Ask HN: Do you use a Chromebook or Pixelbook as your primary machine? - <AUTHOR> I love the design on the new pixelbook - https://store.google.com/us/product/google_pixelbook but I have a hard time believing that its of any use for a developer or even a remote power user. Does anyone have any experience using it as their primary machine and for what purposes ? <comment><USER3> I used to. I had the second-gen Pixel that has apparently become the third-gen Pixelbook because Google couldn't even resist stealing the name of their own product for something completely different.

I loved it. I could have run Linux natively, but I've spent too much of my life already fighting all the familiar recurring sound/video and suspend/resume and wifi issues on Linux laptops. No, it's not because I'm bad at it. I worked at Red Hat at the time, where most of the people who actually fix this stuff for you also work, and I was no worse than others around me. But being good at fixing problems isn't the same as not having to put up with them in the first place. I don't want to have to take even ten minutes to debug a system issue in the middle of trying to do something else while I'm on the road, over and over again every month or so. The whole point was to have a base platform that was feature-complete and stable, plus a full Linux environment (via crouton) with all of my favorite tools available simultaneously. It also helped that it's a beautiful piece of hardware, with a nice (somewhat square-ish) screen and a trackpad that works and the best battery life I've seen so far.

It was really like having two laptops instead of one, each suited to its purpose. The only reason I don't still use it is that I couldn't be bothered replicating all of the "special sauce" to conform with the infosec requirements of my current employer on an OS different than the one they installed on the laptop they gave me. If I were to switch jobs again, or retire, I'd gladly go back to the Pixel.

<comment><USER4> I have a Dell XPS13 Dev Edition. I run Ubuntu on it natively, but really hitting the same things you describe. Ubuntu is usually a joy to use, but having to debug random things at random times while at work or on the road really stinks. I'm really on the fence at this point about just getting a Macbook. My work laptop is a Macbook and really polished for development.

<comment><USER5> I'm also using Dell XPS 13 (model 9360, non-touch, 1080p screen) with Fedora 26, and I haven't had any issues. This is by far the best linux laptop I've had. Just another data point in case someone is looking into buying these.

<comment><USER3> Linux on laptops is like a disease. It's rare that _everyone_ gets sick, but it's bad enough that many do. Even at Red Hat, where the employees collectively know more than anyone about making Linux run on laptops, internal mailing lists were often full of gripes about issues. If it wasn't the Big Three that I already mentioned, it was fans running constantly and batteries being sucked dry, switching monitor resolutions or dis/connecting a second monitor leaving things in a weird state, the utter impossibility of getting trackpads to work as well as they did under Windows/MacOS, international keyboard layouts not behaving properly, camera remaining locked when it shouldn't, and so on and so on ad nauseam. If you never hit _any_ of these then good for you, but I can say with absolute confidence that such an experience is exceptional.

<comment><USER6> Had arch linux running on an Samsung ativ book 9. No real/relevant issues.

</comment></comment></comment></comment></comment><comment><USER7> Yes, been using it as my primary development machine for the last two years. I work on a large Node / React codebase, and occasionally do design work.

My setup:

* Chromebook Pixel 2 in dev mode

* Crouton ([https://github.com/dnschneid/crouton/](https://github.com/dnschneid/crouton/)) running CLI-only Debian stretch

* Google's SSH app ([https://chrome.google.com/webstore/detail/secure-shell/pnhec...](https://chrome.google.com/webstore/detail/secure-shell/pnhechapfaindjhompbnflcldabbghjo))

* Tmux running with NeoVim, cmus for music

My dotfiles and setup scripts are all here: [https://github.com/fortes/dotfiles](https://github.com/fortes/dotfiles)

Overall, I like this better than the old mac setup I have. Being in dev mode (and having to enter crouton chroot once per boot) aren't ideal, but I've gotten used to it. I'm hoping that maybe we'll get first class support soon though ( [https://www.reddit.com/r/chromeos/comments/742f8j/how_chrome...](https://www.reddit.com/r/chromeos/comments/742f8j/how_chromeos_vm_and_containers_will_seem_to_run/) )

<comment><AUTHOR> What do you use for the design work ? Just standard debian based software ? Any hacks to get adobe software working ?

<comment><USER7> Design work done mostly done in browser via Figma: [http://www.figma.com/](http://www.figma.com/)

Debian is strictly via CLI, I don't do any GUI apps via crouton, felt too janky and I didn't really need the overhead.

</comment></comment></comment><comment><USER8> They're fine machines once you install real Linux on them. The hardware is excellent and they make great laptops for doing real work. Here are some notes about installing Xubuntu on the 2013 model. I hope some of this transfers to newer models: [https://lee-phillips.org/pxsetup/](https://lee- phillips.org/pxsetup/)

<comment><USER9> > The hardware is excellent

Is there a particular model you recommend? Seems like there are a variety of chromebooks, I wouldn't expect them to all be the same quality, but perhaps they are?

<comment><USER8> I was writing about the Google Pixel models in particular - great hardware. Don't have experience with other makes, except Toshiba, which I bought for my children. I don't recommend those, despite the low price and good specs, because they don't honor their warranties.

</comment></comment></comment><comment><USER9> Is anyone concerned about privacy using a Google laptop? I noticed recently that for years I've relied on Chrome's private browsing feature only to learn that it does _not_ disable geolocation (unlike Safari) and websites always know where I am located even when browsing privately. And turning this off can change depending on the version of Chrome (in fact I cannot figure out how to turn it off in my current version). I wonder how much intrusion these chromebook's make into your privacy? User data is a core of Google's business model, so that is a big problem for me.

<comment><USER10> My company uses Chromebooks as primary computers with our own fork of ChromiumOS. Our build excludes Google keys thus hypothetically offers reinforced privacy.

Our fork is called NayuOS ( [https://nayuos.nexedi.com](https://nayuos.nexedi.com) ) and is a true system for hackers. It erases user folders on every restart and no extensions are allowed. It is very hard to track and since the Chromebooks are very cheap it is easy to exchange devices often.

It has to be run in Developer Mode thus you have writable /usr/. Chrome Brew is fully functional thanks to that but it is a security hazard.

My company moved everything to cloud so we access everything via browser. It was hard to get used to it but in the end it is a huge time saver. Google went the same direction.

<comment><USER11> Thanks for your wonderful info. I will bring this in our next meeting to our CTO. BTW, link is not working: [https://nayuos.nexedi.com/build-your-own- image](https://nayuos.nexedi.com/build-your-own-image)

</comment></comment></comment><comment><USER12> I used a Samsung ChromeBook 2 (ARM) for about 3 years. You can load a full GNU/Linux environment such as Debian or Ubuntu with Crouton, but you have to enable developer mode.

This involves an annoying beep every time you turn your machine on (or otherwise hitting ctrl-d at the right time), and you run the risk of disabling developer mode--thereby reformatting your drive--if you accidentally hit Spacebar.

Unless they're changing how dev mode works on the new PixelBooks, I do not recommend using one as a dev machine. This year, I bought a Dell XPS Developer Edition and never looked back.

<comment><USER13> If you are worried about that, just don't use Crouton. Completely remove all of the Chrome OS partitions and run linux natively.

I typically get several months of uptime. Suspend/resume has been flawless too. Pressing one button combo a couple times a year hasn't been a show shopper.

<comment><USER14> I did that on an Acer Chromebook and installed GalliumOS ([https://galliumos.org/](https://galliumos.org/)) which is a lightweight Linux distro for Chromebooks.

<comment><USER15> That's badass. I didn't know you could do a full linux install on a chromebook. I used to run Ubuntu using crouton but I had to press all these crazy button combinations to boot up in developer mode and then enter some more shell commands to finally bring up Ubuntu.

</comment></comment></comment></comment><comment><USER16> I use a 1st gen Chromebook Pixel as a secondary machine, for light development (e.g. personal projects), and I'm actually _NOT_ using crouton these days.

I used to have Linuxbrew for installing packages (git, gcc, etc), and a non- GUI chroot through crouton, which I used for anything that wouldn't build using Linuxbrew's toolchain.

However, a few weeks ago Linuxbrew completely broke for me, so I decided to try something new, and instead of reinstalling it I got Nix (the package manager from NixOS) working via proot.

Nix's toolchain pretty does everything I need so I haven't had the need to run crouton anymore. I also run Docker containers via rkt.

Finally, I tweaked the crosh command so it opens a shell directly without having to type 'shell'. I know it might be somewhat picky, but when you're constantly firing up new terminals it can become a bit of a PITA. :)

If anyone's interested I can post some links for reference, or maybe even do a writeup.

</comment><comment><USER17> I would say as long as you can install GalliumOS (which is a custom xubuntu build of Linux designed for Chromebooks) on that Pixelbook, then it should be good to go.

Personally, I installed GalliumOS on a $350 Chromebook (Toshiba CB35) and while I don't use it as a primary machine I do quite a bit of "real" development on it.

