Who Pays Writers? - <AUTHOR> http://whopayswriters.com/#/results <comment><USER2> On a related topic, a lot of tech companies will pay you $100-400 per blog post. For example DigitalOcean pays $200 per 1500ish words for in depth tutorials.

That's a little above 13 cents per word for a complex tutorial which solves a real problem and potentially has source code.

<comment><USER3> I would actually blog for tech companies on occasion if they were willing to pay 5 - 10k per post. It seems like companies are only willing to pay for very cookie cutter stuff though.

<comment><USER4> that's pretty crazy. There's hardly a post you couldn't write in a day of hard work (because then it's too long! spend one day writing it, so someone can spend 20 minutes reading it, don't make readers take hours to read through months of your writing.)

So you want a monthly salary of 5k (your low end per day) * 24 days = 120k per month?

<comment><USER3> If there is research involved, each sentence or paragraph could easily take an entire day. E.g. a couple years ago I wrote a post about deaths caused by drug use/misuse, and just getting an idea of how many deaths are caused by smoking involved reading through several chapters of the Surgeon General's most-recent 800 page report. So I figure more like one post every 50 - 150 hours, for something 2,500 - 6,000 words in length.

That said, even a monthly salary of 100k+ per month isn't completely crazy given that there are magazines that cost 100k per year to subscribe to, with dozens or hundreds of corporate subscribers. That's obviously not the market that most tech companies are going after, but there is precedent there in general.

<comment><USER4> Nobody makes a salary of 100k per month. That is $1.2 million per year. The CEO of IBM, a company that had revenues of $80 billion in 2015, made salary of $1.6 million in 2015.[1] If you want to include stock or options or a revenue share or bonuses or whatever go ahead - but that's not salary and your figures are completely, utterly ridiculous.

>That said, even a monthly salary of 100k+ per month isn't completely crazy

yes it is.

[1] [http://www.businessinsider.com/ibm-ceo-ginni-rometty- gets-a-...](http://www.businessinsider.com/ibm-ceo-ginni-rometty-gets-a- raise-2015-1)

<comment><USER5> > _Nobody makes a salary of 100k per month. That is $1.2 million per year. The > CEO of IBM, a company that had revenues of $80 billion in 2015, made salary > of $1.6 million in 2015._

Actually lots of people do. In TV, for example, even for a small European countries, such as that I know of, you can make like $500K per year if you're one of the 20-30 "stars" of the various network channels (head presenter, show host etc).

In the US: "In the depths of the recession in 2009, there were still 236,883 individuals who earned more than $1,000,000 in the United States. We know from other research that, by rough estimates, 90 out of 100 men and women reaching this income level are self-made with little to no inheritance. Almost all have college degrees. Men dominate the field, and almost all own or started their own business or work as an executive for a large business".

I wouldn't call 230,000 people "nobody".

<comment><USER6> In the US news business, $100k/month is strictly the domain of TV on-screen personality presenters; i.e., not the reporters, but network affiliate anchors who are referred to in-house as 'the talent'. Absurd sums of money when you look at the rest of the newsroom staff salaries, but this is all about ratings, sweeps and very local/regional popularity.

</comment></comment></comment></comment></comment></comment></comment><comment><USER7> I realize "its the web" is a thing but back when I was doing freelance writing for tech magazines I found the Writers Market[1] very handy. For print publications it had print calendars and editorial descriptions of what they liked to publish. I've not bought one since the rise of web journalism but I expect there are resources out there which have this info.

[1] [http://www.amazon.com/Writers-Market-2016-Trusted- Published/...](http://www.amazon.com/Writers-Market-2016-Trusted- Published/dp/1599639378/)

<comment><USER8> This is pretty much old hat. Duotrope[1] is one of the larger market listings. There was a big huff after they turned to a subscription model, which led to the creation or expansion of The Grinder[2].

At Aliterate[3] we've seen about 25% of our inbound submissions coming from each of The Grinder and Ralan[4]. The balance is some mix of Duotrope and smaller players.

[1] [https://duotrope.com/](https://duotrope.com/)

[2] [http://thegrinder.diabolicalplots.com/](http://thegrinder.diabolicalplots.com/)

[3] [https://www.aliterate.org](https://www.aliterate.org)

[4] [http://ralan.com/](http://ralan.com/)

</comment></comment><comment><USER9> What's amazing is the variance, even within one publication. Businessweek, for example, pays anywhere from $0.08 to $1.75 per word, which I assume depends on a writer's fame, relationships and maybe even writing skills. ;) Other key considerations, which this site can't really address, are who has a budget for freelancers, and _when_ do they have that budget? Many publications have a yearly budget and by late fall, that budget is gone.

<comment><USER10> I was shocked to see $0.08 for Businessweek, but read the additional details -- that was a kill fee. I'm actually not sure why they included it.

<comment><USER11> What's a "kill fee"?

<comment><USER12> It is a cancellation fee for freelancers - if the publication sees your work and decides not to run it, you get the kill fee and you're free to shop the story to other publications. The fee is specified in the contract, commonly 25% but rarely higher.

The vague intention of the kill fee is as insurance against an article being a bad fit, but generally the contract wording is intentionally vague. You can imagine any number of abuses by unscrupulous publishers who have the option to solicit far more material than they intend to publish.

An analogous situation might be a software house outsourcing a task for a flat fee, then dickering around with payment and eventually announcing they've decided your software doesn't pass their new test suite and you can accept a 75% pay cut or gtfo. Bear in mind that day rates for writers aren't what they used to be, and generally can't do a great deal of investigative journalism in your pyjamas.

<comment><USER6> Just to be sure, I'm more used to seeing 50% kill fees, at least from Asia and West Africa (for Western or Western-run publications). 50% is customary, and with established clients, unsaid until the time comes

<comment><USER12> It certainly depends a lot on the type of publication (and the nature of the article).

The treatment of articles upon which publishers "choose not to proceed" is very important knowledge going in. Perusing the whopayswriters JSON feed* there is a wide variety of behaviour described, not all of it making everyone look good.

* In the absence of full-text search, left as an exercise to the reader

</comment></comment></comment></comment></comment></comment><comment><USER13> Is per-word pricing actually how writers still get paid, or is this site just reporting that as a common metric? Most of the freelance writers I've spoken to have gotten paid either per-piece (lots of blog shadow writing), or per- hour.

<comment><USER14> Per-word pricing is standard in trade fiction (short form -- e.g. magazine markets, which are mostly dead outside the SF/F genre field).

It's also how I used to be paid as a jobbing IT reviewer/columnist/journalist in the British newsstand computer trade press (caveat: I switched to writing novels full-time in 2005).

<comment><USER15> Accelerando is currently blowing my mind. Very cool stuff.

</comment></comment></comment><comment><USER16> A lot of these reports are for "fob"s. Does anyone know what that means in this context?

<comment><USER17> It stands for "Front of Book", often where shorter news pieces appear on a magazine

</comment></comment><comment><USER18> Glancing through the site, it looks like most writers get their writings published through referrals / relationships with the editors.

Are there avenues where people can send writings / research into with an opportunity to publish on being compensated?

My motivation is around analytics, data research, visualization, mortgages, finance and real estate

<comment><USER6> The phrase you would be looking to use in your pitch to the editor would be to offer it 'on spec'. Some publications mandate that the first piece they get from new freelancers will be submitted on spec. But when you're making a living from it, it sucks to hear that.

</comment></comment><comment><USER19> Is anyone else a bit surprised at these wages, on the high side? I mean certainly it's not a lot hourly and there must be a lot of uncertainty (writing pieces on spec etc) but Buzzfeed giving $.50 a word for a 6000 word article is $3000... Which is better than I had assumed. But maybe that's just me.

<comment><USER10> I was in journalism school in 2004 and almost all the older journalists I met lamented the fact that high end publications were paying $1.00 per word and had been since the 1970s. There had never been any kind of adjustment for inflation.

<comment><USER20> With the rise of the internet, I think the written-word sector of the economy has inflated more than any other.

<comment><USER21> I find your comment puzzling. Are you arguing that volume has increased? I can't imagine how average compensation has increased, given the prevalence of free.

<comment><USER20> I sort of meant it in a reverse way, with words as currency. When a currency inflates there is more of it and it is devalued, that's the situation with article-style content these days. Instead of being obtuse, what I probably should have said is that we have a supply glut.

<comment><USER21> OK, I get it. Word inflation. Totally makes sense.

</comment></comment></comment></comment></comment></comment><comment><USER22> I shudder to think what my pay would be if we calculated it as $/token

<comment><USER23> Even better, sometimes we get paid to _remove_ tokens!

</comment></comment><comment><USER24> Best I ever did was $2/word from ESPN the Magazine.</comment>


Ask HN: Cryptocurrency To Replace Real Estate? - <AUTHOR> The question is simple - is it possible to design a cryptocurrency to replace real estate as a store-of-value and generational wealth mechanism? If so, what features and/or design goals would you incorporate? To focus the discussion, I'm only considering feasibility in terms of RE-like price stability and long-term appreciation (not regulatory/tax implications). Personally, I think the biggest challenges are implementing illiquidity and regional market pricing (e.g. SF real estate prices don't really influence the NY market). As for why any of this matters, I've had this nagging (grandiose) idea that replacing real estate as an asset class can enable affordable housing on a global scale. Thoughts? <comment><USER2> _replacing real estate as an asset class can enable affordable housing_

This is a great insight. Taking Germany as an example, policies to de- financialize housing lead to low and stable prices. China has been the opposite with the US in the middle.

Ultimately investment gains have to come from somewhere; real estate "investment" has mostly ended up stealing unsustainable amounts from the next generation. Even if you could replicate that with crypto it would probably only work for one generation (if that).

I guess government regulations created the housing market so you could imagine different government regulations (Sinagpore-style?) propping up some crypto instead, but that's not realistic today. Although... a system that almost every working person invests into then cashes out decades later sounds like US Social Security (except bigger and more harmful).

 _the biggest challenges are implementing illiquidity and regional market pricing_

Why are these good?

