy, or swirly whatever, of the week that would defeat the monster, or other swirly whatever, of the week. Now and then they would just drop the ball on some potentially awesome plot points, like the aliens invading from subspace that snatched people out of their beds and did surgery on them (real creepy stuff) or the Ikonian Empire (apparently a big deal, left magic portals everywhere, completely forgotten about) or the parasites mind-controlling certain Federation higher-ups (leading to the only head-explosion in Trek history.)

But the truth is, the "science fiction" was just stage dressing for utterly banal drama. Probably the books got into it more deeply. The Borg was nice though, until it wasn't.

Edit: I shouldn't say 'no one cared.' Reading blogs by people like Doug Drexler, clearly a lot of people cared, just all too often the plot didn't seem to permit much complexity or insight.

<comment><USER7> I think it's telling too that the vast majority of the fanfic I've seen seems to be fantasy romances between various characters rather than exploration plots or stabs at technical explanations or something non-banal.

Sure we get the Starfleet Technical Manual, but that was tossed as non-canon almost as soon as it hit the stores.

</comment></comment></comment><comment><USER8> Not a bad article. It is worth noting that TNG was super soft-sci-fi not "real" sci fi and as such reflects its era's social commentary, nothing more, no alternative universe type of effect which is so interesting about hard sci fi.

Don't have to limit consideration solely to Trek series to see a growing pessimism about the future from a cultural perspective. A smooth drift across all cultural properties from utopian to dystopian futures.

If you do want to have a tech talk about Trek, specifically TNG, its fun to recall tech of that era. I had an old XT class PC and watched it on a Sony Japanese made 12 inch SD TV, and for the TNG premiere, they simulcasted the audio on a local FM radio station in stereo, which sounded pretty awesome. Then after an episode I'd dial into a local BBS and discuss, of course a BBS being a BBS that means a good discussion takes about a week, which is just about right... About two years into the series I got access to usenet and eventually a SLIP account on the internet (SLIP being kinda like a static configured by hand networking parameters with out-of-band authentication, but otherwise kinda like PPP, of course in this post-modem era maybe PPP is becoming unknown?).

<comment><USER9> On the other hand, by the last episode in 1994, I was spending around eight hours a week in transatlantic multi-party video conferences over the Internet using IP multicast. That and this little thing called the web had already taken off. Looking back, a lot changed in the early 1990s.

</comment></comment><comment><USER10> Sci-Fi is commentary on the present, or the near future.

Even Star Trek (TOS was 60's era Apollo optimisim, ST:TNG was 1980's "Communism is falling"/We're getting okay with Russia/The Economy is booming/Roddenberry said so!)

The reason why today's SciFi isn't hopeful is that there are lots of very easy to see bad ways today turns into tomorrow, and not very easy to see good ways.

I honestly think self driving cars will make life _crazy_ better for instance. But there isn't Sci-Fi to write about that is interesting enough to publish or make a show about with that premise. Or for 3d printing. etc

<comment><USER11> >Or for 3d printing. etc

There's The Diamond Age, which is moderately optimistic, and other molecular nanotechnology-related fiction.

<comment><USER10> But was written 20 years ago. Certainly within memory of many readers who'd be alive today, but certainly missing many important themes that could be explored to extrapolate from today.

</comment></comment></comment><comment><USER12> Stargate was pretty hopeful about the future. Although it is somewhat set in the present it does touch on the future quite a few times.

<comment><USER13> In the one episode where they actually did show Earth's future, it was a Brave-New-World-esque dystopia fueled by an alien incursion. (Really good episode in one of my absolute favorite franchises) I agree that it's generally optimistic but it's hard to say that the characters had any faith in humanity in general, since they keep the whole program a Military secret.

[http://stargate.wikia.com/wiki/2010_(episode)](http://stargate.wikia.com/wiki/2010_\(episode\))

</comment></comment><comment><USER14> Some one should make a series out of Iain M. Banks Culture novels. I find them very optimistic regarding technological advancement, its societal influence and liberal coexistence of minds of very different kinds and power.

<comment><USER15> I rather liked David Brin's take on the Culture:

"...Culture Universe was among the few to confront straight-on the myriad hopes, dangers and raw possibilities that might be faced by a humanity-that- succeeds."

[http://davidbrin.blogspot.co.uk/2013/06/science-fiction- lame...](http://davidbrin.blogspot.co.uk/2013/06/science-fiction-lament-then- optimism.html)

NB If anyone wants to get a quick taste of the Culture visiting the Earth the BBC Radio 4 version of "The State of the Art" is available on YouTube:

[http://www.youtube.com/watch?v=IRl9D_agLbU](http://www.youtube.com/watch?v=IRl9D_agLbU)

</comment></comment><comment><USER16> "The Heisenberg uncertainly principle means that transporters like the ones in Star Trek are physically impossible, at least in terms of the physics that we understand. But that didn't stop Roddenberry and friends. They just assumed that human beings would figure out some way to "compensate" for the physical laws." From what I've read, that's somewhat of a generous and optimistic view. My understanding was that the transporter was created purely as a money-saving feature, as they didn't have the budget to create planetary landing effects on a weekly basis. The Heisenberg compensator circuits were a convenient piece of techno-babble in an attempt to hand-wave the underlying physics problem of transporters away...

<comment><USER17> Via Memory-Alpha:

> _When asked by Time magazine in 1994, "How do the Heisenberg compensators > work?" Michael Okuda replied, "They work just _fine, thank you."

I suspect the article being referenced is "Reconfigure the Modulators"[1], but it's behind a pay wall so I can't confirm that.

[1] [http://content.time.com/time/magazine/article/0,9171,981892,...](http://content.time.com/time/magazine/article/0,9171,981892,00.html)

</comment></comment><comment><USER18> Babylon 5's ending had a lot of downs, but it did end in a good place for humanity.

</comment><comment><USER19> When it comes to storytelling, conflict is inherently more interesting than the alternatives. I can't help but feel that this explains most of what's going on here.

<comment><USER2> There are many forms of conflict. Optimistic visions of the future often portray a healthy, competent humanity vs. some unknown danger, mystery, or challenge.

<comment><USER19> I agree. But I think those kinds of stories are harder to write, especially for television shows that need scripts for dozens or even hundreds of episodes.

</comment></comment></comment><comment><USER20> Star Trek: Enterprise was incredibly optimistic.

</comment><comment><USER21> Neal Stephenson makes a similar point in this interview:

[http://damiengwalter.com/2014/05/07/nealstephenson/](http://damiengwalter.com/2014/05/07/nealstephenson/)

<comment><USER22> Pretty weird, considering he's rather strongly steeped in the post-cyberpunk weirdtopian tradition.

</comment></comment><comment><USER23> I think Internet made us not so naive about the future considering how we really are, specially after we get some kind of power. And the present is making us even more pessimistic about it.

</comment><comment><USER24> I can't find it now, but I remember a brilliant comment on reddit that described the theme of TOS and TNG as being about _"what it means to be a hero in a utopian age"_.

</comment><comment><USER25> _In 1994, technology was a part of our lives, but it did not dominate us completely. So it was possible for Star Trek: TNG to imagine a world in which we, as people, stayed much the same, but the worlds in which we traveled expanded infinitely outward. Technology for the past twenty years has relentlessly driven inward._

It's so interesting to me that commentators keep making this same point over and over again, and the only answer we get is "But we'll just make even cooler tech, and it'll all work out."

I don't think so. I think the time of man is at a close, whether we evolve past it or self-terminate. Billions of years of evolution has created this species of hominids that travel in packs. We are, instead, trying to re-make ourselves in something closer to the Borg. It's not going to end the way we expect it to.

</comment><comment><USER26> I liked mostly all the Star Treks, but it bugged me that the later ones became so militarized. Zeitgeist of a post 9/11 world I supposed. I loved the optimistic future painted in TNG.

<comment><USER27> > _" the later ones became so militarized. Zeitgeist of a post 9/11 world"_

Both DS9 and Voyager were completely wrapped up prior to 9/11\. Enterprise struck me as far less militarized -- though far more competently written (it gets off to a slowish start, but the later seasons are great). And the original was probably written in part by people with naval backgrounds (note how people are constantly handing Kirk clipboards to sign off on, there's a fire control room that weapons fire is sometimes directed through, etc.)

I think the only thing that fits your pattern is Star Trek: Into Darkness.

<comment><USER6> I believe Gene Roddenberry was in the Navy. I'll probably be downvoted into oblivion if i'm wrong though. CBA to google it.

</comment></comment></comment><comment><USER28> Futurama could be considered at least partly hopeful, but I suppose that doesn't really count?

</comment><comment><USER29> From whose perspective is living a militaristic fascist communist state dressed in onesies hopeful?

<comment><USER30> You've never seen the show have you?

<comment><USER29> Which part of the description do you feel was inaccurate?

What I see is on the show is a glorified militaristic hierarchy and an audience of fans whose greatest wish is to be the guy giving the orders. It's the kind of thing the Star Wars Empire would fund as state propaganda.

<comment><USER31> > Which part of the description do you feel was inaccurate?

Militaristic -- even Starfleet, the main "military" in the federation, seems to (despite the fact that it fights wars, has military ranks, and military process like "courts-martial"), maintains a myth that it _isn 't_ military. The society is so anti-militaristic that it can't even admit that it _has_ a military.

