Going Colo - <AUTHOR> http://blog.pinboard.in/2012/06/going_colo/ <comment><USER3> It's really cool that Maciej is so open about his setup. This is especially true given how opinionated people are about these sorts of operations. For example:

I'm hoping the Hurricane Electric facility he mentions is Fremont 2. The Fremont 1 facility has been plagued with power and packet loss issues over the last year (ask your friends with Linodes in Fremont all about it ;)

It also seems a shame to put both of the deployments so close together. Proximity to your machines is a non-issue with a decent colo provider: his example of driving to Vegas every time a drive fails assumes that the provider would be unable or unwilling to sell him 20 minutes of remote hands. Spend a little extra money up front for out-of-band access to your infrastructure and leverage the provider for the physical stuff!

<comment><USER4> >Spend a little extra money up front for out-of-band access to your infrastructure and leverage the provider for the physical stuff!

This /sounds/ like a good idea until the reality of trying to get someone random to fix an actual hardware problem over the phone sets in.

It only takes one idiot pulling the wrong drive once.

(to be clear, spend the money on oob management, too. Serial consoles are essential if you want to have a hope of knowing why that server rebooted last night. And you need to be able to monitor your power draw; it really doesn't cost that much more to spring for the PDU that can monitor and switch the outlets.)

<comment><USER5> I was half thinking of setting up colo in Hawaii specifically _to_ cause people to have to make work-covered travel plans to there to "fix things". The official justification would be to be under US law and have lower latency access to Asia (although I think Seattle to North Asia is about the same as HNL to North Asia, and certainly cheaper/better bandwidth).

The problem is power is even more expensive there than in SF.

</comment></comment></comment><comment><USER6> HE Fremont is a total ghetto. 15A per full rack, essentially no cooling. Its just a massive open warehouse. Fremont 2 is much better than Fremont 1, but still had one power outage when I was there.

Connectivity wise, they are pretty good. Sometimes may be a little more DDoS prone though.

I've been in several Sacramento datacenters and currently have a half rack in in Webion in Rancho Cordova. Ragingwire is freakin expensive.

The pricing with prgmr.com looked pretty good though. SJ gets better bandwidth pricing, and probably about just as crappy on power.

If looking for a serious deployment, generally have to look outside CA. Great connectivity, but power is what will kill you.

<comment><USER4> if you are using serious power and are willing to go super high density (e.g. you are willing to pay the premium for blades) BAIS in santa clara is not a bad deal; north of 10Kw usable for under two grand a month. Santa clara power prices are dramatically better than san jose power prices.

I'm trying to move my own stuff in the direction of santa clara.

Of course, at the low end? I mean, if you are the $200/month customer that is thinking about buying from me? that sort of thing probably makes less difference.

The funny thing about he.net is that if you work out the cost per watt, they are more expensive than most places after negotiation. (on the other hand, he.net gives you the price off the top; most other places go for 30-50% over what the real price is.)

<comment><USER6> Doing the quick math from what I remember HE's pricing to be, it is cheaper per watt... at my peak I had a full rack and 4.2Kw and only actually using half a rack. It just feels wrong to have to get 3 racks at HE and basically just be 4 servers per rack.

HE just seems at weird economies of scale. Pretty much no cooling, 70-80% of the warehouse empty, and $1/Mbit (they lower now?). If Fremont 2 gets more populated, will it inherit the same power issues? Part of me doesn't want to know.

I've heard good things about SVTIX though... haven't toured or had anything in there, but it seems to have a good rep.

<comment><USER4> you had 4.2kw in a rack at he.net? I didn't parse that. ah. You must have had 3 racks (or at least 3 15a circuits) as that'd be about that much power usable.

they'd only sell me 1 15a 120v circuit, which is 12a usable; 1.44Kw. Something like $500/month before bandwidth, $347 per Kw.

Compare that to $600/month for 20a 120v at svtix (I'm going to charge you $650, and throw in some bandwidth if you buy from me. If you go direct with the guy that runs the place, maybe you can do better, maybe not, but you'll definitely spend more time negotiating with him than with me.) that's 16a usable, 1.92Kw. $339 or so per Kw retail, including 10Mbps bandwidth.

(I'm not saying my prices are great; I think my prices are a reasonable no haggle deal. compare this to the quote from BAIS in santa clara for 11.5kw.. 6x20a 120v circuits in a single 47u rack... 96a usable, for two grand, that's $174 per Kw. Of course, at that point you are paying extra for higher density servers, though, and the up front price was rather higher.)

The power at Svtix has been solid for me, and the owner of the data center keeps it way colder than it needs to be. Which, I guess, is good marketing? but it costs money; 70-80F isn't going to kill a modern server.

I think that he.net fremont is a fine temperature; 80 degree temps aren't going to hurt your servers. (much above that and you worry) but the power at fremont 1, at least, has been horrible. I have two legacy racks there that I'm trying to get out of, and man, they've gone down three times in the last two years, which is horrible by the standards of such things. Once, the power surge when the power came back toasted one of my servers.

It was miserable. One of those "this is why you should get dedicated servers rather than co-locating your own stuff" experiences. I screwed up the configuration on my PDU, so my stuff didn't come online after the first outage; I was paged and had to leave a party. I fix it, and then the next day (early, if I remember correctly, or maybe it just seemed early) the power went out again, and this time it fried one of my servers, so I had to shuffle in, zombie-like, and swap it out with a spare.

<comment><USER6> Ohh no, 4.2Kw in Sacramento... just thinking in terms of what that would be in HE.

I must need sleep, since just realized I calculated kW/$. :)

With my math corrected though, getting about $338/Kw.

</comment></comment></comment></comment></comment><comment><USER7> As mentioned in the blog, "So many factors to consider!" Do your homework early and upfront even if planning to colo just an Atom or Soekris box. I can tell you that moving many multiples of racked equipment via semi-truck from one datacenter to another is not an enjoyable experience.

Ping - Power - Pipe : Ask everything you need. If a datacenter is unwilling to share or discuss who they are, what they do and what they offer then walk away. Colocation is a buyer beware environment.

Here's a VERY ROUGH list/braindump of questions that AT THE VERY LEAST you need to know before placing equipment with the colocation provider/datacenter.

Tier I,II,III, IV datacenter? Who owns the datacenter? Investors? What's your ASN number(s)? Carrier neutral facility? How many connectivity providers are present in the data center? Does data center run BGP over these providers? IP Transit providers - Bandwidth Pricing? Overage pricing? Straight $mbps/month? Who manages your network? Ip allotment? Assignment procedure? High density for micro vms(Heroku style)? 200 VMs per host meaning 200IPs per vm. Swip/rwhois updates on assignments? Cross-connects? Cross connect pricing? Charges? Local loop(last mile connectivity) charges? BGP support? Is our traffic on a private/separate v-lan from your other customers?

Infrastructure? -Redundancy in detail -Brands -Networking -Connection -Power. Maintenance programs?

A/B feeds from two separator breakers or breaker panels or better yet two Utility Power Service Provider if they are truly A/B feeds. A/B Diesel- Generators? Additional fuel storage on site? Is a PDU included? If so, how many outlets and is it accessible from the web or telnet? What type of hand off/drops to your rack will you be provided (Ethernet)? Are there raised floors? Are there any fire suppression systems in place? Physical/Video Security? Biometrics? Screening of employees?

Insurance requirements to colocate equipment with you?

On-site visit requirements? 24x7 staffing? Remote Hands - Cost and Abilities? What's included? Shipping/Receiving of hardware?

Sas II 70 or SSAE 16 certification? Audit available for review? -Common practices -Staffing -Security -Emergencies - Escalations -Contacts Outage alerts? Notifications through Twitter or similar offsite status page? RFOs for past outages? What's been your corrective action?

Power density per rack? 80% rule or true metered? Can you rack the equipment for us? Who provides cabling? Types of rails for servers? Billing-95th or other? Rack size? Partitioning available? 4u/10u/Quarter/Half? Cages? Lockable or baker's racks? Shared with others?

Finally, ask for a listing of ALL fees.

<comment><USER8> A perfect example of the time-wasting that he says you should avoid.

<comment><USER9> Maybe for 1 or 2 servers in a quarter rack; but all of these questions and concerns are very salient if you are filling full rack(s) or cages and plan to get your own ASN and such (as any serious internet company should, since otherwise you are not PART OF THE INTERNET). Not getting the answers to these questions is the difference between quite a lot of pain, heartache, and money spent or having everything run (relatively) smoothly.

