Postmortem: Every Frame a Painting - <AUTHOR> https://medium.com/@tonyszhou/postmortem-1b338537fabc <comment><USER3> This news breaks my heart because Every Frame is my favourite youtube channel bar none. I feel empty knowing that I won't get to watch another video from them.

I did enjoy reading this though, because learning more about their creative process helps me appreciate them that much more. It now makes sense why the Jackie Chan video was amazing - it was a 150 hour labour of love from knowledgeable professionals who spared no effort.

For me, watching this channel was more than just an enjoyable 10 minutes - <USER2> helped me understand and appreciate film for the first time ever. I could always say that I loved the opening sequence of Pixar's Up, that it brought tears to my eyes, but I could never express what made it so special. Tony and Taylor gave me the vocabulary and the ability to do so, and I'm forever indebted to them for that alone. Thanks guys.

<comment><USER4> It's kind of amazing... at 150 hours, even after 900 people have watched your video, you've still invested more time than all of your viewers combined.

At 9,000 views society is leveraging 10 units of consumption for every 1 unit of work.

So big YouTubers who get on the order of a million views per video and spend an order of magnitude less time on the content are producing entertainment at an approximately 10,000:1 ratio. Ten thousand hours of mindless consumption for each hour of work they put in.

<comment><USER3> > mindless consumption

I'm uncomfortable with this characterization of consumption. I'm not doubting that most consumption is passive, but I think its a bit unfair to most people. Even creators, including in this case, Tony and Taylor are consumers 99% of the their lives. Nor is consumption a bad thing - watching Every Frame changed the way I think - which is great.

<comment><USER4> I thought twice about that word "mindless" but I stand by it.

I was explicitly not talking about Tony and Taylor I was talking about creators who put in "an order of magnitude less effort" and get a million views per video.

Much of that content is mindless. Not all. And I'm not judging mindless entertainment. Mindfulness is one thing, not everything. But I think it's a fair characterization of the typical in the segment I described. It's worth noting that to get to that level of viewership you typically need to be producing very consistent content daily.

</comment></comment></comment></comment><comment><USER5> Big fan of Every Frame a Painting. Loved the indepth breakdowns the channel did and really affected the may I look as film as a medium. Sad to hear that it winded down.

For others interested in similar channels, here's my list:

NerdWriter: [https://www.youtube.com/user/Nerdwriter1](https://www.youtube.com/user/Nerdwriter1)

Lessons from the Screenplay: [https://www.youtube.com/channel/UCErSSa3CaP_GJxmFpdjG9Jw](https://www.youtube.com/channel/UCErSSa3CaP_GJxmFpdjG9Jw)

The Film Theorists: [https://www.youtube.com/user/FilmTheorists](https://www.youtube.com/user/FilmTheorists)

Beyond The Frame: [https://www.youtube.com/channel/UCZ7g7HfH1gWmhgxW47IcW7Q](https://www.youtube.com/channel/UCZ7g7HfH1gWmhgxW47IcW7Q)

Wisecrack: [https://www.youtube.com/user/thugnotes/videos](https://www.youtube.com/user/thugnotes/videos)

Movies I Love (and so can you): [https://www.youtube.com/user/MarcusHalberstram88/featured](https://www.youtube.com/user/MarcusHalberstram88/featured)

<comment><USER6> I would also add Now You See it: [https://www.youtube.com/channel/UCWTFGPpNQ0Ms6afXhaWDiRw](https://www.youtube.com/channel/UCWTFGPpNQ0Ms6afXhaWDiRw)

</comment></comment><comment><USER7> This is insane.

"I spent about a week doing brute force trial-and-error. I would privately upload several different essay clips, then see which got flagged and which didn't. This gave me a rough idea what the system could detect, and I edited the videos to avoid those potholes."

It is amazing the hoops people have to go through to enjoy the rights provided by law.

<comment><USER8> I'm fairly sure people have been through similar experiences trying to get films through manual censorship processes.

It would be interesting to know what they found about where the boundaries lie and how this compares to the "traditional" approach - sample clearance. I'm fairly sure that if you tried to get _approval_ for using lots of micro-clips it would be incredibly time-consuming, prohibitively expensive, or both.

<comment><USER9> > I'm fairly sure that if you tried to get approval for using lots of micro- > clips it would be incredibly time-consuming, prohibitively expensive, or > both.

But approval is not needed. These videos are pretty much textbook examples of legally-protected fair use of the content they discuss. The labor necessary to get such content through the gates at YouTube is stifling others who can't dedicate the kind of time needed to skirt their overzealous copyright protections.

<comment><USER10> Shifting economic burdens onto the least well-resourced is a standard formula in American business and public life.

</comment></comment></comment></comment><comment> forgot-my-pw A lot of good lessons in the script. It may not be apparent, but they sure put a lot of hours into making the videos. I especially like the point of no Googling for research (research offline). Every Frame a Painting feels unique because they don't just try to echo other's opinions.

      A huge percentage of the Internet is the same information, repeated over and over again. This is especially apparent on film websites; they call it aggregation but it's really just a nicer way to say regurgitation.

It's sad that they couldn't turn it as a final video, even using a very different style (breaking from their norm). It feels that a video channel deserves a video closure, not a blog post.

I'm happy that both of them finds happiness in their new jobs and location.

<comment><USER11> Can I ask that people quote things like this:

> _So that it wraps when you have a long line, so that it wraps when you have > a long line, so that it wraps when you have a long line, so that it wraps > when you have a long line_

Instead of like this

        so I have to scroll horizontally to read beyond about 120 characters

<comment><USER12> This is unfortunately a losing battle. It kills me that people overload the code blocking for quotes because it's simply unreadable on mobile/tablet.

<comment><USER4> Looks fine on iPhone.

<comment><USER12> I'm on an iPhone - it does not.

</comment></comment></comment></comment></comment><comment><USER13> This was an interesting detail: _Nearly every stylistic decision you see about the channel — the length of the clips, the number of examples, which studios' films we chose, the way narration and clip audio weave together, the reordering and flipping of shots, the remixing of 5.1 audio, the rhythm and pacing of the overall video — all of that was reverse-engineered from YouTube's Copyright ID._

</comment><comment><USER8> "A huge percentage of the Internet is the same information, repeated over and over again. This is especially apparent on film websites; they call it aggregation but it's really just a nicer way to say regurgitation."

I think this is increasingly a problem, and various forms of clickbait make it worse. As does the counter-trend of demanding sources for everything. Where only online sources are acceptable.

<comment><USER10> As I keep saying, this is a fundamental limitation of the web, which shows you leaves on trees. What you _want_ is the inversion of that as a dynamic DAG in 3d. This would be the killer app for VR.

<comment><USER14> Huh? How could VR possibly get rid of "the same information, repeated over and over again"? The problem comes from limited research (fast & cheap, not good), not HTML presentation. VR is not going to help with that, as it's not going to magically replace Google (which already indexes books anyway).

<comment><USER10> Because VR makes it easier to look at the structures like the branches of the tree. You can put this on a screen too, of course, but from a user interface point of view it's a bit like looking at the world through a letterbox.

The 3d-ness of VR makes it easier for people to maintain a persistent mental model of a virtual environment than that which can be presented through a single screen, and that facilitates the presentation and navigation of complex structural information in 3 dimensions.

</comment></comment></comment></comment><comment><USER15> This channel was really amazing, got a lot out of it, noticed things I'd never noticed before. Highly recommend along with _Lessons From The Screenplay._

</comment><comment><USER16> Why don't Netflix or Amazon pick them up?

Cheap production. These companies eat copyright problems for breakfast. Documentary series seem to be popular lately, and Every Frame is already a well-known name.

<comment><USER17> It looks like the creators weren't interested:

> We didn't care about cheap or fast, we cared about it being _good_. [...]

> If we sold the channel to another company, or partnered with some network, > then we would no longer control the triangle. And guess which of these three > things would get sacrificed first?

Edit: added exact quote from article

<comment><USER18> They have over a million subscribers on YouTube. They could just post a video saying "listen, YouTube sucks, sign up for us on Patreon, if we get more than $X at minimum $Y per-person we'll make the next video and send you all a hosted download link".

There's podcasts with less reach than this channel that easily make $100K per upload in revenue.

<comment><USER17> Why do you assume that monetisation was the main problem? This wasn't a startup that needed to return 10 times the initial investment in 5 years.

The impression I got from the postmortem was that they just got tired of the format and wanted to do something else.

<comment><USER18> I have not assumed that, we're commenting on a specific sub-problem they mentioned in their post in this thread, yes they made it abundantly clear that it wasn't the only reason.

Between copyright issues on YouTube, getting around that by working with a big partner that would sell their content, and getting donations on Patreon, they never seemed to have considered selling access to high-quality content for a fee _without_ partnering with someone.

I listen to several Podcasts that have something like this as a monetization model, i.e. some sort of paid-for premium content or content exclusively for subscribers.

</comment></comment></comment></comment></comment><comment><USER19> Apart from a wonderful end to a lovely YouTube channel this essay easily surpasses most 'lessons learned' articles i've read. Kudos to Tony and Taylor for having the motivation to write this down.

</comment><comment><USER20> There is no wonder they stood out. They did research very thoroughly to create every single video.

</comment><comment><USER11> I've made a few toy films for work - an internal movie festival, nothing professional - and I'm glad that their timelines look kind of close to what mine look like, with things overlapping all over the place instead of something neat and orderly.

</comment><comment><USER21> I watch a lot the French equivalent Blow Up [1], they are a lot more productive, less didactic and I find them more irreverent & interesting. I think they do not have any upload and rights issue because they are produced by Arte, a Franco-German TV network

[1] [https://www.youtube.com/channel/UCfE1oQ47oqyJNzM- nFy_gjA](https://www.youtube.com/channel/UCfE1oQ47oqyJNzM-nFy_gjA)

</comment><comment><USER22> they said they stopped when it stopped being fun, after their marvel series. Is there any clearer proof needed that Marvel is killing cinema?