For example, it has no problem running fairly large Rails applications with Postgres, Redis, Elasticsearch running inside of Docker containers. I often have a decent amount of browser tabs, streaming music through Youtube and other typical developer things open at the same time.

Key features for me are a 1080p IPS diplay, a great keyboard and it was only $350 even after buying a third party SSD to swap in.

Full details, a review and guide on how it's done can be found at: [https://nickjanetakis.com/blog/transform-a-toshiba- chromeboo...](https://nickjanetakis.com/blog/transform-a-toshiba-chromebook- cb35-into-a-linux-development-environment-with-galliumos)

</comment><comment><USER18> I have a 2015 Pixel LS. Wiped out useless Chrome OS, installed vanilla Ubuntu (with Linux Samus kernel [https://github.com/raphael/linux- samus](https://github.com/raphael/linux-samus)). With 16 GB of RAM it handles just about anything I throw at it, like for instance multiple projects on IntelliJ without breaking a sweat.

The 2560x1700 (3:2) screen is magnificent. Design/hardware is top notch, especially USB Type-C charging. Once you get used to plugging in a charger from either side of the laptop and using the same charger (I have Nexus 6P) for your phone too - you'll never want back to the whole multiple proprietary charger bullshit. I can even charge this laptop from a portable battery pack used for phones.

There are some minor downsides of course, such as absence of a conventional BIOS/UEFI, delete key, F key markings, but I can live with that, there's no such thing as perfect when it comes to laptops.

</comment><comment><USER19> I used an Acer Chromebook 13 (Tegra K1-based) for a couple of years, not as my primary machine, but as my only laptop. I paid $350 for it on sale, in 2014.

Generally, it worked just fine. 99% of the stuff I do on a computer these days is via a web browser, so I didn't feel like I was missing too much. I also highly appreciated the light weight, fanless design and 10+ hour battery life. And the touchpad was seriously good, I'm talking Macbook-level quality, an absolute delight to use.

However, it did have some performance issues. Forget having more than 10 tabs open at the same time, I had to install The Great Suspender to avoid slowdowns. Having music playing in the background from Google Play Music while simultaneously browsing other websites was impossible. Initially, it would play 1080p Youtube videos just fine, but thanks to various updates, codec changes and such, I had to force it down to 720p30 by the end, just to be able to watch videos without frame dropping.

And of course I couldn't install anything on it that wasn't a Chrome plugin/app. So no Spotify client (and the current web player sucks, big time). No games. No decent video player, and the preinstalled one can't play videos with AAC sound, probably due to licensing issues.

After some time, I got fed up with all of these issues, so I sold it and bought a refurb Thinkpad T420, also for around $350. It's bigger, heavier, has a worse touchpad and gets worse battery life. On the other hand, the performance is light years ahead and I can install everything I want, not just whatever can function in a browser.

</comment><comment><USER20> I use the second edition of the Chromebook Pixel (i.e. from 2015) as my main machine. I've shrunk the chromeos partition and run Arch on it. At first, the mainline kernel barely supported the device. Touchpad and sound didn't work. Nowadays, it's mostly OK. The touchpad driver seems to be not high-quality though: It expects some device to have a hard-coded id which is assigned non- deterministically during boot/wakeup. This means that I have to reset it sometimes using a script the good people at [https://github.com/raphael/linux- samus](https://github.com/raphael/linux-samus) have written. Chromeos has a workaround or something, so before I found linux-samus, I had to reboot into chromeos once to fix it -- extremely annoying.

I have a bigger problem with charging. My chromebook doesn't recognize high- power chargers (both the original one and one I bought afterwards) and charges extremely slowly, to the point that it even _unloads_ when the CPU is busy. Happens in chromeos too though.

</comment><comment><USER21> I've been using a Chromebook as my primary laptop for the past 3 or 4 years... I do my programming, my blogging, and even photo editing on there. I have one Chromebook that has Linux on it as an alternative, just in case I need SSH or FTP access. But primarily, I'm doing everything on the Internet. There's a website or Chrome extension for just about everything.

Since most of my coding happens in PHP and MySQL.. I don't really need an official platform for that... I just use whatever tools my host provides and thats good enough.

I love it because I don't have to deal with "loading times" or viruses or anything like that. The worst thing that happens is that I open up too many tabs at once and it might crash every so often, warranting a restart, and while most devs might not recommend it, I do recommend it. I'll never go back!

Another advantage is that I only buy Chromebooks with T-Mobile SIMM card adaptions built in, as I can connect it and be wireless no matter where I go. So I won't buy any Chromebook that is not capable of that.

</comment><comment><USER22> I'm wondering how feasible is it to run your development 100% on a remote machine. One of the drawbacks is that you need always access to internet, but this would not be a problem for me.

I don't think that ssh + vim would work for me. I like GUI editors. Is there a good self hosted cloud IDE? Or is it maybe possible to run VS Code on a remote machine and access it through a web interface?

<comment><USER23> 100% remote development is the norm at my company -- not remote from home, although that's an option you can work out with your manager. You can mount your sandbox's filesystem via sshfs, and use whatever editor you like. If your laptop dies, you really haven't lost any work.

<comment><USER24> Doesn't it get slow? I'm running Firefox with a profile on a mounted sshfs directory, and it freezes for a few seconds quite regularly, despite having a decent connection.

<comment><USER23> Nobody's complained, and I am one of the people responsible for fixing such complaints.

ISTR Firefox does an awful lot of writes in order to maintain state; [https://www.servethehome.com/firefox-is-eating-your-ssd- here...](https://www.servethehome.com/firefox-is-eating-your-ssd-here-is-how- to-fix-it/) is from more than a year ago, but I wouldn't be too surprised if something similar were happening to you.

</comment></comment></comment></comment><comment><USER25> From my experience try to get one that has a non-arm chip (intel) with regard to being able to install everything. I almost could install everything (crouton) but like VS Code wasn't supported.

I have this "fear" that my laptop will be stolen so I try to run everything off a USB (attached to my keys) so laptop is pretty much disposable assuming ~$100 in cost (used).

The ram/storage is a concern and I'm talking the junk 2GB 32GB setups. I picked up an ASUS TP200SA 11.6" transformer lately. I know not really able to do much on a 11.6" computer.

Still it's cool got all my stuff setup but can't have different stacks configured (not enough ram) so remote to develop. At least plain JS you can run by browser.

Just my thoughts,definitely got my two screen setup at home just bought a 22" 1080p monitor ohhh yeah.

<comment><USER26> your usb key might get stolen. Full disk encryption and regular backups probably buy better assurance.

<comment><USER27> Also, in my anecdotal experience, the most common failure mode of an USB stick seems to be going completely dead without any prior warning. So regular backups, definitely.

<comment><USER25> Yeah that sucks. I did read that the constant/read write does decrease life, maybe that was specific to SD cards but probably applies to USB as well.

I don't know... one of those things where you think too much about it... like what about general consumers with a password on their Windows/Mac computer... is that "secure"? I don't know.

You could potentially access that hard drive by taking it apart assuming it wasn't a soldered on storage device.

<comment><USER28> All flash-based memory devices have a limited number of write/erase cycles. Internal flash memories have more sophisticated strategies to extend memory life but they all rely on having spare memory available. Try not to go past 80% usage.

<comment><USER25> Thanks for the tip. Probably should have bought a larger USB 3.0 than 32GB, the Ultra Fits are nice by San Disk checked read/write pretty good (have numbers if needed)

</comment></comment></comment></comment></comment></comment><comment><USER29> I tried to use a chromebook as an on-the-go machine where I wouldn't be too worried if it was stolen, but I wasn't successful. The requirements were:

      * Not Developer mode. I want the full security of verified boot.

      * All Security keys and whatnot needed to be on the yubi key.

The ssh client did work with ssh-agent and the yubi keys, so that was good. Establishing ssh sessions from remote machines in parallel didn't work well (e.g., using capistrano), but that's an easyish hack to do serially. I found the ssh client to be a little wonky and not terribly stable.

Termux seemed to be a good alternative, but I couldn't get gpg-agent working with the yubi key.

<comment><USER13> > _Not Developer mode. I want the full security of verified boot._

So you ran something inside of ChromeOS? It seems like a better option would be to replace the bootloader with CoreBoot (which doesn't have a dev mode) and you can add your own keys for whatever OS you choose.

<comment><USER29> Which seems the hard way to get to an os that I have to manage myself. If I wanted a linux machine, I'd get a thinkpad or something and do it that way.

I have to trust something, somewhere. With ChromeOS + ssh and the keys stored on a yubi key,I'm pretty sure that if someone lifts the machine without the key, there's not a whole lot they can do with it, other then factory reset it and move on.

In doing that though, I am trusting a few bits of software from the chrome app store, and that's probably the weakest link. But it's an order of magnitude less code than a linux distro.

</comment></comment></comment><comment><USER30> I did this for a few months, sort of. I used the Secure Shell Chrome app[1] to connect to a server where I do my actual work. It worked about as well as a Macbook did for the same purpose - side-by-side Chrome and ssh windows.