<comment><USER10> I have to agree his list is a little unfortunate. It contains all the basic questions that you _should_ ask (responsibilities/transits/power density etc.), but then also rather specialized things (PDUs, RFOs) that are a little over the top when you're going to rent half a rack without significant growth perspective.

That said, the colo _should_ indeed answer all these questions. It's just that most small shops will not be able to make sense of the answers...

If you're a small shop looking to dip a toe into colo then a good summary question to ask is "Who else do you host?". If they have a few big-names to share then they'll probably be good enough for you, too.

Ideally ask for permission to ring up one or two of their reference customers and then actually do that. Colos don't like that very much - but if they outright refuse then you'll know to better look at another one.

<comment><USER7> Ideally, most of this would be on a provider's website. Unfortunately, the NAPs of the world rely on multi-level sales staffing that present what they think is important(or differentiates them). The smaller colos who envision themselves the equivalent of the NAPs refrain from sharing much info as well and then the consumer ends up in a dim corner of "kinda/sorta generally acceptable commodity(service and quality) level colocation." It is then your burden to translate that to a customer why their LOLcats website is loading slowly for Uncle Bob. SLAs are hard and most providers treat them like a joke. If you're a startup and want to pass the buck, then just go with AWS. There is a solution for everyone.

<comment><USER4> Yeah, I find this incredibly irritating. Just getting the real price can take months of back and forth. On the low end, the cost of just the negotiation can dominate everything else.

</comment></comment></comment></comment></comment></comment><comment><USER11> I'm also currently working with Luke, of prgmr.com, to set up a new home for my colo-ed server. (In fact, I'm getting the same 10U, 4 amp package.) He and his team have been fantastic. I can't recommend them enough.

<comment><USER12> Honestly, I found that page (<http://prgmr.com/san-jose-co-location.html>) fascinating. Way better than the linked article.

<comment><USER5> EDIT: I was wrong (based on misreading website)

They are single-homed to Cogent (at least that's how it appears; I didn't check looking glass), which is fine for a hobby server, but not really good for a startup.

<comment><USER4> nope. I'm single homed to egihosting, who is mostly he.net but also globalcrossing and nlayer.

<http://www.datacentermap.com/as/47066_upstreams.html> (47066 is me) <http://www.datacentermap.com/as/18779_upstreams.html> (18779 is egihosting)

Now, that's not a whole heck of a lot better from my point of view; but egihosting (they are another co-lo provider you might want to check out) is multihomed... so if you are the sort that thinks outsourcing means you don't have to worry about it, I have outsourced my multihomed bandwidth to egihosting.

The references to Cogent were referring my last attempt to get a second upstream. (the deal appears to have fallen through? we will see. I will have to write about it. It was a long story, in which a mistake I made 7 years ago comes back to bite me in the ass.)

I mean, yeah, the network isn't awesome, but eh, it is reasonable, I think, for the cost. I think that if you have physical hardware, you are better off spending the money on a second location (and for the difference between my level and 'premium' co-location, well, you can host with me, you can duplicate your setup with someone else in my price range, and probably have some money left over.

Two cheap ones are usually more reliable than one good one

(especially as this is way more of a 'market for lemons' than auto buying. It's really hard to get true information about the reliability of various providers.)

<comment><USER5> Oh! Sorry -- I was confused. That's a bit better. (I like nlayer in particular). egi is pretty good.

Being single homed to a small but competent provider who is multihomed is IMO better than being single homed to a large provider, in that the small provider is a lot more likely to actually help you out when things go wrong.

Cogent obviously would be a nice way to get some cheap extra bandwidth, too. I just fear depeering days :)

<comment><USER4> I agree that singlehoming to a good tier-2 provider is much better than being singlehomed to a tier-1 of any quality; It's not so much the support I fear as the... as you said, depeering.

(of course, if you are looking for and willing to pay for serious bandwidth, you want to look for three or more upstreams. And in that case, having 3 tier 1 providers is better than having 3 tier 2 providers, as you are less likely to get route overlap, and tier 1 providers, all other things being equal, usually have better latency.)

</comment></comment></comment></comment></comment></comment><comment><USER13> Just a couple of observations based on experience:

\- You'll most likely run out of power well before you run out of physical rack space.

\- You'll (hopefully) spend less time in the data centre than you think, especially if you have good lights out access, remote power bar access etc. If you're locating in a large city you can often get a better deal somewhere in the suburbs rather than downtown with very little downside (at least that seems to be the case here in London).

\- Interconnects between racks can be awkward to get set up, and you can't necessarily get the rack next door when you want more space.

\- Redundant everything will save you a lot of hassle, but gets quite expensive. In particular redundant power will save you from downtime when the data centre decide they need to take one of the power feeds down for maintenance (it happens), and setting up redundant (external) networking has the same effect. Having a second network for admin access prevents you from being locked out in some failure cases. Hot swappable drives are useful for systems which are awkward to take offline (e.g. database servers), but not massively useful elsewhere if you have good redundancy at the server level.

\- Data centre rack floors are about the most unpleasant place to work you can imagine :-)

\- If you can get a handle for how competent the data centre are at mitigating DoS attacks it's a useful datapoint. If they aren't on the ball an attack against anyone hosted in the same place will take you offline too. having said that, I'm not entirely sure there's a fool-proof way to determine this ahead of time.

\- You can generally borrow a cart with a keyboard and monitor on it to wheel up to your rack, so no need to have those permanently installed.

\- Keep a stash of network cables, cable ties etc. at the bottom of your rack - it's annoying to show up only to find you've forgotten that kind of thing.

\- You may need to register authorised employees before showing up, so make sure you do that before taking your new intern to help rack a server. Expect them to ask for ID before letting you in.

\- Data centres (at least some of them) will take deliveries on your behalf, so there's normally no need to get things shipped to your office then drive them out yourself.

</comment><comment><USER14> So, what's the consensus regarding colo vs. the cloud? I've enjoyed walking through rows of colo'd equipment, both as a security guard and as a technology professional. There's a lot of romance to it.

It also seems that we've entered an era where you're a fool if you colo a lean startup. Is there a best practice, book, really good blog post, etc that helps one determine when it makes sense to colo vs just spinning up more Heroku dynos?

<comment><USER5> IO heavy applications still don't belong in the cloud. They may make more sense in dedicated servers vs. coloing your own hardware, though.

<comment><USER4> >IO heavy applications still don't belong in the cloud.

I agree.

>They may make more sense in dedicated servers vs. coloing your own hardware, though.

depends on what skills you have already, and then your time to money exchange rate. If you use a lot of compute power, you can save a lot of money with a relatively small time investment, if you already have the skills.

<comment><USER5> Even though I like messing with hardware, if you've only got a few racks of equipment, some kind of managed hosting often makes sense for alternate sites just due to cost of sending staff there to mess with things. Maybe use colo at your primary site, but managed hosting for a DR site somewhere.

<comment><USER4> I think "the cloud" is perfect for DR. have a script that spins up your site in the cloud, test it one day a month, and pay for it one day a month. You go down for a day? you pay for one day in the cloud.

Of course, this does eat the same amount of labor as building for the cloud /and/ building for co-lo, so you still have the time cost.

<comment><USER6> It is great for DR if it can support your IO load, considering the cloud sucks for IO. :)

One project moved from AWS to a managed hosting provider with gear built to our specs mostly due to IO issues... continued to grow and then went back to AWS looking to do an easy DR process. Had some issues just with EC2 being able to keep up with replication at that point.

The one thing I'd like to try with AWS though is their Direct Connect service. Basically colo in a facility near them and get a cross connect to EC2 (think it focuses on VPC). <http://aws.amazon.com/directconnect/>

IO loads on real hardware, EC2 for all the other stuff.

<comment><USER4> well, really, it's virtualization[1] that sucks for I/O, not "the cloud" - <USER2> could build something very ec2-like without shared disk, in fact, I think ammazon might.

But yeah. Active/active is a far better solution than what I describe, I mean, modulo the extra cash it costs.