<comment><AUTHOR> My thinking was that real estate's lack of volatility comes from its illiquid nature. You can't buy and sell property on whim so there's less chance of temporary events (e.g. Trump tweets, earnings call results) having an outsized impact on prices.

Similarly, regional market pricing would prevent pan-region price crashes arising from someone dumping a large number of coins in this illiquid market. However, the more I think about this, I think it's a non-issue if you have large enough demand for this coin and a lack of liquidity.

</comment></comment><comment><USER3> If you buy a house now, you know that in 20 years someone will need a house. (Assuming you select a nice spot, and do all the maintenance work.)

With a cryptocurrency, you don't know if you choose the correct one. Will Bitcoin or Ethereum win the race? Which fork? Will they survive the transition from mining to fees? Will a PoS coin win?

Why a cryptocoin is better than a bank account or a treasure bond or a tracker fund?

<comment><AUTHOR> For the first question, here are the features I thought would be beneficial to this brand new coin.

1) ASIC-resistant proof algorithm (like in ETH 2.0 iirc).

2) Fixed mining rewards. For example, offering 1 REcoin per mined block forever. The idea is to prevent the deflationary aspect of BTC.

3) Whole coin transactions (i.e. no buying/selling 0.0001 BTC) to simulate the capital range of real estate investments.

4) An ICO valuing each coin highly (e.g. $10k). The initial capital would be used to set up an insured exchange. The idea is to leverage the insurance to become the dominant USD/REcoin exchange, preventing a large exchange- established dark pool that trades fractional REcoins and threatens the coin's price stability.

For the second question, I think this coin is better than a treasury bond or index fund since it discourages trading and thereby emulates the illiquidity of RE. I've talked about why I think this illiquidity is important in another comment below. With respect to a bank account, I think this coin is far superior since it aims for a rate of return on the order of an RE asset (i.e. much higher than a traditional savings account).

</comment></comment><comment><USER4> If you want to disincentivize nonproductive investment in real estate (Such as buying up re and holding it unoccupied as a kind of safe deposit box) that could be done with taxes and financial regulation. Where the money goes after that is not really our problem.

<comment><AUTHOR> I think the problem is bigger than that. Consider the NYC housing market. Even though there's almost no vacant real estate, rents are always rising due to the constant flipping of property. I say flipping since most of these purchases don't fundamentally improve the property in any meaningful way. Moreover, this continues despite the city having one of the highest capital gains tax rates in the US.

If investors had access to an alternative asset class that allowed them to realize decent YoY appreciation without undertaking risky construction, demand would cool down significantly. The end result (in the long run) would be sustainable property values and affordable housing for the middle class.

<comment><USER4> There are alternative asset classes. There's no market mechanism that can guarantee returns for any asset class. Even real estate takes hits once in a while.

</comment></comment></comment><comment><USER4> Can I get a 3-bedroom bitcoin a 20-minute bike ride from work?

<comment><AUTHOR> Of course this crypto wouldn't give you a physical asset (that's kind of the point). But if it were to be possible, maybe that 3-bedroom apartment wouldn't be so expensive...</comment></comment>


The start-up inflection point - <AUTHOR> http://www.scottberkun.com/blog/?p=377 <comment><AUTHOR> Not many companies get past the inflection point; so few that I think it's disingenuous to call it that. Most just languish there and clog themselves up with more and more management overhead. The only exception that comes to mind is Google.</comment>


Ask HN: Why are there not many successful link centric startups? - <AUTHOR> Very few companies have been able to make a breakthrough in this area even though the volume of people sending links, saving links is huge. Why is this so?
Many have seen success isolating and focusing the experience of photos, videos, etc. But not links.
Could it be the case that Facebook, Twitter, etc are actually link sharing companies? Or is there something inherently different about the link as a content type? <comment><USER2> Isn't Twitter really for link sharing?

</comment><comment><USER3> How would you monetize?

<comment><AUTHOR> You're saying that's why there's not many?</comment></comment>


Vim Magic Option - <AUTHOR> http://vimdoc.sourceforge.net/htmldoc/pattern.html#/magic

<comment><USER2> In addition to useful special characters in search pattern matching, vim can also do some excellent stuff in the second phrase of its substitution statements, as documented in sub-replace-special: [http://vimdoc.sourceforge.net/htmldoc/change.html#sub- replac...](http://vimdoc.sourceforge.net/htmldoc/change.html#sub-replace- special)

I find \U, \L and \E to be most useful, for example:

        :%s/ALL_CAPS_\(.*\)_HUZZAH/SOME_LOWERCASE_\L\1\E_HUZZAH/g

Will translate "ALL_CAPS_IS_GREAT_HUZZAH" to "SOME_LOWERCASE_is_great_HUZZAH". Super handy in certain situations.

It's also worth noting that these "magic" settings affect :s, :g, / and ?.

</comment><comment><USER3> But is there any way to set the "very magic" option in your .vimrc so you don't have to type \v every time you want to avoid a barrage of backslashes?

<comment><USER2> I believe there is no "very magic" nor "very nomagic" option, because the "magic" option itself is assumed to be binary by legacy vi scripts, which Mr. Moolenaar does not want to break. Also, either of those would wreck functionality on a lot of existing scripts, which make assumptions about the environment's level of magic.

I had a period of time where I reflexively typed \V or \v before everything, but really, I think it's worth it to just get used to remembering which characters need to be escaped in magic mode.

<comment><USER4> I second leaving 'magic' at its default.</comment></comment></comment>


Why we have to boycott RSA - <AUTHOR> http://blog.erratasec.com/2014/01/why-we-have-to-boycott-rsa.html <comment><USER2> > I mention this because people on Twitter are taking the stance that instead > of boycotting RSA that we should attend their conference, to represent our > views, to engage people in the conversation, to be "ambassadors of liberty". > This is nonsense. It doesn't matter how many people you convince that what > the RSA did is wrong if that doesn't change their behavior. If everyone > agrees with you, but nobody boycotts RSA's products/services, then it sends > the clear message to other corporations that there is no consequence to bad > behavior. It sends the message to other corporations that if caught, all > that happens is a lot of talk and no action. And since the motto is that > "all PR is good PR", companies see this as a good thing.

 _DO BOTH_. This is the real world. People have to compromise to send a unified message. Don't refuse to help one group who shares your goals because they have a different idea of how to achieve it. If you are in a position where you can boycott _and_ voice your opinion to their faces, do it. Maybe you're right and they don't give a shit about what you say. Who cares? Let the other people there know, and let them know that there are more of you out there.

<comment><USER3> It would take too much secret coordination, but the coolest thing would be if all the world's encryption experts/academics colluded to talk at RSA's conference with seemingly-plausible topics, but then have everyone just deliver a speech on RSA's actions before leaving the podium. Then again, getting in would require writing legitimate papers that RSA could still publish in their proceedings to make the conference look successful.

</comment></comment><comment><USER4> I'd go further. I think there needs to be a class action suit brought by customers who purchased a security solution and got snake oil. I'm sure the RSA license limits liability but I think there's a case to be made that this isn't just negligence but willful criminal acts and the limitations should be set aside. The case itself would probably be pretty damaging ("Tell us, what did you think the $10m was buying?"). I think RSA would go pretty far to avoid a trial.

<comment><USER5> [https://www.eff.org/files/filenode/20111229_9C_Hepting_Opini...](https://www.eff.org/files/filenode/20111229_9C_Hepting_Opinion.pdf)

"II. The 2008 Amendments to the FISA

While the underlying actions were pending in district court, and partially in response to these suits, Congress enacted the FISA Amendments Act of 2008, Pub. L. No. 110-261, 122 Stat. 2435, codified at 50 U.S.C. § 1885a. Among the amendments is § 802, an immunity provision and related procedures that are triggered if the United States Attorney General certifies to one or more of five conditions. In such case, no civil action may be maintained "against any person for providing assistance to an element of the intelligence community." § 802(a)."

This to me says such an action would not even get off the ground let alone them having to answer the "what did you think the $10m was buying" question.

<comment><USER6> You should also paste the five conditions for completeness:

1\. any assistance by that person was provided pursuant to an order of the court established under section 103(a) directing such assistance;

2\. any assistance by that person was provided pursuant to a certification in writing under section 2511(2)(a)(ii)(B) or 2709(b) of title 18, United States Code;

3\. any assistance by that person was provided pursuant to a directive under section 102(a)(4), 105B(e), as added by section 2 of the Protect America Act of 2007 (Public Law 110–55), or 702(h) directing such assistance;

4\. in the case of a covered civil action, the assistance alleged to have been provided by the electronic communication service provider was—

A) in connection with an intelligence activity involving communications that was—

i) authorized by the President during the period beginning on September 11, 2001, and ending on January 17, 2007; and

ii) designed to detect or prevent a terrorist attack, or activities in preparation for a terrorist attack, against the United States; and

B) the subject of a written request or directive, or a series of written requests or directives, from the Attorney General or the head of an element of the intelligence community (or the deputy of such person) to the electronic communication service provider indicating that the activity was—

i) authorized by the President; and

ii) determined to be lawful; or

5\. the person did not provide the alleged assistance.

</comment></comment></comment><comment><USER7> RSA is a subsidiary of EMC. This means that a boycott of Greenplum, Pivotal, VMWare, Isilon, Mozy, and MANY others would probably be included.

I just don't see an effective boycott of this scale happening -- especially when most of their customers just care about the product cost and benefit. Also, it can probably be argued that trying to secure your systems against a targeted intrusion from the NSA using technical means is pointless and a waste of money (throwing money at the EFF might be more effective).

Having said that, is there an good alternative to SecureID? The only thing that seems to come close is CRYPTOCard, but it looks like they have closer ties with the NSA than RSA does. A yubikey also looks nice, but I don't like how it needs to be plugged in as a keyboard -- a device that is kept physically separated from the login machine would be ideal. OTP apps on a multi-purpose device (mobile phone) also isn't something I consider to be secure.

<comment><USER8> >is there an good alternative to SecureID?