</comment><comment><USER23> While I'm sad my favourite channel has officially ended, I still feel so grateful cause they made me look at movies in a different light.

</comment><comment><USER24> One of my favotite channel. Sad, its over.

</comment><comment><USER25> > The big danger for future video essayists is that large websites have > started moving away from the written word and towards video, which is > completely unsustainable. Video is just too expensive and time-consuming to > make. (TAYLOR) Unfortunately, no matter how hard you try, nobody can cheat > this triangle. And sooner or later, all of these large sites will bleed > money, at which point some executive will say "We need to make our content > both faster AND cheaper!"

I feel the field of video editing and clipping needs a solid dose of machine learning and other software magic. In the future, creators like Tony and Taylor will collect clips and start talking. And the software will edit, transition and even reorder clips to match what's being spoken and what's consistent with the style of the channel. Suddenly that 8 hours of editing per minute of video will go down to 8 minutes. So get on it Adobe: make editing great again!

PS: I fucking hate medium. How does shit like this even happen? [https://imgur.com/UVdXKxk](https://imgur.com/UVdXKxk)

</comment><comment><USER26> Damn, this channel had under 30 videos, but I'm grateful to Tony (and apparently Taylor; bad on me for not bothering to read the credits) for helping me appreciate movies technically. It's been dead in all but name (no videos for a year), but I read all of this classy post-mortem in Tony's voice.

<comment><USER27> I'm going through now and watching the ones I missed before, and I think only eight have the double credit. I assume you read that sentence the same way I did, which was the _first_ video only had one credit, but all subsequent videos credited both. But I think he meant the first one only credited him, he just used the same template for a while, and started putting in a double credit near the end.

</comment></comment><comment><USER28> Well, that is very sad. I just watched the final episode and it is probably my favorite things I have watched in years. I truly mean this. I am a film editor who truly despises temp music, and never knew about this episode. Bravo! I am honestly just goig to watch this again, and admittedly in a self-righteous pat-myself-on-the-back sort of way. I know, it's awful, but so has watching the art of film be sacrificed through these systemic abuses.

I may have just begun a marathon. I don't know. I had work to do today.

<comment><USER26> Unfortunately, they only made 30 videos (and now I understand why). So more like a 10k than a marathon :)

I'm going to marathon today too (but I had no work to do).

<comment><USER29> In memory, I will also put off work to run an Every Frame A Painting 10k today

</comment></comment></comment><comment><USER30> I thought it was about this animated movie of Vincent Van Gogh: [http://lovingvincent.com/](http://lovingvincent.com/)

<comment><USER31> I saw a poster for that somewhere and was hoping they'd mention it, but no luck.</comment></comment>


My data's bigger than your data - <AUTHOR> http://policybythenumbers.blogspot.com/2012/04/my-datas-bigger-than-your-data.html

<comment><USER2> It's incredibly misleading to use the Google logo as they've done on this blog. I was very confused for a minute as to why Google PR let them make a "My ____ is bigger than yours argument" -- clearly they didn't.

<comment><AUTHOR> The blog is from Google, so the logo is OK. The post, OTOH, has clear attribution.

Edit: Also:

        The authors of these posts include Googlers and guest
        bloggers. Opinions expressed here do not necessarily
        represent Google's views. We hope the numbers presented
        will inspire meaningful conversations and inform policy
        debates.</comment></comment>


Zinc – Rust's safety features applied to embedded development - <AUTHOR> http://zinc.rs/

<comment><USER2> This looks nice!

Rust is starting to join Ada, Oberon, Pascal dialects compilers in bare metal support.

Good way to dispel the belief only C compilers can do it.

Specially if like Zinc, there is zero C code there.

</comment><comment><USER3> I'm very exciting to see Rust move into embedded!

Some minor comments: The page includes example code. I worry that it might be abstracting TOO much away, while at the same time hiding details.

For example, in the main oscillator example, you _still_ would have to consult deep in the manual to understand what m, n and divisor do if you wanted to change the frequency. I think if you're going to use a library, it would be cool to operate at a higher level than this.

Also notice in the timer example, you still have no idea what frequency the timer will run at! Maybe I just want something higher-level built on top of this? Maybe I should implement libopencm3 on top of this?

p.s. Crazed fans of the greatest microcontroller of all time, the stm32f4, check out [http://reddit.com/r/stm32f4](http://reddit.com/r/stm32f4) and [http://diydsp.com/livesite/pages/stm32f4](http://diydsp.com/livesite/pages/stm32f4)

<comment><USER4> >[http://diydsp.com/livesite/pages/stm32f4](http://diydsp.com/livesite/pages/stm32f4)

Very cool page! Great links to some amazing projects on the stm32f4.

I see you mention Lua and JavaScript on the stm32f4, have you seen micropython running on it?

[https://github.com/micropython/micropython/wiki/Board- STM32F...](https://github.com/micropython/micropython/wiki/Board- STM32F407-Discovery)

<comment><USER3> Wow. I didn't know that was possible! Ima haveta try it. You can easily see I'm obsessed. I'll add it now.

Seriously, a chip like this hasn't been out in a long time. Sure there are more powerful ones like the BeagleBoards and RPis, but they require more support hardware, space, components and power. Hell, the stm32f4 can run with just a few capacitors and no external crystal, and still have 24 analog inputs, two analog outputs and floating point. Plus it has internal cache so it can run at 168+ MHz and DMA, etc.

<comment><USER5> I read that they will be release a new $1 stm32f4 mcu using a new process soon.

[http://www.st.com/web/en/news/n3547](http://www.st.com/web/en/news/n3547)

BTW , my mistake , it's stm32f3 , altough it's cortex-m4. a bit weird naming.

</comment></comment></comment></comment><comment><USER4> A came upon this the other day, and was so impressed that I'm about to drop $60 on an lpc1768, which is the primary MCU they are using at the beta stage (they plan to expand to others once the API is solidified).

They also have used an stm32f4, which I do have at the moment, but support for it seems to have dwindled over the past few months.

But I really like the safe way they are developing the API. Even the hardware configuration is done as a safe DSL. Very impressive.

This project looks like a great foundation for a realtime OS in Rust I've been itching to try my hand at.

<comment><USER6> > I'm about to drop $60 on an lpc1768

I usually buy them at ~$3 a piece...

<comment><USER4> Yeah, I should have specified the eval board, which includes peripherals. This Zinc project already has support for several of the peripherals, including a few TFT drivers, which I want to be able to try out.

I don't always buy eval boards -- if a chip comes in a DIP package, I've just breadboarded it in the past. As a hobbyist, I haven't yet tried to build a breakout board for any SMT-mounted chips, but it's on my todo list.

The one I'm looking at (by RioRand) is not a bad deal, since it actually includes a 2.8 inch TFT on the board as well as Ethernet interface. But I did consider just buying the chip and breadboarding it. I may still do that and buy the LCD separately.

$60 would indeed be expensive for the chip alone.

<comment><USER6> BTW, you cand find cheaper boards or with more peripherals from China, just check out eBay or aliexpress

<comment><USER4> Yeah, I know I can probably get the eval board a bit cheaper -- I've bought chips from China on ebay and frequently look at TFT LCD displays on aliexpress while dreaming of a commercial product I'd love to do some day.

But in this case, I don't want to wait 2-4 weeks for delivery. The RioRand will be here in 2 days since it's on Amazon Prime.

</comment></comment></comment></comment></comment><comment><USER7> Can someone clarify two things please?

Firstly, bare metal here means this stack can create an img with an executable that will be run with nothing more the uboot? I.e. No OS, no kernel, not even a Rust runtime (hence, presumably, no std in the example)?

Secondly, can anyone recommend a good reference to get a handle on platform trees? I first came across them on my beagle bone. My understanding it was mostly because Linus got fed up of hundreds of patches for each and every ARM board.

<comment><USER4> >Firstly, bare metal here means this stack can create an img with an executable that will be run with nothing more the uboot? I.e. No OS, no kernel, not even a Rust runtime (hence, presumably, no std in the example)?

Yes, that is correct. No OS, no kernel, no runtime. Now, Rust is isolating a core library (called libcore) that can be used without runtime support (and hence in projects like this one).

<comment><USER2> To be pedantic, from compiler design point of view, that is also a runtime.

<comment><USER4> Well, it uses the libc runtime [This is actually mostly incorrect, see comment below by dbaupp], which obliges me to invoke the old quote, "the greatest trick C ever played was to convince the world it has no runtime".

I wish I could track down the originator of that quote, but I have no idea. I'm sure someone here will know.

<comment><USER8> Libcore doesn't use the (entire) libc runtime; IIRC, it essentially just needs the memcpy and memset symbols to be defined.

<comment><USER9> Why not just implement those in Rust too? It seems like you could break the dependency entirely.

<comment><USER8> Yes, you can, and they are even provided in pure Rust for exactly that reason: [http://doc.rust-lang.org/master/rlibc/](http://doc.rust- lang.org/master/rlibc/)

(Seems there were 2 more mem* symbols required than I remembered.)

</comment></comment></comment></comment></comment></comment></comment><comment><USER10> Zinc doesn't rust though.

ED: Read the correction below.

<comment><USER11> That is almost incorrect. Zinc is used as a plating because it corrodes preferentially to steel, and in doing so it removes electrons needed for oxidation and thus prevents the steel from rusting. This is why you can stop a ship hull rusting by simply bolting a block of zinc to it.

<comment><USER7> I read ages ago that the Sydney Opera House uses sea water for air conditioning, and has a sacrificial zinc anode.

</comment></comment></comment><comment><USER12> I think it's unfortunate that LLVM has no first-class public targets smaller than ARM to help guard against 'all the world's a VAX' pitfalls. There are/were projects for MSP430 and AVR but it's not practical to keep up with LLVM without full-time developers.