[1]well, really, it's sharing spinning disk... the actual overhead of virtualization is pretty low by this point, but if you have two people accessing the same spinning disk? each gets rather less than half the performance they'd have gotten if they have the whole disk to themselves due to the physics of spinning disk and how much worse random access is than sequential. (two simultaneous sequential read/write streams to the same disk can look a lot like random access, depending on queueing.)

</comment></comment></comment></comment></comment></comment></comment><comment><USER15> The article says that you're are not allowed to use the full rated capacity of a circuit. Can anyone tell me why? This seems weird to me.

Also, is his concern about earthquakes really warranted? I'd have thought that a DC would have been able to withstand more or less anything thrown its way.

<comment><USER16> Most electrical equipment, including computers, draw significantly more power as they're starting up than they do at steady-state. If everyone's server were pulling the maximum rated capacity at steady-state, you'd probably trip a breaker when everything started up (for instance, if power had just been restored after a failure, or if several machines were power cycled simultaneously).

<comment><USER17> Its this. You need the headroom for power-on/reboots. Blade chassis are smart enough to stagger starting up each blade for this reason. 1Us don't know about each other.

<comment><USER18> 1U also "know" as long as you use proper PDUs (Power Distribution Units, basically power strips with some tiny brain). PDU's will also measure the amps for you and you call poll them for numbers and you can powercycle servers remotely. They're usually worth every penny.

</comment></comment></comment></comment><comment><USER19> We moved from a single dedicated server to a colo 5 years ago and we've never looked back. It's saved us a lot of money. We started with 2 lonely servers in 24U and now we've got 9 servers, a couple routers, a couple switches, and some other stuff in there.

Here are my tips for people that are considering a colo. These are really all about working comfortably within a confined space (a half rack or smaller)

* 10U is not that much. Don't buy space that you aren't going to need but compare prices and find out about options for expansion. Space isn't expensive but you might have trouble buying space that isn't bundled with power.

* Keep your wiring organized. Don't say "I'll fix that later".

* This goes hand in hand with the previous: If everything has redundant power, are you going to run out of outlets before you fill your space? Consider installing a metered PDU (or PDUs) before you add any machines

* You probably don't need 2U servers. The 1Us that I currently buy have 2 CPUs, 10 x 2.5" drives (also handy for SSD) and redundant power: [http://www.supermicro.com/products/system/1U/1027/SYS-1027R-...](http://www.supermicro.com/products/system/1U/1027/SYS-1027R-N3RF.cfm)

Also, like justauser said, get a complete price list. Sucks to grow and find out that you are going to get hosed on cross connects or extra power or something like that.

</comment><comment><USER20> So, I have a lot of opinions about datacenters.

Bandwidth - So, this seriously matters, but you shouldn't spend money on it. The biggest things about bandwidth, and connectivity are: reliability, latency, and capacity (in order of most important to least important)

Reliability: This is things like, packet loss, how often your connectivity is impaired, etc... This will have the largest Ux impact. Most bandwidth providers will have a pretty good story about this. Typically, the delta of reliability between a $15/mo provider and a $150/mo provider doesn't actually provide any realistic differences. Don't waste your money.

Latency: Although, most of the applications we'll be working on won't be sensitive to connectivity latency, it does create an upper bound of the speed of TCP data transfer. (Look at the big fat, long pipe problem). All of us have big fat, long pipes to our houses phones now. You can't do much for this than locate your datacenter well. The other thing i, you can ensure that your transit provider has good peering relationships, and transit. I would recommend looking at the list of peers through a looking glass (bgp.he.net is a particularly good looking one).

Capacity: This is the question of how much bandwidth can I soak up at any given point. You shouldn't ever have to think about this problem. You're probably not going to have to scale your bandwidth faster than what your upstream already has. Nonetheless, if you're running a bandwidth intensive site, you should consider this, because you could potentially choke your upstream. They will more than likely just go ahead and blackhole you in order to preserve the rest of their revenue stream.

</comment><comment><USER21> Interesting that the author chose to use a Kill-a-Watt for power consumption monitoring.. seems like a better idea to use the planning applications available from the major vendors to determine usage depending on workload, etc. Dell and HP both have a calculator where you set the system (RAM, CPU, # HDs, etc.) and the load and it will provide you with an approximate power use, along with a peak load.

<comment><USER22> The calculator is useful for approximations, but I've been bitten a few times. The only real way to know, as always, is to _measure_ it.

The Dell/HP salesmen are worse, if you try to talk about power, especially if you do HPC. They will often flat-out refuse to believe that you're going to take 100 servers, stuff GPUs and all the RAM you can find in them, and run them at 100% for years on end.

</comment></comment><comment><USER23> Surprised the author was able to get 100mbps unmetered for such low prices. Would guess the bandwidth is not multi-homed and single carrier. Usually you pay for a standard 100mbps drop, but then 95th percentile based on the number of purchased megabits in your contract.

<comment><USER18> HE in Fremont is a very special place. I have about 10 racks there. They're cheap and bandwidth is free, the support is awesome, but it's a ghetto, to put it simply. Or a hippie camp. The racks are telecom, not computer ones (which means that they're shallow and narrow, 30" long server prevents the back door from closing). The power is not redundant and only 15A per rack tops (extra amps are ridiculously expensive).

But for a frugal startup it's perfect - cheap, good connectivity, awesome support, easy access. Not very reliable, right, but you don't have many users, don't ya? :-)

<comment><USER24> They just opened Phase 3 in Fremont2. All the racks are 36" and there is tons of available space. I agree that power is expensive, but the bandwidth cost can't really be beat.

</comment></comment></comment><comment><USER25> If you're looking at Sacramento, consider the flood risk.

The entire city sits in a flood plain, and is protected by floodwalls, levies, dikes, and flood gates.

The last major flooding of major structures that I'm aware of was 1956 (mostly affecting areas north and east of Sacramento State), but given changing weather patterns and grave concerns over the delta levee system, nothing is certain.

Most of the major datacenters are clustered along US50 (which follows the American River), with others downtown and in West Sacramento, also within vulnerable zones.

Probabilities of a major flooding event exceed those of a quake. Though of course the Fremont/Hayward datacenters are direction on the Hayward fault.

</comment><comment><USER26> If your looking to Sacramento for seismic or other reasons, the place for scrappy startups is istreet solutions. I'm local to Sac and have had all my servers parked their since 2003 with only a few hiccups. If you inquire ask for Mark (the owner), ask for the "Troy Deal" (I am his first customer, leased a cage of an otherwise empty datacenter in 2003, spent way to many creepy nights behind windows servers and a kvm switch before discovering the serenity of headless linux). Not that he'll give the same deal as his first customer, but it doesn't hurt to ask!

</comment><comment><USER27> Another big question for colos is redundant power. Preferably they have two separate lines all the way to the utility and test their generators on a regular basis.

</comment><comment><USER28> Hey, you spelled prgmr.com wrong. (You got it right in the <a> tag though.)

</comment><comment><USER29> 10 terabytes of fanfic? I thought that you could fit the Library of Congress in less. 10TB is 20M novels of 100K words, unzipped.

<comment><USER30> "I thought that you could fit the Library of Congress in less."

Nope. I've worked there, they've got multiple petabytes of data, though a major portion of that is audio and video. Even the books aren't stored as txt files.

</comment></comment><comment><USER31> This is very similar to what I ended up doing. I bought a server, and hosted it at he.net.

</comment><comment><USER32> Nice write-up - thanks for this!

</comment><comment><USER33> Somewhat on-topicish, does anyone have any recommendations for colocation in Toronto? The only recommendations I've gotten for a reliable provider has been for peer1, but they are insanely expensive and both their support and sales staff are quite the opposite of helpful. For reference (since peer1 tends to make up "whatever we think we can get away with" pricing), I was quoted $60/Mb for 95th percentile or $0.85/GB (which puts 1TB of data transfer at nearly $1000!).

<comment><USER34> Give 151 Front a try. <http://www.151-front-street.com/></comment></comment>


Graph API - Facebook Developers - <AUTHOR> http://developers.facebook.com/docs/api <comment><USER2> It's about time. The FB API was a nightmare. But there's 400 million people on Facebook, so FB integration is probably good for your site, regardless of was your site does. The new Open Graph protocol actually looks pretty awesome. This could be huge.

