OpenSSL still riddled with bugs - <AUTHOR> http://www.ubuntu.com/usn/usn-2914-1/ <comment><AUTHOR> More issues with OpenSSL are discussed in this study sponsored by the German government: [https://www.bsi.bund.de/SharedDocs/Downloads/EN/BSI/Publicat...](https://www.bsi.bund.de/SharedDocs/Downloads/EN/BSI/Publications/Studies/OpenSSL- library/DocumentationOpenSSL.pdf;jsessionid=010AB4C20423F092DE8C483A2BC06807.2_cid286?__blob=publicationFile&v=2)

</comment><comment><USER2> bad title, it's the security notice and update instructions for the last batch of security issues found and solved in OpenSSL on Ubuntu ... See [https://www.openssl.org/news/vulnerabilities.html](https://www.openssl.org/news/vulnerabilities.html) for the (non distro specific) main list of security vulnerabilities that have been patched so far.</comment>


Highschooler's solution to charities' marketing - <AUTHOR> http://www.techwurk.org

<comment><AUTHOR> Explanation: Created by a group of high school students, techwurk pairs skilled students with charities in need of web or graphic design. The students get volunteer hours or scholarships, and the charities have the chance to put resources towards education, not corporations.</comment>


Ask HN: Do you do volunteer work? - <AUTHOR> Hi HN,<p>I'm a college student interested in spending some time doing weekly volunteer work.
What's your advice on some ways I can do that?
Does anyone volunteer regularly who wouldn't mind sharing their experience? Additionally, what are some ways to use a math / CS skill-set to impact my community in a positive way? <comment><USER2> I volunteer my time at my local FIRST high school robotics team. There are a lot of teams looking for mentors. [https://chiefdelphi.com](https://chiefdelphi.com) can be a good resource to find a team.

I find it extremely fulfilling teaching programming and controls to students. It's helped me grow professionally too.

</comment><comment><USER3> I understand your volunteer work goal may be to "use a math / CS skill-set to impact my community in a positive way". There are many ways you can use your skills. For example, you could start participating in a well established and valuable open-source project or take a part in hackathons solving big problems, you could organize workshops, teach people. Anything you do, remember to balance your volunteer work with other parts of life and career.

</comment><comment><USER4> I teach programming to kids, former Uber drivers, entrepreneurs, etc. Also training the people who teach programming.

I'm not sure if it counts as volunteering as they pay well, but it's still way below market rate and I only do it for the social impact. But it's been less impactful than expected - only one person has ever changed their life from it, which is why I stopped.

</comment><comment><USER5> I volunteer at the humane society in my county and its a ton of fun. The staff are caring and sweet, the other volunteers are amazing, and its fun seeing all the animals getting cared for. Surprisingly, its happy and sad to see them adopted. You are glad they have found a home, but you kind of miss them.

</comment><comment><USER6> >Additionally, what are some ways to use a math / CS skill-set to impact my community in a positive way?

You could volunteer at a code camp for underprivileged kids, or maybe tutor math for free for people who cannot afford it.

</comment><comment><USER7> I volunteered to teach two lessons on programming to two elementary classes for coding week this year. I have never done this before.

But if you have CS skills I think you could do the same. Just visit a local school.

</comment><comment><USER8> I volunteer on two open source not for profit projects, they're both legacy projects which would require huge amounts of work to completely modernise.

</comment><comment><USER9> Openstreetmap has lot's of work and challenges for (also) tech types. If you like maps :-)</comment>


Solaris to Linux Migration 2017 - <AUTHOR> http://www.brendangregg.com/blog/2017-09-05/solaris-to-linux-2017.html <comment><USER3> I'm ex-sun, kernel group. I'm retired, early at 55, but after reading Brendan's write up, I'd work for that guy. Holy smokes, he is all over it. Reminds me of me when I was in the groove. Brendan if you read this, I'm old school, not good at all the ruby on rails etc, but systems, yeah, pretty good. Not looking for money, looking for working with smart people, I can be paid in stock. If it works out, great, if it doesn't still great because I like smart people.

Sorry for making it about me, you all should read his post, it's someone who is completely in the groove, has breadth and depth, knows about systems. These people are rare, but hugely valuable when you need to scale stuff up.

<comment><USER4> If you are indeed interested in coming out of retirement, Brendan Gregg does performance engineering at Netflix. It might be worth reaching out.

[http://www.brendangregg.com/blog/2017-05-16/working-at- netfl...](http://www.brendangregg.com/blog/2017-05-16/working-at- netflix-2017.html)

<comment><USER3> I'm kinda old and burned out but thanks for the link. I'll reach out. It could be a boatload of fun.

<comment><USER5> It's even much more fun than described in this article, because Netflix mostly works with FreeBSD not Linux. So no NIH syndrom, proper dtrace (no eBFS hacks), proper ZFS, proper tooling, easy kernel maintenance.

<comment><USER6> As I've seen it described here before (by Brendan Gregg ?) Netflix uses FreeBSD for the CDN servers (streaming the video), and Linux for everything else, browsing Netflix, encoding, etc.

<comment><USER7> That's true, although he was right about the Linux counterparts. Reading this migration guide, at least to me, it seems that all Linux replacements for things like dtrace, ZFS, SMF, zones... are just subpar.

<comment><USER3> So I got a different vibe. I can't speak to how good all that stuff is in Linux vs Solaris (or BSD) so it's just a vibe. The feeling I got was it was someone who was extracting the best value out of the system he was using.

Which is refreshing, the constant whining about Linux vs $SOMEONES_FAVORITE_OS gets old. Very pleasant to have a "just the facts" pile of info. And I learned a few tools that I didn't know about.

<comment><USER7> Of course it is valuable, and being myself a Linux user, I'm glad somebody did the effort to get all those tools available for us.

However, I feel sad seeing the best tech from Sun going down the drain despite being open source.

<comment><USER3> I've been here before. I fought like crazy to prevent SunOS 4.x from being tossed on the trash pile. If you think Solaris going away sucks, it sucked harder (for me) to see SunOS go away. It was a far more pleasant environment than Solaris ever was.

As an example of that, because it's fair to go "what??!", I installed some open source solaris in the last few years to play with it. The default install was miserable, the tools were crap. I was having lunch with Bryan Cantrill and some of his team and I mentioned my negative reaction. They laughed and said you have to install the GNU tools and put that in your path first.

Say what? SunOS 4.x came with good tools. In /usr/bin. The default install was useful. Solaris was "standard" in that it came with all the System V stuff in /usr/bin. And Shannon and crew "protected" those standard tools and refused to evolve them to make them useful. They started sucky and stayed sucky all in the name of being "standard". Except nobody else used those tools. There was no other System V based Unix that had any significant volume. *BSD certainly didn't move to System V, Linux wasn't System V, the only System V Unix with any volume was Solaris. So they were standard for no good reason and all these years later Solaris still has crappy stuff in /usr/bin, you want /opt/GNU/bin or something.

Sorry for the rant, and it's off topic. Well maybe it's off topic, maybe not. I sort of wonder if Sun had shipped the GNU stuff and installed it by default as the real tools, would it have made any difference? Probably not but boy, do the default tools make a bad first impression.

<comment><USER7> > Sorry for the rant, and it's off topic

No, I always find it interesting to hear stories about people who worked for companies like Sun in the past.

Regards

</comment></comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER8> Nice article! Though I do think the article could have more clearly noted that Linux containers are not meant as security boundaries. It doesn't explicitly say it but it is a very important distinction.

Unlike FreeBSD jails and Solaris Zones. You can't run multiple docker tennant's safely on the same hardware. Docker is basically the equivalent of a sign which says: "don't walk on the grass" as opposed to an actual wall which FreeBSD jails and Solaris zones have. Now if you have a very homogene environment (say you are deploying hundreds of instances of the exact same app) then this is probably fine. Docker is primarily a deployment tool. If your an organization which runs all kinds of applications (with varying levels of security quality) that's an entirely different story.

<comment><USER9> There are dangerous things that you can allow Docker to do. But if you don't do those things, it is pretty difficult to break out of a container.

Redhat has been especially good here, with not allowing anyone but host-root to connect to Docker and using SELinux and seccomp filtering. With those working, it doesn't matter if your container mounts a host filesystem since it won't have the correct SELinux roles and types anyway.

Many people claim that ruins Docker, since now you can't use Docker from within Docker. But that's the price you pay for security.

I believe that with the correct precautions, a Linux container is just as safe as a jail or zone. Perhaps the problem is just how easy it is for a sysadmin to put holes into the containers that ruin the security.

<comment><USER10> > Perhaps the problem is just how easy it is for a sysadmin to put holes into > the containers that ruin the security.

I think there's a bit more to it than that. For some examples of other reasons people might be wary vs zones:

docker itself is still a daemon that runs as root, combining a large number of different functionalities which require root access into a single binary with a large attack vector and a lot of code which doesn't need to be privileged. While isolation of responsibilities of docker has begun, even their own security page [1] admits that there's a long way to go here.

