Could you hack into Mars rover Curiosity? - <AUTHOR> http://www.extremetech.com/extreme/134334-could-you-hack-into-mars-rover-curiosity?utm_source=rss&utm_medium=rss&utm_campaign=could-you-hack-into-mars-rover-curiosity <comment><USER2> More than a full (unlikely) hack on Curiosity that would potentially allow to hijack it; I would be interested in finding out how feasiable direct signal de-cryption is. Specifically I can't immagine curiosity having too much of a sophisticated encryption system. Just by knowing a little bit about embedded- systems and hardware encryption, it is probably something like 3DES or AES-256 with a firmware stored symmetric key. This means that the key used to encrypt signals won't change too often and therefore I wonder how hard would it be to break it and get a hold on Curiosity's image and commands feed.

</comment><comment><USER3> Correct me if I'm wrong, but I'm pretty sure in one of the pictures NASA sent out there were tracks in the ground from some rover moving. Was it not Curiositys tracks? Or an earlier rover?

<comment><USER4> No other rover has visited this location. So if there was a picture with tracks on the ground it would most likely be from the rover rolling during the landing.

Edit: Just reviewed all the pictures on the NASA MSL page and didn't see any tracks. Maybe a news article mislabeled a picture from another rover?</comment></comment>


The revenge of the listening sockets - <AUTHOR> https://blog.cloudflare.com/revenge-listening-sockets?T=1 <comment><USER2> Really? A 32 slot hash table? How do they justify that these days?

I think a stock Linux kernel listens on enough ports to risk a collision, doesn't it?</comment>


ASK HN: List things you believe in your 40s you didn't understand in 30s? - <AUTHOR> https://mobile.twitter.com/jrichlive/status/1226275355478020097 <comment><USER2> I'm past my 40s, but here are three things that I didn't understand in my 30s that I learned in my 40s.

1) Being wrong is valuable and should be embraced, acknowledged, and mined for everything its worth. You don't learn and improve by being right.

2) Making too much money will decrease your happiness and life satisfaction just as surely as not making enough will.

3) Things don't matter. Relationships and experiences do.</comment>


Your Android phone, now with NSA-grade security - <AUTHOR> http://venturebeat.com/2014/06/05/your-android-phone-now-with-nsa-grade-security/

<comment><USER2> _Your Android phone, now with NSA-grade security_

The strength of the encryption is and was never a problem.

 _One of the biggest hurdles for widespread adoption in the private sector is that encryption is perceived to cause friction between users [...] With that in mind, Vitru has managed to keep friction to a minimum._

Key management is indeed the main problem but the article has nothing to say how they attacked the problem.

 _Virtru's Android encryption enables users to control access to email messages and files and can be "revoked" at any time. Users can also set expiration dates for sensitive email._

No, that does not work. Screenshot. Revoking may work within a specific client but to become really successful you will most likely have to open the protocol to alternative clients and that's the definite end of revoking or expiring messages.

<comment><USER3> They say how they've attacked the problem. And its as stupid as you would imagine: [https://www.virtru.com/how-virtru-works](https://www.virtru.com/how- virtru-works)

I'm guessing the system works by sending the encrypted item out-of-band. Revocation could be done by the key server. Though there's nothing to prevent designing a client that automatically grabbed the key material when an encrypted message was sent.

</comment></comment><comment><USER3> Found this in their blog post on Google's OpenPGP plugin support:

"…is so easy to install and use that anyone, regardless of technical sophistication or ability can use. There is no need to understand PGP or exchange keys with the people you're sharing information with."

I get that PGP is hard, and keyex is a huge UX problem, but that's because it breaks immediately as soon as you try to simplify it. In the case of Virtru, they're requiring you to rely on a trusted third-party.

About the only charitable thing that could be said about this is there might be a practical improvement in security, provided the key and document are sent separately.

</comment><comment><USER4> Virtru claimed, in a blog post in January, that they would release the source for components of their software.

[http://blog.virtru.com/2014/01/virtrus-open-source- strategy/](http://blog.virtru.com/2014/01/virtrus-open-source-strategy/)

Assuming they do eventually release these components, are they enough for the software to be trusted? Why wait to release the source anyways? I'm not comfortable (at all) with installing closed-source software developed by "ex- NSA employees".

<comment><USER3> There's enough in their service description to not trust them.

The way the system is described, you encrypt a file on your device, upload both the key and the file to the cloud, then the receiver downloads both the file and the key.

Look at the diagrams here: [https://www.virtru.com/how-virtru- works](https://www.virtru.com/how-virtru-works)

The "encryption key storage" is central to how the whole thing works. It's also a dumb idea. The only thing I can think is that it allows a file to be delivered out-of-band, but the inescapable fact is that decryption material is available to at least one other party.

<comment><USER5> I assumed it was asymmetric like pgp, but you're right they dont mention it anywhere. That is rather puzzling. wtf.

<comment><USER6> Actually they seem to mention it's symmetric:

        Each email or file has its own unique key, which is stored
        in and protected by a keystore in my butt. By default,
        the Virtru keystore is used, but advanced users will be
        able to operate their own key stores.

<comment><USER7> Our base case is indeed symmetric for each message (the key distribution is over Elliptic Curve Diffie Hellman Ephemeral).

The number one reason why we allow for symmetric message keys is to allow you to send an encrypted message to anyone, even if they don't have public keys somewhere. Distributing and using private/public keys in a trusted AND easy to use way is a problem we're currently working to solve, and will add as soon as we get that done in a way that doesn't make our software so hard to use that people stop using it.

<comment><USER6> We don't have a problem with symmetric encryption. We have a problem with the key being stored on your servers, effectively nullifying encryption.

Now, I'm not saying it's an easy problem; kudos to you for tackling it. It's just that

\- if you have the keys to the payload

\- if you don't provide open-source client code

then no one can honestly trust your service. Don't forget that what you're primarily doing with is trust.

</comment></comment></comment></comment></comment></comment><comment><USER8> _> Ackerly spent eight years at the NSA, where he specialized in cloud analytic architecture — specifically, protecting the agency's in-house data transfers._

1.) Former NSA analyst does not mean "NSA-grade security."

2.) Didn't the NSA have their most secret documents leaked? I think "NSA- Proof" security would be more impressive.

</comment><comment><USER9> NSA-grade?

Which of the two alternatives does this mean? One, proof against all foreign intercepts, 'coz it uses NSA-strong safeguards, or two, all your comms are automagically pwned, 'coz it uses NSA-approved addons?

I could go with either, I just want to know what I'm buyin'.

</comment><comment><USER10> My suggestion would be that keys were exchanged by physically bumping two devices together. In this way the authenticity relies on people looking each other in the eyes which through millennia has been a quite successful method for identifying one another.

</comment><comment><USER11> "former NSA" sadly is today slang for "no technical backing, so i'm going to dump that on you and try to impress". Some years ago random ivy league phd departments where used for that.

<comment><USER12> I'm not convinced that's new. I think it now comes with potential that they might have actually stopped working for their former employer.

<comment><USER11> what? pretty sure the use of the term exploded. here is some data to back it up [http://www.google.com/trends/explore#q=former%20nsa&cmpt=q](http://www.google.com/trends/explore#q=former%20nsa&cmpt=q)

everyone is trying to cash in the fact that they can offer 'former NSA' employees in hopes that clients think "hey, he knows the stuff NSA does, he will help me protect against it"... which is total bullshit.

</comment></comment></comment><comment><USER13> One can't run trust code on a untrused platform. And I'd say smartphones are the least trustworthy platform out there.

</comment><comment><USER14> With NSLs, your Android phone is one legal step away from Google being coerced into pushing an NSA-laden update to you.

</comment><comment><USER15> Must. Refrain. From posting. Cynical comment.</comment>


Use Esperanto instead of English - <AUTHOR> https://github.com/crystal-lang/crystal/issues/2394 <comment><USER2> Even though it's April fools, but Esperanto is great language in the context of automation. It has handful of clearly stated rules and no exceptions, thus language parsing. It is much more easy to parse natural language or automate text/speech generation, etc.

<comment><USER3> And Esperanto can act as linguistic neutral grounds for people of all languages.

<comment><USER2> Exactly. .. and can be neutral ground even for software :D

</comment></comment></comment><comment><USER4> I feel like a true international language is a good idea, but Esperanto strikes me as such a Romance family language that it's hard to think of it as neutral.

</comment><comment><USER5> Albeit a joke, I could read it OK and would likely learn more about Esperanto that way.</comment>


Show HN: CaaS - Cocktails as a Service - <AUTHOR> http://www.shakencocktails.com

<comment><AUTHOR> I saw this - [https://news.ycombinator.com/item?id=6818369](https://news.ycombinator.com/item?id=6818369) and thought you might enjoy ShakenCocktails too. Every month a different cocktail kit is posted to you.

I'm a web developer and long-time reader here, and almost half our members are in the tech industry, there's some kind of link :) (These do work very well as an office friday-drinks treat. We're beginning to ship to a few places around London who are doing that.)

</comment><comment><USER2> What's the 'remember me' for? Doesn't Stripe vault your card regardless of the choice

</comment><comment><USER3> I like the idea but how do you stop a 16 year old with a debit card signing up?

