Ask HN: Which SSL Cert to Buy? - <AUTHOR>

For past projects, I've always used GeoTrust, because of their combination of price and browser acceptance.
Today I noticed that GoDaddy, Entrust.net, and instantssl are all cheaper.
Does anyone have any experience with those three?
I.e., is there any reason I shouldn't just use a $30 per year SSL cert from GoDaddy? <comment><USER2> A lot of this is merely price discrimination. Some people won't find out about cheaper certificates and will pay lots more money for something from GeoTrust. GeoTrust actually _owns_ RapidSSL (<http://www.rapidssl.com/ssl-certificate- about/index.htm>). NameCheap is reselling those RapidSSL branded certificates for less than RapidSSL.com is selling them. RapidSSL.com is, in turn, selling certificates for less than GeoTrust. And they're all signed by the Equifax root certificate!

Single root certificates are a better option and the RapidSSL certificate that NameCheap is selling for $10 is single root and run and signed by the same people as GeoTrust. Do go with a single root as it makes life easier.

<comment><USER3> Namecheap offers free PositiveSSL certificates, as well as a free whois masking option. You must register or transfer a domain there to get it, but it's not tied to the domain you buy, so you could buy a new domain and use the free cert on an older one.

<comment><USER4> Don't use whois masking services, it effectively gives a third party ownership of the domain in question and most certainly does violate the ICANN rules about truthful and accurate registration information.

<comment><USER3> I've used whois protection services for years (and for thousands of domains), there's never been a problem for me.

When the whois protection service is provided by the registrar you used to register the domain, how is that third party ownership? They already have a lot of control over the domain.

I don't know about ICANN rules on the matter, however I think they would have pressured registrars to stop offering such services, if that was the case.

If you have further information/links on the subject, please elaborate.

<comment><USER4> <http://www.dynadot.com/resource/article/qa.html?aid=0>

TL;DR: you can do it, but understand the risks you are taking. The whois record is the authoritative record of domain ownership, if your name (or company name) isn't on it, then if there is a dispute, you lose.

<comment><USER3> That post uses Domains by Proxy as an example, which is an awful service. Towards the end of the article, Dynadot explains the whois protection service THEY offer themselves. That's what Namecheap (and other registrars) does and it's what I've always used.

I can tell you for a fact that I receive a lot less email spam at the email address I use for whois, because Namecheap changes the address (which forwards to mine) listed every other day. Also I don't get any snail mail junk, although this was never a big issue.

</comment></comment></comment></comment></comment></comment><comment><USER5> I usually buy the RapidSSL cert from NameCheap, $10.95/y or less for longer periods. It's single root (unchained) and signed by a very well supported CA cert. The only downside is no subjAltName (which lets you do both www.foo.com and foo.com).

All you really need to know is what the root CA is, because some certs (even expensive ones like Thawte's EV) are signed by newer CAs that aren't present in older browsers, mobile devices, etc. Also extra "features" like > 1024 bit keys often cost more.

<comment><AUTHOR> Thanks, I'd never heard of NameCheap before.

I see that they resell GeoTrust at $47/year (which is a nice discount from the $250/year I'd been expecting to pay), but what's the difference between that and their own $9/year certs?

<comment><USER6> Basically brandname, which logo you get to put on your site.

</comment></comment></comment><comment><USER7> No experience, but there was a recent Ask HN about the same. This response says something about GoDaddy's certificates vs more expensive ones: <http://news.ycombinator.com/item?id=1308619>

Not sure if that helps you any.

<comment><AUTHOR> Thanks for the link; I did a search before posting, and the only other thread I found was more than 400+ days old.

I don't understand the chaining issue described, but I can research that a bit more.

It makes sense there's some sort of catch with GoDaddy, since their certs are orders of magnitude cheaper than the others (everyone else is $150+ per year).

<comment><USER7> I think the chaining issue is just that it takes more work for you to setup. But maybe someone who knows what they're talking about can give you more info.

</comment></comment></comment><comment><USER4> > is there any reason I shouldn't just use a $30 per year SSL cert from > GoDaddy?

GoDaddy uses an intermediate certificate which means you need to install, not just your cert, but also all of the certs back to the root. It's a minor annoyance, except for the fact that they don't tell you about it until after you buy the cert.

</comment><comment><USER8> It depends on what you want to do with it. For a basic cert for a web site GoDaddy is fine but remember to generate a CRS with of 2048bit (<http://help.godaddy.com/article/5619>) at least and not the older default of 1024 since some newer mobile devices will not like that. If you want it to work on ALL mobile devices you may have issues with GoDaddy anyway. Something about the chain of trust - it's been a while.

I would recommend you do your homework by checking out GeoTrust (here is a kb article from them <http://bit.ly/9HMsqp>) - If you are unsure, call them. If anyone has worked with ActiveSync and mobile devices perhaps you can remind me of some of the other issues.

</comment><comment><USER9> Yes,you shouldn't pay $30 per year for SSL cert from GoDaddy because you can get it for $12.99 if you just search on Google for Godaddy SSL

<http://www.google.com/search?q=godaddy+ssl>

</comment><comment><USER10> if you're looking for cheap, why not go for <http://www.startssl.com/> ? it's completely free and works on all recent browser, and most older ones too.

<comment><USER11> I agree on using startssl, and especially because of their ethos of how they charge: you only pay for the verification process, and after that, SSLs are free because they're automatic.

Also, startssl's founder is the best ambassador - send a help request, and he'll answer in no time.

</comment></comment><comment><USER12> It depends a lot on what kind of site you are trying to secure, but a cheap certificate works in many cases. Browser acceptance really isn't an issue with major providers. I would just be sure to check out some reviews for the provider that you want to go with: <http://www.sslshopper.com/certificate- authority-reviews.html>

</comment><comment><USER13> I use <http://www.rapidsslonline.com/rapidssl-certificates.php> (~$15/year) and haven't had any problems.

<https://www.servertastic.com/rapidssl/> look similar.

</comment><comment><USER14> We use <http://www.digicert.com/> since we need a SAN (SubjAltName). SAN lets you do *.domain.com and domain.com

Weird surprise, Android does NOT support SAN. DigiCert gave us a root cert for free with our wildcard.

</comment><comment><USER15> I use Comodo to buy a domain specific cert for $30 and wildcard for $300. But that may be due to my company being a reseller of comodo certs..

<comment><USER16> Yes, normally they are three times more expensive</comment></comment>


In Defense of Erlang: Through Magic of Offence - <AUTHOR> https://drive.google.com/file/d/0Bz8Lmg2kodQiRXYwWVpGNXQtdG5hNG5GaDFFNF9UNXp4UXo4/view <comment><USER2> Whoa whoa whoa.

"Only" exploit developer?

[https://github.com/zv/otp](https://github.com/zv/otp)

I was writing the fuzzing machinery for the BEAM instruction decoder AND EPMD while you were ... doing much more impressive stuff.

Besides paragons of industry like myself, The "CUTER" guy (known by his friends as "Greek Fire") has done considerable work in manually verifying and pretend model checking large swaths of the Erl OTP code, despite being less "vulnerable" than the biffer or port-mapper (for example), _DOES_ happen to comprise the vast majority of the OTP code base.

Other people have done admirable work in reviewing OTP, patching remotely exploitable holes and advancing our security posture. Unsurprisingly this breed of hacker doesn't bother registering a catchy domain name with a dope live stunt-hacking demo to Wired.

This is to say you've never heard of them.

<comment><USER3> Pretend model checking?

<comment><USER2> Pretend model checking is an exciting new field born from frustrations with actually model checking large amounts of code that accepts somewhat arbitrary inputs and uses (large) loops. After enough neologisms like 'symbolic execution' and 'program synthesis' the distinctions between the various terms- of-art break down for laymen like myself and it all blurs together into some vague guarantee about software behavior.

In Aggelos Giantsios's (CUTER's) case, this means writing your own stuff. Everywhere else, this means writing a TLA+ specification for your favorite component of the term protocol, some implementation environment and "slapping on the TLAPS".

This has the unfortunate property of only model checking a model that the implementer THINKS the program behaves in (many 'model checking' efforts fit into this camp). Those who are truly serious about verification have a Maude<->ACL2 of the resulting assembly or try to check for symbolic constraints with KLEE.

Those who are even MORE serious (usually on philosophical grounds) have a host of approaches I couldn't even tell you about.

</comment></comment></comment><comment><USER4> The slides were previously discussed on the Erlang mailinglist.

[http://erlang.org/pipermail/erlang- questions/2016-June/08941...](http://erlang.org/pipermail/erlang- questions/2016-June/089413.html)

</comment><comment><USER5> > All user written code is call-back based, reducing code complexity

I think this line deserves further explanation. _(I wish people would just post the video of a talk instead of slides, they are often devoid of important context)._

<comment><USER6> Erlang programs are typically structured around OTP-like style. In this style an executing process consists of an "upper" half, written by the user as a module of callback hooks. And a "lower" half which is reused in all components. The lower half usually doesn't "trust" that the upper half is doing things correctly.

Furthermore, Erlangs core is functional, so data is by default persistent which makes it harder for code to do "nasty" things to other parts of the code.

From a correctness perspective it makes it harder for code to mess up. From a security perspective correct code with hard error constraints is safe, leading to controlled process crashes with no memory corruption.

Of course it is no panacea, but it goes a long way toward making systems safe.

</comment></comment><comment><USER7> the erlang odbc module will also let you overwrite the heap if you aren't careful. it lets you specify a string size for query params and if you pass in a binary/list that is larger than the string size it will just corrupt the heap. if you are not validating client input this can be remotely exploitable. :/

<comment><USER8> This sounds pretty bad, has it been reported?