Fascistic -- Aside from militarism (discussed above), a defining element of fascism is _nationalism_. It'd be hard to think of a society _less_ nationalistic than the Federation.

Communist -- Rather than a planned economy, people seem pretty free to chose their own pursuits and applications of productive resources.

State -- while it clearly has institutions like Startfleet, its not clear that the Federation _is_ a state as we'd understand it, rather than an international institution with sovereign members like the UN.

About the only part of your description that _is_ roughly accurate is the "dressed in onesies" part.

<comment><USER30> The poster clearly hasn't really watched the show, without a doubt spouting off something that sounded 'edgy' for the sake of it.

Nice rebuttal by the way!

</comment></comment></comment></comment></comment><comment><USER32> It surprised me to only see Gene Roddenberry mentioned in an aside....

</comment><comment><USER33> Most sci-fi shows men kind in good form controlling a few plannets around. I would call it great success.

<comment><USER34> Just suggesting that we'll control a lot of real estate isn't much of an optimistic view of the future. Historically, exploration and colonization went hand in hand with subjugation.

<comment><USER35> That's assuming we'll find inhabited planets. Current research seems to indicate that we'd have to be quite lucky to find 5 terraformable planets (not supporting life, but could be if artificially managed) in a 10-lightyear cube.</comment></comment></comment>


Refer someone smart, win a free decade of github - <AUTHOR> http://www.rglabsinc.com/#github

<comment><USER2> Here's to GitHub being around in a decade :-)</comment>


Ancient Dog DNA Reveals Close Relationship with Contagious Cancer - <AUTHOR> https://www.scientificamerican.com/article/ancient-dog-dna-reveals-close-relationship-with-contagious-cancer/ <comment><USER2> _...Through the 1950's and '60's Chester Southam, an oncologist at Memorial Sloan Kettering Cancer Center, experimentally injected cancer cells into more than 300 people, often without properly informing them. Some subjects, which included prison inmates, developed tumors from the injected cells. (Southam was never prosecuted and was later elected president of the American Association for Cancer Research.)_

Three things struck me as odd about this passage: (1) that I had never seen references to this research before; (2) it seems to have been a key experiment in determining that some forms of cancer are communicable; and (3) the lack of outcry, especially coming so soon after the Holocaust.

Southam later had this to say about what he had done, quoted in the NYT:

"It is not necessary to present [the subject] with what you feel are inconsequential data and [it is] unethical to ram down his throat information which is detrimental to his condition."

[https://www.nytimes.com/1964/01/26/archives/many- scientific-...](https://www.nytimes.com/1964/01/26/archives/many-scientific- experts-condemn-ethics-of-cancer-injection.html)

And later:

 _Thirty years later, Southam remained convinced his research was both sound and scientifically important. He was unwavering in his belief that none of the patients injected with the cancer cells would contract the disease.

When I asked, "What if they had?" he calmly replied, "If they did, we'd just cut it out."_

[https://nypost.com/2013/12/28/nycs-forgotten-cancer- scandal/](https://nypost.com/2013/12/28/nycs-forgotten-cancer-scandal/)

<comment><USER3> I'm confused:

        Some subjects, which included prison inmates, developed tumors from the injected cells.

and later

        When I asked, "What if they had?" he calmly replied, "If they did, we'd just cut it out."

So did they or didn't they?

<comment><USER4> Wild ass guess: Some patients developed localized tumors at the injection site, which were eradicated by the host immune system. Thus some could have tumors without really developing a disease we would call cancer

Edit: I've actually seen this exact reaction with subcutaneous injections of tumor cells in mice.

<comment><USER3> Makes sense. Thanks for clarifying the difference.

</comment></comment></comment></comment><comment><USER5> NYT coverage discussed yesterday:

[https://news.ycombinator.com/item?id=17481404](https://news.ycombinator.com/item?id=17481404)

</comment><comment><USER6> Interesting. I thought that Tasmanian devil face tumors were the only directly transmissible cancer

<comment><USER7> I seem to recall there's a certain type of bivalve (clam? oyster?) that suffers it too.

<comment><USER8> /s? These are both mentioned in the article...</comment></comment></comment>


Critical Security Release for GitLab 8.2 through 8.7 - <AUTHOR> https://about.gitlab.com/2016/05/02/cve-2016-4340-patches/ <comment><USER2> Is it just me or has gitlab issued a lot of critical security releases lately?

I'm not sure if this is because they're particularly open about these things or because their product might be particularly insecure.

<comment><USER3> Your comment is weirdly similar to this other comment that I saw in the initial announcement:

[https://news.ycombinator.com/item?id=11593362](https://news.ycombinator.com/item?id=11593362)

<comment><USER4> Since we are doing deja vu, I uploaded some new metrics that better highlights how insane GitLab's churn rate is.

[http://imgur.com/a/4uaSR](http://imgur.com/a/4uaSR)

What's really interesting is the number of contributors.

<comment><USER5> What does this show, exactly? I'm not familiar with this tool and there are no labels.

<comment><USER4> It basically shows how much has changed in GitLab's master branch in the last 30 days. The main metrics is cumulative code churn (lines added, changed, and deleted that does not involve comment or blank lines).

In the first picture it shows the churn was about 24,000 if you don't include merge commits (nomerge:true) and if you ignore changes that were the result of adding/deleting files (action:M).

The numbers with the avatars are basically. First column is number of commits. Second column is cumulative code churn. Third column is percentage of churn that does not involve blank/comment lines.

The second and third pictures shows the code churn as grouped by top level directories. In GitLab's case the most churn occurred in the app directory. And if you drill down to app/assets/javascripts, you'll see the following:

[http://imgur.com/B2GE1yk](http://imgur.com/B2GE1yk)

The charts and metrics basically shows GitLab's code base is changing a lot. This is the churn for Gogs in the last 30 days.

[http://imgur.com/ZmzyMsz](http://imgur.com/ZmzyMsz)

And I guess the question is, is the high rate of change a contributing factor for increased security issues? Statistically speaking, the more code, the more chances for something being missed during code reviews.

It's important to note the metrics isn't saying the quality is bad. It's just saying a lot is changing.

<comment><USER6> A lot is changing since GitLab is rapidly developing. If you have more churn with the same amount of developers that might lead to increased security issues. We've been quickly adding paid developers over the last year, so I'm not sure what that ratio did. Also, some of the churn is due to refactorings, although these are risky in themselves over the long run they increase code quality.

</comment></comment></comment></comment></comment></comment><comment><USER7> Note for admins using Apache 2.4, regarding the manual quick fix described, take into consideration the Apache auth config changes described here [https://httpd.apache.org/docs/current/upgrading.html](https://httpd.apache.org/docs/current/upgrading.html)

</comment><comment><USER8> Gitlab can be run on Sandstorm.io (of which I am tech lead / co-founder). Sandstorm claims to mitigate most vulnerabilities in apps:

[https://docs.sandstorm.io/en/latest/using/security-non- event...](https://docs.sandstorm.io/en/latest/using/security-non-events/)

Let's see how it scores here...

For background, on Sandstorm, each Gitlab project is placed in a separate grain (container), isolated from all others. In order to communicate with a grain at all, you must have been granted some level of access to it by its owner -- Sandstorm does not let you send requests to private grains to which you haven't been given access. So, private Gitlab repos hosted on Sandstorm are basically not vulnerable to any vulnerability.

Of course, Gitlab is the kind of thing you might intentionally make public to all, e.g. to host an open source project. Therefore, it makes sense to analyze whether a public repository would be exploitable.

        Privilege escalation via "impersonate" feature

On Sandstorm, authentication is handled by Sandstorm. The app receives an unspoofable header indicating which user the request came from, and what permissions they have. A well-written app uses this header on every request to authenticate the user.

Unfortunately, our Gitlab package currently uses this information only when a session first opens, then relies on the session cookie going forward. This pattern is sometimes used as a "hack" on Sandstorm to more easily integrate with existing login code designed to do upfront / one-time authentication. As such, public Gitlab repositories hosted on Sandstorm would be vulnerable.

Had Gitlab on Sandstorm been implemented "properly", it would not be vulnerable. That said, the "impersonate user" feature would not have worked at all. That's probably for the best: a feature like this really ought to be implemented by Sandstorm itself, which would have the ability to implement it (securely) across all apps at once, rather than have each app implement its own version.

Somewhat embarrassingly, the Sandstorm package of Gitlab actually predates this feature being added, therefore Gitlab instances on Sandstorm today actually aren't vulnerable. (Generally, if the upstream app author does not directly maintain the Sandstorm package, then the Sandstorm package will tend to fall behind. This should get better as Sandstorm gains popularity and upstream authors target it explicitly.)

        Privilege escalation via notes API
        Privilege escalation via project webhook API
        Information disclosure via project labels
        Information disclosure via new merge request page

These vulnerabilities allow a user to manipulate a private project to which they aren't supposed to have access. On Sandstorm, a private project would live in its own grain, and if you hadn't been given access then Sandstorm would deny you the ability to talk to the grain at all. Therefore, these cannot be exploited.

