The Rahul Yadav Story - <AUTHOR> http://www.foundingfuel.com/article/the-rahul-yadav-story-youve-never-heard-before/ <comment><USER2> Rahul's is the story of the quintessential silicon valley startup founder, except he's in India and these stories are novelty.

When media contacted him if his company was acquired, he reportedly said yes to 50% of the journalists and no to 50% of the journalists "to have fun" \- [http://indianexpress.com/article/blogs/rahul-yadavs- latest-a...](http://indianexpress.com/article/blogs/rahul-yadavs-latest- antics-it-makes-you-doubt-everything-about-housing-com/)

This was apparently the last of a growing list of misdemeanors. So the board of directors asked him to step down.

</comment><comment><USER3> can anyone outline what the backstory is? i feel like without knowing Rahul Yadav and what happened at Housing, this piece is hard to follow ...

<comment><USER4> 12 guys started Housing.com in 2012. (4 of them had more control of the company if I'm not wrong). Rahul Yadav was the CEO till yesterday. Good team, they executed things quickly, got attention from investors, got handsome funding early on. Bought a domain name like Housing.com. But Rahul Yadav is very brashy too and publicly ridiculed the VCs several times on not taking decisions on his terms.

Softbank (Japan) had nearly 30% stakes in housing.com . Rahul had ~4.5%. Anyway the investors eventually had enough power to expel Rahul "with immediate effect" after yesterday's board meeting saying "The board believed that his behaviour is not befitting of a CEO and is detrimental to the company".

I'm still not sure whether to side with Rahul or the investors. But he does like the spotlight for sure, even if it comes as negative publicity. I don't entirely disregard his opinion or frank talks, but there's a certain professionalism he lacked viz. bringing boardroom talks to media frequently, trying to sensationalise how he talked brazenly to the VCs.

<comment><USER5> What has been the accomplishments of housing.com?

<comment><USER6> They have raised some 120 mn in 5 rounds of funding (the last one at 250 mn valuation). I haven't seen the traction yet, which is probably ok for a 3 yr old company. The product is good, but the market in India is still nascent.

The problem is that the only reason I hear about them is Rahul's antics.

</comment></comment></comment></comment><comment><USER7> This story reminds me of Boo.com during the dotcom boom. I wonder if india's startup culture is bubble and it is soon going to burst.

<comment><USER8> There is a newly available 150 Million middle-class with smartphones and Internet.

The huge market in each city (Bangalore alone has 1 Million IT folks, middle class is ~5 Million), the high density (10K/sqkm), high Internet penetration, make this a market comparable to the largest US cities. These cities now have critical mass to kickstart new product companies.

The daily friction of life is so high, that home delivery/ecommerce is changing the entire retail landscape including in food and groceries, and soon in services too.

Bangalore is on par with SF on food/grocery delivery, and perhaps ahead on services delivery (see home medical service startups like Portea.com).

Startups are not a bubble per se. We need more startups to smoothen out the rough edges of life in India.

However, late stage valuations may be in a bubble. In the early stage, valuations are moderate.

<comment><USER9> Quick question: If one were to look for such quantitative figures that you provided what would be a good way to find them.

<comment><USER8> Was from Wikipedia + Google + back-of-the-envelope.

Didn't find things in one place.</comment></comment></comment></comment>


Treat Medicines Like Netflix Treats Shows - <AUTHOR> https://www.nytimes.com/2019/03/05/opinion/can-netflix-show-americans-how-to-cut-the-cost-of-drugs.html <comment><USER2> This is insurance. Literally insurance.

You pay a monthly fee in return for a good, service or cash payment should something happen.

however in the USA, something odd has happened. For what ever reason, be it legal, cultural or other, copay, crippling buerocracy and down right greed has stopped the health system working properly.

The problem with a "netflix" model, is that doctors can currently prescribe anything, regardless of cost or efficacy. There are legions of people around the USA bribing doctors to prescribe expensive generics. Until that practise is stopped the US system is sunk.

For insurance to work, US doctors must follow national guidelines laid out by a scientific body (ie NICE in the UK) any deviation without justification would/should lead to fines and censure. They would set out a list of drugs that work for certain conditions, anything else is either poor value for money, or the wrong drug.

The very fact that medicare is legally barred from negotiating volume discount tells you that some deeply wrong has happened.

<comment><USER3> >The problem with a "netflix" model, is that doctors can currently prescribe anything, regardless of cost or efficacy

Unknown to almost everyone in the US is that if you are a Medicare patient, when you go to fill a Rx before the pharmacist fills the therapy, insurance software suggests cheaper generics to the pharmacist and requires the pharmacist to do the leg work of asking the doctor to change the Rx based on what the insurance company wants (ie the cheaper medication).

So the question might be..why would a pharmacist do what the insurance company software tells them... or why would a doctor second guess their initial Rx at the request of an insurance company trying to minimize their costs? Because if the pharmacist/pharmacy doesn't do what insurance says or if the doctor doesn't do what insurance says, they get dropped from the insurance network.

<comment><USER4> > insurance software suggests cheaper generics to the pharmacist

I have never heard of pharmacists using "insurance software". The pharmacy system requests coverage from the patient's insurance, and it is either accepted or rejected.

Additionally, if there _is_ a generic they just fill it, assuming the patient consents. In fact, pharmacists in many states are _required_ to point out generic alternatives if they exist.

> requires the pharmacist to do the leg work of asking the doctor to change > the Rx based on what the insurance company wants (ie the cheaper medication)

If a prescription requires modification, the _patient_ is required to go back to their doctor. Pharmacists cannot just ask doctors for prescription modifications.

Where are you getting these ideas from?

<comment><USER5> >If a prescription requires modification, the patient is required to go back to their doctor. Pharmacists cannot just ask doctors for prescription modifications.

>Where are you getting these ideas from?

This is not strictly true, at least in the US. I have had to wait while pharmacists contact the doctor to modify a prescription to sub something in due to availability issues.

The mail order service through my insurer will also do this to have doctors to order a 90 day supply rather than the usual shorter supply.

<comment><USER4> You're right, my statement was too absolute. What I meant to convey is that pharmacists cannot just ask for modifications without the knowledge and consent of the patient.

</comment></comment></comment></comment></comment><comment><USER6> > For 1 billion Australian dollars — $766 million U.S. — Australia gets, for > five years, all the hep C medicine it can use.

What will happen in five years ? If we follow the Netflix model, a _lot_ of what used to be available will simply stop being there because the producer will markup the price significantly. In Netflix case, I don't really care since I can download the movies from other sources anyway, but for drugs ? No thanks. The consequence of getting a fake product from the black market are orders of magnitude worse than downloading some porn.

<comment><USER7> > _What will happen in five years ?_

According to the article, Australia is on track to have hep C eradicated by 2026.

<comment><USER8> That's 7 years away...

</comment></comment></comment><comment><USER9> A great theory but one major flaw. The utility value of most tv and movies comes when they are brand new with quickly diminishing returns afterwards.

Drugs on the other hand have equal utility for their lifetimes (until replaced by something better, which can in some cases take centuries). In fact sometimes a secondary use for a drug is found and its utility goes up.

Entertainment rarely has increasing utility. Even the biggest sleeper hits have a short peak of utility until returning to baseline.

It's two totally different utility models and I don't think the cost models are transferable.

<comment><USER10> I don't understand how you're measuring.

Hep C medicine has zero utility value for me right now.

And I'm enjoying watching Brooklyn 99 from the beginning right now, because I'd never seen it. My wife is watching series after series on Netflix that are all old.

My daughter is enjoying the entire archive of Disney movies. Snow White is what, 82 years old?

When Incredibles 2 is coming out, you can bet the utility of Incredibles 1 went way up.

That said, I think you're being entirely too specific and literal. It's a bad, clickbait analogy. And? Buy medicine in bulk. Not a huge leap to make.

<comment><USER11> Maybe because that's just you, a unique individual.

For a different unique case, such as someone who has Hep C, the utility value for the medicine could literally be everything for the person.

So, if we average the utility value for a whole population, the utility value would actually be pretty high, especially if a lot of people have Hep C.

<comment><USER10> I'm sorry, can you explain how we "average" the utility?

For me, it has zero value.

For another person, it saves their life, and they would pay literally anything they could.

How do we average that?

My hot take: We can't. Buy medicine in bulk, give it to people for free, progressive taxes to pay for it.

<comment><USER12> I like your take, but how are we going to enforce progressive taxation? The wealthiest firms escape taxation, at the moment.