<comment><AUTHOR> As I understand, MSP430 _is_ such first-class target. MSP430 is in-tree and maintained.

</comment></comment><comment><USER13> Great domain name for a project.

</comment><comment><USER14> Is anyone here actually using Rust in a "real-world" situation? My impression is that is gaining traction, yet is not yet stable enough for production use. Anyone have experience to say otherwise?

<comment><USER15> There are three production deployments of Rust: OpenDNS, something I always forget, and Tilde, for Skylight.io.

(I'm starting to think it's only two and my brain made up the mysterious second one)

That said, you have to be a certain kind of person to use a pre-release programming language in production.

<comment><USER8> The best kind of person. :)

((Members of) Tilde are writing Rust's awesome new package manager, Cargo: [http://crates.io/](http://crates.io/) )

<comment><USER15> Right, which was great, as "We already use Rust in production" combined with "we built Bundler" is a pretty decent pitch.</comment></comment></comment></comment>


PSA: LastPass Does Not Encrypt Everything in Your Vault - <AUTHOR> https://hackernoon.com/psa-lastpass-does-not-encrypt-everything-in-your-vault-8722d69b2032# <comment><USER3> I think this is NOT the case.

You are looking at intermediate data of what's stored in your decrypted blob. Yes, some things are encrypted twice in the Lastpass vault.

The contents considered "unencrypted" by the blog post are actually only accessible after your private key has been provided.

"How can Lastpass show me the Google logo?" It's shown by your Lastpass Extension, after your vault has been decrypted with your password. It's the same reason that Lastpass can show you the password saved for Google!

Notice that request has an unencrypted folder name, "Email." Those folder names are only accessible after the decryption of the entire vault.

URLs are encrypted. LastPass does not know your URLs.

I noticed the article does not include the destination URL for this request, only the parameters. So I can't make a determination as to why this request was made and who the destination server is.

I just tried adding a new site to the "Email" folder, and no requests to remote servers showed up in my Network tab.

IF the LastPass extension really does make a call to lastpass.com with this information, then, yes, there is a possibility that Lastpass can track these hashes in some separate store. But that doesn't mean that the encrypted vault blob has the unencrypted data as claimed.

<comment><USER4> Agreed that the vault blob almost certainly hides all of this, but the question still remains about how the logo is initially obtained. There still might be a leak to lastpass when the logo url is first requested.

And if the extension is pulling the logo from the web then there is also a leak to each site whenever it pulls (rather than to lastpass itself).

Best case scenario: the extension comes with a list of the most common logos baked into it. But if that's the case, why would it save a logo url. Hmm ...

I'm pretty sure we'll be hearing back from Lastpass on this one.

<comment><USER5> _there is also a leak to each site_

That's not really a leak unless you're keeping a password to some site without actually using the site and don't want the site to know you've done this. But that probably doesn't come up often in practice.

<comment><USER4> Well, sure, but any out-of-band communication is potentially a leak. If the extension pulls every logo whenever you run it (notwithstanding whatever caching is used, if any), then every site that has a logo could track when you open the extension at all. There are other potential issues here too ... like if a maliciously formed logo image could be used to crash the extension, etc..

Those aren't great examples, but any out-of-band information leak is a bad thing to have. Even if there are no known exploits now there might be future exploits that haven't been anticipated. A common issue when it comes to security.

<comment><USER5> How can the site tell you're using the extension? And so what if it does? The site can guess you're using a password manager by noticing the instant password entry. The malicious logo, that's really a problem for your browser to deal with. Using an extension to help you talk to a site you already talk to is not really a leak, given the purpose of such extensions.

<comment><USER4> A lone request for the logo image with no other simultaneous requests in the log could probably be gleaned as a lastpass extension lookup.

And again in this scenario (which we don't know if it's accurate, yet) it's pulling the image for every site with a logo whenever you browse the vault. So your IP address could be leaked to a site that you don't want to know your whereabouts at that moment.

Forensic information is forensic information. A security-conscious tool should not be increasing one's forensic footprint.

</comment></comment></comment></comment></comment></comment><comment><USER6> Back to the Metadata problem. Here's how this information could be weaponized:

NSA: LastPass, we suspect that John Smith uses your service. Give us access to John Smith's password database.

LastPass: We cannot, all of John's usernames and passwords are encrypted and we ourselves don't have the key.

NSA: Alright, then, give us the _websites_ for which John Smith's database has credentials for, and we'll subpoena each website of interest individually.

If John Smith has known email address email@example.com, it is probably safe to assume that the email is the login for at least some of the websites of interest, and can then ask each website for info on that particular user.

<comment><USER7> Your tin foil hat is on a bit too tight.

        1.

The NSA already has that data they have your home address (this is public) and can see you connect to gmail servers at times you are normally home for. We've already seen evidence this is well within the NSA's capabilities based on the Dread Pirate Robert's trial.

        2.

LastPass's RNG is closed source so if your threat model includes the NSA you've already lost as it is very reasonable the NSA knows every password LastPass could ever generate for you.

        3.

LastPass's encryption/decryption is ALSO closed source so there is no reason the NSA can't just subpoena them to update your client with a faulty crypto.

        4.

LastPass Apps/Browser phone home once unlocked. If subpoena by the NSA they can steal your password there.

Seriously if you have a threat model that includes the NSA you've already lost.

<comment><USER8> DPR had terrible OPSEC. We should all learn from his failures.

You are completely correct that any threat model that includes direct attention from the NSA is insurmountable. Even highly skilled targets like OBL are eventually defeated.

<comment><USER9> OBL seems like an odd example for "insurmountable". He was probably the target of more US gov't attention than anyone else who isn't running a country. After more than a decade of active pursuit, he was compromised by a largely non- digital security breakdown.

I agree with the general point about direct attention, but OBL seems closer to the exception than norm.

</comment></comment></comment></comment><comment><USER10> Is there is any proof that the "Concerned LastPass User" who wrote this isn't just the creator of BitWarden?

I normally don't assume astroturfing without concrete evidence, but there is no information in the post that explains why the author is anonymous and the creator of BitWarden has previously made comments without disclosing their affiliation ([https://news.ycombinator.com/item?id=12754396](https://news.ycombinator.com/item?id=12754396)).

<comment><USER11> Does it matter? If the claim is true, then it's a serious problem. If it's untrue, then the article is wrong. Neither one is changed if the author is a particular person.

<comment><USER12> I really don't see how this is a "serious problem".

The only thing unencrypted is the site's domain name. Who cares? Site domains are public anyways.

Definitely two opinions on this matter, I suppose. But for me, I really don't care that they don't encrypt the domain names for the sites.

<comment><USER13> Metadata matters. The NSA revelations have shown this.

For a really simple example, I guess there are quite a few people with a pornhub account in their vault. I'd guess a significant portion of those users don't want that fact to become public.

</comment></comment></comment></comment><comment><USER14> LastPass is so buggy, I have a draft blog post that I'm going to publish some day listing the dozens of bugs I've found. It's still the least worse cross- platform password manager (with sharing and sync features) that I've tried.

Bitwarden looks interesting, but it doesn't seem to support team features, nor does it seem to have any documentation, or even an "about us" page.

<comment><USER15> I'd either need Bitwarden to take some money _or_ be fully open source and I have to provide the cloud storage. Being "free" but still clearly costing them real operational money (even if not much) is not something I will plan on being there in 5 years.

I don't necessarily _need_ LastPass to be there in 5 years, since I can export and recover what I need into another manager if I need to, but I personally don't want to go into something that is set up right now to not be there in 5 years.

This is not a permanent objection forever and ever, amen. If my objections go out of date, I'd consider at least trying it.

<comment><USER16> Hi there. I'm the lead developer of bitwarden. bitwarden is currently sponsored by the Microsoft BizSpark program which covers many of our operation costs and allows us to offer services for free to our users. We are working to introduce enterprise features for businesses in the future which will allow us to monetize. For now though, everything is free for users.

<comment><USER17> Can I suggest that you explain this on the website? I visited, could see that you had a cloud sync but couldn't see how you make money and left because it didn't add up.

</comment></comment></comment></comment><comment><USER18> I don't see this as much of an issue personally. I don't ever store any identifying information in urls, so it's more of a convenience to have the logos for easy navigation.

I get that they say that _everything_ is encrypted, but really it could be a lot worse. I definitely won't be switching password managers just because of this like some people are saying.

<comment><USER19> Its a pretty huge deal if you store passwords for websites that you don't want other people to know you even have an account for. Like, say, a dissident in a politically oppressed country having an account for the US immigrations website.

</comment></comment><comment><USER20> Well, I'd love to use something other than Lastpass but there are no other password managers that are as well integrated into chrome and that sync seamlessly.

Keepass had tons of issues on the synch-side, merging incorrectly or just plain not syncing in addition to the android app being horrible to some extend. Additionally the chrome plugin is less well written, it's not bad but not as easy to access as lastpass.

1password is still not out on linux and I have no intention of using them until they bring out a linux client.

Bitwarden looks fishy to me (audit? pricing? funding? integration?).

If the only problem with Lastpass is that they sent out the URL of the site in cleartext over a HTTPS connection, fine, have it, there is clearly worse and it's something I'm willing to accept in exchange for one of the better password managers.

<comment><USER21> Have you seen enpass? It is basically a more polished version of Keepass. [https://enpass.io](https://enpass.io)

<comment><USER20> enpass certainly looks interesting, the UI looks atleast as polished as lastpass. I'll give it a short drive.

Thanks for sharing.

</comment></comment></comment><comment><USER22> This doesn't seem like a terribly important information leak, but what gets me is that they obfuscated it by converting it to hex. Why do that?