        XSS vulnerability via branch and tag names
        XSS vulnerability via custom issue tracker URL
        XSS vulnerability via label drop-down

These vulnerabilities require that you have write access to one project on the server in order to launch an attack. On Sandstorm, since every repository is its own instance, the attack would be limited to the repository on which you have write access -- you would not be able to use this attack to damage someone else's Gitlab repository on which you lack write access.

        XSS vulnerability via window.opener

This is a subtle phishing issue that is very widespread. However, it mostly doesn't work when the opener is a sandstorm app: the app lives inside an iframe which is prohibited by Content-Security-Policy from browsing away from the server.

        Information disclosure via milestone API
        Information disclosure via snippet API

A public project hosted on Sandstorm would be vulnerable to these (leaking confidential issues attached to public milestones, and leaking private snippets attached to a public project). Sandstorm can only enforce access control at the grain level; anything finer than that is up to the app, and is subject to app bugs. I generally recommend that Sandstorm users try to put confidential data in separate grains from public data -- e.g. creating a separate issue tracker for confidential issues.

(The Sandstorm packaging again predates the milestone bug's introduction, though may be affected by the snippet issue.)

We will update the Gitlab package tomorrow. Once an update is pushed, every Sandstorm user will receive a notification within 24 hours and can apply the update with one click.

Conclusion: Sandstorm mitigated 8/11 issues by design, 2/11 by accident, and is vulnerable to 1/11\. The biggest issue was only mitigated by accident in this case, although a well-behaved Sandstorm app normally wouldn't have this kind of issue by design. Overall, though, I'm disappointed in Sandstorm's performance here -- it's much worse than the usual 95% mitigation rate.

<comment><USER9> From [https://sandstorm.io/install](https://sandstorm.io/install)

> Run this in a terminal:

> curl [https://install.sandstorm.io](https://install.sandstorm.io) | bash

kthxbye

<comment><USER10> No need for the rudeness.

I always get bothered when people bring up the `curl [...] | bash` "argument" (which is usually less of an argument and more of a rude dismissal of a good product).

Sure, the script downloaded with curl should be validated.

Not sure, but I'm pretty sure you don't validate every tarball you download, and even if you do validate them, you certainly wouldn't look through each line of code making sure there isn't a backdoor or something.

Any malicious person could break into a tarball download site, and replace the checksums as well (only way to mitigate that is using a signature that is associated with the tarball maintainer), and even if something like PGP is used, the attacker would be able to replace the instructions to obtain the PGP key with their own generated one, or even remove the signature completely.

This is, of course, the same for curl piped into bash, but my point is that it's only slightly worse than an unsecured package site (which I'm sure there are many of). The only thing worse about it is that it's less noticeable when the script has been replaced.

Also, some scripts (such as the rvm installatio script) /require/ PGP to be used for the installation to even start.

In conclusion, please don't be rude and dismiss an entire product because of a single installation method, which isn't actually worse than a malicious tarball.

<comment><USER11> > I always get bothered when people bring up the `curl [...] | bash` > "argument" (which is usually less of an argument and more of a rude > dismissal of a good product).

Why? Package managers were created for a reason. Virtually every Linux distribution anyone would use to host a service such as Sandstorm will include a package manager.

> Not sure, but I'm pretty sure you don't validate every tarball you download, > and even if you do validate them, you certainly wouldn't look through each > line of code making sure there isn't a backdoor or something.

I don't download tarballs. I install packages. Who downloads tarballs to install software in 2016?

Anyone actively developing for a project will likely be using git, and I'm not aware of too many projects which make use of toolchains which are so new that they're not available in any rolling release/testing distro.

> Any malicious person could break into a tarball download site, and replace > the checksums as well (only way to mitigate that is using a signature that > is associated with the tarball maintainer), and even if something like PGP > is used, the attacker would be able to replace the instructions to obtain > the PGP key with their own generated one, or even remove the signature > completely.

Yes, fine. And that's why all major distributions sign their packages, so you know that it's valid. Again, it's 2016, who seriously installs software from tarballs?

> The only thing worse about it is that it's less noticeable when the script > has been replaced.

No, what is _much_ worse than that is you are installing software outside of your package manager. Also, companies who deploy via curl | bash, typically pull in their own dependencies outside of the package manager.

It's bad form.

If your application has specific dependencies, then ship it as an appliance using LXC, Docker, or $TRENDY_CONTAINER_TECH. That way, all updates are atomic and you don't risk eff-ing the OS by pulling in a bunch of stuff outside of the package manager.

> In conclusion, please don't be rude and dismiss an entire product because of > a single installation method, which isn't actually worse than a malicious > tarball.

In conclusion, package management is a solved problem. Companies which have installers which do not make use of the distribution's package management system are lazy, and anyone who defends curl | bash is an apologist.

Seriously, it's not difficult to generate a DEB/RPM/<insert distribution package format> and create your own signed repo. Package management has been a solved problem for at least a decade.

It annoys me that companies think it's okay to have curl | bash as an installation method. If they think that will ever be acceptable in an enterprise environment where change management is important, they're delusional.

<comment><USER8> > Virtually every Linux distribution anyone would use to host a service such > as Sandstorm will include a package manager.

Yes, but:

* Most of them ship on a 6-month or even 2-year release cycle whereas Sandstorm updates every week.

* Most of them will not accept a package that wants to self-containerize with its own dependencies, which means Sandstorm would instead have to test against every different distro's dependency packages every week, whereas with self-containerization we only depend on the Linux kernel API -- which is insanely stable.

* If we publish the packages from our own repo, we're back to square one: how does the user get the signing key, if not from HTTPS download?

* Sandstorm actually _has_ a PGP-verified install option: [https://docs.sandstorm.io/en/latest/install/#option-3-pgp-ve...](https://docs.sandstorm.io/en/latest/install/#option-3-pgp-verified-install)

* You should probably be installing Sandstorm in its own VM anyway.

I'm certainly not saying curl|bash is perfect. There are trade-offs. For now this is the trade-off that makes the most sense for us. Later on, maybe something else will make sense.

> If they think that will ever be acceptable in an enterprise environment > where change management is important, they're delusional.

We've never had an enterprise customer comment on this (other than requesting the PGP-verified option, which we implemented). The vast majority of complaints come from HN, Twitter, and Reddit. ::shrug::

<comment><USER11> > Most of them ship on a 6-month or even 2-year release cycle whereas > Sandstorm updates every week.

That's fine. Run your own repo where you control the release cycle. Puppet does this. GitLab does this. PostgreSQL does this. Sandstorm does _not_ do this.

> Most of them will not accept a package that wants to self-containerize with > its own dependencies, which means Sandstorm would instead have to test > against every different distro's dependency packages every week, whereas > with self-containerization we only depend on the Linux kernel API -- which > is insanely stable.

GitLab ships an omnibus installer with their CE/EE product, and it works great. I don't see why Sandstorm couldn't also publish an omnibus installer which contains all the dependencies, in essence creating your own container in somewhere neutral like /opt

This way, you have atomic releases you can install. How do I select the version to install with 'curl | bash' without user interaction?

> If we publish the packages from our own repo, we're back to square one: how > does the user get the signing key, if not from HTTPS download?

Publish your signing key as a distribution package. This is what most organizations do (e.g. EPEL, PostgreSQL, Puppet).

Then the user does 'apt-get install sandstorm-release', 'apt-get update', 'apt-get install sandstorm' and you have an authenticated release.

Your signing infrastructure should be secure enough that you don't have to change the signing key within the major release cycle of a Linux distribution anyway.

> You should probably be installing Sandstorm in its own VM anyway.

This isn't an excuse for 'curl | bash' installs. If they want to recommend that their customers run the product in a VM or container, they should provide appliance/container images, as well as packages.

> We've never had an enterprise customer comment on this

I am in enterprise, although I'm not a sandstorm customer. I will tell you that one of the first considerations when deciding on a product is how well it fits into our existing infrastructure. If I can't push a repo and install a specific version of the software, tested and known working, using puppet, it's not getting deployed in our org.

Perhaps the reason none of Sandstorm's enterprise customers are asking for packaged installers is because every enterprise customer who expects a packaged installer sees Sandstorm's installation method and decides not to use it.

</comment></comment></comment></comment></comment></comment><comment><USER12> Thanks for the release! We updated the cloudron.io app to use 8.7.1 we well. Cloudron users will get GitLab auto-updated tonight.</comment>


Valuing Cryptoassets from the Ground Up - <AUTHOR> https://medium.com/@sall/valuing-cryptoassets-from-the-ground-up-441ad5a9ff03 <comment><USER2> But are cryptoassets distinct enough to be considered separately?

So to take your example of gold, if BTC is gold, then is ETH more like silver or more like a new source of gold? If ETH is silver then there will be some base demand for ETH separate from BTC but if ETH is just more gold then all we've done is drastically increase supply. To me it seems that demand for specific cryptocurrencies isn't really that high while demand for cryptocurrencies in general is, that makes ETH and BTC seem both like gold to me and that makes me question the fundamental notion that the appreciating cryptos have supply restrictions.

</comment><comment><USER3> I've always struggled with this idea that people are trying to apply logical models to illogical situations. Ideal buying size is not going to save you from a 10 minute pump and dump.

Optimal holding percent is not going to protect you against a total whale coming in and selling off because they're bored of the currency.