</comment></comment><comment><USER9> Just want to shoutout to the Nerves Project, which is working on creating a platform for Elixir on embedded systems:

[http://nerves-project.org/watch/](http://nerves-project.org/watch/)

</comment><comment><USER10> > High security potential

What is that supposed to mean?</comment>


The Greatest Teaching Techniques Don't Compute over Zoom - <AUTHOR> https://www.bloomberg.com/opinion/articles/2020-07-12/the-greatest-teaching-techniques-don-t-compute-over-zoom <comment><USER3> > let me say a word about diversity and inclusion.

Blind person here. On line learning is the best thing that can happen to diversity and inclusion, particularly when disabled people are concerned. For me, being in an environment free of students constantly shouting over my speech synth made a huge difference. I could adjust the volume of the teacher, or even mute them for a while, when I really needed to focus on the speech. Being able to request the name of the person talking, or hear who joins/leaves/raises hand is really useful too. I imagine the difference is even bigger for blind teachers, as they normally don't know who raises the hand or talks, and that's very important to them. Other disabilities benefit too, wheelchair users were very relieved they didn't have to move / be moved through inaccessible buildings etc.

There are a lot of accessibility implications to on line learning, most of them positive. Personally, I wish I could just stay that way forever.

<comment><USER4> >> There are a lot of accessibility implications to on line learning, most of them positive. Personally, I wish I could just stay that way forever.

It's obvious that your quality of education has improved and makes sense that you'd want to kleep it that way. It would be great if we could support people in your situation without greatly diminishing the experience of a huge component of attendees though: all those with learning, attention and focus issues. The stats are truely mind boggling with how many kids struggle to control their behaviour in a virtual classroom.

Question: why DON'T you stay remote? Most of the time the last thing we want to do is isolate people in different situations but it sounds like this would be preferable for you. It would seem to be quite easy to support too.

<comment><USER5> There are practical difficulties in having some students in the classroom and some students online: it's hard for a single instructor to split attention that way, unless they have some help (e.g., a student assistant) in the classroom. It would be more effective if universities had more dedicated online versions of courses. This had already been happening before the pandemic and would probably be accelerated post-pandemic for a variety of reasons.

Edit: fix grammar + clarify.

<comment><USER6> At my school our professors actually did this split very well. They had a chime sound when an online hand was raised, they always prioritized those students, and they had good tech to display their screens both in the classroom and online.

With the right tech and competent teachers, it's completely doable in my experience.

<comment><USER5> Oh, I completely agree with that. One of the issues, especially at large public universities, is that many faculty members who are perfectly effective in person have difficulties with the technology. Asking them to split attention on top of an already stressful situation is hard, and training only gets one so far. So the online experience is hard to make consistent across courses and even sections of the same course.

</comment></comment></comment></comment></comment><comment><USER7> This is an odd opinion piece to have made it to HN front page. It's essentially a collection of unsubstantiated claims that would likely have no impact to policy even if they were demonstrably true because the driving factor is human safety and not efficacy or ease of teaching.

Remote teaching may be harder, require more work, and have pitfalls that are quickly overcome in person. Much more useful would be a collection of ways to mitigate them, rather than an airing of grievances.

Maybe I'm being too hard on this, and it's just a good serving up of the real conversation. So, what are other folks doing to overcome the difficulties outlined in the article?

Reading the room, avoiding distraction, using humor, and inability to establish command.

On the last note, I will say that I believe it's a red herring. The most soft spoken person, who clearly has a passion to share their subject, will be easily gifted this by a willing audience. Even over Zoom.

<comment> doopy-loopy2 Just because you don't agree doesn't mean it shouldn't be on HN.

Personally, it seems blatantly obvious that Zoom cannot replace face-to-face interactions whether in a work setting or in an educational setting.

The people advocating "100% remote and video calls for everything" are either just really short sighted or have some other motive going on.

<comment><USER7> Oh, I don't disagree at all. The reason I don't think it belongs on HN is because "It's essentially a collection of unsubstantiated claims that would likely have no impact to policy even if they were demonstrably true because the driving factor is human safety and not efficacy or ease of teaching."

That has nothing to do with whether or not I agree with those claims, although in this particular case, it just so happens that I do.

</comment></comment></comment><comment><USER8> I've been teaching classes online since March. Honestly, even at the best of times it feels like teaching a brick wall.

One of the universities has a rule that everyone must have their cameras on at all times, so you end up teaching classes to seas of blank faces. You get no meaningful feedback this way.

One thing I've used which has been useful is Miro [1]. It is a collaborative whiteboard tool. Being able to get a little bit of output from everyone is wonderful. Even just being able to see people's mouse pointers move makers a huge difference.

One of the pluses has been everyone has suddenly got much better at using the universities online learning system (which existed before). General organisation and admin has been streamlined somewhat.

[1] [https://miro.com/](https://miro.com/)

<comment><USER9> I had to teach online during a weather emergency decades ago(back when you used powerpoint and a RealPlayer product to make movies). No live lectures though- all we had was dial-up so it was all asynchronous.

One thing that it seems to me would be very helpful would be an instantaneous feedback channel where you could have premade questions (say, multiple-choice) and ask students to answer them in real time. This would allow you intersperse formative assessment into your lectures more like what happens live. It would go a long way toward helping the class be interactive. They would have to be graded automatically for large classes, of course.

</comment></comment><comment><USER10> So I've taught a few thousand activists/journalists in security over the years in person and a couple of hundred over remote webinars. I've also built online self paced courses. My takeaway is that the biggest mistake educators make (and I was guilty of this at early stages) is trying to directly shift things like lessons plans from the physical to the online world. One way lecture style stuff which is kind of outdated (or occasionally just lazy) for many use cases in a physical classroom really fails for a lot of stuff when put online.

To do it well, online courses have to be approached completely differently. You have to switch your way of thinking, switch how you apply learning (esp adult) methodologies, switch your time planning and also change your expectations. For example adults mostly learn and enjoy learning best through facilitation where possible, stuff like group work. That's very hard to do well with current online tools. Also attention spans are very different.

Even small things like physical movement. In the training room you the educator can move around and in most sessions you can integrate opportunities to get the people you are training to stand up and move around for a bit (for example get a group to look at a problem and address it on the wall). You can't do that when someone is looking at a screen. Plus it's tricky to encourage people to feel able to spontaneously contribute or throw in a question etc on web. It's obviously also harder for more than one person to speak. Plus the way that people tend to be zeroed in on the educator means they are less likely to have positive engagement that spins off from what someone else is saying. E.g picking up follow up questions, asking their classmate how to do something or putting forward their own theory on something.

There are some advantages to using webinars about what you can use - <USER2> on topic you can draw on a wider variety of material.

Overall when developing online courses I felt at times it shifted to require more of a Producer mentality than purely an Educator one.

<comment><USER11> Group work has its advantages, but possibly my sample is biased in a different direction than yours - I've always found groups a terrible way to teach programming, at least to complete beginners. Once they have the basics, then group work starts to work a bit better.

<comment><USER9> Same with physics, at least the theory in the classroom. It really became the blind leading the blind and very inefficient.

Maybe I just sucked at it.

</comment></comment></comment><comment><USER12> My 14 year old son, didn't take to online learning at all well (we're in Finland - the school already used google classroom and a lot of online technologies and had all the resources and training they needed). It seemed to be the lack of attention both ways - the teacher can't really see how well the students are understanding the information and the students are perhaps taking less in (maybe the youtube/snapchat use has dulled their perception of video lessons) and are less inclined to ask for help.

I wonder if video lessons of traditional in-class teaching will ever be effective long distance to younger pupils. And shorter online interactive lessons - duolingo/khan academy etc. or something else is required.

<comment><USER13> Unless we solve this early, the problem you describe could be terrifically self-perpetuating.

Online learning (in its current state) requires lots of motivation and discipline. These are skills learned from tight feedback loops which historically happen in-person. If kids fail to pick this up early, they will be even less inclined to online learning. As a parent of a young kid, I'm very concerned that we're going to learn this lesson after it's far too late.

</comment></comment><comment><USER14> The working model of management in at least certain high ranking UK universities is that it takes less time to run an online course than an in- person one, while maintaining the same standards. It's a convenient justification, if one not publicly made, for shrinking the industry's labour pool. So this year not only do many university teachers find themselves fighting the uphill battle of teaching online (or 'mixed', both online and in person), but they do so with fewer hands ready to help out. I despair.

<comment><USER10> That's ridiculous, I would say in terms of preparation and creation an online course is probably nearly double the time of a physical one at a minimum.

<comment><USER15> There is some truth to this. For in-person lectures I could just show up to class with a general theme and blather onto the whiteboard, whereas online, all the students want text lecture notes, slides from the lecture, they don't ask questions during lecture, so they are confused, taking time later.

If you spend time editing together a pre-recorded video, it can easily triple the amount of work. Even if you go with the pro-style one take, you need to rehearse and have a good plan in place to make such a video.

<comment><USER10> Absolutely. I felt like I was documentary producer as well as an educator when doing our online courses.

</comment></comment></comment></comment><comment><USER16> The author presents a model of learning where the teacher dominates the physical classroom (and, by implication, the students are submissive): he says this explicitly when talking about a "dominating professor".

Online learning doesn't allow for that in the same way, so a teacher dependent on this style of teaching is likely to experience significant discomfort.

Is this really a "Greatest Teaching Technique" though, as the headline suggests? I am highly doubtful. This is more about having control of a classroom, than enabling learning. I find it hard to call this a teaching technique at all.

If you say "Greatest Teaching Technique" to me, I immediately think of the Socratic method. With the understanding that it is more difficult to read body language and physical cues, that still works perfectly great over Zoom.

<comment><USER17> I don't think the Socratic Method is universally applicable. I'm not sure how one would use it to effectively teach Spanish, or history, or geometry.