On the one hand, it feels like they're being sneaky and trying to trick savvier users who might glance at the data to make sure it "looks encrypted". On the other hand, they have to have realized someone would notice eventually. Or maybe that's the point: if they obfuscated it well, someone would break it and they'd have egg on their faces. By just hiding it a little, they have plausible deniability that they weren't trying to obfuscate.

But any way you slice it, it seems weird.

<comment><USER23> It's probably just easier to convert it to hex rather than worry about escaping characters. I've done that before.

<comment><USER22> Yeah, good point, although URL escaping is particularly easy.

</comment></comment></comment><comment><USER24> Stupid question: why can't LastPass encrypt the URL as well and decrypt client-side to show the logo, like they do (as I understand it) with passwords?

<comment><USER25> that seems a better solution, but lastpass would still know that user_x is downloading the google.com logo.

<comment><USER24> How? The logo image request goes to google.com then, and not Lastpass, right?

<comment><USER25> I am assuming lastpass have the logos on their domain. if the request goes to google.com then its fine as long as the referer isn't sent.

</comment></comment></comment></comment><comment><USER26> Perhaps a silly question as I do not have a lot of experience with software like this, but:

What prevents Lastpass, bitwarden or any other third-party to update their software (and/or compromise the download server) to synchronize all information un-encrypted in a new version which is auto-updated by the user?

I currently use KeePassX, and synchronize this file with a secure server myself since I feel uncomfortable with having software that handles the encryption also controlling the synchronizing service.

<comment><USER27> Two fixes: 1) find an opensource one, compile it yourself, verify it's behavior, install it yourself 2) find one that works without using network, don't approve adding network permissions ever, run it in a jail without network, on android you can deny the network permission.

This works again random software companies, but not against google.

</comment></comment><comment><USER28> Lastpass is an atrocity to software. In almost a year using it (including its "Premium" version), I was unable to get their password change feature working and it was often unable to remember passwords properly. I would change the password, Lastpass would show the right password in its UI, then it would use the wrong one. This is the most basic feature of a password manager and it simply doesn't work. Their support, even for the paid version, might as well be a bot that just spits out random Lastpass "facts".

I see a ton of reviews all over the Internet claiming it's one of the best password managers, and I wonder if these reviewers and websites didn't just get paid some money to write a positive review without ever installing, let alone using the software. With the software being so shoddy, I would not trust my passwords to Lastpass even if they ended up fixing the UX. I ended up deleting my account and switching to Enpass which has worked flawlessly. On top of that, I don't have to trust Lastpass, or any shitty company like that, with my most valuable data and can sync it over WiFi, my NAS, and shared folders in addition to cloud providers (also works in Linux).

</comment><comment><USER29> I've been using LP as a paid user for several years now, and was really annoyed when they were absorbed by LogMeIn. My main issue is this: while there are several alternatives to LP, there don't seem to be as many which have the same or similar features while ALSO integrating YubiKey's OTP functions. I bought a YubiKey because of LastPass, and slowly integrated it into my workflows. I really like it as a second factor, and the additional capabilities (such as storing secrets for TOTP, etc.) make it nearly indispensable.

Last I checked (over a year ago), 1Password wasn't terribly interested in adding it as a feature, and while there was a KeePass extension which implemented HOTP-based 2nd factor, I never got it to work reliably. Is there ANY service which integrates the YubiKey as well as LP does? I'm more tied to that than I am to LP.

 __Unrelated to the initial post, but here 's a recent LP annoyance: on January 9, LP pushed an update to the Chrome extension which broke the version 3.0 view (which looked like a filesystem), forcing users to move to their 4.0 view if they wanted to use the extension. According to a user commenting on the support tab in the Chrome store, "you deleted the min.js file from your extension but your lastpass version 3 view still needs this file. cant even manually copy it back because chrome then thinks its malware. keep up the good work!"

I can't speak to the veracity of the comment, but LP's forum was pretty active, and admins essentially said "don't use 3.0" as a fix. Support tickets mentioned they were aware of the issue, but not much else. To be fair, LP did say they would eventually deprecate the 3.0 view, but there was little communication about the recent update, making it seem like they don't really give a shit. I don't like their 4.0 view; it's less efficient, and more interested in making things look pretty.

</comment><comment><USER30> As someone who's worked in this domain, I found this very poorly handled. The obvious, privacy-conscious solution, would be to embed all logos in the client, but this can be unfeasible on the web, depending on the quantity of data. In practice, maybe sacrificing a couple of MB for a one time download isn't such a bad trade-off for privacy (and this will only happen for logged- in users who visit their vault).

However, if we want to trade off _some_, but not all privacy (in terms of what logins a vault contains), I can think of a naive obfuscation scheme where random domains are added to a login alongside the real one. Here's how that could work:

        Preprocessing
        * assign an order to the logos and hence numerical IDs
        * pick a hash function (URL / site name) => ID

        User adds a new login:
        * is the URL recognized (e.g. accounts.google.com) i.e. do we have a logo for it?
        * if yes, obtain its ID e.g. 1
        * get N more random IDs e.g. 14, 124, 144
        * save all of them as the login's metadata e.g. "logo_cache:1,14,124,144"

        User requests logins (and hence needs logos):
        * compute (and cache) the list of IDs of logos needed (M entries x N logo IDs each, deduped)
        * pack and send the logos (hopefully a much smaller subset than all logos)

</comment><comment><USER11> It's really weird that the URL parameter is encoded as hex. Is this some attempt to hide it, or just a lazy programmer not wanting to call an escape function?

</comment><comment><USER31> I got a license for 1Password Families in a Humble Bundle recently and have been seriously considering making the switch from LastPass. The LastPass Chrome extension gets disabled on me once or twice a week and has become a real annoyance. The only thing holding me back is the ongoing pricing for 1Password is 5x more than LastPass.

</comment><comment><USER32> I'm an ancient Lastpass user too. But I don't think the unencrypted URL worries me.

If any 3-letter agency want my history, they can just visit anyone in between me and the URL.

My browser have my browsing history. My ISP have my browsing history. DNS resolvers have my browsing history. CDN have my browsing history. Proxy/VPN have my browsing history. (which some they claims they don't log at all)

Basically browsing history is too accessible to anyone. If you are using network that doesn't managed by you, they have your browsing history too. (McD, Starbucks, etc)

And last again like others+Lastpass have commented, your whole pile of encrypted data is encrypted together and sent to Lastpass. Did you try to read your Wireshark?

</comment><comment><USER33> I really like a lot of the features of LastPass... works across devices, has groups with sharing options for teams, security audit and summary, auto updates (on some sites), 2FA, and the dead man's switch is nice...

I haven't found any other services that work as well for teams with features like this. I've tried 1Password and some others and found their team sharing options lacking.

Curious what other teams are using -- not just personal password managers but tools you can use successfully over an entire organization.

</comment><comment><USER34> I've heard many bad things about LastPass - and this is just the cherry on top. I highly recommend 1Password to everyone. I've been using it for about 2-3 years now and it's been absolutely flawless. Yes, it doesn't have a Linux client, but that's literally the only "drawback" I can think of. As a developer who uses a Mac, the only time I'm on Linux is when I'm SSH'd into a server.

<comment><USER35> It does run just fine in Wine, though. I've got a Ubuntu box that's been running it with Dropbox and it syncs and runs just as well as my Mac version.

</comment></comment><comment><USER36> I ditched LastPass after LogMeIn acquired them. With all of the bad press that company has had over the years it was enough for me to move on.

For the most part I am happy with Dashlane and pay for it annually. Sometimes when chrome or firefox update it take a while to load the browser plug-in. other than that I have few complaints.

Anyone else use Dashlane or something similar, other than LastPass?

</comment><comment><USER37> I had the same reaction when I saw the Google logo in my vault: "how do they know?"

<comment><USER3> The vault is a local extension. It does not run off lastpass.com, unless you actually log into the website-based online vault.

<comment><USER37> Good point. I rarely, if ever, use the website

</comment></comment></comment><comment><USER38> Anyone have recommendation for replacing Lastpass? I need support for Android, Linux, and Windows. I would like to be in control of my data if possible (sync to cloud) and a nice to have would be a browser extension for autocomplete.

<comment><USER39> KeePassX - I've been using it for years now. I just put the database on my Dropbox. Quick, convenient, and most importantly for me, always in my own hands.

<comment><USER40> I've used KeePassX for offline/cold storage for years. I like KeePassX so much wrote a YubiKey extension [0] years ago but it was never merged. I assume the maintainer wasn't interested, never responded, but allowed the discussion to continue. Turns out this was more the norm than the exception, I assume the maintainer was too busy or lost energy/interested in maintaining what became a big project.

Years later KeePassXC[1] was forked and slowly growing.

[0] [https://github.com/keepassx/keepassx/pull/52](https://github.com/keepassx/keepassx/pull/52)

[1] [https://github.com/keepassxreboot/keepassxc](https://github.com/keepassxreboot/keepassxc)

</comment></comment></comment><comment><USER41> If they have access to URLs that's even more bad than it seems. The URLs are often registration form urls and can have secret data as url parameters.

LastPass needs to comment on this. It looks pretty bad.

</comment><comment><USER42> The (otherwise excellent) Password Store program effectively does the same thing.

Folks, encrypt _everything_. Anything less is profoundly foolish.

</comment><comment><USER43> I have a question to all the hackers here about personal identity managers and UX. There are projects to decentralize personal identity and move away from passwords, such as Solid ([https://solid.mit.edu](https://solid.mit.edu)) and our own project, Qbix ([https://qbix.com/platform](https://qbix.com/platform)).

The WeChat article recently posted shows one major thing about user behavior and UX architecture. Users actually prefer to have one APP on their phone representing their social identity, have all their notifications, contacts, etc. from all different communities in the app.