Trading is based on emotion and the control of that emotion. Buy into technology you understand and find valuable. The only calculation you need is to know what you're willing to lose and set your stop loss, everything else is a bit of a waste in my opinion.

</comment><comment><USER4> > ETH executes all VISA payments

> ETH Value: $0.088

(There are 100M ETH)

Correct me if I made a mistake, but it seems like this is not a stable market. What's to stop me from buying a large chunk of the supply and sitting on it? That would increase the value of my ETH because VISA throughput would have to be maintained. Many others would come to this same conclusion, driving the price up massively.

<comment><USER5> Right, this would place the value of the ETH network at $8.8 million if it were processing all VISA payments. Something is wrong with the author's math or conclusions on that point. The value of processing as many transactions as VISA should be self evidently worth billions.

Another factor in crypto is that especially with proof-of-stake coins (like ETH is heading toward), part of the security of the protocol is in the expense of doing a hostile takeover of the network. A paltry $8.8 million valuation would presume that someone with as little as that could buy up all the supply (or 51%) of ETH and take effective control of the network.

You're right that attempting to do so would drive up the price, very rapidly.

Another sweeping point the author makes without backing up is the idea of "infinite competition" in the crypto space. Yes, anyone can fork BTC or ETH and make their own coin, but miners, stakers, exchanges, users, app developers, etc, won't necessarily flock to it. "Trust" is not built into the protocol.

I have no faith that someone who clicks the "Fork" button on Github necessarily has any idea how to run, maintain, secure, and grow a blockchain into doing something unique or novel. And I wouldn't stake my business or assets on it, per se, unless I was convinced that a team of people and a community was able to spring up around that blockchain.

Network effects matter, especially in crypto-assets. I trust the BTC network, because it's gone 9 years without a major exploit. I trust it because of the community, network, and ecosystem behind it. To act as if a fly-by-night crypto can swoop in and steal that crown so easily is foolish. Anyone can make a Linux fork, doesn't mean you're going to dominate the desktop market.

<comment><AUTHOR> It's a good point that the low market cap could lead people to try to buy a controlling supply. I explain in the other comment why I think it wouldn't be profitable on a pump-and-dump basis. On the basis of control and trust, maybe there still needs to be some assumption that at least 51% is being held by various parties, enough so that the market trusts the network to not manipulate. I need to think about that more. I'm really glad you brought it up.

As for network effects, I find that to be a super interesting question. Because you're right, there are definitely certain levels of trust that existing networks have earned, and there's a good argument for why that creates friction and earns those networks the ability to charge a premium. I personally don't think that extra friction is long lasting. I'd expect that if there were indeed a new solution that accomplished the same thing at half the price, it would get attention and the market would gravitate to it fairly quickly (maybe not within weeks or months, but years? maybe it depends on the timeframe you want to consider, and the level of improvement it provides). But it's a really good point, and something I think about a lot.

<comment><USER4> If you look at it from a utility perspective and discount the network effect, at a certain point, it becomes economically incentivized sharding.

"We accept any of the 2021 or prior World Bank approved ETH forks." Your multi-wallet client automatically chooses the one with the lowest transaction fees (also economically regulated).

</comment></comment></comment></comment><comment><USER6> What about possible protocol-enforced scarcity/supply-side limits even in the potential future "mass adoption" scenario?

</comment><comment><USER7> I see cryptocurrency as a harbinger of AI, which is the real revolution. Blockchain is just a tool. People get really confused trying to understand and develop pricing models for the current state of the world but I see a lot of cryptocurrency value as reflecting the adoption of AI.

The author's equation produces low valuations at high velocity and this suggests a use case for low valuation, high velocity cryptocurrency as a medium of exchange if not a deflationary store of value. I don't think this currency exists yet, though I get lots of pitches for things that want to be this while also trying to justify their own value into the future.

In the early days of crypto, libertarian economists predicted that bitcoin would go to the moon and the USD would undergo hyperinflation. This is clearly not happening. What I think could happen is a relatively stable USD under the guidance of the Federal Reserve and a simultaneous hyperdeflation of ETH and BTC as they become the reserve currency of distributed AI capital organizations.

<comment><USER8> > I see cryptocurrency as a harbinger of AI, which is the real revolution. > Blockchain is just a tool. People get really confused trying to understand > and develop pricing models for the current state of the world but I see a > lot of cryptocurrency value as reflecting the adoption of AI.

This seems like a strange thing to believe. Why do you believe it?

<comment><USER7> I don't see nearly as much use case for humans and cryptocurrency as for AI and cryptocurrency.

I think in the future, the average technologically savvy person will be just as confused about what bitcoin is and does as they are today and it will mostly be used to securitize options and derivatives of unprecedented complexity.

<comment><USER8> Bitcoin is pretty bad at offering advanced securities or derivatives.

Really bitcoin is pretty bad at everything except atomic transfers.

Bitcoin is shit at loans, it's shit at writing wills, it's shit at scheduling payments, it's shit at offering shorts, it's shit at offering options, it's shit at providing oracles etc.

<comment><USER7> Right. I imagine a future where AI capital entities just hold bitcoin and never do anything with it other than hold it forever to secure the things they're doing on the advanced financial platforms of the future.

<comment><USER8> If the only action your AI takes is to hold bitcoin I've been running an AI for many years.

Capital that you can not leverage is a disadvantage.</comment></comment></comment></comment></comment></comment>


Macchiato: ClojureScript on the Server - <AUTHOR> http://yogthos.net/posts/2016-11-30-Macchiato.html <comment><USER2> How viable would using this be from within clojurescript?

[https://github.com/audreyt/node-webworker- threads](https://github.com/audreyt/node-webworker-threads)

<comment><USER3> It'd be doable but getting a nice Clojure-y API over it would take a little more work.

To start, you could try making a 1-to-1 mapping by closing over the web worker methods with cljs functions. To keep track of the web workers, you could put them in a cljs map inside an atom. This is what servant does to handle web workers.[0]

The other interfaces could be handled in a similar way by closing over methods with functions too.

It might be better after brute forcing a basic 1-to-1 style to create one or more layers of abstraction to make the interop more usable and Clojure-y. There could be cljs deftypes for the threads or web workers which hook into core cljs protocols[1] so that cljs.core functions would work over them. Macros could add syntactic sugar to lower level functions to make your API easier to use (looks like servant did that).

There are lots of options for how to build a good API depending on how powerful an abstraction you want to make for yourself. Getting basic support for the library could work by just closing over functions and adding some glue though.

[0][https://github.com/MarcoPolo/servant/blob/master/src/cljs/se...](https://github.com/MarcoPolo/servant/blob/master/src/cljs/servant/worker.cljs)

[1][https://github.com/clojure/clojurescript/blob/master/src/mai...](https://github.com/clojure/clojurescript/blob/master/src/main/cljs/cljs/core.cljs#L439)

</comment></comment><comment><USER4> Professionally I have most often developed on Node but on the side have been really interested in FP. Applying FP ideas to JS is certainly possible, but this new accessibility of CS to my current world is exciting!

</comment><comment><USER5> Assuming a commercial web application, appropriately sized hardware, and correctly optimized code, when is "footprint" a significant disadvantage? How is "footprint" defined? When are startup times a significant disadvantage?

<comment><USER6> Here's a couple significant disadvantages to the jvm.

A simple jvm clojure app running jetting deployed as an uberjar takes about 12 seconds to start on a 1GB digital ocean vm.

Using jvm clojure as with aws lambda, it takes ~20 seconds for a cold start. Normal java is typically a couple of seconds, and it's likely that a cljs/node instance will be sub-second cold start.

<comment><USER7> Note that with Lambda a cold start doesn't have to happen every time - if the function is executed frequently enough, the application will be kept around on the executing node.

Also, if your application has fairly stable load, then startup times are irrelevant 99% of the time, since you can just run persistent servers.

</comment></comment></comment><comment><USER8> Please stop naming projects after drinks :(

<comment><USER4> It's probably a play, similar to the name of CoffeeScript

<comment><USER9> I was going to base it on Express.js originally. Express and espresso were both taken on Clojars, so I that's how I ended up with macchiato. I later realized that I didn't need Express.js after all, but decided to keep the name.

<comment><USER4> Btw, I like the name and it's an awesome project

<comment><USER9> Thanks, I'm really enjoying working on it. :)

</comment></comment></comment></comment></comment><comment><USER10> Can I write Clojure that gets compiled to JavaScript with ClojureScript and run that on JVM's JavaScript engine Nashorn?

Obviously turning code into JavaScript at least once is a mandatory requirement for fulfilling the "web" part of "web scale" and running the JavaScript on JVM gives me the "scale" part.

/snark

<comment><USER11> I see the /snark, but I'll answer seriously.

Most JS code assumes it's targeting either a browser or node.js. Nashorn is very barebones, and can't pass for either. trying to run core.async on Nashorn didn't work for me because it expects either Window.setTimeout (which browsers use) or whatever-node-js uses for timers. I expect a large percentage of the libraries you'd want to use will be similarly affected.</comment></comment>


Wattvision (YC W09) Power Monitor: Best Price through Energy Circle - <AUTHOR> http://www.energycircle.com/blog/2010/11/17/wattvision-power-monitor-best-price-through-energy-circle

<comment><USER2> I'd love to buy this thing, but at that price, I can't justify the expense. $49 seems like the sweet spot for me.