<comment><USER4> We're still small, so we manually check out each person who joins.

</comment></comment><comment><USER5> I like how the logo looks like a Y-front</comment>


Authoritative DNS Performance Reports - <AUTHOR> http://www.turbobytes.com/reports/dns-performance/

<comment><USER2> This is a pretty amazing resource if you are a webservices speed freak and need to find the lowest latency possible for users in a particular geographic location. I haven't seen so many services rated in a single place before and never seen one that actually updates the ratings so frequently.</comment>


Linear Feedback Shift Registers - <AUTHOR> http://datagenetics.com/blog/november12017/index.html <comment><USER2> LFSRs are an interesting topic since they see so much use in hardware testing, scrambling, and orthogonal coding. Typically they are used as MLS-Maximum Length Sequences. These sequences and the generating polynomials were (I think?) shown to be related groups by Galois. Look for Golomb and Rice coding if you're interested in this math.

[https://en.wikipedia.org/wiki/Maximum_length_sequence](https://en.wikipedia.org/wiki/Maximum_length_sequence)

It's a bit odd that they only show the Galois generation method in this blog and not the more commonly used Fibonacci feedback method which takes the current state and generate the next bit each clock (rather than modifying multiple bits each shift).

Note that Gold and Kasami codes are related to MLS... and if you recognize those names from NASA, it's because they developed those high auto-correlation codes for GPS and interplanetary communication.

</comment><comment><USER3> LFSR's are cool. Jason Sachs also has a great article series on LFSR's on Embedded Related, if you're interested in an even more in-depth coverage.

[https://www.embeddedrelated.com/showarticle/1065.php](https://www.embeddedrelated.com/showarticle/1065.php)

</comment><comment><USER4> Just don't use them (or any linear function, for that matter) for cryptography:

[https://en.wikipedia.org/wiki/Content_Scramble_System#The_ci...](https://en.wikipedia.org/wiki/Content_Scramble_System#The_cipher)

</comment><comment><USER5> Those are fun. The little flickering LEDs used as replacements for candles have a linear feedback shift register as the random number generator.

<comment><USER6> Most 2D Nintendo games too.

</comment></comment><comment><USER7> It was common to use them as counters in early FPGAs such as XC2000 and XC3000. LFSRs where faster and smaller than binary counters since the early FPGAs did not have fast carry logic.

I used them for column, row and address generation in FPGA-based video capture and display cards.

<comment><USER8> You might find Linear Hybrid Cellular Automata (LHCA) interesting as well. They're similar to LFSRs, but with potentially better performance.

[http://webhome.cs.uvic.ca/~mserra/AttachedFiles/CA_Tutorial....](http://webhome.cs.uvic.ca/~mserra/AttachedFiles/CA_Tutorial.pdf)

</comment></comment><comment><USER9> This 256 byte C64 music project--not mine, unfortunately--used LFSRs to generate the melody.

[https://linusakesson.net/scene/a-mind-is- born](https://linusakesson.net/scene/a-mind-is-born)

</comment><comment><USER10> LFSR's are cool, I learned a decent amount about them while I was implementing SHA-3 in python.

</comment><comment><USER11> The Wolfenstein 3D tidbit is lovely. That game's a gem for so many different reasons.</comment>


The Anatomy of a Y Combinator Demo Day Pitch - <AUTHOR> http://bryce.vc/post/4085241146/the-anatomy-of-a-y-combinator-demo-day-pitch <comment><USER2> As the number of startups increases, is there a risk that most or all of the investors end up chasing the 10-20 best pitches? While perhaps any single company could hold their own in isolation, it seems like they're fighting the others for attention. It must be fascinating to see the distribution of interest between the investors and companies.

<comment><USER3> For a while I've worried that will start to happen. So far I haven't seen it. Rationally it shouldn't happen, and the best investors are pretty rational about "deal flow." But I'm still going to keep watch for signs of trouble.

<comment><USER4> What about before DDay? Do startups within the same batch feel like they're competing against each other, or does everybody manage to get along and help each other out?

<comment><USER3> So far at least there's not much feeling they're competing against one another. Which is reasonable, because they're really not. Investors don't have limits on how many YC startups they'll fund.

</comment></comment></comment></comment><comment><USER5> I was somewhat surprised by the lack of actual, you know, demos and the emphasis on streamlined slide shows. Is that common now? It's been a while since I pitched something...

<comment><USER3> Presentations were so short this cycle that there was no time for demos.

Since everyone asks how we decide how long presentations should be, I'll just answer that now. People can sit for about 55 minutes. Two sessions = 110 minutes. 43 startups presenting means slots are at most 110/43 minutes.

The solution will be to move to 3 sessions. That was inevitable anyway, as the number of startups per cycle increases. It will make DDay as a whole longer, but I think investors will be ok with that, because it is still much more efficient for them than meeting the startups individually.

<comment><USER6> Any thought of adding follow-up longer form presentations on a later day for doing actual demos for interested investors and startups, maybe in groups of five to ten startups at a time?

<comment><USER3> Interesting idea, but I don't think there would be time. When investors see startups they like at DDay, they know they have to act fast, because 350 other investors just saw them too. So investors interested in a startup are usually meeting with them in the next couple days.

<comment><USER6> That's interesting too - there's now no time in the YC program for pitching actual demos to investors, at least in inital group pitch format.

</comment></comment></comment></comment></comment><comment><USER7> Always been taught: a pitch without a demo is like a sandwich without bread, a beach without sea, a HN without votes, a veggie burger, ...

Is it a _fact_ that the product execution by YC teams will be flawless, so we can just minimize it?

<comment><USER3> It's more the case that that's not investors' biggest worry. Investors are willing to believe (usually correctly) that the kind of people we fund can build things. They worry more whether there's a market for what the startup is building, whether the founders can actually ship, how much money they can make, etc.

</comment></comment><comment><USER8> My initial response was to dislike the idea of presentations all using the same format - it sounded boring and uninspired. But Demo Day is not for the teams but for the investors and I can't imagine being slammed with dozens of interesting ideas all while trying to choose which to invest large sums of money into. The similar presentation formats likely help the investors stay focused on the idea and the team.

I wonder if this "investor friendly" presentation format evolved from the experience of YC doing this year after year. An example of the Y Combinator partner's experience that Paul sometimes refers to...

<comment><USER3> _I wonder if this "investor friendly" presentation format evolved from the experience of YC doing this year after year._

Very much so. We always stand at a point where we can watch both the presentation and the investors watching the presentation, to see how they're reacting to it. And I've probably watched over 700 DDay presentations now. So by this point I can even predict fairly well which jokes they'll laugh at.

<comment><USER9> The funny ones?

</comment></comment></comment><comment><USER10> With the exception of the slides, how might the presentations differ from a one-on-one pitch where you still might only have the same two-three minutes to convey the same basic info? I would image investors are very busy and would often want brevity regardless of the venue.

<comment><USER3> One on one pitches are more conversational. So the slides are designed to be something you have a conversation about, not something you simply present.

<comment><USER11> What are good elements of design for conversation-sparking slides?

<comment><USER3> It's really the short Demo Day type pitches that require the most design. A Demo Day pitch can't leave obvious questions unanswered, because there is no chance for anyone to ask them. A pitch deck for an hour long VC meeting doesn't have to be so watertight, because if investors have questions they can ask them.

</comment></comment></comment></comment><comment><USER4> I'm curious if this kind of presentation is useful for teams that haven't already been validated with YC backing yet. I imagine this format only works because the investors are already interested in the teams since PG is interested in them. In other words, if somebody were to make a slide deck that followed a similar format (no demo, most focus on team competency) and present it to VC's without YC backing, would it receive the same enthusiastic response?

</comment><comment><USER12> Has anybody posted a 'YC Demo Day Pitch Deck' online on slideshare or elsewhere? I know most won't want to post it, half the companies didn't even want their product talked about publically. Some must have raised money and gone on far enough that they're welcome to share. Perhaps a class or two ago?

</comment><comment><USER13> I'm curious: if most of these companies go on to raise rounds by going through the proper channels, why bother focusing on the pitch and not just the demo? It seems to me that if these companies still have to pitch to individual investors anyway, why not use the current iteration of Demo Day as their "Elevator Pitch" deck to investors, and use Demo Day as a real day of demonstrations, the "sneak preview" of things to come to wet the mouths of investors before they hear the real pitch?

</comment><comment><USER14> Are the YC pitches so similar to each other as the article implies?

</comment><comment><USER15> Glad to see the evolution of the bio slide. I never think those are useful when they look like Linkedin pages.

</comment><comment><USER16> Which companies does he think are the most promising?

Is he going to invest in any?</comment>


England first country to mandate programming in primary and secondary schools - <AUTHOR> http://www.telegraph.co.uk/technology/news/10410036/Teaching-our-children-to-code-a-quiet-revolution.html

<comment><USER2> _Many teachers will have to re-train, and some schools are likely to struggle to provide the computing resources needed to deliver the new curriculum._

This is what I first thought when I started reading the article. If a teacher has trouble, it is likely that one of the students would step in.