Twitter, Tumblr, Facebook, MIT, Stanford, Sony, Arbor Networks, 37 Signals, Twilio, (and many more) all use Duo Security as an alternative to RSA SecureID. [https://www.duosecurity.com/success- stories](https://www.duosecurity.com/success-stories)

Duo 2FA is easily the most secure[1], easiest to use[2], and most developer friendly multi-factor solution[3].

[1] [https://www.duosecurity.com/security](https://www.duosecurity.com/security)

[2] [https://www.duosecurity.com/product](https://www.duosecurity.com/product)

[3a] Almost all of Duo is open source. [https://github.com/duosecurity](https://github.com/duosecurity)

[3b] Duo's c development libraries and SSH/PAM packages are available in the official repos for major distributions like Debian/Ubuntu, REHL/CentOS/Fedora, SUSE/SLES, etc. [http://packages.debian.org/search?keywords=duo+security&sear...](http://packages.debian.org/search?keywords=duo+security&searchon=all&suite=testing&section=all)

[3c] Duo's REST APIs kick ass: [https://www.duosecurity.com/api](https://www.duosecurity.com/api)

<comment><USER9> The only downside to Duo is Jon Oberheide's previous collaborations w/ Charlie Miller, ex-nsa'er & advocate of the "no more free bugs" movement.

Minor nitpick, but if we're shaming companies in the security community, I think it's worth calling out some of the security celebrities whose stances contribute to the privacy destroying activities of the NSA. He and people like the gruqg are enablers of the government's destruction of our privacy.

I agree with you though. Duo is one of the best alternatives out there. Jon's collaborations w/ Miller were years ago. Perhaps I'm being a bit to grudgy.

</comment></comment></comment><comment><USER10> Branding this as a boycott implies that this is an expression of protest, that this is a moral issue. I agree that it is, but a lot of people don't. The morality of the NSA, and of cooperating with the NSA, is a matter of national debate.

However, it is not a matter of debate that the RSA backdoor of BSAFE was and is not open merely to the NSA. It is an objective fact that anyone can take advantage of a backdoor like this. As such, even if you think that the NSA is right, even if you think that cooperating with the NSA is correct, this is not the way to do it.

It might make business sense to do business with a security company that cooperates with the NSA. It does not make business sense to do business with a security company which is proven to produce vulnerable software.

Whether or not it's an ethical problem is subjective. The fact that it's a business problem is objective.

This comment misses the mark:

> Also, it can probably be argued that trying to secure your systems against a > targeted intrusion from the NSA using technical means is pointless and a > waste of money

The BSAFE backdoor does not simply make companies vulnerable to targeted intrusion from the NSA. It makes _every_ technology which uses Dual EC_DRBG vulnerable to _any_ hacker who knows how to use the vulnerability. This is a pseudorandom number generator, which means that it affects almost every primitive cryptographic operation.

A company which would introduce such a vulnerability for the NSA may or may not be an ethical company, but it certainly is not a company qualified to provide security.

EDIT: It looks like I messed up my understanding of the way in which Dual_EC_DRBG was broken. See the responses to my post for details.

<comment><USER11> > However, it is not a matter of debate that the RSA backdoor of BSAFE was and > is not open merely to the NSA. It is an objective fact that anyone can take > advantage of a backdoor like this.

This is not accurate. You need to know the private key for the generator, and this is not publicly known.

<comment><USER12> But, how many people have access to said private key? Will it ever be leaked, as some pieces of sensitive data have been? You can't trust keys that aren't yours to control, because while we can probably safely assume that NSA has better security than you or I or the companies we work for, it also has much higher capability attackers than most of us ever see in our lifetimes. The value of this particular private key is probably the highest of any known single private key in existence.

And, what about further down the road? 10 years, maybe 20, when this new type of key is predictably breakable with large enough resources? A 1024 bit RSA key is breakable for about $10 million _today_ , according to a study that was linked to in a previous discussion about the state of quantum competing a couple days ago.

There are too many ways this one key could end up compromising potentially millions of locks.

<comment><USER13> " … because while we can probably safely assume that NSA has better security than you or I … "

This is the same NSA that has no idea what or how many documents Snowden exfiltrated as a contractor sysadmin?

Would you bet your company's confidential data (and possibly future existence) on the assertion that Snowden didn't have access to that private key? Or that other less politically motivated NSA contractors didn't have access to that private key, and which they could have sold for profit instead of publicly whisteblowing for ethical reasons?

<comment><USER12> I've seen no evidence that the key has been compromised, nor evidence that any important NSA keys have _ever_ been compromised. I must assume they have different practices for their keys than for their data gathering practices.

While I've never seen it spelled out this way, I've always been under the assumption that the reason the NSA had so many outside contractors doing particularly dirty work was perhaps because they knew it was illegal and unconstitutional, and wanted it to happen outside the agency itself. But, I may be misinterpreting. It may have simply been a cost-cutting measure in which they failed to account for the lower level of loyalty to the state and higher level of loyalty to the constitution and individual rights than they were accustomed to from "company men".

<comment><USER13> In this post Snowden era, any time I hear the phrase "I must assume … ", I automatically have to wonder just how well founded that assumption is any more.

You're _probably_ right.

A year ago I would have said you were "probably right" if you told me the NSA wasn't recording metadata for almost every phone call, email, and website visit.

<comment><USER12> I don't disagree with you, really.

I think we both agree that any company that is willing to compromise its users to _any_ entity, for money or otherwise, is not a company that should be entrusted with security. I will never deploy an RSA product, and will encourage my customers to choose other options (we support 2FA in our products, as of a couple of months ago, so we have the ability to determine what potentially millions of users choose, though realistically only a few hundred of our users have enabled 2FA, thus far; we don't support RSA).

So, yeah, it's _also_ possible that the NSA's super secret input data they used for this RNG will be revealed or will be compromised by some powerful attacker (China, for instance, who would have very high incentive to compromise a large percentage of major corporations in the US in one fell swoop).

</comment></comment></comment></comment></comment></comment></comment><comment><USER14> Do we have a customer list of RSA? We should at least try warning them about it. Many of them probably aren't even aware of this. What banks use RSA's products?

<comment><USER15> Conservatively: all of them.

<comment><USER16> I'm far more concerned about the overlap between the name of the organization and the name of the algorithm.

The political debate over "working inside the system" is certainly important to have. But the organization that makes those hardware tokens used all over the place could vanish, and it would be a minor systems integration inconvenience.

The reputation hit to a fundamental algorithm is going to be confusing programmers for a long time. I don't even know how to start measuring the cost of that.

<comment><USER17> I think the solution to that problem should be that if a programmer doesn't understand the difference between RSA the company and RSA the algorithm or the difference between a random number generator and an asymmetric algorithm, for God's sake don't let them anywhere near any crypto code.

Of course that probably won't happen since programmers who don't know what they're doing implementing crypto seems to be as popular as ever.

<comment><USER16> Ahh, yes I wasn't clear enough. There are two distinct issues here. I observed more than one reaction to the original news, where a tech journalist type was clearly experiencing "reasonably informed confusion" about RSA.

And then, the degree of "knowing what you're doing" is important too, because I'm pretty sure I have a better background in algebra than some professional cryptographers, but human blind spots can get pretty subtle.

The difference between a PRNG and an asymmetric cipher is _easy_ to understand. The _cognitive load_ of associating RSA the company with RSA the algorithm (and ECDRBG the PRNG with ECC the PKI for that matter) is difficult to overcome even when you're aware of the potential bias.

</comment></comment></comment></comment></comment><comment><USER5> "In some cases the companies had no choice (Verizon)"

This is how wrong so many people are. Verizon's CEO has flat out said "they are our largest customer" (i.e - go fuck yourself).

</comment><comment><USER18> From the article:

"Sadly, I haven't spoken at RSA in many years. Had I been accepted to talk this year, I'd certainly be canceling it."

<comment><USER19> What does this have to do with the core part of the article: that people should boycott the RSA for helping the NSA so willingly in surveilance?

</comment></comment><comment><USER20> A boycott is symbolic, and that is important. But I doubt it will be effective in changing their corporate priorities. RSA makes its money from government contracts, or from other government contractors, not from privacy-minded individuals like us.

Instead, I propose that it be unlawful for companies which have been thoroughly hacked to bid on government cybersecurity contracts, at least for some period of time. After the SecurID hack, RSA should have been blacklisted for, say, a year. BSAFE should not be anywhere near a government or defence network.

PS: The analogy to Vichy France isn't great. It was not a matter of French technocrats collaborating just to save their jobs; it was real counter- revolutionaries fighting to bring down the Third Republic from within.

</comment><comment><USER21> Via this logic, shouldn't we boycott Yahoo, Google, and Facebook too?

<comment><USER15> Why would you boycott companies that spent millions of dollars fighting NSA because of an allegation that another company took millions of dollars to hep NSA?

<comment><USER21> Well these companies are giving information to the NSA one way or another. Its a slippery slope argument, but anyone that doesn't refuse to give up the information e.g. Lavabit is complicit in aiding the NSA. Whether they get paid for it or not seems irrelevant.

<comment><USER22> I think that a reasonable person would consider {Apple, Google, Lavabit, ...} receiving a National Security Letter coercion, and therefore not "complicit".

"Complicit" would be Verizon or AT&T, who to this day still sell phone call metadata to the NSA.

</comment></comment></comment></comment><comment><USER23> I initially read this as boycotting RSA products like BSAFE, rather than the conference.

Aside from their secure ID products, do people use many RSA products?

</comment><comment><USER24> What About EMC?

Should they bear any of the burden or only the subsidiary?

What about those companies that use RSA products and services?

These are just questions.

Not advocacy.

</comment><comment><USER25> +1.

411 - [http://rsaconference.com](http://rsaconference.com)</comment>


SecureFlag CE is an OWASP project to host on-premises AppSec training platforms - <AUTHOR> https://owasp.org/www-project-secureflag-community-edition/ <comment><AUTHOR> The SecureFlag Community Edition is an open source training platform created for developers to learn and practice modern secure coding techniques through hands-on exercises.