Zones are, as many of the articles in this thread point out, a first class feature designed and implemented. What docker/"containers" allow you to do is the culmination of many building blocks which have been incrementally added to the Linux kernel. Some of those have been pretty recently, and without an overall design, their interactions with other portions of the Linux kernel or other components of the system have often been surprising and led to a number of security issues over time. In comparison, both the code and the design of the system are relatively young. A good example of this can be found at [2], which ends with the following very apt quote:

> Why is it that several security vulnerabilities have sprung from the user > namespaces implementation? The fundamental problem seems to be that user > namespaces and their interactions with other parts of the kernel are rather > complex—probably too complex for the few kernel developers with a close > interest to consider all of the possible security implications. In addition, > by making new functionality available to unprivileged users, user namespaces > expand the attack surface of the kernel. Thus, it seems that as user > namespaces come to be more widely deployed, other security bugs such as > these are likely to be found.

It might also be interesting to read [3], which is already showing that 3.5 years later, user namespaces are still a breeding ground for security issues that lead to privilege escalation.

[1] [https://docs.docker.com/engine/security/security/#related- in...](https://docs.docker.com/engine/security/security/#related-information) [2] [https://lwn.net/Articles/543273/](https://lwn.net/Articles/543273/) [3] [https://utcc.utoronto.ca/~cks/space/blog/linux/UserNamespace...](https://utcc.utoronto.ca/~cks/space/blog/linux/UserNamespacesWhySecurityProblems)

<comment><USER11> I can appreciate that the features needed to be developed and matured over time, but I don't understand why Linux didn't invent an umbrella concept to tie everything together.

It seems to me a grab bag of things which Linux allows to be independently namespaced/isolated: Cgroups, networking, PIDs, VFS, etc. From a kernel point of view, this would be the perfect use case for an "object-oriented" design with some kind of abstract container concept that reflected the nesting of each container, but instead it seems very scattered and ad-hoc.

In particular, each mechanism is opt-in and must configured separately, very carefully; to approximate Zones you have to combine all of the mechanisms together and hope you didn't forget something, and also hope that the kernel's separation is perfect (which, given the vast amounts of "objects" it can address, is doubtful). To my untrained (in terms of kernel development) eye, this seems the opposite of future proof, because if the kernel invents some new namespacing feature, an application that uses all of the existing mechanisms won't automatically receive it, because there's no concept of a "container" as such.

opt-in seems like the wrong approach. The safer alternative would be that a new container process was completely isolated by default, and that whoever forked the process could explicitly specify the child's access (e.g. allow sharing the file system). This is, I believe, how BSD jails work.

<comment><USER12> That "object-oriented" design is called capabilities.

</comment></comment></comment></comment></comment><comment><USER13> > _It 's a bit early for me to say which is better nowadays on Linux, ZFS or > btrfs, but my company is certainly learning the answer by running the same > production workload on both. I suspect we'll share findings in a later blog > post._

I am eager to read this piece!

Even though I am afraid to see it confirm that btrfs still struggles to catch up…

The 2016 bcachefs benchmarks[0] are a mixed bag.

[0]: [https://evilpiepirate.org/~kent/benchmark-full- results-2016-...](https://evilpiepirate.org/~kent/benchmark-full- results-2016-04-19/terse)

<comment><USER8> Is BTRFS really an option now that RedHat has decided to pull the plug on their BTRFS development? That basically leaves Oracle and Suse I think? As far as I can tell the future of BTRFS doesn't look good.

Facebook using it doesn't mean anything since they are probably using it for distributed applications. Meaning the entire box (including BTRFS) can just die and the cluster won't be impacted. I really can't imagine they are using BTRFS on every node in their cluster.

<comment><USER14> > _Facebook using it doesn 't mean anything since they are probably using it > for distributed applications. Meaning the entire box (including BTRFS) can > just die and the cluster won't be impacted._

I don't think that follows for lots of reasons:

\- If enough of your boxes die that you lose quorum (whether from filesystem instability or from unrelated causes like hardware glitches), your cluster is impacted. So, at the least, if you expect your boxes to die at an abnormally high rate, you have to have an abnormally high number of them to maintain service.

\- Filesystem instability is (I think) much less random than hardware glitches. If a workload causes your filesystem to crash on one machine, recovering and retrying it on the next machine will probably also make it crash. So you may not even be able to save your service by throwing more nodes at the problem. A bad filesystem will probably actually break your service.

\- Crashes cause a performance impact, because you have to replay the request and you have fewer machines in the cluster until your crashed node reboots. It would take an extraordinarily fast filesystem to be a net performance win if it's even somewhat crashy.

\- Most importantly, distributed systems generally only help you if you get _clean_ crashes, as in power failure, network disconnects, etc. If you have silent data corruption, or some amount of data corruption leading up to a crash later, or a filesystem that can't fsck properly, your average distributed system is going to deal very poorly. See Ganesan et al., "Redundancy Does Not Imply Fault Tolerance: Analysis of Distributed Storage Reactions to Single Errors and Corruptions", [https://www.usenix.org/system/files/conference/fast17/fast17...](https://www.usenix.org/system/files/conference/fast17/fast17-ganesan.pdf)

So it's very doubtful that Facebook has decided that it's okay that btrfs is crashy because they're running it in distributed systems only.

<comment><USER8> This article [https://www.linux.com/news/learn/intro-to-linux/how- facebook...](https://www.linux.com/news/learn/intro-to-linux/how-facebook- uses-linux-and-btrfs-interview-chris-mason) explains somewhat what Facebook does with BTRFS.

"Mason: The easiest way to describe the infrastructure at Facebook is that it's pretty much all Linux. The places we're targeting for Btrfs are really management tasks around distributing the operating system, distributing updates quickly using the snapshotting features of Btrfs, using the checksumming features of Btrfs and so on.

We also have a number of machines running Gluster, using both XFS and Btrfs. The target there is primary data storage. One of the reasons why they like Btrfs for the Gluster use case is because the data CRCs (cyclic redundancy checks) and the metadata CRCs give us the ability to detect problems in the hardware such as silent data corruption in the hardware. We have actually found a few major hardware bugs with Btrfs so it's been very beneficial to Btrfs."

The sentence: "We also have a number of machines running Gluster, using both XFS and Btrfs." seems to imply Facebook is not using it heavily for actual data storage. What I distill from this (which is obviously my personal interpretation) is that Facebook mostly uses it for the OS and not for actual precious data.

<comment><USER14> I'm reading that as quite the opposite: they're saying that Gluster, a networked file storage system, is being backed with btrfs as the local filesystem, so all data stored in Gluster is ultimately stored on btrfs volumes. (They're also using it for OS snapshotting, yes, but insofar as the data stored in Gluster is important, they're storing important data on btrfs.)

See also [https://code.facebook.com/posts/938078729581886/improving- th...](https://code.facebook.com/posts/938078729581886/improving-the-linux- kernel-with-upstream-contributions/)

 _" We have been working toward deploying Btrfs slowly throughout the fleet, and we have been using large gluster storage clusters to help stabilize Btrfs. The gluster workloads are extremely demanding, and this half we gained a lot more confidence running Btrfs in production. More than 50 changes went into the stabilization effort, and Btrfs was able to protect production data from hardware bugs other filesystems would have missed."_

</comment></comment></comment></comment></comment><comment><USER15> > Linux has also been developing its own ZFS-like filesystem, btrfs. Since > it's been developed in the open (unlike early ZFS), people tried earlier > ("IS EXPERIMENTAL") versions that had serious issues, which gave it > something of a bad reputation. It's much better nowadays, and has been > integrated in the Linux kernel tree (fs/btrfs), where it is maintained and > improved along with the kernel code. Since ZFS is an add-on developed out- > of-tree, it will always be harder to get the same level of attention.

[https://btrfs.wiki.kernel.org/index.php/Status](https://btrfs.wiki.kernel.org/index.php/Status)

So long as there exists code in BTRFS marked "Unstable" (RAID56), I refuse to treat BTRFS as production ready. If it's not ready, fix it or remove it. I consistently run into issues even when using BTRFS in the "mostly OK" RAID1 mode.

I don't buy the implication that "it will always be harder to get the same level of attention" will lead to BTRFS being better maintained either. ZFS has most of the same features plus a few extra and unlike BTRFS, they're actually stable and don't break.

I'm no ZFS fanboy (my hopes are pinned solidly on bcachefs) but BTRFS just doesn't seem ready for any real use from my experience with it so far and it confuses me. Are BTRFS proponents living in a different reality to me where it doesn't constantly break?

EDIT: I realize on writing this that it I might sound more critical of the actual article than I really am. I think his points are mostly fair but I feel this particular line paints BTRFS to have a brighter, more production-ready future than I believe is likely given my experiences with it. BTRFS proponents also rarely point out the issues I have with it so I worry they're not aware of them.

<comment><USER16> We're using both btrfs and zfsonlinux right now, in production, and fortunately we're not consistently running into issues (I'd be hearing about it if we were!).

I should note that we do have a higher risk tolerance than many other companies, due to the way the cloud is architected to be fault tolerant. Chaos monkey can just kill instances anytime, and it's designed to handle that.