So this probably means that the "personal identity server" should have some default protocol to receive notifications (encrypted with user's public key) and an APP for iOS and Android. The server would have rules for processing notifications and may notify the user (eg it may stop after the first 5 or set do not disturb where only the badge updates). Upon opening the app the user would see all the notifications from all the other services (they would be fetched and decrypted). And those notifications may contain deep-links back into flows that generated the notifications, eg a chat.

What is also nice is if you can have these rules be general purpose hooks that run on the client in some isolated JS environment. Then for example you can update the list of ids that a user's contacts have on different services (if you have pairwise anonymity) in the background. And next time you visit a website the auth extension/library/app can offer to connect you with those people on that website.

I think the Personal App should display badges corresponding to the # of websites that have caused notifications, not the # of notifications. The latter should appear only when you open the app and see the list of relying party websites. Then each website can have a # of notifications next to it and the can be sorted eg by most recent or most urgent notifications.

Last thing - by having a personal APP I have a feeling that it would also be tied in with payments in the future. Identity service is becoming tied with payments (to prevent fraud, China now ties the two together more than any other country and cash is disappearing). So the Personal App could in the future have some standard for attaching payment methods and using them without giving the relying party anything except tokens representing payment plans the user agreed to (like Stripe does).

In this way, even though payments are increasingly tied to identity - <USER2> may lead to fascism - we can empower local communities to control the identity and maybe in the future even issue their own money on their own credit! This may help finance loans for poor people in India etc. (already shown that having a large group guarantee loans works better for everyone due to social factors etc.) and pull people out of poverty faster. @mediaprophet what do you think of these points about integrating payments inside identity App in the future?

(By the way I say community because you may host your own data AND your own identity on your own server but when it comes to reputation and payments, there has to be some others who give you this value. Maybe it will not be communities. Maybe it will be completely distributed with no centers. But so far in history, wealth and reputation and power has always found a way to concentrate itself at least a little.)

</comment><comment><USER44> What's wrong with Chrome's built-in password manager nowadays?

<comment><USER45> Anyone with access to your computer can look at the plaintext passwords in Chrome just by going to settings > passwords > show.

It's been a long-standing dispute... Chrome says "if people have physical access, security is broken anyway." But that's because they refuse to acknowledge the lesser threat model; "A non-tech savvy friend or family member borrowing my computer for 20 min" -or- "my computer gets stolen from my desk while I was logged in... and now they have access to all chrome passwords in plaintext."

It's infuriating. Wish they'd fix that, even if it's a superficial fix.

<comment><USER12> Not on windows. On windows is requires your windows password to unlock your passwords.

Actually, I think it does that on Mac OS too.

Don't know about Linux, since I haven't tried it.

<comment><USER46> It has support for Gnome Keyring or KWallet (IIRC, default is `--password- store=detect`). If you're using either, then it's the same.

<comment><USER44> Yes, it's using the gnome-keyring which requires unlocking. How is this less secure than using LastPass or KeePass?

</comment></comment></comment></comment></comment><comment><USER7> The article is 504'ing

Did they delete it?

<comment><USER47> Medium is having issues: [https://medium.statuspage.io/](https://medium.statuspage.io/)

</comment></comment><comment><USER48> "I wonder what the Federal Trade Commission thinks about that claim"

Would be my reply to the email, coupled with my demands.</comment>


I Don't Like Smartphones (2016) - <AUTHOR> https://www.devever.net/~hl/smartphones <comment><USER2> The author went somewhere totally different than I thought they would here. Their argument boils down to "smartphones are shitty computers with too many limitations". This is a fair point but arguably not the main one.

IMO the real reason smartphones suck is that they are attention sucking, dopamine delivery systems. A logical evolution of a slot machine. I hate mine yet here I am yelling into the internet on it...

<comment><USER3> >attention sucking, dopamine delivery systems

I've been siting here for five minutes, trying to think about something, anything, that is _good_ and doesn't fit that description. Everything people like, from exercise to socializing, shopping to charity. Literally everything that i _do_ and that i _like_ can be summed up as some form of _attention sucking, dopamine delivery system_.

<comment><USER4> Just be careful to draw the distinction between a dopamine hit as a reward for genuine effort and one delivered deliberately to reinforce an action...

<comment><USER5> Actually all reward systems work the same. There is no distinction between reward that is deemed good and bad for society.

<comment><USER6> I don't think parent is saying the mechanism is different, just that we need to distinguish the effects.

</comment></comment></comment></comment></comment><comment><USER7> I've gone through this thought exercise a lot myself, even considering replacing my iPhone with a flip phone. For me personally, the issue is the time-sucking nature of the apps and services that were on my phone.

To solve this, I deleted any apps with infinitely scrolling content, leaving my phone to include only utilitarian functionality, maps, and tools for music creation.

Because I know myself and my vices, I went so far as to add Facebook, Instagram, and Reddit to the "Restricted Content" list.

I bookmarked text.npr.org and mprnews.org and use those as my quick, bullshit- free gateway to local and national news.

With my phone in utility mode, I no longer experience false vibrations or that feeling of a phone burning a hole in my pocket.

Finally, I joined a meditation center and attend weekly.

My relationship with my phone is improved. It's great.

Always looking for more suggestions.

<comment> frosted-flakes What about websites like Hacker News?

<comment><USER7> I set my Hacker News profile to `noprocrast=yes`.

</comment></comment></comment><comment><USER8> I would also add that from a UX perspective they utterly suck. Many task that are possible with a mouse / keyboard setup are impossible on a smartphone, and what _is_ possible is much much slower and less precise.

I think its clear they have been designed from the ground up to be merely shiny toys / gadgets, and not useful pocket computers.

The key fundamental flaw in their design is the touchscreen. Eg. Press a 'button' which is just an image on the screen and has 0 haptic feedback, so the only way to locate it is by looking at it, but your finger is obscuring it (as you are moving to press it with your finger) so you cant see it. It is oxymoronical design.

<comment><USER9> > Many task that are possible with a mouse / keyboard setup are impossible on > a smartphone, and what is possible is much much slower and less precise.

I agree. But, you can't practically put a mouse on a phone. (At least, I have no idea how it could work—if you have a brilliant idea, I'd be interested to hear it.)

I think touch is the best input we have available for a device the size of a phone. On tablets, the lack of a mouse makes less sense, and I think it's notable that tablets haven't replaced laptops to the extent some predicted when the iPad was first introduced.

Edit: There is one alternative mechanism I can think of—a _stylus_. Still touch, but offers much more precision and in turn allows interfaces to be designed with smaller buttons that take up less real-estate.

The downside is that styluses get lost, take time to extract from the slot, and cannot be used in the same hand that holds the phone. Also, to truly reap the benefits of stylus input, the UI would need to be wholly stylus-focused. A hybrid UI will need to work with the lowest common denominator.

<comment><USER8> Just something like a Blackberry is decent.. Where you have a screen, that you look at, and buttons that you press with your fingers. Not a screen that you cover with your fingers and also a haptically featureless screen that you press with your fingers.

Handheld gaming devices are actually often well designed, eg. Gameboy, PSP.

Gaming consoles have a long heritage of being able to navigate complex menus and perform complex tasks on with just a controller (eg. Mario-maker, LittleBigPlanet)

Phones / tablets _are fine_ for just faffing about on, but that is all they have been designed for imo.

I think a pocket computer designed for actually doing stuff on might resemble a weird Blackberry / PSP hybrid.

<comment><USER9> Mario Maker uses a touch screen.

Little Big Planet worked impressively well with buttons, but I wouldn't consider it ideal, and it's notable that the spiritual successor, Dreams, is designed around a mouse-like, gyroscope-controlled pointer. Media Molecule chose this option despite the fact that it feels awkward on a dualshock and requires frequent re-centering.

I do miss slide out keyboards, but I don't think they're a complete solution. Similar to a stylus, sliding out a keyboard takes precious seconds, and they introduce a mechanical failure point. If you go full-on Blackberry, you loose valuable screen real-estate.

<comment><USER8> * Mario Maker uses a touch screen.

Ok, well 'street fighter', you need to input very complex and precise controls. Or pokemon on the gameboy, or a JRPG with its labyrinthine menus and options + 100's of complex difficult games.

* sliding out a keyboard takes precious seconds

As opposed to the minutes you lose fumbling with a 'keyboard' you cant feel (or see, cus ure finger is in front of it)

* If you go full-on Blackberry, you loose valuable screen real-estate.

If that 'real estate' is also trying to act as a physical interface, then its not valuable real estate anymore, its garbage-land, its acting as the worst interface imaginable. Ive heard that expression before and I think what the phone designers mean when they say it is: if you add a keyboard it no longer looks like a _cool_ shiny sci-fi gadget.

I dont get how people are ok with touchsceen interfaces, they're a haptic _nothing_. People were livid about the IBM PCjr's chiclet keyboard. Even that is infinitely better than 0.

</comment></comment></comment></comment></comment><comment><USER10> I don't like smartphones either, mostly for a reason he missed. They are _intrusive_. They are designed to suck your attention, and I feel peer pressure to be available all the time. I refuse to, and I'm often looked down for this reason.

I prefer extreme computing devices. Either big desktops, with great ergonomics and power, or tiny _non-intrusive_ wearables.

I hope we get true autonomous watches soon, that can silently track some biomarkers and offer some smartphone-like capabilities for occasional use (maps, calls & IM) without apps nagging for your attention.

</comment><comment><USER11> Smartphones rob users of the ability to communicate person-to-person.

Visit any restaurant and you'll find example after example of people worshiping at their private electronic altars despite the presence of friends and family.

Or try having a conversation with almost anyone with a smartphone. The minute a notification goes off, they're gone. Master calls, bye.

It's a vicious cycle. Greater isolation leads to greater dependence on the fake bullshit being spewed.

It's kind of comical to see geezers doing this. But to see it in young adults is terrifying. They're going to fight this addiction until the day they die. Most won't even know what's wrong with their lives because they've never seen anything else.