The platform helps develop secure coding skills through real-world challenges to ensure knowledge acquired during the course can be confidently and continuously applied in the real world.

Exercises run in isolated Docker containers that are disposed when the exercise ends. The desktop comes with a pre-configured development environment, complete with the IDE and various tools that the candidate can use to solve the exercise. Environments are created on demand and can be accessed through a web browser, without the need to install additional software.</comment>


China Is Building a Rain-Making System Three Times as Big as Spain - <AUTHOR> http://www.scmp.com/news/china/society/article/2138866/china-needs-more-water-so-its-building-rain-making-network-three <comment><USER2> Excluding systems which put water into the air, Atmospheric water is a zero sum game AFAIK so if this causes rain to fall where the Chinese want it, somebody else misses out.

Freshwater from high mountains in the India/China region is a hot topic. They're running out of glaciers.

<comment><USER3> Wouldn't higher temperatures and lower humidity due to water vapor extraction lead to an increase the evaporation from the oceans to maintain the balance?

Not saying that wouldn't have other effects, just wondering if atmospheric water is really a zero sum game.

Based on this [0], it looks like the weather systems head out over the pacific after passing China, so should have ample time to refuel?

[0] [http://wasatchweatherweenies.blogspot.com/2012/02/jet- stream...](http://wasatchweatherweenies.blogspot.com/2012/02/jet-stream.html)

<comment><USER4> It's not a 0 sum game so much as an equilibrium expression.

They're just putting their thumb on one side of the scale. Where the extra evaporation comes from and how it affects global climates is too tricky to predict but that's not going to stop them so we'll just have to live through it.

</comment></comment></comment><comment><USER5>
         Under the guidelines of the Clean Water Act by the
         EPA, silver iodide is considered a hazardous
         substance, a priority pollutant, and as a toxic
         pollutant.(10) Some industries have learned this all
         too well. ... If the toxicity manifests in pollution
         and illnesses, the effects may not be reversible ...

[http://www.ranches.org/cloudseedingharmful.htm](http://www.ranches.org/cloudseedingharmful.htm)

So.... this doesn't seem like the best idea.

<comment><USER6> Regardless of the merits or demerits of this particular scheme, I admire the spirit. With a fraction of such confidence we could revive the Neanderthals, build an asteroid defence system, clean up the oceans, on and on. Instead we're not trying much. We feel ashamed... because... why?

<comment><USER7> At what cost? Some cultures do not value the health and life of the every day person. I don't think that is something to be honored or respected.

<comment><USER8> While clearly true, I think we'd have to rephrase that as "all cultures" \- here in the US people are sleeping on the sidewalk outside my office. In the PRC, they're willing to gamble on geoengineering which could poison people (just not people in power). I can't think of any current society that really values every member - but we can keep working towards that goal...

<comment><USER9> Scandinavian societies are pretty good at looking after everyone "in" the society, though for outsiders things can be hit and miss.

</comment></comment></comment></comment></comment><comment><USER10> Googling around a bit, there seems to be a long history of weather- modification news coming out of China.

In 2008, according to the Beijing Weather Modification Office, China used rockets to make sure the Olympic opening ceremony was rain-free: [https://www.independent.co.uk/sport/olympics/how-beijing- use...](https://www.independent.co.uk/sport/olympics/how-beijing-used-rockets- to-keep-opening-ceremony-dry-890294.html)

In 2013, China was producing "55 billion tons of artificial rain a year" according to the China Meteorological Administration: [https://qz.com/138141/china-creates-55-billion-tons-of- artif...](https://qz.com/138141/china-creates-55-billion-tons-of-artificial- rain-a-year-and-it-plans-to-quintuple-that/)

Last year, the CMA spent millions on airplanes and rockets to affect rainfall: [http://www.scmp.com/news/china/policies- politics/article/206...](http://www.scmp.com/news/china/policies- politics/article/2064729/china-showers-y115b-rainmaking-project-parched)

That said, it's unclear whether cloud seeding actually works: [https://cen.acs.org/articles/94/i22/Does-cloud-seeding- reall...](https://cen.acs.org/articles/94/i22/Does-cloud-seeding-really- work.html). An experiment in the US, the Wyoming Weather Modification Pilot Program, gave somewhat positive but inconclusive results on the order of a 5 to 15 percent increase in precipitation amount: [https://fivethirtyeight.com/features/we-may-never-know- how-w...](https://fivethirtyeight.com/features/we-may-never-know-how-well- cloud-seeding-works/)

And, sure enough, in 2011, China's rainmaking tech wasn't enough to fix the Yangtze delta drought: [https://www.theguardian.com/environment/2011/jun/01/china- dr...](https://www.theguardian.com/environment/2011/jun/01/china-drought- weather-modifying-yangtze)

To me, all this rain-making news out of China seems like either propaganda or some Chinese government bureau justifying its existence by inflating how much this cloud-seeding technology can actually do. But that's just my feeling from an hour of searching around and skimming articles -- I'd love to hear how I'm wrong!

<comment><USER11> > To me, all this rain-making news out of China seems like either propaganda

It's easier to organize a very public and sophisticated rain dance than it is to properly manage water resources at scale.

</comment></comment><comment><USER12> The potential environmental impact of loads of silver iodide on human and other animal life is of concern. But it is China, so they probably don't care about that aspect.

<comment><USER13> Not only China, but which large country cares about larger environmental impact? Looking at the weapons the big countries are still building (man made floods, tornadoes etc) I don't think it's fair to target China alone.

<comment><USER14> > which large country cares about larger environmental impact?

Germany and Japan come to mind.

<comment><USER15> Such irony. The losers of WWII now care about the fate of the planet more than the "winners". I say "winners" because no one really wins a war. We all lose.

<comment><USER16> Huh, what does this have to do with the _outcome_ of a war? That would imply that someone can win a war by caring about the planet. Also, caring about climate change does not necessarily have a strong correlation with views on war.

Apart of that, generations have passed since then. The majority of people alive now were born after the war, so shift in mindset is not too surprising.

<comment><USER15> > ...caring about climate change does not necessarily have a strong > correlation with views on war.

I think the right side of the American political spectrum pretty much disproves this one.

<comment><USER17> Thats funny, I have never met anyone from any political system, short of nhilism, who doesen't care about climate change. The argument, whivh you seem to be intentionally reframing, is about the cause of said change. Don't make HN political, particularlly with petty, misleading quips like that.

<comment><USER15> No, I am not reframing. I'm sorry for your limited experience, but I have met far too many conservatives that all but spell it out. I used to be one and traveled in those circles. Look at people's actions. Conservatives in Congress and the WH cut the EPA, they cut Climate Science budgets, and not only do they offer all-out denial, they often just flat out state that a warmer planet would be or could be a good thing. So if that doesn't qualify as "not caring" about climate change, then we aren't seeing the same thing. Obviously, not everyone on the right is a fire-breathing climate denialist, but the OP was about correlation between views on war and views on climate change and IMHO there is strong one.

<comment><USER18> Anecdote doesn't make data, otherwise my personal experience of never having once met a conservative that doesn't care about clean air and water would cancel out your experience.

Straw men and ad hominem don't make up for actual data.

<comment><USER15> I am not certain what model you use for reasoning, but if person A says "I never saw X" and person B says "I saw X on occasions Y, Z, and W", then they don't "cancel each other out," unless someone is lying. Literally the entire rest of my comment was not about what I thought I saw, but what people have actually done. E.g. I mentioned what conservatives in Congress have actually _done_ (e.g. latest [https://www.washingtonpost.com/news/energy- environment/wp/20...](https://www.washingtonpost.com/news/energy- environment/wp/2018/02/12/trump-budget-seeks-23-percent-cut-at-epa-would- eliminate-dozens-of-programs/)) and suddenly we are arguing about anecdotes and I'm accused of offering strawmen. Uh, no.

</comment></comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER19> I think access to water resources has always been part, if not the bulk, of modern China's Tibet play. And now they're starting to tap into those resources. I wonder what the effects will be once they start pumping / rain- making at an even more massive scale.

More on water resources in Tibet: [http://www.tibetnature.net/en/introduction- water-resources/](http://www.tibetnature.net/en/introduction-water-resources/)

<comment><USER20> Well yeah. It's a territory next to India, which is short on water, has a huge population and the atomic bomb. So it was always about who would get it first without getting busted.

</comment></comment><comment><USER21> Where would this rain that's being diverted normally end up?

Is some other country going to have a drought because of this?

<comment><USER22> It's possible, even likely, that much of the rain would have fallen on the ocean.

<comment><USER23> Really? Because most of the moisture originated from the oceans in the first place. Are you saying that after genesis, it travels for some time over land before being deposited back in an ocean?

<comment><USER24> provided no other variables... considering it's 71% of the area of the planet, I'd say it's 71% likely to rain on the ocean

<comment><USER25> That sounds kind of shortsighted reasoning. I know that in Scotland most of the weather comes from the West, hits the mountains and falls as rain. Its dryer on the east coast (though it still rains plenty).

<comment><USER26> In the US, prevailing weather moves from west to east.

Moist air from the Pacific is immediately pushed up by the Rockies and rains out. Almost the entire US West is in the rain shadow, and very dry. Weather patterns pushing north from the Gulf of Mexico and passing over the Great Lakes restore normal rainfall roughly between the Mississippi River and the Appalachians. Since those are very old and weathered mountains, there is a very slight rain shadow to their east, and proximity to the coast evens it out shortly thereafter. Most of the deserts in the US Southwest only get rain from the monsoon thunderstorms from Gulf of California and Gulf of Mexico, because otherwise they're "behind" the mountains all the time.

Obviously, the oceans themselves don't have mountains that cast rain shadows. But they have warm and cold currents. Cold currents have a sort of shadow, because they evaporate less moisture into passing air masses. The warm/cold current split is why San Diego is dry while San Francisco is wet.

Scotland's winds blow over the Norwegian branch of the North Atlantic warm current, rain out over the highlands, and rain out a tiny bit less on the lowlands. The patterns are entirely predictable from orography and oceanic currents. All of Britain is warmer and wetter from the current, and Scotland is where all the mountains are.

