Breaking a large AWS spend into understandable pieces - <AUTHOR> https://segment.com/blog/spotting-a-million-dollars-in-your-aws-account/ <comment><USER2> Sounds about right, this is really a hidden 'extra cost' with AWS. Once you get to a certain size, you really need to spend dedicated engineering resources to build extra tooling like this or do other 'cost engineering' like RI capacity planning - which you totally thought you didn't need to do anymore right?

You can offload some of that to paid services like cloud-health but it still takes engineering resources to manage the costs you find out about. I.e You may want a 'fully immutable' data pipeline (i.e DPL) - with each job running on a fresh instance each time but that usually means getting hit with a full billing hour even if the job takes <1 minute. So you have to use schedulers/containers but then you're working outside the 'instance' paradigm and get hit with the problems segment talks about.

To control costs and provide good UX for end users we eventually started regressing to mainframe-style computing with the ridiculous X1 RIs which was an interesting experiment. These take like a house down-payment but on the plus side users are really pleased when they see 128 cpus in htop.

<comment><USER3> I'm curious what you mean by fully immutable data pipeline or DPL. Is this a data processing methodology or an actual technology?

<comment><USER2> Ah probably sound have said 'idempotent'. Often, you want a fresh and clean resource to pop into existence, process something, persist the result someplace, and then go away. To align with the rest of AWS in terms of billing, security/IAM, networking, etc you kinda need to use the 'ec2 instance' as this resource but this causes problems so usually the customer has to create and manage another level of abstraction (like EMR, kube, mesos, ECS, what have you).

It'd be real nice if the customer didn't have to do this but AWS would rather spend their engineering resources to compete with the G at beagle identification APIs or try to vertically integrate with poor clones of github. (I realize this is _slightly_ unfair )

I know, I know - you're saying 'lambda' is the answer - won't get into that here.

<comment><USER4> I don't think anyone would say Lambda is the answer for anything but very quick jobs, not until they pump the available run time up to an hour.

</comment></comment></comment></comment><comment><USER5> We are about to open source our tool that consumes the billing files from S3 (via SQS notification) and then loads them into redshift auto handling the purging/updating.

Dealing with Amazon billing is absolutely infuriating. We are also on their EDP (Enterprise Discount) program and all of it is done MANUALLY. There is literally NO way i can check hundreds if not thousands of instance hours to ensure there was no error in their processing. Its complete madness. We use a dozen services and EBS, Bandwidth, inter-AZ bandwidth is impossible to audit.

That being said we have Looker sitting on top of Redshift, we make sure each "team" has a tag (infra wont spin up without it) and then we can easily set budgets, watch trends in Looker and track spend by team and by product name. Our finance team loves it.

The data is there, but Amazon REALLY makes you do the work. Their default billing reporting is useless.

Will publish on HN when our tool is open sourced.

<comment><USER6> Please do :-) I just want to see cost by EC2 instances type.

<comment><USER7> You might be interested in netflix's opensource solution ice ( [https://github.com/Netflix/ice](https://github.com/Netflix/ice) )

It's been very helpful to notice and track down extra costs as they come in

<comment><USER8> Netflix ICE has a few quirks but overall it's a pretty useful free tool.

Unfortunately, the project has been largely abandoned and the current version in the Netflix GitHub repository won't work out of the box for many companies due to lack of support for new AWS regions, instances, reservation types, and services, as well as showstopping bugs (such as [https://github.com/Netflix/ice/issues/210](https://github.com/Netflix/ice/issues/210)). In order to effectively use ICE today most users will need to maintain their own patched fork.

I'm currently campaigning to create a community-maintained version of ICE, with committers from multiple organizations, in order to revive the project: [https://github.com/Netflix/ice/issues/240#issuecomment-29960...](https://github.com/Netflix/ice/issues/240#issuecomment-299604856)

<comment><USER9> Heres to hoping the ICE team releases their new tool.

</comment></comment></comment></comment></comment><comment><USER10> I'm constantly surprised by how much work Amazon expects its customers to do themselves. The work that Segment has done here should be a service provided by AWS directly, continuously updating cost data in a Redshift database without any customer work required.

We just migrated our data infrastructure to GCP. One of the big motivators was experiences like this with AWS. We've got near-realtime GCP cost dashboards in BigQuery, and the only meaningful work on our end to make that happen was writing the SQL queries.

<comment><USER11> Agreed. I don't know why Amazon (and Azure) make this so hard. I've done something pretty similar to what Segment did (except it supports normalizing stats from Azure and AWS), and 90% of the work is stuff you don't feel like you should have to be doing.

<comment><USER12> > I don't know why Amazon (and Azure) make this so hard.

The company posting this recently managed to save $1,000,000 annually on their AWS bill.

Having confusing billing makes it harder to spot that you're paying too much.

<comment><USER13> Yes I think the motivation is clear.

It is the same reason Dropbox doesn't include anything in the web interface to find large files.

\--

Edit: tossing in some options to accomplish this; not really related to the current discussion:

Space usage analyser for Dropbox? | [https://webapps.stackexchange.com/questions/47440/space- usag...](https://webapps.stackexchange.com/questions/47440/space-usage- analyser-for-dropbox/56724)

Unclouded - Cloud Manager | [https://play.google.com/store/apps/details?id=com.cgollner.u...](https://play.google.com/store/apps/details?id=com.cgollner.unclouded)

</comment></comment></comment></comment><comment><USER14> I've been working with a client in a similar situation recently, but instead of building a custom solution we went with customizing cloudhealth ([https://www.cloudhealthtech.com](https://www.cloudhealthtech.com)).

It's a complicated tool for sure, but once it was all set up we finally had visibility into a complex multi-account AWS spend, and could start generating automated cost reports for each company business unit and major customer.

I wouldn't recommend going to the effort of building a custom setup... AWS billing is just too complicated and it changes frequently to add even more layers of complexity. As one example, the recent change to add RI size flexibility completely changed the calculations for RI costs and recommendations.

I've also used cloudability and cloudcheckr in the past, but both systems had serious drawbacks. In my opinion cloudhealth is a much more advanced/professional system at this point.

</comment><comment><USER15> This is exactly what our team has been working on[0] for over a year now. Beyond running a simple, 2-3 component service on AWS, it's pretty hard to actually know what's going on with your billing. Tagging and cost allocation reports help, but you do quickly run into a wall with shared resources like segment did.

We don't yet introspect ECS clusters to assign a portion of spend to tasks, but we do breakdowns of services, tags, instances, ELBs etc across 1-N accounts. For S3 we can actually introspect buckets and produce rollups by object metadata as well as heat maps (which objects are being accessed a lot)

[0][https://trackit.io](https://trackit.io)

<comment><USER16> Is that a product your company sells? Or do you plan an open-source version? Seems like there would be a lot of interest in the OS version.. Could be good for marketing ;)

</comment></comment><comment><USER17> I've went through this process with a couple companies running medium-size infra. Basically every month we would import the detailed billing report into a google sheet (SQL queries in your spreadsheet are awesome btw), do some analysis on the heavy hitting services, and come up with a couple solutions to address those. Rinse and repeat. A few big hitters I remember off-hand:

1\. Obviously shut down and remove anything you're not using -- instances, ebs volumes, etc.

2\. ELB - paying per-request for many small requests; and you pay double on the bandwidth in some cases. Switched to terminating ssl using nginx on the frontends and using dns load balancing to save a pretty good chunk of money.

3\. vpc endpoints for s3 - can be significant savings if you're doing a lot of I/O on s3 from private instances in a vpc over a nat gateway.

4\. new instance types -- the newer instance types typically have more compute/ram/disk for less money, migrate to them.

5\. Consolidate services onto a smaller number of VMs where it makes sense

Once you learn some of these tricks, you just sorta do them that way from the start on new products. Best practices in terms of spend on these platforms.

<comment><USER16> Solid tips. Could you elaborate a little on 3? It's not something I've heard of before.

<comment><USER17> Docs are pretty decent on this: [http://docs.aws.amazon.com/AmazonVPC/latest/UserGuide/vpc- en...](http://docs.aws.amazon.com/AmazonVPC/latest/UserGuide/vpc- endpoints.html)

</comment></comment></comment><comment><USER18> Great article. Here at Expedia we are building something very similar for our AWS spend as we are migrating. Since our spend is multi-million per month (and we have barely started migrating), it's even more difficult. Hopefully, we will have a blog post in the coming months as well detailing it.

</comment><comment><USER19> I use SaaS CloudHealth. We tag all resources once and never change tags. Than we have late binding all those tags into useful groups (called perspective in CloudHealth).

We tried initially building it on our own, but the engineering cost was way too high. Especially given all quirks and changes in AWS.

</comment><comment><USER20> Honest question: when you get anywhere near six figure monthly bills, isn't it the time to migrate to your own hardware?

Sure, there are _several_ pros and cons to weigh, but if the application isn't locked in, a migration to metal could make sense. Anyone went through this?

<comment><USER21> I would imagine that unless you have staff sitting on their hands, that level of hardware commitment would require at least one extra employee, generally at a cost of 6 figures a year.