It was fine for building and testing web app changes. I used Chrome Remote Desktop to test with Firefox and IE. It was fine for building and testing Android apps but only when I was physically next to the remote workstation to plug in a device for adb. I think there might be some weird hack to tunnel adb over ssh through your Chromebook, but I never got that to work.

It was a bit more cumbersome to get personal and work Chrome profiles running on the same monitor. You can sign in to multiple accounts at once, but they're separate desktops. However, you can right-click on a title bar for a "move to other session" option. A ChromeOS PM showed me that trick; no idea how a user is supposed to discover that.

The other things I missed on ChromeOS were 1Password (the Chrome extension relies on the desktop app being present) and BetterTouchTool (for programming additional trackpad gestures and remapping mouse buttons).

[1]: [https://chrome.google.com/webstore/detail/secure- shell/pnhec...](https://chrome.google.com/webstore/detail/secure- shell/pnhechapfaindjhompbnflcldabbghjo)

</comment><comment><USER31> I had a 2015 Pixel for about 6 months; originally used it just using ChromeOS and it was great in every respect for everyday use (screen in particular was fantastic), but I couldn't find a suitable solution for using it for programming in Python - all the web-based solutions weren't as good as Pycharm which I've been using on my desktop at home, and while I'm not a professional programmer, I am spending a fair bit of time doing it as I learn/improve - particularly when I may not have constant internet (such as on a train), so I wanted another solution. That led me to put GalliumOS on it...

I've also got a cheap Acer chromebook (which got me started on the whole ChromeOS trip), which I'd already put GalliumOS on and found it pretty usable overall - indeed almost 'throwaway' because of the low cost secondhand (I paid £60 for it in the UK).

GalliumOS was generally pretty good on both machines - giving access to Linux software which was generally easy to install, but the issue on the Chromebook was the battery life/power consumption and management; it seemed to be running the fan a lot, and went from the usual 8-10 hours on ChromeOS for the Pixel down to maybe 2 or 3, which kind of defeated the object of having it.

During this time I got a MacBook Air at the right price secondhand, and that has taken over as my main 'browsing/mobile use/learning Python' machine, so I put the Pixel back to stock and sold it (amazingly for more than I paid for it).

If there had been a native Python IDE for the Pixel I would have kept it - <USER2> really was a high quality piece of equipment - but alas I didn't find a solution that I was happy with (and certainly not one that made use of the Pixel's true power and quality).

</comment><comment><USER32> What about internet access? Are there still chromebooks with built-in cellular data? If they released a Chromebook with built-in LTE and a google-hosted data plan with unlimited data (from chromeOS), for a reasonable price, I would be all over it.

I use a MacBook Pro which I like but 95% of the time I am doing stuff I could be doing using ChromeOS.

</comment><comment><USER33> I had one of the 2012 Samsung ARM Chromebooks, then when its battery started to die I replaced it (earlier this year) with an Acer R13 (also ARM).

For development I mostly only need git, ssh, and emacs. So I use the cli-extra target from crouton for an Ubuntu command line.

Occasionally I need to run something graphical so I have a 2nd chroot for X windows.

The R13 is nearly perfect as far as the hardware goes - high-resolution touchscreen, 12+ hours of battery life, trackpad and keyboard are the best I've used (better in my opinion than Macbook Pro). The processor is 64-bit and it has 4GB of RAM, which is usually plenty.

Software is another issue. Most of the time if there isn't already an Arm64 binary, compiling from source works. I view claims of "cross platform" with total suspicion nowadays.

One thing I miss is hardware accelerated graphics in crouton. ChromeOS supports it but the driver isn't open as far as I know.

</comment><comment><USER34> Just a comment. ChromeOS may soon be able to run OCI containers.

Source: [https://plus.google.com/u/0/+WilliamGreene76/posts/Qosa9BstS...](https://plus.google.com/u/0/+WilliamGreene76/posts/Qosa9BstSHu)

</comment><comment><USER15> I bought a Chromebook two years ago thinking I could wipe out Chrome OS completely and install Ubuntu to use as my primary machine. But I actually was only able to "sort of" install linux using crouton. It was cool but kind of annoying, you had to press all these crazy button combinations to boot up in developer mode and then enter shell commands to bring up Ubuntu. Pretty neat, but I was left with so little storage space I wasn't able to install Android studio so I couldn't use it as my primary laptop. Sadly, I don't think chromebooks make for very good primary machines. However, I wrote this comment using a chromebook, so I obviously dig them even if they have a ways to go.

</comment><comment><USER35> I was using it as my primary machine for the last 2 months. It was still a challenge even after putting crouton on it and at times things boggled down to a snail's pace.

The best multi-tasking I got was when I was running VS Code, mysql and mongodb servers, one node web server, one python web server, music from the main chrome browser and opera on crouton.

I was trying to build Android apps on it but Android Studio is a no go so I just ended up building it from the command line. I couldn't run anything other than the editor and the build process at the time and things became very very slow until the process was done. I only did this once or twice though so I'm sure it would have eventually hung the entire system.

</comment><comment><USER8> Here's a guy who used an ipad and remote servers:

[http://yieldthought.com/post/31857050698/ipad- linode-1-year-...](http://yieldthought.com/post/31857050698/ipad- linode-1-year-later)

</comment><comment><USER36> I used to run a Samsung Chromebook 2 13" with Crouton, so I could run XFCE Linux next to Chrome OS. It was an excellent setup for the money, aside from a few drawbacks:

\- ARM processor (excellent power efficiency and battery, but you can't run certain Linux packages, or programs such as Sublime Text) \- Limited storage space (so you must use USB volumes, or server/cloud storage) \- Physical security (chroot runs somewhat at a compromise to security)

Other than those, it really was a surprisingly great little Linux machine. Very lightweight, outstanding battery life, and capable of 99% of what I need as a web developer and for casual entertainment.

</comment><comment><USER37> Typing this from a first-gen Chromebook Pixel, which is my primary machine for hobby programming (I don't currently code professionally, and I have a beast of a Wintel desktop for gaming).

It's lightweight, build quality is good, screen is terrific. I got it for a great price, too. I think the original retail price of the version I bought was a bit high, but that new version you just linked looks like a good price/performance.

I really only want a shell plus a browser anyway. Though I've had X11/XFCE working in the past.

All in all I'm quite happy with it for this purpose. Though if price was no object, I'd probably reconsider.

</comment><comment><USER38> I use an Acer C720P with GalliumOS installed on it as my secondary dev machine. My main rig is a Windows desktop.

I have no real complaints with Gallium or the C720P, it's a really solid little machine, and it's super fast. My only gripe is the keyboard - there's no delete key, there's a magnifying glass where the Caps Lock should go, and that gets mapped to Super, and the worst part, I only have F1-F10, missing F11 and F12.

I'm sure there's a good way to remap some keys to get F11 and F12, but I haven't figured out a good key combination that doesn't interfere with other keyboard shortcuts.

<comment><USER39> On my Acer c720, alt-backspace acts as delete. Not sure if that's ChromeOSes doing or the keyboard firmware.

I've gotten so used to it that I had to make my windows machine do the same thing!

<comment><USER38> Thanks! That worked for me. I had no idea.

</comment></comment></comment><comment><USER40> I use a Samsung Chromebook 3 with Linux installed in a chroot via Crouton.

[http://bryangrohman.com/ubuntu-i3wm- chromebook/](http://bryangrohman.com/ubuntu-i3wm-chromebook/)

It's a bit underpowered, but it works just fine for my personal use which includes some light coding. It would be way underpowered to use for my day job in any capacity other than ssh-ing into other machines. Then again, it is one of the cheapest Chromebooks available at $169, so you get what you pay for :)

</comment><comment><USER13> Yes. It has been great and I've written about it: [http://kmkeen.com/c100p-tweaks/](http://kmkeen.com/c100p-tweaks/)

Asus has released an updated version (C101) with USB-C: [https://liliputing.com/2017/09/asus-chromebook- flip-c101-hit...](https://liliputing.com/2017/09/asus-chromebook- flip-c101-hits-us-299.html)

</comment><comment><AUTHOR> Seems like to get any good developer use out of it you either got to root it or run crouton. Basically get some linux on it. I used macbooks for a long time but new one specially the 13" pro did not have the specs I was looking for. Eventually settled for a Dell XPS developer edition. But these new pixelbooks have an amazing build. Would love to get my hands on one but sounds like I'd have to root it for my purposes at least.

</comment><comment><USER41> I've been using a de-chromed acer c720 as my primary machine for a couple of years now, I upgraded the m2 sata, wiped it, and installed xubuntu. This is a low powered machine though, and the display barely tolerable. I use it for web browsing and side projects using vim and scripting languages.

Sounds like the newest machines are much more capable, I would never try to do Java development with a heavy ide like eclipse on this setup, for example.