Anyway, getting into specific differences is something that we should blog about at some point (the Titus team).

<comment><USER15> Do you use replication at all? I have a feeling the reason why nobody else sees my problems is that most folks will be using a system like Ceph for distributed replication rather than BTRFS for local replication.

</comment></comment></comment><comment><USER17> This is a great set of information comparing features and tools between the two ecosystems. I like it, and wish more were available for Linux -> BSD and even lower level command tool comparisons like apt-get vs. yum/dnf.

In fact, this works a general purpose intro into several important OS concepts from an ops and kernel hacker perspective.

My only surprise is that this is written as a specific response to Oracle Solaris' demise. From that specific perspective, how many target viewers are there? 10? Illumos isn't losing contributors, and there are still several active Illumos distros. Nevertheless, interesting.

<comment><USER16> Yes, I hope to write one for Solaris -> BSD.

This post was written for the illumos community as well.

<comment><USER18> Please do. I often advocate for BSD when it fits the need but I get pushback due to its lack of popularity. If all Solaris users migrated solely to Linux my position becomes weaker. :( and BSD is very good at quite a number of things.

</comment></comment></comment><comment><USER19> It is actually sad to see that you had to write this.

Funny how the most used / popular technology and a mismanagement from a single company can crush other competing tech.

It is frightening how much of what was invested in Solaris is now lost because of it.

</comment><comment><USER20> SmartOS might be easier for the Solaris familiar, looking to deploy Linux containers rather than go fully Linux.

<comment><USER21> Does SmartOS actually support Linux containers (aside from the obvious approach of running containers in a Linux VM)? Last I checked, SmartOS just used the word "container" to refer to Solaris Zones.

<comment><USER22> SmartOS has code specifically in place for using 'lx' branded zones as wrappers for docker containers (which is distinct from its support of kvm)

[https://github.com/joyent/smartos- live/blob/master/src/docke...](https://github.com/joyent/smartos- live/blob/master/src/dockerinit/README.md)

[https://www.cruwe.de/2016/01/27/using-docker-on-smartos- hype...](https://www.cruwe.de/2016/01/27/using-docker-on-smartos- hypervisors.html)

It's been a while since I've looked in to it, but if memory serves they are using docker filesystem snapshots without modification and running them on a thin translation layer of Linux system calls to Solaris system calls. Hard to find anything backing this up, so I could be way off the mark as to how it's implemented.

EDIT: forgot that's what 'lx' zones are: zones which allow the execution of Linux binaries

</comment></comment></comment><comment><USER23> If you can't access it directly, here's a cached version: [https://web.archive.org/web/20170905181357/http://www.brenda...](https://web.archive.org/web/20170905181357/http://www.brendangregg.com/blog/2017-09-05/solaris- to-linux-2017.html)

</comment><comment><USER24> > If you absolutely can't stand systemd or SMF, there is BSD, which doesn't > use them. You should probably talk to someone who knows systemd very well > first, because they can explain in detail why you should like it.

I can't imagine trying to sell _anything_ with the phrase "why you should like it". SMF certainly doesn't need that kind of condescending pitch--it just fucking works and doesn't get in your way.

<comment><USER25> It helps that SMF doesn't include reimplementations of DNS resolvers and NTP clients, both of which have caused security flaws in systemd. :/

<comment><USER26> You certainly can only use systemd's pid1 together with ntpd (systemd only does SNTP, not full-blown NTP) and no caching resolver.

In fact it's the default in most Linux distributions. The only mandatory pieces if you use systemd as pid1 are udevd and journald.

Misinformation like this is exactly why Brendan said you should ask an actual user of systemd.

<comment><USER25> I actually _like_ systemd as an init system, and use it that way on all my current machines. (I'm a fan of journald so far too.)

However, the mere fact that (s)NTP and DNS are re-implemented in the same codebase is still unsettling to me.

Nor is it misinformation to mention their existence, or the bugs/limitations caused by the duplication of effort.

[http://people.canonical.com/~ubuntu- security/cve/2017/CVE-20...](http://people.canonical.com/~ubuntu- security/cve/2017/CVE-2017-9445.html)

[https://github.com/coreos/bugs/issues/391](https://github.com/coreos/bugs/issues/391)

(Looks like the sNTP client hasn't caused security flaws, though. I was wrong there.)

<comment><USER26> They are independent, you can use one without the other. They are just residing in the same repository and build system.

</comment></comment></comment></comment></comment><comment><USER27> > _" Xen is a type 1 hypervisor that runs on bare metal, and KVM is type 2 > that runs as processes in a host OS."_

Is it not the other way around, that KVM runs on bare metal (and needs processor support) while Xen runs as processes (and needs special kernel binaries)?

<comment><USER28> No, it's not.

It's true that KVM needs processor support: it kind of adds a special process type that the kernel runs in an virtualized environment, through the hardware virtualization features. The linux kernel of the host schedules the execution of the VMs.

Xen has a small hypervisor running on bare metal. It can run both unmodified guests using hardware support or modified guests where hardware access is replaced with direct calls into the hypervisor (paravirtualization). The small hypervisor schedules the execution of the VMs. For access to devices it cooperates with a special virtual machine ( _dom0_ ), which has full access to the hardware, runs the drivers and multiplexes access for the other VMs - <USER2> hypervisor is really primarily scheduling and passing data between domains, very micro-kernel like. Dom0 needs kernel features to fulfill that role.

<comment><USER27> Today I learned something. Thanks!

</comment></comment></comment><comment><USER29> Solaris support ends in November, 2034. Yeah, 17 years from now. No need to hurry ;-)

<comment><USER30> Given that they fired everyone, who do you think is going to give that support and fix bugs?

<comment><USER31> They didn't quite fire everyone: Alan Coopersmith ([https://twitter.com/alanc/status/904366563976896512](https://twitter.com/alanc/status/904366563976896512)) is still present. I'm sure lots of support and bug fixes will be neglected and probably moved offshore though.

Also, it certainly seems like Oracle Solaris 11.3 (released in fall 2015) will be the last publicly available version. Between-release updates (SRUs) have always been for paying customers only, but now it seems like there will never be another release.

</comment></comment></comment><comment><USER32> I think two things need to be mentioned :

1\. ZFS is officially supported by Canonical on Ubuntu as part of their support plans. 2\. Docker over raw containers or zones.

</comment><comment><USER33> > Crash Dump Analysis...In an environment like ours (patched LTS kernels > running in VMs), panics are rare.

As the order of magnitude of systems administered increases, rare changes to occasional changes to frequent. Especially when it is not running in a VM.

Also, from time to time you just get a really bad version of a distro kernel, or some off piece of hardware that is ubiquitous in your setup, and these crashes become more frequent and serious.

(Recent example of a distro kernel bug - [https://bugs.launchpad.net/ubuntu/+source/linux/+bug/1674838](https://bugs.launchpad.net/ubuntu/+source/linux/+bug/1674838) . I foolishly upgraded to Ubuntu 17.04 on its release in stead of letting it get banged around for a few weeks. For the next five weeks it crashed my desktop about once a day, until a fix was rolled out in Ubuntu proposed)

Most companies I've worked at want to have some official support channels, so usually we'd be running RHEL, and if I was seeing the same crash more than once I'd probably send the crash to Red Hat, and if the crash pointed to the system, then the server maker (HP, Dell...) or hardware driver maker (QLogic, Avago/Broadcom).

Solaris crash dumps worked really well though - they worked smoothly for years before kdump was merged into the Linux kernel. It is one of those cases where you benefited from the hardware and software both being made by the same company.

<comment><USER34> > As the order of magnitude of systems administered increases, rare changes to > occasional changes to frequent. Especially when it is not running in a VM.

I think the perf engineer for Netflix is quite aware of this.

<comment><USER8> While I really respect Brendan's opinion (I've got most of his books and he is one of my IT heroes) I do think he is very netflix-IT-scale minded. When your Netflix you can maintain your own kernel with ZFS, DTrace, etc. and have a good QA setup for your own kernel / userland. Basically maintain your own distro. However when your in a more "enterprisy" environment you don't have the luxury of making Ubuntu with ZoL stable yourself. I know from first hand experience that ZoL is definitely not as stable as FreeBSD ZFS or Solaris ZFS.

<comment><USER35> And there it is - the elephant in the room noone mentioned. People in 99% of the IT shops get an existential crisis if you mention during the interview that you want to do kernel engineering. Thank you!

</comment></comment></comment></comment><comment><USER36> OmniOS anyone? [https://omnios.omniti.com/](https://omnios.omniti.com/)

<comment><USER37> Article from 4 months back,

> OmniTI will be suspending active development of OmniOS

[https://news.ycombinator.com/item?id=14179006](https://news.ycombinator.com/item?id=14179006)

<comment><USER38> Since OmniTI pulled back from the project - there has now been a reboot by the community. Regular releases started in early July with regular updates following with support for USB, ISO and PXE versions. The most recent release was August-28-2017. See [http://www.omniosce.org/](http://www.omniosce.org/) for more info.</comment></comment></comment>


The Collapse of Harvard's $36.9 Billion Endowment  - <AUTHOR> http://www.vanityfair.com/politics/features/2009/08/harvard200908 <comment><USER2> It baffles me that the first instinct of some students in response to massive budget deficits is to protest budget cuts and layoffs. They should move to California when they graduate, they would fit right in. I was on the mailing list of a few organizations that urged me to fight the state government's plans to cut back staff positions and hours in response to our multi-billion dollar hole. What do they think we should do, close our eyes and wish the deficit away?