<comment><USER22> Nope, these days servers pretty much run themselves. One just needs to make sure hardware is not failing, and that is pretty much it. Really. Speaking from experience.

<comment><USER21> Sure, though we're talking about a 6 figure/mo cloud spend. That's dozens or hundreds of servers. (+network config etc) I run our tech stack, and I can stand up instances pretty easily, but I had to rack and stack, manage power, bring in leased lines, I'd be well outside of my skill set.

</comment></comment></comment></comment><comment><USER23> Our spend is anything like Segment, but we've been using stax.io for tracking our AWS spend. Stax doesn't currently support all AWS services, but they're got the key ones. There are some nice auditing tools in stax for ensuring service config meets corporate standards.

It picks up on your AWS tags and then lets you allocate that to projects/departments/cost centres. Reporting on untagged service is available OOTB.

The business model is a 30 day trial and then you're charged a percentage of your AWS monthly spend. It worked out cheaper than building something ourselves.

</comment><comment><USER24> Analysing AWS billing information is a bit of a 'dark art' in my experience. I wish they could improve some of their reporting tools to make it easier to reconcile assets.

For example, we switched to purchasing reserved instances up front to try and reduce our monthly bills (albeit at a higher up front cost). But trying to match up Reserved instances with EC2 or Elastic Beanstalk instances that are actually running is a real headache.

Several times, we've been caught with useless reserved instances sitting there not being utilised - because we had shut down a project or similar. Had we been able to see "Oh, we have 10 t1.micro reserved instances, but only 7 are being utilised by active EC2 instances at the moment" then we could easily know that we could provision another 3 t1.micro instances at no extra cost to experiment with something or for a client project. Or we could convert those t1.micro instances to another region or instance type to meet demand elsewhere.

It would also be handy on their billing reports if they delineated or showed the breakdown of the total usage hours against 'on demand' and 'reserved' instances. I know they _sort of_ do that now, but I think it could be better laid out so we can see at a glance whether we are getting best use from our reserved instances.

<comment><USER25> The Cost Explorer now has Reserved Instance utilization and coverage reports which are quite useful.

<comment><USER24> Thank you!! That RI Utilisation report is perfect! I have never delved into the Cost Explorer reports before, but this is _exactly_ what we are after, and I appreciate you taking time to point this out.

</comment></comment></comment><comment><USER26> I started project on github for loading detailed billing reports into elasticsearch so you can analyze the information with kibana: [https://github.com/ProTip/aws-elk-billing](https://github.com/ProTip/aws-elk- billing) . I don't really maintain it anymore, but a group of people have contributed quite a bit more to it over the past couple years. Some here may find it useful.

</comment><comment><USER27> Would using something like [http://cloudcheckr.com/](http://cloudcheckr.com/) or [https://www.cloudability.com/](https://www.cloudability.com/) have worked, too?

<comment><USER28> Aside from several other companies offering AWS cost analysis as a service, there is also Netflix ice ([https://github.com/Netflix/ice](https://github.com/Netflix/ice)) if one wants an open-source, self-hosted solution.

AWS also published a quick guide how to get the billing data into Redshift and use Quicksight to analyze it: [https://aws.amazon.com/de/blogs/aws/new-upload- aws-cost-usag...](https://aws.amazon.com/de/blogs/aws/new-upload-aws-cost- usage-reports-to-redshift-and-quicksight/)

</comment></comment><comment><USER29> For comparison, the invoice provided by Azure is inherently itemized. "X hours of Compute at Y rate", "X units of storage on PREMIUM/STANDARD storage type", etc.

Edit: Sample invoice: [https://www.microsoft.com/en- us/download/details.aspx?id=388...](https://www.microsoft.com/en- us/download/details.aspx?id=38805)

<comment><USER11> the azure billing report is a disaster; they seem to be slowly fixing it though. The line items are tricky and usually not super human friendly, multiple billable resources roll up to single items with weird quantities in some instances, if you have mixed ARM and ASM resources only the ARM stuff in your usage report will have data for tags (cause there's no concept of inheritance from parent resource group), ARM and ASM resources have different formats for some common fields, and tons more I've repressed from memory.

If you have an EA agreement, half (or more?) of the billing report interfaces don't work. If you have to use the EA portal due to an EA agreement....lets just say within the past year they have been through some rough periods of random undocumented format changes, magically disappearing billing reports for a few hours at a time, random intermixed windows and linux style line endings in the same file, periods where they are DAYS behind your actual usage, etc...

Source: I wrote a infrastructure inventory and billing/usage aggregation system that normalizes data from Azure, AWS, and vCenter to help our company easily track spending by service, tags, etc... across all of platforms where we have a presence.

</comment></comment><comment><USER30> Just use more than one AWS account!!!! Use Roles to manage any cross-account dependencies.

<comment><USER31> Does not help the author's particular use case with ECS.

</comment></comment><comment><USER32> Shameless plug, but it was the lack of clarity that we had with our AWS bills that prompted us to build [https://cloudops.ai](https://cloudops.ai)

We've got a prepaid service that allows you to always ensure your AWS bill never goes above certain amount as well as flat discounts on your monthly spend

</comment><comment><USER33> The solution is one account per team [https://stups.io/why](https://stups.io/why)

Installing ICE to see costs in detail [https://github.com/Netflix/ice](https://github.com/Netflix/ice)

</comment><comment><USER34> To make sure that resources are compliant I would suggest using AWS Config Rules as they allow to specify for example that tags need to be applied. Validation of resources is done in a lambda function which should in theory allow to terminate the resources if they are not compliant.

</comment><comment><USER35> If you are getting to the point of a large AWS spend wouldn't that presuppose that you might want to start moving on to on premesis physical servers ?

</comment><comment><USER36> As someone who's a noob to AWS and is getting ready to launch a product on it, this is absolutely terrifying. As in what to expect in terms of billing.

<comment><USER37> Extremely unnecessary until your bill gets large, and/or you have many different teams using AWS

</comment></comment><comment><USER38> Anyone else see the irony of using aws services to understand your aws bill? It makes complete sense, just funny.

</comment><comment><USER39> Very nice and detailed.

</comment><comment><USER40> When did "spend" become a noun?

<comment><USER41> In the 1930s:

[https://books.google.com/ngrams/graph?content=average%20spen...](https://books.google.com/ngrams/graph?content=average%20spend%2Caverage%20spending&year_start=1900&year_end=2008&corpus=15&smoothing=3&share=&direct_url=t1%3B%2Caverage%20spend%3B%2Cc0%3B.t1%3B%2Caverage%20spending%3B%2Cc0)

Via:

[https://english.stackexchange.com/questions/336478/is-it- rea...](https://english.stackexchange.com/questions/336478/is-it-really-ok-to- use-spend-as-a-noun)

EDIT: lies, first use is 1688:

[http://www.grammarphobia.com/blog/2012/04/spend.html](http://www.grammarphobia.com/blog/2012/04/spend.html)</comment></comment>


Vertebra: Cloud computing with XMPP (EzraZ's latest project) - <AUTHOR> http://brainspl.at/articles/2008/06/02/introducing-vertebra

<comment> Xlp-Thlplylp I had vague thoughts of using XMPP for grid computing--but I suppose this is obvious.</comment>


MIT Technology Review: 50 Smartest Companies - <AUTHOR> http://www2.technologyreview.com/tr50/2014/

<comment><USER2> I'm surprised Apple isn't on that list.</comment>


NTRU Prime [pdf] - <AUTHOR> https://eprint.iacr.org/2016/461.pdf <comment><USER2> Wow, what a fantastic paper! Very well written, easy to read and understand. Makes me want to run out and implement it!

<comment><USER3> NTRU itself is patented.[1] Given this is just a tweak of NTRU, you're getting yourself into a legal mess very fast if you run out and implement it.

[1] [http://grouper.ieee.org/groups/802/15/pub/Patent_Letters/15....](http://grouper.ieee.org/groups/802/15/pub/Patent_Letters/15.3/ntru%2015.3.pdf)

<comment><USER2> I already have implemented a naive NTRU in python. I'm not worried about it.

Besides, I mainly meant as a fun side project, not an open source thing for distribution. I'm not a bad programmer but I have no experience with secure coding.</comment></comment></comment>


Ask HN: How do you manage bookmarks? - <AUTHOR> I've a habit of hitting {Ctrl|Cmd}-D every time I see something interesting, with the intention of reading it later.  Consequently, I've accumulated hundreds of bookmarks over the years across different browsers on different machines.<p>I imagine this must be a common problem, and a quick search reveals a plethora of tools out there for managing libraries of links.  Does anyone have recommendations?  Ideally it'd be either cross-platform software or SaaS without locking my collection into something proprietary. <comment><USER2> Self plug but relevant. This is why I made curabase.com

It is a SaaS with a chrome plugin.

Also it is mvp with lots of rough edges, but it more than solves my use case. I spend time to improve it when I can, with an eye to monetize in the future.

You are welcome to try and send feedback. I do read and respond to it, and I even take feature requests like bookmark exports (under development).