</comment><comment><USER42> I used a Chromebook Pixel as my primary dev machine for a couple of years. Works great with either crouton or Termux for the Linux-y stuff.

Later I switched to an Android tablet: [http://bergie.iki.fi/blog/working-on- android-2017/](http://bergie.iki.fi/blog/working-on-android-2017/)

I had to return the tablet when I quit my previous job, so now programming from an iPad Pro.

<comment><USER43> interesting, do you use an external kb ? doesn't the small screen bother you (especially multi window IDEs) ?

<comment><USER42> I used the 11" MacBook Air for a few years, so I'm quite used to working with small screens. Good eyesight means I can fit ton of vim splits on the screen with a small-ish font.

Example: [https://d2vqpl3tx84ay5.cloudfront.net/android- tablet-2017/pi...](https://d2vqpl3tx84ay5.cloudfront.net/android- tablet-2017/pixel_c_desktop.jpg) (from the Android tablet I had before this current iPad)

Right now I'm typing this using the Smart Keyboard from Apple, but I also have a nice custom mechanical keyboard that I can plug in when I'm home: [http://bergie.iki.fi/blog/atreus-build- log/](http://bergie.iki.fi/blog/atreus-build-log/)

</comment></comment></comment><comment><USER44> I've been using a Samsung Chromebook Pro for the last couple of months as my primary machine. Pretty happy with it! My needs are pretty modest though, as I do my development work over ssh.

I do think it's awesome to be able to run progressive web apps, Android apps and native Linux apps (using crouton and xiwi) side by side rather seamlessly. This makes it a more versatile platform than any, IMO.

</comment><comment><USER45> For the pixelbook price I'd rather get one of these [https://www.razerzone.com/gaming-systems/razer-blade- stealth](https://www.razerzone.com/gaming-systems/razer-blade-stealth) or since I'm a Mac fanboy a 13" MacBook Pro, then at least I'd be sure the OS would be updated for the next 4 or 5 years or more.

<comment><USER42> Chrome OS gets roughly that amount of years of updates as well.

<comment><USER46> Google promises support for at least 5 years after release.

</comment></comment></comment><comment><USER47> I recently switch from a Macbook to the Asus Chrome flipbook and am happy with the following workflow. I enabled developer mode and installed Chromebrew, vim, git, rsync and tmux. I git checkout my projects locally and edit in vim/tmux and then rsync the changes to a cloud server for compilation and testing.

</comment><comment><USER48> Usually yeah I do. I'm not using a super powerful one (the pixel is a massive waste of money and always was). Just have the 4GB Acer R11. Small, good battery life and a touchscreen.

My setup: Dev mode Chromebrew with tmux,vim,irssi,python3.6

I don't use crouton because I don't need it.

</comment><comment><USER46> I work quite a lot with a Chromebook Pixel from 2013. All I need to get work done is a VM somewhere, SSH/mosh, tmux, vim and a nice display.

I hope to be able to buy the new Pixelbook as a replacement, if it ever ships to my country.

</comment><comment><USER49> Yes, but I fixed the rom, installed a real ssd in it and put Ubuntu on it. It's great and I love it.

</comment><comment><USER50> previous discussion:

[https://news.ycombinator.com/item?id=14863580](https://news.ycombinator.com/item?id=14863580)

</comment><comment><USER51> Primary laptop, yes. I have a desktop with a vastly superior mechanical keyboard and multiple monitors, but for a primary laptop, sure.

The concept of "primary machine" is weird to me. Since the early 80s, things keep getting separated out. NFS home directories moved bulk file storage to a fileserver in the 80s or early 90s. I could run ALL the self tests and build for ALL possible outputs by hand like the old days on a local machine, but that's what the Jenkins vm is for. I could run git without any centralized server, but no one really does that, there's a host for that. I could keep track of bugs in email or in my head like the baddest of bad old days, but there's a host for that. Logging for debugging is on separate hosts now a days. I used to run my dev environment locally using lots of memory and CPU and battery power but I've had access to a vmware cluster that weighs several tons, I'm not carrying that kind of power around in a laptop. Since everything has abstracted out into cloudy hosts, there's really nothing I can do with local dev resources WRT the proverbial "what do I do in an internet outage?" question. The answer is "same thing I'd do with my desktop, nothing, because everything is online and cloudy today." In 1981 I could program productively on one machine air gap isolated from every other machine on the planet, but that was a very long time ago. There may also be inherent cultural issues, you can and we did program in Z80 assembler in '81 on completely isolated self hosted machines, but I'm not sure that even works culturally with modern languages, burned right into the tools are things like automatic dependency resolution that assume internet connectivity.

Having infinite cloud power laying around makes things weird talking with older generation devs. Yes the Scala compiler is not fast if you run it on a low speed battery friendly laptop cpu with 2 gigs of ram and slow spinning rust for storage, but the vmware image I compile on has specs better than anything you can buy today in as a laptop so I just don't care about speed.

You have to get used to some closed source weirdness, but can be worked around. You "right click" using alt and the touchpad on my weird keyboard. The keyboard feel is awful compared to an original model-M on my desk but it does work. The cheapest chromebooks have ridiculous low res low dpi screens and one with a good screen, is, as you'd expect, hundreds of dollars not $49 or whatever the school kids get today. The vnc client still complains about security every time I use it as if I'll respond on the 35194th complaint. The SSH client UI is like a weird re-interpretation of putty which is initially weird.

On the other hand, its never crashed or failed in any way not designed into it, OS security and maint patching isn't an issue, the boot time is a couple seconds so I don't bother with sleep mode, the battery really does last ten hours while it weighs practically nothing. It just works as an appliance which is very unusual for general purpose computer use.

Most chromebook solutions are multistep which makes it either impossible to use or trivial to use depending on your mindset and past experience. How to program an arduino on a chromebook? Well, that's impossible in one step there is no one click arduino IDE installer on the google play store, but absolutely trivial in multiple steps. Setting up a VNC client on a chromebook is trivial. Setting up VNC server on a dirt cheap pi and accessing it via the network is trivial. Setting up arduino ide on a pi is trivial. So its both impossible to program an arduino using a chromebook in one step, and its also four unimaginably trivial steps to accomplish. So using "windows monolithic thinking" many things are simply impossible on the chromebook and will forever be impossible as long as you demand one click solutions, while "unix small optimized tools thinking" means everything is possible, even trivial, on a chromebook. Chromebooks have acceptable individual tools that can be strung together unix-like to do anything, but there are very few swiss army multi- tool giant monolithic one click solutions. You can't one click install visual studio locally, but you can trivially VNC into a giant overpowered vmware image running emacs connected to cloudy fileserver and jenkins and gitlab and things...</comment>


It's the worst time in history to be a clown - <AUTHOR> https://www.washingtonpost.com/lifestyle/style/its-the-worst-time-in-history-to-be-a-clown-they-just-want-you-to-love-them-again/2018/03/29/ff911a62-2934-11e8-b79d-f3d931db7f68_story.html <comment><USER2> Talk about a coinkydink - last night I turned on The Simpsons for the first time in years, and it's about Krusty becoming a pariah - for being a clown - and making a foray into serious acting.</comment>


Google scraper may have to be permanently retired, thanks to a change at Google - <AUTHOR> https://ssl.scroogle.org/cgi-bin/nbbwssl.cgi?Gw=Google

<comment><USER2> So in other words, Google are the bad guys for depreciating/axing a feature which they no longer use, and which was probably never intended to be used in the way which Scroogle are using it?

That's right, it's all about Scroogle. I appreciate that Scroogle are upset that their service (which relies on hacks) will no longer work, however, it's ridiculous that even developers are acting irrational these days.

Why Scroogle thinks that Google should pay developers to maintain an interface to support their service which strips the ads from results, is beyond me. I'd say this change shows scroogle's true colors...

<comment><USER3> This note simply describes the bare facts underlying Scroogle's outage and that they've emailed Google to ask some relevant and perfectly reasonable questions.

How is any of what they say "irrational"? Where do they imply that they're entitled to anything from Google?

As for Google being "bad guys", well, that really depends on how much you value privacy and whether you think Google is acting in ways that respect their users' privacy.

<comment><USER2> I'd say that the title is intended to strongly imply that Google are evil. Also, the vibe the article is trying to create is that if Google don't re-add the api, they are probably doing it to block competition (why else would they start with their Microsoft rant at the bottom?)

Also.. Privacy issues with Google? Just because they are capturing details you put into their system, doesn't mean they are sharing it, or changing their privacy policy overnight to make all your details public (as Facebook does). Or are you complaining they take photos in public areas?

<comment><USER3> _"I'd say that the title is intended to strongly imply that Google are evil."_

The title is "Scroogle has been blocked". How does this imply Google is evil?

 _"Also, the vibe the article is trying to create is that if Google don't re- add the api, they are probably doing it to block competition (why else would they start with their Microsoft rant at the bottom?)"_

They put in the quote from a lead Microsoft developer that describes Microsoft's anti-competitive practices, and then say "Let's hope Google doesn't do the same thing." Is this an unreasonable hope? I really don't see the problem with what they say here.