Both effects come together at the Atacama Desert, because it's in the orographic rain shadow from the Andes _and_ has a dry coast from a cold ocean current.

Even if the entire planet was covered in ocean, there would still be uneven rainfall patterns, as the circulation currents would be influenced by underwater ridges and seamounts, wind patterns, and seasons.

</comment></comment></comment></comment></comment></comment><comment><USER27> This should be regulated internationally by the UN. This solution is like turning on the AC when it's hot out. It won't make it less hot outside and you will need more and more electricity to power the AC as the world heats up from increased CO2 levels.

This technology releases significant amounts of CO2 and as the Earth's temperature rises from increased greenhouse gas concentrations, solutions such as these will show diminishing returns because the technology they are built upon only worsens the underlying problem by producing significant amounts of the gas causing the problem in the first place.

Disappointing approach to solving climate change and mitigating it's impacts.

<comment><USER20> What's more, local weather is always existing in a global context. When they'll modify the meteorology at the scale of their country, it may very well impact the climate of the entire planet. Water must come from somewhere. Air current will be impacted. And temperature deltas.

It's very concerning.

<comment><USER28> How dare they think of their own country! Those are trully irresponsible national leaders.

<comment><USER20> There is a huge gap between doing something that will improve your situation only, and one that does at the expense of everyone else.

</comment></comment></comment></comment><comment><USER29> I've always thought Australia should build a giant canal from the Great Australia Bite up through central Australia. Perhaps forming a permanent inland sea. The sea water evaporating would fall as rain (not sure _where_ , though...).

A question for this article is who would have gotten that rain had it not been seeded.

<comment><USER30> Do you mean Lake Eyre? [https://en.wikipedia.org/wiki/Lake_Eyre](https://en.wikipedia.org/wiki/Lake_Eyre)

There has been discussion about flooding it with sea water for years but it seems impractical.

<comment><USER29> Not specifically, more DIY inland sea.

I think the big problem is motivation: we have heaps of arable land, and people are increasingly concentrated in cities.

EDIT thanks for the headsup, there's quite a bit online about it. I had this idea pre-internet, but haven't had the idea of googling it. IANA millennial, AMA (but I won't know).

</comment></comment></comment><comment><USER31> Interesting how quickly we went from "weather modification is a conspiracy theory" to reporting about it on an increasingly regular basis.

<comment><USER32> You're right. As a fan of conspiracy theory drama, I love it when I make this discovery (how something went from conspiracy theory to non-conspiracy theory). I had actually read about this before it had its own Wikipedia page and people thought I was crazy if I chose to speak about it - [https://en.wikipedia.org/wiki/Operation_Popeye](https://en.wikipedia.org/wiki/Operation_Popeye)

Those who have a deep desire to be in control will try almost anything.

As far as actual conspiracy theories go, I don't see why some people have such a hard time imagining that powerful, control-hungry people could form groups and work together to feed their desires. I guess they just can't relate because that's not how they think or they just don't want to think about it because it makes them uncomfortable.

</comment></comment><comment><USER33> >The chambers burn solid fuel to produce silver iodide

seems a little off - most fuel doesn't contain silver or iodine. I expect what happens is the put silver iodide on the fuel and then they heat produced causes it to rise up in the manner of a hot air balloon.

Incidentally silver iodide seems to cost $300-$500 / kg but you don't need very much of it

Wikipedia has "Approximately 50,000 kg are used for cloud seeding annually, each seeding experiment consuming 10–50 grams."

</comment><comment><USER34> Unfortunately there is little evidence that cloud seeding is actually able to increase the overall precipitation in most cases [0 - response to NRC report on cloud seeding].

There are spectacular results when glaciating individual clouds [1] and there is some evidence of glaciogenic cloud seeding (the kind done with silver iodide) working in mountainous regions where supercooled clouds are common [2 - paywalled unfortunately]. However, much of the Tibetan plateau has high amounts of dust, which means that the clouds already form ice at relatively warm temperatures [3]. In this case, silver iodide might not be expected to have a large effect on precipitation formation.

It is also very difficult to detect a change in precipitation, as it varies strongly in both space and time, requiring long averaging periods to detect a change. This will be an very useful experiment if it goes forward, but I suspect that concerns over rain-stealing are rather overblown, as are hopes that it could significantly enhance rainfall in arid regions.

[0] - [https://journals.ametsoc.org/doi/abs/10.1175/BAMS-86-5-647](https://journals.ametsoc.org/doi/abs/10.1175/BAMS-86-5-647)

[1] - [https://www.ge.com/reports/snow-men-cometh-kurt-vonnegut- ice...](https://www.ge.com/reports/snow-men-cometh-kurt-vonnegut-ice-nine- white-christmas-demand/)

[2] - [http://www.pnas.org/content/115/6/1168](http://www.pnas.org/content/115/6/1168)

[3] - [http://www.pnas.org/content/107/25/11211](http://www.pnas.org/content/107/25/11211)

</comment><comment><USER35> This sounds like a potential military weapon as well

<comment><USER36> They mention the US, CN and then SU, now RU, had engaged in weather research for offensive purposes --but at least some of that has turned to defensive measures now, given pop growth and climate change.

</comment></comment><comment><USER37> Really cool. It uses silver iodide though. How much silver would need to be consumed to make this work? That probably won't be cheap.

</comment><comment><USER38> Why not plant trees? [https://forestsnews.cifor.org/10316/make-it-rain- planting-fo...](https://forestsnews.cifor.org/10316/make-it-rain-planting- forests-to-help-drought-stricken-regions?fnl=en)

<comment><USER39> China is probably planting more trees than any other country in the world.

[http://www.natureworldnews.com/articles/20305/20160321/china...](http://www.natureworldnews.com/articles/20305/20160321/china- reforestation-nasa-deforestation-efforts-pollution.htm)

"Based on the images captured by NASA's Moderate Resolution Imaging Spectroradiometer (MODIS), it was revealed that 1.6 percent of the total land surface of China became heavily forested in a span of only ten years from 2000 to 2010."

[http://rspb.royalsocietypublishing.org/content/284/1854/2016...](http://rspb.royalsocietypublishing.org/content/284/1854/20162559)

"China is investing immense resources for planting trees, totalling more than US$ 100 billion in the past decade alone"

</comment></comment><comment><USER40> Not being apocalyptic and all, but reminds me of this:

[http://matrix.wikia.com/wiki/Operation_Dark_Storm](http://matrix.wikia.com/wiki/Operation_Dark_Storm)

</comment><comment> Digit-Al Sounds like a bad idea [1] to me.

1\. [http://www.ranches.org/cloudseedingharmful.htm](http://www.ranches.org/cloudseedingharmful.htm)

</comment><comment><USER41> > The system, which involves an enormous network of fuel-burning chambers

Oh dear... Wonder what will be burned there?

</comment><comment><USER42> > The chambers burn solid fuel to produce silver iodide, a cloud-seeding agent > with a crystalline structure much like ice.

> ...releasing only vapours and carbon dioxide, which makes them suitable for > use even in environmentally protected areas.

Hmmmmmmmmmmmm

</comment><comment><USER43> I'm sure this will have no unintended consequences...

</comment><comment><USER44> What could go wrong?

</comment><comment><USER45> What exactly is being burned to produce silver iodide?

</comment><comment><USER46> In other news, in San Francisco, the NIMBYs won an agitation to prevent a 4 school building from being constructed.

I am kidding..maybe.

In all honestly, I think the time for US to create large scale construction projects that serve humanity (at the expense of environment) are over. We are lucky that the interstates got build in 1950s, that the NYC Subway was formed in late 19th century etc. Today, the regulations and outrage is so strong that none of these would have been possible.

It is good to see other countries such as China being on the cutting edge to see what is possible.

<comment><USER47> Not an engineer but, if your infrastructure is that old first of all I'd focus on maintenance, rather than having dick measuring contests with countries that have questionable attitudes towards pollution, safety and nature.

<comment><USER48> The condition of the roads and infrastructure in a large part of the US is very, very bad when compared to countries like the Netherlands. It's like the US is a superpower with third world infrastructure.

<comment><USER49> Maintenance of old infrastructure in large projects is difficult and budget for this purpose is hard to justify, while building new things gets harder due to (self imposed) new regulations and higher costs (outsourcing might be cheaper, but always has some risks...).

I don't know, sounds very familiar :)

<comment><USER47> While I agree with you 101% I think that politics play a huge factor on this: no administration wants to do its homeworks, only for the next one to profit from the shiny new infrastructure.

I believe this is a stronger factor in countries that have a maximum amount of mandates per administration.

</comment></comment></comment></comment></comment><comment><USER50> _steals tibet_ _fucks it up with silver iodide_

<comment><USER51> Please don't do internet tropes here. They're bad for discussion quality. On HN the idea is to (a) have a substantive point to make and (b) make it thoughtfully.

[https://news.ycombinator.com/newsguidelines.html](https://news.ycombinator.com/newsguidelines.html)

</comment></comment><comment><USER52> MIT figured out fusion this month, water shortages are on the verge of being solved since water is not scarce, just dirty/salty - it's an energy problem.

<comment><USER53> I think the recent 200GW solar power deal between Saudi Arabia and SoftBank has more potential to solve desalination problems than Fusion (at least over the medium term).

<comment><USER52> That too, although solar still has relatively high costs per watt. Fusion can make energy nearly free.

<comment><USER54> No, fusion wont make energy nearly free.

Let's pretend a fusion plant is completely free to build, maintain, operate, and decommission.

50% of the cost of electricity is from transmission and distribution. Those costs aren't going anywhere.

So at most, you'll get a 50% savings. But you're not getting that either, because that fusion plant definitely wont be free.

<comment><USER55> For the purported usage (desalination) distribution is not an issue. But obviously fusion generated electricity won't be free, though marginal cost of production may approach that (if it ever becomes a reality).

<comment><USER53> But for AC, you have both distribution and variable demand. Not sure how easy fusion plants will be able to react to demand. If they're like nuclear plants, you'll need a sizeable amount of peaker capacity as well (not that solar wouldn't need that).