</comment><comment><USER3> I find pocket super convenient. It formats almost all web articles into phone friendly format to read on the go. [https://getpocket.com/](https://getpocket.com/)

<comment><USER4> Came here to recommend this. It really is helpful!

</comment></comment><comment><USER5> I have been using xmarks for a few years and I find it helpful ([https://xmarks.com/](https://xmarks.com/))</comment>


Ask HN: How do you secure your Windows PC? - <AUTHOR> Like the similar thread about Mac[1], how do you secure your Windows PC?<p>[1]: https://news.ycombinator.com/item?id=19681270 <comment><USER3> Leave the Defender/Firewall untouched, don't install any additional "security" software and increase the UAC level to the highest one [0] that even prompts for changing important Windows settings.

Obtain all 3rd party tools from the Microsoft Store or scoop [1] or chocolatey [2] (in that order) and not by downloading `foo.msi` from the first search result. This way you can update all your apps in a single step and don't have to rely on built-in updaters.

[0] [https://docs.microsoft.com/en- us/windows/security/identity-p...](https://docs.microsoft.com/en- us/windows/security/identity-protection/user-account-control/how-user-account- control-works)

[1] [https://scoop.sh/](https://scoop.sh/) (enable its additional repositories for GUI tools or all possible JDK flavors: [https://github.com/lukesampson/scoop/wiki/Buckets](https://github.com/lukesampson/scoop/wiki/Buckets))

[2] [https://chocolatey.org/](https://chocolatey.org/)

<comment><USER4> Windows has some additional Local Group Policy rules that are pretty killer in newer versions

      1. Attack Surface Reduction Rules - Blocks some commonly seen dodgy techniques
      2. Credential Guard - Moves LSASS to an isolated VM (break's VMWare etc though, see 5 if this is a dealbreaker)
      3. Application Guard (Enterprise Mode) - Transparently virtualises and isolates Microsoft Edge (same caveat as above)
      4. Microsoft Defender MAPS and Block at First Site
      5. Run LSASS as a protected process
      6. Process creation auditing with commandline
      7. Powershell script block logging

Most of this is backed into an windows image I run, but maybe I'm a bit paranoid ;)

[1] [https://docs.microsoft.com/en-us/windows/security/threat- pro...](https://docs.microsoft.com/en-us/windows/security/threat- protection/windows-defender-exploit-guard/attack-surface-reduction-exploit- guard)

[2] [https://docs.microsoft.com/en- us/windows/security/identity-p...](https://docs.microsoft.com/en- us/windows/security/identity-protection/credential-guard/credential-guard)

[3] [https://docs.microsoft.com/en-us/windows/security/threat- pro...](https://docs.microsoft.com/en-us/windows/security/threat- protection/windows-defender-application-guard/wd-app-guard-overview)

[4] [https://docs.microsoft.com/en-us/windows/security/threat- pro...](https://docs.microsoft.com/en-us/windows/security/threat- protection/windows-defender-antivirus/enable-cloud-protection-windows- defender-antivirus)

[5] [https://docs.microsoft.com/en-us/windows- server/security/cre...](https://docs.microsoft.com/en-us/windows- server/security/credentials-protection-and-management/configuring-additional- lsa-protection#BKMK_HowToConfigure)

[6] [https://docs.microsoft.com/en-us/windows- server/identity/ad-...](https://docs.microsoft.com/en-us/windows- server/identity/ad-ds/manage/component-updates/command-line-process-auditing)

[7] [https://www.fireeye.com/blog/threat- research/2016/02/greater...](https://www.fireeye.com/blog/threat- research/2016/02/greater_visibilityt.html)

<comment><USER5> Curious, do you run any other OS?

<comment><USER4> MacOS for my primary laptop, Windows for my training/travel laptop, *nix in various other places

</comment></comment></comment></comment><comment><USER6> Install updates when asked. Delaying updates is perhaps the worst thing for security.

Scan files you download, submit them to virustotal if unsure.

Sync data (e.g. [0] or whatever drive/dropbox/nextcloud) and keep snapshots [1]. Only way to ensure you don't lose anything

Lying DNS server can also help for privacy and security, as well as a sinkhole for known-bad IPs [2,3,4] (should be deployed network-wide though) (I could use some help to test if my scripts run on WSL, as they're mostly POSIX).

[0] [https://syncthing.net](https://syncthing.net)

[1] [https://try.popho.be/securing-home.html](https://try.popho.be/securing- home.html)

[2] [https://pi-hole.net](https://pi-hole.net)

[3] [https://try.popho.be/byeads.html](https://try.popho.be/byeads.html)

[4] [https://gitlab.com/moviuro/moviuro.bin/blob/master/lie-to- me](https://gitlab.com/moviuro/moviuro.bin/blob/master/lie-to-me)

</comment><comment><USER7> I've been using Windows boxes as my primary work / personal machine for over 20 years and I've only gotten a handful of viruses or malware and in the times I got them, I was going to very questionable sites back in the day.

I disable Windows defender and all built in firewalls (my router has a firewall). I also don't run any anti-virus software. This is something I've done from the beginning.

But I do run uBlock Origin in any browser I use.

I also make sure to Win key + L (lock) my machine when I leave it unattended.

From time to time I check the startup tab in task manager to make sure nothing looks suspicious and occasionally look at things like CPU / memory usage to look for anything out of place.

So far it's been working out great. My current computer runs just as fast as it did 5 years ago when I built it and I haven't had to format a machine due to a virus in over a decade.

I find most things like Windows defender and A / V tools to be more destructive than most malicious software. Often times these tools will crush I/O performance and make things run slower 100% of the time in the off chance you get a virus. I'd rather have things run super fast all of the time and take my chances. If I get even a hint of my machine being compromised I would format anyways.

<comment><USER8> " I've only gotten a handful of viruses or malware "

This is a variation of the bad toupee fallacy. You won't notice viruses and malware, almost by definition.

<comment><USER9> If a virus or malware has no noticeable effect - does nothing that affects me - is it still a virus or malware?

<comment><USER10> So quietly exfiltrating your personal data is OK then?

<comment><USER9> If it has no noticeable effect - my life is completely identical - it's hard for me to see it as something negative. If something has absolutely zero effect on my life whatsoever - not even a single advert on my screen - <USER2> it a virus or malware seems unwarranted.

I suppose if my personal data was somehow used to damage someone else, that would warrant calling it malware.

<comment><USER11> Your stolen personal data could be used to empty your bank account or to commit a crime in your name which could cause permanent damage to your reputation, even if you were exonerated.

<comment><USER9> That sounds like something I would notice, and is thus outside the scope of this discussion.

</comment></comment></comment></comment></comment></comment></comment><comment><USER12> For the most part default Windows 10 is fairly hard to break into if updated. Leave everything on and don't open new holes in it and its probably fine. I went to a demonstration on hacking into machines with Kali Linux and Metasploit and my Surface was on the Wi-Fi. I told him to go right ahead and let me know what he could do.

He admitted defeat quickly. ;)

For the most part, problems with computers are ones we create ourselves by shutting off security protections or adding services that open up holes in the security of a system. Sometimes its necessary of course, but you need to understand the risks you take when you do and mitigate them.

</comment><comment><USER13> \- Don't disable Secure Boot, Windows Defender and Windows Firewall

\- If you _really_ think updates are annoying shift the monthly updates by one month BUT __always __confirm the security updates

\- If you have a PRO license give a try to VBS [0] and Controlled Folder access [1] (spoiler: this will be a little annoying at the beginning but will became almost perfect with a well configured whitelist)

\- Also from the next (major) patch you should use Windows Sandbox [2] to run untrusted software(still a PRO feature)

[0] [https://www.microsoft.com/security/blog/2018/06/05/virtualiz...](https://www.microsoft.com/security/blog/2018/06/05/virtualization- based-security-vbs-memory-enclaves-data-protection-through-isolation/)

[1] [https://docs.microsoft.com/en-us/windows/security/threat- pro...](https://docs.microsoft.com/en-us/windows/security/threat- protection/windows-defender-exploit-guard/enable-controlled-folders-exploit- guard)

[2] [https://techcommunity.microsoft.com/t5/Windows-Kernel- Intern...](https://techcommunity.microsoft.com/t5/Windows-Kernel- Internals/Windows-Sandbox/ba-p/301849)

</comment><comment><USER14> Leave Windows Defender/Firewall on as default and stay away from dodgy sites. Simple as that really.

<comment><USER15> Yep, same. Sometimes I'll spin up a VM if I'm visiting a site that I'm suspect of or installing something random (even if it's open source because I didn't build these binaries and I haven't audited the code), but as I used to say when I was doing desktop support "you don't get malware by visiting CNN".

<comment><USER16> > "you don't get malware by visiting CNN"

I have to barge in here and mention that doing totally reasonable things can result in getting malware installed on your systems.

The most glaring case was the early Windows XP era, when it was enough to plug in the Ethernet cable during installation to get malware. I had to download the service pack and install it offline before plugging in the network.