From what I know, most OSes in English schools are Windows. I don't think it is the best system for programming.</comment>


New documentary about diversity in tech is coming soon by Codr Tv - <AUTHOR> http://coderfactory.com/posts/women-in-tech-documentary#.VXv5Yt8VpAU.hackernews <comment><USER2> > 2\. Women are less prone to overconfidence

> 3\. Women are more ambitious

Well okay.</comment>


Andy Hertzfeld's take on the Schlender-Tetzeli bio - <AUTHOR> https://medium.com/backchannel/would-steve-jobs-have-liked-the-new-biography-i-don-t-think-so-c9ceb4fc3005

<comment><USER2> The Isaacson book:

(a) contains some amount of content that seems to be ripped straight from Hertzfeld's Folklore site. (b) reads in many places like a reporter's notebook - a bunch of notes to follow up on, but no actual followup, no contextualization, and no help to the reader. (c) contains very little factual content new to me, and thus probably to any person well-versed in Apple's history.

Based on that, I assumed at the time that it was rushed into production, without any significant editing, to capitalize on the death of the subject. Capitalism! It's simply not a very well-written book. The defense of it in some quarters is puzzling.

Andy Hertzfeld's Folklore site, on the other hand, is a treasure. Someone should put it out in book form again (and do it right this time -- O'Reilly gave it an inappropriate and bad mid-90's cover design, saddled it with a generic name, and made the images -- screenshots of early designs of the first significant mass-market graphical interface -- so small as to be nearly illegible).

</comment><comment><USER3> Nobody is going to write a "definitive" biography of Steve Jobs. You're just going to have to piece everything together from things people have written that are well sourced.

<comment><USER4> That's what's great about Andy's 'folklore' site. Oral histories are sometimes the best way to get an accurate sense of a person/place/time. You get overlapping impressions and can piece together the mosaic yourself as the reader.

</comment></comment><comment><USER5> All biographies are going to have a narrative or else they would be laborious to read. Some assumptions and shortcuts must be taken to summarize someone in a few hundred pages. People follow patterns most of the time but not all the time. Andy is correct in saying that you need multiple accounts to get some idea of what a person is like. I read the first biography of Steve jobs and I may get around to reading this one. It was inevitable but Apple just isn't as interesting without Steve.

</comment><comment><USER6> Is it known that Apple leaders endorse the contents of Becoming Steve Jobs?

Perhaps Apple chooses to promote the work for the publicity _despite_ its angle on Jobs' career stages. They might dislike the Isaacson biography now but they promoted it plenty when it came out...

<comment><USER7> The Kremlinological aspects aren't too surprising -- neither Cook nor Ive is widely associated with the _ancien regime_ at Apple so there's no downside for them in criticizing it. Mistakes Were Made, and so on, but the company is doing So Much Better Now.

From the point of view of the current leadership, it's time to both praise Jobs and bury him.</comment></comment>


Sd - a peer to peer bugtracker I actually like - <AUTHOR> http://blog.bestpractical.com/2009/08/prophet-and-sd-07-cavil-are-now-available.html

<comment><AUTHOR> I've been using this for crosstalk with rt and trac installs for some time - being something of a command line addict I find that the simple but relatively sane UI provided is not only rather good but very easy to shell script around for custom stuff.

Plus the "wget <url> | perl" installation is so wonderfully trivial it makes me incredibly happy (and I have some truly weird and hacked up perl installs on certain dev boxes and none of them have managed to fsck up the installer yet :)

</comment><comment><USER2> I'm intrigued by Prophet. Anybody here using it?

 _Prophet is a lightweight schemaless database designed for peer to peer replication and disconnected operation. Prophet keeps a full copy of your data and (history) on your laptop, desktop or server. Prophet syncs when you want it to, so you can use Prophet-backed applications whether or not you have network._

<comment><USER3> I'm interested, too. Reading the documentation now (<http://search.cpan.org/dist/Prophet/lib/Prophet/Manual.pod>). I must say, the linked presentation on how Prophet came about is hilarious (<http://www.slideshare.net/obrajesse/web-20-is-sharecropping>), full of vintage screenshots.

</comment></comment><comment><USER4> Bugs are so tightly coupled to the actual code that I am surprised no mainstream bug trackers (that I know of) actually store their databases in the version control itself. Seems like it would be easy to just store and read from the git repository, in which case all the p2p functionality is free.

<comment><USER5> Your insight is a reasonable one -- and it's where we started when we were designing SD. It quickly became apparent to us that there's a subtle but serious impedance mismatch.

It turns out that the way you want to handle merging of databases is different than how you want to handle merging of codebases.

On top of that, the obvious advantage of storing your bugs in your VCS is "branching bugs" -- unfortunately, that turns out to hurt really badly once you want to start asking questions about "what bugs are open?" and "has bug xyz been fixed."

Besides, we have a bunch of other p2p database apps we want to build that aren't sourcecode related ;)

<comment><USER6> I have found similar insights to you.

The first problem I had with using ditz on git was that I suddenly need git and ditz to just say 'hey, I'll implement this feature'. If I use trac, I just need a browser (which is clearly an advantage if you have conservative computer-pool administrators at the university :) ).

Second, I don't like how git+ditz allows one to easily see OLD version data. If you forget to pull before checking your ditz, you see old data, so you don't see how I started working on the task you start working on, so we both do the same thing. That won't happen that easily if your task&bug-management lies on a webserver.

This, merging and branching becomes a lot more bothersome, at least if the issue-tracker is not implemented carefully, as you said.

Third, I kept running into problems, because I liked to work on certain tasks in parallel, on differnt branches (because both were interesting :) ), this did not work out well with ditz either, because comments to these tasks ended up being on different branches and this, not in a central thingie.

Thus, I'd conclude that there is a certain analogy going on here: Programmers need non-programmer managers to reach peak efficiency (even though a programmer-compatible and understanding manager makes this even better), and a repository needs a good issue management tool to reach peak efficiency (even though a repository-compatible issue management tool makes this even better)</comment></comment></comment>


Unless we change course, the US agricultural system could collapse - <AUTHOR> https://www.theguardian.com/commentisfree/2020/aug/26/us-farming-agriculture-food-supply-danger <comment><AUTHOR> [https://www.sfchronicle.com/food/article/The-novice- farmer-w...](https://www.sfchronicle.com/food/article/The-novice-farmer-who- search-for-his-roots-led-to-13910953.php) : an article about the same farm from may 2019. the latest 2020 article becomes more interesting reading after reading the 2019 one.</comment>


Show HN: My first book: Orchestrating Docker - <AUTHOR> http://www.amazon.com/Orchestrating-Docker-Shrikrishna-Holla/dp/1783984783

<comment><USER2> Congrats on publishing.

Since this is your first book, and you have no immediately obvious prior published authority on the matter of Docker, I recommend you improve your Amazon author profile.

Currently I see the book and think, "this looks good!" But then I ask, "wait who is this guy, and why does he know so much about Docker?" Your author profile should answer that question, but right now it's just a brief picture of your personality. Sell yourself. Explain why you are the best person to teach me about Docker.

Always establish your authority. :)

<comment><AUTHOR> Thanks for that tip! Will do.

</comment></comment><comment><USER3> My first though on reading the title was "How can you write a book about docker and orchestration now? The tech is too immature and evolving too quickly." From the table of contents, it looks like the book doesn't actually focus on orchestration.

      1: UNBOXING DOCKER
      Installing Docker
      OpenStack
      Inception: Build Docker in Docker
      Verifying Installation
      Useful tips
      Summary

      2: DOCKER CLI AND DOCKERFILE
      Docker terminologies
      Docker commands
      Running your own project
      Dockerfile
      Docker workflow - pull-use-modify-commit-push
      Automated Builds
      Summary

      3: CONFIGURING DOCKER CONTAINERS
      Constraining resources
      Managing data in containers with volumes
      Configuring Docker to use a different storage driver
      Configuring Docker's network settings
      Linking containers
      Summary

      4: AUTOMATION AND BEST PRACTICES
      Docker remote API
      Injecting processes into containers with the Docker execute command
      Service discovery
      Security
      Summary

      5: FRIENDS OF DOCKER
      Using Docker with Chef and Puppet
      Setting up an apt-cacher
      Setting up your own mini-Heroku
      Setting up a highly available service
      Summary

I found the table of contents at [https://www.packtpub.com/virtualization-and- cloud/orchestrat...](https://www.packtpub.com/virtualization-and- cloud/orchestrating-docker)

<comment><AUTHOR> That is true. This is more of a book about Docker than about orchestration. The naming is unfortunate, and something that I did not have control on.

<comment><USER3> Okay, I understand now. Congratulations on being published! I'm sure it was a lot of hard work to write this.</comment></comment></comment>


Co-founder or employee? - <AUTHOR> I am the sole founder of a year old software start-up that is modestly profitable. At this stage I need another technical person to help me develop the product further. I want to hire a top notch engineer, and am willing and able to pay a market salary. I recently pitched my start-up to a grad school classmate who is currently working at major tech company in the Seattle area, and he seemed very interested. This guy is one of the best engineers I know, and if he joined it would be a huge help to me, both from the point of view of sharing the technical work, and just the emotional burdens of start-up life. I have been looking for a kick-ass 2nd employee for a while, and this is the first one I have found who is interested in my start-up. The problem is that he wants to join as a co-founder instead of as an employee.
However, I feel that I am the one who took all the real risk in taking the start-up from scratch to where it is today. I don't want to give up half of my start-up to another person!! I am willing to pay him more than what he currently earns, plus 5-10% equity in the start-up. But I have a feeling this won't be acceptable to him.
If I am not able to hire my friend, I don't know when I will find another equally talented guy. So I am in a bit of a dilemma. I would like to get some advice on this from fellow hackers. If someone else has been in this situation from either side of the equation, and he can share his own experience that would be very helpful in making up my mind. Thanks. <comment><USER2> I'm a solo founder, and think 5% is way too much. Your classmate has already decided that earning less is acceptable to him. If you're offering him more than he currently earns, you're already paying more than market rates. And you want to add ownership in the company?