<comment><USER13> We ought to tax wealth instead of income, and tax individuals instead of corporations. The nature of corporate wealth is that the generation of value is disconnected from the generation of cash. It's impossible to fairly regulate the infinite shell games that result from this. The problem we are trying to fix is inequality of wealth, so we should tax wealth directly and not via proxies like corporate profits.

</comment></comment></comment></comment></comment></comment><comment><USER14> I'll just leave this here:

[https://en.m.wikipedia.org/wiki/Cost_of_drug_development#Res...](https://en.m.wikipedia.org/wiki/Cost_of_drug_development#Research_and_development)

<comment><USER15> Not sure if you're posting this as a disagreement with the suggested model, or agreeing.

From the link, it looks like it costs ~$10bn per successful drug, at the top end of that list.

Australia paid $750m for 5 years access.

Australia has ~1/10th the population of the United States. and ~1/3rd the population of the UK.

If just the UK, USA and Australia paid at that same rate (per capita) then they would cover that 10bn average development cost in 5 years.

Seems like it's a good suggestion

<comment><USER16> I imagine the Hep C drugs are some of the more monetizable drugs though and will need to rake in more money to subsidize the development of niche drugs.

</comment></comment></comment><comment><USER17> I went to PAMF in Palo Alto, california yesterday for a "group diagnosis session" with the dermatologist. It seems dermatologist appointments are hard to get, so they came up with this method. You sit in a circle with other patients and doctor comes to each of you and quickly checks what happened to you and prescribes medicines. If she thinks it requires deeper consultation, she will scheduler private visits.

I thought this is a good system, especially if you are young and kind of know that what you have is one off fever or some such thing.

What am I missing? Why are more hospitals not following this? Why is no one applying to YC with this idea?

<comment><USER18> I would not be comfortable with that method, and would definitely find a new doctor if I was presented with that situation

<comment><USER17> Well big ailments I would mind too. But small ones like fever or flu, I am ok particularly because its much less time consuming and much cheaper.

<comment> xkcd-sucks Ah, a reverse quarantine

</comment></comment></comment></comment><comment><USER19> Maybe I'm missing something, but discussions on the cost of medicine never seem to question whether using prescription drugs is the right choice to begin with.

IMO, it would be far preferable to treat pharmaceuticals as a last resort, focusing instead on preventative medicine and addressing the underlying social issues that cause the medicine to be prescribed in the first place. From the article:

 _Hep C kills more people in the United States than all other infectious diseases combined. Cases are soaring, largely caused by injection of heroin and opiates; it's a blood-borne virus spread by sharing needles._

Surely the solution to this epidemic is to address the underlying drug problems first?

Edit: I'm not suggesting that the treatments be ignored or that people who already have the disease aren't helped. But rather that if X disease has an increase in cases, the only solution shouldn't be to treat it - it should also be to figure out why it's increasing and then try to prevent it.

<comment><USER20> > Maybe I'm missing something, but discussions on the cost of medicine never > seem to question whether using prescription drugs is the right choice to > begin with.

Because it's pretty darn obvious that once you have Hep C, yes, prescription drugs are the right choice. No one's pumping Hep C drugs into people who don't have Hep C.

> Surely the solution to this epidemic is to address the underlying drug > problems first?

I'd recommend addressing both problems at the same time. There's no reason we can only do one.

<comment><USER21> > No one's pumping Hep C drugs into people who don't have Hep C

However, that is what is being done with HIV drugs under the guise of PrEP

[https://en.wikipedia.org/wiki/Pre- exposure_prophylaxis](https://en.wikipedia.org/wiki/Pre-exposure_prophylaxis)

So I wouldn't be so quick to rule it out, specially if Pharma companies see a way to profit out of it.

<comment><USER22> > Under the guise of

I thought y'all were all about prevention? Now you're acting like preventing acquisition of a lifetime disease is a bad thing.

<comment><USER21> Prevention is great, and I'm certainly a big fan of it...

but by overexposing people to the drugs that are actually effective against HIV we're both helping the virus evolve around them and having to deal with whatever adverse side effects the drugs have on healthy patients.

</comment></comment></comment></comment></comment><comment><USER23> Seems like Ben Thompson's aggregation theory could be useful to look at here.

Netflix & Spotify are aggregators, they own the consumer and distribution. Acquisition of movies costs either royalties to a studio or cost to produce the movie (actor salaries, etc.) Royalties are probably negotiated and the aggregator has leverage in negotiations because they own the consumer and distribution to them.

Insurance owns the patient, but the patient doesn't necessarily get to choose the medication. Their condition plus the doctor's prescription dictates what medication they can use. You're also not allowed to shop around for doctors who will prescribe what you ask for. Pharmacies own the distribution of medication. Drug companies need to recoup the massive R&D costs of developing drugs and thus are granted 20 year patents. This is somewhat similar to studios producing content and the copyrights afforded to those studios.

Not sure how to put all of this together but I think a big difference is that the consumer doesn't have discretion like they do in the Netflix/Spotify space. Maybe a good parallel would be Friends/Garth Brooks. If I want to watch Friends, I have to use Netflix or if I want to listen to Garth, I have to use Amazon Music. But despite the fact that I enjoy Garth's music, I can live without it or I can get it through other means (youtube, buying an album direct from a studio-owned distribution channel, etc.) People literally cannot live without some of these medications so consumer discretion is removed there.

Also, consumers don't have the ability to self-diagnose and self-prescribe. There are also no other distribution channels for medication. All of it must come through a pharmacy. There is no distribution done by the owner of the consumer(insurance companies), although PBMs may be a similar model?

Maybe somebody else could help me fill in the gaps with how the aggregator model is different from the pharmaceutical model or identify mistakes in my assumptions.

</comment><comment><USER24> It really boils down to what a society values. Does it value caring for people and health or does it value hurting people for profit? We have the tools to be caring but in America, we generally don't use them because we value companies' profits above all else. We let corporations profit as much as they want off the suffering of others. We used not to, as the article points out. We can override patents. We can see drug users as human. We can try to eradicate diseases like hep c. Or we can go our current path and let corporations profit while millions die. It's really a cultural issue. Do we want to be compassionate or do we want to exploit our own people? That is the question being asked when we talk about reducing drug prices and having national healthcare instead of the vile insurance and drug industries we support now. It's not looking too hopeful for compassion at the moment.

</comment><comment><USER25> Cool, I'd love to share my insurance with 3 people strategically distributed across time zones to avoid contention.

But please don't send me emails about my insurance being suddenly used in Egypt. Those false alarms are really worrying.

<comment><USER26> The pop up alerts when your friend's ex's mother gets an abnormal blood result can be a real drag.

</comment></comment><comment><USER27> The system is too entrenched especially after all the unchecked consolidations disguised under the ACA. Put it bluntly it's disgusting. The drug pricing trends we are seeing is a form of regulation arbitrage. We need to overhaul the FDA and the way new and old drugs are approved.

</comment><comment><USER28> The reason why Gilead is doing this is because their hepatitis C franchise has already slowed and will likely be much smaller in a few years. Far better to negotiate a deal like this and lock a country into buying your treatment than to lose market share against competitors.

</comment><comment><USER29> If only we had private companies that can freely experiment with different business models...

</comment><comment><USER30> This seems quite important, and raises questions about whether free market capitalism is actually the best or only model to spur innovation (spoiler: I don't think it is, at all).

<comment><USER31> Especially when lives are at stake! Market capitalism is probably fine for coffee shops, less so for insulin pumps.

<comment><USER32> The part of medicine that's often overlooked is the creation of new medicine. Usually the discussion goes along the lines of "we can make pill X for $0.1 each, but these greedy pharmaceutical companies just want profits". But what they're missing is that without those pharmaceutical companies we probably would have far fewer treatments/drugs in the first place. Doctors and labs need money to run. Investors help with that. If you chase investors out then less research will be done. You won't feel it immediately but after a decade or two it will catch up with us.

<comment><USER33> > If you chase investors out then less research will be done. You won't feel > it immediately but after a decade or two it will catch up with us.

I don't think you'll feel it... BUT, if we keep investing in drug research we'll feel it :)

You don't have to look far to fine an article like "Cancer Statistics Report: Death Rate Down 23% in 21 Years"

I'm not sure we'll notice if the improvements don't keep coming, but we will notice if the improvements keep coming :)

Today, we're keenly aware how HIV isn't a death sentence anymore.

</comment></comment></comment></comment><comment><USER34> We are big pharam, give us tons of money and hope that we cure you! We don't! we just treat you.

</comment><comment><USER35> We desperately need a socialist pharmaceutical industry: The same researchers that work for Gilead Science could work for the NIH. Instead of directing research at the most profitable niches it could be directed at the guidance of the CDC.

</comment><comment><USER36> Line 2 of the article is:

> Why can't the United States?