<comment><USER3> _What do they think we should do, close our eyes and wish the deficit away?_

No, they think we should raise taxes on people richer than they are. Your political opponents are not crazy, they just have different goals.

<comment><USER4> Presumably the people poorer than them also feel the same way?

If you look at the numbers - at what percent of people pay what percent of the total collect from income tax - the inescapable conclusion is that a lot of people aren't pulling their weight, and those aren't the highest earners...

<comment><USER5> You're starting your rebuttal from the wrong point. Those who earn more are indeed contributing more tax. But why are they earning more? Is it that their contribution is worth so much more to society? Doubtful. More, perhaps, that much more, unlikely.

For example in the article the guys earning 30million a year (10% of their gambling wins) are only able to earn large amounts because they're on a buoyant market. It's largely random fluctuations - they win for 15 years and then lose it all (except they don't personally lose of course); others win for 15 days and lose it all.

So, the guys paying the most tax, the investment managers &c. are adding little to overall productivity (except some lubrication which could be provided without the ineffecient losses of traders wages) but are creaming off inordinant amounts of wealth from the top all the time simply because of a mathematical glitch -- if you waited 100 years and analysed the gains of any investment firm I'll guess they do marginally better then inflation but extract far more worth for the traders.

Those doing productive work, even the highly paid Harvard professors are earning pennies compared to the investment teams.

So are the investment managers pulling their weight in society by creaming off the wealth by gambling with other peoples money? I don't think so.

Capitalism means the rich get richer, some clever people manage to use other peoples money to be rich first. The rest of us are being suckered.

<comment><USER4> _You're starting your rebuttal from the wrong point._

No, you are :-) It's not a zero-sum game like a casino. There is value created by the allocation of resources. That's what Warren Buffett does. OK so it's not what LTCM did, but that's a flaw in the implementation, not the theory, of capitalist economics. The gambling metaphor simply doesn't fit.

<comment><USER5> Touch/e.

Capitalist economics is pretty useless as a theory, if it doesn't work in practise then it's no use. Define "work". The purpose of capitalism AFAICT is to make money for wealthy capitalists and it does a pretty good job at that. The social fixes added by governments to avoid the capitalists destroying the workforce (eg social security, min wages, health care) are the only reason it can continue. And now of course we have the bailouts, without which the capitalist economy would be dead already rather than groaning in death pains.

I'm pretty /au fait/ with the concept of borrowing to leverage larger sums of money to optimise efficient growth - floatation works IMO only if those buying have altruistic reasons as well; everything is too open to abuse from the big investors. Efficient allocation of resources is not the net effect IMO.

Another example, I can see how you want to mitigate against changes in currency destroying your profit on a large / long-term cross-border project by ForEx deals, but this isn't only how ForEx is used.

I don't see how gambling doesn't encompass a naked-short-sell (say) unless you have opportunity to influence the market by some insider trading, which is both [normally] immoral and illegal, or predict the market by being privy to some deals before they are made (as in the recent expose of the NYSE network being sniffed).

<comment><USER4> Capitalism has no "purpose" other than an optimal allocation of existing wealth with the objective of creating new wealth. It's an algorithm or a technology, not an ethical system. This is where many critics of capitalism stumble.

The bailouts are emphatically _not_ capitalism. Capitalism says let the banks go bankrupt, let the investors lose their shirts, they knew the risks, they knew the profits they were making were in return for taking those risks. The bailouts are _entirely_ political (oh shit! we need those Detroit votes!).

</comment></comment></comment></comment></comment></comment></comment><comment><USER6> "That Summers suggested women lacked a natural ability for sciences did not help matters one bit."

That isn't quite accurate. Summers had prefaced his remarks saying "I'm going to provoke you", then pointed out that math and science test scores were higher for high school boys than for high school girls. No one understands why, he continued, but is it _possible_ that genetics plays a part, and it is not strictly a socialization issue?

He was castigated by some faculty members for those politically incorrect remarks. How DARE he even ask the question?

See: [http://www.boston.com/news/local/articles/2005/01/17/summers...](http://www.boston.com/news/local/articles/2005/01/17/summers_remarks_on_women_draw_fire/)

<comment><USER7> I think he actually argued that men might have a different distribution for mathematical ability than women. Specifically, he suggested men might have a higher variance in their distribution, meaning more men in the tails at both sides. But the distributions would still have the same mean. So men are not 'better than math' than women -- there would be more dumb ones and more smart ones, and less in the middle, effectively.

This phenomenon, by the way, is commonly observed in other species for various genetic traits. From an evolutionary perspective, it makes sense for the males to "roll the dice" and have a higher variance for many traits. For example, one superstar male frog can have _many_ more offspring than one average male frog. But one superstar female can really only have as many offspring as the average female. That's a crude over-simplified explanation, but the idea is sound.

<comment><USER8> _he suggested men might have a higher variance in their distribution, meaning more men in the tails at both sides_

That's my understanding as well.

A professor I respect a lot presented his analysis of Summers' argument in a lecture I went to. This professor said that Summers' argument was statistically invalid, since the number of outliers in the tails of the IQ distribution was insufficient to tell if the distribution was in fact different at the tails between men and women.

It's fair to say that this rebuttal was not the one Summers got when he presented his idea to the faculty. :)

</comment></comment></comment><comment><USER9> Honestly, the article comes off kind of like someone who was a billionaire complaining about how they've become a millionaire. We don't get free coffee or _free hot breakfast every weekday morning in the dorms_ at my school.

<comment><USER10> I was thinking that too. Those poor diddumses! Next thing you know they'll have to do their own laundry.

Harvard's demise might be a sobering economic indicator, but I wonder if there'd be many who actually mourned its passing? To me it's nothing but a old boy's club filled with entitled trust fund brats, and the only real benefit of going there is that you then get hired by the previous generation of intolerable WASP twats. And members of this little club seem to have made an outsize contribution to the ills of wall street, law, government and the current crisis.

Who respects Harvard? Who'd miss it? Not I.

<comment><USER11> I respect Harvard; they do great work. I think the world would significantly miss it if Harvard, it's really hard to respond to such a poor argument, but the medical school alone is a world changing institution.

<comment><USER10> Well, looks like their PR department does great work, indeed. But it's not just their token medical school - I think their business school and law departments have also been "world changing institutions", just maybe not in a positive way.

Anyway this idea of having elite schools for an elite class is dangerous. Just look at the list below. Nepotism and class segregation by proxy, that's all Harvard is. Oh lookie, there's Obama! He went to Harvard, replacing GWB, who - surprise - went to Harvard. And the CEO of Goldman Sachs, who replaced the old CEO who also went to Harvard! What a coincidence.

[http://en.wikipedia.org/wiki/List_of_Harvard_Law_School_alum...](http://en.wikipedia.org/wiki/List_of_Harvard_Law_School_alumni)

Make no mistake. Harvard is "The Man" writ in bricks and stone. I am not very much a fan of The Man, which is why I am not unhappy to see The Man in trouble financially. But no worries, if things really get bad I'm sure a bailout's on the way.

<comment><USER12> Whats with the downvotes? I, for one, largely agree with you.

<comment><USER13> HN isn't reddit, at least not yet. Populist/anti-establishment/anti-elite sentiment doesn't guarantee upvotes regardless of comment merit here.

</comment></comment></comment></comment></comment></comment><comment><USER14> I thought that Alan Dershowitz' comment was particularly interesting:

 _Apparently nobody in our financial office has read the story in Genesis about Joseph interpreting Pharaoh's dream—you know, during the seven good years you save for the seven lean years. And now they're coming hat in hand, pleading to the faculty and students to bear the burden of cutbacks. It's a scandal! It's an absolute scandal, the way Harvard has handled this financial crisis._

The issue that a lot of organizations and businesses seem to be facing now is that they're doing like he says and spending in the fat years what they have which makes the lean years painful. However, this also applies to spending on salaries. As the article notes, Harvard spends a lot more on professor salaries than other Universities because, during the fat years, they spent what they had giving it to professors. And now Professor Dershowitz complains that he has to share in the lean years just as he shared in the fat years.

There are only two plausible ways to do it. Either salaries stay at a pretty steady rate and don't rise in the fat years and hurt in the lean years because the rises are smaller -or- salaries run in tandem with the fat and lean years. You can't get huge raises in the fat years and expect it through the lean years as well.

Now, clearly Harvard's building spree is the cause of some of the hurt, but it isn't like the faculty and students haven't taken their cut of the fat years with the highest professor salaries around and students who pay next to nothing in tuition. If you want in on the fat years, you get in on the lean years.