You (and him) seem more concerned about issues of face than issues of compensation. This is dangerous. Quantify the value of your business and the value he brings. If you're not sure how much value he brings (emotional support? you're kidding me!), don't give equity. Come up with a plan to evaluate things in six months, or make a commitment that require hitting aggressive performance targets that are linked explicitly to his work. And make sure things vest.

One approach might be giving him the option to purchase up to a certain percentage of the company at a set value. Then figure out the value by asking yourself a simple question: if you had to sell the whole company, how much would you want for it? If he really cares about ownership he can purchase equity out of his salary over time. If he doesn't want to invest that is a warning sign he won't be contributing to growth.

And ultimately, remember that friendship and business is hard to mix. You will have a working relationship with him. He could easily come to resent working for you for "so little" at the same time you may come to resent giving him "such a good deal". People's relationships change when money is involved. At least by focusing on the numbers you won't toss away your business for nothing, and can be dispassionate with him when discussing what you can offer.

</comment><comment><USER3> If he's such a great engineer, go through the sums with him. Get him to sign an NDA, then talk about the value of the company. If he wants shares, he should pay for them.

Rough order of magnitude - Supposing your company has a turnover of 100Kpa and is 20% profitable. Finger in the air, the company is worth around 700K, and 10% is worth 70K cash (ignoring the details of pre-money/post-money investment).

Is he willing to put in 70K for 10% shares, and then work for dividends? Probably not. However, that's what you're doing (in effect) so why should he get a better deal?

Do the sums. They are more convincing than woolly ideas. Better yet, get _him_ to do the sums. Then you can see what he thinks things are worth.

If he's so good, don't alienate him, get him on side. Work through the issue with him. Negotiations can be win/win and don't have to be zero-sum games.

</comment><comment><USER4> this post is the reason programmers shouldn't be business guys. There is no dilemma here, the guy is offering to rape you over a barrel and you are actually thinking about pulling down your pants and bending over. Anyone who takes advantage like that is no friend to you.

Want some real numbers? At this point there are two choices: a) Full Salary + 1-2% equity. or b) 8-10% equity vested over 4 years and minimum wage salary.

Paying full salary AND 10% equity, when the startup is already beyond ramen profitable stage is insane, it only makes sense if the guy is a real genius. I mean Larry Page/Sergey Brin level, and on top of that his knowledge, is something that you MUST have. Noone else in the world has that knowledge, and you NEED it to get your product to the next level. Then, and only then can you even consider that sort of deal

<comment><USER3> You are right, but you're not explaining where you're getting your numbers from, nor are you suggesting how they can find an agreed way to proceed. Maybe his friend really just doesn't have a clue and simply needs to be educated.

I think your rhetoric is unhelpful, even if the arrangements you suggest are right. Try explaining why, otherwise it seems like more unjustified advice from someone random.

</comment></comment><comment><USER5> Some points to noodle on:

1) The emotional side of not wanting to call him a founder is something for you to get over. His title won't matter to you if he helps you become a billionaire.

2) He's part of your founding team at the very least.

3) 5-10% equity is very generous. More than I'd offer.

4) If he's the right guy, do what it takes within reason to bring him in. If he wants to call himself a founder, let him. The real story is known by you and that should be enough.

5) If you do bring him on board as a founder, you need to internalize it or you'll constantly struggle every time you see his name alongside yours in print or on the site and it will be a source of conflict.

</comment><comment><USER6> I understand where everybody is coming from when they say that salary + 5% is very generous. Really, I do. However, I would caution OP to consider the following two (which it sounds like he has, at least for item 2 below).

First, biggest reason to go over 5-10% + market salary: if you think he will bring in that much additional money. Say you pay him $100k + 10%. Suppose your current profit is $50k / year (you said you were mildly profitable). If he ramps this profit from $50k to $200k, you're still ahead of the game. Yes, it is possible: with only 1 founder, OP is stuck doing a lot of overhead work, which would take less time of a second guy. Plus, there's: 2) The emotional support. Fresh blood can definitely help the weariness and solitude of running your own company. Sure, employee #2 may not bring in another $150k, but he could help you increase what you bring in due to more enthusiasm (and, more impt, quality of life).

If you ever want to take a vacation, you will need a second in command. Higher percentage means more (emotional) ownership, so this guy is also less likely to treat it as another job. He probably doesn't want to work for someone else ever again (a common thought), so he wants more ownership.

</comment><comment><USER7> If you can edit your original post so that he wouldn't be offended if he read it, it might be worth pointing him to this thread to see the "consensus" view among other startup founders.

This could make it less emotional -- "you know, this is the done thing".

Alternatively you can assemble a short case with several links/references to show that what he's asking for is a lot.

</comment><comment><USER8> How much stability are you asking for him to sacrifice in order for the deal? ownership of the company should be thought of in cash terms, it can then be traded off directly between salary and equity. Give him a generous full package of what you honestly think he's worth, keeping in mind his current position + stability of that position vs potential stability of the position in the new organisation, and then let him pick out the details of how he wants to split it between investment in the company and raw salary.

The results should be pretty illuminating into what he really thinks of your venture.

</comment><comment><USER9> don't give in, ask him why he thinks he deserves co-founder status. If he is being reasonable he will realize you have done far more than what him walking in the door offers.

co-owners brings more issues than you may expect

</comment><comment><USER10> Trust me, there's no win-win situation in your case. just give him salary, if he's really good than give him a really good salary. That's it ;)

As soon as you start giving shares away, the one who's taking them will get greedy and ask for more. How does that end ?

You'll stop being friends ( trust me ), he'll get way much more from something that you've built than you will,

If you want to work 'in percentages' with him anyway, than do it with new projects and businesses.

</comment><comment><USER11> If you do decide to work together, be sure to have a strong legal agreement between you two. Especially, if you bring them on as a co-founder.

Key points: \- Stock vesting \- Dispute resolution \- Out clause \- the usual boiler plate

Otherwise, if things don't work out (and if they are a friend, it can get nasty) you want to have a clear plan that everyone has agreed to.

</comment><comment><USER12> If he is really that good, make him an offer that he cannot refuse. In the end , if he is really gonna make a difference , do not hesitate. Why not make him a cofounder/employee and offer him say 20% . U can also tell him to start as an employee and he will be promoted once u start making more money and need to grow.

</comment><comment><USER13> i'd pitch your best non-cofounder option first. it sounds like your offer is an appealing one, and something that i don't think anyone would be offended at receiving.

if they reject it and push for cofounder, sit down and figure out which one you want more -- to retain total control or to have this person on the team.

</comment><comment><USER14> How much do you think your company is worth? If you're considering making him a co-founder, then estimate the value of the additional equity he's asking for, and ask if he'd like to give up an equivalent amount in salary over his vesting period.

</comment><comment><USER15> Don't hire him yet. Hire him at the earliest employee 5. At that point he'll understand he's just not the only chick in a sausage fest, instead he's getting paid for his value.

Or don't hire him at all. There are a lot of quality engineers out there right now.

</comment><comment><USER16> I think you can still make him a co-founder without giving him a 50% stake. Give him 10% and make him a Director of your company (or whatever works).

</comment><comment><USER17> In my opinion, don't hire your friends unless they complement perfectly. Even then, have a backup ready in case that person wants to move on.

<comment><USER18> I've had your experience, I lost both money and a friend. People tend to over- value their contribution. If things are already working well and you're making profit, then you need to quantify how and when this guy is actually going to add value any offer should discount such a projection with an incentive component to reward over-performance.

If you need emotional support, then either book a series of sessions with a shrink or get a puppy. Long-term personal success is a function of your emotional resilience. So wanting to get your friend involved at any cost is a warning sign. For some people a mentor might be a good alternative.

</comment></comment><comment><USER19> If he is a 30+ guy, let him join as Co-founder.

<comment><AUTHOR> Care to explain why?

<comment><USER19> He will me more productive as Co-founder because his technical and business skills would reach peak stage by 30+

</comment></comment></comment><comment><USER20> What's the product?

</comment><comment><USER21> 5-10% plus pay!? And you're already profitable? Sounds like a kick ass deal to me. Give him a nice title and the deal sounds amazing and nearly too good. Especially at 10% equity. Just make sure to have vesting on his shares over 2 to 3 years.

</comment><comment><USER22> You should give him 100% of your company on the condition that he thinks about giving you a job for $2 an hour plus all the fruit snacks you can eat.