Today, I'd point out that ad networks' code is barely scrutinized, and they can hit unpatched vulnerabilities all right (sorry for not providing examples).

<comment><USER5> Be fair to yourself, they're intentionally not easy to track names of, etc.

That's why it's so important to discuss & combat conceptually, not specifically.

</comment></comment></comment></comment><comment><USER17> What exactly is meant here by secure? Windows in its default state contains spyware that you cannot disable or remove, or at the very least you cannot expect laymen to do. It is essentially covered in their terms of service and privacy statement. Then there is Intel ME, AMD PSP, etc.

Short answer is that you simply do not secure your Windows PC. You may eliminate some of the spyware, but it does not make it secure. Can you make anything fully secure? Perhaps only secure enough, but then you need to specify what is meant by enough.

In any case, for Windows 10: [https://github.com/Nummer/Destroy- Windows-10-Spying](https://github.com/Nummer/Destroy-Windows-10-Spying)

Note: it may break your system as some services are deeply embedded into it, and may require them to remain intact to function properly.

<comment><USER18> I'd be careful running any tools to clean up Windows 10. While I haven't used this one before, I've used others that do basically the same thing. The telemetry features are so baked in to Windows 10 that running these tools can break Windows if you're not careful. And since every major update of Windows 10 changes so much with no regard to user preferences, even if your clean-up works today, it might break in the future.

I try to avoid Windows 10 whenever possible.

<comment><USER17> > running these tools can break Windows if you're not careful

I think this definitely needs to be taken into consideration when running these sort of tools, I agree.

> I try to avoid Windows 10 whenever possible.

Good advice. I second it.

</comment></comment></comment><comment><USER19> I keep the silly Windows in a virtual machine or a few.

Also standard hygiene applies such as opening files and attaching unknown media in a burner VM, not mixing banking, documents and entertainment, disabling autoplay and media icons if the previous options are inapplicable.

Staying away from dodgy sites helps too.

I generally do not have to keep the firewall or defender active as the routing (or lack thereof) is more effective.

Also skip the automatic that pins everyone, such as remote device detection.

</comment><comment><USER20> Being facetious but I gave up on Windows on my computers just over a decade ago due to this very reason. I was sick up constantly needing to upgrade every 2-4 years and having serious security issues. I went full Linux and I don't consider myself a free software zealot.

</comment><comment><USER21> I too believe that for most people Windows 10 out-of-the-box is more secure than most Linux distros. Sure you can lock-down an Arch build but it's difficult (even for the technically inclined), time-consuming and needs constant monitoring and sometimes manual updating/reconfiguration.

For Windows I do all of the things shared below (plus a few other tweaks) which are good enough a medium security risk level. The combination of all of them represent a significant barrier to non-state actors;

-Upgrade to Windows Pro

-Change computer name to something nondescript

-Use a local login account (no email address)

-Create a separate Admin and Standard account

-Install favourite Anti-Virus and Firewall

-Enable Exploit Protection (CFG, DEP, Mandatory ASLR, Bottom-up ASLR, High-entropy ASLR, SEHOP and Heap Integrity)

-Enable Windows Defender Application Guard and Core isolation memory integrity

-Install preferred VPN

-Install trusted password manager

-Crank UAC to the highest setting

-Use an encrypted Virtual Drive for files

-Disable AutoPlay for all devices

-Activate all privacy toggles in Windows Settings

-Reduce telemetry to the minimum allowed

-Ensure cloud clipboard is disabled (!)

-Defer feature updates but allow quality (security) updates

-Receive updates directly from Microsoft and not third-parties

-Run PowerShell script to remove any pre-installed, non-Microsoft, junkware

-Enable BitLocker with triple factor authentication (TPM + Enhanced PIN + USB)

-Activate BitLocker 256-bit encryption in XTS-AES mode

-Disable BitLocker recovery key

-Require Secure Boot and Additional Authentication at -Startup

-Enable device lockout after X number of invalid login attempts

-Disable NTLM and SMB

-Disable debugging logs

-Disable Sleep Mode

-Disable Hide extensions for known file types

-Enable Show hidden files, folders and drives

-Harden web browser by disabling all unnecessary features

-Install content blockers into web browser

<comment><USER22> > I too believe that for most people Windows 10 out-of-the-box is more secure > than most Linux distros.

At the risk of being off-topic: Even if that were true (which I doubt but it has been better-debated elsewhere) ... 1) that list would be much-changing over time, and 2) it seems like Debian (or Devuan) stays on top of things reasonably well, especially if you add a firewall (I've liked the "arno- iptables-firewall" one though it doesn't seem to auto-start any more except on Devuan).

Also, the length and changeability of that list illustrate why I use OpenBSD: it is more secure by default (as a key goal), and then when you make changes to the default config you can consider the security implications of each change. They put a lot of attention into auditing and making good design choices.

Having said all that, many people simply won't like the feel of bsd or linux, and prefer a more commercial experience (for lack of a better term). (Edit: more of my thoughts on that, hopefully lightweight and skimmable, at [http://lukecall.net/e-9223372036854587380.html](http://lukecall.net/e-9223372036854587380.html) )

But thanks for posting that list, as it could help someone.

Edit: I also posted here some things I do on any system, for safer browsing: [https://yro.slashdot.org/comments.pl?sid=13803908&cid=584646...](https://yro.slashdot.org/comments.pl?sid=13803908&cid=58464622) (part of: [https://yro.slashdot.org/story/19/04/19/2345227/incognito- mo...](https://yro.slashdot.org/story/19/04/19/2345227/incognito-mode-isnt- really-private-try-browser-compartmentalization) ).

</comment></comment><comment><USER23> I found this[1] a while back and have followed it on my Windows PC. I don't go so far as to install GlassWire, but the other suggestions it makes are reasonable for me.

On the anecdotal side - keeping software up to date and being highly suspicious of all software seems to have kept me safe from issues for over a decade.

[1] [https://decentsecurity.com/#/securing-your- computer/](https://decentsecurity.com/#/securing-your-computer/)

</comment><comment><USER24> I mostly stick to open source or well known commercial software, run Windows Defender, and I run uBlock Origin. I'm of the opinion the biggest risk of malware comes from rogue ads.

I've only been hit with malware twice in the 25 years I've been using Windows. Once was me running a sketchy exe from a torrent site (that's on me) and once when I wasn't running an ad blocker.

</comment><comment><USER25> Simple. I assume that my PC is compromised and do not do any financial transactions on it. Still run dubious software in a VM but have a separate cheap netbook for banking/online purchases.

</comment><comment><USER26> Full-disk encryption. [https://www.howtogeek.com/234826/how-to-enable-full- disk-enc...](https://www.howtogeek.com/234826/how-to-enable-full-disk- encryption-on-windows-10/)

Nothing more than speculation but...I suspect if you aren't using an open source OS, it's possible the NSA has a backdoor into the machine. The lack of open source is partly why the EternalBlue exploit existed across decades of windows releases.

</comment><comment><USER27> I use this to monitor network activity [https://www.glasswire.com/](https://www.glasswire.com/)

</comment><comment><USER28> In addition to leaving Defender alone, I also recommend people install the free version of MalwareBytes and turn on Bitlocker.

<comment><USER29> I'd recommend the paid version of Malware Bytes

<comment><USER30> I was really disappointed with MalwareBytes. It seemed great, so I paid for it, and every other week it would de-activate itself without warning. I would only notice this when explicitly checking the control panel, to find it had been turned off, and I needed to re-enter the license key.

Maybe they've improved it? I should give it another shot!

</comment></comment></comment><comment><USER31> Most things already mentioned in the comments here, plus:

\- Disabling Windows Script Host

\- Enabling 'Memory integrity' feature under Core Isolation. This however uses Hyper-V so it is enabled on my laptop but not on my workstation as Hyper-V only supports enhanced sessions with Ubuntu.

</comment><comment><USER32> Keep Windows Defender + Firewall on.

Don't visit sketchy sites.

Firefox + uMatrix to block all JS by default, and judiciously enable domains until things work to my satisfaction, or go elsewhere. Maybe open it in Chrome + uBlockOrigin if I think the hipsters who run the website don't know how to make a website.

Pi-hole.

Don't click ads. (hardly any remain by this point)

Stay behind a router.

Don't run/install every little piece of software that you come across.

Install updates.

Look for and verify hashes of downloads.[0]

Examine CPU/RAM usage, startup processes, and services regularly.

Use a password manager. (KeePassXC)

[0] [http://implbits.com/products/hashtab/](http://implbits.com/products/hashtab/)

</comment><comment><USER33> This depends entirely on what you are protecting against. Being hacked (someone stealing data for example) or data loss, such as getting a ransom Trojan? I worry only about the latter. I don't have secrets on my machine that I would be upset if someone got hold of. That makes protection easier.

Use a good backup software with write only snapshots (not mirrors).

Apply updates quickly. Don't disable any built in protections and don't add any third party ones.

</comment><comment><USER34> Have a separate admin account. Use a Pi Hole.