<comment><USER3> Agreed. The simplicity and elegance of the API is really great. A lot of sites have status updates + commenting + liking + feeds... and this essentially gives you a lot of that functionality for 'free'. You don't need to worry about the hard problems in regards to friend visibility, scaling the push model, etc etc. All the difficult data processing is handled on Facebook's end while a site becomes more of a lens/context/perspective on the data.

Of course the cost of this is that Facebook gets your data. It's a bit of a Faustian contract (hope I'm using that reference properly). They'll save you engineering cycles and promote your content to your user's social graphs, you just have to give them your data.

Sites really now have 3 options: 1) Ignore FB to their own risk 2) Embrace FB and give up control of their data 3) Use FB as a data mirroring and distribution mechanism - but still give them all your data.

Choice 1 is a difficult decision to make... if FB becomes THE standard and you're not providing your users the experience they expect, maybe they'll go somewhere else. Of course this could be like Beacon where users hate it. Or it could be like Facebook Connect where it's cool and some sites leverage it really well, but hasn't change the landscape of the web THAT much.

If you choose Option 3 you're still giving your data to Facebook. So now you're left with, is it worth the engineering cycles to ensure you don't get locked out of your own data. I think most people on here will say yes, but a surprising number might not.

Now after thinking about it for a while, this will cause an uptick in Facebook Connect usage and integration, but I don't think it's going to fundamentally change the way sites are designed. Maybe in a year or two if Facebook continues its growth current trajectory.

<comment><USER4> I doubt I would design a site differently, but I sure as hell would make sure I connected to the "open graph". Its simply to big a win, it can't be ignored unless your a big enough player.

And may i restate: The API is slick and sexy and feels damn open.

The only downside here is that its a company like facebook that ends up as the biggest winner. But should you as a minor site really give a damn? I mean, its unlikely that facebook is in competition with you anyway so its not like you actually lose anything by giving them data.

And isn't this really a step in the direction the entire web have been crying out for a long time? No more data duplication, "let me put my info one place and then pluck it from there". I consider todays f8 to be quite major for web developers like myself and obviously for facebook as this means they are actually heading towards their goal from some time ago; Becoming a platform.

</comment></comment></comment><comment><USER5> This API tastes so much like the old FriendFeed APIs. Compare <http://friendfeed.com/api/documentation> and the Facebook API's and you'd swear that it's just v3 of the FriendFeed API.

(This is a good thing, btw. I guess there is now doubt that Facebook got good value out of that purchase)

<comment><USER6> Makes sense, considering Facebook bought FriendFeed not too long ago. This is probably the first of many benefits they got from that acquisition.

</comment></comment><comment><USER7> The big thing to me is the addition of a search method. If I understand it all correctly (I did miss the first part of the f8 keynote) we've got the permission to pull any data out by keyword for the very first time.

</comment><comment><USER8> this could turn into a generic graph API eventually, even though right now it's just an API refactor.

also looks like bret taylor's been working on this - guess the friendfeed acquisition worked well for facebook.

</comment><comment><USER9> Coming next: social network aware adsense.

<comment><USER10> Mix in community with adsense and you get: looking for gadget XYZ? Here are the ads for it, by the way X of your FB friends bought product 1, 4X of your FB friends bought product 2. Which are you more likely to buy?

</comment></comment><comment><USER11> Is there a reason they chose not to use rdf/microformats? This is their proprietary FBML markup, I believe.

Seems a little redundant, but maybe I missed something.

<comment><USER5> _Is there a reason they chose not to use rdf/microformats?_

Because RDF sucks? And microformats only help in some cases

 _This is their proprietary FBML markup, I believe_

It looks a lot like JSON to me. What are you looking at?

<comment><USER11> Is this a widely held view? I'd like to understand the logic, so a reference would be appreciated.

If a suitable standard exists, you would think they'd take advantage of it (increased adoption), no? I also don't like the idea of duplicating efforts, but apparently I have missed some technical limitation.

[Edit] I think I just found the part of the answer: <http://news.ycombinator.com/item?id=1283507>.

<comment><USER12> Yes, lots of people who like RDF dislike the RDF/XML serialization of it. It's ridiculously verbose, hard to process with XML tools, not very human-readable, and there can be many equally valid RDF/XML serializations for any given RDF graph.

N3 is much more widely liked - <http://www.w3.org/2000/10/swap/Primer> \- as is RDFa - <http://www.w3.org/TR/xhtml-rdfa-primer/>

<comment><USER11> This is why it's always good to hang around people smarter than you are. Thanks for all of the great replies.

</comment></comment></comment></comment></comment><comment><USER13> Page is currently down for me.

<comment><USER14> Page requires login for no apparent reason. I HATE however accessing essentially anything at all on Facebook requires one to sign in first.

<comment><USER15> The example shows in the doc use your OWN Facebook username. I guess that is why.

</comment></comment></comment><comment><USER16> I love the irony that you have to log in to read the docs.</comment>


I updated "Hacker News Full" for Android to fix the loading errors - <AUTHOR> https://play.google.com/store/apps/details?id=com.jazzychad.hn&gpref=09afwjoei23jh2398h

<comment><AUTHOR> Hi all. Hacker New Full allows you to login, vote up/down, and comment on threads. It has been plagued by loading errors for a while because I was using the ihackernews api (which returned a lot of errors), but I finally wrote my own HN api service which uses heavy caching to play nice with HN. I'm really sorry it took so long to get updated, but please give it another try if you gave up on it because of the errors!

<comment><USER2> Any chance for this API service to be open sourced or public?

<comment><AUTHOR> maybe in a while after i'm sure it is stable and doesn't run afoul of request limits...

</comment></comment></comment><comment><USER3> Any chance you could update it to follow Android 4.0+ UI guidelines? You still have the old style menu and no overflow button.

<comment><AUTHOR> maybe... I don't have any 4.0+ devices to test on, and the large majority of users are still on 2.x

<comment><USER4> make it open-source and I'll do that for you. You can then update the app with the new design if you'd like.

<comment><USER3> I'd be willing to help out as well. I'd really like to see a good HN site browser for Android.

</comment></comment></comment></comment><comment><USER5> Nice. Now where in can I find the data about my comments - e.g. what's at <http://news.ycombinator.org/threads?id=SideburnsOfDoom>

<comment><AUTHOR> not there yet because nobody has ever requested that feature :) i'll add it to the todo list

<comment><USER5> If we're on features, I should also be able to do that wherever a user name is shown on screen - i.e. click on it and go to the profile & comment history.

Also you may prefer white on black, but I strongly prefer to read in black on white. Option for colours?

<comment><AUTHOR> agreed about being able to do it for all usernames (i might just have them go to a profile view, from there you can view their threads). also added color/theme option to todo list.

</comment></comment></comment></comment><comment><USER6> My favorite HackerNews Android app: [https://play.google.com/store/apps/details?id=com.glebpopov....](https://play.google.com/store/apps/details?id=com.glebpopov.hackernews&hl=en)

Anyone know the best way to read TechMeme on Android. The one app I found is not the great: [https://play.google.com/store/apps/details?id=com.spacenext....](https://play.google.com/store/apps/details?id=com.spacenext.techmeme&hl=en)

<comment><USER7> My favorite mobile HN thing is <http://ihackernews.com> \-- not an app, but still great.

For TechMeme, have you tried using Google Currents?

</comment></comment><comment><USER8> Unfortunately, the app looks terrible on newer devices (4.0+).

On my Galaxy Nexus, I use:

[https://play.google.com/store/apps/details?id=com.glebpopov....](https://play.google.com/store/apps/details?id=com.glebpopov.hackernews) (Read Only)

[https://play.google.com/store/apps/details?id=com.airlocksof...](https://play.google.com/store/apps/details?id=com.airlocksoftware.hackernews) (Read/Write)

<comment><USER9> I also use [https://play.google.com/store/apps/details?id=com.glebpopov....](https://play.google.com/store/apps/details?id=com.glebpopov.hackernews) too, unfortunately i cant comment, but it's quite good

</comment></comment><comment><USER10> I really wish Reddit News could support HN. It's has such an intuitive design (loading comments and the article simultaneously in a split pane so you can swap between) as well has a nice comment navigation (buttons to navigate by submitter, navigating top level comments with a button, highlighting recent comments).

<https://play.google.com/store/apps/details?id=reddit.news>

</comment><comment><USER11> Excellent, I'm writing this comment using the new version :-)

One request: when viewing comments from the ask hn section, it doesn't display the text from the question. Is this a pain to fix?