<comment><USER12> Most won't even know what's wrong with their lives because they've never seen anything else.

I feel like that's something every older generation says about the younger generations. Why should the younger generations care about ways of living that are no longer relevant to them? If nobody knows that they're doing it wrong, then are they really doing it wrong?

<comment><USER13> Technology changes but the human nature at the core does not, we are a social animal and we need to live in packs where communication, verbal and nonverbal are key, it's not just cultural but primal, i see it everyday, people don't know how to socialize or communicate anymore and that leads to isolation and depression.

</comment></comment></comment><comment><USER5> > They have ruined web design.

With regards to that: maybe we should switch away from responsive designs? Modern phones have big enough screens that it s often better to navigate a medium-desktop site by zooming rather than by collapsing everything to an endless scrolling stream. I find often that trying to compromise things to fit in responsive design is annoying for little benefit.

> They have led to massive centralization

I really wish someone comes up with a successful home router that includes preloaded optional decentralized services like ipfs. It's a pity that we don't take advantage of can't take advantage of that always-on computing power in the era of crappy-battery tablets and phones.

<comment><USER14> > Modern phones have big enough screens

Not all phones have big screens. Not all people want phones with big screens, and even though it's the current fashion that may change in a few years.

<comment><USER5> Agreed. But they have high enough resolution to show any website in a reasonable, pinchable way

<comment><USER15> But mobile browsers choose not to. Text too small? All you can do is zoom in and then you're stuck scrolling back and forth line by line.

</comment></comment></comment></comment><comment><USER16> I like the idea of getting rid of my smart phone, and I don't really have the "addiction" a lot of people seem to have, but every time I think about getting rid of it, I'm stopped because:

1) Maps/GPS for driving

2) Ride Sharing apps

3) Web browser for quick googling when I'm out

I can live without access to phone games or the reddit app, but it would be enough of a burden for me to not have access to these three things that I don't see myself dropping a smart phone any time soon.

<comment><USER17> One solution is to password protect the app store and forget the password or give it to someone else.

</comment></comment><comment><USER18> What a terrible article.

They are unequal devices. - This is not a design flaw. The screen is just small.

They are not real network clients. - This is not a design flaw. It's the best batteries can do.

They have led to massive centralization. - No, high bandwidth and big data requiring centralized processing is what led to centralization.

They have ruined web design. - This isn't even a critique of smartphones, it's about desktops.

There are no secure smartphones. - Are they really worse than other computers?

They are devices of unclear alignment, or of clear malevolence. - Wait, what? You claim that your phone is not secure, then you want to root it, install arbitrary software, and do your online banking on it? wtf?

</comment><comment><USER19> > _They have ruined web design... Suffice to say however that I am very, very > tired of the epidemic of (often massive) position: fixed headers on websites > nowadays._

Well fixed headers are annoying, but I find that considering all sorts of screen sizes has actually _improved_ web design in the most part.

Most sites are better in terms of accessibility and UX than they were 15 years ago, which could be attributed to more diversity in devices that developers need to deploy to.

<comment><USER20> > considering all sorts of screen sizes has actually improved web design in > the most part

Yeah, no. Considering all sorts of screen sizes usually means considering all sorts of mobile screen sizes and depending on your browser width, which oversized, overpadded elements will disappear.

And woe to you if you are using a low DPI desktop screen and do not want to have your browser window maximized, because suddenly your 23" or 27" monitor gets the shitty mobile UI.

</comment></comment><comment><USER21> I consider the main issue to be the first point: that they are purely consumption-oriented platforms. This might evolve for the better though with a little imagination(°).

However I disagree with the second point. Smartphones were optimized for power consumption, while PC were optimized for stability and functionality (depending on your operational flavor, the platform can be quite flexible, allowing such seemingly contradictory directions).

This "optimization for (reducing) power-consumption" is the only times it seems to have happened, and it is actually a good contribution to network design. We should actually embrace this process in general, not only mobility- based computers.

°: A future where your smartphone will be your transportable workstation, only docking on controls changing depending on your activity (screen + keyboard + mouse in general, screen / speakers for media consumption, joysticks for gaming). You'd arrive to work and dock your phone, start working, take it with you and being able to work from another office, another location, remotely (at home), etc.

<comment><USER22> I've never understood the "they're only consumption devices" gripe. It's such a narrow perspective, and very programmer-centric. I use mine,

1) as a tool to build real-world stuff (a level, camera to get reference pictures, measurement notes for when I go to the hardware store, measurement converter)

2) to regularly take better pictures of my kids than we get from "real" photographers with fancy, expensive cameras & lenses—and I barely even know WTF I'm doing, _plus_ I'm like 2 generations behind on my iPhone,

3) to cook—measurement conversion, recipe book which _I guess_ is consumption but I also use it to track results and take notes for the next time I cook something

4) I write messages to people. If that's consumption then so's letter writing which... can't be right.

5) Note-taking device for various personal projects, most of them having nothing to do with programming (thank God).

Further, if you asked me to film & edit a movie with a single device, you bet your ass I'd take a "consumption-only" iPad or (even) iPhone over a laptop or desktop. And so on for a bunch of other non-consumption stuff, for which the devices are anywhere from good-enough to much-better when compared with a laptop.

They're not great for programming, sure. Phones are awkward for long-form writing, though tablets are fine with an external keyboard. They're pretty good—even great—for tons of other creative work. Programming is not the only thing computers are for. In fact we program only to make the computer let us do _other_ stuff with it. From a certain perspective, programming's the _worst_ creative thing you can use a computer for.

</comment></comment><comment><USER23> >Smartphones are unapologetically devices for consumption.

The only people who say this, as well as "Tablets are only for consumption" are those who lack creativity and imagination.

Movies have been shot on smartphones. Music has been produced on smartphones. Novels have been written on smartphones.

On a smartphone I have "created" or edited notes, videos, spreadsheets, photo slideshows, goofy songs for friends and family, and smartphones are a portal to a vast wealth of information that is infinitely more convenient and useful for my technical hobbies than a laptop or desktop PC.

Ham radio tools, astronomy tools, film photography light metering apps, the list goes on and on.

Using Star Walk to peruse the constellations at night while in your backyard "creates" knowledge and memories better than any astronomy program on a "computer".

If you're not using a smartphone (AND TABLET!) to "create", you are probably a very boring person.

<comment><USER24> > Novels have been written on smartphones.

There's no accounting for masochists I suppose. That's like saying its possible to beat Dark Souls with a Guitar Hero controller. It may be technically true but that doesn't mean anyone should ever do it.

<comment><USER25> Nice reference - [https://youtu.be/g789wC9YhCw](https://youtu.be/g789wC9YhCw)

<comment><USER26> Which lead me to "Using Donkey Kong Bongos, I beat Dark Souls 3 with no shields or summon."

[https://www.youtube.com/playlist?list=PLI4MuUyu64FsljRm8G0jr...](https://www.youtube.com/playlist?list=PLI4MuUyu64FsljRm8G0jrSqPo1RET8kJM)

 _shakes head in bewildered admiration_

</comment></comment></comment></comment><comment><USER27> Smartphones are great for communication. Better than anything we've had before. But past a point, they are distracting. Just use smartphones for communication and have the self control to avoid the pitfalls.

<comment><USER28> For me it's not just communication. Maps give you super-powers. Camera comes in handy. Phones are decent remote controllers for other devices. Playing music (and occasional video) is also useful feature. All these features except incoming communication require you to engage, which provides benefit without stripping me of control.

Just disable most of (or all?) notifications and don't use social networks. Observe yourself checking the phone compulsively, and disable distractions that cause this behavior.

</comment></comment><comment><USER29> I've had this idea of starting a SaaS of sorts which delivers a bunch of functionality supplied by apps and web pages over SMS. Back in the early 2000's using my Blackberry 7290 I was able to access all kinds of information by texting to various short codes.

Does anyone here think there's a demand for this type of service anymore. It seems a lot of folks just want talk and text with access to some information like news headlines, weather reports, sports scores etc. All doable over SMS.

</comment><comment><USER30> I would pay a significant amount of money for a general computing device with the form factor and build quality of an iPhone.

Cell phones are amazing tech hamstrung by operating systems designed to drain wallets and collect data.

I do not have a phone number and I use a lower end Samsung basically as an ipod with wifi support. It constantly annoys me that apps that have no reason to require a phone number will not even let you register without one.

<comment><USER31> > I do not have a phone number and I use a lower end Samsung basically as an > ipod with wifi support. It constantly annoys me that apps that have no > reason to require a phone number will not even let you register without one.

This is interesting. I've never had a cellphone plan myself, however given that some apps (e.g., Telegram) and job applications require a phone number as you say, I've been using a TextNow [1] phone number with the caveat of needing wifi/cellular data. As of now, the only thing that worries me a bit is when I'm out and I need to contact someone but I don't have wifi access.

So how do you go about without a phone (mainly for calls)?

[1] [https://www.textnow.com/](https://www.textnow.com/)

<comment><USER30> I live on a small island with poor cellular connection, so a phone number is pointless anyways.

People explored the entire planet without phones, I can get by without WiFi for a few hours.

When I visit more civilized societies where people have the expectation of immediacy in communication I just plan my days when I wake up. My friends and family all know that when you make plans with me it is usually more detailed than "I'm not sure where we will be, I'll text you later."

I use apps for all of my day to day communication. Email is also one of my main communication channels.

Some apps like PayPal are basically unusable without a phone number, so I don't use them.

I get asked why I don't just buy a sim card when I visit other countries, and it really just boils down to liking being disconnected and bored of seeing people staring at their phones every time they are confronted with a problem.

</comment></comment></comment><comment><USER32> Instead of these hyper-thin smartphones, can't we have one that's relatively fat but where the battery lasts a few days, or even one whole day?

<comment><USER33> You just have to buy one of them. But grabbing one for yourself you may decide that thin is better after all.