 _"Also.. Privacy issues with Google? Just because they are capturing details you put into their system, doesn't mean they are sharing it, or changing their privacy policy overnight to make all your details public (as Facebook does). Or are you complaining they take photos in public areas?"_

I consider any and all information about me, my interests, my friends (since you bring up Facebook), etc, to be private. If that information is collected without my explicit permission, I consider it a privacy violation. If that information is shared without my explicit permission, it's an even worse privacy violation.

<comment><USER4> > The title is "Scroogle has been blocked". How does this imply Google is > evil?

The title of the post on HN is "Google scraper may have to be permanently retired, thanks to a change at Google". Big difference.

<comment><USER3> That's an even more innocuous title. I really don't see why you think it implies Google is "evil".

<comment><USER2> If I wrote "Flash no longer available, thanks to a change by Apple", I'm pretty sure you'd probably change your mind.

And if I wrote "Linux no longer supports our program due to a change in kernel design. We are asking why it was done. Oh, and Microsoft did the same things 2 years ago and were sued for trying to block competitors. But until we find out, we can't confirm its because they are trying to stop competition."

Both of these statements are obviously heavily biased, and yet, that's what we see in the article, and in the hacker news headline.

If it weren't biased, why would Scroogle even mention the Microsoft thing? It is hardly relevant. It seems like they are trying to invoke anger by the community, so that Google is forced to reinstate the feature. And judging by the headline here, it seems to have worked.

But hey, I guess headlines which are anti-large company on a system which only gets upvotes would generate more attention than neutral ones, because all the Google haters jump on board and vote it up, without reading the article and actually seeing if the headline is remotely accurate.

</comment></comment></comment></comment></comment></comment></comment><comment><USER3> Scroogle shall be sorely missed.

I've now switched to using ixquick instead:

<https://us2.ixquick.com/>

Does anyone know of any other privacy-respecting search engines that can be used over SSL ?

<comment><USER5> Check this out: <http://www.googlesharing.net/>

</comment></comment><comment><USER6> They should look at <http://www.google.com/xhtml?q=blah>

<comment><USER7> Perhaps that interface implements IP-based rate limiting like the regular google.com

</comment></comment><comment><USER3> Previously: <http://news.ycombinator.com/item?id=1337039>

</comment><comment><USER7> I'm amazed it was allowed to continue for so long. It's pretty clearly against Google's terms of service.

<comment><USER3> I'm not amazed at all. I would guess that most violators of Google's terms of service don't even get noticed by Google until and unless their actions begin to significantly impact Google's bottom line or Google feels threatened in some other way.

The API changes that resulted in Scroogle no longer being able to get results from Google may not have had anything to do with Scroogle violating Google's terms of service.

But if it did, then it's likely Scroogle was performing a significant number of searches and Google noticed. This would lead me to believe that there is a serious demand among a significant number of Google's customers for more privacy, and Google itself was not meeting that demand.

I hope other privacy-respecting search engines step up to the plate and fill the void left by Scroogle's demise.

<comment><USER7> Write a little script that runs a search on google every few seconds and let me know how long it runs before you're blocked. Google definitely cares.

These guys weren't using an API, they were breaking the rules and scraping an obscure search results pages that Google apparently neglected to secure.</comment></comment></comment>


Google Blogger deleted my blog ... as Spam - <AUTHOR>

Google Blogger team "surprised" me in a bad way today -- they claim that my purely hand-written blog with occasional posts on development topics -- is spam, so they deleted it: === Your blog at http://developmenttips.blogspot.com/ has been reviewed and confirmed as in violation of our Terms of Service for: SPAM. In accordance to these terms, we've removed the blog and the URL is no longer accessible. === My blog might be boring, but how could it qualify as SPAM -- it have no clue. Google Cache is still available -- http://www.google.com/search?hl=&q=site%3Adevelopmenttips.blogspot.com<p>Any idea what went wrong? <comment><USER2> At first thought, I too would think it was written by a machine, not a person... Frankly, I am not impressed with google's abilities to recognize spam. After all, sufficiently advanced spam is indistinguishable from content. And humans are slowly becoming machines.

<comment><AUTHOR> 1) I know that my writing skills are not too good, but I'm sure I'm doing much better than even modern machines. However spammers can easily read RSS from my blog and feed it into their blog. The end result -- spam content is identical to my blog... Still it does not excuse Blogger for doing such a bad job at spam detection. My account is much older (5+ years) than spammers' accounts.

</comment></comment><comment><USER3> It seems to have now been restored.

I imagine it was your resume that triggered it, particularly the Keywords section.

<comment><AUTHOR> 1) Yes, I submitted appeal request and now my blog is restored. But that made me think about how much I can trust blogger... Probably not too much. 2) Why do you think it was keywords section? Do you think spam filters don't like keywords and are able to recognize such section?

</comment></comment><comment><USER4> This will probably not be something you want to hear, but this is EXACTLY why you should host your own blog on your own server. No threat from someone potentially shutting it down for no reason.

<comment><AUTHOR> I was hosting blogs on my own server in the past. But it takes additional effort to host it on my own server... May be I should...

<comment><USER4> It takes less effort to host your own blog than it does to recover from someone taking yours down and leaving you hangin out to dry.</comment></comment></comment>


Show HN: Relay – Event-driven DevOps automation - <AUTHOR> https://relay.sh <comment><AUTHOR> Hi everyone! PM for Relay here.

Relay is an event-driven DevOps platform. It listens to events from 3rd party services like AWS, Datadog, PagerDuty, Jira and more to trigger simpler, smarter workflows that automate tedious tasks. A lot of existing solutions either require a lot of upfront DIY work (AWS Lambda or running your own script) or they weren't built for DevOps teams (Zapier, IFTTT).

Relay provides out-of-the-box workflows for common use cases like cloud cost optimization, security, incident response and more. If those don't work for you, you can write your own workflow using integrations with dozens of cloud provider services, open source tools and APIs that can be composed together in a YAML-based workflow (yes, I know, more YAML).

Some features we think are interesting:

\- Visual execution graph shows exactly what's happening in your workflow run.

\- Connections make it simple to authenticate to other services.

\- Audit log shows who initiated every workflow run, whether manual or by an external service.

\- Human in the loop approvals give you full confidence in your automation.

\- Growing community of 30+ open source integrations with AWS, Azure, GCP, Datadog, PagerDuty, VictorOps, Jira, Terraform, Helm, and more.

We also just recently put out a blog post about some pretty novel uses of Knative and Ambassador to create user-generated triggers: [https://blog.getambassador.io/user-defined-webhooks-in- puppe...](https://blog.getambassador.io/user-defined-webhooks-in-puppet-relay- with-knative-and-ambassador-api-gateway-542ef2e1e137)

<comment><USER4> Looks great! "Zapier for DevOps" would convey it a lot faster. It didn't click for me until I got to that part. I'm excited to try it out!

A couple things:

1) Please, _please_ support some other config file other than just YAML. Even JSON would be an improvement, since you wouldn't have to change your config reader library. YAML has been a miserable nightmare to use in other tools like Open API Spec. I'm not alone in my YAML hate, either[1][2][3][4].

Implicit typing and semantic whitespace in a data file is insane. At least in Python, you're not unlikely to get an error if your whitespace is off. In a config file, you might just end up with dangerous/confusing behavior.

2) I'm surprised you used Relay, which is already used by Facebook. I don't think Facebook is going to care that much, but it's going to be really hard to Google this library.

1\. [https://dev.to/jessekphillips/stop-using- yaml-3kec](https://dev.to/jessekphillips/stop-using-yaml-3kec)

2\. [https://hitchdev.com/strictyaml/why/implicit-typing- removed/](https://hitchdev.com/strictyaml/why/implicit-typing-removed/)

3\. [https://devopsdays.org/events/2019-stockholm/program/philipp...](https://devopsdays.org/events/2019-stockholm/program/philipp- krenn)

4\. [https://www.arp242.net/yaml-config.html](https://www.arp242.net/yaml- config.html)

<comment><USER5> > _1) Please, please support some other config file other than just YAML._

Although we don't directly advertise it, you can in fact write a workflow in JSON and there's an underlying JSON interchange format that is authoritative in our system. We expect that any other languages we support would "compile" to this JSON format. What other languages are interesting to you? We've looked at CUE[0], HCL, and of course Puppet itself.

[0]: [https://cuelang.org/](https://cuelang.org/)

<comment><USER6> Also, Relay is built by Puppet, so not a separate company :)

</comment></comment></comment></comment><comment><USER7> Sounds interesting. Have you any comparisons between this and StackStorm? At first glance, this looks like it competes in a similar market.

Additionally, is this only going to be a SaaS offering, or will we have the option to self-host this as well?

<comment><USER8> Hey there, as mentioned elsewhere I'm an engineer on Relay. Our PM is busy right now so thought I'd jump in.