<comment><AUTHOR> oops, yes this moves to the top of the todo list

<comment><USER11> Awesome, thanks!

<comment><AUTHOR> should be fixed now.. was an api issue, the app should handle it correctly without and update :) some items might still appear to be broken if they were cached, but will reset automatically upon expiry

</comment></comment></comment></comment><comment><USER12> Not to critique the effort, but couldn't this be done with an (aggressive) alternate stylesheet for the main site? (ie. via stylish)

</comment><comment><USER13> The app works great, I think it would be nice to also have a "light" color theme.</comment>


Shodan: The scariest search engine on the Internet - <AUTHOR> http://money.cnn.com/2013/04/08/technology/security/shodan/ <comment><USER2> Eagerly awaiting the moment someone at CNN finds out about Metasploit. I'd like to think of it as a kind of "Dark Firefox".

<comment><USER3> Love this:

<http://www.metasploit.com/about/penetration-testing-basics/>

"You can become a penetration tester at home by testing your own server and later make a career out of it."

Sounds like the old style correspondence school ads - a bit hokey.

<http://www.thefreedictionary.com/correspondence+school>

I would have rewritten that as:

"Many people have actually made a career out of being a penetration tester by first testing their own home server"

<comment><USER2> You can absolutely learn to do penetration testing on your own time with your own servers. We have a script we give people to do the same thing. If you feel like you have a knack for systems programming, being a good systems programmer is 1/2 the hard part of appsec; the other 1/2 is literally "taking pleasure in finding creative ways to break things", and you can find out if you have that personality streak in just a couple hours of trying attacks.

<comment><USER3> Agree. Fully understand the ability to self learn (and have done that with almost everything I've ever made a dollar on despite going to one of those good business schools which is why people think I make money rather than other qualities).

My comment strictly related to the style of what they were saying (and how I might rewrite that) I think it's a great idea.

</comment></comment></comment></comment><comment><USER4> I apologize for the downtime/ delays, this was a big surprise this morning and I clearly wasn't prepared for the full on-slaught of CNN etc. If you have any questions about Shodan I can try to answer them here.

<comment><USER5> It would kill your business eventually so it may me a naive question but : do you need volunteer work to help identify and warn those insecure networks ?

<comment><USER6> I guess you should feel free to do so. It takes away lots of fun for highschoolers though :P

<comment><USER5> Also, sorry for highschoolers, but this is for their own good :)

I had my own "let's see what we can do" youth, and sure thing it is very insightful. If we were talking only about business damage, I would say : "well, they desserve it". But we're not.

What do you think would happen if tomorrow, news headline was : "Massive oil truck crash kills 10, caused by hacker tempering with traffic lights." ? Repressive laws against any kind of computer toying would become even harder, and our highschoolers may go to jail for simply trying to have fun.

</comment></comment></comment></comment><comment><USER7> +1 for the System Shock reference :)

<http://en.wikipedia.org/wiki/System_Shock>

<comment><USER8> Gah, still get creeped out watching the System Shock 2 intro.

<http://www.youtube.com/watch?v=MXPn6wcsUmk>

Let's hope this Shodan isn't as intelligent and psycho as System Shock 2 Shodan! Oh, and no zombies.

<comment><USER9> "Lo- lo- lo- look at you hacker.."

I've beaten this game at least 4 times, including co-op a couple times. Such a great piece of gaming history.

</comment></comment></comment><comment><USER10> mhm sorry as i don't know so much about this, but how is this different from google?

meaning that with a specific search in google i can find for example all kinds of cameras or systems one shouldn't find, e.g.:

-) <http://preview.tinyurl.com/34959u>

Maybe Shodan "focuses" on that, but they can't possible index more of those things than Google already has...

Can you find one single thing over Shodan you can't with a specific Google search? (maybe you find such things more easily with Shodan...)

EDIT: More information on Shodan:

-) Defcon Presentation [pdf]

[https://www.defcon.org/images/defcon-18/dc-18-presentations/...](https://www.defcon.org/images/defcon-18/dc-18-presentations/Schearer/DEFCON-18-Schearer- SHODAN.pdf)

-) Secanalysis.com

<http://secanalysis.com/a-brief-analysis-of-shodan/>

JoshuaRedmond beneath also provided interesting links

<comment><USER11> Crazy idea, if you don't know what you're talking about, shut the hell up.

<comment><USER12> I used to be able to tell people like you to go back to Reddit. Unfortunately the quality of HN has declined far enough that your content-free insulting of a decent question is not immediately recognizable as something with no place here.

I consider that fact a sad commentary on how far HN has fallen.

<comment><USER13> I'm a relatively new HN reader (~1 year) and have taken much away from my time here (much reading, few comments). I understand where you're coming from with concerns about quality; however, I resent the fact that I may be considered part of the increased readership responsible for "HN's decline"

<comment><USER14> I've been lurking HN for awhile now, and complaints about HN's decline were going on even years back when I was first introduced to the site...

<comment><USER15> That's how all communities work though. As a community grows and attracts new members, the old guard moan about how it was better when they were noobs.

In fact this is true for real -"offline"- life as well.

</comment></comment></comment></comment></comment></comment><comment><USER16> For similar coverage about finding barely-secured devices that shouldn't have ever even been connected to the Internet, check out the Security Now! podcast, episode 396 - The Telnet-pocalypse:

<http://www.grc.com/securitynow.htm>

Transcripts are available in several formats:

<http://www.grc.com/sn/sn-396.htm>

<http://www.grc.com/sn/sn-396.txt>

<http://www.grc.com/sn/sn-396.pdf>

</comment><comment><USER17> <http://youtu.be/5cWck_xcH64> is a really good presentation about what you can find on shodan.

</comment><comment><USER18> _But he added that cybercriminals typically have access to botnets -- large collections of infected computers -- that are able to achieve the same task without detection._

What do botnets have to do with crawling the web for unsecured devices? I'm not sure I understand the correlation.

<comment><USER15> Funny enough that question was answered in a rather public way just a few weeks ago: <https://news.ycombinator.com/item?id=5404642> (Researcher sets up illegal 420,000 node botnet for IPv4 Internet map)

<comment><USER18> I did read this article a few weeks ago but seem to have forgotten its link to my question.

Thank you for the reminder.

</comment></comment></comment><comment><USER19> From Wikipedia: SHODAN (Sentient Hyper-Optimized Data Access Network) is a fictional artificial intelligence and the main antagonist of the cyberpunk- horror themed action role-playing video games System Shock and System Shock 2.

<http://en.wikipedia.org/wiki/SHODAN>

Kinda cool they chose that name.

</comment><comment><USER20> Hardware manufacturers should ship their devices with a piece of paper printed with a unique UID and password. Not "admin/1234".

The owner would have the ability to change these at will, and resets would revert to the original UID/pw combination.

Lost your piece of paper? Send the device back. No more trivial hacks.

<comment><USER21> That would make the devices more costly to produce and would raise prices. I know that ISPs do this with their devices sometimes, but some companies will cheap out and will just ship with a generic username and password since they only have to flash one single ROM image.

<comment><USER22> It shouldn't really. I mean, it's not like devices don't come with at least 3 or 4 unique IDs for different purposes. Just using one of those for the default password or adding a new ID shouldn't be that big of a task.

I know that this is how some of the router/modem combos from french DSL providers worked - the admin and WPA passwords are two seperate UUIDs printed on the device.

<comment><USER21> The gateways provided by the cable ISPs here in Western Canada tend to have unique passwords. It would be prudent on the part of the device manufacturer to just create a scheme for creating default passwords based on the unique serial that the device has and then just print labels for each and have the default ROM just sort it out upon it being powered up for the first time.

</comment></comment></comment></comment><comment><USER23> I wonder, why noone turned off traffic lights or something like that to do mischief?

Also, why no terrorist yet used those security failures to do terror?

Once a random dude managed to log into ISS controls... Ever wondered what happens if some terrorist crash ISS into New York?

<comment><USER24> At least over here, traffic lights fail and turn off on their own, no need for hackers :) . Now, fixing them (for example setting up a "green wave"... hmm that could be a more interesting use :)

<http://en.wikipedia.org/wiki/Green_wave>

<comment><USER25> I'd like to see the local lights reprogrammed to follow the legal guidelines instead of short yellows to maximize traffic ticket revenues.