<comment><USER34> I'm still using my Nokia N900. It lasts a few days on battery and there's still nothing better on the market, although I sometimes carry an old Galaxy S3 to access banking app or to buy public transport tickets - however, I sometimes have to do without them when its battery is flat :P

<comment><USER35> My n900 had usb charging trouble, and i had to get a "universal" battery charger, and alternative batteries. I have even recased it - it is surprisingly user-friendly in regards of repairs. However, i'm not nimble enough with the soldering iron, so it gave way to jolla first, and finally i succumbed to s8 later on, because swapping the batteries is just an ordeal. Loved the thing madly, tho.

</comment></comment></comment></comment><comment><USER36> Discussed at the time of publication in 2016:

[https://news.ycombinator.com/item?id=11097994](https://news.ycombinator.com/item?id=11097994)

(Shared for information purposes; not a dupe).

</comment><comment><USER37> All the issues except for "ruined web design" and to some extent "there are no secure smartphones" seem to be solved by phones based on GNU/Linux rather than Google/Linux. I'm very much looking forward to my preorder of Librem 5 and being able to use it like a regular PC with any peripherals.

<comment><USER38> The author says that smartphones suck because battery life limitations mean you cannot use the full power of the phone's components. Librem admits that they are aiming for a mere one day of use before you have to charge the phone's battery, which is shorter than many Android devices these days. Therefore, even the Librem phone may disappoint the author of this article.

<comment><USER14> That's a pretty obscure reason to say that smartphones suck though. If you need more computing power, buy a tablet or a big battery pack, or use a laptop. Hell, log into a remote server and run your apps there.

95% of people who use phones don't need that much power and given how many people own phones they clearly find them extremely useful.

</comment></comment></comment><comment><USER39> > With a PC, I don't have to perform some arcane operation to actually have > control of the device.

I guess he does not have "user" accounts on his PC and runs everything under the Administrator account

</comment><comment><USER40> OLD MAN YELLS AT CLOUD

Right off the bat the author has embarrassed themselves. They seem to be oblivious to the fact that the majority of content on the most popular platforms is created using smartphones (Youtube, Facebook, Twitter, Instagram, Snapchat). Smartphones have actually democratized content creation and in a way that laptops and desktops never could. This should be obvious, not sure how this ever got upvoted.

Go take pictures with your laptop OP.

<comment><USER41> While it may be true that the majority of Youtube content (by hours uploaded) is created with smartphones, the majority of _worthwhile_ Youtube content very much isn't.</comment></comment>


The Battle That Created Germany - <AUTHOR> https://global.handelsblatt.com/politics/the-battle-that-created-germany-841255 <comment><USER2> I think there is another German who predates Teutoborg by about 50 years, and who really captivated me when I found out about him - Ariovistus.

He was a leader of the Suebii (mentioned in TFA), who extended German rule into Gaul around the same time as Julius Caesar launched his invasion. The two men met right before an ultimate battle between the Suebii and Rome.

Ariovistus's message was simple: while they are both invading Gaul, Caesar is doing so under the pretence of protecting states that are friendly to Rome, but ultimately he wants all of the Gaul to be Roman anyway, because the Romans see all of Gaul and Germany as "barbarians". So basically, he called out the Romans on what he rightfully recognised to be hypocrisy based in a false feeling of cultural superiority.

Caesar beat Ariovistus the day after and proceeded to put all of Gaul under the Roman rule.

And we know all this from Caesar himself: [http://classics.mit.edu/Caesar/gallic.1.1.html](http://classics.mit.edu/Caesar/gallic.1.1.html)

<comment><USER3> We also know this famous part from Caesar, describing moose without joints who lean against trees to sleep at night:

 _There are also [animals], which are called moose. The shape of these, and the varied color of their skins, is much like roes, but in size they surpass them a little and are destitute of horns, and have legs without joints and ligatures; nor do they lie down for the purpose of rest, nor, if they have been thrown down by any accident, can they raise or lift themselves up. Trees serve as beds to them; they lean themselves against them, and thus reclining only slightly, they take their rest; when the huntsmen have discovered from the footsteps of these animals whither they are accustomed to betake themselves, they either undermine all the trees at the roots, or cut into them so far that the upper part of the trees may appear to be left standing. When they have leant upon them, according to their habit, they knock down by their weight the unsupported trees, and fall down themselves along with them._

<comment><USER2> Thank you, thats brilliant

</comment></comment></comment><comment><USER4> Romans did not give up after a single loss in battle. They didn't give up after getting thrashed by the Carthiginians, nor the Parthians, nor the Gauls, nor the Germans in eastern Europe. I can't buy the argument that this one defeat forever made western Germania a no-go zone for the Romans.

"Germanicus" became an honorary title given to (a lot) of Romans who fought at beat Germans over the centuries...

[https://en.wikipedia.org/wiki/Germanicus_(disambiguation)](https://en.wikipedia.org/wiki/Germanicus_\(disambiguation\))

<comment><USER5> I think you are comparing two different Romes. The punic wars were for Rome's survival. The gallic wars were for Caesar's political survival, for significant gain in capital (human slaves) and to establish a buffer zone against the Germans (that were already more feared than the Celts). Back then, Rome was essentially unstoppable, you feel kinda bad for their enemies. 100 years later, Rome was well established and cozy for the elite - why risk your neck against the now battle proven Germans? Eventually this cozyness would be Rome's downfall.

</comment></comment><comment><USER6> Interesting I did not know the story of Arminius, and it mirrors in multiple ways the story of Vercingetorix and the battle of Alesia, that was also used in the XIXth century as a "national foundation myth", up to the erection of a giant statue.

[https://en.wikipedia.org/wiki/Alesia_(city)](https://en.wikipedia.org/wiki/Alesia_\(city\))

<comment><USER7> Slightly different result though.

I guess the English equivalent would be Bodicea/Boudicca.

<comment><USER8> And the Scots possibly Calgacus at Mons Graupius:

 _" To robbery, slaughter, plunder, they give the lying name of empire; they make a solitude and call it peace."_

Shame that Calgacus and his speech were almost certainly invented by Tacitus.

[https://en.wikipedia.org/wiki/Calgacus](https://en.wikipedia.org/wiki/Calgacus)

</comment></comment></comment><comment><USER9> I honestly do not think this battle matters as much as a lot of people think.

If you check where Roman culture really made a large impacts its mostly in Mediterranean climates and cultures.

The less excess-able inland areas in many places have much lesser cultural impact, think of Northern Britain for example.

Just in terms of impact these areas actually had lots of trade with the Romans and the people living on both sides of this 'line' were very similar.

<comment><USER10> The battle matters a lot in terms of it being a useful myth for propaganda during the forming of the German nation state after its unification.

I had to learn about it in art school. Specifically, about a German artist who criticised how eagerly post-war Germany was to forget it altogether, pretending the monuments raised for it and the operas written about it didn't exist. As if pretending it never happened is somehow better than remembering that what happened was wrong.

<comment><USER9> Sure, but my point was that it did not matter so much for Rome and Roman cultural influence.

</comment></comment></comment><comment><USER11> A battle that catastrophic could be seen as an early precursor to the crisis of the third century, slight dents appearing in Rome's facade and armour. A stretch maybe but worth discussing.

<comment><USER12> This was before there was a concept of Rome's invincibility, their peace with Parthia was not built on Roman success. This was just a lost battle, most noteworthy for setting up Germanicus' retrieval of the lost standards. Not comparable to the hell that was the crisis of the third century.

<comment><USER13> The idea of Roman invincibility is sort of bizarre concept, looking at the history. Roman armies were routinely defeated and destroyed. Rome's great advantage through the Republic and early Empire was that they could absorb such losses, which would be catastrophic for most states, and keep churning out new armies.

<comment><USER14> This is absolutely correct and I think the same thing whenever I read suggestions that Roman defeats are/were significant to its decline. Rome's major strength from the beginning was an indefatigable political will. Hannibal did not just cross the Alps, he decimated multiple Roman armies _in_ Italy and then rampaged around the peninsula for over a decade. There is an anecdote that when Hannibal's armies approached Rome, inside the city Roman traders sold land rights to the spot on which his army camped. Much like the Russians and Americans have found in Afghanistan, it is hard to defeat an enemy that shares a common fundamental belief in its own persistence and refusal to acquiesce.

Even in this story, as the article notes, after having lost three legions in an utterly decisive battle in the wilds of Germania, Emperor Tiberius' son Germanicus decided he would go back and wage more war to recover the standards. That is not the sort of political will we are used to.

</comment></comment></comment></comment><comment><USER15> I had learned the story of the battle of teutoberg forest when studying roman history (in which it looms large as a shocking and humiliating defeat), and I was surprised when I spent some time living and working in Germany that none of my German colleagues had ever heard of Hermann or the battle (as I expected it to be a relevant date in the timeline of Germany's formation of identity).

<comment><USER16> This has several reasons, I think.

\- Modern Germans don't really see themselves as descendants of those Germans, in the German language both are named differently. Modern Germans are 'Deutsche' \- ancient Germans are 'Germanen'. English does not make this distinction. There are more annoying confusions like this, for example, the Germanic tribe of the Saxons has nothing to do with the modern state of Saxony, as the ancestors of modern Saxons spoke a different dialect. There are several breaks like this in between modern Germany and Germanic tribes which are masked by nomenclature.

\- German (Deutsche) Catholics distanced themselves from the 'barbaric', non- Christian Germanic tribes.

\- As usual, the Nazis ruined it. The battle was sometimes used for propaganda reasons by the Nazis, replacing Romans with Jews. Modern Nazis are also using it for their own purposes (replacing Romans with immigrants and the US)

Edit: the battle itself isn't silenced or anything, I do remember quite a few events when the 2000 year anniversary happened, including the cover of the SPIEGEL having it (IIRC?)