<comment><USER18> > I don't think the Socratic Method is universally applicable. I'm not sure > how one would use it to effectively teach Spanish, or history, or geometry.

Doesn't seem hard. Socrates himself used the method to teach geometry: [http://www.socraticmethod.net/essays/meno_geometry/meno_geom...](http://www.socraticmethod.net/essays/meno_geometry/meno_geometry.html).

</comment></comment></comment><comment><USER19> I teach in college. In my opinion physical presence beats online teaching hands down for all but a few use cases. In my experience the last three months a minority of students thrive by online teaching, another (slightly bigger) minority stumbles and falls, and the rest struggles.

As a teacher I feel way less effective as well.

I do not think there is a technical solution to this. If online teaching becomes the norm I will leave the profession.

<comment><USER20> The main problem with online is the mental agility of the student - smartness. Some are auto didactic - capable of self teaching. Some are not, we can not all be an Archimedes or an Isaac Newton. Online teaching needs to develop a high degree of parallelism. Let us say they break the topic down to a large number of short modules. Each one needs to be shown and explained and then the uptake tested. If student fails test 1, he needs to be taken through a different module on the same topic, explained and uptake tested. Repeat until the parallels are exhausted and the fails assessed to determine the composition of the way the student fails. Once assessed, the student needs to enter a new set of modules with greater detail in the explanatory detail. This will need an exhaustive degree of preparation, but it needs to be done. Once done on all topics you will have a huge massively parallel data base that is capable of teaching a wide range of people. On route, one needs to assess all manner of supportive skills - keyboarding - is that student capable of reading and entering the responses the program will demand of him? If not, that student needs some preparatory modules to deal with all the test and numeracy issues he faces. In human teaching, this is done via very personally demanding instruction in person. The program needs to be able to rapidly select from all the modules in it's repertoire. Ideally, such a system can handle all the way from a child to a graduate student. Assessing all the way and presenting and reviewing, remoduling etc all the way. Students vary widely, some are highly intelligent (but as yet are untaught), some are not so smart. AN ideal system will also test for what I call 'physical IQ' \- the capacity for detailed physical tasks, such as fencing or basketball or any sport. They may be brilliant at physical tasks, not so good at physics or programming. Modern computers are capable of this. It is a demanding task to program them, but once done, it can be deployed millions of times amond millions of students. I hesitate to call it an 'AI', it is just a capable parallel high speed machine.

<comment><USER21> Trying to replicate a classroom online is the primary mistake I think people are making. Why should there be a teacher delivering scripted lectures to students at a scheduled time at all. Trying to do classes over zoom is a terrible idea. Why not just put all the kids on individualized learning plans, have the teachers act as tutors and counselors and graders, and let the kids go at their own pace, with staff following their progress closely and making sure they're getting their work done on time, clearing up learning impediments, etc. Then you can have the kids that need one-on-one help getting that time, and the kids that can do self-directed learning being free to go as fast as they want to.

<comment><USER19> I think generalizing all ages is a bad idea. In fact kids grow and learn so fast that almost each age needs a different approach, and I don't mean a 5% difference.

Another thing is that we tend to underestimate how much kids learn 'between the lines'. What is acceptable, what is valuable.

Lastly I'm convinced individualised learning is a fallacy. We technocrats like personalisation, but in my opinion that is only good for adults.

I want to recommend books and talks from Katharine Birbalsingh for an entirely contrarian, but very successful take on elevating underprivileged children.

</comment></comment></comment></comment><comment><USER22> I get the impression that the author needs to think a bit further outside the box.

Simply taking the classroom model and trying to perfectly replicate it in Zoom won't work. _Of course._ But online learning opens up a whole host of new possibilities that in-person learning is equally unable to replicate.

I earned my most recent degree online, from a fully online program, and really appreciated some of the thought they put into creating an online learning experience. One of the key changes was moving toward pre-recorded lectures. This yielded all sorts of fruit. It meant that I, the student, could listen to lectures at a time that worked best for me, rather than being tied to a classroom schedule. Not able to concentrate right now? Fine, take a break and try again later. Morning person? Never have to struggle to stay awake during late afternoon lectures ever again. Evening person? Same for morning lectures. Lecturer's voice dulcet tones and musical prosody make you drowsy, or hard of hearing, or classes not taught in your first language? You, my friend, are going to _love_ the new Transcripts feature.

It also greatly reduced the time we needed to spend in classroom sessions, which, in turn, _increased_ our access to personalized instruction by freeing up space in the instructors' schedules for small group and one-on-one meetings with students.

I, personally, didn't have difficulty focusing on class during class. I don't know that my classmates did, either. My suspicion is that those studies about students not paying attention were looking at typical online classes, which do consist of the traditional "classroom lectures, only on a screen" model. In which case, I am not at all surprised. Traditional classroom lectures tend to be _boring as hell._ A live classroom environment creating psychological cues that discourage distraction behavior doesn't fix that problem, it just makes it less apparent to the lecturer. Moreover, with asynchronous, recorded lectures, when my attention wanders (as all attentions will), its no big deal, all I have to do is rewind 30 seconds. In the classroom, if the lecturer says something critical while you were zoned out, too bad, you missed it.

The real problem here is that the pandemic has taken teachers who worked under the traditional model, and rudely thrust them into a completely new working environment that requires a radially different approach to the job, and has left them them zero time to adapt. But even a baby you didn't ask for shouldn't be thrown out with the bathwater.

</comment><comment><USER23> I think we all know that this is true, that online courses have subpar experience compared to physically being in the classrooms especially with younger kids. The question is, how can we make an online classroom experience be as good as it can get and also scales up?

<comment><USER24> Does "scaling up" have to be part of it? Maybe teaching is better done with small groups, and being online doesn't change that. Could the time-shifting and decentralisation of online learning reduce class sizes instead of increasing them?

<comment><USER25> You could certainly scale-up the product/solution and at the same time, try to optimize/reduce the number of students per teacher.

A p2p model where students teach other students just below their baseline would be an awesome way to make studying more fullfilling/enjoyable

<comment><USER26> For what it's worth, that used to be a very common model of teaching, especially in early school (and it still is pretty common at university level, with TAs). It would be common for fourth-graders to teach first graders, as I understand it, especially in rural schools where there were very few teachers available.

I think there are problems with he system though, as you can't rely on the teaching capacities of an 11 year old child, even if they are quite gifted in that particular subject matter. I think doing group work with a mix of older and younger children would help a lot though, but it is still probably best if the concepts are first introduced by an adult who has at least some pedagocical training.

</comment></comment></comment></comment><comment><USER27> I think back to number of classes I slept through in high school and have to wonder if the problem is strictly confined to online teaching...

</comment><comment><USER28> I agree that learning over a video call is no substitute for in-person instruction, but I wouldn't give too much praise to the way we currently teach. Different people have different learning styles, and curriculum is rarely designed for that. I think teaching others does more for mastery than standard studying, but it rarely finds its way into classrooms in a meaningful way. Universities are even worse. Professors often have no interest in teaching. Even when they have an interest, the lecture format seriously sells education short. Compare a how high school seniors are taught vs. college freshmen; they're pretty different, but the kids are almost the same; I'd bet money that the college instruction is less effective. I guess a video call is just college instruction on steroids. Sink or swim--it's all on you.

</comment><comment><USER29> Teaching online is like flying blind; you have so much less information than you do in person, and can't read body language, get an immediate overview, check in on students in the thousand tiny ways that come without thinking in person.

Teaching virtually is doable, and still valuable, but it's definitely a degraded experience.

</comment><comment><USER30> As a college educator for 22 years in technology/compsci, I definitely agree with many of the early points in this article surrounding the benefits of the physical classroom.

However, I strongly disagree with the comments regarding distraction and focus for online and blended learning environments.

In my field, online is not a distraction per se, but something that is necessary for app development (think StackOverflow and IDE documentation!). It reinforces what I'm demonstrating and lecturing about, and encourages students to research and think outside of the box. For example, I actually expect students to Google topics and documentation while I'm teaching online, and this process is both motivating for students and key to being successful in my field.

<comment><USER31> We do High School CompSci without the internet (for our intro course). I do see the internet as a distraction at this level. Forcing young students to think through the logic of a problem and come up with their own solution (no matter how crazy or inefficient it is) has a lot of downstream critical thinking benefits.

</comment></comment><comment><USER32> Sadly I haven't had many teachers as described in this article in my university career.

I believe those teaching skills will eventually have to move to remote. The teachers who adapt fastest will be the most successful.

Any good examples for great remote teachers (beyond great presentation)?

</comment><comment><USER33> I think it's a bit disingenuous to call the rushed switch to online learning during a pandemic a failed or sub-par experiment, as I've seen in the WSJ.

The slapdash system we cobbled together on the fly while trying to figure out if we were dying doesn't hold up against the decades old, well tested and vetted in class educational experience? It would be problematic if it did, wouldn't it? It would mean we were completely wrong about the best way to educate.

The biggest note I see from this is that maybe it's not a great idea to force children to sit still and "learn" for 8 hours a day. If the only way for that technique to work is to have them physically controllable, something might not be working.

</comment><comment><USER34> While I agree that classroom teaching has advantages, and am not trying to argue the points from the article... online learning is not limited to just what happens on video calls. That would be like saying that daily standup meetings are not the best environment to code in. Of course not. That isn't the point. They are about giving new information and coordinating, then letting go off to do their work. Online learning is the same - give info, coordinate, then students go off and do their work. It cannot be compared directly to 6 hours in a classroom because they are fundamentally different methods of working. They both have pros and cons.

</comment><comment><USER35> Just like shoehorning traditional office work into a remote setting doesn't work, you just end up with various forms of online butt-in-seat monitoring while losing all the benefits of asynchronicity, perhaps remote learning needs to be fundamentally rethought for the new medium. What would a remote-first learning experience look like? Probably more like a Khan Academy course than a real-time lecture, with the student-teacher time dedicated 100% to helping and interacting with students instead of going through new material.