That way you'll never be accused of being a capitalist oppressing the working class!</comment>


Apple launches coding camps for kids in its retail stores - <AUTHOR> https://techcrunch.com/2016/06/21/apple-launches-coding-camps-for-kids-in-its-retail-stores/ <comment><USER3> I took my kid to one of these last year. It was fairly useless. They drag around little action-icons into a list to make an animated character move around and do stuff. My 11-year-old was bored stiff.

Edit: PS the Apple Store employee who ran this thing (he was a very nice guy) admitted he had zero coding experience himself

<comment><USER4> Yes, given the level of competence of the staff at Apple stores, it seems unlikely there could be a worthwhile coding camp at that venue. Apple would need to bring in some much higher caliber people.

<comment><USER5> Urgh, it is basics of coding course for 8 year olds. What do people expect? Albert Einstein giving lessons?

<comment><USER4> In my experience, 8 year olds often ask more penetrating questions than adults. If they take an interest in understanding something, they often desire to understand it on the deepest level possible for them - quickly exceeding the capacity of their parent or teacher to explain (unless the adult is a 'renaissance person'). (Edit: or a competent teacher with adequate training relevant to the subject)

If the 8 year olds are really encouraged to explore and ask questions (vs 'jump through these hoops, follow instructions), the staff at apple will most likely be unable to answer their questions.

<comment><USER6> Have you ever met 8 year olds? Care to give some examples of "more penetrating questions"?

<comment><USER7> Maybe jshevek means that they tend to ask "why" type questions which can be difficult to answer, as opposed to "how" type questions which are less difficult to answer.

<comment><USER4> Yes. The way that children use "why", it can mean "with what motive" but also "by what mechanism" or even "which events necessarily precede that" depending on context.

I would say that most adults are often simply unable to answer those questions because they just don't know. Children are naturally curious to levels which exceed the average adults ability to answer. Even educators are often inadequate to the task, if the question falls out of their areas of study. Some educators try to condition their students to focus on the limited prescribed domain of 'material they are to learn' and not ask questions that cross outside of that domain - in part to avoid acknowledging their ignorance.

But I would go further and say that children often also ask perfectly reasonable questions beginning with "how" and "what if" which stump adults. You can see this very readily when the topic is anything related to the natural world, as most adults are ignorant of basic science.

</comment></comment></comment></comment></comment></comment></comment><comment><USER8> A few years back my daughter went to movie camp at the Apple Store. It was really well done and they taught the kids all about making movies, how to edit, and at the end they had a big screening of all the movies the kids in the class made for all the parents. She even got a nice apple t shirt and usb keychain.

Glad to see they are now expanding it to coding.

</comment><comment><USER9> It seems like a lot of folks don't give Tim Cook enough credit in the post- Steve Jobs world for a lot of the philanthropic work Apple has done for education (as well as for the LGBTQ community.) Kudos to them for this initiative - and I'll be excited if this expands to adults at some point.

<comment> rm_-rf_slash When I was an intern at Apple I asked Tim what the hardest part was about filling in Steve's shoes and he said:

"Steve was my friend, and I don't believe a friend could ever replace a friend, so I chose to run Apple like Tim."

I've always respected that answer.

<comment><USER10> what did you intern as, at Apple?

<comment> rm_-rf_slash Can't talk about it ;)

</comment></comment></comment></comment><comment><USER11> I am pretty surprised by the general lack luster comments bordering on negativity here. Personally, I think it is great to see a major retailer take even a misguided stab at improving child tech education which has quickly fallen behind demand (in America).

Do I think the approach is more than a little bit wrong? Sure, GUI programming a non-useful task wouldn't be my choice.

Would I prefer a more robust longer-term program? Absolutely.

Does this fall well short of actually being useful/addressing the original problem? More than likely.

But despite of all that, I would much rather have Apple try this and hopefully improve on the offering pending demonstrated interest than not have it at all.

<comment><USER4> For me, it has the feeling of being more of a PR stunt than a sincere effort to help education. Plus, its an opportunity to build brand allegiance at a young age.

I would rather Apple donate an equal amount of money to any of those entities out there which help to bring technology to the youth.

<comment><USER12> I don't see this as a PR stunt at all, this goes to one of Apple's core values. Apple's very good at marketing, if this were a PR stunt they would have large brand building ads and little substance, whereas this initiative requires a lot of resources, logistics and investments to run and are offering it for free.

Since Tim took over Apple's been doing a lot more towards "We want to leave the world better than we found it". Eventually I expect it will be good for Apple's bottom line long-term, but this follows their theme (e.g. Swift playgrounds, WWDC Scholarships) of helping teach more kids how to code. Personally I think Apple wants to attract students, because they prefer that demographic. There would be a lot more money to be made going after Enterprise wallets than spending it on free programs for cash-poor students.

Basically under Tim's leadership I'm expecting Apple to invest a lot in: Green Energy, Kids Education, Privacy, Diversity. Not because it's good for their bottom line, but because they think it's the right thing to do.

<comment><USER13> Perhaps add privacy to that list as well. Hopefully.

<comment><USER12> Updated, thx. Yeah that's definitely one of their core values.

</comment></comment></comment></comment></comment><comment><USER14> Ironically, I sometimes fear Apple would be the harbinger of programming's death, what with how much can be done via consumer-friendly app and touch- screens. It didn't help hearing about OSX becoming macOS, which would be well in line with a dystopian future in which the only people who need to know about plaintext and file systems are the full-time Apple programmers.

But this sounds like a great initiative...and also, one that seems to be nearly all upside for Apple. Great PR, good benefit to society, increased buzz at the brick and mortar stores, and the cost of running these camps seem like it would be more than paid for by kids who are not only buying the programmable peripherals (anyone have experience hacking the Sphero?), but Apple products for all of their coding lives.

<comment> rm_-rf_slash I think the invention of the GUI killed the dream of mainstream programming.

If computers had to be interacted with in ways that resembled programming - like a UNIX prompt - then people would be more used to the way computers actually work, with functions and parameters instead of icons and settings menus.

I really hope that raspberry PI gets more mainstream appeal as time goes on. I fear the separation between coders and users is creating parallel worlds of echo-chamber wizards and ignorant commoners.

<comment><USER15> I believe as you do and in basically the same terms, but, having had forms of this discussion for much of my life, I've encountered a counterargument that I thought I'd bring up as a devil's advocate:

> the way computers actually work, with functions and parameters instead of > icons and settings menus

Isn't "the way computers actually work" at a fundamental level about electrical engineering, or at least about machine instructions? If you're using Unix commands, hasn't a whole lot of work already been done to create the abstractions of pipes, file descriptors, files, filesystems, and so on? Is it clear that there is some sense in which these abstractions are faithful and true to the machine and technology, where other software abstractions are not?

<comment><USER15> I got a ton of upvotes on this, but nobody has replied to it! I wonder how many people who upvoted me noticed that I claimed to be expressing an argument against my own opinion. :-)

<comment><USER16> I noticed, but I'm sort of mystified about why you wouldn't agree with that opinion. Clearly the command line is an order of magnitude more abstract than practical electrical engineering.

We need different people to understand different layers, and as long as there are enough people paying attention to each layer, there's no problem.

</comment></comment></comment></comment></comment><comment><USER17> I remember going to Apple Camp as a kid (around 2006). At the time, they had different sessions teaching kids how to "edit movies", "make music", "build websites" etc. They were showing us how to use iMovie, GarageBand, and iWeb.

After attending those camps, I so badly wanted a Mac.

</comment><comment><USER18> As much as I want to cheer this it leaves me with the sour thought that modern Apple robbed kids of the joys the original Apple afforded. Growing up with the Apple II+ in our home I was programming from an early age because that was the primary activity you could do with one right out of the box. Look at the loops you have to run through to unleash the power of the iPad. Developer accounts, EULAs, closed APIs. Where is the modern equivalent of computer clubs where most members could code or at least were interested?

</comment><comment><USER19> I find this program ironic since Apple locks down iDevices pretty hard - <USER2> App Store rules prohibit coding[1] on iPhones & iPads. If anyone were to attempt to make an interpreter/port Scratch or Python to iOS, the app would not be approved.

1\. §3.3.2 An Application may not download or install executable code. Interpreted code may only be used in an Application if _all scripts, code and interpreters are packaged in the Application_ and not downloaded.

<comment><USER20> Perhaps you haven't heard about Pythonista, which is a full Python programming environment available on the App Store. Now there's also Playgrounds, which is a Swift programming environment that comes with the iOS 10 beta and runs on the iPad (you can even invoke iOS frameworks, apparently) — yes, this is from Apple itself, and yes, they're bending their own rules. But your original statement is not strictly true.

<comment><USER21> In what way are they bending their own rules? The application comes with it's own Swift compiler and exposes only the public APIs.

Nothing Pythonista couldn't do already.

<comment><USER22> Pythonista cannot open code from other apps so all code has to originate in the app (other than copy-paste).

Swift Playgrounds can round-trip with XCode.

</comment></comment></comment></comment><comment><USER23> People often suggest that we should be teaching programming in primary/elementary school to kids.

I'm skeptical that that would encourage kids to code. This opinion is particularly espoused by politicians who can't code but want to be seen as technically progressive.

I think part of loving programming is discovering it on your own and seeking it out. Events/Sessions like this and CoderDojo that we have here in Ireland are more effective at evangelising kids to code because it endows a greater sense of autonomy to the individual that what you get in a classroom and I think thats a more conducive environment to encourage coding.