<comment><USER15> How do you infer that Dershowitz approved of the salary increases in the fat years?

<comment><USER14> Well, if he didn't, then why would he complain about cutbacks?

I'm not trying to pick on him or anything, it's just that he's quoted. But if your salary is increased from $150,000 to $200,000 and then you're asked to cut it down to $150,000, well, if you didn't approve of it in the first place the chances are that you'd be ok with going back.

We often don't get to make those choices as individuals, but usually no one complains about their salary increasing. It's also totally possible that he's protesting on other people's behalf as I doubt he's hurting as a successful book author and probably one of their more well paid professors.

But generally speaking, when a company is having fat years, people generally want a piece of it. I don't mean any disrespect to Professor Dershowitz. It's just that most people act like he acts - it's human nature. It's annoying when fat years are here and we don't get a cut. It's annoying when lean years come and people want us to make concessions. I feel that way too. It's completely devoid of reality, but it's an interesting part of our psychology.

<comment><USER5> I'd have to re-read to be sure but I don't think Prof Dershowitz was commenting on salaries at all. The salary of the professors shouldn't be linked to the Uni's investments. The Prof to me was saying that if they'd been less inclined to blow all the money in the rich years then they'd have the reserves needed to tide themselves over the lean years without having to dick about with peoples salaries, etc..

Also, them overspending 100Million on a building has got to bite a bit when they then announce they're going to cut back on your breakfast. $100Mil buys a lot of breakfast.

</comment></comment></comment></comment><comment><USER8> Most interesting was the idea of conservatism as an asset for some classes of enterprise:

"Harvard, institutionally, never had change when I first came here," the law professor Alan Dershowitz told me. "It was like the old baseball teams; you were born here and you died here.... But the turnover now has become like corporate turnover—and that always takes a toll."

</comment><comment><USER16> It's been amazing. A good friend was laid off from what should have been a job for life there. I don't see how they're going to operate while eliminating people from nearly critical positions.

If this would happen to my company, I'd expect the doors to close. If it happened to any of our competitors, we'd be throwing a victory party.

<comment><USER17> _A good friend was laid off from what should have been a job for life there._

Where else in the current economy do people expect to have jobs for life?

<comment><USER18> I think there's probably a decent chunk of government or quasi-government jobs (post office, amtrak) that are pretty reliable, but this recession has certainly shaken things to their core. Who knows these days?

</comment></comment></comment><comment><USER19> I wonder what perceptual damage this will do to the Harvard brand?

Being one of the world's leading business school and being in financial trouble just doesn't look good.

<comment><USER20> How much time do business schools spend on managing investments? It sounds like its own specialty, but I don't know where one learns it.

</comment></comment><comment><USER21> _Only a year ago, Harvard had a $36.9 billion endowment, the largest in academia. Now that endowment has imploded_

Was anyone able to get through all 6 pages and find what exactly _imploded_ means?

<comment><USER22> The important details are on the second page, and the explanation isn't very clear. But at it's core this is a liquidity crisis. Harvard hasn't _lost_ all that much (maybe 25% if the $8B number holds up). But as a result of the recent aggressive investments, huge chunks of its endowment is in illiquid assets that can't themselves be used to fund the university. Combine that with some very liberal spending projects in recent years, and suddenly this very wealthy university can't actually pay its bills.

<comment><USER23> Which is another way of saying: Harvard is still in denial.

They (like many) are refusing to admit that they made bad investments that are no longer worth what they once were. So they're trying like hell to avoid _realizing_ those losses, because that red ink would go on _their_ permanent record. Which is tantamount to career suicide. (Hence the blame-gaming at all levels)

<comment><USER24> Selling in a down market can often be worse than debt.

The cuts are extreme because they need to start thinking 1/2 the ROI * 70% of the endowment or ~35% of last year's income. They must do a huge drop in spending over the next 10 years or they are going to actually run out of money.

<comment><USER23> Assuming we're merely in a _down_ market. Which is the standpoint which I categorize as 'denial'.</comment></comment></comment></comment></comment>


Equivalence principle of general relativity holds even at gravitational extremes - <AUTHOR> http://blogs.discovermagazine.com/d-brief/2018/07/04/einstein-relativity-heavy-objects-fall/ <comment><USER2> This was a measurement of the Nordtvedt parameter which characterizes the difference between a gravitational field and an accelerating reference frame. If there is no difference, as GR predicts, then the parameter is 0.

This experiment tests the idea that gravity itself gravitates: gravity imbues very massive bodies with gravitational binding energy, and therefore more inertia. If your inertia is increased due to gravity, do you nevertheless fall at the same rate? i.e. does gravity affect the energy that itself imbues? The conclusion is consistent with "yes."

[http://www.scholarpedia.org/article/Nordtvedt_effect](http://www.scholarpedia.org/article/Nordtvedt_effect)

<comment><USER3> I've never thought of the equivalence principle like this. I knew gravitational fields have their own mass-energy and can cause a runaway effect (black holes), but I never realized this could mean more inertia too. Neat!

I'm curious about what this means as the event horizon is crossed.

<comment><USER4> Sorry I'm a few days late to this party. There are lots of things I am tempted to comment about other comments, but even though the OP doesn't really have anything to do with black holes directly, I'll try an answer restricting myself to your good, honest question:

> I'm curious about what this means as the event horizon is crossed

tl;dr it means General Relativity is how we answer this; more specifically, we expect that if we do a Galileo-like experiment replacing the Leaning Tower and the ground with a giant scaffold surrounding a black hole, and we carefully drop in a feather, a planet, and a neutron star, neither object's centre of mass wins a race to the horizon (it's a tie, even though the neutron-star is strongly gravitationally self-bound, and the feather is not gravitationally self-bound at all).

In practical terms, and strictly with respect to your question, the results of Archibald et al. [2018] (the work described in the original post) mostly (more below) vindicate the use of a post-Newtonian approximation (PNA) formalism as a short-cut to the results we would get from the full theory of General Relativity. At the horizon of anything but the smallest black hole[1] one expects "no drama" for a freely-falling infaller. This is not terribly surprising, as we could already make a model black hole's mass arbitrarily high, bringing the curvature at the horizon down well below the curvature we experience in laboratories here on Earth.

Clifford Will, who has written many papers on post-Newtonian methods, in (deliberately accessible to non-specialists) Will [2011] [2] writes:

 _The reason is a remarkable property of general relativity called the Strong Equivalence Principle (SEP). A consequence of this principle is that the internal structure of a body is "effaced," so that the orbital motion and gravitational radiation emitted by a system of well separated bodies depend only on the total mass of each body and not on its internal structure, apart from standard tidal and spin-coupling effects. In other words, the motion of a normal star or a neutron star or a black hole depends on the body's total mass and not on the strength of its internal gravitational fields. This behavior was already implicit in the work of Einstein, Infeld, and Hoffman, where only the exterior nearby field of each body was needed, and has been verified theoretically to at least second post-Newtonian order by more modern methods._

(So, for example, SEP means a neutron star's strong internal curvature -- the strongest we can access observationally with current technology -- doesn't cause the neutron star to radiate energy-momentum away as dipole gravitational waves.)

Archibald [2018] provides observational verification for SEP for the inner radio pulsar of the triple system to good sub-leading post-Newtonian order, improving on results from (among others) the Hulse-Taylor binary and (indirectly) LIGO.

Will [2011] uses the "xPN" notation for subleading orders, where 1PN is leading-order, 2PN is next-to-leading order, 3PN is next-to-next-to-leading order, and so forth.

A problem raised in Archibald [2018] is that the most popular formal system (the parameterized post-Newtonian (PPN) formalism) for comparing alternative theories of gravitation which may distinguish inertial mass from gravitational mass is only good to 1PN; any theory that does not match the results of Archibald [2018] at 1PN can be excluded, but anything that differs at subleading order needs a different comparison framework.

Again, this is not tremendously surprising; PPN was explicitly constructed to fully contain weak-field results (mostly within our own solar system), and the region around the central binary in Archibald [2018] is clearly not weak- field. So while this spells trouble for several families of alternatives to General Relativity (GR), there are several others where the results of breaking GR's inertial mass == gravitational mass equality appear only in the strong field limit. An extension of PPN is needed to capture the results of Archibald [2018] into a formal comparison system that may distinguish between such theories and General Relativity, assuming the compared theories match in every other PPN parameter (if they don't we can exclude one on that basis).

Or, in short, General Relativity looks really sound still, and post-Newtonian programmes are not wildly off-track.

\- --

[1] The region near (but outside) the horizon of a small black hole is going to be dramatic for other reasons, ranging from astrophysical ones like the virtual certainty of a hot accretion structure to theoretical ones like the increasing heat of Hawking radiation as one takes the black hole mass to zero. An object like a space capsule with a person inside would be vapourized by the hot matter outside a small black hole well before reaching the horizon. As we make the mass of a black hole larger, the matter just outside the horizon -- at least on average -- is a lot cooler and sparser, so a space capsule could easily freely fall through the horizon.