<comment><USER3> I'd even pay $100-$150, like for the Blue Line non-networked product.

$50 would be a no-brainer.

Over $200, however, means I'll wait.

<comment><USER4> There's one alternative now at $179, I think (Envi). It's a terribly limited product, and requires a connection inside the breaker panel. Their newly release connection (to Google PowerMeter) seems "gangly" and is still in early release.

BlueLine has the non-connected version (meter connection and display) for $99. But this is only part of the equation, and they have been beating that horse for many years. The new WiFi connected device is OK, but brings the price up to parity with Wattvision, with far more components, and complexity.

</comment></comment></comment><comment><USER5> As a card-carrying member of the fan club I find this quite a treat. Go Wattvision! A monitor on every meter!

</comment><comment><USER6> I love this gadget - we are trying to invest in energy efficiency (as a business - we pay upfront for efficiency improvements and collect a percentage of savings) and this could be a great way to reduce the cost of ongoing monitoring.</comment>


How to DDoS Your Own Website with Python - <AUTHOR> https://acorwin.com/2016/08/09/how-to-ddos-your-own-website-with-python/ <comment><USER2> Neat! How is this distributed if it is only your machine doing the work?</comment>


Vue.js 3 - <AUTHOR> https://v3.vuejs.org/ <comment><USER2> I want to take this opportunity to mention my project template used to create Vue 3 apps without the need for Webpack or any other build tool:

[https://github.com/arijs/vue-next-example](https://github.com/arijs/vue-next- example)

I already integrated vue-router, and am currently on the process of fully integrating Vue server renderer. I already have a basic usage implemented, where the home page is compiled to a html string, but I still need to make it easy to compile all pages and to implement client-side component hydration.</comment>


Show HN: Check out our data analysis platform - <AUTHOR> http://www.kidura.com/data_analysis/analysis/list/

<comment><USER2> Fascinating - can you provide details on how the graph is constructed?

I should also add that those visualizations are pretty sweet.</comment>


When Twenty-Six Thousand Stinkbugs Invade Your Home - <AUTHOR> https://www.newyorker.com/magazine/2018/03/12/when-twenty-six-thousand-stinkbugs-invade-your-home <comment><USER2> Great article. There are few things on this earth I absolutely cannot tolerate in any amount: cilantro and these insects. My first exposure to them was in Virginia around 2012. Don't ever take a shop-vac to a huge cluster of them: you'll just blast cilantro stink at an ungodly CFM all over your home.

Now I live in Michigan and have, anecdotally, watched their population skyrocket here. Last year my strategy was simple but worked well because I was diligent about doing it many times a day for a week or two until they were mostly all dead around my home.

I'd put on nitrile mechanics gloves and fill a 2 liter soda bottle with dawn dish detergent and hot water. Shake it up to get some bubbles going. Then I'd wander my home with the bottle collecting the bugs. They'd usually die instantly after getting stuck in the foam. You'd watch them eventually sink to the bottom. I'd either grab one off my home with my left hand (gloved!) or by gently squeezing the bottle, holding it near a bug, and releasing, it would almost suck those clumsy little bastards in with a gentle vacuum.

Put the cap on and let them surely die for a few days. Then pour it out in the corner of the yard and try again.

If I see one I won't rest until they are all dead.

<comment><USER3> Seems like a lot of effort to me. They are pretty lazy bugs. When I find one I pick it up with a tissue and flick it out the window. They are big and dense enough that you can send them really far away from the house.

<comment><USER2> I want them dead. It's very rewarding to dump out 50-100 dead bugs into the trash knowing they won't be reproducing.

<comment><USER4> Yeah honestly that's like scooping a bucket of water out of the Mississippi River and thinking you're helping prevent a spring flood. But I understand the satisfaction anyway.

</comment></comment></comment></comment><comment><USER5> That was a depressing read. As an engineer though I'm already imagining mechanical ways to try to mitigate their population. Given their attraction to warmth I could imagine a cylinder with vents that warms itself to invite in the bugs, then when full it seals itself and flushes with a solvent or incinerates with a gas flame. Once clean it re-opens for the next batch.

No doubt there is something wrong with that but it would be an interesting project to build and figure out if you could exterminate large quantities of these bugs with that technique.

<comment><AUTHOR> The bugs are actually fairly easy to kill: a weak detergent solution in water will do so in a few minutes, and very simple traps based on this.

Adding the concept of some form of bait -- food or heat seem to be the obvious options, might be the bee's knees. I'm thinking of a simple solar concentrator under one of these bait stations to create a warm attractive target (set out in the mid-to-late fall when the bugs are seeking out warmth) and attract the bugs.

For ag: a concentrated essence of whatever it is that most attracts the stinkbugs, with a similar detergent-water trap underneath, around field or orchard perimeters, might serve.

The bulk materials are inexpensive. The attractants, if sufficiently targeted, should not have an excessive impact on other insects.

The wasp angle also seems attractive, though potentially risky (see the cane toad angle from the story).

</comment></comment><comment><USER6> I remember the first few summers they invaded Maryland en masse. They were everywhere, like the article describes. I got pretty good at picking them up with papers and throwing them in the toilet without them spraying their smell.

My mother noticed they were coming through the chimney so she sprayed up there with some sort of bug spray.

Bad idea. Hundreds of them died and fell all at once, each releasing their stink reserves in death. There were several vacuum cleaner bags worth of them. The living room smelled like soapy rotten cilantro for a week.

They were so new, they didn't really have natural predators. I was so happy to see a robin eat one one day. They didn't come back in nearly as great a number after that.

<comment><USER7> Here in Harford county, MD they have annoyed my household each year since 2010 or so. Especially mid fall til end of February.

I was just looking for them today via a scan of my room yet not seeing any... when in season I can just look up and around any room in my house and see one.

Overall they are most annoying and worthless creature on the planet. Maybe they provide a benefit to society yet due to being so annoying and gross any benefit goes out the window for me!

</comment></comment><comment><USER8> Wow. These guys can be found around my property in the summer. I had no idea these were stink bugs and despite handling them when I was younger, I've never smelled anything foul about them.

After some googling, the bug that I am familiar with as a stink bug is also known as a pinacate bug. These are up to an inch and a half long, and I never see more than two at a time. When I thought of 26k of these invading a house, I was shocked. Finding out this other beetle is also a stink bug was fun to learn. I could imagine an invasion of these.

These stink bugs are similar to box elder bugs, a kissing beetle, which can swarm when it warms up. These guys, I've had collect up in window sills. There are vastly more outside than in (they are flying around, gathering everywhere), but can be just an annoyance inside as they keep to windows.

These smaller stink bugs have an apparent vector of the Tree of Heaven, another invasive species that is actively combatted in my area. So it makes sense we would have the smaller stink bugs too. I was also surprised to read they were first documented in 1996 in America as I can recall these at least as early as 1990 or 1992. As a little kid, I would have to look out for them on the blackberries I picked out of my yard.

<comment><USER9> Glad to hear we're not the only ones! The box elder bugs definitely love windows, and the insulation in door frames. They like to overwinter in those spots.

The box elders can be a big nuisance - but they are also very pretty at an individual level.

<comment><USER10> They _love_ to live under the cedar shingle siding of my house... Invariably the house will be swarmed a couple times a year.

<comment><USER11> I'm being swarmed by box elder bugs right now - thousands of them on the sunny walls of the house. I shop vac them up. Luckily they don't stink.

</comment></comment></comment></comment><comment><USER12> These are called "bärfisar" in swedish ("berry farts"). Don't think we have the house invading kind... yet. Looked it up, there are over 6000 variants, we have 28 here.

Had some problems with flour beetles once, they didn't exactly smell like roses either. Not sure if I ever crushed a berry fart though so don't know how it compares. Probably much worse.

</comment><comment><USER13> Been dealing with these things over the winter. I'm both glad and creeped out by having read this now. I have a method to kill them that works and doesn't smell, but is quite annoying - I shoot them with my salt gun a few times. The real key is to get a near-range shot to the underside. Sometimes It takes a number of them, but I can usually do it in 3. One to knock em down from their perch, one to stun, one to kill.

The salt it leaves behind is annoying to clean, of course, but I've found it to be quite effective.

</comment><comment><USER14> We're completely invaded in NH - best trick I've learned is leave a shallow pan of water in kitchen with desk light shining on it all nite - rinse and repeat every day :-(

<comment><USER15> Also in NH here. I'm going to try this out this summer. Luckily we "only" get about 5-10 per day in the hotter months so far.

<comment><USER16> Same here. We moved to a new house a few years ago and was hoping they'd stay at the old one, but no luck.

Also: hey Fred!

</comment></comment></comment><comment><USER17> I'd recommend enjoying some [salsa de jumiles]([https://en.m.wikipedia.org/wiki/Jumiles](https://en.m.wikipedia.org/wiki/Jumiles)) - stinkbug salsa.

</comment><comment><USER18> Great article! I haven't actually seen these yet even though they appear to be present in my area. One thing I'll say for all the HNers that may grow roses - monitor the (mentioned) Japanese Beetle map: [https://www.pioneer.com/CMRoot/pioneer/US/images/agronomy/li...](https://www.pioneer.com/CMRoot/pioneer/US/images/agronomy/library_corn/pests/japanese_beetle/jap_beetle_distrib.jpg)

These things are absolutely crazy as well.