> Have you any comparisons between this and StackStorm?

Relay is very similar to StackStorm! One of the biggest differences between Relay and StackStorm, however, is that every step and trigger in Relay is just a docker container. You can basically run any container you want, but containers that are authored specifically for Relay are, obviously, better (integration with the execution environment, our secrets management service, etc.).

> is this only going to be a SaaS offering

This is another key difference between Relay and StackStorm: We only offer a SaaS right now. That's not to say that we won't eventually offer a self-hosted version (or some sort of hybrid solution for that matter)--it's just the approach we're going with for now.

<comment><USER7> > every step and trigger in Relay is just a docker container

Ooh, that makes sense. This is also reminding me a bit of Concourse CI ([https://concourse-ci.org](https://concourse-ci.org)) as that's all docker- based too, though last I checked it wasn't as kubernetes-native (which I appreciate)

<comment><USER9> There's a lineage -- Concourse was an inspiration for Tekton, and Relay uses Tekton as part of its substructure[0].

[0] [https://relay.sh/docs/how-it-works/#workflow- execution](https://relay.sh/docs/how-it-works/#workflow-execution)

</comment></comment></comment></comment><comment><USER10> So I didn't see anything on your site on my cursory glance at it, but I'd like to know if you have any use cases replacing Jenkins Pipelines and Helm deployments into an OpenShift/Kubernetes environment? I'm writing a lot of Jenkins pipelines now and groovy is killing me!

<comment><USER5> We do have a Helm integration that might be able to help you out: [https://relay.sh/integrations/helm/](https://relay.sh/integrations/helm/)

The limiting factor right now would be whether your cluster is accessible to the internet, which of course isn't super common. We are working through what our story for connecting to on-prem infrastructure looks like, so if you can provide any additional details on your environment, it would be helpful!

</comment></comment><comment><USER11> I think we can do the same things using github actions now. P.S we have self- hosted runners in our enviroment where each step is a docker container too.

We have complex flows where we use Slack, Spinnaker(Webhooks), Terraform, PagerDuty ... and much more.

Is there something better that we can achieve with this?

<comment><USER5> Hi,

This is a good question, thank you! The flow of events into our system is somewhat different than GitHub Actions. We're trying to be a consumer of all sorts of events, including, say, data published to AWS SNS or via a Docker Hub webhook[0]. All of that isn't quite in place yet, but we want to act more like an event broker than a CI/CD solution alone.

One concept we're throwing around is supporting CloudEvents[1] and dispatching workflows based on event types. If anyone has experience with CloudEvents we'd love to hear if that would be something useful to you.

[0]: [https://github.com/relay-integrations/relay- dockerhub/blob/m...](https://github.com/relay-integrations/relay- dockerhub/blob/master/triggers/dockerhub-trigger-image-pushed/handler.py)

[1]: [https://cloudevents.io/](https://cloudevents.io/)

<comment><USER9> I'm writing a book on Knative and have some material in there about CloudEvents. It's on the MEAP program and the relevant chapter was put up yesterday, as it happens: [https://livebook.manning.com/book/knative-in- action/chapter-...](https://livebook.manning.com/book/knative-in- action/chapter-6)

<comment><USER5> Thank you! I'll take a look through this! Would it be okay if I sent you an email in the next week or two for follow-up questions?

<comment><USER9> Please do.

</comment></comment></comment></comment></comment><comment><USER12> Sadly, it doesn't seem to support SSH, so I can't use it to replace Fabric scripts.

<comment><USER5> Hi,

I wrote an SSH step for you. Here's the source code:

[https://github.com/relay-integrations/relay- ssh/blob/master/...](https://github.com/relay-integrations/relay- ssh/blob/master/steps/exec/step.sh)

And since it isn't documented yet, here's how you would use it in a workflow:

      steps:
      - name: ssh
        image: relaysh/ssh-step-exec
        spec:
          connection: !Connection {type: ssh, name: my-ssh-connection}
          username: relay
          port: 2222 # defaults to 22
          knownHosts: |
            server1.example.com ssh-rsa AAAAEXAMPLE
            server2.example.com ssh-rsa AAAANOTHEREXAMPLE
          # or
          #strictHostKeyChecking: false
          on:
          - server1.example.com
          - server2.example.com
          input:
          - <USER2>
          - <USER3>
          - cat /etc/passwd

Please feel free to shoot me an email (check my profile) and I'd be happy to help write a workflow for your use case with you!

</comment></comment><comment><USER13> This looks like it uses tekton pipelines and triggers under the hood.

<comment><AUTHOR> Yep! Relay uses Tekton under the hood to execute the workflows. It actually knative and ambassador to execute the triggers. You can read more about the trigger system here: [https://blog.getambassador.io/user-defined-webhooks-in- puppe...](https://blog.getambassador.io/user-defined-webhooks-in-puppet-relay- with-knative-and-ambassador-api-gateway-542ef2e1e137)

</comment></comment><comment><USER14> What's the pricing model? I don't see it on the website

<comment><USER15> We're thinking about a few different models, but haven't settled on one yet. What kind of model would you be interested in? Metered or other usage-based, per-seat or per-user, or something totally different?</comment></comment>


Rackspace: concerns from a former Slicehost customer - <AUTHOR> http://kmkeen.com/rackspace/ <comment><USER2> A lot of places just have legacy code and policies. You have no evidence of your claim that they store passwords in clear text.

Their restrictions may in fact have cut down on widespread security outbreaks from users who use the same password across multiple web sites. This means that Rackspace has also enforced a unique password from their other passwords via their enforced scheme.

<comment><USER3> That's not quite the claim he made though. His claim is that the only reason to have those policies is to mitigate SQL injection and because you're storing cleartext passwords.

If you're storing password hashes, you don't care about the charset used for the password, and the only limitation on password length would be sane bandwidth concerns - who really cares if I send you 2 or 3Kb of password if your hash algorthm is going to store that in the same sized database column as "password123"?

Either they have those policies for a reason - they've got bad password storage practices, or they have them for no good reason - which is a very good excuse to ask "WTF?"

And do you _really_ think this might have "cut down on widespread security outbreaks"? That's a pretty lame justification in my opinion - it's like claiming I'd be "improving my users security" by disallowing vowels in passwords, to minimise the risk that they re-use existing passwords. There is no way to "enforce a unique password" without keeping too much knowledge of users passwords.

I think the OP's stated "concerns" are very valid, and I agree with him that Rackspace's policies and answers fall a long way short of providing the reassurance that they're storing critical security credentials in a safe fashion.

<comment><USER4> Be careful with that. BCrypt for example silently truncates long passwords (>72 chars).

</comment></comment></comment><comment><USER5> Wow a whole blog post on the presumption that not allowing some special characters means they are vulnerable to an sql injection attack.

How about.. testing that theory?

<comment><USER6> Who cares if they're not actually vulnerable? It's 2012. These password restrictions are arbitrary and anachronistic.

<comment><USER7> They are also the kind of policies that will make enterprisey minds feel safe and secure. Not worth reading too much into them.

</comment></comment></comment><comment><USER8> I've been a loyal Slicehost customer since 2009. I was previously a Rackspace customer too. There were a lot of reasons I jumped to SH when I had a chance. I'm seriously considering moving over to Linode soon. I desire the most control over my servers, and the combination of that and the low cost of SH is hard to find elsewhere. I think Linode will be a good alternate. Do any others have experience with Linode that can comment?

<comment><USER9> We host a couple of external DNS-servers on Linode for redundancy, and I just looked at our smokeping reports, and everything looks pretty nice. We wouldn't notice downtime on a single machine other than some noise in nagios, but as far as I can remember, they have been stable all year.

I've added some reports from smokeping and munin. Please note that these are DNS-servers, so basically the only thing that generates IO is logging and updates. Your milage may vary.

Linode London DC: <https://dl.dropbox.com/u/24775/linode_london_v4.png> <https://dl.dropbox.com/u/24775/linode_london_v6.png> <https://dl.dropbox.com/u/24775/linode_london_io.png>

Linode Newark DC: <https://dl.dropbox.com/u/24775/linode_newark_v4.png> <https://dl.dropbox.com/u/24775/linode_newark_v6.png> <https://dl.dropbox.com/u/24775/linode_newark_io.png>

<comment><USER8> Thanks _alot_ for the graphs. That's awesome data to have on hand. Very reassuring. Could you say roughly how many servers you guys run?

<comment><USER9> No problemo! Roughly around 30 servers, give or take.

</comment></comment></comment></comment><comment><USER10> I call Hanlon's Razor (on part of this anyway). I suspect it's far more likely that it was a (stupid) business decisions on the password length/characters to reduce the number of times people would forget their paswords and initiate a password reset. I have tragically come across this many times (and more than once in the UK retail banking sector)

<comment><USER3> I'm less inclined to give them the benefit of the doubt.