</comment><comment><USER35> \- Update Windows and associated programs always

\- Leave Windows Defender alone (no hassle anymore)

\- Set UAC to lowest level (Too annoying to leave on high)

\- Use Firefox and always update

\- Use Umatrix and Ublock Origin

\- Use Bitlocker and Truecrypt/Veracrypt for especially sensitive stuff

\- Use Keepass for passwords \- Never run any file you don't know what is outside of a VM

<comment><USER36> \- Set UAC to lowest level (Too annoying to leave on high)

I think it's just better to leave it in default position.

\- Use Umatrix and Ublock Origin

Firefox already has tracking blocking and I've done tests to check: Firefox is way faster and stable without any extensions. Ublock Origin removes ad page blocks, but actually adds more resources to the program + slows page loads. Just try to turn it off and recheck.

</comment></comment><comment><USER37> I use ShutUp10 to apply a lot of privacy and security settings to at least get a handle on things.

Available at [https://www.oo-software.com/en/shutup10](https://www.oo- software.com/en/shutup10) or via Scoop or Chocolatey.

</comment><comment><USER38> 1) windows defender

2) ublock origin + privacy badger

3) using brain before i click on stuff

4) keepass for logins and veracrypt for private stuff

<comment><USER39> I do the same, plus a (heavily) modified hosts file and simplewall ([https://github.com/henrypp/simplewall](https://github.com/henrypp/simplewall)).

</comment></comment><comment><USER40> Which threat are we defending against, here?

</comment><comment><USER41> Not sure about efficacy, but using a DNS sink like PiHole or pfblockerng gives me some piece of mind.

</comment><comment><USER42> Secure? As long as nobody knows my password is h __ __*2 I 'm good.

</comment><comment><USER43> My educated guess is that Windows will never be secure, because as I see it it is an un-designed un-principled heap of low-quality software. Therefore I keep Windows enclosed and strictly locked down in a virtual machine. If I need to do anything I feel is dubious I branch to a new timeline in a snapshot and roll back when I'm done.

This also eliminates the hazard of Windows being unavailable for work due to the slow and uncontrollable update process; Just hop back to the last working snapshot. Update later.

—

Edit: To downvoters: Please note that this is a factual and sincere answer to the question "how do you secure your Windows PC?". This is literally how I do that.

In the comment, my opinion is clearly framed as my opinion, and the rest is a description of a technical workflow, its premise, and its implications. Therefore this is a better candidate for discussion than for downvoting if you disagree. In my opinion. I'm not attached to the fate of my comment, but I prefer the society we are building here to work that way. And that is, I believe, the premise.

<comment><USER44> I think this is an outdated view of things. AFAIK, Windows is commonly regarded as more secure than Linux out of the box.

Having used Windows for over 20 years and never gotten bit by any malware, I think the quality of Windows security has always been a bit overrated. Being the biggest target for malware has its advantages I guess.

<comment><USER45> I'd love to see a source for windows being more secure? An out-of-the box install of windows is generally years out of date, Linux installs are usually only 6 months old.

<comment><USER44> I said it's commonly regarded as being more secure. The source would be the comments on just about every thread anywhere it comes up.

Looking at all the comments here - most people are saying that they don't do very much to secure Windows and that certainly mirrors my own experience.

<comment><USER43> I personally haven't got the feeling that Windows is now considered more secure than Linux. I see a consensus that Windows is more secure than it was, but my perspective is that the design foundations are the same as before, and that they are hard to reason about and that the interactions are complex, so I personally will not be placing faith in Windows being as secure, as securable, and as _known_ to be securable as an OS could be.</comment></comment></comment></comment></comment>


Principles and priorities - <AUTHOR> https://adactio.com/journal/16811 <comment><USER2> The thing that confuses me about "modern", JavaScript-everything web development is that I just don't see the developer efficiency, at all.

I've collaborated with many different teams that use the modern JavaScript stack. It seems to me that it takes multiples of time to deliver features compared to the old forms-and-HTML-with-a-tiny-bit-of-JavaScript-enhancement methodology.

Are we really optimizing for developer efficiency here? We've given JavaScript-everything a decade to prove that it's a better, more productive way of building higher quality websites and applications. I don't think it has.

<comment><USER3> Your experience does not match mine.

I worked through the pre-Javascript world, the jquery world, the angular1 world, and now the react world (not to mention a decade of native GUI development before that). I am _vastly_ more productive with react and my UIs are much easier to use.

Every time I submit some 1990s or 2000s era form that gives me an error because I typed some field wrong, but also wipes out half the other fields I spent 15 minutes typing... and of course, hitting the back button wipes out the remaining fields... I want to reach into the screen and throttle someone.

No thanks.

<comment><USER4> None of the problems listed is inherent in HTML + touch of JS. Especially since most browsers these days will remember what you typed anyway unless specifically instructed otherwise. Complaining about the back button behavior in SPA world seems...misplaced? If anything, its behavior is even worse.

<comment><USER5> I think this is referring to the server round-trip -- form submit, server-side validation, "you have to specify a color for your widget" and everything on the field is blanked out because the server didn't fill in the default values into the form based on your previous submission.

Back button stuff; I mean, it's not trivial to support it correctly now, and it might just be an increased focus on usability and testing of this sort of thing, but hitting back was always dicey -- half the time you'd get some error about re-posting form data when you hit back, and if you said no, bad things happened, and if you said yes, worse things happened.

<comment><USER6> > it's not trivial to support it correctly

Back button works every time if you create pages, and navigate between them using links.

There are some garbage web forms out there, but if we're comparing building SPA in 2020 or webforms in 2020, webforms is unlikely to screw up your back button.

</comment></comment></comment></comment></comment><comment><USER7> Developer efficiency often gets prioritized over user experience _because that 's the only way the software would even get to exist_.

I take my own software that I write solely for personal use as examples. In those cases, I play both roles of the developer and the end user. Most of my utilities are _console command line_ utilities instead of full GUI. As a result, I have a bunch of command-line utilities that are very cumbersome to use. That's because I prioritized the dev experience over the UX.

Console apps are 10 times faster to code. I can bang out printf() or Console.WriteLine() statements 10x faster than placing GUI textboxes on a form. Yes, GUI wizards and templates accelerate the layouts but it's still not as fast as console apps for quick & dirty utilities. As an end user, I'd prefer easier-to-use GUI apps but I don't have the extra time to code them. I complained to the developer (that's me) to make a GUI app with better UX instead but the dev ignored me.

With my limited time, I'd rather have 20 utilities with bad UX that _exist_ rather than just 5 apps with good UX at the expense of not having the other 15 at all. It's an unavoidable tradeoff of finite time.

Likewise, I as an end user don't like Electron apps but I know that lecturing developers on using something lighter weight like C++ & Qt or C#/Winforms means they _wouldn 't bother writing the app at all_. It was the ease (and/or familiarity) of Javascript that allowed them to write the app in the first place.

[REVISED above text to clear up the misunderstanding in the reply.]

<comment><USER8> Is it possible you are agreeing with the author?

> Most of my utilities are console command line utilities instead of full GUI > and they are very cumbersome to use. That's because I prioritized the dev > experience over the UX.

As the user you prefer command line utilities, and so I interpret your building command line utilities as prioritizing the user's experience.

On the other hand, if you needed a program that could exist very efficiently as a command line utility but, desiring to learn how to use some new GUI toolkit you built a GUI instead, I might interpret your action as prioritizing the developer experience (in which you are focused on the details of the implementation) over the user experience (in which you are focused on the results).

<comment><USER9> You misunderstood that line, they're saying the command line utilities are cumbersome

<comment><USER10> > the command line utilities are cumbersome

Except this is obviously untrue? I can't pipe a _window_ through grep or sed.

<comment><USER11> When you need to. Other times when you need to pass lots of params and havent decided which ones are staying so scripts are a bit extra time which is not there and when you need to explore in a different way the domain area, GUIs or TUIs may be more suitable. I love what one can do out of simple tools like that and how nicely they compose but if the experience is draining, my brain is going to notice and start avoiding it next time

</comment></comment></comment></comment></comment><comment><USER12> Developer efficiency is actually harmed by valuing it so much. Developers get into pointless ideological debates about purity and that hurts their efficiency. When good developers have to deliver features in a short time frame they stop debating that stuff and make decisions. They then learn from these decisions the hard way and no one is having an ideological debate any more.

<comment><USER13> And if they keep delivering features in short time frames they will never get a chance to debate quality or elegance in their work.

And eventually you will start hearing them complain about an unmaintainable mess and turnover will probably increase.

/s

I think you do have to care, on some level, about maintaining code quality and standards. I've worked in feature-factories and it's not a panacea. _It doesn 't crash_ and _it goes reasonably fast_ are both features after all that seem to be related to the quality of a code base and the expertise of the team behind it.

<comment><USER14> One approach is a schedule for when everyone works on debt vs features vs testing.