[2] Proceedings of the National Academy of Sciences of the United States of America, April 12, 2011. 108 (15) 5938-5945; [https://doi.org/10.1073/pnas.1103127108](https://doi.org/10.1073/pnas.1103127108) Thankfully PNAS makes it freely available at [http://www.pnas.org/content/108/15/5938](http://www.pnas.org/content/108/15/5938)

</comment></comment></comment><comment><USER5> I've heard of the new atomic clocks underway to make this ridiculously precise measurement even more precise:

[https://www.nist.gov/news-events/news/2013/08/nist- ytterbium...](https://www.nist.gov/news-events/news/2013/08/nist-ytterbium- atomic-clocks-set-record-stability)

<comment><USER6> Although that news is actually five years old. I guess in some time-frames that could be considered new.

</comment></comment><comment><USER7> > Galileo famously (and likely apocryphally) demonstrated the principal by > dropping lead balls of different weights off the Leaning Tower of Pisa and > observing them hit the ground at the same time.

This never made sense to me as something you'd need to test, once the question had been considered.

Imagine 1000 cannonballs all connected to each other with threads. The result is a single object with 1000x the mass of a cannonball. Would you expect it to fall faster?

<comment><USER8> We shouldn't write off the difficulty of the problem, just because it feels self-evident now. It's much easier to come up with a thought experiment once you have the answer. It's completely intuitive that "0" is a thing, I mean, you can just go "whats 2-2?" but it wasn't always the case. It's very hard to get into a frame of mind that includes only those items the contemporary discoverer would have known.

<comment><USER9> I'm pretty sure that "0" as in "2-2" has been known since before we became the current species.

What was new and interesting was the use of "0" as a place holder to allow decimal number representation.

</comment></comment></comment><comment><USER10> The new paper claims to add to the confirmation of "the strong equivalence principle of general relativity."(0)

Reading Wikipedia to find which theories are (or were) the alternatives which assumed that principle not to hold:

"The strong equivalence principle": "The first part is a version of the weak equivalence principle" "The second part is the Einstein equivalence principle (with the same definition of "local"), restated to allow gravitational experiments and self-gravitating bodies."

"This is the only form of the equivalence principle that applies to self- gravitating objects (such as stars), which have substantial internal gravitational interactions. It requires that the gravitational constant be the same everywhere in the universe and is incompatible with a fifth force. It is much more restrictive than the Einstein equivalence principle."

"Einstein's theory of general relativity (including the cosmological constant) is thought to be the only theory of gravity that satisfies the strong equivalence principle. A number of alternative theories, such as Brans–Dicke theory, satisfy only the Einstein equivalence principle." (1)

So it seems that "Brans–Dicke theory" and similar are ruled out by this observation, that is that the following line from one Wikipedia page can't remain:

"At present, both Brans–Dicke theory and general relativity are generally held to be in agreement with observation."(2)

But note that the authors of (0) don't claim that the alternative is completely impossible, but that they have measured even bigger space where the "strong equivalence principle" holds, compared to all measured up to now:

"our limit on the strong-field Nordtvedt parameter, which measures violation of the universality of free fall, is a _factor of ten_ smaller than that obtained from (weak-field) Solar System tests"(0)

That is, of course, a success, as every scientific and measured increase of "known" is. Note that other "Solar System" tests mentioned in (0) are also very new, from this year. Also: the parameter is "a factor of almost a thousand smaller than that obtained from other strong-field tests"!

The article from Nature, of course more scientific that the OP on HN (currently: from discovermagazine.com), ends with:

"Although the [scalar–tensor] theories are not completely quashed, their hopes for validity have been made that much fainter."(4)

0) [https://www.nature.com/articles/s41586-018-0265-1](https://www.nature.com/articles/s41586-018-0265-1)

1) [https://en.wikipedia.org/wiki/Equivalence_principle#The_stro...](https://en.wikipedia.org/wiki/Equivalence_principle#The_strong_equivalence_principle)

2) [https://en.wikipedia.org/wiki/Brans%E2%80%93Dicke_theory](https://en.wikipedia.org/wiki/Brans%E2%80%93Dicke_theory)

3) [https://journals.aps.org/prd/abstract/10.1103/PhysRevD.48.34...](https://journals.aps.org/prd/abstract/10.1103/PhysRevD.48.3436)

4) [https://www.nature.com/articles/d41586-018-05549-4](https://www.nature.com/articles/d41586-018-05549-4)

<comment><USER11>
      A gravitational constant that is the same
      everywhere in the universe and is incompatible
      with a fifth force.

The fallout of this ramification is that, gravity is some sort of ambient side effect of material presence, sort of like a shadow cast, more than an emission radiated.

As a constant, that means that its invariance is significant, in the same way the speed of light is significant. There is some externality pegging the phenomena we notice, at the value we observe. Perhaps some sort of Planck- level absolute fact, which is irreducible in the same way that the concept of color doesn't exist very much beneath 400 nanometers (violet/near- ultraviolet), since color is only an abstraction of our eyeballs and the language we use to describe our sensations.

<comment><USER12> I wouldn't say that general relativity suggests that gravity is an "ambient side effect" of material presence. It means precisely that the geometry of spacetime is determined by the matter-energy content within that spacetime; and that matter moves on geodesics dictated by spacetime. I suppose that I am forced to accept that whether you think gravity is more like a shadow of matter than an active participant in dynamics is somewhat up to you, provided that you get the physics correct. If you don't, then your perspective is wrong.

Glancing at some of the other things you've said in the thread, you seem to be convinced that some waves, like sound waves, are somehow illusory. Let me assure you, there is nothing illusory about wave phenomena, both in general and with gravitational waves in particular. Anything that produces wave-like phenomena can be said to radiate emissions, to paraphrase, and in many cases, there is nothing really more "fundamental" than the wave.

As for the concept of color, I suppose it depends on what you mean by color. Color as defined by the wavelength/frequency of light is perfectly well defined outside of the visible spectrum. As a mental concept, I don't see why it is "irreducible." I suppose you are attempting to say that the universal speed of light is somehow fundamental... but in the same way that a "redder" red is impossible? This is a dubious analogy. It confuses the limitations of the mind with fundamental physics.

<comment><USER11> Sound waves are changes in the distribution of particles within a volume over time. The sound wave itself is a byproduct of the particles compressing closer together or stretching farther apart.

You might be in love with the idea of describing an equation that frames the gradient of distribution, and the nature of it's propagation through a medium, but the sound wave is the manner in which the gaseous molecular constituents of the air are set in motion relative to one another. They get closer, they move apart, the changes occur at different places in the medium, at different times, and do so at a certain velocity, in sequence as interactions are forced upon the medium.

Indeed, the reason sound waves travel at the speeds we observe, is because that's how fast the very molecules themselves, comprising the air, are moving at the temperature and pressure of the environment.

Meanwhile, what color is a beam with a wavelength of one nanometer? Would you characterize the color as "soft x-ray"?

<comment><USER12> The sound wave is not a "by-product." It is precisely the phenomenon you are describing. And while we are discussing equations and distribution functions, you might as well get the equation right: wave phenomena arise when the equations of motion are hyperbolic PDEs. Such systems involve the Laplacian, not just the gradient. Indeed, the physics of such systems are typically studied as a whole, in terms of... wave phenomena.

Further, not all waves require a medium. Light and gravitational waves are prominent examples. There is nothing to reduce these phenomena to, except for the fields themselves, whose form is dictated by... a wavelike solution.

While we are at it, let me disabuse you of your explanation of the sound speed. Turns out that the sound speed is a thermodynamic quantity; it is the speed at which small wavelike perturbations propagate. To properly derive the sound speed, one must linearize the Euler equations, and then adopt a thermodynamic equation of state, from which the sound speed is derived. It is, emphatically, not the speed at which molecules move.

Finally, it is obvious that you did not understand what I was driving at with respect to color. I agree wholeheartedly that we have no true color, within our minds, with which to perceive, say, soft x-rays. But this issue has to do with our own neurobiology, not fundamental physics. Comparing the two is what is problematic. There is little reason to suspect that our mental limitations have anything to do with anything but evolutionary necessity. Such limitations are categorically different than, say, the speed of light.

</comment></comment></comment></comment></comment><comment><USER13> Just a layman question: does this have any implications for theories of quantum gravity, like LQG or String theory?

<comment><USER14> Yes, the authors discuss the implications for scalar-tensor theories, and it doesn't look great for many of them. The Nature News and Views article by Clifford Will [1] offers a decent overview.

[1] [https://www.nature.com/articles/d41586-018-05549-4](https://www.nature.com/articles/d41586-018-05549-4)

</comment></comment><comment><USER15> >with a margin of error of only 30 meters, according to a

Amazing they can measure it that accurately

<comment><USER14> We can do even better some of the time - for example, we can get to ~few nanosecond timing precision for pulsars like J1909-3744 [1], which is equivalent to measuring (changes in) the path length to that pulsar to a few meters or better.

[1] [https://arxiv.org/abs/1406.4716](https://arxiv.org/abs/1406.4716)

</comment></comment><comment><USER16> why do they call it Principal?