</comment><comment><USER19> When I heard that there was a need for an insecticide that could be used in the home it made me think the unthinkable...

What about DDT? If it works it is not terribly toxic to humans but is pretty good at killing insets in general. The devastating consequences to the environment would be avoided if used in the home. I believe it is still used for mosquito control in Africa.

I see in the Wikipedia article it is banned by international treaty except for disease control purposes due to the environmental dangers of it's agricultural use. But I guess it would be good to know if it works...

</comment><comment><USER20> Man if I get these, I'm moving into the city.

</comment><comment><USER21> It says that pesticides are not that effective because the stinkbug's long legs keep them from much contact with the pesticide on a surface. Maybe could use pesticide balls with little spikes all over them (like burrs) to make better contact with the stinkbug.

<comment><AUTHOR> Direct spray onto a collecting surface seems to work fairly well. In my experience, the bugs will congregate on window screens. Spraying them with a weak (1/4 or lower) mix of detergent (Dawn, Trader Joe's handsoap at a 10 shot / litre, or Clearwood & Sage Multi-Purpose Cleaner at 1/4 - 1/8 strength) will kill them in a few minutes.

I've offed 100s per day in this manner.

A screen-based bait / spray station might automate this.

<comment><USER21> I'm thinking more for crops.

<comment><AUTHOR> Right. I still think that getting the bugs to the kill-system is probably more effective than getting the kill-system to the bugs. Figuring out how to create bait-and-kill systems that are cheap, abundant, targeted, and effective is probably the best option.

Attractant, kill mechanism (detergent & water), and some way of getting the bugs onto / into / misted by this, is the general formula I'm looking at.

Spray-based pesticides is a move-the-mountain-to-Mohammed approach.

</comment></comment></comment></comment><comment><AUTHOR> As submitter, I found this to be a good backgrounder on the history and dynamics of this phenomenon, though it's weak on the aspect of residential control, at least for modest infestations: detergent-and-water bait stations, kill jars (have a tightly-fitting lid to avoid the stink), or spray bottles, work well.

Dawn dishwashing detergent is frequently mentioned (I've found any of several detergents works well), in a weak solution. Trader Joe's Cleary & Sage Multi- Purpose Cleaner cut to 1/4, 1/8, or weaker strength, pump hand soaps at ~5-10 pumps per 1 litre bottle, are all effective.

The major problem is when you have a _large_ infestation and need to break the cycle. I don't have a solution for this, yet.

The buggers _absolutely_ cluster on the back surfaces of furniture, wall- hangings, curtains, etc., as well as inside lampshades and other spaces. Frequent checks of these are useful. They also turn up behind books and other shelved items. And inside dressers, cabinets, closets, etc.

The other element of the story I find interesting are the dynamics involved: transport (and commerce) systems and infestations, unintended consequences, private benefits vs. socialised costs, the requirement for regulation and inspection, and comparison with earlier swarming infestations.

On transport, this passage especially:

 _Prior to the era of planetwide transportation networks, species routinely took millennia to establish themselves in new places. Today, thousands move around the world every day—by ship and plane and freight and pallet and packing crate, by business meetings in Switzerland and military deployments in Pakistan and tourism in Hawaii. At present, this vast influx of new species costs the United States about a hundred and twenty billion dollars a year and is, after habitat destruction, the main reason the world has lost so much biodiversity._

In another context, I'd turned up a reference to epidemiology: If a phenomenon follows transport or communications networks, it's an epidemic. This seems to be a general rule. (Sadly the reference is resisting attempts at rediscovering it.)

James Burke, commenting on his wildly successful 1980 television programme _Connections_ several decades later, on how he'd continue the themes of the first series, mentioned for the jet airliner, epidemics. That is, _any_ transportation system will become involved in the spread of disease _or other dishygenic agents_. That's a valuable lesson.

The fact that it was importers and exporters who _didn 't_ practice sufficient sanitation who brought about the spread of this epidemic reflects on the privatised benefit / socialised cost element.

And the fact that there are now significant restrictions, inspections, and insect-control regimes (including fumigating and/or heat-treating imports and exports, including such goods as automobiles), speaks to regulation and the concept of _well_ and _appropriately_ regulated activities.

There's swarming behaviour itself and the role it plays ecologically. Typically these involve flying or air-transmissible creatures or agents, with birds (the passenger pigeon), and grasshopper/locust behavioural phase- switching organisms, as key exemplars. A swarming or flocking mode allows for a seeking out and amortisation of some nutrient or food potential, in a fast- acting fashion. There are obvious analogues to various human, commercial, and economic behaviours here as well.

</comment><comment><USER22> I would expect to see some photos but there is none :-(

<comment><AUTHOR> Those are easy enough to find elsewhere, and the textual information is quite good.

[https://en.wikipedia.org/wiki/Brown_marmorated_stink_bug](https://en.wikipedia.org/wiki/Brown_marmorated_stink_bug)

Though ... the bits on trapping/killing the bugs is weak. Soap/detergent seems quite effective.

</comment></comment><comment><USER23> I heard they are quite tasty, though. Seriously!

<comment><USER21> Not according to this article.

</comment></comment><comment><USER24> Well written: both interesting to read and apparently accurate on detail and sources.

<comment><AUTHOR> Pretty good, though a bit defeatist on the baiting / trapping / killing element: detergent-based traps _do_ work well.

As submitter, that's the weakest element of this article.

</comment></comment><comment><USER25> Just found one in the Arizona desert. Oh boy. I thought I was safe here.</comment>


Moving from Disqus to Commento - <AUTHOR> https://victorzhou.com/blog/replacing-disqus/ <comment><USER2> Congratulations for switching to Commento :)

Shameless plug: I've blogged about other alternatives to Disqus here [1].

[1] [https://darekkay.com/blog/static-site- comments/](https://darekkay.com/blog/static-site-comments/)</comment>


Apple, please kill the 16GB iPhone - <AUTHOR> http://www.cnet.com/news/apple-please-kill-the-16gb-iphone/

<comment><USER2> "Why Apple killing the 16GB iPhone is their biggest mistake yet" \- future article from this author.</comment>


Satellite Images Show Wakashio Being Towed Toward Antarctica as Mystery Deepens - <AUTHOR> https://www.forbes.com/sites/nishandegnarain/2020/08/19/satellite-imagery-captures-wakashio-being-towed-toward-antarctica-as-mystery-of-ship-deepens/#f8bb65a7eaf9 <comment><USER2> "Towards Antarctica" as in there is nothing else that direction and its really just "towed out to sea"?

or is it actually near Antarctica and how close

<comment><USER3> "In this set of satellite imagery, the wreck could clearly be seen 16 kilometers Southeast of Pointe D'Esny, Mauritius."

So like 7000km to go?

[https://www.wolframalpha.com/input/?i=distance+from+Southeas...](https://www.wolframalpha.com/input/?i=distance+from+Southeast+of+Pointe+D%E2%80%99Esny%2C+Mauritius+to+Antarctica)

<comment><USER4> You'd be right but the closest 7-11 for snack top off is taking them off the optimal route. Yah it's not looking good either way.

Ops comment was hilarious!!</comment></comment></comment>


The next Bank of England £5, £10 and £20 banknotes will be printed on polymer - <AUTHOR> http://www.bankofengland.co.uk/banknotes/polymer/Pages/default.aspx <comment><USER2> > The Serious Fraud Office and the Australian Federal Police are conducting a > joint investigation into the activities of the employees and agents of > Securency International PTY Ltd and their alleged corrupt role in securing > international polymer banknote contracts.

> The trial of Peter Chapman is currently on-going and began on 4 April 2016 > at Southwark Crown Court. Mr Chapman's first court appearance was on 5 May > 2015 at Westminster Magistrates Court. There he faced six charges under the > Prevention of Corruption Act of allegedly making corrupt payments to an > overseas official in order to secure contracts of polymer for his company, > Securency. The alleged offences took place between 9 July 2007 and 18 March > 2009. He has been remanded in custody.

[https://www.sfo.gov.uk/cases/innovia-securency-pty- ltd/](https://www.sfo.gov.uk/cases/innovia-securency-pty-ltd/)

</comment><comment> semi-extrinsic Polymer banknotes were introduced in '88 by Australia, who switched completely to polymer in '96\. Other (ex-)commonwealth nations have followed suit, so it's not that surprising Britain is switching as well.

<comment><USER3> The question is will they be using the same Australian printer as many of the other countries that have switched to polymer notes. Seems like a big single point failure node at this point.

<comment><USER4> I think the Eurozone uses a different polymer printer than Australia, so the UK might just use the same as the rest of the EU.

<comment><USER5> The euro is printed on paper.

Romania is the only European country to use polymer notes.

<comment><USER4> Not anymore, at all.

For 2 years now it's been on polymer: [https://www.ecb.europa.eu/euro/banknotes/europa/html/index.e...](https://www.ecb.europa.eu/euro/banknotes/europa/html/index.en.html)

<comment><USER6> That's really interesting, I didn't know that. Does anyone know what the timescale is for phasing out paper? I seen that the website mentions parallel issuance for a period - in the last year I've visited Munich and Paris and only come across paper.