<comment><USER17> Very interesting. So are the modern Germans descendents of the 'barbaric' ones? Is the distinction made only for separating the earlier pagans from the Christianized tribes? And is the distancing only for religious, or for cultural reasons as well? I mean, were the modern Germans really more 'civilized' (whatever that means) than the barbaric ones, or is it just propaganda?

<comment><USER18> The distinction is strongly related to the habit of claiming Charlemagne as the founding myth. Makes a lot more sense as a precursor of the EU, but in the fast-forward way history is taught at school, this is usually the point where the wording shifts from "tribes who lived in the same geographic area" to "a precursor state".

People who want to identify with victory over Romans to fuel a nationalistic mindset won't stop at Arminius, they also claim the legacy of various gothic etc tribes who troubled and/or continued thedying western empire.

</comment></comment></comment></comment><comment><USER19> It is very interesting as the Romans lost the battle because of complete lack of scouting and intelligence/information gathering. They had a disdain on it. They also had a disdain on archery as well (they considered it unmanly). They lost in similar fashion with Partha as well.

Here there are some good recaps of the battle:

[https://www.youtube.com/watch?v=kmF3VBA_RcM&t=42s](https://www.youtube.com/watch?v=kmF3VBA_RcM&t=42s)

[https://www.youtube.com/watch?v=A3jSjknuUG0](https://www.youtube.com/watch?v=A3jSjknuUG0)

</comment><comment><USER20> As an german: No, Germany wasn't created 2.000 years ago. That kind of history telling was made by Hitler. Modern historians say Germany was created in 1871.

<comment><USER21> As a fellow German, at the _very_ least you'll need to account for the Treaty of Verdun. (No, not that one. The other one :)

From there, Louis the German received East Francia, which in many ways formed the core of what would later be Germany. From there, we certainly took a long and winding road. (The reformation settlement is probably another point worth touching upon, though)

1871 is merely the point where there was an actual administratively unified nation state called Germany. It's the first time we did that, so in _that_ sense, sure.

(Sorry. I nerd out on history. Really, it's a distraction to your main point - the whole legend of Arminius thing is a German nationalist myth. Tied to 1871 - each nation state needs a founding myth)

</comment></comment><comment><USER22> Slightly OT. I am a big Fan of the hypothesis that Siegfried (the main character of a major old German story) is Armenius. E.G. [https://www.jstor.org/stable/27701032?seq=1#page_scan_tab_co...](https://www.jstor.org/stable/27701032?seq=1#page_scan_tab_contents) (PDF is free)

<comment><USER23> well, a part of the myths at best, I guess

</comment></comment><comment><USER24> Complementary reading: "A Most Dangerous Book. Tacitus's Germania from the Roman Empire to the Third Reich" by Christopher B. Krebs (W.W. Norton & Company, NY, 2011)

(German translation: "Ein gefährliches Buch. Die 'Germania' des Tacitus und die Erfindung der Deutschen"; DVA, München 2012)

Especially interesting for pointing out a rather ambiguous role of early humanism (as related to the reception of the Germania) in German history.

</comment><comment><USER25> It quite interesting how little land north of Rome was conquered. You can draw a line on the map where the winter average temperature goes below -5 and it will be close to the border.

</comment><comment><USER26> I thought this was talking about Konninggratz, since Germany did not exist until 1870.

</comment><comment><USER27> As said Augustus: Vare, legiones redde!</comment>


Branding on the cheap: 99 tips for poor web startups - <AUTHOR> http://www.avivadirectory.com/branding/?p=1 <comment><USER2> Nice, this resource is also useful for team members wearing multiple hats, and they need something quick to come up to speed, and also offers a holistic perspective to marketing/branding. .

</comment><comment><USER3> This article contradicts another more practical article posted here a few days ago, that says branding is worthless, which I liked better. Branding implies consistency, and no startup, no matter how pretty or expensive their logo is, is going to know exactly what they stand for, and they shouldn't know going into it all.

If branding was important to startups, no startups would exist, as they usually have no brand name.</comment>


Morgan Stanley Robot Learns by Reading Unreadable MUNI Documents - <AUTHOR> https://www.bloomberg.com/news/articles/2019-09-16/a-robot-learns-lessons-by-reading-unreadable-muni-bond-documents <comment><AUTHOR> This was mentioned in Matt Levine's latest Money Stuff ([https://www.bloomberg.com/opinion/articles/2019-09-20/it- s-h...](https://www.bloomberg.com/opinion/articles/2019-09-20/it-s-hard-to- say-no-to-aramco-s-ipo)). He thinks that "If there were a robot trained to spot subtle changes in bond documents then that would be super useful." But his verdict is that this won't happen soon:

The robots can use the documents to analyze the quality of the issuer, but they can't actually use the documents to analyze the quality of the documents. Reading every word of a boring bond document to figure out if it's going to hose investors is still, strangely, a job only humans can do.</comment>


|| is a Monad - <AUTHOR> http://lambdadev.blogspot.com/2013/09/is-monad.html

<comment><USER2> Ok, how? I thought Monads required closure returns and some sort of future or deferrence?</comment>


On the New York Times' Ethics Policy: Transparency vs Bias - <AUTHOR> http://www.techcrunch.com/2009/09/06/losing-its-religion-the-new-york-times-compromises/

<comment><USER2> Lovely twitter discussion between Calacanis and Pogue on the subject:

<http://twitter.com/Jason/status/3806517603> Seriously, @pogue is so conflicted & is such a apple fan boy it's pathetic. Showtune about iphone was @nytimes low point on par with J.Blair

<http://twitter.com/Pogue/status/3810167984> RT @Jason: Seriously, @pogue is such a apple fan boy it's pathetic. [DP sez: Not really. See <http://bit.ly/1a7i1a> , for example.]

<http://twitter.com/Jason/status/3806537615> The @wsj wouldn't let @pogue in the building w/his conflicts.Geek cruises?! writing manuals 4 Apple/MSFT!? brought this up years ago onTWIT.

<http://twitter.com/Pogue/status/3810117324> RT @Jason: The @wsj wouldn't let @pogue in the building w/his conflicts.Geek cruises? [DP sez: Yep! 2008, Windows cruise. 2010, Mac cruise!]

<http://twitter.com/Pogue/status/3810136180> RT @Jason: The @wsj wouldn't let pogue in bldg w/his conflicts. [DP sez: WSJ is the standard? Walt earning $1M/year from his D conference?!]

<http://twitter.com/Jason/status/3810848949> Seriously @pogue, shouldn't you be working on your romantic opera to Steve Jobs?! Back to the showtunes girlfriend. #mancrushonsteve #sad</comment>


JPEG or PNG or GIF? Which Image Format Should You Choose? - <AUTHOR> https://imagekit.io/blog/jpeg-vs-png-vs-gif-%E2%80%8Awhich-image-format-use/ <comment><USER2> _...PNG24 for high quality, complex logos_

PNGs used to be a really bad choice for logos. PNG has a gamma correction value embedded in the image that's pretty much always wrong. It can be omitted, but then a browser can just make something up. If you want your image colors to match your CSS colors in older browsers, don't use a PNG.

[https://hsivonen.fi/png-gamma/](https://hsivonen.fi/png-gamma/)</comment>


Heroku's down. Anyone else experiencing problems? - <AUTHOR>

<comment><USER2> I've been moving over to EC2 and use S3 and Route 54. I am starting to wonder if Amazon, which I think Heroku also uses, is reliable. It isn't just with the system as a whole too (like the outage they are having now).

I've had 3 servers out of 22, in around 1 month, degrade. I've only had the servers for a few months. That is like 6% degradation a month on servers. Every server has redundancy, but still...

Is EC2 worth the risk?

</comment><comment><USER3> There seems to be a really widespread EC2 outage. My company's site is down and we're in multiple availability zones. Foursquare is down as well.

</comment><comment><USER4> From the AWS service health page at: <http://status.aws.amazon.com/>

7:39 PM PDT We are investigating connectivity issues for EC2 in the US-EAST-1 region.

7:50 PM PDT We can verify connectivity issues between instances in the US- EAST-1 region and the Internet.

</comment><comment><USER5> AWS definitely down, at least for US-east-1a US-east-1d. Several servers unresponsive.

Support tickets submitted, but their dashboard still shows clean.

</comment><comment><USER6> Network Issues

Issue: We are currently investigating network issues with our upstream provider.

Aug 09, 2011 – 2:37 UTC – less than a minute ago

</comment><comment><USER7> <http://www.downforeveryoneorjustme.com/heroku.com>

</comment><comment><USER8> I've got a dozen or so projects hosted on Heroku. They're all up.

Work has at least 100. No Pingdom alarms in my inbox yet.

<comment><AUTHOR> Right, unless of course Pingdom uses AWS ...

</comment></comment><comment><USER9> Hm, running a staging server for our app on Heroku and it seems to be up and running. Maybe just a temporary outage?

</comment><comment><USER10> Amazon AWS/EC2 seems to be having issues.

</comment><comment><AUTHOR> Life 2.0 - Amazon goes down, half of your assets are unavailable. Hello SkyNet!

</comment><comment><USER11> I think its AWS I get the following for reddit as well:

An error occurred while processing your request. Reference #97.8fa41160.1312856795.489b05e0

EDIT: My daughter just alerted me to netflix streaming being down as well. Asking if I can fix Netflix's internet, she is 6.

This started (with reddit) 10 to 15 minutes ago - Netflix, about 3 minutes...

<comment><USER12> Netflix probably failed out later since the video was buffered onto your computer. The failure was probably at about the same time.

</comment></comment><comment><USER13> dotCloud is struggling as well ... Amazon US-EAST-1 out :P

</comment><comment><USER14> heroku is working fine for me now, got 2 projects hosted on it

</comment><comment><USER15> Fucking AWS.

</comment><comment><USER16> Yep its down</comment>