</comment><comment><USER36> _" I'm a classroom teacher and I'm totally not obsolete, here are talking points on effective teaching methods, which only a person like me can perform!"_

I don't buy it.

I didn't pay attention in class for most of my school time and that was before any of the more modern distractions existed.

To do well in school, you need to:

1\. Capture and memorize factoids that will be on the test

This _can_ be done the roundabout way by taking notes, which does help with memory retention. It's however far more efficient to just copy other more diligent people's notes and memorize those.

2\. Understand mechanisms and systems

This requires you to work on your own, try things, figure things out, getting error feedback. Schools are notoriously awful at this, with 20+ kids you just can not spend the time to give meaningful advice, to give enough feedback in a timely manner. You send kids home with homework and they get results a day later or worse. The kids that do really well here usually get help from parents/siblings/externals.

Neither of these require teachers to do any classroom work.

Of course, there's the whole social and daycare aspect of schools which can be beneficial or oppressive, depending on the teachers and environment. Let's just not pretend that actual learning needs a classroom environment, or that it's _better_ in classroom environment, because we don't actually know that yet. Classroom teachers talking their book doesn't help.

<comment><USER37> A teacher's job, if they're doing it right, is not to provide continual feedback to 20+ kids, but to create a space which focuses them on learning a particular skill or achieving a particular goal. Kids learn best when working with other kids, usually by modeling one another and taking the best bits as they go. It's continual exploration with an expert on hand to help when they get stuck or see some basic skills training.

<comment><USER38> I think part of the reason teaching is the way it is currently is because if you create that space for kids to work with other kids then anywhere from 20-60% of them will slack off or disrupt others. Not that it doesn't happen with the current system but it's less visible.

<comment><USER36> Like you say, it's not visible. We are forcing _children_ to sit idle and pretend to listen to the teacher, which is an entirely unnatural thing for to them to do for several hours per day.

I would argue that children would actually learn a lot more social skills by interacting in this "disruptive" and "slacking off" kind of way, especially nowadays where children are otherwise locked up at home by overprotective parents. Those skills are far more valuable than whatever trivia the curriculum is mostly made up of.

<comment><USER38> Increasing break times I think would have a better effect at improving children's social skills. Perhaps it's a difficult pill for educators to swallow that the most important skill children learn at school doesn't involve them.

</comment></comment></comment></comment></comment><comment><USER39> I think this is true, and i agree. However, institutions of (higher) learning have transformed into giant scams and money sucking administrative monsters, whose function is gatekeeping rather than education. As a response to this trend, online education is an excellent antidote for a fraction of the cost.

</comment><comment><USER40> I don't teach, but I wonder why people use Zoom and not BigBlueButton, which at least was made for the job. It also presumably doesn't have whatever the privacy implications are with Zoom that students have to accept.

</comment><comment><USER41> I've been teaching in person and had to transition online during COVID-19.

I agree with all of his points that going online can degrade the experience.

 __but __all of this pre-supposes what it means to teach and what it means to learn.

Some comments mention children, but the OP is a Yale law professor. Seems like esp. higher ed needs to be a little more open minded in their thinking going forward given the circumstances.

> it's important to acknowledge what online learning misses.

It seems to me that by only describing how a zoom meeting is lacking vs. an in person classroom he's missing what an online learning environment is capable of creating.

A lot of his arguments seem to be centered around grabbing and holding someone's attention in a digital environment, which I also empathize with, but I think some things can also be a symptom of an educational system whose purpose is not always actual learning- i.e., is the purpose of grade school educational, or is it day care for working parents? Is the purpose of yale law school learning about law or is it to serve as a gate keeper in the legal profession? etc.

When the whole reason people are sitting there has not much to do with what you're trying to convey, it's no wonder they have trouble paying attention.

That being said, if students are interested and expectations are aligned, some things that I found that some things were actually improved upon in a digital setting: (specifically I teach at a coding bootcamp)

\- one-on-one teaching can feel _more_ intimate and effective, (as in a zoom breakout room) since you are not speaking to that student in the classroom where others can overhear or that you don't also have to speak to the whole class at the same time. Sharing someone's screen feels more like you are right there with them.

\- the asynchronous nature of doing things online means that people can come more well prepared vs. having to have everyone in sync in a classroom all the times, in real time.

\- it's logistically simpler to not ask 30 ( 50? 100?) people to all gather in the same physical location at the same time. I suppose this is obvious, but when you stop to consider this, physically transporting yourself somewhere else is, at best, tangentially related to learning something.

\- also obviously, it's easier to convey certain things on a screen than it is in person speaking / on a white-board. Specifically I mean being able to focus in on a diagram or example. On a projector or on a white board you simply become limited by real estate that you get back on a whole screen.

(edit: formatting)

</comment><comment><USER42> I can agree that Zoom is not the best format for classes, but that doesn't mean classes can't be online and working perfectly.

For me there is so much room to innovate in EduTech!

Why always trying to go back to the past form of tradition instead of being the engine of innovation.

There are plenty of talented people here, that are currently reading HN, so instead of saying please get my physical classmate, ask for change in the cyber world, you should be served well ;)

<comment><USER37> The article isn't saying that classes can't be online, just that the medium doesn't work as well when employing certain teaching techniques.

</comment></comment><comment><USER43> On the flipside, this serves as a demonstration for what is good teaching practice. The classes that suspiciously see no change go to show you can't scribble on a whiteboard and call it a day.</comment>


Latest Facebook bug exposed up to 6.8M users' private photos - <AUTHOR> https://www.digitaltrends.com/computing/facebook-expose-68-million-users-private-photos/ <comment><USER2> [https://news.ycombinator.com/item?id=18681772](https://news.ycombinator.com/item?id=18681772)

350+ points</comment>


Memory and Native Code Performance - <AUTHOR> http://www.infoq.com/news/2013/06/Native-Performance <comment><USER2> _Reading a single 32-integer from the L1 cache takes 4 cycles. The L2 cache takes 12 cycles, the same amount of time it would take to calculate the square root of a number. The L3 cache takes more than twice as long, 26 bytes. Reading from memory takes far, far longer._

I guess this is true, but it's sort of misleading. Adding some details as I understand them:

1) On Sandy Bridge, a read from cache takes the same amount of time whether you are reading a single byte or a 32 byte AVX vector. That said, it is often faster though to read integers individually than to read them as a vector and split them.

2) While the L2 latency is comparable to taking a single square root, if using an XMM register, you can also take 4 square roots in the same number of cycles. Viewed this way, if you can use SIMD, you could consider each square root to be comparable to an L1 hit.

3) For DDR3-1600 10-10-10 (current fast standard) a read from main memory will take 12.5 ns to start returning data. At 4GHz, this is 50 CPU cycles. DDR3-1333 10-10-10 is 15 ns --- about 60 cycles. This is about twice as long as a read from L3: longer, but not "far, far longer".

[Note to author: s/26 bytes/26 cycles/]

</comment><comment><USER3> I'm a decent coder but don't know about anything near the metal.

Is there a good introductory resource for learning about low-level details like the ones discussed in the post?

<comment><USER4> Try Drepper's (of GNU library fame) _What every programmer should know about memory_.

[http://www.akkadia.org/drepper/cpumemory.pdf](http://www.akkadia.org/drepper/cpumemory.pdf)

Slightly dated but still excellent introduction.

</comment></comment><comment><USER5> And this why -Wpadded is always a useful clang/gcc flag to enable when doing optimisations

</comment><comment><USER6> summary of this and every other article: make sure you're doing sequential scans in your tight inner loop, and ideally also exploit memory alignment and cache sizes while you're at it.

</comment><comment><USER7> I don't understand the "Multi-core effects" one. Surely the linear memory scans in c[i] = a[i] + b[i] will result in cache prefetch and thus be limited by memory bus bandwidth and not cache size?

</comment><comment><USER8> I suspect that a better matrix multiplication algorithm would have a much more dramatic effect on performance than improving the memory access pattern:

[https://en.wikipedia.org/wiki/Strassen%27s_algorithm](https://en.wikipedia.org/wiki/Strassen%27s_algorithm)

Constant factor improvements are great, but asymptotic improvements are better.

<comment><USER9> You should benchmark, but you are probably wrong. The whole talk was about how hardware (i.e. memory accesses) matters. Even the Wikipedia article you linked to suggests this.

"Earlier authors had estimated that Strassen's algorithm is faster for matrices with widths from 32 to 128 for optimized implementations. However, it has been observed that this crossover point has been increasing in recent years, and a 2010 study found that even a single step of Strassen's algorithm is often not beneficial on current architectures, compared to a highly optimized traditional multiplication, until matrix sizes exceed 1000 or more, and even for matrix sizes of several thousand the benefit is typically marginal at best (around 10% or less)."

<comment><USER8> Sure, but that benefit will become increasingly large as the problem size is increased. Benchmarking should be done, of course, but only as a way to determine _where_ Strassen's algorithm begins to dominate. Note also that that quote supports what I said, at least in the limit: Strassen's algorithm _does_ improve performance more dramatically for large problem sizes (though how much more dramatically is certainly debatable).

I am not going to deny that hardware matters, but it is important to know _where_ it matters. Hardware matters in terms of constant factors. For sufficiently large problem sizes, hardware might give you a 10x improvement if you use it correctly -- but that is 10x no matter how large the problem size becomes. An algorithmic improvement will become increasingly beneficial as the problem size increases; that is why we speak of things like "crossing points," where an asymptotically faster algorithm begins to dominate. Even very poor use of hardware features (terrible locality of reference, etc.) will eventually be irrelevant for an asymptotically better algorithm; a large number of really good uses of the hardware is still slower than a small number of really bad uses.