<comment><USER26> Consider yellow to mean "stop", and the length of it becomes irrelevant and the roads become a little bit safer.

<comment><USER27> For each given stop light, speed limit, and vehicle configuration, there is a rubicon that is crossed where it is impossible to stop before entering the intersection. Set up your camera and creep the yellow light time down past this limit and profits just start rolling in.

<comment><USER25> Exactly. There's uncountable number of stories easily google-able across the country where intersections with red light cameras magically coincidentally have their yellow light interval dropped by 1/4 to 1/3 vs intersections without red light cameras, to increase revenue.

<comment><USER28> Yep.

And then the red light cameras start magically getting bullet holes in them.

[http://www.knoxnews.com/news/2007/dec/12/police-man-shot- cam...](http://www.knoxnews.com/news/2007/dec/12/police-man-shot-camera-after- it-shot-him/)

[http://www.nj.com/news/index.ssf/2012/08/shoot_out_the_red_l...](http://www.nj.com/news/index.ssf/2012/08/shoot_out_the_red_lights_2_tra.html)

</comment></comment></comment></comment></comment></comment></comment><comment><USER29> " The good news is that Shodan is almost exclusively used for good.

Matherly, who completed Shodan more than three years ago as a pet project, has limited searches to just 10 results without an account, and 50 with an account. If you want to see everything Shodan has to offer, Matherly requires more information about what you're hoping to achieve -- and a payment. "

How does the fact that he charges for it mean that it's "almost exclusively used for good"? I would argue there is very little incentive to pay for something like this unless there is a monetary gain.

<comment><USER4> Actually, a lot of companies use Shodan data for research! For example, if you want a training set for your new webapp fingerprinting software then loading Shodan might be a good start. Or if you want to create whitepapers for your business, to drive sales for a specific product/ service, then Shodan can provide some empirical data to back up your claims. As was demonstrated with the Internet Census 2012, for people with bad intentions it's easier and much less attention-getting to just use a botnet (plus you don't need to go through the typical business agreements as you would with me). I hope that clarifies it a bit!

</comment></comment><comment><USER30> "Shodan searchers have found control systems for a water park, a gas station, a hotel wine cooler and a crematorium. Cybersecurity researchers have even located command and control systems for nuclear power plants and a particle- accelerating cyclotron by using Shodan."

How can there be any conceivable reason to connect these systems to the internet? Do they WANT an attack right out of a technothriller novel or the latest James Bond film?

<comment><USER31> Many embedded systems run Linux and are frequently attached to the netword for remote control. The root passwords aren't usually changed on these Linux boxes, so they are a wide open security hole.

Many companies pay attention to this sort of thing and make an effort to isolate these kind of devices to the local intranet. For every company that is it good about it, there are probably 10 that aren't even aware of the issue.

</comment></comment><comment><USER32> This is awesome, I never knew such a thing existed! But it's also quite alarming that so many devices are connected to the internet/computers that probably shouldn't be.

So my big question is: Is there a way to solve this 'security failure'? And if so, what is it/is it feasible? For someone with malintentions, Shodan seems to be golden.

<comment><USER33> It used to be fairly costless to ship products without security. It still is but the more attacks there are the more incentive there is to fix stuff. But there are so many more online devices shipping...

<comment><USER34> Part of the problem too is that when a particular product is compromised, most people stop at "Product X sucks" and don't ask themselves if the same vulnerabilities are present in products they themselves use.

As an example, take WordPress. I talk to people all the time who say "oh, WordPress isn't secure" even though the reasons most WordPress sites get hacked are due to practices that would make you vulnerable no matter what CMS you run -- not keeping up with security patches, running unneeded services on the server, not putting the admin area behind SSL, etc. But there's lots of people who move from WP to, say, Drupal and think that's made them secure, even as they continue doing all those same practices.

</comment></comment></comment><comment><USER35> A nice article regarding the deep web is this one from fravia <http://search.lores.eu/deepweb_searching.htm>. It's from 2008 but I guess there is still some information there that is useful and relevant with Shodan.

</comment><comment><USER36> More sensationalistic headlines? Shodan is nothing new, and I find nothing "scary" about it.

</comment><comment><USER37> I've been playing with the data from the Carna botnet output[1]. Basically someone scanned a massive portion of the Internet using broken routers as bots. There's some interesting finds in the data but analysing it is quite awkward given the size. Shodan is interesting but unless you take up a subscription is pretty limited.

[1] - <http://internetcensus2012.bitbucket.org/paper.html>

<comment><USER4> Actually, more than 90% of the website's services are completely free! There are only 2 services that I charge for: HTTPS and Telnet. All of the new stuff for the past year I've added and made available for free. And with the Developer API you can easily access the data from within your own scripts.

Oh, and I've seen this in a few locations now but: NO SUBSCRIPTION REQUIRED. All of the stuff that's sold on the website is a one-time charge. There are no subscriptions on the website :)

<comment><USER37> That's interesting and I stand corrected, I was under the impression for some reason that subscriptions existed. As an aside, have you had a look at the Carna botnet output, and if so how does it compare to your data?

</comment></comment></comment><comment><USER38> This is incredible! Unfortunately, Shodan itself appears to be down at the moment, presumably due to traffic from CNN. Awesome nonetheless.

<comment><USER39> could anyone register for a new account? all I get is a 405 not allowed.

<comment><USER4> That problem has been fixed! I made an error in configuring nginx for memcached and it ended up treating certain pages as static (which prevents them from getting POST requests).

</comment></comment></comment><comment><USER40> which brings up the legal question (based on the ATT 3 year jail sentence):

When is a admin/password login not acting as a admin/password login at all?

</comment><comment><USER41> They also missed ERIPP, which does something similar. This is all old news though, these things are constantly mentioned in other security reports. Even the government knows these things exist, which means that CNN is not scouping anyone :)

<comment><USER4> ERIPP is cool (I spoke to the author years ago), but to my knowledge it hasn't been updated in a while. And I cover 20+ services at the moment, so it's not just HTTP.

<comment><USER41> ERIPP v2 coming out in a (maybe) few weeks, and even though its current data is oooooold its been written up in the last month or two.

In general, It is pretty humorous that these things still catch people by surprise :)

</comment></comment></comment><comment><USER42> Looks like it's down: <http://imgur.com/TqeYX95>

Wonder if that's just because of the publicity, or is someone DoS'ing them.

<comment><USER4> It's a variety of factors that is causing downtime at the moment. The main culprit is the network itself at the moment, and I'm still trying to put out fires to hopefully make the website a bit more stable.

</comment></comment><comment><USER43> Even scarier is how fast their servers fall over :)

</comment><comment><USER44> Authorization is hard, so why bother doing it at all?

</comment><comment><USER45> OT: CNN broke the back button in Chrome on Windows.

</comment><comment><USER46> I could be wrong but the article reads like a paid for PR piece[1] to get publicity for this search engine.

[1] <http://www.paulgraham.com/submarine.html></comment>


Telecommuting with the Amiga [video] - <AUTHOR> https://www.youtube.com/watch?v=gYgwpB-8nWY&feature=youtu.be <comment><USER2> This starts slow and I almost quit but it gets really interesting in the middle, if you are into this retro stuff.

I never would have believed that you could use Dropbox from a machine as old as this. And we are not talking about accessing the files only with a web browser but actually mounting Dropbox as a drive. All the stuff involving TLS, like browsing modern websites or IMAP access to GMail, I'd also written off, but apparently it works.

<comment><USER3> For TLS they have a port of OpenSSL (named AmiSSL). So, when that port gets updated, and software is updated to any changes resulting from the port, they get any features (if they were ported) from OpenSSL.

They import (their version of) the Mozilla trust store, so roughly the same CAs are trusted as in a copy of Firefox from the same date as your install of AmiSSL.

</comment></comment><comment><USER4> This is a neat video. It made my day. I'm currently in isolation at my family's place due to covid, enjoying my old computers, including my A1200 (which I use with an OSSC), so I found it particularly amusing.

As I have a 68030 and I've been messing with current netbsd on it (a decades old pcmcia bug finally got fixed on netbsd-9 stable branch, so now my ethernet card works on netbsd), I feel the video should have been called "with AmigaOS" rather than "The Amiga".