The answer is either "regulatory capture masquerading as capitalism" or "but that'd be socialism!" depending on how snarky you're feeling.

<comment><USER37> I don't think most people have fully internalized the fact that insurance companies are fully invested in rising medical costs since their margins are regulated and their BoD are looking for rising profits. Their "everybody wins!" means everyone who pays for medical care loses.

They would rather drive lower cost independent doctors into a higher cost hospital systems as long as all of their competitors pay the same... and they do.

</comment></comment><comment><USER38> So, I should binge on them?

</comment><comment><USER39> Am I missing something:

>A study just published in The New England Journal of Medicine found that on average, Australia pays $7,352 (U.S.) per course of treatment. It has been able to treat seven times as many patients as it would without the agreements.

I guess the reason we don't treat medicine like Netflix is because most people don't want to spend $7352 for a course of penicillin....?

<comment><USER4> What does penicillin have to do with this?

<comment><USER40> I don't want to put words in their mouth, but I think it might be a bundle vs a la carte argument. For issues that tend towards short term treatments (eg a handful of antibiotic pills to mitigate the risk of wound infection) then you don't want to pay the same total price as someone who is treating some chronic condition.

I can't find statistics on comparing one-off and routine prescription drug use. CDC data from 2014 shows that when asking about a 30 day period 47% of the population used >1 prescription drugs, 21% used >3 drugs, and 11% used >5 drugs. That suggests to me that there is a large population of people who could be bundled together, but for the context of the article this would all depend on the specific treatments.

[https://www.cdc.gov/nchs/data/hus/2017/079.pdf](https://www.cdc.gov/nchs/data/hus/2017/079.pdf)

<comment><USER39> > I don't want to put words in their mouth, but I think it might be a bundle > vs a la carte argument. For issues that tend towards short term treatments > (eg a handful of antibiotic pills to mitigate the risk of wound infection) > then you don't want to pay the same total price as someone who is treating > some chronic condition.

Yeah this is what I meant. The article says that the Australian government offset the high cost of new Hep-C drugs by negotiating a flat rate of $7.5k per person per year for any Hep-C drugs, and then talks about the high cost of penicillin and epipens.

Nobody would use Netflix if the subscription fee had to account for films that cost billions in R&D and only 10 people were going to watch.</comment></comment></comment></comment>


Recurly releases API V2, client libraries and multi-subscription - <AUTHOR> http://blog.recurly.com/2011/10/api-v2-and-multi-subscriptions/

<comment><USER2> I wrote my own Python client for Recurly API v1 that I released a few days ago (<http://pypi.python.org/pypi/recurlib>) and asked them, last week, if I had their permission to release it publicly, not because I technically needed it but as a courtesy. I also asked them if they had any requests on what I should or should not name it; I thought it would only be polite to give them first dibs on the PyPi name. I also asked them if they had any requests on what license I should use. In the process, I reported a large number of bugs on the v1 API. They never answered any of my questions straight, they just said "we're releasing our own Python client". They never mentioned that releasing their own Python client was going to coincide with an updated API and that I was actively coding against a soon-to-be deprecated interface.

So thanks, Recurly. I spent a week writing a library to add value to your product without so much as a "good job" or a "that's cool", and when I extended every courtesy I could you basically said "fuck you" to me in every way possible.

<comment><AUTHOR> We certainly appreciated the efforts you contributed to the v1 version of our API Python library. As we had mentioned to you in our support exchanges, we realized our old Python library was not up to our standards, and that we had been working on a new client library - because this is such a large project with many working pieces, we were keeping it slightly under wraps to allow for flexibility in the release cycle.

That being said, we know many merchants will opt to stay in v1 of our API for some time, and your client library will be very much appreciated.

<comment><USER2> well to be honest that client library was written to address the shortcomings of the previous Python library, which didn't support Recurly.js (arguably the best part of Recurly), but the new Python client library does and my library wasn't completely finished yet. Even though I have to move some code on my project over, it frees me from having to finish writing that client library, which is honestly about as interesting as waiting for paint to dry so you can watch it chip. It's don't exactly wake up in the morning and think "I wonder what kind of XML I'll get to parse today".

I'm annoyed that I did a bunch of throwaway work that could have been easily avoided, but the API updates are a significant improvement and they solve a bunch of problems for me that I was previously forced to solve myself (especially the new support for multiple subscriptions), so it all comes out in the wash.

</comment></comment></comment><comment><USER3> But still no metered billing or check-receiving. These two features would really be a killer feature for Recurly/Cheddargetter/Chargify, as opposed to Zuora's $10k/month minimum fees.

<comment><AUTHOR> Metered billing can be accomplished through the Recurly API: <http://docs.recurly.com/subscription-plans/metered-billing>

</comment></comment><comment><USER4> How is recurly relevant any more, given Stripe and Samurai?

<comment><USER5> well first off they have many customers, I'm one of them, that use and love their product.

Second, anyone with an established merchant account that would like to add a recurring payments front to it is in the market for recurly and not as much stripe.

Not sure about Samurai, but Stripe is an aggregator of payments which can lead to problems down the line because credit card companies don't like to deal with aggregators because when issues arise with customers, the onus is on the credit card companies. Example: a Amex customer tells amex 'I never paid company X money'. Amex looks and doesn't see any payment to company X but a payment from Stripe which aggregated payments from Company X. This creates problems which typically yield in Amex refunding the customer but taking the hit because they can't prove it to the aggregator. It makes it very hard to resolve the issue and as a result credit card companies start playing hard ball with aggregators. Note: I'm a huge fan of Stripe and what they're doing. All the power to them.

<comment><USER4> Established merchant accounts are expensive.

Why pay those merchant account fees, and on top of that, pay another set of fees to be able to do recurring billing?

<comment><USER5> To be absolutely sure it will work.

Recurring billing is a whole separate issue. I've rolled my own before and realized how much of a pain it can become. Using recurly allows all non devs on my team to handle all the subscription and recurring problems without me having to build anything.

<comment><USER4> Stripe and Samurai don't work?

Recurring is built-in to both of those platforms, and the fee structure is far less.

I don't know why you're willing to put up with the credit card processing status-quo.

</comment></comment></comment></comment></comment><comment><USER6> What do recurly use to generate their docs?</comment>


Facebook Killer Feature Arrives (LinnkedIn Killer Feature) - <AUTHOR> http://www.allfacebook.com/2007/12/facebook-killer-feature-arrives/

<comment><USER2> I sincerely doubt this is going to kill LinkedIn. I've actually stopped using Facebook because the signal/noise was all noise. LinkedIn is far more professional and just being able to group my Facebook friends isn't going to do much unless I can make Facebook show different profiles to different groups of people. But, you know, why bother? LinkedIn works great for professional contacts, can't see any reason to try to embed LinkedIn inside Facebook.

<comment><AUTHOR> I totally agree that this is not a LinkedIn killer, but if FB is able to eventually get everyone on it, then this could be a LinkedIn killer...nevertheless this is a much needed feature

</comment></comment><comment><USER3> The official fb blog on this: <http://blog.facebook.com/blog.php?post=7831767130>

</comment><comment><USER4> This is not a LinkedIn killer.

As an example:

Facebook's job search feature is a joke - it's just a section of the "Marketplace" and is filled with the typical "Make money from home" ads.

LinkedIn solves legitimate problems business people have with Facebook and other social networking services.

</comment><comment><USER5> My Boss (Executive VP) is on LinkedIn.

His Kid (15 year old daughter) is apparently on Facebook.

Sounds to me like it's two different worlds. I highly doubt I'll be seeing my 50-some year old boss on Facebook giving me Vampire bites any time soon.

<comment><AUTHOR> Only if she was a bit older heheh... I do see your point, but I still think you'll be surprised to see how many important, and influential people are actually on fb and use it... also LinkedIn is def a more professional place but you don't always want to spend your time with your bussiness connections and in the office, sometimes there are other ppl in your so called social graph that you would like to socialize with and have fun ...and for that you def have to come to fb and not linkedin

</comment></comment><comment><USER6> "Facebook Killer Feature" - means a feature Facebook developed, meanwhile...

"LinkedIn Killer Feature" - means a feature that will kill LinkedIn.

Confusing. Yet another reason never to use "killer feature" or "_____ killer."

<comment><USER7> Whatever it is, it's a killer LinkedIn killer Facebook feature!</comment></comment>


"Thorium Core" Kickstarter campaign to commercialise ReactOS - <AUTHOR> https://www.kickstarter.com/projects/thorium/thorium-core-cloud-desktop

<comment><USER2> Don't support this! Thorium fluorid reactors would be a good thing, but this is not what it is about. They're a CIA operation intended to confuse things up.