<comment><AUTHOR> Double spelling error (first two occurrences), from the third on the article got it right.

</comment></comment><comment><USER17> *Equivalence principle</comment>


A Hotel Room Hacking Spree (2017) - <AUTHOR> https://www.wired.com/2017/08/the-hotel-hacker/ <comment><USER3> The Onity lock hack was mine. I imagined many outcomes when I decided to disclose it; a meth-fueled crime spree wasn't one of them. Man, life is weird.

<comment><USER4> What were you thinking would happen? That you'd simply become the envy of magazine-reading normies and nerd conference attendees?

Anyone who's pirated software knows that electronic locky things are about as worthy as masking tape. But you gave all the work away such that it took all the brains of a jailbird methhead life-winner to rig up a formidable burglary tool with an arduino (which i've always derided as baby-talk-programming-for- potheads, how about that) Normally there would be some secretive jackass in the middle like those developing and selling the auto theft tools to the guys who manage car thieves... but you changed the world! Congrats.

<comment><USER3> I don't think the vitriol is warranted or constructive at all, but regardless...

What I thought would happen: the general public would be made aware of a serious vulnerability in products they believe to be safe (they were -- millions of people were made aware of it and I spent years dealing with the press for exactly that reason), and that the companies involved would be forced to act (the big ones were, small ones weren't). With the benefits of hindsight, I 100% stand by the decisions I made and feel confident that I did the right thing, despite that I knew that some folks would use this for crime (and now know that they definitely have).

You can say that everyone knows that they're not secure, but that's ... Frankly dumb and naive. The vast majority of people have no idea, and they don't _care_ about the abstract notion of them being insecure. They do care when I say "I can open any of 10 million locks in a second with no special skills."

<comment><USER4> Thank you for replying, despite my shitty abrasive attitude.

No the normies don't know anything, that's why they are buying garbage like cars without keys, "connected" door locks, and burglar alarms that some talk radio host tells them is "safe". You can't teach them, and if you have something better to sell with meritable security they won't choose it.

I don't know if you were surprised to find what you found. At any rate, you knew that this stuff is garbage as soon as you found it. And so has anyone who has attacked just about anything. From consumer junk to military toys, there is very little out there that has actually incorporated much thought to attack resistance... the only examples I can think of right now are pay television and some game consoles... really, the most frivolous things.

I think it was the late 90s when I checked into a hotel and was slightly surprised to get a magcard instead of the swiss cheese looking ving stuff I was used to. I am sure that I am not the first or only one who thought, well this is shit. The card probably only encodes a site code and an id for the individual lock. I was impressed to learn that when the next guest gets a card then mine won't work anymore. But whether we had the capacity to realize how stupid the implementation must be, we all had some reassurance in that there was at least a level of sophistication required to put me at risk there. Whether that's a shitty night clerk disclosing the password for that card writing device, or someone who took apart the lock to figure out how to throw the bolt, there was something more required than a dickhead reading the internet to do it. And for like fifteen years "it was acceptable" because nobody gave a how-to to everyone.

So what were we supposed to do when the details - not the idea - <USER2> disclosed? Not travel anymore? You did make the attack a lot easier than necessary to make your point. Explaining an overview, the idea, still carries some risk - there are so many people in the world that nobody has any novel skill and someone's bound to replicate the rest of your work - but all these details lowered the bar unreasonably.

Man, what if I had published the party trick that lets you start a toyota without any keys or fob? I know I'm not the only one and doubt I was the first. But it's not that people could lose their property, it's possible that people who would not normally have access to "that car" would do something extremely shitty with this possibly lethal weapon. Another attacker without travel experience, grown up in the usa, might not realize that in other places you can get away with car theft simply by driving east. I wouldn't have thought about this when I was young but now I sure as hell don't want anything like this on me.

</comment></comment></comment></comment><comment><USER5> It's an interesting story, but it's rather sad. I really hope he gets the help he needs in prison and avoids falling back into his old lifestyle.

<comment><USER6> "Then, a year after that DUI stop, in the summer of 2012, Cashatt got a letter from the court. It informed him that he was being charged not merely with that DUI misdemeanor but with a felony, the result of his latest charge plus all of his prior offenses. The minimum sentence: six and a half years in prison."

I think this is the saddest part. He had his life together, no matter how fragile, and he was pulled back into the system.

<comment><USER7> I'd withhold judgement - no matter how messed up people are, humans can always be great story tellers.

Yes, I guess it sucks if you think you get off scot-free for a DUI and multiple other offenses, but then are drawn back into the system. But that doesn't mean that this guy actually had his life in order, or quit drugs, or really did anything that he said he did.

</comment></comment></comment><comment><USER8> Surprised that we haven't seen a class action suit against Onity and/or the hotel chains that used their locks after the hack was known and they weren't patching it.

<comment><USER3> When it was first disclosed, all the major hotel chains went to Onity with a huge "what the fuck?" and got discounts or free hardware. Then Onity closed up shop entirely; the name still exists in UTC, but the original Onity just ... ceased to exist.</comment></comment>


Five Boroughs for the 21st Century - <AUTHOR> https://medium.com/topos-ai/five-boroughs-for-the-21st-century-8da941f53618 <comment><USER2> Data warning: this page is 37-40 MB (depending on the cache) even with an adblocker.

</comment><comment><USER3> I wish that articles like this would release some of the data; even if it was just their reduced 16 dimensions, I'd love to redo their clustering but optimize compactness somehow.

</comment><comment><USER4> So basically divide the city by income bracket?

<comment><USER5> 65 dimensions, not including income, but so many things in life do end up correlating to wealth.</comment></comment>


Ask HN: Review our startup: Unbig.me - <AUTHOR>

The concept is still in an early beta stage but I've love to get some feedback.<p>http://unbig.me/ <comment><USER3> As a consumer I will hate this, as site owner I will love it. Nonetheless, nice idea. Good luck!

<comment><USER4> Twitterers should love this.

</comment></comment><comment><USER5> You have a neat idea here. I am particularly fond of how unoffensive the advertisement delivery actually is. Best of luck to you!

</comment><comment><USER6> I've been using it and I love it. It's so easy to use and the stats are terrific. The ads are clean too. i was frustrated with other shorteners displaying mainly soft porn and gambling ads!! Only one sore point - <USER2> support. I have sent a few support requests and have not received any replies. and how do we receive our paymnets? All the best!

</comment><comment><USER7> Interesting idea. How did you arrive at the numbers for pricing/payouts? When I look at the price I feel like there is some disconnect from the usual CPC vs CPM. The person displaying the link is getting a click, which is usually paid per action while the advertiser is getting an impression.

<comment><AUTHOR> Good point. I'll have to make the distinction clearer or rethink model. Thanks!

</comment></comment><comment><USER8> This is nice, but eam's right: consumers will hate it!

Assuming it takes off, this could become <the> way to share links, basically making reddit/digg submissions profitable.

Any thought to how to handle any major backlash, like a site banning an unbig.me link altogether?

<comment><AUTHOR> I honestly haven't considered sites banning unbig.me. I'll have to think about possible solutions. Maybe working with the sites - i.e. providing a share of the revenue or suchlike?

</comment></comment><comment><USER9> What's to stop:

1) People avoiding unbig.me links because they don't like advertising

2) People taking one unbig.me link and then retweeting another to steal the advertising money?

You might not consider either of these a problem, of course :-)

<comment><AUTHOR> Thanks for the input. I've thought of both of them. #1 is would be problem. #2 each link made by our registered users is unique and assigned to the user that made it - even if its the same link someone already used... and I think retweeting a link would be a welcome site to the original link owner :)

</comment></comment><comment><USER4> The link: <http://unbig.me>

</comment><comment><USER4> Nice. I like it.</comment>


Sorry, kids, no jobs here - <AUTHOR> http://www.thenation.com/article/154478/sorry-kids-no-jobs-here

<comment><USER2> An epic failure with not a word about the recent minimum wage increases, e.g. 10% last summer (<http://en.wikipedia.org/wiki/Fair_Minimum_Wage_Act_of_2007>). A very bad thing to do in a deflationary period.</comment>


Ask HN: Motivation and employement - <AUTHOR> Hi, HN,
I am working at big tech corporation in Russia as a experienced software developer. We got a lot of perks, I enjoy cushy salary (approximatly 7-9k$ after tax monthly - this is approx 8-10x Moscow median income), and I saved reasonable amount of money (I think I can live up to 5-6 years not working without frugality with the same standard of living).
I do not enjoy consumption - I own old car, live in standard Soviet old flat (with mortgage paid off), but have a family of three (including myself) to support.
The thing is I completely loose motivation to be an employee - there is just no economical sense in it, I just feel that my free time costs potentially more, than the wage I make.
I am thinking about starting couple of my own things, but this is requires my time (to communicate with customers, to make sales, to build and evolve product), and it is risky (I can fail =) ).
So the question is: I think that many of fellow HN's been in a such situation. What mady you (or not) to actully jump the ship? <comment><USER2> My comment to people in similar situations, is to always remember that if you have that much savings, you are closer to retirement than you realize. If you can live off of a 4% drawdown, then you have very little risk long term of ever touching your principle in a very conservative index fund investment (stock markets historically in the US average 4% above inflation, and I suspect that's true globally). I'm not sure what the russian equivalent to Vanguard is, but I'd he surprised if you didn't have access to similar low cost investment.