Of course, on netbsd, it is very possible to run ssh, ansible, aws-cli and all the other crap I use to work.

</comment><comment><USER5> Wauw, I love this, you can make money doing virtually anything. Amiga seems to be way ahead of it's time.

</comment><comment><USER6> Doesn't seem to cover Slack, I guess you'd do that by running one of the Slack to IRC gateways on a VPS and connecting to that using an IRC client.

</comment><comment><USER7> Wow everything is so painful. Every time I get nostalgic for the "oldentimes," I use old hardware / an emulator and quickly remember how far we've come. It's easy to omit all the pain from your memory until you try to use this stuff for real.

<comment><USER8> Obviously if you keep using it though you get used to the pain. Perhaps you'll even start to enjoy it.

</comment></comment><comment><USER9> Why does the Amiga UI always look "stretched out", like someone forcing a 4:3 tv show into a wider aspect ratio?

Edit: thanks for the explanations!

<comment><USER10> Good question. On classic Amiga, the UI was designed for the default un- interlazed resolution of 640×256 (PAL).

Anyone wanting higher resolutions on would go to the interlaced resolution that doubles the vertical resolution to 640x512 (PAL). The UI, however, does not adjust resulting in squeezing UI elements vertically.

<comment><USER11> If you had a plain old monitor of TV resolution, then going to so called "high res" (640x512) meant that there was a terrible flickering that made this unusable. You had to buy an expensive multiscan monitor that could handle that.

A trick I used to do was to jump up to the NTSC equivalent (640x400) which was flickering less in my standard monitor.

<comment><USER4> >"high res" (640x512)

In OCS Amiga, Low/High/SuperHigh are defined by the base (as in not using overscan) Horizontal resolution, 320/640/1280.

PAL and NTSC are 256 and 200 lines base vertical resolution respectively, and 50/60Hz vertical refresh rate respectively.

512 and 400 lines are Interlaced modes. The flickering has to do with the interlacing. The improvement perceived with the NTSC mode is due to the increased vertical refresh rate.

ECS Amiga (A500+/A600/A3000) introduces the so-called Productivity modes, which are just the 512/400 lines hires modes but in Progressive, thus doubling the horizontal refresh rate to ~31KHz, while also doubling the DMA bandwidth required.

At full DMA you can form a a palette of 2^2 colors instead of the usual hires 2^4, and unless you have FAST RAM you'll want to keep it at 2 color in order to let the CPU use the odd ram access cycles.

This palette can of course be changed during horizontal blanking, as then the display DMAs are off and the copper has room to access the palette registers, or several times midline if only using 2 colors.

In Productivity mode, as the chip that does actually encode the video receives the same bitrate as usual, the color depth is reduced to 2 bits per channel (from 4) for a choice of 64 colors.

These restrictions do not apply to AGA (A1200, A4000, CD32) Amiga, which are a different beast.

To display the picture from an Amiga today, I do use and recommend the OSSC (Open Source Scan Converter) and a modern monitor with HDMI input.

<comment><USER12> To expand on this, apps could also (ab)use "overscan" modes, which granted slightly larger resolution but image quality at the corner/borders was often somewhat unreliable.

<comment><USER4> Image quality on overscan is alright. This is very testable by throwing the video output through the OSSC.

There are restrictions on some aspects of overscan display, however. They vary between generations of Amiga chipset. e.g. It might not be possible to display sprites outside of a certain area, or display them at all if overscan is large enough.

</comment></comment></comment></comment></comment></comment><comment><USER13> Save file dialogs should take ten seconds to open up like in Windows 10, or it's not ready for prime time yet.

<comment><USER14> My old 1200 was able to boot from cold in 8 seconds so I think that's a tall order. Amigas just can't be slow.

<comment><USER15> My A1000 took a minute or so to boot. It spent about 10 seconds with the Kickstart diskette, then swap to whatever program I was running for another ~50 seconds or so.

Until one day I read in a magazine how I could create a ramdisk ("RAM:") and use my startup-sequence file to load Workbench in there.

Then the warm reboots were instantaneous magic! (But a cold start took a bit longer as it had to copy the entire contents of the WB disk into memory. Worth it.)

<comment><USER4> >Until one day I read in a magazine how I could create a ramdisk ("RAM:") and use my startup-sequence file to load Workbench in there.

RAM: is a fs like Linux's ramfs, and is implicitly mounted on early boot, you don't need to create it. It is also gone on reboot.

What you're referring to is ramdrive.device, typically mounted as "RAD:", which is implemented as a standard reboot-persistent module that offers a standard trackdisk block device, and can be configured as bootable. You'd format the drive with FastFileSystem or OFS after creating it.

<comment><USER15> In Workbench 1.3, the device was named "RAM:" (EDIT: I'm wrong). Not sure if that changed in later versions of the OS, but 1.3 was as far as I got with the 1000. And yeah, I guess I didn't "create" it so much as "use it as the boot disk".

It was gone on power-cycle, but it persisted through so-called warm reboots. (CTRL+𝔸+𝗔, I think?)

<comment><USER4> Definitely "RAD:", not "RAM:".

RAM is a filesystem and not reboot persistent.

RAD is a block device and reboot persistent.

Article on RAD usage: [http://www.amigareport.com/ar139/p1-6.html](http://www.amigareport.com/ar139/p1-6.html)

Annotated disassembly: [http://wandel.ca/homepage/execdis/ramdrive_disassembly.txt](http://wandel.ca/homepage/execdis/ramdrive_disassembly.txt)

It's fresh to me, because I still use my Amiga computers.

<comment><USER15> Thanks. Your first link dislodged some cobwebs. I'm definitely confused after all these years. Yeah, it must have been the RAD: device that I copied my WB1.3 disk to.

<comment><USER4> As an added note, ramdrive.device would use chip ram, which is not very clever as CHIP RAM is limited and precious, besides slow from a CPU perspective.

There's third party RAD implementations that use FAST RAM instead.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER16> Until the Amiga has versions of Microsoft Outlook, Microsoft Teams, and the proprietary VPN the IT department decided on, it's unsuitable as a telecommuting machine.

<comment><USER17> I'm guessing you're being sarcastic, since Linux has none of these and is still used by a lot of people for remote work.

<comment><USER7> "A lot of people" = small percentage</comment></comment></comment>


Why the Netherlands Is Telling Its Tech Startups to Leave the Country - <AUTHOR> http://www.forbes.com/sites/karstenstrauss/2015/06/22/why-the-netherlands-is-telling-its-tech-startups-to-leave-the-country/

<comment><USER2> > the Netherlands has fewer than 17 million residents and a language that > nobody else speaks

If you don't count the flemish in Belgium (about 6-7 million people). In addition, (almost) everybody speaks english.

> One of the hardships Dutch startups face, says Kroes, is overcoming the > natural Dutch tendency to be humble.

Really? This is not the impression I get from the Dutch. Belgians love to make fun of Dutch people for being arrogant. There is also a very strong culture of entrepreneurship in the Netherlands, starting and having a successful company is highly regarded. And there are already a few successful startups, like ticketswap which recently opened in several other countries.</comment>


A $60k Patrol Boat and a Single Deck Gun Changed the Course of Korean War - <AUTHOR> https://nationalinterest.org/blog/buzz/how-lone-60000-patrol-boat-and-its-single-deck-gun-changed-course-korean-war-78871 <comment><USER2> That's amazing fortune!

The officers and enlisted men and their families scrounged up enough money to get the govt to pony up the rest to purchase a decrepit ship in need of repair.

It was repaired in New York with one mounted gun. They bought one hundred rounds on the way back in Hawaii. Two months after beginning maritime ops in Busan Harbor it sighted a DPRK ship with approx 1000 enemy soldiers who tried to fire on and swim to the patrol boat. The patrol boat fired back and sunk the ship staving off an invasion force which, once the war would start two months hence, would have denied UN forces the toehold they eventually leveraged to a stalemate on the peninsula and save SK from falling into communist hands.

<comment><USER3> I was the most surprised by the crowdfunding aspect. South Korea and its citizens were destitute yet managed to raise over $200,000 adjusted for inflation.