No money for a bad name!</comment>


Does software performance still matter? - <AUTHOR> http://lemire.me/blog/2017/03/20/does-software-performance-still-matter/ <comment><USER2> No one answer works for everyone nor for every situation.

I've been programming for 49 years. I'm self-taught and not very good at it, but people thought I was brilliant. They did because I ignored efficiency and pushed the machine far beyond what was done by those folks who were handicapped by their concern for efficiency.

One program ran for 3 days. Another user-focused highly interactive program kept the user waiting for 26 minutes. It didn't matter how long it took because the result blew everyone away. It looked like something out of Star- trek even though it was straight forward work. I felt guilty because I knew there were far better programmers working there, but they were unwilling to abandon small foot print and rapid execution as the metrics of "good" programming.

This worked for me because I could choose my own projects within the limits of my employer's goals. Creativity mattered. Again, there is no one answer to this question. It depends of the situation.

<comment><USER2> I haven't worked professionally since 1995, so my example will seems too obvious. It's hard to believe how drastically things have changed and how our _expectations_ have changed.

My most striking work was finished in 1989. Any mildly competent programmer could use a framework to do what I did today. I had to carve my own framework out of a block of wood. Maybe I exaggerate a little bit. Yet, creating that framework wasn't really difficult. The technology (dynamic color graphics and mouse monitoring) had been around for a few years.

We had a data base of polygons representing the boundaries of geological formations, a data base of mineral deposits, and an extensible data base program (4D). I wrote extensions to display interactive geologic maps on a mac screen.

The user did a search for mineral deposits of interest. The mac displayed their locations on a custom map. When the user clicked on a location, the mac displayed the complete data record for the deposit. The user could get similar information for other objects displayed, e.g. faults, Forest Service boundaries... Believe it or not the USGS national headquarters was actually considering waking up Ronald Regan to show him what we could do. Times have changed.

Most GUI apps at that time were pretty static. Click on a button. Type into a text field. Click on a text link. Drag a rectangle... Complex displays that were custom created for the user and that contained deep information were largely unknown.

"Programmers did not do things like that." While I had great respect for those guys, they were self-limited by their expectations. The very real demands for small footprints and fast execution times imposed by hardware and software limitations of the past few decades had been so binding on the profession's expectations that few of us realized we were unnecessarily limiting our imaginations. Times had changed. The first time this app ran, it took 26 minutes. It did not matter. That's what the others missed. Any passing similar inspirations (and I'm sure many had them) were immediately rejected as unrealistically slow, too futuristic to consider practical.

I think that our expectations are still limited by excessive concern for efficiency. I admit that programmers working in a production environment have little or no choice in the matter. There, creativity is properly focused on obtaining efficiency.

The big question is what marvelous innovations are our current perspectives grounded in the past hiding from us, innovations that in the future will be considered mundane.

</comment></comment><comment><USER3> We've all heard this, but it's important to practice it:

Premature optimization is the root of all evil.

<comment><USER4> Too often the word "premature" is forgotten, and too often "optimization" is understood to be "any care about performance whatsoever, either low-level or high-level".

The comment comes from a time when people would regularly do foul things like changing code similar to a switch/case into something that involves shoving an integer directly into a flags register or worse. (then you must add another case or port to different hardware... uh oh!)

Failure to think about performance from the beginning can get you in deep trouble. The worst case is when there is no bottleneck to be found by a profiler; instead there is slowness spread all throughout. This may force a total rewrite or abandonment of the project. Language choice is particularly prone to causing this, but habitual poor choices can mess you up just as badly.

</comment></comment><comment><USER5> Based on my web browsing experience these last few years, fewer and fewer JavaScript devs feel that performance matters.</comment>


Disco: running commodity operating systems on scalable multiprocessors (1997) [pdf] - <AUTHOR> http://research.cs.wisc.edu/areas/os/Qual/papers/disco.pdf <comment><AUTHOR> Research paper on VMMs by three of the people who later founded VMware.</comment>


Google Allo and Duo, new messaging apps - <AUTHOR> https://googleblog.blogspot.com/2016/05/allo-duo-apps-messaging-video.html?m=1 <comment><USER2> Can anyone explain the management at Google and why they continue to produce these products that seem to be copies of copies of programs that have been failures, before they even launch? Is it like an octopus where the 7th tentacle doesn't know what the 1st is doing?

I'm very curious about the decision making process at Google these days.

If the world needs anything, it's one more messaging app. /s

<comment><USER3> But wait, this one allows you to make your own emojis that you can only use within its app!

<comment><USER4> Don't forget the scaling text and emojis!

</comment></comment></comment><comment><USER5> Oh look, Google's 67th messaging app attempt. I'm sure it's going to be a killer this time... Preset responses, seriously??? bwahahahaha, only a socially challenged googler could've thought of something like this.

<comment><USER6> > Preset responses, seriously???

I'm guessing that they've got some pretty good experience with the reception the same feature has had on Inbox, where its been around for a while. Just because its not something that seems useful to you (I rarely use it, but it has sometimes been useful for quick and contextually appropriate acknowledgements) doesn't mean it doesn't have value to the broad base of users Google is targeting.

</comment></comment><comment><USER7> No desktop app means it will never be able to compete with Skype. I don't even see a reason trying out the phone apps.

<comment><USER8> Similarly, Messenger and Whatsapp have awesome web clients. Very surprised by the mobile-only strategy.

<comment><USER9> Whatsapp has also a PC/Mac desktop app since a few days.

</comment></comment></comment><comment><USER10> This is absolutely baffling. Not a replacement for Hangouts, doesn't integrate with SMS... it's dead before it has even started.

<comment><USER11> I just don't get it anymore. There are two primary modes for chatting, SMS and IM. Integrating with both has its challenges, but it can't be impossible. If someone could just create an app that makes messaging via the two systems seamless, they'd dominate the market.

<comment><USER12> Signal works nicely enough for me.

<comment><USER13> Only on Android is Signal able to merge its IM with SMS. iOS doesn't expose this capability so only iMessage does it.

<comment><USER12> Well if you buy into a walled garden you can't expect other devs to be able to get in if the owner of the ecosystem won't allow it.

</comment></comment></comment></comment></comment><comment><USER14> Features only an engineer could think of.

i can imagine clicking even once on the preset responses and then receiving a barrage of curses from the other side from having used it.

<comment><USER15> I use suggested responses on Inbox all the time. People tend to send lots of email that only needs a one line response, and the suggested responses of "Thanks for confirming", "That time works for me", etc. are perfect.

Likewise in social messaging apps there are a lot of "transactional" style conversations where you need to confirm receiving the text message with some expected response. In an instant messaging program these bot suggested responses will work fine for all the one line responses like "cya soon!", "looking forward to it!" , and even "I love you too!"

If anything bot suggested responses mean that the longer form less vanilla text messages you type out are more meaningful. It will encourage people to send stuff that isn't so basic and trivial that a bot can form an adequate response.

<comment><USER16> Email messages you describe are formal and generic replies can be useful. But hitting canned replies to my friends and spouse is a bit sad.

<comment><USER15> The way I see it there are two types of messages to friends and spouse. There is the silly little stuff like "Check out this cute dog!" and if Google suggests "Awwww!" as a response, and that was pretty much what I was going to type out anyway then I'll just hit the "canned reply".

If its a serious message though like someone telling me that their relative is in the hospital I'm probably not going to hit an automatic reply like "Sorry to hear that", I'm going to type out a longer message.

</comment></comment></comment></comment><comment><USER17> Chat and VoIP networks with no desktop clients...? I'll stay with Hangouts, thanks.

</comment><comment><USER18> "Allo is a smart messaging app that makes your conversations easier and more expressive"

For a moments I though they found the cure for socially awkward people like myself :)

</comment><comment><USER14> And yet another feature-limited non-standard IM solutions to alienate everyone even more.

</comment><comment><USER19> So I should have 3 different Google messaging apps? Please stop

<comment><USER20> If you're on iOS, you should use Google Hangouts to communicate with people across iOS, Android, and Chrome. But it doesn't integrate with the portable Google Voice number, so you'll also want that app. And now YouTube has been relaunched with native messaging capabilities, so you'll want to install that too to talk with YouTube users. But that won't let you communicate with all the people on Google+, so you'll need to install that too. But of course, you won't get all the latest features for all these messaging apps unless you get the new Allo and Duo, so you should really have all 6. If you're on Android, you can add a 7th with the native SMS app.

Actually, I forgot that you'll also want to talk in small groups about special interests, so you'll need Google Spaces. You really only need 8 apps to message people with Google.