I'm genuinely interested to see how the logistics of rolling out a new material will work across such a large area with so many countries and banks involved

<comment><USER4> 5€ bills were replaced several years ago, 10€ bills over the course of last year, and now 20€ bills were replaced already.

The old 10€ bills stopped showing up in the change I got from stores by end of 2015, and around march 2016 the old 20€ bills stopped showing up.

Obviously, they're still in use in several places.

And regarding the rollout: Most banks have had to accept dozens of possible payment methods, for them one more type of bills is not an issue. Producing the money is more of an issue, but the link I mentioned before has an article about that, too.

<comment><USER5> These new notes are paper. It says so on (1).

I don't live in the Eurozone, but I have a new and old €20, and the paper is the same. I have an old €50, and a new €5, and the paper is the same.

Polymer notes almost always have transparent windows, and they feel like plastic, not paper.

(1) [http://www.new-euro-banknotes.eu/Euro- Banknotes/PRODUCTION](http://www.new-euro-banknotes.eu/Euro- Banknotes/PRODUCTION)

<comment><USER4> The €20 note has a transparent window, and feels like plastic.

Are you sure you have actually gotten one of the new €20 notes?

<comment><USER5> Do you have one? The window is only in the security strip, and it's clear on the reverse where the window has been cut out from the paper. The plastic is applied somehow to one side of the note.

Polymer notes like those I've used from New Zealand and Vietnam have the whole thing made from plastic, and no paper at all. Example: [http://banknote.ws/COLLECTION/countries/ASI/VIE/VIE0124.htm](http://banknote.ws/COLLECTION/countries/ASI/VIE/VIE0124.htm)

See, for example, [http://www.reuters.com/article/us-euro-fakes- idUSBREA0C0JQ20...](http://www.reuters.com/article/us-euro-fakes- idUSBREA0C0JQ20140113) I can find no mention anywhere of polymer Euros.

<comment><USER4> As far as I know they're a cotton-nylon base with plastic coating on top, in contrast to the previous cotton-paper base without coating.

That counts as plastic money, IMO.

</comment></comment></comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER7> Slightly off-topic but did anyone else find it amusing that the Bank of England website does not support HTTPS? I think that's the first bank website I've ever seen that uses HTTP only.

<comment><USER8> It's all just policy information on there. It's not online banking. It'd be nice if all sites were available on HTTPS, but it's not unusual or funny.

<comment><USER7> There are many reasons to switch to HTTPS - protecting financial data in transit is just one of them. Here's an overview with further explanations but many similar examples exist: [https://snyk.io/blog/10-reasons-to-use- https/](https://snyk.io/blog/10-reasons-to-use-https/)

<comment><USER8> Yes, amazingly I understand that. But it's not any more surprising or funny that the Bank of England would be on HTTP compared to any other policy website which still isn't on HTTPS.

<comment><USER7> Okay, fair point. Perhaps I did not explain myself thoroughly.

When I see bank + policy + not just some random bank but the BANK OF ENGLAND, I do expect to see HTTPS guaranteeing the integrity of what is unquestionably important and influential data being served to decision makers.

This amused me, but maybe I'm just easily amused.

</comment></comment></comment></comment></comment><comment><USER9> I like the Canadian plastic money. The only complaint is that when working retail you have to deal with people who fold their bills ot put them in a small wallet, and the bills are so much harder to unfold than paper making them difficult to count.

<comment><USER10> I swapped some bills with a Canadian friend when he came to visit. They're nice and space-agey, but I couldn't feel the difference between them and the receipts in my wallet. I'd miss the ability to distinguish between bills and receipts by touch if we ever moved to plastic money.

<comment><USER6> This raises an interesting point for visually impaired people. Sure, once you separate the banknotes and other paper, UK notes can be differentiated by their dimensions. But it might result in some confusion if similarly sized and textured receipts get mixed in with the banknotes.

<comment><USER11> The next generation of polymer banknotes in Australia will have a tactile feature to help visually impaired people - see [http://www.rba.gov.au/media- releases/2015/mr-15-02.html](http://www.rba.gov.au/media- releases/2015/mr-15-02.html)

These new tactile notes haven't been released publicly yet.

</comment></comment></comment></comment><comment><USER12> We've had them in Romania for about 15 years or so. They're just great.

</comment><comment><USER13> a) be thankful that banknotes are not being withdrawn altogether, but...

b) mention of the 50 suspicious by its absence.

<comment><USER5> The £50 has only relatively recently been reissued, and presumably lasts a long time in circulation.

There's an FAQ on the bank site, buried in a PDF, saying it will be considered later.

<comment><USER13> ...more likely it is being considered for withdrawal from circulation altogether for all the usual war-on-cash reasons. Indeed, in large amounts, 500 euro notes are already selling for 515 euros for reasons of moving money outside of the banking system (demand very high in China), so as to avoid that system's prying eyes, and also for reasons of negative interest rates becoming the norm. The GBP 50 has the same bad reputation in _bien pensant_ policy circles.

Anonymous, large-denomination notes have this amazing attribute that they are _not_ easily controllable by politicians and central banks, the latter in their quest for negative rates particularly stymied by them. By contrast wealth in your bank account, or the dematerialized stocks and bonds that you might own, can be switched off completely with a few SQL queries, on demand.

<comment><USER5> €500 is worth £390, not really comparable.

£50 is worth less than $100, so I doubt it's of much interest to international criminals.

With inflation, it's useful in Britain, though difficult to get as only a couple of cash points in Canary Wharf dispense it.

</comment></comment></comment></comment><comment><USER14> Is the US likely to follow suit?

<comment><USER15> Honestly I hope not, we have polymer notes in Canada and they tear horribly. I have lost bills just pulling them out of my wallet, most tellers will not take them unless you mend them first.

U.S. bills are excellent, and I would encourage them to continue printing them as-is.

<comment><USER16> The Bank of England has a very good reputation for reimbursing people with damaged notes: [http://www.bankofengland.co.uk/banknotes/Pages/damaged_bankn...](http://www.bankofengland.co.uk/banknotes/Pages/damaged_banknotes.aspx)

<comment><USER17> US as well

[http://www.moneyfactory.gov/submitaclaim.html](http://www.moneyfactory.gov/submitaclaim.html)</comment></comment></comment></comment>


Awesome Sysadmin: Open-source sysadmin resources - <AUTHOR> https://github.com/kahun/awesome-sysadmin

<comment><USER2> An impressive list. However - how do you choose the right tool for your needs? "What is the best tool for ..." is usually rejected in SO (and other Stack Exchange sites). A "Stack Overflow for tools" recommendations, pros and cons would be great.

<comment><USER3> Seems to be missing some obvious things:

Under virtualization: XenServer -- it has Xen, but most SysAdmins wont use raw Xen, but instead a complete hypervisor such as XenServer or VMware, etc.

XenServer was recently re-rereleased and now is 100% open source (all features). Now you get all the "enterprise" features in the freebie Open Source version.

Under SMTP Servers: Zimbra - excellent top-of-class email server, and open source.

<comment><USER4> Kinda off-topic, and you might be the wrong person to ask, so, sounds like a plan! Which hypervisor would likely be the best on Ubuntu 14.04. It'd be for a single, fairly low-utilization system. Looks like 14.04 has support for Xen, KVM, and VMware. As I said, low utilization, virtualizing a couple of linux boxen and a single Windows box.

Everyone else feel free to join in on the discussion (i'm probably breaking all kinds of site rules, aren't I?:) It's a greenfiield setup so I'd like to start with what the folks around here might recommend.

If one of the choices is correct by a very margin, let me know that's the case and I'll go checkout that path. Thanks!

</comment></comment></comment><comment><USER5> This was mostly spawned from this: [http://sabok.org](http://sabok.org) which several LOPSA members have contributed to. Everyone has their own flavor of "What's the best" & "How to do Sysadmin", there's no real definitive list for anything. There's also [http://ops-school.readthedocs.org](http://ops- school.readthedocs.org) which seems to be more focused on DevOps instead of real Sysadmin.

<comment><USER6> Founder of [http://sabok.org](http://sabok.org) here. Thanks for the mention! I used to work with the founder of Ops School -- we're still in touch and we're both gung-ho about effective ways to make more sysadmins / ops engineers.

<comment><USER5> Hi there, I promise I spelled your name right this time - it's me :)

</comment></comment></comment><comment><USER7> I'll be submitting things for sure. The more resources we have like this the better. Also, if you are interested in this type of stuff, I recently wrote an essay on "Bits Sysadmins Should Know", talking about sysadmin career advice and the main systems you will likely use @ [http://sysadmincasts.com/episodes/25-bits-sysadmins- should-k...](http://sysadmincasts.com/episodes/25-bits-sysadmins-should-know)

</comment><comment><USER8> quite realted, but dont know how this would fit in there: DONT PANIC First Aid Kit - resources and links: [https://8ack.de/firstaidkit/](https://8ack.de/firstaidkit/)

<comment><USER9> Awesome. Thank you

</comment></comment><comment><USER10> I have a problem with "cloud storage." Most of those are simple file sync services and they have nothing to do with "the cloud".

OwnCloud for example, is just a php app used for syncing files with different clients. It is not distributed, the data is not replicated, there is no High Aveilabilty(HA) setup. Seafile could has HA if you pay.