<comment><USER24> I've long felt that the utility of learning to code was less about vocational training but more about analytical thinking.

Ie, figuring out how to solve problems by analysing a task and breaking it into small and discrete bite-size pieces that can be understood by a computer's rule set.

<comment><USER25> Hopefully a course like UC Berkeley's "CS10: The Beauty and Joy of Computing" can point the way: [http://cs10.org/su16/](http://cs10.org/su16/)

"But this course is far more than just learning to program. We'll focus on some of the "Big Ideas" of computing, such as abstraction, design, recursion, concurrency, simulations, and the limits of computation. We'll show some beautiful applications of computing that have changed the world, talk about the history of computing, and where it will go in the future. Throughout the course, relevance will be emphasized: relevance to the student and to society. As an example, the final project will be completely of the students' choosing, on a topic most interesting to them. The overarching theme is to expose students to the beauty and joy of computing. This course is designed for computing non-majors, although interested majors are certainly welcome to take the class as well! We are especially excited about bringing computing (through this course) to traditionally under-represented groups in computing, i.e., women and ethnic minorities."

</comment></comment></comment><comment><USER26> That's a really good idea to make the future developers learn the Apple platform. But Microsoft had a better one; to buy Minecraft and add it to Visual Studio.

</comment><comment><USER27> Microsoft already does one day events in their stores. My SO who's an elementary school teacher took her class to one of them.

<comment><USER28> I didn't know that. I found the link to the MS summer camps.

[https://www.microsoft.com/about/philanthropies/youthspark/yo...](https://www.microsoft.com/about/philanthropies/youthspark/youthsparkhub/programs/yscamps/)

</comment></comment><comment><USER29> I like Apple's initiative but why use a third party application instead of their Swift Playground? It seems more appropriate and based on what's shown on WWDC, it's not that hard to learn.

This is a possible sign that Tynker can be bought by Apple soon to be integrated with Swift Playground.

<comment><USER30> Swift Playgrounds only runs on the iOS 10 beta and is itself still in a prerelease form.

<comment><USER29> It's possible that it still runs on iOS 10 beta, but based on their sample templates and what they have used in WWDC16, it's already a fully functional app. Better implementation than Tynker. And it's also a good preview for future coders to use.

<comment><USER30> Yeah, and it might even be the best choice to use it. I'd guess it would be. But it feels against Apple's "house style" to use unreleased software in that way.

</comment></comment></comment></comment><comment><USER31> It would be more useful to teach them an ultra-simple language like BASIC (there was an article posted about it recently -- the early DOS version -- still being the best language/IDE to teach kids), or even a stripped down version of javascript. Imagine the advantages in pure thought that would come for those kids that are able to grok functional programming at age 8?

<comment><USER6> Why do you want to expose kids to the horrible mess called JavaScript? And you can teach functional programming with Swift, thank you very much.

</comment></comment><comment><USER32> Can I do the coding camp? I'd like to learn...

</comment><comment><USER33> Does anyone else ever wonder if this is part of a long term strategy to reduce costs by inflating the pool of developers? Corporations can think long term.

</comment><comment><USER34> for a second i thought it said walmart in the beginning

</comment><comment><USER35> Why aren't there any white people on the pictures?

<comment><USER36> Because you need glasses?

</comment></comment><comment><USER37> I don't think it's necessarily fair to call this program "philanthropic." It's teaching kids how to use proprietary and commercial software, like iMovie, iBooks, and Tynker, when completely free alternatives exist like Blender and Scratch.

This is essentially building a new generation of future Apple customers.

<comment> rm_-rf_slash It's still better than nothing.

If Uncle Ben's rice donates its branded rice to victims of a natural disaster - provided the containers say "Uncle Ben's Rice" \- would you refuse it for a generic?

<comment><USER37> If I were a relief agency, and those were the terms of their donation, I would refuse it. If they aren't willing to donate without making it a marketing opportunity, it's not really charity/philanthropy.

<comment> rm_-rf_slash Wow. You would rather people starve than look at a logo?

Wow.

<comment><USER37> No, _they_ would rather let people starve than _not_ look at their logo.

</comment></comment></comment></comment></comment><comment><USER38> Why surprised? This is HN

<comment><USER11> I suppose I anticipated a more open reception to the idea of Apple leveraging it's brick and mortar locations for something like this from a tech oriented community.

Not that you have to like the course, there is a lot to dislike about it, but the melding of Apple's store location infrastructure for providing accessible child bootcamps certainly is an interesting concept.

I was surprised everyone chose to focus on the course content instead (at least when I wrote the comment originally).

</comment></comment><comment><USER39> They're taking our jobs!</comment>


Who Is Anna-Senpai, the Mirai Worm Author? - <AUTHOR> https://krebsonsecurity.com/2017/01/who-is-anna-senpai-the-mirai-worm-author/ <comment><USER2> One of the comments on the Krebs article points to a Reddit comment from "Anna-Senpai" posted five days ago, before the article was published (note: contains strong language): [https://www.reddit.com/r/AskReddit/comments/5nqq3c/serious_p...](https://www.reddit.com/r/AskReddit/comments/5nqq3c/serious_people_whove_written_malicious_code/dce7rh9/)

</comment><comment><USER3> Just wanted to add a slightly off-topic note:

> At the time, an exploit for a software weakness in Skype was being traded > online, and this exploit could be used to remotely and instantaneously > disable any Skype account.

According to this article [1] blocking someone's account is still possible.

[1] [https://hub.zhovner.com/geek/how-skype-fixes-security- vulner...](https://hub.zhovner.com/geek/how-skype-fixes-security- vulnerabilities/)

</comment><comment><USER4> Amazing read. I'm wondering if the release of this information has been timed with some other events - sort of responsible disclosure to FBI. I assume there's been an ongoing federal investigation and this will clearly tip the subject in destroying everything they're sitting on.

<comment><USER5> This was actually all disclosed to the FBI in advance when the Mirai source code was originally released. Afaik Krebs has also been communicating with them and sharing his findings. It's not really a disclosure so much as a reaction because I'd assume the FBI investigation has advanced and he now believes it's the appropriate timing since all the puzzle pieces came together. The information has been held back for quite a bit to not interfere with the FBI.

</comment></comment><comment><USER6> Wow, I wouldn't be so confident in putting all this personal information out it the open. But this was a great read.

It's both sad, worrying, and slightly comforting that Mirai is run by a bunch of kids. Gives me hope that these issues can eventually be resolved.

<comment><USER7> > I wouldn't be so confident in putting all this personal information out it > the open

Neither would I, because there is no proof of it. It is entirely coincidence and hearsay. Interesting to pass on to police, but not necessarily to call someone out publicly with.

</comment></comment><comment><USER8> > 20-year-old [ProTraf] President Paras Jha, from Fanwood, NJ

<comment><USER9> Yep, noticed that too. Plus he's Indian, which makes me want to apologise for my Race :(

<comment><USER10> Don't. Every race has its assholes, and they aren't representative of everyone else.

</comment></comment></comment><comment><USER11> Well written and a decent read, but honestly though, does anyone actually care? Sure, disclose this to the FBI but I can anticipate the apathy of anyone who is even a little familiar with the HF skid scene.

It's just another skid that made some bruteforcing malware but this time let the other little HF skiddies have fun with it too instead of just hoarding it for himself.

<comment><USER12> What do you mean when you say "HF skid"?

<comment><USER13> hf = Hackforums, skid = script kiddie</comment></comment></comment>


Smartphone Users Wasting Hundreds Of Dollars Per Year On Unnecessary Contracts - <AUTHOR> http://www.mobilecrunch.com/2011/04/11/study-smartphone-users-wasting-hundreds-of-dollars-per-year-on-unnecessary-contracts/ <comment><USER2> None of these issues are a problem for Sprint customers. Sprint lets you change your plan anytime, so you can drop to a lower plan or move up to a higher plan without extending your contract. They even have a tool that analyzes your usage over the past year and recommends the best plan for you. Not that voice minutes are even necessary these days, with VOIP over broadband, free nights starting at 7pm, free weekends, and free calls to any mobile number (including Verizon, T-Mobile, and AT&T). And for data, 4G plans are unlimited, so there are never any overage charges (though 3G-only plans are capped at 5GB or 2GB).</comment>


The Physical Origin of Universal Computing - <AUTHOR> https://www.quantamagazine.org/20151027-the-physical-origin-of-universal-computing/ <comment><USER2> This concept really resonates with me in many ways. I like to also think of the mind/body problem in the same way. Physical processes in the universe construct the brain, and while in a different form, the same algorithms, patterns, math, emergence form consciousness and the mind. These artificial walls of difference/understanding/categorization only hinder our ability to understand the true nature of things.</comment>


Draft chapters of the Ruby on Rails Tutorial, 3rd Edition - <AUTHOR> http://news.railstutorial.org/rails_tutorial_3rd_edition/

<comment><USER2> I have no affiliation with the author, but I'd recommend this book to pretty much anyone trying to learn Rails, I own the second edition.

Before this book I'd never done any real web programming. My background is in compilers and trading systems/machine learning( those two are essentially one in the same), all C++ desktop software.