</comment></comment><comment><USER21> End to end encryption ... with bots examining your chat to provide adds. Maybe we should call this end to _and_ google :-)

</comment><comment><USER22> Have to say, that restaurant booking example is pretty handy. Can't see myself using this though

</comment><comment><USER23> Is this supposed to replace Hangouts or be a Hangouts that's attached to your phone's SMS? Also, where does this mean Voice's SMS capabilities are now canned?

</comment><comment><USER24> Do these have anything to do with Jibe, or is this yet another orthogonal dimension to messaging at Google?

<comment><USER24> It turns out they have nothing to do with Jibe. This is what I was able to dig up: [http://www.telirati.com/2016/05/telirati-analysis-18-quic- br...](http://www.telirati.com/2016/05/telirati-analysis-18-quic-brown- fox.html)

</comment></comment><comment><USER25> This is just becoming ridiculous..</comment>


Show HN: Www.HowDoIQuitV.im - <AUTHOR> http://www.HowDoIQuitV.im <comment><AUTHOR> After the excitement yesterday I couldn't resist :)

<comment><USER2> gotta say the original 'how do i quit vim' website is easier to follow

howdoiquitvim.com

also doesn't put www in front of it

<comment><USER3> I didn't really like what happens when you click no, seems a bit mean!

</comment></comment></comment><comment><USER4> Shows a 123reg holding page for me

<comment><AUTHOR> yeah i messed it up, fixed it and made it more exciting in one breath.</comment></comment>


Work-Life Balance is BS - <AUTHOR> https://medium.com/desk-of-van-schneider/work-life-balance-is-bullshit-f51bf8b3767#.t9m9y8csn <comment><USER2> >I strongly believe that every person can make a living doing something they love. And often enough, it's more of a mindset to become happy with your work. Often it's not the work that sucks, but how we see it.

>I remember, many years ago I asked a "Waste Collector" on the street what happened that he has to work in this job? (notice how my question was with negative assumptions in the first place)

>With a smile on his face he replied. "I've been working as a Garbage Guy for more than 20 years now, I love this job and would never trade it for anything else."

This is a pleasant idea, but not everyone can convince themselves that they love being a garbage man.</comment>


Ask HN: What do you listen to while coding? - <AUTHOR>

What kind of Music? Or do you listen to anything at all? <comment><USER2> <http://musicforprogramming.net/>

<http://simplynoise.com/>

Groove Salad from SomaFM

And often, simply quiet. Quiet is underrated in my opinion.

<comment><USER3> thanks for sharing those links, awesome stuff.

</comment></comment><comment><USER4> I created a Programming Music playlist and started out with very mellow, non- lyrical music from Tycho. From there, I kept following the Related Artists feature (I'm using rdio) and added a number of other artists including Ulrich Schnauss, Isan, and others. It's taken some time, but I'm able to concentrate on my work without being distracted, while the music tends to keep me upbeat and focused.

</comment><comment><USER5> Depends. I have a whole pile of various Pandora stations I've created, that I listen to sometimes. Most of those are rock/metal centric, but there is one focused on gangster rap stuff.

Other times, I like to listen to trance / electronic music / europop stuff, and for that I tend to just find a shoutcast station and tune into that. Same for the times when I'm in the mood for classical music.

Always, however, the Prime Directive remains "ABC" - Anything But Country.

<comment><USER6> Me too, country makes me feel like dancing!

</comment></comment><comment><USER7> The best offices I've worked in have always had a Spotify account set up, so anyone can remotely connect to the machine running Spotify and put whatever they want on.

It's good because we always get a mix when people get past letting others know how bad their taste in music goes. We've gone from Paramore to Jurassic 5 to John Mayer in the space of an afternoon before, and the mix tends to help everyone relax.

</comment><comment><USER8> I search YouTube for the term "Full Album" and am surprised each day about the full albums that got uploaded there.

I also listen to soundtrack mega mixes(songs of 4 hours+ that mix various soundtracks).

</comment><comment><USER9> God is an Astronaut ([http://www.youtube.com/watch?v=oMEGJ- Jk58Q&playnext=1...](http://www.youtube.com/watch?v=oMEGJ- Jk58Q&playnext=1&list=AL94UKMTqg-9BO0mvKQHXXSc9l00s2uKN7)), when there is a lot of noise around else _Quiet_ . Also, sometimes I listen to: <http://www.rainymood.com/> . I read somewhere that hearing the sound of rain makes us Happy subconsciously (Humans depending on Agriculture for a long time etc,.)

</comment><comment><USER10> SomaFM. Makes me feel like I'm in a science fiction epic.

</comment><comment><USER11> BBC1 Essential Mixes. It's a great way to discover new styles of music while listening to the (hopefully) best, curated tracks of each genre.

</comment><comment><USER12> Mostly music without words as I find it less distracting. Usually Electronic stuff, Classical or some Jazz.

</comment><comment><USER13> <http://www.getworkdonemusic.com/> mostly

</comment><comment><USER14> shortwave recordings of numbers stations from across the globe. (The Conet project - <http://irdial.hyperreal.org/the%20conet%20project/>)

Also, lush from Soma.fm

</comment><comment><USER15> Lots of turntable.fm's "Ambient Chillout & Trip Hop" channel.

</comment><comment><USER16> Rodrigo Y Gabriela: <http://open.spotify.com/artist/7vX3cMVyW8gtDA4y855ynF>

</comment><comment><USER17> Anything I've heard 10+ times before. If I try to listen to a new song or album while I'm concentrating I'll lose focus too often.

</comment><comment><USER18> I listen to anything electronic or just nature sounds. Neither have that much structure, and they definitely do not have vocals.

</comment><comment><USER3> quiet, post rock, or noise (think 65 days of static) when it's really time to get something done. pop trash when it's just time to do whatever else:

<http://www.codercowboy.com/2012/12/19/music-to-code-by-2012/>

</comment><comment><USER19> 8tracks, and usually whatever I'm feeling at the time (Reggae, Blues, Indie Electronica, or Hip Hop).

</comment><comment><USER20> In work: Nothing

At home: I normally have a TV show playing in another tab

</comment><comment><USER21> I switch it up. Sometimes I use my phone's static noise generator (Ambiance on iOS and Android) and set a timer for 50 minutes.

If static noise is causing my mind to go numb, I'll switch to classical...well-known pieces that I've listend to hundreds of times. When I'm not doing anything particularly mindbending, I'll put on alt-rock...Lana Del Ray and Florence + The Machine have been my go-tos recently.

</comment><comment><USER22> Mainly rock (Guns n' roses, ACDC) and pop (MJ,Maroon 5).

</comment><comment><USER23> ... the sound of silence (not the song)

</comment><comment><USER24> Pink Floyd, RHCP :)

</comment><comment><USER25> My office I don't have the "quiet" option. Specially because we don't have money for some equipment, I and my associate sit next to the other, and we are near a very noisy road with lots of trucks and buses.

So, to code, music is needed!

sometimes I hear demoscene music, be it from a radio (like nectarine: <https://www.scenemusic.net/demovibes/> ) or from musicdisk (specially BitFellas bitjam vol 1.1: <http://www.pouet.net/prod.php?which=31658> )

That is, it is already some good time that I don't stick with trackermusic, I am mostly using youtube.

For that I have:

Programmers rock: [http://www.youtube.com/watch?v=w9TGj2jrJk8&list=PLBB8AAF...](http://www.youtube.com/watch?v=w9TGj2jrJk8&list=PLBB8AAF63722EEEE5) Programmers zone: [http://www.youtube.com/watch?v=mqrsNIHssTU&list=PLCC8F93...](http://www.youtube.com/watch?v=mqrsNIHssTU&list=PLCC8F930EC4692DA7) and this list of metal touhou remixes: [http://www.youtube.com/watch?v=un8y1IbbMno&list=PL8736B2...](http://www.youtube.com/watch?v=un8y1IbbMno&list=PL8736B2E1102136CA)

Sometimes I go with OCRemix lists too.

<comment><USER26> Care to share more playlists? Brazilian here too

<comment><USER25> I don't have more :(

I used to have a iPod filled with all Engenheiros do Havaí tunes, U2 and Cansei de Ser Sexy

</comment></comment></comment><comment><USER27> Silence.</comment>


Too Perfect a Mirror - <AUTHOR> http://jefferai.org/2013/03/24/too-perfect-a-mirror/ <comment><USER2> The number of commenters that think the KDE sysadmins were stupid enough to not know that "raid isn't a backup strategy" is depressing. You either didn't read the article or you haven't understood it.

Git repositories contain redundant information to perform consistency checks. If a bit flips in one of your repos, _git fsck_ will immediately catch it. The KDE sysadmins thought these consistency checks were triggered when keeping a repository clone in sync and thus any FS level corruption would be caught at the first subsequent attempt to sync.