</comment></comment></comment></comment></comment></comment><comment><USER56> This is total conspiracy theory stuff and I'll probably get downvoted into oblivion but has anyone else in London found it really strange on how on the day of the Brexit referendum - we had these sudden overnight thunderstorms which resulted in many roads being flooded, polling stations being inaccessible and huge delays / suspensions of the Tube? Just a coincidence and bad luck?

* [http://uk.businessinsider.com/polls-open-britain-eu-referend...](http://uk.businessinsider.com/polls-open-britain-eu-referendum-london-weather-2016-6)

* [https://www.washingtonpost.com/news/worldviews/wp/2016/06/22...](https://www.washingtonpost.com/news/worldviews/wp/2016/06/22/brexit-heavy-rain-with-a-chance-of-leaving-the-e-u/?utm_term=.bcafd7f1b002)

* [https://www.mirror.co.uk/news/uk-news/uk-weather-commuters-u...](https://www.mirror.co.uk/news/uk-news/uk-weather-commuters-urged-go-8262824)

The next morning it all cleared away and it was a beautiful sunny day to the point where even Nigel Farage had to make a comment / joke about it [[https://www.youtube.com/watch?v=sLCb1cGROAw](https://www.youtube.com/watch?v=sLCb1cGROAw)].

If localized rain-making on a massive scale like this is possible, I wonder if it was used to manipulate the referendum by whoever might be interested in that.

<comment><USER57> Rain coming down over London is really strange and noteworthy.

<comment><USER56> > The issues were caused after the South East was struck by a massive > thunderstorm, which saw a month's worth of rain fall in an hour, in the > early hours of EU referendum day.

I've lived in London for a while, it was definitely not your usual bit of rain.</comment></comment></comment>


A list of Apple phone support numbers around the world - <AUTHOR> https://support.apple.com/en-us/HT201232 <comment><AUTHOR> This page is hidden deep on the Apple website... purposely.</comment>


U.S. Starter Homes Are Scarcer, Pricier, Smaller and More Run-Down - <AUTHOR> https://www.bloomberg.com/news/articles/2018-03-21/u-s-starter-homes-are-pricier-smaller-older-and-scarcer <comment><USER2> With the price of even the cheapest housing and the price of medical care going to extreme highs in America, increasingly Americans can no longer afford to live in America.

That is an astounding situation, and the people and their politicians are still hiding from that truth.

We are living in a split society where some people are grandfathered into the economy and others may never get a chance to enter it. I worry that we are headed for a catastrophic collapse as the grandfathered generations die off and there is no one who can take there place.</comment>


Show HN: Branch Deepviews – Autogenerated app content previews with deep links - <AUTHOR> https://branch.io/deepviews/

<comment><AUTHOR> We started as app developers ourselves set to fix the problems we were facing building our own app, and the ability to surface content was our biggest challenge.

You've know the problem - generic interstitials that prohibit people from using the mobile website with the intention of driving an app install. A user clicks on a link and is taken to a full page advertisement for the app. It's basically the worst.

Thousands of apps use Branch deep linking to route users to the right page after they install the app. We wanted to take this to the next level and give app developers the ability to route users to the right page before they install. What started out as a suggestion from a few developers in the Branch community has turned into a full-fledged product offering.

Branch Deepviews are previews of your native app content that are:

\- dynamically created \- automatically formatted \- fully customizable \- desktop or mobile web compatible

Every Deepview comes loaded with a download call-to-action (CTA), powered by a deferred deep link, that will route users to the App Store and give them a personalized post-install experience. If a user already has the app, the Deepview will not be shown and the user will be taken directly to the content in the app after they click on the link. Moreover, because now every piece of content in your app has a webpage, we automatically add Apple Universal Link tags as well as Google App Indexing tags, Facebook AppLinks tags, making your app content discoverable.

Let us know what you think. Don't hold back.

</comment><comment><USER2> Very cool. Having made mobile splash pages in this past, pretty sure this will save a ton of time on projects going forward.

Is there a way to customize the site? I want to maintain a consistent UI/UX.

<comment><AUTHOR> Hi Charlie, yep. Right now we have three templates you can choose from, but they are all open source so you can create your own. Happy to help you with that if you contact us at email@example.com

</comment></comment><comment><USER3> How will this work with iOS 9's deep linking functionality?

<comment><AUTHOR> Hi jreed91, our links already support/work with iOS9. Deepviews have Apple Universal link tags embedded in them by default.</comment></comment>


Strange Bedfellows: Finding Success by Reaching Outside Your Discipline - <AUTHOR> http://www.druckerinstitute.com/monday/strange-bedfellows/ <comment><USER2> This is why I am doing a Supply Chain Management degree despite 30 years as a programmer and when ingot here my faculty said there's a likelihood I can do a paid PhD if I get a 1st.</comment>


A Book Lover Switches to the Kindle - <AUTHOR> http://bennesvig.com/post/5856162321/book-lover-switches-to-kindle

<comment><USER3> I know there are many who complain about things like the inability to copy and paste text and so forth, but I've not found that to be much of an issue.

In general I'm the type of guy who reads books but doesn't lend them out. Not that I wouldn't, mind you, but it just doesn't happen that much. And since my local Borders - my de facto place for getting computer/tech books - <USER2> last months, I'm happier than ever to be a Kindle user. (Even though I get the irony in this).

Physical books won't go away and ebooks are still evolving. I look forward to what the future of reading holds.</comment>


How do you keep a good work/life balance - <AUTHOR> I left my last job because of burnout but now after 2 years here I'm picking up the same bad habits, checking email and doing extra work on weekends. I know one of the triggers was getting a work laptop, which I now use as my primary computer. How do you keep a balance between life and work? <comment><USER2> If you can leave your laptop at work; otherwise keep it turned off when you get home and use a separate computer for personal stuff.

If work needs you I'm sure they can get a hold of you besides emailing you.

With that said I think your "bad habits", as you call them, might be more of a symptom rather than the problem. If you are interested, I would like to talk to you more about your experiences with burnout. You can reach me at firstname.lastname@example.com

</comment><comment><USER3> I've always felt that making sure that you keep your work tools and your play tools separate helps with keeping track of what you are supposed to do.

Also if you can leave the work phone and computer at work and don't sync the mail home.

Basically I am a firm beliver of the idea that I need roadblocks to stop myself from falling into bad behavior.

</comment><comment><USER4> I make sure to seperate work and home life as much as possible. Basically my wife and I commute to home and work together almost every day. So we do our "work debrief" almost every time we drive home. This is nice because it gets all that stuff out of the way when we are in the car. I make sure that my work device stays put away or on the charger and I don't check it. It's hard to do but I find that I am happier when I don't check it. But you also need something to fill your time to get your mind off of work, so a hobby/family/friends would also be advisable.

</comment><comment><USER5> Separate computer / phone for work.

I may check e-mail off hours from time to time, but I never reply. I don't ever check on vacation.

I eat lunch away from my desk 99% of the time.</comment>


Feed2mail - real-time feed notifications (email)  - <AUTHOR> http://www.feed2mail.com

<comment><USER2> That's, historically, a pretty interesting reversal - I'm pretty sure I went for RSS (back in the dawn of time around 2000) to avoid the flood of e-mail news/newsletters, and for faster notifications (back then). Ah, the Wheel of Life indeed: <http://catb.org/jargon/html/W/wheel-of-reincarnation.html>

<comment><AUTHOR> Well, I found myself flooded with feeds. That was the idea behind feed2mail - get the important stuff by mail. You are right, this is a pretty interesting reversal.

</comment></comment><comment><USER3> An odd idea.

I have "some" feeds and getting those emailed to me would suck, unless I went back to using a real email client. And even then, it'd be pretty lousy.</comment>


Show HN:I had to redesign this landing page. - <AUTHOR> Https://www.colorsandfonts.com <comment><USER2> The landing page doesnt have any links or interaction. You have to press the menu to see the options.

<comment><AUTHOR> Still? It should have been fixed. It works for me.

A user reported it worked on firefox.

Thank you so much.</comment></comment>


Why the stock market must go down - <AUTHOR> https://thereformedbroker.com/2019/08/05/why-the-stock-market-must-go-down/ <comment><USER2> I'm not sure I follow the purpose of the... fable? at the end.</comment>


Riots are destructive, but can lead to social reforms - <AUTHOR> http://www.vox.com/2015/4/30/8518681/protests-riots-work <comment><USER2> I feel the idea of riots is to say "Hey neofeudal overlords, this is over the line. Get you dogs to behave, or the city you own will burn down."

Of course it will not make the moderates agree. But the moderates were okay with people being tortured or murdered by police for fun.

</comment><comment><USER3> I don't understand why people are defending property destruction and looting. The whole point of a democracy is disagreements are solved peacefully without resorting to violence. Intellectually defending this behaviour is helping to encourage it and the people defending this behaviour should be ashamed.

<comment><USER4> > The whole point of a democracy is disagreements are solved peacefully > without resorting to violence.

Your little country would still be a British colony of peasants and slave holders.

<comment><USER5> In India, peaceful, nonviolent resistance got rid of the British.

<comment><USER6> This is largely a myth. Gandhi would have been ineffective without an implicit threat of violence behind him, and pissed off a lot of more activist people for taking undue credit.

</comment></comment></comment></comment><comment><USER7> While I hate that riots exist, it honestly makes me feel good that there is a group of people in the US that get angry enough with the system to get up and do something.

Every time I hear about protests and think about people standing outside the whitehouse all I can think of is how futile it is. Especially after Occupy Wallstreet where the media did it's hardest to discredit the entire movement.

<comment><USER8> The movement discredited itself by failing to organize any coherent goals. "why aren't bankers in jail" isn't a message, especially since the majority of the protesters couldn't come up with laws the bankers broke.

<comment><USER9> I want to agree with this, and I do agree with it, but the concept also scares me. It feels like rule-mongering, like winning on a technicality alone.

Occupy Wall Street failed to express any unified goals and demonstrated a lack of understanding of specific reasons why they felt grievance was justified. In many ways it was more of a mob and its message was lost.