<comment><USER10> Sometimes the problem size doesn't increase. Sometimes you maybe just need to do lots and lots and lots and lots of small matrix multiplications.</comment></comment></comment></comment>


C11: A New C Standard Aiming at Safer Programming - <AUTHOR> http://blog.smartbear.com/software-quality/bid/173187/C11-A-New-C-Standard-Aiming-at-Safer-Programming <comment><USER2>
        //C11, safe version of strcat
        errno_t strcat_s(char * restrict s1,
                         rsize_t s1max,
                         const char * restrict s2);

_strcat_s() copies no more than s1max bytes to s1. The second function, strcpy_s() requires that s1max isn't bigger than the size of s2 in order to prevent an out-of-bounds read:_

        //C11, safe version of strcpy
        errno_t strcpy_s(char * restrict s1,
                         rsize_t s1max,
                         const char * restrict s2);

_Originally, all of the bounds-checking libraries were developed by Microsoft's Visual C++ team. The C11 implementation is similar but not identical._

There are so many problems with this. Yet another slightly different string manipulation function? Why not standardize on one of the already existing ones, such as strlcat/strlcpy? I can see people making some big mistakes with strcat_s, since the size passed is the number of unused characters left in s1, not the size of s1. And strcpy_s can cause a segfault if given an s1max that is greater than the size of s2. Why not only copy up to the first null character?

Also, these functions have the same name as the VC++ functions, but behave differently. In VC++, strcat_s takes the size of s1, not the space remaining. People are going to google for strcat_s, read the MSDN docs, and unknowingly add buffer overflows to their code.

Finally, these functions have annoying behavior. If they hit the limits passed to them, they erase s1. No best-effort. No copy whatever fits. Just destroy the data in the destination string.

strlcat/strlcpy solve all of the problems I've mentioned. See <http://www.courtesan.com/todd/papers/strlcpy.html> for more info about them. It's sad to see them only supported by *BSD and OS X.

<comment><USER3> strlcpy is flawed. And often times silent truncation is not a "best-effort", but a huge hole. This is especially so when strcpy is blindly replaced with strlcpy. For new code, strlcpy is flawed.

<comment><USER4> Ulrich Drepper? Is that you?

There are valid reasons not to use strlcpy, but we need something like it. What we do not need is this _s shit, which has all the same problems (which sometimes matter, and sometimes don't) WHILE BEING MASSIVELY HARDER TO USE. And what's the advantage? Just that it returns an errno. That's fine, but what about the rest of it? Just read the instructions for it - it's crap! (I can imagine why they think they want it to work this way, because it gives you a fighting chance again non-0-terminated source strings, but it's just never going to work properly if you've only got one size argument.)

Using strlcpy, by contrast, is simplicity itself.

About 99% of the time when you're using strlcpy (and strlcat), you can just do your calls, passing the same size value into each one (how convenient), then check the length of the result using strlen. Is it one less than the size of the buffer? Yes? Then assume there's an overflow, and disregard the result, assuming you even care about that. This is very straightforward to do, and (unlike this _s junk) doesn't require you to go updating counts or checking maximum values or any of that error-prone nonsense. Just one check at the end, rather than a bunch of updates and stuff scattered all through your string code.

strlcpy! Just say yes!

<comment><USER5> As far as I'm aware Ulrich Drepper hates strcpy_s just as much as everyone else does. Certainly glibc had no plans to implement it when last I checked.

</comment></comment></comment></comment><comment><USER6> The big problem with C99 was that MS refused to implement it. If C11 is going to take off, it will depend on MS updating their C compiler. Previously they have said that they don't support C development on Windows except on the device driver level, and would prefer everyone use C++ or one of the .NET languages, so I'm not hopeful about C11's chances.

<comment><USER7> I'm not seeing this as much of a problem. Windows is a dying platform because of a multitude of bad decisions like these. If they choose not to implement it, less software will be made for Windows, accelerating its demise.

<comment><USER8> People will continue writing software for windows for as long as it remains the dominant platform. What happens is that they'll use other languages such as C# (which is perfectly fine for them)

<comment><USER7> Of course people will continue to write software for the platform. I never said otherwise.

But there is a ton of software being written right now that doesn't target Windows, with no plans to target Windows. The only way Windows users will ever be able to use that software is if Microsoft makes it easy enough to port.

The nail in the coffin will be when most of the games on Steam do not work in Windows. With most business software becoming web-based, the only holdouts left will be old businesses locked into their enterprise crapware.

</comment></comment></comment></comment><comment><USER9> The removal of variable-length arrays is the main thing from C99 I miss in C11 (though it seems compilers can continue to support them if they wish). Imo they're fairly elegant in many scenarios, and without them, C programmers tend to make heavier use of magic #define'd array sizes in order to retain the notational convenience of auto arrays.

<comment><USER10> I write C for a living and I've never ever used that feature. I don't think I've seen it used outside of C99 tutorials as well.

Can you give us a practical example of some code where variable-length arrays prove really useful?

<comment><USER11> Variable-length arrays are great for printf-like functions.

<comment><USER12> How so? Do you mind giving an example of a printf like function that needs variable length arrays?

<comment><USER11> I wouldn't call it a "need", more like "occasionally desirable". The short version is that it's a convenient method of letting the compiler handle resource management when you have a variable number of values and sufficient stack space. As others pointed out, it's particularly handy for multi- dimensional arrays.

There are also some possible applications here: [http://gustedt.wordpress.com/2011/01/13/vla-as-function- argu...](http://gustedt.wordpress.com/2011/01/13/vla-as-function-arguments/)

In fairness, I've used them only rarely, but those few times I've used them have saved me a bit of grief.

I could easily live without them if required...

</comment></comment></comment></comment></comment><comment><USER13> I am not excited about any of the new features ( except many aligned_malloc) and I write C for a living. I think you get to a point with a language with C where I actually _dont_ want much change everything works just the way it is and we have dealt with its warts for decades. I am actually a little leery of the thread additions and the atomic additions. I feel that shouldn't be a part of the language specification and I would much rather see that incorporated at a higher level.

<comment><USER14> Presumably you are familiar with Boehm's famous "Threads Cannot be Implemented as a Library" [1]. Meanwhile, pthreads require heavyweight OS involvement and implementing a simple spinlock requires inline assembly or non-portable compiler builtins. There is still no widely-used portable library of atomics (the Linux kernel is the most complete I know of, but their atomic support isn't trivial to extract for use outside the kernel, and it was only written for one compiler (gcc)). I'm definitely looking forward to stdatomic.h. Unfortunately, compilers are already mis-applying [2] the macros that are supposed to be available for determining the presence of thread and atomic support, so, as usual, configure tests are needed for everything.

[1] <http://www.hpl.hp.com/techreports/2004/HPL-2004-209.html> [2] <http://gcc.gnu.org/bugzilla/show_bug.cgi?id=53769>

<comment><USER15> Widely used, not yet.. but meet <http://concurrencykit.org/>

<comment><USER14> That's an interesting project, but it doesn't qualify as portable yet since it's currently entirely dependent on gcc inline assembly syntax and doesn't support a number of important architectures, including ARM. Thanks for sharing though, I'll keep an eye on it.

<comment><USER15> It is _portable_. It's not intensively _ported_ yet: Archs: Power, SPARCv9, x86, x86-64 Compilers: gcc, clang, icc, suncc

Adding a wildly different compiler shouldn't be the end of the world but it would need some build sys work and a new compiler wrapper.

Samy was focusing on a few archs that help debug the code. I got him access to the GCC build farm, but the ARM boxes there were fairly weak when I remember. Access to good hardware might help him move it along.

</comment></comment></comment></comment></comment><comment><USER16> It's been a while since I used C very much, but news like this plus the great new _21st Century C_ , <http://shop.oreilly.com/product/0636920025108.do> from Ben Klemens and O'Reilly has me reconsidering that. That book says those who complain the standard doesn't do enough should look at POSIX and libraries like GLib for help.

</comment><comment><USER17> I find it interesting that this snuck up on me. I heard dozens of things about C++0x for years before it happened, but this seems like its already been published and this is literally the first I've hear of it.

<comment><AUTHOR> The article is about C (as in C11 standard) and not about C++ (as in C++11).

<comment><USER18> Which is exactly what the OP is talking about. There was a lot of buzz about C++11 before it was released, yet there was very little buzz about C11 (or at least, not something the OP noticed).

<comment><USER5> While the C++ community is gossiping about language features, the C community is busy writing software to get things done. =)

<comment><USER19> While this is flippant (and amusing) there's an underlying truth here somewhere - I've really not met many C programmers who care about new language features.

C++ folks do seem to care a lot about which features of boost are going to be folded into the language spec and runtimes and what else has been dreamt up for their baby, and how they're going to be able to be more efficient, safer and gosh-darnit just all-round smarter in future.

C programmers mumble something about being busy and already having the tools they need to do everything, though (grudgingly) that VA_ARGS preprocessor extension from '99 was quite handy I suppose...

(I'm a C programmer by trade and history, working on C++ at the moment, just in case I pissed anyone off enough to start a holy war :)

</comment></comment></comment></comment></comment><comment><USER20> It's sad that C99 was never widely adopted. It's 2013 and MSVC still doesn't implement it. I really like the constructs that were added, especially with regard to named structure and array initialization. It manages to make programming in C just that little bit friendlier, more powerful and less over- verbose.

<comment><USER5> It's not clear what you mean by "never widely adopted". With the exception of MSVC, are there any mainstream C compilers that don't _try_ to follow the C99 spec?

<comment><USER21> Microsoft doesn't make a C compiler. They have a C++ compiler that can also compile C90.

</comment></comment></comment><comment><USER22> "Finding C99-compliant implementations is a challenge even today."

"Originally, all of the bounds-checking libraries were developed by Microsoft's Visual C++ team. The C11 implementation is similar but not identical."