Limited password lengths (shorter than possible DOS attacks attempting to upload megabytes into the password field) mean that either a) you're storing cleartext passwords, or b) your tech people are storing hashed passwords and somebody who doesn't understand web security is in a position of enough control to subvert the decisions of the tech people who _do_ understand how to do things.

Either their password storage is insecure, or their marketing/support/management is reducing security by imposing arbitrarily policies on passwords - arbitrarily policies which just happen to look exactly like they're mitigating SQLi and storing passwords as cleartext.</comment></comment>


How I stay happy making open source software - <AUTHOR> http://www.snarky.ca/how-i-stay-happy-making-open-source-software <comment><USER3> I've been working on a realtime framework for 3 years. It got 0 attention for the first year. Then I repackaged it and renamed it and it got some traction. The community only started up one year ago. Before that, it was just me.

I was always very greatful for any comment my project received - <USER2> negative/constructive ones.

I didn't get much feedback early on so there weren't many opportunities to improve.

SocketCluster was never about the code. It was always about creating a useful tool. It has gone through many refactorings and changes in technical philosophy. Seeing steady improvement in the product and the dedication of the community is what keeps me happy.

I was very fortunate that the project got so much traction. It did help me with my career. I owe it to everyone who clicked that star button on Github to keep going.

GitHub: [https://github.com/SocketCluster/socketcluster](https://github.com/SocketCluster/socketcluster)

Website: [http://socketcluster.io/](http://socketcluster.io/)

<comment><USER4> If you don't mind me asking, can you expand a little on how it has helped your career? I've thought about creating some ambitious open source projects before, but I always imagined it would be purely for fun/technical advancement because the ROI from a purely monetary standpoint (increase my salary by being a known expert?) would be small compared to spending the time doing "real" work for clients.

<comment><USER3> I've had promising start-up founders reach out to me with job offers and/or invite me to their offices (got them on my Skype). It also opened up a lot of possibilities when looking for jobs.

That said, I would agree with you that the ROI (at least in the medium term) is not worthwhile. If you want cash, you are probably better off working on your own commercial project or working for clients.

</comment></comment></comment><comment><USER5> When people complain about GitLab I always try to give a positive response, thanking them for their feedback and trying to address their point. People complain because they care about you getting better. As the project matured the expectations are higher so there are more complains. Which means I say sorry a lot more. But as the project matures people are also no longer expecting the CEO to care and say sorry anymore. So when I respond to a complaint the tone of the poster frequently changes. Some of these initial complainers have turned into fans and contributors of the project.

Your code is not you and neither is your project. As maintainer you are not responsible for fixing all bugs (we at GitLab Inc. are, but that is another story). If people care to complain it is OK to ask them to contributing a fix or showing the advantages of a different approach.

</comment><comment><USER6> One recommendation if something does not work as expected and people claim that it should (be it positive or negative): as the creator, never ever say "sorry"!

This will help you to keep the 'correct mental direction', which is that YOU provide the additional value and the issue poster wants something from you.

Also if you are the maintainer, put a warning to people with too strong words and throw them out of your mailing list if a second violation occurs. Also newer 'mailing lists' (like discourse.org) help here with flagging capabilities, edit buttons and more.

Try to ensure that the discussion stays 'emotionless' and without sarcasm or if you allow it do so only with emoticons ;)

<comment><USER7> Agreed. Saying "sorry" brings out the worst in some people. If you pay attention, you'll sense a shift in the power dynamic, and some jerks out there will become more hostile, belittling, and demanding. It's better to just focus on what can be done to move things forward.

</comment></comment><comment><USER8> tl;dr: negative people can suck all the joy out of software development, particularly when doing the less enjoyable parts such as support/bug fixes for free. The author has some suggestions, but I think they work best for larger projects.

I've related this before, but I've had some super negative experiences with very entitled people. One person was a professor for whom I continued to build stats software for 18 months after leaving university. He actually repeatedly called me screaming when I was too busy to do some custom work for him on his timeframe. After giving him 10+ hours a week of free work for a year and a half because I thought the software was interesting and I believed in the work the various labs were doing.

I also work on a bit of open source software that I wrote that implements a high performance (threaded and heavily beaten on with vtune) ml algorithm.

I think the solution, particularly for small projects or individuals, is to preemptively cut people off. After many negative experiences, when I get bug reports or requests, if the reporter hasn't put in a reasonable amount of work already, I just killfile the email address and move on with my life. Even a small fraction of negative people was ruining any interest I had in working on my project: I'd open the tag in gmail, read a nasty or demanding email, and lose all motivation.

If people don't preemptively respect my time, I have no use for them. If they don't like that, they can have a full refund of everything they've paid me =P

<comment><USER9> Jesus! What a horror story. I don't get how the professor concluded that he was entitled to your time like that.

Agreed that it's best to cut off things like this early. Some programmers need to learn the value of their own time -- and act accordingly. If you don't respect your own effort, other people never will.

<comment><USER10> People become entitled like that, basically because you let them by repeatedly allowing them to take your time for free.

Compare with: "Sure, I'd love to do that. I can spend about 10 hours on that this week and that will cost you $1000. Who do I address the invoice to?"

That should sort the wheat from the chaff pretty quickly.

<comment><USER11> Yup! This is also applicable for people who won't pay you back with their time, either! What helps some people is to have plenty of stuff going on in your life so that it's easier to say no because there actually are a ton of compelling things you want to spend your time on...

</comment></comment></comment></comment><comment><USER12> My preference in the last ~2, 3 years is rule out language contribution. Because I am not familiar with compiler and language design, when I make comments I feel like people just think "this guy is stupid." This negativity is so strong I feel depressed. Actually, Python mailing list is a really good example how the community discussions are both fruitful and disastrous at the same time. One question can go into so several sub topics into 200 replies and just more tangential talks. At some point people don't reply to comments you make (but you made that same damn comment before the other person did!), and you feel like like a victim of "you are not one of us."

I am pretty permissive about contributing to big projects. I feel like an outcast. So I choose to spend my time working on private projects whenever I get a minute. I guess I am just one of the few cynical negative developers out there.

</comment><comment><USER13> This blog post made me think:

We need something like "Code Triage" (codetriage.com) but instead of giving people old / aging tickets to fix, this service would alert people of negative comments.

I'm assuming it would have an ML algorithm which would flag comments if overall sentiment of the comment was negative. So people would sign up for github / bitbucket / etc. projects they're familiar with, and would then start receiving emails if negative comments were being posted. They could then help by more or less shielding the project owner from the negativity and hopefully preventing the complainer from going on rants across the web shaming the project or being negative in general about the project.

</comment><comment><USER14> Github needs a ignore user list for project where the issues and pull requests from a use just get ignored. So those mean people don't know they are being ignored but are ignored.

<comment><USER15> [https://en.wikipedia.org/wiki/Stealth_banning](https://en.wikipedia.org/wiki/Stealth_banning)

</comment></comment><comment><USER16> The hard truth is that open source software is the wild west; if you don't have a thick skin, you'll have to grow one, and if you can't grow one, they'll just eat you alive.

Eventually you realise it's either you or them. That's when you've mastered it.

<comment><USER17> I'm wondering why you're getting down votes. Maybe someone who down votes could explain?

I'm a freshman when it gets to maintaining an open source project (just started with one, it's on my user page), and am very interested in getting savvy on how to feel or judge things, hence I found your image welcome. I wouldn't know whether it's wrong or right, but I find it welcome as it's strong, i.e. sticks around, my mind will compare it to real-world situations in the future and figure out over time whether it's correct.

I think what the image points out is that you're ultimately doing your own decisions, for your own benefit, and not doing it for anyone else unless you decide so. And I'd think that this is correct: I did believe that open source is something to improve the world, and standing against closed-source software, and hence if I saw that open source software was lacking, it felt wrong, and led me in a couple occasions to give strong statements to open source developers, which I guess were received exactly like the negative, demanding inputs criticized here. So I'm guilty of this myself. So now, while I realize that the other side (the user) wants to be appreciated, too and not doing that will lead to project failure (both of which might be the reason leading to the down votes here), it would be wrong to let that suck out your energy. And the picture of the cowboy primarily needing to survive himself seems fitting.

(PS.: I think what I'm advocating to accept here is more "either you or me are going to survive", and not so much "either you or me are going to die". These are not equivalent if there's a middle ground where there are other outcomes than dying. Anyway, the OP points out even better solutions anyway, too.)

(Edit: thanks for the replies, I've appreciated them all.)

<comment><USER16> I'm getting downvoted by people who don't like the reality, I guess; I'm just pointing out the truth as I have experienced it myself.

About what you said, most projects, if not all, will be struck by hordes of users asking for all kinds of things, some of them will be reasonable, some of them will not. Never hesitate to say NO to a user, even if he's written a patch already. Never merge things out of pity.

Another important thing: if the project grows large enough, it'll attract collaborators that, despite their best intentions, screw up often. Obviously you must be friendly towards them, but be sure to make it clear when they've screwed up.