But it's also difficult to claim that it does not represent a growing fear and pain felt by a fairly large number of people. An emotional plea if not a logical one. A representative government should have an ear to such things and the fact that it appears not to is about as clear a statement of purpose for OWS as I think history will ever have.

This is often the case with civil unrest of any kind. When a system for representing the needs of citizens fails to do so---whatever the reason---then by the notion that the powers of government are given by its citizenry it becomes important to create a message to show the extent and damage of this failure. There are a lot of ways to do this and people will find the ones that they feel might work. They might fail and pick methods which do not work (riots, e.g., which invite pollution of message, judgement, loss of support, and legitimate reason to oppose) and they might be forced into methods which are poor.

But I fear to live in a place where the government fails to hear these things for too long. Not individuals in government, either, but government.

Voting is not the only tool of civil will. It's supposed to be designed well enough to keep civil will from turning to less constructive tools, though.

<comment><USER8> But OWS wasn't representative of a very large portion of the population. That's the issue with not having a message. Other than acting as a way for people currently pissed off about something to get together, it provided no message for the broader population (e.g. baby boomers with collapsed retirement accounts, etc) to get behind. Every time I asked someone about OWS that wasn't an early twenties reddit user, they would just mention that they were the modern 'hippies protesting the system'.

Successful protests have leaders are not nearly as organic as they initially appear. OWS participants failed to realize this and instead sat around empathizing with each other.

<comment><USER9> I'm not claiming OWS was at all successful. I'm claiming that ignoring people complaining just because they fail to organize well is something of a warning sign.

</comment></comment></comment></comment></comment><comment><USER10> Completely agree with this. I don't think anyone truly _wants_ this to happen. The point is it may _have_ to happen, if people want to see serious change. If criminals take over the government and its power, how else can you take down down?

But some people don't even like protests because they "make them be late to work" or whatever, when they block traffic. Well guess what, the point of riots, protests and even strikes is to _inconvenience_ to the point where change _has_ to be made and demands listened to.

Otherwise if you just go and protest on a mountain, like the Tibetans do, nothing will ever change since you won't be inconveniencing anyone in the slightest.

<comment><USER11> Yeah, but for most people(me included), if the rioters make me late for work I am angry at them,not at the government. Therefore I am more likely to support any effort to get rid of them as a nuisance.

<comment><USER12> _" if the rioters make me late for work I am angry at them,not at the government"_

Then, you were never on their side, anyway, and it makes no difference who you're angry at.

The protesters are making it very clear who they're angry at, and making it clear they're willing to escalate in the interest of altering the status quo, even if it costs them more than it costs those in power (and it always does). That's what desperation looks like.

I'm personally uncomfortable with the status quo, if the status quo has large segments of people who feel so unheard that they have to riot to get media, to get the attention of those in power, to have any sort of voice at all. Whether I agree with the tactics, or not, I recognize how much this means to so many of my fellow Americans, and I recognize that means there's something really wrong, even if I don't personally feel it in my daily life.

In short: I don't like people getting hurt. I don't like people going to jail. I don't like random acts of destruction. But, even moreso, I don't like my country stepping on the throats of ~13% of the population to maintain the privilege of a few. So, I'm gonna go to the events in my city in solidarity with the folks in Baltimore. Just like I went to the solidarity events for Michael Brown and Eric Garner. And, I'll go to the events for Larry Jackson, an unarmed black man who was gunned down by an Austin police officer, despite having committed no crime (in a rare instance of sanity, the officer has been indicted on a manslaughter charge). I'm a white, middle class, male. I don't necessarily understand all of this...but, I know I can't tell an oppressed person how to respond to their oppression.

<comment><USER13> > I know I can't tell an oppressed person how to respond to their oppression.

Actually, it sounds like you understand it quite well.

</comment></comment></comment></comment><comment><USER14> I'm left puzzled after reading this. So riots can be effective, but the response to the last riots sowed the seeds that led to these riots. Doesn't that imply rioting is indeed a bad way of making positive change?

<comment><USER15> > Doesn't that imply rioting is indeed a bad way of making positive change?

No. Nothing changed since the last riots systemically, so of course there are more riots. We are now however raising public awareness of previously unheard injustices, and by doing so (hopefully, if our system works correctly), inducing positive change.

Riots are happening because people literally don't know what else to do. The system has failed them. The system has decided it's OK for white cops to kill and imprison and mistreat black men en masse. Very public trials aren't yielding change, poor blacks continue to be terrorized, prejudiced tickets and arrests further amplify vicious cycles of poverty. Riots are acts of desperation that get a lot of attention (for better or for worse, depends on the system, many variables are unknown).

When the system moves in response (to correct in injustice at hand) that is when the riots will stop.

(Unfortunately that means either oppression will reign or true social change will be effected.)</comment></comment>


Xmarks shutting down in Jan - <AUTHOR> http://blog.xmarks.com/

<comment><USER2> This is absolutely driving me nuts.. they have 2 million users, steady growth, and not only can they not figure out how to make any money- they have never, in the history of the company, tried _anything_ that would bring money in the door.

In five minutes I can think of a dozen awful ways that would bring some cash flowing in. They aren't even going to try? Anything?

Even if they just said, "OK, xmarks is now $50 / month", and half of their userbase tells them to fuck off, that's still... 50 million a month in income. Even if 90% of their userbase tells them to fuck off, that's uh.. 10 million in the door?

Show ads? A donation widget? How can you be so brainwashed by the VC model that you don't even try to do anything?!

</comment><comment><USER3> No ads on the homepage, but I see there are on the subpages. Almost 19000 backlinks and pagerank 7. Should be possible to make some money on this.</comment>


ELife Lens a Backbone.js powered viewer for research articles. - <AUTHOR> http://lens.elifesciences.org/#about/

<comment><AUTHOR> We have launched this as an experimental viewer for research articles. We convert NLM xml to a custom JSON format, and save these JSON vserions of the articles on an s3 bucket. The web app then displays the article. You can read about the tool <http://www.elifesciences.org/lens/>.</comment>


Ask HN: Law about X (i.e. Conway, Moore's, etc.) - <AUTHOR> Is there a ~Law~ which says something like the following: No entity can be created that is more complex than the entity that creates it.<p>I bumped into a video of F. V. Hayek, and his whole argument hinges on that -- 'was wondering if there was a namespace for that idea. <comment><USER2> There's something similar in Gall's Law:

"A complex system that works is invariably found to have evolved from a simple system that worked. A complex system designed from scratch never works and cannot be patched up to make it work. You have to start over with a working simple system."

[https://en.wikipedia.org/wiki/John_Gall_(author)#Gall.27s_la...](https://en.wikipedia.org/wiki/John_Gall_\(author\)#Gall.27s_law)

I've never heard of the quote as stated, though. I don't believe it to be true: much of what we know about life and evolution would be impossible if so, since we were all "created" from bacteria.</comment>


The Consul outage that never happened - <AUTHOR> https://about.gitlab.com/blog/2019/11/08/the-consul-outage-that-never-happened/ <comment><USER2> > There is just no substitute for understanding how everything works.

Great line, and one I strongly agree with. I love the tooling we have available today like Terraform, Ansible, etc. but the experience I gained by keeping bare metal servers alive and happy with nothing more than a shell has undoubtedly made me a much better admin.

<comment><USER3> Agree 100%. I'm an SRE team of one and I'm looking for an additional team member. I've interviewed about a dozen people so far and one thing I've noticed is that a lot of young engineers do not know the basics. They really can't tell me how to log into a Linux box and troubleshoot. I think that's a shame. You really lose a lot of insight if you don't understand how the underlying pieces work.

<comment><USER4> Even worse I joined a new company in a senior technical role and it's seen as a negative that I prefer ssh/strace/tcpdump to debug problems.

<comment><USER5> It arguably is.

A good SRE needs to understand systems, as in automation of n computers. Focusing on and prefering single system tools where you have to take manual action points to an immaturity in dealing with complex distributed systems.

However, it's a common problem and most of the folks buying complicated distributed tracing systems don't have particular skills in using them either, so your skills are valuable, even if there could be better ways to do it.

Similarly if you focus on hiring SREs who know shell commands well, you might lose more pertinent skills such as knowing what terraform is actually doing, general programming skills, CI/CD and an understanding of cloud APIs.

Horses for courses; the more we know the better. Look for both sets of skills in your teams and cross train as much as possible.

<comment><USER4> Arguably those who demonstrate understanding of low level fundamentals have the drive to understand as many layers as possible.

Capturing AWS API calls through sslproxy not only implies you know what terraform is doing but you also have a higher probability of solving difficult problems.

All code boils down to an execution layer and having inspection ability at that layer will always be valuable.

</comment></comment></comment></comment></comment><comment><USER6> This was a fascinating read but I feel like I'm left with some more questions about what's going on under the hood in gitlab cloud:

1\. I thought gitlab was hosted in google cloud, but there's a lot of references to e.g., a hand rolled consensus system and self-managed database clusters. I'm wondering if this event changes the math on build vs. buy at all for gitlab, sounds like a lot of money has gone into this solution. How did that solution come up, is it about some specific Postgres features that aren't available in googles hosted dbs or pricing?

2\. Again on the google cloud angle, why are servers being hand-managed and rebooted? Elasticity in the cloud would make me think that the safest option would be to stand up parallel infrastructure (like in a DR plan) and migrate traffic. Was this just about speed of solution rollout? Does gitlab have plans to harden DR plans so that you can execute in cases like this? Whenever someone says they're "in the cloud" and yet unable to treat servers like cattle, I get a bit worried.

<comment><USER7> 1\. The consensus system you are talking about is Raft ([https://raft.github.io/](https://raft.github.io/)) and it's baked into Consul.