If you think "Gee, if I know this, surely they do?!" then perhaps the answer is: "They probably do and this issue is more subtle than you initially thought. Reread carefully before implying how dumb others were."

<comment><USER3> Relying on consistency checks will not save you if someone does the git equivalent of rm -rf on the master repository. Which is why mirroring (of any description) is _not_ _a_ _backup_ _strategy_.

Yes, git --mirror should probably automatically invoke the moral equivalent of git fsck by default in order to catch internal repository inconsistency like the other git commands do, and the KDE team have been caught out by this. But they still don't have any protection against user error leading to loss of data with this setup as far as I can see, and that seems like a huge oversight.

<comment><USER4> Surely every backup system has some equivalent of an rm -rf ? A disgruntled employee could phone the off site tape archival company and tell them to toss all the tapes in the shreader.

<comment><USER5> In the specific case of offsite tape archival, let's say someone who has the authority to do so requests that they destroy all tapes.

Most service providers (who stay in business) have enough compliance features in place so that multiple authorized people have to be in collusion, a sufficiently senior executive must make the request, or there will be a "package" ready to be served to the client and relevant policing unit (police, FBI, whatever) so that charges can be brought against the malefactor efficiently.

While you may be limited in financial compensation by your contract with the service provider, it is absolutely in their best interest to avoid the situation with procedures (they do not want to be a party to a crime) and if those fail, to provide extensive records of the movement and disposition of those tapes.

</comment></comment></comment></comment><comment><USER6> How many times does it have to be said? Mirroring is NOT a backup strategy!

The number of times I've seen some sysadmin(s) base their entire organization on this faulty premise is absurd. Mostly it's because they have decided that RAID 1 or RAID 5 should be a decent "backup" strategy, but then there are those who believe mirroring systems is how to do backups.

They never, ever, take into consideration what happens when something corrupts/is deleted/is compromised. Without a way of going back in time (i.e. an _actual_ backup) they are forever stuffed.

Sysadmins: MIRRORING IS NOT A BACKUP SOLUTION. STOP DOING THIS!!!

<comment><USER7> Did you actually read the article? The mirroring in question is NOT block level like you'd see with DRDB or RAID.

It's the --mirror option to much of git's plumbing, and it's not the same thing.

<comment><USER8> I think you should re-read chris_wot's post.

> Mostly it's because they have decided that RAID 1 or RAID 5 should be a > decent "backup" strategy, _but then there are those who believe mirroring > systems is how to do backups._

I think he is implying that this is a case of the second. That is to say, I think he is saying that --mirror is not a backup strategy.

<comment><USER6> That's correct. Yes, I read the article :-)

<comment><USER9> You didn't. Mirroring in this case refers to using git --mirror.

You're assuming it works like a traditional file system or block level mirror, but it doesn't. Corruption would in most cases have been caught. The weak (and accidental) link was relying on the server to give us a proper accounting of the current valid repositories.

<comment><USER8> > _You didn't. Mirroring in this case refers to using git --mirror._

We have established that he knows they used git --mirror, and I am pretty certain that you could not possibly know that he did not read the article.

</comment></comment></comment></comment></comment></comment><comment><USER10> >The root of both bugs was a design flaw: the decision that >git.kde.org was always to be considered the trusted, >canonical source.

It seems that an even bigger design flaw is that they (still) aren't doing regular backups. The mirroring of course provides some redundancy, similar to what raid does, but as they say: "raid is not a backup solution".

<comment><USER11> Backups address the problem only to the degree that they give you an older revision to revert back to. The interesting thing that happened here is that corrupted data was propagated through the mirror network, which syncs more often than backups get made, and how to prevent that. Because while having a safety net is nice, avoiding developers being inconvenienced by a failure is the real challenge.

Plus unchecked backups of corrupted data aren't worth a lot, and corruption- proof mirroring acts as further (and timely) backup.

<comment><USER12> Having a hot standby/failover is nice, but of course only the icing on top of your backup strategy.

I read the article same as the OP, it doesn't mention any backup system, only the mirroring. In fact, they did restore from a replica that was out of date in the end (from projects.kde.org). Had they had actual backups, the article would surely mention they only used projects.kde.org because it was somewhat more recent than their last backup?

The story about planning to do regular ZFS snapshots hints to the same, if they had a backup system they wouldn't need that.

edit: sorry, is that your post/do you have more insight? In that case I'm sure you know better than me speculating on what the author meant ;-)

<comment><USER11> > edit: sorry, is that your post/do you have more insight? In that case I'm > sure you know better than me speculating on what the author meant ;-)

Nah, I'm not Jeff. I have some general insight because I was involved with setting up our git infrastructure in its early days, but I haven't worked on the mirroring code, and I've been out of the loop on day-to-day admin operations for a while, so I can't comment on the backup schemes that may or may not be in action on the servers right now.

</comment></comment></comment></comment><comment><USER13> I must say a big thank you to KDE's sysadmins. Please remember that they are doing this as volunteers.

</comment><comment><USER14> Something I haven't seen anyone mention in these threads is that KDE is an open source project - therefore they have hundreds (if not thousands) of backups.

Even if all the official repos where destroyed, all they'd have to do is ask the last person who'd pulled to give them a copy of their clone.

No doubt it would be a pain to do, but no data should have been lost.

As Linus said: "Only wimps use tape backup: real men just upload their important stuff on ftp, and let the rest of the world mirror it"

</comment><comment><USER15> An amazing thing about git (and other DVCSs as well) is that even if a much more serious catastrophe had happened (e.g., if a nuclear bomb had struck the KDE datacenter), it would probably still be possible to reconstruct (an approximation of) the master repo, simply due to the fact that it was fully cloned on hundreds of developers' machines worldwide.

Linus Torvalds once coined an adage that "real men don't make backups. They upload it via ftp and let the world mirror it." Well, the FTP bit isn't true anymore, but otherwise DVCSs have enabled this for mere mortals.

<comment><USER11> In terms of how this would be done practically: We did have intact gitolite logs I believe, which record the credentials involved in pushing any ref and what they're getting updated to, so we'd have known what data we would have needed to locate and who we could contact to provide it. And since the commit hashes describe their content, there wouldn't have been a risk of manipulated data.

<comment><USER16> Presumably the mirrors also did not run an aggressive 'git gc' immediately after 'git remote update', so they would still have non-corrupt commits in the object store, in which case you could recover by "just" resetting any corrupt refs.

</comment></comment></comment><comment><USER17> It would be interesting to here what someone from GitHub has to say about this, they must have dealt with this issue at some point.

Also I would be interested to know why KDE don't use something like GitHub or BitBucket? It would be cheaper for the organisation, and they could still setup web hooks to get notifications of commits.

<comment><USER18> KDE has a policy of not relying on non-foss services, as explained more eloquently by the other reply to this comment.

<comment><USER19> So they want to support Hetzner but not Github?

<comment><USER11> There are open alternatives to GitHub - we managed to put one together we're reasonably happy with, after all - but unfortunately the buck right now tends to stop at the hardware.

As for Hetzner: The git.kde.org master server isn't at Hetzner, nor are a bunch of the mirrors. Our infra is pretty distributed and eclectic as far as hosting locations go, partly because a lot of the resources are donated from all over. We don't "support" any hoster in particular.

</comment></comment></comment></comment><comment><USER20> To me, it sounds like the mirroring system is circumventing Git and is syncing the underlying directory structure, in which case, Git is absolutely not to blame. It's not a Git reliability issue. Had they been using "git fetch" on the mirror servers to clone from the backup servers, checking SHA1s while doing so, the issue would not have happened and the corrupt files would not have gotten silently replicated across servers.

<comment><USER21> > To me, it sounds like the mirroring system is circumventing Git

The mirroring system _which git provides_?

<comment><USER22> The mirroring they were using is explicitly meant to be a fast local ad-hoc clone that _doesn't_ do integrity checks.

They used the safe version before, because they were running into problems _with the integrity checks_ , i.e. ref deletions and non-fast-forwards.

What they should have done was to write a hook or a script that did those non- safe updates manually (maybe only for some repositories, and some refs, don't want to rewind e.g. master).

But instead they completely bypassed the safety mechanisms and got screwed by corruption.

</comment></comment></comment><comment><USER23> Unfortunately many of us learn this simple truth the hard way: a mirror is not equal to a (daily) backup.

<comment><USER24> Non-checking backups are not a perfect solution here. Running on non-ZFS filesystems, you can get slowly building corruption in files. When you take a backup, you copy that same corruption over to your backup as well.