The book got me up and running, better than any of the online rails tutorials, and there are a lot of rails tutorials online.

One thing I really appreciated was that it didn't just build an app, it actually took you through the steps of deploying on Heroku and using git.

A Lot of other books and tutorials seem to assume you want to build an app and run it as localhost for the rest of its life.

The other nice touch was the chapter that teaches a Rails flavoured Ruby. As someone who had used Ruby for scripting, but never for Rails, I thought this was a nice touch.

<comment><USER3> I actually recommend strongly against this book. It teaches things new people to Rails, let alone people new to programming, don't need to be messing with so early on. I'm mainly talking about the use of RSpec and some of the outdated Rails idioms.

For myself and a few people I've mentored, Agile Web Development with Rails[0] has yielded much better results. If they follow that up with Eloquent Ruby[1] they will be golden and well ahead of their peers with similar experience.

This book single-handedly breeds the "I'm a Rails Programmer!" that write terribly awful Ruby code that we all know and hate.

I don't mean to discredit Michael's hard work. Writing and maintaining a book like this is a huge achievement that I'm probably not capable of. I also appreciate that his book is at least bringing people into the Rails ecosystem. I just can't recommend it over others.

0 - [https://pragprog.com/book/rails4/agile-web-development- with-...](https://pragprog.com/book/rails4/agile-web-development-with-rails-4)

1 - [http://www.amazon.com/Eloquent-Ruby-Addison-Wesley- Professio...](http://www.amazon.com/Eloquent-Ruby-Addison-Wesley-Professional- Series/dp/0321584104)

<comment> adi-pradhan yeah i wasn't too fond of the use of non-omakase stuff but i believe that is now resolved

"100% default stack. The 3rd edition of the Ruby on Rails Tutorial uses the default Rails choices for all relevant technologies, thereby substantially reducing the configuration necessary to get started. The excellent but syntactically heavy RSpec testing framework has been replaced with the default Rails testing stack (MiniTest), making for a much gentler introduction to testing than in previous editions."

<comment><USER3> This is good to hear. I'm glad to see RSpec removed. A better example site than a microblog would be an even better step in the right direction. Learning to program via building social website clones needs to stop. I've called out all the Developer Bootcamps that do that kind of teaching, too.

</comment></comment></comment></comment><comment><USER4> Wow! I am mentioned in Chapter 1.

> If you still find this tutorial too difficult, you might try starting with > "Learn Ruby on Rails" by Daniel Kehoe...

Thank you, Michael. It's generous to mention my book. I've said that we need a better introduction for beginners and I'm overjoyed to see the improvements in the 3rd Edition. In the last two years, so many more people want to learn Rails, often without any background in other web platforms (or even programming).

</comment><comment><USER5> Very encouraging to see tests used more sparingly. I was a novice developer when I first tried this tutorial and found myself lost in the weeds when I tried to follow along with rspec. Understanding the difference between rspec and cucumber probably isn't critical at that point. The tutorial made a lot more sense to me after someone recommended ignoring the tests the first time through.

<comment><USER6> My first time going through(and then second time a few weeks later), I totally ignored the tests and felt like I was better for it as well.

</comment></comment><comment><USER7> I totally agree with chollida1. This is always the first tutorial I point people at.

Is it possible to add "overflow: scroll" to the code sample blocks' CSS? I get a few characters flow down to the next line which is a bit ugly. A couple of examples:

[http://draft.railstutorial.org/book/rails_flavored_ruby#code...](http://draft.railstutorial.org/book/rails_flavored_ruby#code- application_layout_full_title)

first code block here (with a wrapped "g"): [http://draft.railstutorial.org/book/rails_flavored_ruby#sec-...](http://draft.railstutorial.org/book/rails_flavored_ruby#sec- back_to_the_title_helper)

<comment><AUTHOR> Weird. Those code blocks look fine locally, so that's a bug. Will fix ASAP.

UPDATE: They actually look fine in Chrome, but not in Firefox! I'm digging into it now.

UPDATE 2: Looks like it's working now

<comment><USER7> Well, that's odd. They have the wrapped characters in Mac Chrome for me, but _not_ in FF.

Another comment says change deployed but they're still off in Chrome on Mac (even with a forced/shift reload): [http://imgur.com/IIaUiav](http://imgur.com/IIaUiav)

</comment></comment></comment><comment><USER8> These sound like really awesome improvements - that installation and configuration cliff and the heavy use of RSpec were the two things that kept me from recommending the 2nd Edition to beginners.

If you've got time, it'd be nice to see the installation and configuration chapter make it in as an appendix, since new programmers are going to want to set up their development environment at _some_ point - it's just better to have it at the end of the book, when they've hopefully already gotten hooked.

<comment><AUTHOR> Thanks for the suggestion and for the kind words. Instructions for setting up a local development environment are already effectively an appendix, because the _Ruby on Rails Tutorial_ just defers to the excellent [InstallRails]([http://installrails.com/](http://installrails.com/)) service provided by One Month Rails.

<comment><USER9> Hello. Thank you so much for the book and the pioneering model that you have published it with. All the best on the platform for distribution.

Please don't take the advice to downplay rspec. I think in chapter 8 you update the User model. It was so incredibly nice that, having been a week or so since I was able to work on the project, I was confident that the introduced changes did not break any functionality of the app. It is very easy to not see the benefit of testing when learning, only to curse your luck when you look at code later.

I have recently read a good article using your test suite as an example of how to improve tests. The author criticized the terse nature of your tests, with subject and nested describes. He felt that you write once and read often, so there is great benefit to making the tests verbose. It is, in effect, a contract that any User model must satisfy to be a valid user model. Going DRY and code golf on it only helps to frustrate the person looking to acclimate themselves to a project rather than saving a few minutes during test creation.

Again all the best and thanks for the wonderful tutorial and interesting distribution network.

<comment><AUTHOR> _Please don 't take the advice to downplay rspec._

I think you may be confusing RSpec with testing generally. The 3rd edition replaces RSpec with the default Rails testing framework (MiniTest), but it still develops a thorough test suite.

</comment></comment></comment></comment><comment><USER10> I learned Rails with this tutorial (for Rails 3), which was good, but I thought it covered too much testing which is a bit overwhelming for someone starting off. Its everything-at-once approach also made it harder to reference topics afterwards. The changes in this edition like they'll be pretty helpful. It's also cool that he'll be using a default Cloud9 environment so people don't need to worry about installing anything.

However, I still think there's space for a fully modular approach to learning Rails instead of covering so many topics at once. For example, users could first learn how to use Active Record to interact with data on its own, and only later learn the other steps to building an app. This would also make it easy to look up topics later or just jump into the parts you're interested in. It would also be cool if users were given tasks with pre-written tests (but without solutions) so they would need to figure out the solution on their own and immediately see if they got it right.

(I even thought of creating a small Rails tutorial on [http://www.learneroo.com](http://www.learneroo.com) but I can't currently run Rails on it. I guess one could either use an online IDE like Cloud9 or setup a custom Docker environment.)

</comment><comment><USER11> Hi Michael

Thank you for creating this resource, I used your book to learn ruby on rails.

I think all of the changes you made make sense to a person new to rails and they solve problems/walls I hit while progressing through the book:

\- setup/configuring rails. In my case I was using non standard hardware, a web IDE eliminates the issue

\- default stack: while going through the book, I was also referring to the official rails documentation, which uses defaults like mini-test and not rspec. Juggling two testing frameworks as someone new to web development was overwhelming.

\- test lite: same as above

\- version specific features: removing another point of failure is good

\- highlighting lines: not sure, but it's good to see innovation

</comment><comment><USER12> Similarly to what others have mentioned, I've also found Hartl's Ruby on Rails online edition to be the most comprehensive and impressive tutorial yet. I'd already had a strong foundation on Git, Heroku, TDD-testing, etc. but it was nice to see how they integrated so well with a Rails project and I personally believe they are both beneficial and critical for any web application development.

However, after a cursory glance at the tutorial, I was surprised to see how embedded Cloud9 was in this new version and that seems to be the route Hartl has taken. I'm wondering if anyone has used Cloud9 and what impressions they have?

Great work! Looking forward to taking a deeper look into the tutorial.

<comment><AUTHOR> Thanks for the kind words. To allay your concerns, Cloud9 isn't embedded at all; it's just the recommended environment if you don't already have something set up. Anyone who already has Ruby installed, has a favorite text editor, and knows how to use a command-line terminal can still follow the tutorial as written.

</comment></comment><comment><USER13> This is not only the best tutorial-style book I have ever read, but probably the best book there is to get into web programming for someone who has never done it. This book totally demystifies the process from start to finish:

* What's a web framework? * Why do I want one? * How do I set up useful version controi? * How do I build an app? * How do I test my app? * How do I deploy my app to the real world?

No other book I have ever seen answers so many questions so eloquently. Thanks mhartl, you are doing something great for new web developers everywhere.

</comment><comment><AUTHOR> As noted in the announcement, I think this is the best edition yet. I'm planning to monitor the HN comments today, and I'd be happy to answer any questions.

</comment><comment><USER14> I'd like to thank Michael for putting so much work into this - it has helped me obtain a baseline of knowledge to get into web development as my career about 2 years back (even though I have been mostly doing JavaScript professionally), and I recommend it wholeheartedly to anyone interested in trying to learn about web development.