2\. There are two ways to interpret parallel infrastructure. I will post my thoughts on both. 2a. Standing up a parallel Consul cluster. This is problematic because typically what people do with Consul is to put a Consul agent on every server (or pod) which registers its services for discovery to the Consul servers. When you make a parallel Consul cluster you need to also restart the Consul agents on every other service. They only mention Postgres in this blog post but there can potentially be a LOT of other servers registered to the Consul cluster. 2b. Standing up everything it takes to run Gitlab in parallel and then diverting traffic. Honestly sounds great. The reason a team wouldn't do this is due to either a) not having infrastructure code which allows for one-click deployment of whatever it takes to have Gitlab running. or b) it's actually pretty expensive to do if you're not Google or Amazon. The blog post mentions 255 clients (and 5 Consul servers). That's a lot of servers to rebuild!

Now, I would love to hear from anyone else who uses Consul, because I have my own thoughts on how they decided to handle the issue. I will focus my attention entirely on the Consul and not the Postgres portion.

The blog post mentions two limitations: 1) Reloading the configuration of the running service, which worked fine and did not drop connections, but the certificate settings are not included in the reloadable settings for our version of Consul. 2) Simultaneous restarts of various services, which worked, but our tools wouldn't allow us to do that with ALL of the nodes at once.

We don't need to reload. We can run a rolling systemctl restart whicn ansible is perfect for. The nice thing about this is that their stop-gap solution is to disable TLS verification. This means that servers with TLS verification ON in the meantime should be able to continue validating certs while other servers can have a rolling restart that disables TLS verification one server at a time. If we want to minimize downtime we would do every non-leader server in the cluster, then finally the leader, then every client in a serial manner. With 260 servers to deal with it would be slow but it shouldn't break Raft at any point. There is no reason for quorum to be broken. The gossip will still be communicated over TLS, just that some of the servers/clients wouldn't be validating the certs.

Then, we would follow exactly the same process for rolling out valid certificates with TLS validation turned back on. One non-leader server at a time, then the leader, then every client.

I could be missing some critical piece here, and it looks like the Gitlab team did run a lab test before making their change in prod. It's easy to miss a possibility when under pressure, and also easy for an online commentator like myself to think they are so much smarter. They still managed to get out of the crisis with no downtime and congrats to the operators who pulled it off!

<comment><USER8> I think what you are missing is that validating servers/clients would not allow non-validating servers to rejoin the cluster (i.e.: servers/clients with validation enabled will validate both outgoing _and_ incoming connections).

As I see it, by the time you restart the leader (and hence quorum switches to the non-validating portion of the cluster) _all_ of your clients will suddenly fail (they are still validating, and there's no good server for them to connect to). Conversely, if you restarted the clients first they would all become unavailable before the quorum switch happened.

</comment></comment></comment><comment><USER9> > After looking everywhere, and asking everyone on the team, we got the > definitive answer that the CA key we created a year ago for this self-signed > certificate had been lost.

The GitLab outages always make the company seem disorganized and sloppy, and unable to reflect on how to improve how they work. So they don't have a central place to store their CA, and even after an outage, did they improve anything about how they work?

It's ironic that the post seems geared towards recruiting, though I guess it's honest, you know what you're getting into with that team.

<comment><USER10> It would guess that the root cause for most outages that have a human factor is disorganization and sloppiness because if that wasn't the case there wouldn't be an outage.

It's interesting to me that GitLab are so public and honest. I don't think that appeals to everyone, but it is a unique selling point to some.

<comment><USER11> Being public and honest is always cited when this happens to Gitlab. Which I can say because my fragile memory recalls a number of incidents. This should be alarming but apparently their psy ops is better than their dev ops because we all react with fondness and awe. Maybe I should do more of _that_ at work!

<comment><USER12> I think that is because HN has a lot of people who knows first hand that very few places are free of these kind of issues.

In 25+ years of working in tech, I can honestly say I've never worked _anywhere_ where there haven't been one or more serious issues where one or more parts of the cause was something everyone _knew_ was a bad idea, but that slipped because of time constraints, or a mistaken belief it'd get fixed before it'd come back and bite people.

That's ranged from 5 people startups to 10,000 people companies.

Most of the time customers _and_ people in the company outside of the immediate team only gets a very sanitized version of what happened, so it's easy to assume it doesn't happen very often.

Gitlab doesn't seem like the best ever at operating these services, but they also doesn't look any worse than average to me; which is in itself an achievement, as most of the best companies in this respect tends to be companies with more resources and that have had a lot more time to run into and fix more issues. For a company their age, they seem to be doing fairly well to me.

<comment><USER9> So they went off and implemented a brand new fancy service discovery tool for I bet a problem they didn't have, but couldn't do the basics of tracking 2kb of data for the CA. I don't think that's a age issues, that and there's nothing that prevents companies of any size from self reflection on what they're doing and what's important.

Also what's the point of transparency if you're not getting critical feedback from it and learning?

</comment></comment></comment></comment></comment><comment><USER13> > It is maintained by the Infrastructure group, which currently consists of 20 > to 24 engineers (depending on how you count)

20 if you count in Base-12 and 24 if you count in Base-10?

</comment><comment><USER14> It blows my mind they didn't have sane PKI with that many resources. It seems like even the "small" initial team of a couple devs, a manager, _and a director_ would've at least spun up a vault instance to use as a CA.

Also, easy for me say from the peanut gallery, but don't understand why they couldn't have done rolling consul restarts to update the configs, I've done this many times on consul clusters.

<comment><USER15> > It blows my mind they didn't have sane PKI with that many resources. It > seems like even the "small" initial team of a couple devs, a manager, and a > director would've at least spun up a vault instance to use as a CA.

Not mine. Inhouse CA management is a true PITA, even multiple-thousand-people companies regularly fuck this up. I have experienced hours of outage because someone failed to renew the certificate for one of the thousands of pieces making up a Cisco network environment, and don't get me started on the drama that is root CA certificate rollover, experienced this in three companies and nowhere it was painless...

<comment><USER16> I have seen this more than a couple times, at big places with resources to manage it. Is it just me or does the TLS and PKI tooling just seem weak? I keep thinking there should be some badass tool that helps manage this sort of thing, is there something I don't know about?

<comment><USER15> It's not just the tooling that's weak, it's also terminology and education. If you're not dabbling in crypto occasionally, half the OpenSSL manual and 100% of its codebase will be like hieroglyphs... leading to the fact that most organizations put the operation of their PKI to the one person who can successfully manage to get a working HTTPS cert after copypasting shit from Stackoverflow and wrangling with the validation tool of their certificate vendor.

What also really bothers me is that there is no way that (assuming I own the domain example.com) I can not get a certificate that allows me to sign resources below example.com and that are verifiable by clients without messing around with the system root trust store - and then, many pieces of software carry their OWN trust store totally independent from the OS one (especially Java, it's a true pain in the ass every two years to update that keystore so that LDAPS works again)...

</comment></comment></comment></comment><comment><USER17> Consul issues have bitten me at two companies, and I heard word of it being the culprit for some serious outages elsewhere. One possible takeaway here is to remove it.

<comment><USER18> The worst outages will always be those involving core infrastructure.

<comment><USER19> Consul seems to be more prone to issues than one would hope though. Imo the feature set is not worth the increased complexity and operational burden. There are simpler ways of handling service discovery and configuration without running your own consensus based cluster.

<comment><USER8> Genuine question: can you explain a couple of these simpler ways please?

<comment><USER18> Central authorities are typically simpler than gossip and consensus systems. They have failure modes too, of course, but those failure modes are better understood and potentially easier to manage.

Sometimes you can't avoid the need for distributed consensus, but you can box it inside a well defined abstraction like leader election, and then do everything else in a traditional client-server way.

</comment></comment></comment></comment></comment><comment><USER20> If they were going through all this trouble and worry why not create a new CA and drop the crrts from it on the hosts? That's the work of just a few minutes (plus some bash scripting to mass generate your host certs). If they had already accepted that they were going to restart the services on all the hosts anyway it would have saved them having to restart all the services again in the future when they need to drop more certs.

<comment><USER21> Yeah I was really wondering why they didn't just add a new CA. It would be really weird if something as critical as consul was one the few program in the world that only accept a single root certificate.

</comment></comment><comment><USER22> Maybe I am saying something stupid, but infrastructure services should be able to use a dynamic set of keys.

If the first doesn't work, you try the second, and then the third and so so.

Similarly the clients, we should be able to dynamically adds certificate.

Our own key expires and our services are all about to drop connection seems something that should not happen.</comment>


American Schools Are Training Kids for a World That Doesn't Exist - <AUTHOR> http://www.wired.com/2014/10/on-learning-by-doing/

<comment><USER2> Isn't this mostly an ad for Maker classes?</comment>


GitHub for Windows? - <AUTHOR> http://exupero.tumblr.com/post/13921543341/github-for-windows

<comment><USER2> I'd be happy with a native git client on Windows that is more integrated with the system. I use msysgit at work and it certainly works, but at best it feels like a kludge.

</comment><comment><AUTHOR> Phil mentions as much in his post: "This might include...working on a Windows client for GitHub"</comment>


Mageia – A New Linux Distribution, forked from Mandriva Linux - <AUTHOR> http://mageia.org/

<comment><USER2> I don't understand why peopole rush to create yet another linux distribution, while what the linux world really need is a nice desktop. I mean, look at the number of linux distros out there, and look at the desktop options you have: only two or three "OK" ones: GNOME, KDE and XFCE... all a distribution does is assemble "tools" to get a working operating system, wich is useless if you are going to assemble the same tools and use the same desktop environments. Go fork GTK instead. Build YABCDE (yet another but cooler desktop environment)</comment>


Threes: The Rip-offs - <AUTHOR> http://www.marco.org/2014/03/28/threes-ripoffs <comment><USER2> _Once your product is perceived as a generic category and competitors start rushing in, the value of original innovation is lost._

Bullshit. There's no way that Marco and everyone else in this situation doesn't leverage being the person(s) who created an entirely new genre when promoting their next project. 'Inventor of the [product category]' is about the most powerful personal branding you could ask for. This blog post is itself a brand-building exercise.</comment>


Ask HN: What are your favorite blogs/books, and why? - <AUTHOR> <comment><USER2> This is vague. Are you asking for favorite tech-specific books and blogs?</comment>