For instance: first week of the iteration is for paying off debt. Second and third are feature work. Fourth is testing (note: not unit testing, real testing. As in everybody chips in to actually play around with the features their colleagues added and provide feedback; also verify that all the bugs that were fixed this iteration didn't creep back in, or get fixed with a "works on my machine" patch)

</comment></comment></comment><comment><USER15> 1\. Most developers don't work for the end-user. They work for who is paying their salaries, which is often someone is mostly interested in luring the end user and using them to sell a product to someone else (everyone from Google to Facebook to DoorDash has this model). Without those megabytes of JS analytics and whatnot, the end-user cannot be packaged into the actual company product.

2\. As the real customer for the developers consists of these institutions, they care more about development costs than whether customer internet is wasted. Developer convenience means cheaper projects.

3\. Users blame themselves for the performance tax. They think they downloaded a virus, have an old computer, or need faster internet and they go and upgrade all those things, making the performance tax seemingly disappear.

<comment><USER16> > Most developers don't work for the end-user.

This is extremely reductionist.

If you want to take it further, then nobody works for the end user ever. If you have any funding _at all_ (even from the public markets) then you "work for investors".

Can you see how this is theoretically true, but practically not as true?

<comment><USER17> But it does explain a lot of things in practice. Many developers will choose to use a technology not because it makes the end-product better for the end- user, but because it will make their resume more attractive for potential employers.

<comment><USER18> I don't doubt that these developers exists, but I've never knowingly met one in 13 years of full time dev work.

</comment></comment></comment></comment><comment><USER19> The submitted title ("Developer efficiency prized above all else") broke the site guidelines, which ask: " _Please use the original title, unless it is misleading or linkbait; don 't editorialize_" ([https://news.ycombinator.com/newsguidelines.html](https://news.ycombinator.com/newsguidelines.html)). Cherry-picking the detail you think is most important from an article is editorializing.

Like it or not, titles dominate discussion. The comments in this thread are nearly entirely a reaction to that title. The HN guidelines specifically ask users not to abuse that power. On HN, submitting an article doesn't confer any special right to frame it for everyone else.

If you want to say what you think is important about an article, please post it as a comment to the thread. Then your view will be on a level playing field with everyone else's: [https://hn.algolia.com/?dateRange=all&page=0&prefix=false&qu...](https://hn.algolia.com/?dateRange=all&page=0&prefix=false&query=by%3Adang%20%22level%20playing%20field%22&sort=byDate&type=comment)

If it's necessary to change a title, please do that by picking the most neutral and accurate phrase you can find on the actual page which represents what the article is about. More on that here: [https://news.ycombinator.com/item?id=22932244](https://news.ycombinator.com/item?id=22932244)

</comment><comment><USER20> There's a big unspoken truth with Javascript here. The _vast majority_ of Open Source Javascript is created by developers for no money to solve their own problems and itches. Maybe not the most visible top-level libraries like React, but the thousands of dependencies are there to help the developer with some issue they had at some point. Sure they may have secondary goals, some of them including being time efficient, or memory efficient, or size efficient, etc.

So it seems expected that the agglomeration of tools with varying secondary goals, and a clear primary goal, results into this goal of developer efficiency being potentiated greatly. Forget about writing 5 lines of code, just npm install it.

And that _is fine_ IMHO, people/companies with different goals should be doing things differently. It also seems that turnover is a big issue as well for most companies, so they also try to make dev experience better!

</comment><comment><USER21> In my experience, companies expect developers to output features quickly. When it does not happen as quickly as expected the assumption is that its the developers when often times its the overall organizations process that is a mess. Its not necessarily a technology problem but a people problem.

<comment><USER11> People also create technology or adopt technology because of people, most of the time. You have a point there with messy organziations, but that is not mutually exclusive with the software stack, usually up to date with the fashion. And it is amusing that older technology almost always can get the job done okay and efficiently only because its problems are already known and there are already boring but understood worksarounds. Yes, boring but works. Versus cool and solves this problems but causes other new problems we know nothing about. It's been so far just like a game of whackamole

</comment></comment><comment><USER22> Software development doesn't exist in a vacuum. The author talks about these design principles as if they are supposed to satisfy the software team's personal values, when in reality it needs to be more about the organization's goals and values. Take this statement:

>Usability is more important than profitability.

For a bootstrapped company in danger of running out of money, it's ridiculous to prioritize perfecting UX over making sales. For an open source team, profitability isn't part of the equation at all but user experience might be a top priority. My point is, these aren't just matters of personal taste, the "design principles" have to mesh with the rest of the organization.

</comment><comment><USER23> Going one level up to [https://adactio.com/journal](https://adactio.com/journal) shows a sparkline (with author's activity perhaps, the latest posting is entry 2666!) which has a feature I have never seen before: an audible graph. Clicking on the sparkline plays tones matching the data. Not particulary useful, but make me thing about using audio for presenting data (apparently "sonification" is a thing!)

</comment><comment><USER24> You're talking about values, not design principles.

</comment><comment><USER10> Similarly: "Make it work, make it right, make it fast, make it pretty, _in that order_."

<comment><USER11> Make it work now and fast potentially has maintainability issues down the line. Make it maintainable and brautiful may miss the mark on what's actually needed and may be overengineered. Somewhere in between there is a sweet spot that can be found by luck or with some planning, a POC, etc

</comment></comment><comment><USER25> Short term: user experience, even over developer experience, because user experience is the point of developer experience.

Long term: developer experience, even over user experience, because over a long enough time period developer experience drives user experience.

</comment><comment><USER26> I think there is some truth to the conclusion. But remember that developer time is by far the largest expense when creating software. Sometimes the focus on developer efficiency is driven primary by a desire to minimize this cost.

</comment><comment><USER27> > Sadly, I think the current state of "modern" web development reverses that > principle. Developer efficiency is prized above all else.

I strongly disagree with that, "modern" web development values beautiful code over almost anything else, if that wasn't the case you could have one of your dev building a form in a few hours, instead they need tons of tools (react for example) that slow their development

<comment><USER28> Yea, the idea that "modern web programming" is beautiful at all franky makes me cringe.

Web programming and the web has separated developers too far from the hardware that actually runs the stuff and, as a result, we have built confusing towers of babel.js.

I mean, Javascript was originally made for developer ease over user reliability - and look at it now - it shows with the cacophony of NPM dependencies prone to "leftpad" style failures and the new frameworks every 6 months. All of this, of course, goes against one of the author's key points: "User experience, even over developer experience."

Unfortunately, I don't think the problem is solved by process but instead on re-education to compiled, reliable systems, made with a typing system designed to catch errors. Introducing more process and efficiency will never make a bicycle into a proper car.

<comment><USER29> > I don't think the problem is solved by process but instead on re-education > to compiled, reliable systems, made with a typing system designed to catch > errors.

We already have that in the form of TypeScript, but both left-pad and core-js were, for lack of better term, non-technical failures.

Only the most recent such case - is-promise - was purely a technical failure.

There's not much than can be done when the sole core maintainer of a popular library lands in a penal colony.

<comment><USER28> > We already have that in the form of TypeScript

While an improvement Typescript is a far cry from the likes of Ada and doesn't really compare.

> There's not much than can be done when the sole core maintainer of a popular > library lands in a penal colony.

Perhaps the solution is to not use Javascript, since it always forces you into an "ecosystem" of "frameworks" at every turn - and they are not cheap! Just another thing to throw on the stack. mb's be damned.

<comment><USER29> > While an improvement Typescript is a far cry from the likes of Ada and > doesn't really compare.

Given their respective popularities perhaps the point of diminishing returns was crossed somewhere?

> Perhaps the solution is to not use Javascript, since it always forces you > into an "ecosystem" of "frameworks" at every turn - and they are not cheap! > Just another thing to throw on the stack. mb's be damned.

This is becoming outdated information thanks to the likes of Svelte:

[https://svelte.dev/](https://svelte.dev/)

and Solid:

[https://github.com/ryansolid/solid](https://github.com/ryansolid/solid)

</comment></comment></comment></comment></comment><comment><USER30> Here's the TL;DR.

> But as a general principle, I think this works:

> User experience, even over developer experience.

>Sadly, I think the current state of "modern" web >development reverses that principle. Developer efficiency >is prized above all else.

<comment><USER31> I probably complain about this too much, websites built with SPA technologies can very often behave poorly to the user. Jittery, slow to be useful, generally less performant than other solutions. I feel like that gets ignored because so many people want to be on the bandwagon, and many feel the developer experience is better so we just kind of sweep that part of UX under the rug.

</comment></comment><comment><USER32> The TLDR states that the current state of modern development prioritizes developer efficiency over all else, and that user experience is way under valued.

My problem with this isn't that it places value on user experience, it is in the premise that developer efficiency is prized above all else. Deploying an app today is just as hard as it was 15 years ago. The only two things that jump out in recent memory that made a very sizable difference on developer experience were Heroku, Github, Docker. Setting up a hello world with react and a basic API takes me a day or more, where as 10 years ago with jquery this was an hour or so. Deploying an app with K8s is google scale, but takes me a week to do, forget debugging something in production.

If we've been prioritizing developer efficiency at all costs we've failed pretty massively. I personally love the idea of optimizing a lot for developer efficiency because we can do deliver more value to others at the end of the day, but there's a lot of shiny new stuff that has some reason for existing which is definitely not developer efficiency.