Going back through years of backups to find a non-corrupt copy can take a lot of time during which your service is down. Not a perfect solution by a long shot. Discovering which files have been updated and which are corrupt is also non-trivial.

<comment><USER23> Do your daily backups using rsync+hardlinks (rsnapshot, dirvish or something similar) and keep a long history. This is slower than copy-on-write ZFS (obviously), but works reliably on any Linux/Unix file system and the storage cost is roughly the same as for ZFS.

<comment><USER25> This is kind of what I'm doing as backups, but I still don't feel safe (I'm kind of paranoid for my backups):what if an attacker gets in your server and wipes out all your data and backups? And you know Murphy is always ready to strike... I'm currently looking at making regular backups offline, on DVD or blue ray disks, and automating the process. I wonder if this might be a service people are interested in. Let me know what you think... (I put a landing page at <http://www.offlinebackups> to test reactions)

<comment><USER23> It is never a good idea to keep backup copies at the same place as the source data, so normally it should be not that common for an attacker to be able to wipe both original and backup. Regarding the offline optical disc backups, they are still ridiculously expensive compared to magnetic spinning drives or tapes. Backup, especially an automated one, is always an extra security risk to consider, but apparently there are no other good ways...

<comment><USER25> A lot of people put their backups on S3, with a script running on the server. Even if you limit the rights with IAM to only put files, the attacker can overwrite existing files on S3. The only way I thought to prevent that is to give only write access with no listing access, and append a random number to the file name. But, who does that? I'm sure 90%+ of the servers backing up on S3 are not safe for this scenario.

The reason I thought of DVDs is that they're not sensitive to electromagnetic fields as disks and tapes. (You never know: [http://www.telegraph.co.uk/science/space/9097587/Solar- flare...](http://www.telegraph.co.uk/science/space/9097587/Solar-flares- everything-you-need-to-know.html) )

<comment><USER26> If you turn on file versioning in S3, then you'll be able to get to the data that was "overwritten". I don't _think_ there's a way for someone with only PUT access to work around this.

</comment></comment></comment></comment></comment></comment></comment><comment><USER27> Corruption scares me even to this day.

My backup strategy is as follows: my most important files are in my Dropbox folder. So they're both on my computer and on Dropbox' servers.

But what if my drive goes bad and pushes corrupted files to Dropbox?

That's why I have another client with Dropbox that I only turn on every week or so. I hope that if something goes wrong (including Dropbox itself wiping all my files both remotely and locally), I can still get the older versions. That, and time machine backups (they include Dropbox folder).

</comment><comment><USER28> It's funny how even in their postmortem they don't seem to understand the obvious: live mirrors are not a backup strategy.

Git mirroring is great, and periodic checks for consistency would help, but snapshots taken and stored (offline) for reasonable periods of time are the only reasonable backup model. There are corruption issues, availability issues, etc. where offline backups are far more reasonable. Ideally you would separately cryptographically sign your backups (which is easier than just keeping track of hashes), too.

(and obviously a backup system is meaningless if you don't also check for restores periodically, and monitor the success of the whole process)

</comment><comment><USER29> I had a few quetions. Q1 Why not running a _git fsck_ on the canonical server before allowing mirror servers to sync ? Q2 could it be possible to optimize _git fsck_ to only do incremental checks, on the diffs sent to he mirrors ? Q3 if a canonical git server is used, why not ensuring this one is very safe against data corruption ? Q4 what about the ext4 corruption in the VMs ? Is the cause identified ?

</comment><comment><USER30> His last sentence about ZFS is impossible to parse. Why aren't they using it?

"I'd love to see this in use, but, after having had excellent experiences with it on Linux for a couple of years, I'm a ZFS fanboy at this point; and, I don't know how well it's supported on SUSE, which is the distribution git.kde.org is running (although I've run it on Gentoo, Debian, and Ubuntu without any problems)."

<comment><USER31> He'd love to use it as he has had an excellent experience running it on gentoo/debian/ubuntu linux, however as he's unsure of its support on suse and prefers ZFS now anyway he won't.

<comment><USER30> Thanks. Much clearer

</comment></comment></comment><comment><USER32> The git issue (if it can be reproduced and validated as true) is an interesting aspect of the story.

For admins there is another interesting one: they artificially generate an extremely vulnerable spof - and after this desaster hey are still doing it.

Can you see the mistake?

Hint: if you have many things, why do you make it one thing?

<comment><USER32> Ok, the elephant error is still unseen in the room - so I give you some more hints: nobody has written about this error until now - it is still there and danger of total destruction also is still there, because the single root of evil was not destroyed. You still do not see it?

<comment><USER6> Just tell us, rather than try to look smart. It's not helpful.

<comment><USER32> This was not meant to look smart, I refuse to compete and do not feel the motivation to position myself, I speak freely here - please do not apply a ratrace-like competitive mindset, this is misunderstanding me. I just was really interested in the question, if the spof is not seen by anybody.

Of course I am willing to help - the problem is desribed clearly in the first point of the author: they are generating _one_ "projectfile" - whatever this looks like, it is a reduction of many to one. The distribution of 1500 git repos with n-thousands of files is relying on one single file - there is no technical need for that, in fact it eliminates the power of distributed repos by reducing reliance into the presence and integrity of one single text file.

The author writes about the process of this file beeing corrupted and triggering a random repo killing process - the incident is a good bad example for what can happen if you anticipate the antipattern of making one out of many.

Building redundant systems you always try to achieve the opposite - make many out of one, to eliminate the spof. You can not scale infinitely with this, because in the end we are living on just one planet.

However, unneccessarily making one out of many is the wrongest thing you could do building a backup or code distribution system. This antipattern still exists in many places and should be eliminated.

This is not about filesystem corruption etc. - the reason for the destruction was one single project file. Do not do this. It is not critical for a backup system if it takes long time to scan a filesystem for existing folders over and over again. A backup system is not a web app, where it might be a good thing to do one out of many (aka as caching in this case), but a backup system does not need this reduction.

</comment></comment></comment></comment><comment><USER33> Darn, why couldn't this have happened to the Gnome 3 repos instead?

</comment><comment><USER34> at least he took advantage of the downtime to upgrade some stuffs.</comment>


Pgslice: Postgres partitioning as easy as pie - <AUTHOR> https://github.com/ankane/pgslice <comment><USER3> > Battle-tested at instacart

If you don't mind me asking, for how long?

I've found using EXECUTE in insert triggers to be very problematic - <USER2> consumes a txid, AIUI, and every 200m inserts, a bunch of anti-wraparound autovacuums have to to scan allofthethings. My insert triggers have big blocks of IF/ELSIF branches (although it's straightforward enough to construct _those_ in pl/pgsql, just requires an extra level of indirection when preparing the partitioning).

<comment><USER4> We've been using the tool for around 5 months, but the same approach/triggers for over a year. I wasn't aware the IF/ELSIF trigger approach had potential advantages over EXECUTE, but will definitely look into it.

</comment></comment><comment><USER5> I wrote this a while back: [https://github.com/fiksu/partitioned](https://github.com/fiksu/partitioned) supports partitioning in rails.

It's best to start here: [https://github.com/fiksu/partitioned/blob/master/PARTITIONIN...](https://github.com/fiksu/partitioned/blob/master/PARTITIONING_EXPLAINED.txt)

for an overview.

the examples should prove its use.

</comment><comment><USER6> Why an external program and not something in PG/SQL or at least a PG extension.

Also, how does it compare with pg_partman[1] which also has similar goals?

[1] [https://github.com/keithf4/pg_partman](https://github.com/keithf4/pg_partman)

<comment><USER7> >Why an external program and not something in PG/SQL or at least a PG extension.

I have no association with the linked project, but here are some reasons why I might take the same approach:

1\. Source control. Code at the level of PG/SQL into source control isn't as easily deployed and managed as, say, Java code.

2\. Not being strongly tied to a single software. It's true that this is currently directly intended to be used for PG, but keeping it separate would make it easier to re-adapt for another database software in the future.

3\. Lack of expertise with PG internals. This one is just a reason, not a justification.

Note that I'm not defending any software design decisions here, just speculating in a way I find reasonable. I also have the same questions and would be curious to hear the author(s)'s responses.

(Edited for formatting issues with the numbered list - and then again for spelling errors)

<comment><USER8> _Code at the level of PG /SQL into source control isn't as easily deployed and managed as, say, Java code._

Why not?

<comment><USER9> You're updating code that needs to be executed against an external layer instead of just the application layer.

<comment><USER8> But you could say the same for any code that say, touches the filesystem.

<comment><USER9> I meant that the code has to be deployed to a separate system.

Application code that touches the file system is still deployed along with the application code.