Picking a nit, but shouldn't this say "The C11 _standard_ ..."? If C99 implementations are hard to find, I'd think it would be more so for C11.

Are there any C11 implementations? Or do you just pick the implementation and libraries that implements that largest set of C11 that are important to you?

<comment><USER23> Clang supports some parts of C11, see <http://clang.llvm.org/docs/LanguageExtensions.html#c11> for details.

</comment></comment><comment><USER24> Restrict is part of the C99 standard

</comment><comment><USER25> Geez, is there a single non-troll comment on that website?

<comment><USER17> Smartbear make code review tools; I wonder if their audience really really likes to nitpick things.

<comment><USER25> I was referring to the anti-C comments on the linked article, but I think it came off like I was criticizing the whole website.

</comment></comment></comment><comment><USER26> Might as well just use Go.

<comment><USER27> You can use go where you use python, ruby and maybe some of the things that get done on c++. But not being C friendly , and with a GC.. for the things people still use C and C++ these days.. probably even if you want to use Go, you wont be able to..

If the guys from plan9 just get the Ken Thompson C compiler from plan9 and changed that C just a little bit, taking care that a plain C header could be added to that code the same way we could do with C++

only then, it would be possible to "just use Go" (plan9 C can be used with gcc using "fplan9-extensions")

<comment><USER8> Loved the direct struct assignment. Is it plan9 only?

<comment><USER27> Do you mean, using anonymous structs for struct composition? you can do something similar with "-std=c11 -fms-extensions"

The only thing it will be missing from plan9 c will be the automatic casting from the composition to the base struct.. but its just to cast to the base struct when you need to reference only the parent struct, polymorphism. (Ken Thompson called this effect as "Poor man classes")

Macros can be handy when you need to hide this nasty castings away when not using the plan9 extension..

the nice thing about "-std=c11 -fms-extensions" is that it works with gcc, clang and vc.</comment></comment></comment></comment>


Towards a dynamic multiscale personal information space (2020) [pdf] - <AUTHOR> http://vis.csail.mit.edu/pubs/towards-convivial-info-space.pdf <comment><AUTHOR> A visionary paper synthesizing Alan Kay, Bret Victor, and recent research in visualization and computational notebooks. "Rethink[ing] the nature of information".</comment>


Ask HN: What are the comp sci kids excited about today? - <AUTHOR> I believe it was Naval Ravikant who said mass market innovation usually comes from what the comp sci / engineers are excited about 5-10 years ago.<p>So what are the computer scientists / engineers excited about today? <comment><USER2> Excited about getting all of our lab computers wannacry'd because of poor patch management resulting in a weeks vacation.</comment>


Show HN: Haskell-like Enum in Scala - <AUTHOR> https://github.com/izeigerman/scalanum <comment><USER2> Scala 3 will include emuns as a language construct [1], but that will probably not be released before 2019.

[1] [http://www.bigdatarepublic.nl/key-takeaways-from-the- scala-d...](http://www.bigdatarepublic.nl/key-takeaways-from-the-scala-days- keynote/)</comment>


An Open Source, Self-Hosted Heroku - <AUTHOR> http://www.bitmatica.com/blog/an-open-source-self-hosted-heroku/ <comment><USER2> I just migrated a hobby website to Dokku, which also markets itself as a self- hosted Heroku. I was curious how Flynn compared. Fortunately, there was a blog post giving an overview[1]. I get the impression that Flynn has all the benefits of Dokku, but has the ability to scale to multiple servers. It seems like Flynn is obviously better than Dokku, so I guess I get to do that this weekend.

Keeping up with new containerization tech is starting to feel like keeping up with new JS frameworks/tooling...

[1] [https://flynn.io/blog/upgrading-from-dokku-to- flynn](https://flynn.io/blog/upgrading-from-dokku-to-flynn)

<comment><USER3> I think a lot of us feel your same pain.

Has anyone had success with sticking to Dokku for small side projects on DigitalOcean/Linode/etc?

<comment><USER4> I've had success going from heroku to Dokku on DO. Pricing is pretty much the same and Heroku has mature features so I may switch back at some point.

<comment><USER5> Are you saying Heroku costs are the same as Dokku on DO? How so?

<comment><USER4> My app is very small. Typical charges on a $7 hobby dyno were $3-$6 per month. DO is $5 for the droplet.

</comment></comment></comment></comment></comment><comment><USER6> This is a great overview of the kubernetes/self-hosted PaaS landscape, but is also clearly a bit of marketing for Flynn. Flynn looks awesome, but also as/more awesome at a glance from my research and test runs is [https://github.com/convox/rack](https://github.com/convox/rack) which I got closer to working more quickly than Flynn, though it helped that Convox builds on top of docker-compose.yml files, which we were already using for development.

For better or worse, we're going the full kubernetes route though, and still working out what deployment etc looks like. So far a lot of un-DRY looking YAML files have inspired a spike at a tool to help manage creating and maintaining kubernetes yaml[1], which others reading this are welcome to try and I'd love to hear better alternatives to or get feedback/pull requests/etc. I may push up a branch I'm working on later that partially automates creating deployments from a Procfile, but we discovered having seperate Procfiles may make applying env-variable only changes harder, curious to hear if others have any guidelines on that, it's so easy to edit an ENV var on Heroku we took it for granted.

[1] [https://github.com/stellaservice/ky](https://github.com/stellaservice/ky)

<comment><USER7> I'd love to hear about any trouble you ran into while trying Flynn so that we can fix it! Feel free to send me an email: email@example.com

Convox is a great pick if you want to use AWS-specific services for your entire stack. Instead of using portable open source components, Convox uses AWS services wherever possible, and acts as a lightweight coordinator to combine them into a platform.

Flynn has no external dependencies on cloud features, so you can run it anywhere, whether that's on your laptop, AWS, Google Cloud, a VM somewhere, or bare metal in a colo or private datacenter. We also include RDS-like highly available database appliances so that your whole stack is portable and you are not locked into a single hosting provider.

edited to add: We didn't know about this post until Bitmatica posted it, this is just a great post from a happy user, not planned Flynn marketing!

<comment><USER6> Yeah, definitely think you guys are both top notch projects, but the article focused on you guys as the end solution and mentioned so many other things en route, I felt people should see one of the other high profile contenders, though forgot to add it was AWS only (added below). It's been a few months now since I kind of timeboxed an hour or two to play with each of 3 I narrowed down to as most likely to offer the easiest transition off of Heroku without being single node like Dokku (you guys, Convox and Tsuru were the 3 I think I tried, and got furthest with and was most impressed with Convox and Flynn). It wasn't a totally fair comparison, as I think I ran Flynn and Tsuru locally via Vagrant, because I could for both I think, but had to actually use real AWS for Convox... but this was all just because I was hoping to make a case at work that we should try one of these actual PaaS-like solutions rather than go for a non-PaaS solution like Kubernetes, as I knew it would not be a trivial transition, as the articles' author discovered. If I ever have time to try it again I'll try and go a little further and provide feedback if I have any!

<comment><USER7> Awesome, thanks for the feedback!

</comment></comment></comment></comment><comment><USER8> As someone who's been using flynn in production for a month or two, some things to be aware of. (Devops is not one of my strongpoints, so keep that in mind)

You want to use an external blob-store, by default it uses its own postgres to store them. However, it also doesn't do any garbage collection, so we ran out of HD space on our cluster, causing postgres to go into read-only mode. This prevented us from pushing updates / changing any app-config settings ( ENV, Scaling, etc ). Thankfully we were hosting our own DB off-cluster or that too would have been read only.

The default limits on memory is 1gb, and for our app, when it runs out, it just crashes. Leaving no obvious error messages to be found.

Obviously RTFM as well, (especially this part [https://flynn.io/docs/production](https://flynn.io/docs/production)) we had some other issues that could have easily been prevented.

Huge shout-out to the team that hangs out in their IRC channel, they were a massive help in solving the problems we've came across.

Using it when it works is lovely, we switched off of heroku recently and its been a very similar experience.

<comment><USER7> > You want to use an external blob-store, by default it uses its own postgres > to store them. However, it also doesn't do any garbage collection

The lack of garbage collection by default will be fixed in next week's stable release, we're really sorry that it caused you pain!

> The default limits on memory is 1gb, and for our app, when it runs out, it > just crashes. Leaving no obvious error messages to be found.

Indeed, we're working on documenting this and exposing out-of-memory events in the app logs so that this is obvious.

<comment><USER9> Good luck with the out-of-memory handling. From personal experience, that's easier said than done.

<comment><USER7> Here's the issue tracking this: [https://github.com/flynn/flynn/issues/3375](https://github.com/flynn/flynn/issues/3375)

</comment></comment></comment></comment><comment><USER10> "However, a primary goal of our solution was to automate the process of going from code in a repository to a deployed application in our cluster — much like Heroku. Kubernetes did not appear have any mechanism to support this type of workflow, nor a handful of other features we had hoped to find."

Just in case someone is feeling the same, deis[1] is providing exactly this. I did not try their software but I've read a lot of positive about them in the last time.

[1] [https://deis.com/](https://deis.com/)

<comment><USER11> I've been using deis in production for ~4 months. It's been great! If I can fit something into a buildpack it's fast to iterate, for more complex concerns you've got the kubernetes backing it up.

</comment></comment><comment><USER12> I run flynn as a local staging/CI service in our networking closet. It allows us to rapidly try out new apps/services in an environment that approaches production on a couple of machines we had lying around super quickly.

There are still a couple of rough edges, specifically around upgrading and persistence across power failures, which is unlikely in a datacenter, but aside from those things, all in all excellent.

In particular, though, the flynn.io team are particularly excellent in terms of support.

<comment><USER13> > In particular, though, the flynn.io team are particularly excellent in terms > of support.