<comment><USER33> > " _If we 've been prioritizing developer efficiency at all costs we've > failed pretty massively._"

Do we not hear all the time on HN, for example, that "Yeah, native apps are more efficient and look better but Electron lets us just write it once and deploy on multiple platforms"?

<comment><USER17> Electron allows you to package your webapp into a downloadable stand-alone package, but does not make your development any more or less painless if you decide to use modern Javascript frameworks and infrastructure built for Google-scale deployment.

</comment></comment></comment><comment><USER34> Operating system policies are interesting in this regard.

Continued correct activity of OS processes is prioritized over user-level activities even where the purpose of the system is explicitly the latter. The reasoning seems to be that if the OS can't keep up, it can't maintain the environment that enables user-level stuff to work.

This generates conflict where user-level activities have real-time requirements. It is very, very hard to get your typical OS to leave a process running on a dedicated ("isolated") core and never, ever interrupt it, even given root privileges and boot-time static provisioning. Just store a byte in a file-mapped page, and whoops! get unsynced millisecond pauses while the OS copies it to the disk sector. Oh, and surely you still wanted an interrupt every millisecond to see if any OS resources tied to the core need cleanup, even though it never is asked for OS work.

<comment><USER35> Which OS? In QNX this isn't an issue. If you have hard real-time requirements you need to use a Real-Time Operating System.

<comment><USER34> Since when is QNX a typical OS?

Most programs need to run on the OS they need to run on, and on the hardware they need to run on. QNX (or other favorite obscurity) most usually is not an option.</comment></comment></comment>


Brush your teeth – postpone Alzheimer's - <AUTHOR> https://www.eurekalert.org/pub_releases/2019-06/tuob-byt060319.php <comment><USER2> P. gingivalis has been shown that it can migrate from the mouth to the brain. It is also found in the brains of Alzheimer's sufferers. But we don't know yet if it is THE cause of Alzheimer's. Which is to say "more research is needed to prove a cause and effect link."

This is still fresh science, the ink is still wet. It might ultimately prove that the cause of Alzheimer's is P. gingivalis (which is Nobel Prize levels of incredible). However, this single 2018 study is far from the body of evidence needed to make a claim on causal link.

That being said: Please brush and floss. There's no downside. Even if it is unlinked to Alzheimer's you've gained something and lost nothing. You'll thank yourself in the long run either way.

PS - I'm not even calling the science here bad (it is not). I am simply saying, this is the start of a marathon and the article is treating it like the end. Ten years ago similar articles on prion-based infections causing Alzheimer's was the hotness, until it wasn't.

<comment><USER3> > Ten years ago similar articles on prion-based infections causing Alzheimer's > was the hotness, until it wasn't.

I think it was not so long ago that I saw an article linking herpes viruses to Alzheimer's (which sounded much more plausible than an oral bacterium). Something must be causing those amyloid deposits...

<comment><USER4> I don't know where I picked up the idea, but I've long thought that it makes a kind of sense that oral plaque and gum disease would be linked to heart and brain diseases.

<comment><USER5> >I don't know where I picked up the idea

It is possible that you might have been pre-conditioned to think that way by the colossal dental industry; which has put out a fair amount of graphic imagery ranging from the saccharine to alarming, surrounding various aspects of oral hygiene and endorsing a variety of bacteria destroying toothpastes & mouth-washes to plaque-hunting rotating brushes in multitude of configurations etc., which compounded by this topic appearing with some regularity on HN might be reinforcing some of your preconceived notions.

Regardless, maintaining _basic_ oral hygiene should be de rigueur, despite how feasible or tenuous the link(s) to other conditions might be.

</comment></comment></comment></comment><comment><USER6> This is going to sound like a shill but I have to recommend the new Gum Detoxify toothpaste from Crest and thought I'd share it with other Hacker News readers. It has stannous fluoride and that is supposed to work better and actually kill bacteria around your gums. The reviews for it seemed crazy positive so I thought I would try it and it has been a product that actually does what it says.

I have to say, I wake up without morning breath pretty much now, which is insane. And I have been feeling better...

Here is a paper comparing stannous fluoride with the traditional type. [https://www.ncbi.nlm.nih.gov/pubmed/30797255](https://www.ncbi.nlm.nih.gov/pubmed/30797255) "Antimicrobial effects of a stannous fluoride toothpaste in distinct oral microenvironments."

<comment><USER7> There's also nano-hydroxyapatite (n-Ha), a bioactive form of calcium apatite that has been found to stick to dentine and help remineralize your teeth [1] [2].

It's popular in Japan, where it's even added to things like sports drinks. It's not easy to get in the West yet. The only toothpaste I know with n-Ha is Boka [3], and there's a more expensive Japanese one on Amazon called Apagard Premio [4].

[1] [https://www.ncbi.nlm.nih.gov/pmc/articles/PMC4252862/](https://www.ncbi.nlm.nih.gov/pmc/articles/PMC4252862/)

[2] [https://www.sciencedirect.com/science/article/pii/S030057121...](https://www.sciencedirect.com/science/article/pii/S0300571211000832)

[3] [https://www.boka.com/products/ela-mint- toothpaste](https://www.boka.com/products/ela-mint-toothpaste)

[4] [https://www.amazon.com/Apagard-Premio-toothpaste- nanohydroxy...](https://www.amazon.com/Apagard-Premio-toothpaste- nanohydroxyapatite-remineralizing/dp/B0016GCZSC)

<comment><USER8> The Apagard Premio stuff works. After my dentist saw my results he started importing it to sell out of his own practice.

</comment></comment></comment><comment><USER9> I shared this with a biostatistician friend and he replied:

There has been epidemiologic evidence of associations between periodontal disease and several diseases/outcomes, including heart attacks, strokes and (in pregnant women) premature and/or low birthweight babies. Clinical trials of treatments for periodontal disease have thus far not shown any benefit in terms of these outcomes. For example:

[https://www.ncbi.nlm.nih.gov/pubmed/19701034](https://www.ncbi.nlm.nih.gov/pubmed/19701034)

<comment><USER10> What is his idea of the true instrumental variable? Immune system? Different genetics in collagen or lipids?

</comment></comment><comment><USER11> The Research Article: [https://advances.sciencemag.org/content/5/1/eaau3333](https://advances.sciencemag.org/content/5/1/eaau3333)

</comment><comment><USER12> Zimbabwean here but live in Canada now. There are numerous older people back in Zimbabwe who probably haven't seen a toothbrush aside from an ad in a newspaper (they are 70+ years of age). No Alzheimer's to speak of its possible this is an anecdote but I don't hear of its prevalence there or other non- north--american countries. But then again those countries don't have as big of a media footprint and research. I still think it's something westerners do (or do not do!) that causes its prevalence here.

<comment><USER13> At least in the mid-2000s, Zimbabwe had the lowest life expectancy in the world, according to the WHO. There are differences in distribution, particularly skewed due to infant and childhood mortality rates, but I'd still expect to see significantly lower rates of late-onset diseases in Zimbabwe. Even looking at the percentage of 70+ year-olds with a given disease, I'd expect significant survivor bias; if people don't live long once they get a given disease, the percentage of the population with that disease is low. You need to be much healthier in Zimbabwe in order to reach old age.

Differences in access to diagnosis can also skew statistics. We don't actually ever know prevalence of a given disease, only diagnosis rates (and perhaps gross estimates of underdiagnosis and false positive diagnostic rates).

Given the factors above, looking at any late-onset disease, I'd expect that the percentage of people living long enough to be diagnosed is much lower in Zimbabwe. Even when just looking at people over the age of 70, I'd expect the percentage living with any given disease that significantly affects life expectancy to be much lower in Zimbabwe.

Having a good healthcare system deceptively skews lots of health-related statistics.

As far as factors related to the article, Western diet is probably much higher in sugar and meat than an average Zimbabwean diet over the past 70 years. I have several dentist friends here in Hong Kong who mention patients being skeptical about modern dental practices because their grandparents never had problems, forgetting that their grandparents had diets much higher in plants and much lower in sugar.

</comment></comment><comment><USER14> A lot of brain diseases are proving difficult to treat due to the "blood-brain barrier"[1]. Could this bacteria be genetically modified to achieve this purpose? If so, the bacteria, when absorbed through the gums could be used benevolently to provide treatment for all sorts of brain diseases.

[1]: [https://en.wikipedia.org/wiki/Blood–brain_barrier](https://en.wikipedia.org/wiki/Blood–brain_barrier)

<comment><USER10> Yes, because giving people meningitis or worse is an excellent way of treating them. To death.

There are many ways to pass BBB but few of them are actually safe. This one is not.

</comment></comment><comment><USER15> I wish there was some way to compare / visualize where I should be putting my effort on this stuff.

Surely I should do better taking care of my gums (flossing...:|), but I also need to improve my diet and exercise, among other things.

I'd hate to find out that the things in my life that I do manage to fix turn out to be more difficult and less effectual than other options...