You might commit schema.sql into your application repository, but that's not the state of your database.

<comment><USER6> I think you are confused. A PG extension is code like any other. For the use cause such as partitioning you should not need to create any schema, what you are doing would be to write a code that acts on schema.

Schema usually is needed for application that will be using a database. I also don't understand the scare about using schema. Schema is FAR FAR FAR simpler to deploy than a Java application.

</comment></comment></comment></comment></comment></comment></comment><comment><USER10> Great to see more options for partition management in postgresql.

We took a similar approach using a ruby library to manage partitions at gilt groupe starting many years ago (2009?). It worked quite well and is still in use today.

Since then have also used the referenced [https://github.com/keithf4/pg_partman](https://github.com/keithf4/pg_partman) on RDS - and it works great! Very happy to have all the partition management in the core database vs. in other languages, and many of the features Keith provides in pg_partman just work. He's done a great job with the project and would encourage folks to take a serious look at his work.

If you are interested in details of how we applied pg_partment to RDS w/out requiring extensions, take a look at:

[https://github.com/flowcommerce/lib- postgresql/blob/master/R...](https://github.com/flowcommerce/lib- postgresql/blob/master/README.md)

We created a simple process to load the scripts directly into the database similar to any one of our other migrations. We then create higher level wrappers for our teams to use to apply consistent use.

</comment><comment><USER11> Looks useful, are you using this in production?

<comment><USER4> Yes, we do at Instacart.

<comment><USER7> Could you speak a bit of the use cases you've found this to be a better tool than competing alternatives, whatever they may be, if you're able to?

<comment><USER4> We didn't really find anything that fit our needs. We wanted a tool that was simple to use with the ability to do time-based partitioning of existing production tables without downtime.

</comment></comment></comment></comment><comment><USER12> Ummm [https://github.com/keithf4/pg_partman](https://github.com/keithf4/pg_partman) has been around for a long time and is used all around the world... AND it doesn't require cron jobs. Much tighter solution

</comment><comment><USER13> I also wrote a Rails gems that makes the create and read processes completely transparent with Active Record when using date partitions. In case someone is insterested github.com/pacuna/partitionable

</comment><comment><USER14> Can I ask why you decided to partition Postgres like this? It looks like you have time-series data based on the examples, and you wanted quick dropping, am I right?

<comment><USER4> That's correct. It allows us to manage the database size over time for tables where we can archive data after a specific period.

</comment></comment><comment><USER15> This is cool. Now if only it somehow magically allowed a unique index over the whole setup, it'd make my day!

<comment><USER16> What do you mean? For uniqueness, simple scheme like "Partition ID + SERIAL" will be unique enough (or just guid or similar). For performance, table index is fine, since you already know which partition request is for.

<comment><USER15> The problem is the unique IDs are GUIDs generated independently (and offline) by the client and then passed to the database; we need to make sure that no event is processed twice.

Currently there's one big log table and a uniqueness constraint on the GUID field. I'd love to partition the table out but until I can identify a clean route to satisfying that requirement I'm keeping one large log.

Though, now that I think about it, maybe partitioning on the first character of the GUID string is feasible, as we can ensure uniqueness per-table then</comment></comment></comment>


Ask HN: What is the best tool to check for vulnerabilities in a REST API? - <AUTHOR> I'm also interested in vulnerabilities in web apps in general, but as all my apps ultimately do their server-side stuff through an API, I should probably check that, first.<p>I'm looking for something for Mac, or that works/can be compiled for Mac, preferably. <comment><USER2> Probably the best tool is monitoring. Connect a honeypot to the internet and watch how the attackers attack.

Good luck.</comment>


Pithy.js - An internal DSL for generating HTML in JavaScript - <AUTHOR> https://github.com/caolan/pithy

<comment><USER2> It is worth noting that the OP is calling this tool pithy (terse, meaningful). In an application I'm working on [1] I have several lines of jQuery and string concatenation to build some simple content.

It's probably overkill to use a full-blown client-side templating engine, but my current code leaves much to be desired. I think pithy.js might be a great fit.

[1] [https://github.com/crabasa/seattlehacks/blob/gh- pages/calend...](https://github.com/crabasa/seattlehacks/blob/gh- pages/calendar.html)

</comment><comment><USER3> This is almost identical in operation to laconic <https://github.com/joestelmach/laconic> what advantages does this have?

</comment><comment><USER4> Nope. Avoid. Switch to templates at the moment you think you need this kind of a solution. Use for example super comoact <http://archan937.github.com/templayed.js/> Compared to almost full blown mustache implementation, pithy.js, surprise, is a bloat. Sorry of being harsh, as a positive note, the code itself, in abstract way is my liking. Very good. May even steal some snippets.

<comment><USER3> Ahh yes, the old "trusty-hammer" argument. Sometimes this exact sort of library is needed, and quite useful. More than once I've found myself doing single-tag or 2-tag templates and composing them in code, with bits for passing in class name or id, and later selecting them to change some property. Basically the use case for a library like this.

Templates are useful, so are tag generation code snippets. Both go in my toolbox just fine.

<comment><USER4> For your case this is all what you need: function replace(str, data) { for( var i in data ) str = str.replace('{'+i+'}', data[i]); return str; }

<comment><USER3> Oh, now I see the light. I don't even need templates, just dozens of str.replaces littered throughout my code. Now I can throw away all these weird screw things, and just have nails!

/sarcasm

My point still stands, no matter what you think you read in my post, different tools for different jobs is OK, there is no "silver bullet" (or magic-hammer or whatever).

<comment><USER4> whatever

</comment></comment></comment></comment></comment><comment><USER5> See also:

<http://github.com/markgandolfo/el.js>

<http://joestelmach.github.com/laconic/>

<http://domo-js.com/>

</comment><comment><USER6> Almost identical functionality appears as part of MochiKit, and I've found it very useful for quick and clean DOM creation:

<http://mochi.github.com/mochikit/doc/html/MochiKit/DOM.html>

</comment><comment><USER7> Pretty cool project, but I feel kind of dirty having js and html being so tightly bound to each other. Do you have a specific use case where pithy would perform faster or be more cleanly implemented than standard templates?

<comment><USER8> From the OP's documentation, I don't think it's intended to be used for large templates where speed of render is important. It's main benefit seems to be as a more readable, less-error-prone alternative to string concatenation, such as in small snippets that are created by client-side-update methods.

</comment></comment><comment><USER9> Why is everyone so afraid of HTML that they insist on starting projects like this? I've seen them come and go for 15+ years now and they're never useful. Even less so in the case of using JS to generate HTML because that makes the browser actually work harder.

This isn't a knock against OP or the project creator (if they're not one and the same) because projects like these can be useful exercises. But I would never use something like this in production and I would hope nobody else would either.

<comment><USER10> What do you mean by "afraid of HTML"?

I haven't used this yet, so bear that in mind, but to me this seems to be something that is more expressive than html (I meant String) concatenation. That leads, in my experience, to better maintainability and thus less worries in the future.

Whether this impacts JS performance enough to be a problem, I don't know and don't have the time to test right now.

Edit: words are hard... I accidentally a few of them.

</comment></comment><comment><USER11> Also there is DOMBuilder <https://github.com/insin/DOMBuilder> which has separate modes for using HTML mock elements on (node.js) server-side or DOM elements in browsers. The mock elements are implementing only a very small set of the DOM functions, but if you extend it a little then it can be useful to share Backbone-like views between server and client.

</comment><comment><USER12> Awesome! Would be useful if there were callbacks for binding events after the node has been created.

<comment><USER13> I suppose it's probably just a matter of trying to keep things as simple as possible. You're already specifying all the attributes of the nodes you're creating, so you can just as easily then bind them yourself. UNIX philosophy and all that.

<comment><USER12> Just an argument for why I think its pretty important (maybe your use case is different so this doesn't apply).

With every HTML injection, I'd have to cycle through all relavant nodes, sorting out the ones that have already been binded, and then apply the relevant bindings. With a dynamic app that injects a lot of small HTML parts, this could be quite painful.

</comment></comment></comment><comment><USER14> I prefer <https://github.com/jed/domo> to create DOM elements in browser. Its output is a real DOM element whereas in pithy.js, its string.

<comment><USER2> It might just be me, but I can't stand all of the capitalization.

</comment></comment><comment><USER15> This is quite interesting, thank you for open sourcing it.

I can see how this can be helpful cleaning up e.g. common string concatenation snippets in code bases.

</comment><comment><USER16> Pardon my ignorance... What is a DSL?

<comment><USER17> Domain-specific language <http://en.wikipedia.org/wiki/Domain- specific_language></comment></comment>