</comment><comment><USER15> As someone who purchased the previous version, I emailed Michael to ask if upgrade pricing would be available. He responded immediately saying there will indeed be upgrade coupons for existing owners, which is good news. I really learned a lot from this book and am looking forward to the updates!

</comment><comment><USER16> Michael, let me ask two predictable questions.

1\. When do you expect to complete the 3rd edition? Seeing as the book is being heavily reworked and knowing your attention to detail, I guess the answer is "when it's ready".

2\. Will the Rails version be fixed at 4.1?

<comment><AUTHOR> I expect the full 3rd edition draft will be released within a couple of weeks. I hope to make a full launch (with screencasts) some time in October or November.

I expect to use Rails 4.1 unless 4.2 is out of beta in time to use for the screencasts. I've compartmentalized the version-specific material, though, so I'm cautiously optimistic that I can swap in new Rails versions (even in the screencasts) as they're released.

<comment><USER16> Do you intend to make use of new 4.2 goodness or simply make the tutorial 4.2-compatible? Granted, some of the improvements in 4.2 are out of scope for the book (like ActiveJob), some are performance related, but there is also web console. It fits the philosophy of the new edition perfectly and would be a useful addition to the book.

<comment><AUTHOR> I'd love to make the tutorial Rails 4.2–compatible before the final revision ships. It really depends on how soon 4.2 final is released. And I'll take a look at web console, which seems like it could be useful.

</comment></comment></comment></comment><comment><USER17> Nice to see the testing toned down a lot.

Previous versions had way too much emphasis on testing, something I'd say unfortunately even 70% of real working Rails developers don't do in real projects.

</comment><comment><USER18> do you recommend using an online IDE only for beginners or is it something you would utilize for your own projects?

<comment><AUTHOR> So far I've only used them for the tutorial, but I definitely expect to start using cloud IDEs for real projects as well. They've really come of age in the last year or two. I suggest giving the recommended cloud IDE a try to see if it might meet your needs as well.

<comment><USER18> Thanks so much for replying! I am president of the Coding Club in my high school, and a lot of the rails teaching that I'm doing is based off of what I learned in your book. The school doesn't allow installing software on the computers, so using a Cloud IDE will be perfect for us. Thank you so much for writing such a great tutorial!

</comment></comment></comment><comment><USER19> Michael, great work as always. Your tutorials helped me to get up to speed on Rails quickly. Just curious, is there any particular reason you switched from GitHub to Bitbucket in your tutorial?

<comment><USER20> I agree, great tutorials. I was also wondering the same thing about Bitbucket.

<comment><AUTHOR> See [Box 1.4]([http://draft.railstutorial.org/book/beginning#aside- github_b...](http://draft.railstutorial.org/book/beginning#aside- github_bitbucket)). The tl;dr is that Bitbucket is free for private repos, which for security purposes the new edition uses by default.

<comment><USER20> Thanks for also replying, I wouldn't have seen this otherwise.

</comment></comment></comment></comment><comment><USER21> I looks great so far, I'm really excited about the extended auth section. Have you ever given any thought to adding a section on working with/building APIs?

<comment><AUTHOR> I don't plan to cover APIs in the core tutorial, but I've had a couple of requests for that subject and will consider making a follow-on product.</comment></comment>


Apple's Genius Bar Manual That Teaches its Employees How To Manipulate Customers - <AUTHOR> http://www.slate.com/blogs/future_tense/2012/08/30/apple_genius_bar_training_manual_a_brilliant_manipulative_guide_to_customer_service_.html

<comment><USER2> Standard customer service really. This is nothing new, just a well-executed image and customer relationship plan with a system to put it in place effectively across their whole company.

Customer service and sales is apparently is A-OK if done by any other company, but if done by Apple suddenly it's "manipulating customers?". Absolute hogwash.

<comment><USER3> I'm sorry you're feeling that way, but I personally found value in the article.

Thanks for the comment and listening to my feedback. And thanks for "giving it!"

<comment><USER2> Oh I found value in the article, it's very interesting; just think the title was a bit inflammatory. :)

</comment></comment></comment><comment><USER4> "But while he reads Apple's tactics as outlandish and creepy, if brilliant, I'd just call them brilliant."

And I would read them as standard sales technique. "Feel, felt, found" or "the three F's" is well known.

</comment><comment><USER5> They won me when I spilt water on my 2 months old Macbook Air and they gave me a new one at no charge.

The genius thought it was really cool that I am a programmer and I was developing apps :-).

<comment><USER6> I've spent thousands more on Apple products once I got a taste of the return policy. My iPhone 3G was 2 months from the end of it's warranty period and the speakerphone stopped working (most likely from me dropping the phone too much) and because they couldn't solve it at the Genius Bar they just gave me a brand new one.

<comment><USER7> My taste of their return policy involved me taking back my busted iphone 4 that was 3 months old into the Apple store expecting a good outcome, like I always hear on the internet, instead I was accused of being a liar and that the phone was water damaged and that they could not do anything for me.

Mind you, I had not even gotten to the genius bar at this point and they had not even looked at the white stickers inside the phone and socket to look for water damage.

Looking up my name also would have indicated I too had spent thousands on apple products.

I had to fight and claw my way through multiple managers and then multiple people at the genius bar before I finally got my phone replaced, and in the end, the way the replacement phone was issued to me was almost like I was being given hush money to shut up and go away. It was pretty ridiculous and extremely unprofessional.

It's not even my worst experience at an Apple Store, which says a lot.

I'm still a big fan of Apple's products, but not a fan at all of the Apple Store, and it is unlikely I will ever step foot in one again after what I've had to endure.

Then again, this all happened in Australia, and our standards with customer service are noticeably much, much lower than in America, so maybe that had something to do with it and the Apple Stores in America do have the excellent customer service I keep hearing about

<comment><USER6> Well, I've always gone to the stores in the San Francisco Bay Area and people here are generally Apple friendly and those I've talked to at the stores seem to be fairly happy. Maybe there's less Apple-geeks working at the stores down under?

<comment><USER7> I believe that. San Fransisco is an amazing place full of amazing people.

Unfortunately over here in Australia, I suspect it is just the general state of any industry involving customer service.

When going to many of the restaurants in Sydney it is extremely rare to experience the kind of customer service which you take for granted over there. We don't do tipping, so that probably explains that.

There are no shortage of apple geeks in Sydney. Theres two Apple Stores in Sydney now as a matter of fact - both on George St (the main street that goes through the Sydney CBD)!

Sydney is a lot like SFO was to me in the sense that its impossible to go out in public for more than a couple of minutes without seeing somebody using an apple product!

For whatever reason though, it seems that Apple Australia keeps hiring the people who really don't show a great deal of passion in Apple at all (or people for that matter)

I'm sure theres plenty of good people working at the Apple stores around Australia, unfortunately I always seem to get the opposite, perhaps I'm just extremely unlucky, but I feel its gone well past that point now.

</comment></comment></comment></comment></comment><comment><USER8> _BREAKING NEWS: Sales people use sales tactics to make sales!_

Details at 10.

</comment><comment><USER9> Blogspam.

Original article: [http://gizmodo.com/5938323/how-to-be-a-genius-this-is- apples...](http://gizmodo.com/5938323/how-to-be-a-genius-this-is-apples- secret-employee-training-manual)

</comment><comment><USER10> Though the OP is referring to another blog post that calls the techniques "creepy", the word "manipulate" is a bit strong for what the OP chooses to excerpt:

      Customer: This Mac is just too expensive.*
      Genius: I can see how you'd feel this way. I felt the
        price was a little high, but I found it's a real value
        because of all the built-in software and capabilities.

      [from the OP:]  This tactic dovetails nicely with the section of the
        manual on things to avoid saying and doing. For
       instance: "Do not apologize for the business [or] the
        technology." Instead, empathize: "I'm sorry you're
        feeling frustrated," or "too bad about your soda spill
        accident."

Yeah, that's not really "manipulation" in the way that most people conceive of it. Manipulation would be, "Yeah, but can you put a price on the happiness of seeing your child's photos seamlessly imported and displayed beautifully on a retina screen? I mean, if you really love your child..."

<comment><USER11> They're simply using the standard "Feel, Felt, Found" formula , which I believe was pioneered by Roger Dawson in "Secrets of Power Negotiating" - [http://www.amazon.com/Secrets-Power-Negotiating-Roger- Dawson...](http://www.amazon.com/Secrets-Power-Negotiating-Roger- Dawson/dp/1564144984)</comment></comment>


Pandavirtualization: Exploiting the Xen hypervisor - <AUTHOR> https://googleprojectzero.blogspot.com/2017/04/pandavirtualization-exploiting-xen.html <comment><AUTHOR> Related Qubes security bulletin: [https://www.qubes- os.org/news/2017/04/04/qsb-29/](https://www.qubes- os.org/news/2017/04/04/qsb-29/)

</comment><comment><USER2> What does this sort of security vulnerability mean for the security of Qubes OS? Also, isn't Xen often used on cloud infrastructure to keep individuals' instances separate?

<comment><AUTHOR> Qubes is vulnerable to the published exploit, a patch will be issued and Qubes 4 will use HVM not PV.</comment></comment>