Seconding this. I've had many (like 10 or 20) very positive experiences with them, where I went from "OMG WORLD IS ON FIRE" to "oh, sweet, I just delete this row in postgres?"

</comment></comment><comment><USER14> We at Globo.com[1] are using docker in production before it was considered ready for prod, with tsuru PaaS, as some features in tsuru(like self-healing) made docker easy to handle, manage and scale containers. Tsuru has more than 4 years, it's really stable and reliable, we are attending huge traffics in a large number of apps and it has lots of important features like multi cluster(pool), metrics, auto scale, granular in relation to permissions of users, etc. We are investing a lot in this project as anyone can see in our repo[2] and we changed completely the way devs, (dev/)ops and product people worked here. Tsuru was already easy to install(all in one VM[3,4]), and now we have an experimental way[5] to make it in all IaaSs supported by docker machine.

[1] Globo.com is the internet arm of Globo Group, the biggest broadcast television in Brazil and second in the world [2] [https://github.com/tsuru/tsuru](https://github.com/tsuru/tsuru) [3] [https://github.com/tsuru/tsuru-bootstrap](https://github.com/tsuru/tsuru- bootstrap) [4] [https://github.com/tsuru/now](https://github.com/tsuru/now) [5] [https://docs.tsuru.io/stable/experimental/installer.html](https://docs.tsuru.io/stable/experimental/installer.html)

</comment><comment><USER15> Since there are some Flynnsters hereabouts: do you run buildpacks unmodified? How do you deal with fully disconnected environments?

I work on Cloud Foundry buildpacks, several of which are downstream from Heroku's. So I'm professionally interested in seeing another perspective on how to drive them.

<comment><USER7> Yeah, we ship unmodified Heroku buildpacks, plus one Cloud Foundry buildpack ([https://github.com/cloudfoundry/staticfile- buildpack](https://github.com/cloudfoundry/staticfile-buildpack)).

So far no one is using Flynn in a fully disconnected environment, and we're aware of this limitation. My take on this is that we need a replacement for buildpacks that allows for repeatable/functional builds (think Nix for app deployment).

<comment><USER15> I see, that definitely makes it easier. The Heroku code (quite reasonably) assumes 100% connectivity.

One gotcha: if you are snapshotting images after building, your images are not truly reproducible. Heroku occasionally swap out the binaries. This surprised once or twice. This is one reason we wound up building all our own runtime binaries[1].

When you get to disconnected environments, look us up. We built a whole tooling, compile-extensions[2], to make it pretty close to seamless. We intercept URLs and transform their either into our URLs or local copies of the files.

(edit: actually, you could just switch to the Cloud Foundry buildpacks, since they have an identical detect/compile/release cycle)

I agree that buildpacks are not the super long term solution. One area being explored by engineers at Pivotal and IBM is to give a buildpack-like experience to OCI layers[3]. I'm sure they'd be happy to work with you on this as well.

[1] [https://github.com/cloudfoundry/binary- builder](https://github.com/cloudfoundry/binary-builder) [2] [https://github.com/cloudfoundry/compile- extensions](https://github.com/cloudfoundry/compile-extensions) [3] [https://www.youtube.com/watch?v=DSTT0przx4g&list=PLhuMOCWn4P...](https://www.youtube.com/watch?v=DSTT0przx4g&list=PLhuMOCWn4P9io8gtd6JSlI9 --q7Gw3epW&index=47)

</comment></comment></comment><comment><USER16> I'm curious about any compelling reasons I should use something like Dokku or Flynn if I already prefer to manage my own infra with something like Ansible or Salt. Serious question, not a sarcastic rhetorical remark about this type of tool :)

<comment><USER7> Great question!

We designed Flynn to solve a bunch of the common problems around running apps in production.

This means that we're working full-time just on the automation and stability of your production environment. As you grow and scale, Flynn will scale with you and provide integrated features without any additional effort.

Here's an incomplete list of things that Flynn provides out of the box:

\- Automatic high availability. Everything in Flynn is highly available, as long as you are running three or more servers. Additionally, it's designed to fail gracefully, so even if there's a network partition or some hosts fail, everything will keep working if at all possible.

\- git push deployment, after installing Flynn you can run `flynn create && git push flynn master` and your app will be automatically built and deployed.

\- Polyglot apps. Want to deploy a Phoenix app written in Elixir? You can do that just by specifying the appropriate buildpack. Everything else works exactly the same.

\- Zero-downtime deployment with release management and easy rollbacks. If a new version or configuration variable causes the app to crash at boot, Flynn will automatically detect this and stop the deploy before any traffic hits it. Deploying new versions of the application does not cause user-visible downtime.

\- Easy app configuration. `flynn env set FOO=bar` rolls out a new immutable release with the configuration change. You don't have to edit any files, and you can roll it back later with `flynn release rollback`.

\- Built-in HA databases. `flynn resource add postgres` configures your app with a PostgreSQL database in a cluster that is highly available and already configured with replication and safe automatic failovers. You can do the same to get a MySQL or MongoDB database.

\- Automatic load balancing and TLS. Flynn automatically load balances HTTP and TCP traffic, and supports HTTP/2 out of the box. You can add a TLS certificate with a single command, and all changes to the routing configuration happen immediately without restarts or downtime. Want to send a subpath to a different app? You can do that in a single command.

I could go on and on like this, but you probably get the idea. Of course, it's probably possible to build every feature of Flynn that you want using your configuration management tool of choice, but that would be a huge amount of time not spent developing the actual applications that you want to deploy with it.

<comment><USER15> I work on Cloud Foundry, a competing system. Flynn is unarguably ahead in certain features (and vice versa, in my biased opinion).

I agree with the thrust of your comment here: rolling your own PaaS is _hard_. Just plain old hard. There's so much, _so damn much_ that you wind up having to do.

Before I worked on CF I worked in Pivotal Labs. I got to see various custom home-grown PaaSes. Some were brilliant. Some were terrible.

 _Every single one of them was a millstone_.

A lot of people don't realise it yet, but the Linux of our time has been written -- in the sense that nobody writes an operating system if they're not in the OS business.

I don't know if it's going to be Cloud Foundry, or Flynn, or OpenShift or some mix of these, but we have already passed the point at which it makes rational engineering sense for the 99% of engineers to build their own.

Disclosure: I work for Pivotal, the majority donor of engineering effort to Cloud Foundry.

</comment></comment></comment><comment><USER17> I looked into all the "Self-Hosted Heroku's" a few few months ago. One feature I found they all lacked is multitenancy, meaning that there is no security model in place to trust that you could host multiple pieces of code from different clients without them hacking each other.

I'm not talking about the deployment specifically, but rather isolating the code once it is deployed.

Am I missing something there?

<comment><USER12> Flynn's upcoming User/ACL model should cover multi-tenancy AFAIK.

<comment><USER7> Yeah, our security roadmap will get us to multi-tenancy eventually.

Due to the security posture of the Linux kernel, we won't recommend running untrusted code side-by-side on the same hosts as more sensitive workloads, but we plan to harden everything to the maximum extent possible.

</comment></comment></comment><comment><USER18> Looks like this is great project.

We are using powerful dedicated server to host multiple sites/apps like the way shared hosting providers do. Maintenance and upgrade is so painful, I am trying to move to something else.

I looked into Docker but seems things are still not stable. Another approach I am looking into is KVM virtualization.

Aactually, all I want is something like Heroku (but self hosted or German providers cause our clients are German and that's important) where we can host each app on it's own container.

So far, this meets all the requirements.

<comment><USER19> That's precisely what we wanted, and we tried a lot of different options. Flynn was the answer, definitely worth a try.

</comment></comment><comment><USER20> I don't compare Flynn with Heroku or Dokku. I compare it with Kubernetes.

When it comes to dev UX, I'd agree that Flynn's is better, though both are easy to use. But I'd point to Convox for great dev UX in something that deploys only to AWS, and that can use a dockerfile/binary artifact instead of git push (I've been a minor contributor to Dokku and Convox, using both in prod on a few different projects).

I mention k8s because "self-hosted" is mentioned in the title.

Personally, the main reason I've been doing personal projects in k8s over the past 6 months or so is that 1) it offers out-of-the-box container networking and dns-based discovery, and my side projects are all distributed software so it makes it easy to get nodes talking, and 2) minikube runs a cluster where I can actually scale my apps up and down and test out distributed software on my laptop similarly to how it will be deployed.

(I'm investigating using Weave's ECS AMI, so that I can also get container discovery and networking in Convox, because I love the Convox dev UX so very much. But I'm also thinking, more and more, about how I can automate a smoother dev UX for my k8s projects, because I also like being able to easily run a real cluster locally in minikube, and Convox can run locally but with only one instance of each app).

</comment><comment><USER21> Facing a similar situation a couple years ago, the solution I had pushed for was just for a few (3) dokku servers setup behind an nginx server as a reverse-proxy... the reason for multiple servers in our case was redundancy first, this split allowed us to do the exact same deploy to three servers, run tests, update nginx config then down the old version(s) of the apps.

Flynn and deis definitely seem interesting, as does the tooling that coreos and docker themselves are working on.

</comment><comment><USER22> I have been using Dokku for a year for personal side projects and it has been awesome. Each release brings good features, fixes bugs and in general improves it.

Setting up could never be easier (read [https://glebbahmutov.com/blog/running- multiple-applications-...](https://glebbahmutov.com/blog/running-multiple- applications-in-dokku/)) and the large number of plugins for databases is a huge plus.

</comment><comment><USER23> I would love to have something like AWS Lambda that can be self hosted on something like this or Flynn.

I know a lot of enterprises that are interested in using serverless arch (the framework serverless[0], not the literal definition of not using servers) but don't want to use AWS or other public cloud providers.