</comment></comment><comment><USER4> The Wikipedia page features photos of the ship: [https://en.wikipedia.org/wiki/USS_PC-823](https://en.wikipedia.org/wiki/USS_PC-823)

<comment><USER5> "at that stage a training ship of the United States Merchant Marine Academy. Fifteen naval officers spent two months in the U.S. to fix her. The ship was in such poor condition that the only thing working was the engine"

Wouldn't you want to be instilling your cadets with the importance of a well maintained ship?

The Academy seems to have been headed by a rear admiral, so I would have expected a military type approach to these things.

<comment><USER6> Have you ever been in the Military?

Making do with what you have is the number 1 skill you need to learn. Those cadets would have gained 10x more experience from getting that ship back up to operational readiness than they would have from working on a brand new ship in perfect condition.

<comment><USER5> I don't follow. Are you saying each class of cadets repaired then destroyed all the parts of the ship?

But no I've never been in the military.

I would have thought preventative maintenance would be a big thing, particularly for the big expensive thing that you're relying on to keep you alive.

<comment><USER6> The cadets took a mothballed ship in poor repair and commissioned it back into service. Sounds like a pretty good exercise.

<comment><USER5> Korea bought it from the United States Merchant Marine Academy, then had to spend time repairing it because it was in such a bad state of repair. I don't know what state it was in when the Marine Academy received it, but when it left only the engine worked.

</comment></comment></comment></comment></comment></comment><comment><USER7> If you're reading this in Chrome on mobile and many of the words are cut off on the right, try the Desktop Site option on the Chrome menu.

</comment><comment><USER8> The article says the ship was purchased via "crowdfunding" in 1948. How retroactive is that word?!

</comment><comment><USER9> Or maybe it just led to a battalion getting slaughtered at sea rather than in the port. Direct attacks on harbors had a pretty sorry record in WW II.

</comment><comment><USER10> War is stupid.

<comment><USER11> Indeed: Some poor NK peasants trying to save their lives by climbing onto that boat, getting gunned down...</comment></comment>


Do people know about fraud by third party IT consultancy companies? - <AUTHOR>

This is just an effort to inform the folks on HN (Future CEOs of big companies :) ) about the routine fraud by many IT consultancy companies with fake resumes and fake phone interviews etc.
Since I am from India, I know of many small scale IT companies run by Indians in US which cheat both the clients and the candidates, with these tactics, but I suspect the thing is not necessarily limited to Indian companies. Here is a typical situation: 1. The company recruits students / graduates without any experience promising them training and job placement. They don't need any CS or IT experience whatsoever, but they are promised they can get 60K+ jobs in whatever technology is. 2. The consultancy creates fake resumes for the candidates and starts forwarding them to other consultancies and clients etc. The guys routinely put 5 or 6 years of fake work experience without knowing a thing about the area. 3. Many companies don't pay anything to the candidates while they are being "trained", though they are paid on paper because of the immigration requirements.
 4. When it's the time for the phone interview, the guy you are interviewing may not be real candidate. Or he may have a couple of other people also listening in and helping him with written answers. 5. Since it's just a contractor job many big companies don't even bother doing an in-person interview trusting the consulting companies.
 6. It's possible that some of the managers in the big companies have indirect associations with these consultancies forcing them to stick to some consultancies despite getting really bad people from them some times.
 7. Finally the guy who knows very little about the field will join the big company as a contractor, and the consultancy takes big cut out of his pay check. 8. The employee may get fired easily first few times, but he will gain legitimate US work experience in the meanwhile and the the previous experience becomes irrelevant. <comment><AUTHOR> References: 1\. This is a very popular classifieds service where many of these shady consultancies advertise free job training opportunities with free boarding etc. : [http://ittraining.sulekha.com/itcourses](http://ittraining.sulekha.com/itcourses) 2.[http://www.scholarshipforusa.com/2009/01/the-truth-about- ind...](http://www.scholarshipforusa.com/2009/01/the-truth-about-indian-it- consulting-firms-revealed/). 3\. This website has reviews of many such companies: [http://goolti.com/faq.php](http://goolti.com/faq.php), [http://goolti.com/](http://goolti.com/) 4.[http://www.uscis.gov/portal/site/uscis/menuitem.5af9bb95919f...](http://www.uscis.gov/portal/site/uscis/menuitem.5af9bb95919f35e66f614176543f6d1a/?vgnextoid=da75d676b6b6f110VgnVCM1000004718190aRCRD&vgnextchannel=a2dd6d26d17df110VgnVCM1000004718190aRCRD)

</comment><comment><USER2> My wife had to deal with many such cases when they were hiring contractors in their group. A few simple checks that could be useful:

1\. Request to have some date of birth, graduation date etc on the CV. It's by no means fool proof, but it at least prevents a 23 year old passing a person with 10 years of work experience.

2\. Replace phone interviews with Skype interviews. She says many times they can actually see the candidates googling for answers and reading the top most result. Of course, they never hire such a candidate.

3\. Maintain a company-wide data-base of who is hired/interviewed from which consultancy and if the there were any red flags. This will help other groups in a big company. Since there is a written record, people also tend not to interview from the same bad company again and again and wasting everyone's time.

</comment><comment><USER3> I have had multiple experiences with that. When I first put my resume up on Dice.com in 2009 after graduation, I was contacted by a lot of these IT companies. A couple of them gave me job offers just over phone interviews which struck me as odd at first but I was also a bit desperate.

Then, they tell you that they will provide you with 2-4 week training which allows you to lie on your resume and put down 5-7 years of fake experience. Their account managers send you job postings and ask you to create fake resumes that are specific to each posting and they have in-house people who proxy your phone interviews.

Really bad, but I think more and more people are catching onto it.

</comment><comment><USER4> It also happens here in India. My sister works in a consultancy company. Her resume was forwarded with 3 years of fake experience while she was just a fresher.</comment>


Ask HN: How do you advise clients when they are probably bound to fail? - <AUTHOR> Hi, I manage digital advertising for an e-commerce startup in an emerging economy. E-commerce startups have not been profitable here, and I'm worried their efforts and cash will run out, and the startup might fail. Is there anything you suggest I do? <comment><USER2> 2 questions -

Why are they not able to see what you are able to see?

Why haven't you brought it up with them? What is the fear?</comment>


I Peeked into My Node_Modules Directory and You Won't Believe What Happened Next - <AUTHOR> https://medium.com/@jdan/i-peeked-into-my-node-modules-directory-and-you-wont-believe-what-happened-next-b89f63d21558 <comment><USER2> @Dang can we get a (2016) tag on this? Also people this is satire... You can read any of the past discussions here:

[https://news.ycombinator.com/item?id=12251162](https://news.ycombinator.com/item?id=12251162) [6 comments, 2 years ago]

[https://news.ycombinator.com/item?id=12235789](https://news.ycombinator.com/item?id=12235789) [8 comments, 2 years ago]

[https://news.ycombinator.com/item?id=12300157](https://news.ycombinator.com/item?id=12300157) [13 comments, 2 years ago]

[https://news.ycombinator.com/item?id=13379750](https://news.ycombinator.com/item?id=13379750) [1 comment, 2 years ago]

[https://news.ycombinator.com/item?id=14048958](https://news.ycombinator.com/item?id=14048958) [5 comments, 1 year ago]

[https://news.ycombinator.com/item?id=17444962](https://news.ycombinator.com/item?id=17444962) [1 comment, 3 months ago]

PS: If you like this article you will probably like this one: "Harvesting credit card numbers and passwords from websites" [https://news.ycombinator.com/item?id=16084575](https://news.ycombinator.com/item?id=16084575) [123 comments, 2 months ago]

</comment><comment><USER3> express does not have dependency on yummy [https://github.com/expressjs/express/blob/master/package.jso...](https://github.com/expressjs/express/blob/master/package.json)

</comment><comment><USER4> I can't even tell... Is this satire?

<comment><USER5> Pretty sure it is. But if it was any less ridiculous I could have been convinced otherwise

</comment></comment><comment><USER6> The title might look like a clickbait, but the article is interesting and well written. :)

</comment><comment><USER7> This issue is from 2016...

</comment><comment><USER8> This guy is great to follow on twitter (lots of funny stuff), but recently he's started rambling on about how twitter is "full of Nazis" which gets a bit annoying.</comment>


30+ Pricing Page Examples for Your Web Design Inspiration - <AUTHOR> http://www.coalesceideas.com/pricing-page-examples/ <comment><USER2> This is good inspiration for create new pricing on my product page. I like simple solutions.</comment>