The only true cloud storage system there is Swift. And CEPH is missing, which is a big player in cloud storage.

I may be wrong here, but cloud should be HA, scailable and distributed.

<comment><USER11> Owncloud can do much more than just sync files: [http://owncloud.org/features/](http://owncloud.org/features/) It's by no means distributed etc, though.

</comment></comment><comment><USER12> Very good list. I do wish some of the entries had a more to their description than "written in Blub." Knowing the language is interesting but not really helpful if I just want to know functionality.

Of all the things I think this list is missing, I think the #1 is the backup software lsyncd: watches a local directory tree for changes, then uses rsync to copy the changes. Great for when your data become so large that you can't complete your periodic backup job in a reasonable period of time.

</comment><comment><USER13> Very good resources link. Thank you for sharing and keeping this thread alive on top. But all of them are not integrated to sort of interoperate leveraging each other's resources.

Is there any project that integrates these different projects? Is there sufficient interest in the group to use sort of selected items as distro?

Are there any takers for such an initiative? May be just focusing on Management and monitoring part to start with?

</comment><comment><USER14> Submitted a pull request to add DREBS - our AWS EBS backup script.

[https://github.com/kahun/awesome- sysadmin/pull/74](https://github.com/kahun/awesome-sysadmin/pull/74) [http://dojo4.com/blog/aws-ebs-backups-we-rewrote- drebs](http://dojo4.com/blog/aws-ebs-backups-we-rewrote-drebs)

</comment><comment><USER15> zeromq is in the wrong place

not sure if it's supposed to go in "newsletters" but there needs to be a place for majordomo and mailman

no sysadmin is going to want a list with mongodb on it. ;)

ticketing systems should include roundup

loggers should include flume

squid and haproxy need a mention

<comment><USER16> I'm not sure if it's in it or not, but mitmproxy is great for troubleshooting page loading problems, especially when you may be behind a filter/proxy.

</comment></comment><comment><AUTHOR> Would be interesting to see a comparable SaaS version as well, for services that correspond to OS solutions here.

<comment><USER17> [http://leanstack.io/categories](http://leanstack.io/categories) is a pretty big repository of such services. Edit: or maybe you mean services which offer the equivalent OS software as a Saas?

<comment><AUTHOR> This is good, that's what I was thinking of, comparable SaaS solutions by use case.

</comment></comment></comment><comment><USER18> "The art of network administration" by Limoncelli et al is still surprisingly (given the pace of our industry) relevant. Great for the theory side.

That and the Evi Nemeth / Garth Schneider book for the step by steps to implement.

</comment><comment><USER19> For anyone interested there is also [https://github.com/opsschool/curriculum](https://github.com/opsschool/curriculum)

</comment><comment><USER20> Hopefully the lack of comments here means everyone is submitting pull requests to the repo instead of posting their favourite missing resource on here. ;-)

<comment><USER21> Based on all the repo email notifications I'm getting, I believe that may be the case :)

</comment></comment><comment><USER22> I'll be submitting a pull request with the ones I know of, but one thing I'd like to see added is spam filtering software.

</comment><comment><USER23> Don't forget wireshark for troubleshooting.

</comment><comment><USER24> Does anything like this exist for testing?

</comment><comment><USER25> What are the other lists like this one?

</comment><comment><USER26> almost every comment on this thread should be a pull request.

</comment><comment><USER27> Do not forget Zarafa!

</comment><comment><USER28> only the first book listed is open source/free/creative commons

<comment><USER5> The point is that the list itself is open source, e.g. anyone can add resources to it.

<comment><USER11> Quite misleading.

</comment></comment></comment><comment><USER29> Good resource

</comment><comment><USER30> Should probably have some Kerberos stuff on there.

CVS is missing in the version control stuff.

Horde is missing from the webmail stuff.

Zabbix is missing.

Nothing about PHP deployment.

~

Lots of neat stuff, but, erm, not really for _sysadmins_.

EDIT:

Nothing on shell scripting, sed, awk, curl, wget, or any other tools of the trade.

Nothing on system V init scripts, or even systemd.

Nothing on RAID!

This isn't sysadmin stuff, this is a list of nifty little tools used by people pretending to be devops!

Urk.</comment>


Magic Leap says it will ship its first augmented reality glasses in 2018 - <AUTHOR> <comment><USER2> Maybe Apple can use their tech one day?

<comment><USER3> More like Disney.</comment></comment>


Show HN: App to setup permanent redirects so people can still find your content. - <AUTHOR> http://nomad.cx

<comment><AUTHOR> At some point a few years ago I decided to move my blog from being hosted on wordpress and a custom domain, to being hosted on github pages with jekyll.

While I was quite happy to use <http://vertis.github.com> for all new posts, I needed to redirect the old posts to their new home. This was made more difficult by the fact that the paths generated by the two blogging engines were slightly different.

So I created a simple rails application that would allow me to specify mappings and have the correct redirect occur.

Recently, I added an administration interface, so that anyone can use it to migrate from one domain/system to another.

It's still kind of new, and a MVP, but I hope someone will find it useful.

<comment><AUTHOR> I would love to get some feedback about what anyone thinks about it so far, and any suggested improvements (I have quite a list of my own still).</comment></comment>


Ovum Analysts: iPad Will Be Surpassed by Google by 2015 - <AUTHOR> http://daringfireball.net/linked/2011/01/21/ovum-tablets

<comment><USER2> Unless Google starts making tablet hardware by then and does an amazing job of selling it, what the analyst is actually predicting is that by 2015, the combined sales of dozens of Apple competitors will be slightly ahead of Apple's sales.

Assuming he's right--so what? It would be at least as accurate to headline the analysts prediction as "By 2015, Apple will still be the dominant tablet maker by far".

</comment><comment><USER3> Is Gruber trolling on purpose? His posts that make it to the HN always turn into flamewars. Why is everyone here so interested in what he has to say?

<comment><USER4> Exactly. I don't even need to read Gruber any more because I invariably already know where he comes down on any given Apple issue. Wake me when Gruber makes a post that _isn't_ pornographically pro-Apple.

</comment></comment><comment><USER5> Ovum may have been wrong on the IPhone but that doesn't mean that Android tablets would not outsell the IPad by 2015.

Remember, a lot of people back in 2008 were saying that it will take a long time for Android to surpass the IPhone. It took Android only about 2 years to achieve that.

<comment><USER6> _Ovum may have been wrong on the IPhone but that doesn't mean that Android tablets would not outsell the IPad by 2015._

Indeed. This is nothing more than an ad hominem on Ovum. It does have some verifiable truth, but nothing that helps us judge how well Ovum can predict the future. N=1, and we aren't told how many other of Ovum's earlier predictions he checked. So, all we learn from it is that Ovum has not always made perfect predictions.

</comment></comment><comment><USER7> tl;dr Pundit says Google tablets will outnumber iPads in 2015, Gruber implies that they might not.

This is not news.

<comment><AUTHOR> While this may not be news, HN welcomes submissions of other types as well. Most of us would agree that interpretations or analyses are acceptable. Even if those analyses are only a few words, they are analyses nevertheless.

</comment></comment><comment><USER8> I don't see Android tablets taking off as quickly as Android SmartPhones did. There are more credible competitors on the horizon. Most of the companies that totally missed the boat on competing with the iPhone are in a much better position today. HP/Palm & RIM of course but also Microsoft who I think has an opportunity to make inroads in the tablet-as-productivity-tool market someday. Any of these companies could stand to capitalize on Google's cat-herding problem or Apple's authoritarian pitfalls. Android/iOS will probably still be the big targets but I don't see the others being such _distant_ competitors this time around.

</comment><comment><USER9> I remember when the iPad first came out and many predicted failure. Who wants a big iPhone? That's was a typical question.

Less than a year later the debate is about which tablet will win.

<comment><USER10> I'm an android fanboy, and I'm still having a hard time understanding the need for a tablet form factor without something similar to the now canceled windows courier interface....

<comment><USER9> For me it's a laptop, desktop replacement. I don't do much content creation outside of work on a computer so I don't need those form factors and I like the portability, video capabilities, and being able to read books from it.

The Courier....that was the only Microsoft product I was ever excited about. I can't believe they killed it though. They are blinded by Apple.

</comment></comment></comment><comment><USER11> I thought Android tablets sales were already at 25% last quarter. It wouldn't particularly shock me if they had 36% (and Apple had 35%) in four years time.

But since the introduction and success of the iPad seems to have been the trigger for all of Microsoft's partners to think they can finally make a go of a linux-based OS I personally would wait for the dust to settle before making any predictions.</comment>


How to Use Google Sheets as a Database or CMS - <AUTHOR> https://medium.com/@tcodinat/how-to-use-google-sheets-as-a-cms-or-a-database-f9d8e736fdce <comment><AUTHOR> Decided to make a short guide in Medium explaining how to set up Google Sheets using the Google API to be the database or content management system of your website, with PHP. Hope you find it useful!</comment>


Apple and Google employees came together to help trace coronavirus - <AUTHOR> https://www.cnbc.com/2020/04/28/apple-iphone-contact-tracing-how-it-came-together.html <comment><USER2> [slightly paraphrased to fit title length limit]</comment>