<comment><USER4> Twice a day of brush, floss, and rinse is the bare minimum to keep healthy teeth and gums

I bought a nice electric toothbrush and water flosser, so I feel like I get a better job done faster (Sonicare and Waterpik)

<comment><USER16> You should not rinse directly after brushing. Toothpaste has a higher concentration of fluoride than any mouthwash, if you're going to use a rinse the recommendation is to wait 30 mins after brushing, and you should never rinse with water

<comment><USER17> > you should never rinse with water

This is going to be a stupid question. What do you rinse with?

<comment><USER18> You don't. You spit it out and go about your day.

<comment><USER19> Is this common advice? I would find having my mouth coated with toothpaste residue to be extremely off putting. You would also end up swallowing quite a bit, yes?

<comment><USER18> It's common advice from all the dentists and hygienists I've ever seen, and it's not something that comes up in conversation among my friends here but from personal experience I wanna say all or most of my partners I've ever seen brush their teeth they do the same. If it helps, this is in Europe, so we (as in dentists here) may have differing guidelines as you.

From what I know, the gist is that fluoride is mineralized into enamel which strengthens it (not sure if this is the correct phrasing). Whatever the correct phrase is, it works by direct prolonged contact. Not rinsing is a way to guarantee this contact, but even if you do there's still fluoride in your saliva to do some good.

I imagine the taste depends on your toothpaste. I use a plain one (Elmex) that doesn't really have a taste, and the taste goes away fast enough that I don't notice it.

As far as swallowing goes, not really. Most of it gets spat out. Besides, (some) astronauts in space just swallow it all instead of spitting cause it's cleaner :)

[https://www.quora.com/International-Space-Station-Is-it- ok-t...](https://www.quora.com/International-Space-Station-Is-it-ok-to- swallow-toothpaste-as-Chris-Hadfield-does-in-this-video)

Yes I know fluoride can be toxic but the amount you'd swallow (a _small_ pea sized dab is all you need, all those pictures of the entire brush covered by toothpaste is advertisement to get you to think you need that much) is probably not going to have any effect.

</comment></comment></comment></comment></comment></comment></comment><comment><USER20> I've always wondered what is the order of importance when it comes to oral hygiene. Brush, paste, duration, technique. Further which is more important, brushing, flossing or a good mouthwash? Is there anything that survives a chlorhexidine rinse?

<comment><USER21> For what it's worth, my dentist told me he didn't care if his patients brushed their teeth or not, as long as they flossed.

<comment><USER22> My dentist always said, "brushing is for you, flossing is for me." (He meant that brushing is to remove the bad taste teeth fuzz, but flossing is what keeps my teeth and gums healthy.)

<comment><USER18> I've heard the saying "you only need to floss between the teeth you want to keep" in response to the question "do I _really_ need to floss?"

</comment></comment></comment></comment><comment><USER23> Wow, this is the kind of article that amazes me on HN. And why I keep coming back.

</comment><comment><USER24> How about mouthwash?</comment>


JSON.sh: a JSON parser written in bash - <AUTHOR> https://github.com/dominictarr/JSON.sh <comment><USER2> I have been using jsonpipe lots, it is deeply useful. I use it to use RESTful services as if they were system processes. Also try to use it with something like resty (<https://github.com/micha/resty>) to really make your life easier.

<comment><USER3> For more elaborate stuff, you can also use jshon (<http://kmkeen.com/jshon/>).

</comment></comment><comment><USER4> You can also use the python json.tool

        $ echo '{"json":"obj"}' | python -mjson.tool
        {
            "json": "obj"
        }

<http://docs.python.org/library/json.html>

</comment><comment><USER5> Awesome. Been working with a lot of APIs, and I also looked for a way to print it out better in terminal. I found an alternative. If you have python, you can pipe it to -mjson.tool and it will pretty print it in the terminal.

[http://stackoverflow.com/questions/352098/how-to-pretty- prin...](http://stackoverflow.com/questions/352098/how-to-pretty-print-json- script)

</comment><comment><USER6> like the idea.. and Id really like to see a fully javascript unix shell.

Using mongo, node.js for real work, I find this a really practical environment, and I often write little 'perl' {java}scripts for text/data wrangling.

I wrote a little utility that has a jsonpath-like syntax to descend down into json docs in mongo from the command line, use that a lot.

</comment><comment><USER7> I can see this being useful. I use bash a lot to deploy small projects, find it's much easier to get a continuous deployment up and running than the fancier tools out there, in the early stages at least.

</comment><comment><USER8> Thanks a lot!

I cannot really say how much I needed this. Just yesterday I was writing a bash script for one of my side-projects and I wrote a ruby script just to parse JSON and called that ruby script within bash.

</comment><comment><USER9> Very cool, I love the idea of piping JSON. Thank you

</comment><comment><USER10> It's probably pretty rare, but I actually had a reasonable use case for something like this some months ago. Worked around it in other ways in the end.

Wouldn't want to use this for any serious work without any clear license, though...

<comment><USER11> Licence seems pretty clear:

"Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:

"The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software."

<https://github.com/dominictarr/JSON.sh/blob/master/LICENCE>

<comment><USER12> he was writing before the commit with the licence was pushed.</comment></comment></comment>


Pcb-stackup: Generate beautiful and accurate SVG renders of printed circuit boards - <AUTHOR> https://github.com/tracespace/pcb-stackup <comment><USER2> This is very interesting and something that I can really apply at work?

Does anyone knows how this compares to Gerber-to-svg? [https://github.com/mcous/gerber-to-svg](https://github.com/mcous/gerber-to- svg)

<comment><USER3> It has gerber-to-svg as an dependency, so I'm curious what it actually adds to this.

<comment><USER4> A PCB consists of multiple layers, each one of which is described by a gerber file. gerber-to-svg renders each individual layer to svg; this project aggregates all the layers and stacks them up (hence the name) in the proper order.

<comment><USER2> Thank you!

Macrofab does this for their web tool, from their Github I guess they merge gerber-to-svg with this SVG Stacker:

[https://github.com/MacroFab/SVG-Stacker](https://github.com/MacroFab/SVG- Stacker)

<comment><USER5> You're right, sort of! =)

We use gerber-to-svg (it is the best we've ever worked with) server-side, but we use svg-stacker to generate images for the cases where we need them (thumbnails, printouts, etc.)

On the front-end, we use html5 canvas rather than a pre-stacked SVG.

</comment></comment></comment></comment></comment><comment><USER6> Somewhat related and in reverse, generate beautiful [0] gerbers for manufacture from SVG/JSON definitions using PCBmodE. [1]

[0] [http://www.boldport.com/blog/2015/11/25/haute- circuits](http://www.boldport.com/blog/2015/11/25/haute-circuits)

[1] [http://pcbmode.com/](http://pcbmode.com/)

</comment><comment><USER7> This is a great project but why is the example image a raster png rather than an svg?

<comment><USER8> SVGs don't work in Github READMEs. I believe this is for security reasons.

<comment><USER9> This is true, though there is a workaround by using cdn.saw fit.com domain. I use the trick to display SVG figures in these white paper notes[1], and I found out about it in this issue thread[2]

Example:

<img src="[http://cdn.rawgit.com/<username>/<path>/<to>/<image.svg>">](http://cdn.rawgit.com/<username>/<path>/<to>/<image.svg>">)

[1]: [https://github.com/samjabrahams/tensorflow-white-paper- notes...](https://github.com/samjabrahams/tensorflow-white-paper- notes/blob/master/README.md) [2]: [https://github.com/isaacs/github/issues/316#issuecomment-113...](https://github.com/isaacs/github/issues/316#issuecomment-113790202)

</comment></comment></comment><comment><USER10> Really like projects like these. Nice building block that'll make like easier for people to share information about boards in the future. Awesome.

</comment><comment><USER11> As @aylons mentioned this is just a thin wrapper onmcous/gerber-to-svg; Moreover mcous has written [http://svgerber.cousins.io/](http://svgerber.cousins.io/) himself.

<comment><USER12> This is in fact a thin wrapper, that I mostly wrote, around a fat wrapper that mcous wrote (pcb-stackup-core).

Check out [http://viewer.tracespace.io](http://viewer.tracespace.io) for the updated svgerber style viewer.

</comment></comment><comment><USER13> What about component models?

<comment><USER14> This is only a Gerber file renderer. Gerber files only contain manufacturing data (it's basically a vector image format).

So 3D models would be very hard to add. It would only work if you export a BOM with position data and references to STEP files for your board. This is not currently supported by most commercial software (no idea if it's possible with KiCad), positions are easy to get, but then you'd still need the 3D models (including position offsets and rotation).</comment></comment>


Tesla is talking to the music labels about creating its own streaming service - <AUTHOR> https://www.recode.net/2017/6/22/15855346/tesla-elon-musk-streaming-music-service <comment><AUTHOR> I'm not sure this undertaking will meet with a lot of approval by Tesla's Investors, considering not only is Tesla not turning a profit currently, but no streaming music service is either. "What we lose on margin we make up for in volume!" This should be interesting.</comment>