You will also find collaborators that not only screw up often, but also defend themselves and think they are always right. Do not hesitate to make it clear that that's not the place for such behaviour and if they don't improve kick them out, outrightly or in a subtle way.

<comment><USER18> It sounds like you are trying to give honest, pragmatic advice, in which case your downvotes are unfair. However, usually when people give that particular advice what they're really saying is that the bad behavior from other people is OK and that the person who feels bad because of it just needs to lighten up.

It's sort of like when someone says, "99% of humanity is too sensitive!" The ONLY people who say that are people who go around pissing off other people on a regular basis and it never occurs to them that the problem might be with their own social skills and not 99% of humanity.

So, when someone's response to someone else getting upset over jerks on the Internet is "you should get thicker skin", it's easy to jump to the conclusion that it's coming from a troll rather than someone honestly trying to help a fellow adult. Based on this comment it sounds like you meant it in good faith and were just trying to help the OP out.</comment></comment></comment></comment>


Evil things to do in a .bashrc file - <AUTHOR> https://unprovable.github.io/jekyll/update/2016/11/10/Evil-Things-To-bashrc.html <comment><USER2> ... on a Linux box. My FreeBSD and MacOS boxes don't know "sort -R".

I'm really here to say that adding "exit" in a .bashrc is fun one to try to resolve.

<comment><USER3> If you're running FreeBSD 10.0 or newer, it knows "sort -R".

<comment><USER2> FreeBSD 8.2-STABLE, released 2011. It's my web hosting machine. I don't manage it. Thanks for pointing that out!

</comment></comment></comment><comment><USER4> I enjoy how JavaScript is used to change anything copied off the page (with included new line).</comment>


US Visitors May Have to Hand Over Social Media Passwords - <AUTHOR> http://www.cnbc.com/2017/02/08/us-visitors-may-have-to-hand-over-social-media-passwords-dhs.html <comment><USER2> It is truly frightening how poorly government understand cyber security...

First Clinton claiming she would work with tech companies to solve the encryption "problem"... clearly not understanding that mathematically speaking, putting a back door in encryption is impossible without also letting the "bad guys" through the door.

Now this.

I'm so glad I already live in this country because if I didn't, I probably would never be able to visit. No way I'm giving anyone my passwords. Never- mind someone at the TSA who could just copy it down for personal use. It's just terrible operational security.

I have enough trouble handing my credit card to a waiter knowing how easy they could skim the numbers. The only reason I'm OK with it is because (at least in the US) disputing credit card charges is easy(ish).

I wonder if this will open the door for social networks to have read-only "security passwords" to give to the TSA that are only good for the length of your stay.

Traveller gives TSA the password... TSA verifies it is good for at least N days (as enforced by the social network)... welcome to the United States.

I'll shut up now because I give the administration any good ideas on how to actually implement such a thing.

P.S. Also, never mind that if I'm up to no good there are less known social networks that would be more effective. And never mind that I could lie and say I don't have an account on a network. This is as stupid as banning some-one based on religion and requiring them to attest to it. No one would possibly lie about their religion right?

<comment><USER3> Even beyond the privacy implications, what about the security implications. This basically means 10s of people would know my account password and whats stopping any of them from abusing it, posting things that would implicate me when I myself have done nothing. Who would take that risk?

</comment></comment><comment><USER4> I use randomly generates passwords stored in a password manager. The database file for the password manager is on my home computer and my phone backed up to cloud storage (the password to the account is also random).

There is no f __*ing way I 'm taking my phone with me overseas with policies like this.

I can't give them my passwords, because I do not know them. I'm 100% sure the DHS grunts are unable to understand that.

</comment><comment><USER5> I wonder what will happen with visitors who don't use social media. I don't have a Facebook account. If I were a foreigner, would I be under extra suspicion because I can't provide an account like most people? Will people start manufacturing social media accounts to paint a picture the U.S. authorities want to see?

The end-game seems to be a social media account that functions like a multi- purpose credit score, à la Sesame Credit[1].

[1] [https://en.wikipedia.org/wiki/Sesame_Credit](https://en.wikipedia.org/wiki/Sesame_Credit)

<comment><USER6> I see a business case for the social media "blandbot." A slightly patriotic fan of cat videos that is sufficiently personalized to your life.

"We're kissing the coshes that cripple us Enjoying the beigeness."

</comment></comment><comment><USER7> Judging from [1], Richard Stallman may be in trouble:

> I have never had a Facebook account. There is a Facebook account called > "Richard Stallman", but it is an impostor.

[1] [https://stallman.org/facebook.html](https://stallman.org/facebook.html)

<comment><USER8> Glad I'm already here; my social media would look suspicious(ly empty).

</comment></comment><comment><USER9> From a practical standpoint, isn't this likely to trip Facebook and Twitter's protections against account theft? If you suddenly log in on a new machine in another country, and that same machine has just logged into a bunch of other accounts in a similar way, I would think that would get you blocked.

<comment><USER10> I wonder if you could also argue that it's against the TOS for the site? I highly doubt the officials would care, but I still wonder...

</comment></comment><comment><USER11> This makes me wonder if Facebook and other social media companies could engineer a solution to this problem.

Maybe have a duress password that unlocks the account and shows only the public data of the user as well as some fake messages, friends, etc.

<comment><USER8> They would not openly resist this, if it became law.

</comment></comment><comment><USER12> I don't remember my passwords sometimes - since Firefox (it's non-corporate!) manages that for me, I can't get the multiple reinforcements I need to remember some passwords.

Lots of folks will be in this situation - just can't recall their password, because The Explorer takes care of it. What happens to them? Does all this handover take place well before a visit?

This seems like a practically unworkable thing to ask for.

</comment><comment><USER13> This reminds me of Black Mirror "The Entire History of You" (2011) [0].

[0] : [https://en.wikipedia.org/wiki/The_Entire_History_of_You](https://en.wikipedia.org/wiki/The_Entire_History_of_You)

</comment><comment><USER14> If this became a requirement, the solution is likely to be no one comes here anymore. Also likely we can't go anywhere else either. Goodbye travel and tourism industries.

</comment><comment><USER15> To be honest, if this happens, the next time I visit the US it will be with a dumb phone.

<comment><USER16> You should have been thinking this for a while already, US border crossings have been getting steadily worse.

Every visit to the US I first replace the harddrive on any laptop I bring. I also image my phone (rooted Android) and reset it, installing a minimum of apps and data, with no important accounts. Once across and on a decent network I retrieve whatever data I need.

This doesn't protect against evil maids or other advanced attacks, but I figure it's good enough for power hungry border crossing officials.

</comment></comment><comment><USER17> I'm guessing "I use a local password manager on a computer I left at home" isn't an acceptable answer?

</comment><comment><USER18> There is no practical way to do this. How can you assume any foreigner to have a facebook/twitter account? If they say they don't have any, how can you prove they are lying?

The only way is probably to check your phone or laptop, then there is easy way to bypass this.

<comment><USER19> And if they say they have one and show it to you, how do you prove that they don't also have another "real" one that they use for all of their terroristing?

</comment></comment><comment><USER20> If they're security-minded and have 2FA, do they also need to hand over a yubikey?

<comment><USER21> If you're security-minded you're already extra suspicious, because then you must have something to hide.

</comment></comment><comment><USER22> Stupid idea when the Obama administration considered it, stupid idea now. And like so many stupid ideas in politics, I'm sure it will gain credibility every time it's brought up, until it actually gets implemented. Le sigh.

</comment><comment><USER23> This seems like a giant security hole. Please send us your password and don't change it for 2 years while we "vet" you. might as well be like here criminals here's your list of passwords.

<comment><USER24> Right. Maybe it's federal employees' way of retaliating for the fact that all their data got taken.

</comment></comment><comment><USER25> This is going to get interesting.

With the international fondness for reciprocity, US citizens travelling abroad will soon face the same intrusions into their privacy.

No-one wins - except the companies bound to pop up offering tailor-made social media presences...

<comment> St-Clock That would be nice. If you know you have a trip coming in two weeks, you could register to get a apolitical facebook account with posts created every day with your virtual apolitical friends. You could optionally register for a twitter account that likes most of Trump's tweets or replies with "I love this guy" kind of message.

</comment></comment><comment><USER26> Great use case for "duress passwords"

</comment><comment><USER27> I thought this is what the NSA, CIA, and FBI were for? Maybe we can start downsizing them if we're just going to hand everything over.

Maybe then we might be able to use the numerous mathematically talented people they've snatched up for something actually productive.</comment>


Japan looks to robots to fill jobs - <AUTHOR> http://news.bbc.co.uk/1/hi/world/asia-pacific/8234463.stm

<comment><USER2> > The United Nations estimates that by the middle of the century there will be > more than a million Japanese who are over 100 years old.

Wow! <http://news.bbc.co.uk/2/hi/asia-pacific/7612363.stm>

</comment><comment><USER3> I suppose <http://www.youtube.com/watch?v=NEVA0WbmfAA> applies to manpower as well as brains.</comment>