[0]: [https://serverless.com](https://serverless.com)

<comment><USER7> This would be great!

The open source Parse server ([https://github.com/ParsePlatform/parse- server](https://github.com/ParsePlatform/parse-server)) already works on Flynn, and we can't wait until someone implements an open source system like Lambda.

</comment></comment><comment><USER24> Is there a way to dynamically auto-scale hosts? One of my app has very bursty traffic, and would require scaling from 2 to 10 host servers and then back down over a period of several hours. I can't see this referenced in the docs? I can see you can scale processes but that's not increasing host resources available, right?

<comment><USER7> Flynn itself doesn't communicate with infrastructure APIs currently, but you could hook this up so that there is a base set of three servers that are always running and then an autoscaling group that watched your metrics or a schedule and added/removed servers.

I'd be happy to explain this more on IRC if you're interested (#flynn on Freenode).

<comment><USER24> Thanks for the reply. Is this something that you have planned in the future?

This aspect is a really big part of Heroku/AppEngine/Elastic Beanstalk and saves me a tonne of money each month due to the auto-scaling that we get (we're on AppEngine). Is there a reason projects like Flynn have not tackled it? Or is it just a question of time?

<comment><USER7> Yeah, it's definitely something we want to support in the future. Autoscaling requires building some components that are aware of and can communicate the underlying infrastructure APIs (AWS, GCP, Azure, DigitalOcean, OpenStack, etc.) combined with app/host metrics. It's just a matter of putting the implementation effort. We'll get there eventually.

<comment><USER24> Great stuff - thanks - good luck!

</comment></comment></comment></comment></comment><comment><USER25> Why not just use Heroku and actually build your product?

<comment><USER2> Sometimes I have hobby projects that need more than the free tier of Heroku. I get a lot more bang for buck somewhere like Vultr or Digital Ocean compared to Heroku.

The standard tier at Heroku is 512MB RAM for $25. Over at Vultr, I can get 2GB RAM for $20. I also get 45GB of SSD, so I don't have to pay for something like Amazon S3 to store uploaded files.

If you're building an actual product, I agree with you, pay Heroku and focus on building your product. However, there's a lot of people looking to host smaller projects that wouldn't break even financially if they used Heroku.

<comment><USER26> Since ~mid 2015, the Hobby tier for Heroku has been $7 / month, and since last month, includes SSL.

<comment><USER27> ...which is for hobbies, not businesses.

</comment></comment></comment></comment><comment><USER28> Take a look at dcos.io (Mesosphere's Data Center Operating System). DC/OS provides a lot of the missing features you're after:

\- Persistant workloads \- Fine grained ACL's for RBAC

They're also working on shipping a consolidated logging and metrics API in Winter of 2017 which will enabled users to get workload plus host-level logs and metrics into almost any log and metrics aggregation solution (in your case, ELK would be easy to ship to).

Best of all it runs on top of production proven scheduling software, Apache Mesos, which has wide community adoption and support.

</comment><comment><USER29> You should check cloudfoundry -> [https://cloudfoundry.org](https://cloudfoundry.org)

It's opensource, multi-tenant and widely tested (used) by big companies.

</comment><comment><USER30> Anyone have experience to how this compares with Deis (Workflow)? Last week I spent an evening getting a small cluster set up with kubernetes and deis. It looks to work very similar to Flynn.

<comment><USER7> When we started in 2013, the only open source scheduler available was Mesos and the ecosystem didn't have community efforts like Kubernetes, so we had to write our own components to build Flynn.

Flynn is designed to be an end-to-end solution for production deployment, and all of our components are created to work together. The whole system is self- bootstrapping and self-hosting, so installation is easy, and the same APIs are used to manage the whole platform as are used to manage apps deployed on it.

In addition to the twelve-factor stateless webapps that Deis Workflow supports, Flynn also includes highly available database appliances with safe, automatic failover (currently PostgreSQL, MySQL, and MongoDB with more coming in the future). We also have a bunch of security features coming over the next few months like Let's Encrypt support and flexible user authentication with 2FA and very granular access control.

If you don't need or want our database appliances and you are comfortable with Kubernetes and happy to install and operate it, then Deis Workflow is a good option. If you don't care about using Kubernetes specifically, Flynn is a good pick as it is easier to get up and running with.

<comment><USER15> > _When we started in 2013, the only open source scheduler available was Mesos > and the ecosystem didn 't have community efforts like Kubernetes, so we had > to write our own components to build Flynn._

I've taken to referring to this as "Not Invented Yet Syndrome". It's hard to base an architecture on a subsystem that doesn't exist.

</comment></comment></comment><comment><USER31> Is there any HIPAA story for Flynn?

You can do HIPAA on AWS yourself or use (expensive vendors). However both of these routes lose you the management/deployment abilities of things like Heroku/Flynn.

<comment><USER21> It seems to me, the security model needs to be similar to using EC2 itself... you probably shouldn't run apps for multiple clients on the same host instance, but you can run multiple services for the same client, and provision version upgrades on a given client.

The docker security sandbox has had a few issues, and probably should not run sensitive data for multiple partners on the same ec2 instance. ymmv though.

</comment></comment><comment><USER32> How would Flynn compare to Cisco Mantl [https://blogs.cisco.com/cloud/mantl- version-1-2-released-kub...](https://blogs.cisco.com/cloud/mantl- version-1-2-released-kubernetes-fully-integrated)? Mantl is Open Source, supports many Cloud platforms using Terraform including Openstack & virtualBox, schedules with Kubernetes & Mesos, etc, etc: all the buzz-words included :-)

BTW Met the Flynn team at 32C3, nice guys indeed.

</comment><comment><USER25> Did anyone checkout [https://convox.com/](https://convox.com/) \- which is a more direct alternative to Heroku?

<comment><USER33> I read some of the convox docs a while ago, and the idea I got is that it is an alternative, open heroku implementation which is nice but you're still locked to Amazon AWS (and its prices)

</comment></comment><comment><USER34> I too have been on a journey to create a heroku for myself. I finalised my system on using rancher + drone ci combo.

You can watch a video of my setup here: [https://www.youtube.com/watch?v=zxPB2v-tWvQ&list=PLjQo0sojbb...](https://www.youtube.com/watch?v=zxPB2v-tWvQ&list=PLjQo0sojbbxViGEbI_87SPXpb3neuVqDL&index=2)

</comment><comment><USER35> Anyone using Erlang/Elixir on Flynn? Will distributed message sending between deployed apps work?

<comment><USER7> Yeah, check out this blog post about how to deploy Phoenix: [http://nsomar.com/how-to-use-flynn-to-deploy-a-phenix- app/](http://nsomar.com/how-to-use-flynn-to-deploy-a-phenix-app/)

Distributed communication should work fine, feel free to ping us on IRC or GitHub if you run into any trouble or have any questions!

</comment></comment><comment><USER36> It isn't clear from the intro docs, but what OS's does Flynn run on?

The install guide mentions Ubuntu. Does it work on FreeBSD? Does it work on other Linux distributions from the Redhat family (fedora, centos, rhel, etc)

<comment><USER37> Currently Flynn clusters must be running a Debian based distro. Out of the box it works on Ubuntu 14.04 but you can get it to run easily on Debian or Ubuntu 16.04. It likely also works on RHEL based distributions.

The CLI can be installed on any Linux distribution, FreeBSD, Windows and OSX.

Disclaimer: I work on Flynn.

</comment></comment><comment><USER38> Curious if the folks looking for an "open source Heroku", whow found Flynn, also looked at open source Cloud Foundry... and what turned them off from CF.

<comment><USER39> I've been a part of running Cloud Foundry in production, both on-prem and in AWS. From a user (developer) perspective, it's pretty magical: throw an app at it, and it runs. On the infrastructure side, the footprint is huge and has a ton of moving parts. If you have an SRE-type team to keep it alive, and your organization is cool with major multi-tenancy, I'd say that it's good enough for now. If it's dev-run, or if you want tenant scoping (e.g. one CF instance per business unit, or other isolated kind of microservices) I would absolutely not recommend it.

They are working on more lightweight versions. CF is pretty "enterprise," with the good and the bad that entails.

</comment></comment><comment><USER40> Anyone have experience with DC/OS? It runs on Mesos, not Kubernetes, but in any case it seems very full featured.

[https://dcos.io/](https://dcos.io/)

</comment><comment><USER41> one more PaaS solution I found today - [https://hasura.io/](https://hasura.io/) built on Kubernetes and Docker. Thought this has some relevance here

</comment><comment><USER42> no autoscaling.

</comment><comment><USER43>
      { tldr : 'https://flynn.io' }

</comment><comment><USER44> TLDR: We tried getting something similar to Heroku up and running but we ended up going with a paid service that starts at 4299$/month.

<comment><USER7> Hey, I'm a co-founder of Flynn.

Flynn is entirely open source and BSD-licensed ([https://github.com/flynn/flynn](https://github.com/flynn/flynn)). You can run Flynn on any infrastructure without paying us anything.

The price you reference is for our Managed Flynn product, where we act as your ops team, operating a Flynn cluster for you and providing hands-on support for your apps and databases in production.

<comment><USER45> Do you have a comparison chart or something lining Flynn up against Azure/Heroku/Google App Engine somewhere?

I know it's probably not as feature-complete as those other PaaS's, but it would be great to get it at a glance.

<comment><USER7> The space is too complex to do a chart, as a bunch of details are not directly comparable.

Many people who choose Flynn are not directly comparing us to hosted platforms, as they want more control over their infrastructure (where they run it, lock-in avoidance, etc).

As far as individual features go, we are closest to Heroku (and maintain buildpack/runtime compatibility). However there are differences including our support for other databases (MySQL and MongoDB in addition to Postgres and Redis) and many other smaller things like HTTP/2 support.</comment></comment></comment></comment>