Sometimes all it takes is another couple years of slogging away at a job you hate to get you to a critical mass where investment income matches your yearly expenses. At that point all risk of quiting is basically gone, and you can pursue whatever you want.

Also keep in mind that seven years is a pretty common number in business for a good product to become successful. You can have 100% growth year over year for 5 years and still only have 32 customers. So it may make sense to hold off until you have slightly more runway than 5-6 years savings.

But doing the math, and putting dates on calendars can do wonders for how you feel about going into work.

Also, you sound like you're in a really good spot no matter what you decide. Good luck!

<comment><USER3> This post confuses me.

It reads as if one could work a SWE job for 10 years, and retire on an index fund. Yet, that cannot possibly be true?

Cost of living is relative, but I can't imagine mine is very high. No kids. Own my car. $700/mo rent.

Yet, 10 years is not even close to enough time to bank enough money to retire. What am I doing wrong?

<comment><USER4> There are probably many factors you have to adjust along the way to achieve it -- possible, but not without effort.

If you live in a place with $700/mo rent, I imagine you probably also live in an area that doesn't pay the kind of salaries San Francisco tech pays.

So you might want to work in SF. But let's say you work in SF and get bay area SWE salaries; if you were to want to "retire" in SF and continue to live with $3-4k rent, that might be a hard point to reach after 10 years.

If you work in SF/Bay and get bay area SWE salaries (or better yet, FAANG salaries) for 10 years, live modestly for most of it and not overspend, you can then probably afford to retire with $700/mo rent (or even buy a house with cash in an area that costs $200k~ a house) after 10 years by moving away from the bay to other states.

The difference in salary and cost of living between different areas is often larger than you can imagine; and it's up to you to figure out how to adjust the knobs to make it work best to your advantage.

</comment></comment></comment><comment><USER5> Here is a question. Do you have a good sense of how you would use your time after you quit? Obviously you would have more time for your family and hobbies, but beyond that, a lot of the challenge of working for yourself is in making sure you are still pursuing a plausible career path and not taking a wrong turn that will stress you out and has no reward.

I recently approached this question by writing down what I know about myself and my general interests and strengths and weaknesses. I limited myself to finding the nine most important of these(an arbitrary number but small enough that I could keep all of them in my head) and reworked it over a few days until they described me well and were no longer contradicting each other.

I figured out that I wanted to position myself towards something more like teaching than, e.g. "deep" R&D, sales, customer support. So now I am working on making video essays for a Youtube channel - something I hadn't considered until I really worked through what I did and did not want - and am having a great time with it. And if the channel and associated products don't work out(like a lot of YT channels, the actual channel and video content can be leveraged into a marketing funnel), it's still a pretty solid career move in terms of getting my name out there.

<comment><USER6> Can you post your youtube channel.

</comment></comment><comment><USER7> Living very frugally, and driving an old car, wouldn't bother me but living in a Soviet-style flat would seriously depress me. Maybe it's having an effect on your own psychology? Human beings are by nature outdoor animals and living in a huge block apartment is about as far from the natural outdoors as you can get.

You could try renting a proper home on Airbnb for a month and see how you feel after a few weeks of having a nicer environment.

This is the main reason most Americans want to own a home with a backyard. It allows you to relax and BBQ in the "outdoors" any time you want. Sitting around a fire pit is soothing in a primal way. I think most people find that it improves their psychology immensely.

<comment><USER8> > relax and BBQ in the "outdoors" any time you want

In Poland (which has similar climate to Moscow), it's not "any time you want", but more like May-September. For me, it's one of main reasons for not owning a house - it's a major hassle throught the year, but you reap the benefits for only around 5 months in this climate.

</comment></comment><comment><USER9> I would suggest that you switch jobs or move to more interesting project at your current job. Starting a business sounds very attractive but it is totally different from a programming job. I personally enjoy programming and would hate to deal with customers/marketing/sales/VCs/employees. Starting a business is just too many variables and never ending cycle of worry.

There are lot of new exciting technologies(AI/VR/Crypto) which are high in demand and fun to work in.

<comment><AUTHOR> Thanks for your reply! This is a good advice, but I already tried it. For me it does not solved the problem, only gave me a little more motivation to dig into new tech. I'm not afraid of dealing with 'business' side of business, cause during my career I was engineering manager for couple of years and solution architect (tech sales guy) earlier.

I also enjoy programming, but for me it is just a tool.

</comment></comment><comment><USER10> I'm going to say something others would generally shy away from:

If you have that much in savings, then instead of building a project, hire someone to build it for you. It will give you valuable management and project management skills, and you can do it easily while working a day-to-day job.

</comment><comment><USER11> Build it part time, if it grows then you can leave. Most people that leave without a plan exhaust their savings and end up in a worst position.

<comment><USER12> I second that. Married with kids? Don't jump off the train right away. Start your own project for fun on the side. It as to be fairly contained and not to hard to put in place because you want to minimize the time spent at your current 9-5 job. Make it grow, look at the potential, get early feedback or eventually generate a tiny income out of it (optional). Look at your savings, make a plan with a 1 year run, or 2 years if you can. Quit in good terms, tell people you're going to pursue your dream and would love to come back in the future.

Quitting a job to pursue your dream is great, but that dream needs a clear definition.

<comment><USER13> How do you make a project that makes money without your employer finding out and firing you?

<comment><AUTHOR> In Russia it is totally legal, however employer wouldn't be happy, but who cares.

<comment><USER13> I was thinking for your employer. If you piss them off then it's the same situation as if you have quit.

</comment></comment></comment></comment></comment><comment><USER14> It's always hard to give advice to someone - and even harder giving advice to someone you don't even know. That said, I think if you came here is because, deep down, you already know the answer and you're just looking for "validation" to do it. ;)

If you're feeling you'd be happier doing something else (and have the financial means to support yourself), just do it. Of course, it's harder when you also have a family to support but just have an honest talk to them and tell them how you're feeling. They'll probably support your decision.

It's a cliché but it's so true: life's too short to waste time doing something when our mind tells us we should be doing something else. That doesn't have to be something definitive either. Just try out something for a year or two and, if things don't work out, you can always find a new job (or maybe even go back to yours). ;)

I think many people here would like as fortunate as you are to have enough savings to quit their jobs and do something they're truly passionate about. You've worked hard to reach this point. Enjoy it! :)

</comment><comment><USER15> It takes about 1-2 years to get decent profit flowing in a startup, so if you can live 5-6 years, then quit and try for 2.

You will grow so much during this time that if you had to go back into employment, you could command a much higher salary.

But this only applies if you are a self-starter. Once I stopped working a full-time job (i.e. employment) and started my startup, I actually do a lot more hours. I dont notice it, but I do. It's not for everybody.

<comment><AUTHOR> Do you quit after you found product-market fit? Or earlier?

<comment><USER15> Before - I had 1 year of runway, and I was sure I could get revenue positive in a year. I was wrong. After a year I had to go back into consulting for 6 months, that 6 months consulting gave me another year runway, and then that was enough to get everything off the ground.

</comment></comment></comment><comment><USER16> Have been in the same position, my advice is to not quit (I did and I thought I could have had it easier)! You are in a great position now to make the next step.

Is taking a sabbatical an option?

Do you have energy left after work to try something on the side?

Find other companies. In the another thread I recommended the book "Why Employees Are Always A Bad Idea". There are different companies out there (building one myself).

</comment><comment><USER17> Can you make your current employer a customer? Can you make a product with what you do for them? Do you know someone you could work with? It's better to work with someone.

Taking that risk seems to be not a big deal in your case because you own your home. I think it's very important to have good support (at least moral) from the family (wife or parents).

</comment><comment><USER18> Read "When to Jump" it's been a quite fascinating read that has encouraged me to be courageous when faced with the task of jumping. ([https://www.amazon.com/dp/B072V1BWFK/ref=dp-kindle- redirect](https://www.amazon.com/dp/B072V1BWFK/ref=dp-kindle-redirect))

</comment><comment><USER19> Starting a business is not easy in Russia. Problem with starting a big business is corrupt government getting interested in your business and oligarch sweeping off your biz. Move to SF and start your business there.

<comment><AUTHOR> LOL, it is really easy, we have 6% tax here if you relatively small (below $1.5M USD yearly revenue).

So, it's not an issue.

<comment><USER19> Tax rate means nothing if it's difficult to expand your business.

"This year, Russia is ranked 40th in the World Bank Group Global Doing Business report, which assesses the ease of doing business across 190 measured economies."

Hiring developers in St Petersburg is no longer easy as developers have come to expect salary like you are getting.

</comment></comment></comment><comment><USER20> You don't have to jump the ship right away. You can find time and transition.</comment>