WTF is a container? - <AUTHOR> https://techcrunch.com/2016/10/16/wtf-is-a-container/ <comment><USER3> I remember going to AWS Reinvent last year and having some beers with a bunch of people who did devops. We started talking about tools, and they were utterly flabbergasted, that we had not embraced docker. They went on an on about how simple docker made HA, and handling fail overs/maintenance. More or less made it seem like it was the greatest thing since sliced bread.

Me and a few coworkers decided to try and dockerize some of our serivces, and move our staging ES cluster to docker.

For the most part building our own containers was easy enough, for the various services. The biggest issue we had was with Elasticsearch, since we have 4 types of nodes. So we ended up building 4 specialized containers for each node type.

Then came the issues:

* Making containers work together, for example we use a logging agent, we decided to make that its own container. Then actually getting a way to share a log directory with the agent, was very painful and unclear. (Honestly the single most frustrating thing i recall was asking for advice in irc and more or less being told i am doing it wrong)

* Containers would randomly crash under load exiting with error 137 out of memory. Apparently a few of our services would randomly leak memory, but only when running inside a docker container vs ubuntu 14.04. (I never figured this out)

* Containers would randomly become unreachable, forcing me to kill them and restart them.

* Random hanging issues, suddenly docker exec is hanging. Being told to revert to an older version, or install a newer version is tiring and makes my environment very inconsistent.

* Trying to debug why our app in the container isn't working is not fun at all.

However the single part that killed me was, i was chatting with one of the people who i met at Reinvent, and i mentioned my issues. He acted like it was completely normal for these kinds of issues.

After a solid 2 weeks of random issues and the constant barrage of pagerduty alerts, i just rolled everything back to static EC2 instances for staging, and have ran into 0 issues. I want to try containers again because i want them to work, but i have just had too many issues.

<comment><USER4> flabbergasted? Wow this is a new word for me, I have never heard of it. When i first read it in my mind I thought it was a Spanish Football player that used to play for Arsenal, Then Barcelona, and now Chelsea. LoL

Is this word even used anywhere else beyond US? Never heard it used in the UK.

<comment><USER5> I'm from the UK and I hear "flabbergasted" reasonably often, more often from upper-middle class folks. Maybe a regional thing?

<comment><USER6> more of an age thing? I use it but I doubt my daughter ever does

</comment></comment></comment></comment><comment><USER7> I agree that containers (both for shipping and servers) are a great idea. And because I'm tired of always configuring servers, I decided to give it a try some time ago.

I wrapped my IRC client (weechat + glowing-bear) in a Docker container. Oh, not a container though, because I also needed https, which meant I needed either a mechanism to build and update letsencrypt certs in the weird format that weechat expects, or to run an nginx instance in the front (and also somehow get the certs, but that's easier with nginx). So two containers.

And even though there was a ready-made nginx+letsencrypt https reverse proxy container (actually several), I had a huge amount of headaches to get it actually working. Even with the system set up, I occasionally have the container crash with exit status 137 (IIRC), which I've assumed might be because weechat leaks/consumes memory and eventually the host server kernel kills the process. Maybe.

So in my limited experience, comparing Docker containers to shipping containers is a gross simplification. Shipping containers are simple constructions requiring well-defined simple maintenance, while Docker containers seem to be complex thingamabobs that have multiple points of failure.

<comment><USER8> Docker is a poorly engineered and over-hyped technology.

The concept is great - and in fact, many companies have built great tooling around Linux cgroups. It lets you efficiently binpack applications on a single server - which is why 'containers' were created in the first place.

The side benefit of letting you define your OS libraries, and other things, is a nice bonus, and way overblown in my opinion.

Docker and its tooling is just plain bad. It's so bloody unstable, unless you pick some esoteric combination of versions and storage backends (old docker + old aufs + old ubuntu seems to do the trick) - and even then, you'll run into problems. Documentation won't help you here - it's trial and error.

The docker group seems focused on feature, feature, feature, while the basic stability and performance remains poor. It's quite amazing how they get it so wrong. Browse through the github issues for performance and hanging issues. The surrounding tooling is poor as well - registry v2 doesn't even support deletes (because they need to maintain compatibility with the 100000 different storage backends for it). There is no LTS release, bug fixes only happen in latest version, so you're in a constant state of brokenness. And so on.

<comment><USER9> The concept is great but it's also not original. It's called "processes". Docker is little more than a mass of complication laid atop fork+exec.

That's why nobody can get it right - because we already did.

<comment><USER10> How is "your own network, your own view of the file system, your own view of the process table, your own view of the user IDs, ..." the same as "processes"?

<comment><USER11> On modern Linux distros every process is running in a cgroup and namespace by default. So these days the main difference between a "container" and a regular process is that regular processes are all jumbled together in the same root namespace, and containers are in separate namespaces.

<comment><USER10> Which Linux distributions do this? I'd like to read how "most" instances of fork and exec end up with unique networks and file system namespaces.

<comment><USER11> I didn't say unique, I said "jumbled together".

Now as far as which distros put processes in a namespace and cgroup by default, I know at least CentOS 7 and Ubuntu 15 do this. And those two distros on their own would qualify for "most".

To check if your distro does it, one way of checking is just doing a `cat /proc/1/cgroup`. This will show you what cgroups process 1 is in. By default you will be in the "root" cgroup.

To check your namespaces, `ls -l /proc/1/ns/`. You'll see the process is in some randomly generated namespace ID per item.

I'm sure you could recompile your kernel to disable this behavior, but the default reality of modern Linux is that everything is already running in a "container".

Now the question is whether or not people want to take advantage of that reality, and separate out processes in isolation, or keep running everything on a system in such a way that any single process can impact the whole system.

</comment></comment></comment></comment></comment></comment></comment><comment><USER12> I never quite understood containers and this article makes them seem kind of similar to what OSs already do.

How is a container different from just installing all the dependencies along with an application? Coming from a Windows background, this is pretty common to avoid DLL hell. Nobody distributes a Windows application that requires the user to go and install some 3rd party library before it'll work.

Isolation from each other seemed like one advantage, but that's not even security strength isolation so you can't count on it to protect the host OS from malware in a container.

A claim I often see, and that's repeated here, is that containers can run anywhere. But can they really run in any more places than an ordinary application with dependencies included, or even statically compiled into it? You still need Linux and the same CPU architecture, right?

<comment><USER13> > How is a container different from just installing all the dependencies along > with an application?

Once the image is built, you can get another installation that is guaranteed to be identical. You can do that with VM images too, but you can not reasonably do that if you try to install multiple applications side by side in a single VM without further isolation - there are too many ways they can interact.

> Isolation from each other seemed like one advantage, but that's not even > security strength isolation so you can't count on it to protect the host OS > from malware in a container.

That's only true to the extent that they don't have a long enough track record. Many container technologies do have a decent track record when it comes to security.

But even so there are plenty of reasons for isolation in cases where the security requirements are not the primary reason for further isolation. E.g. making it impossible for an app to accidentally reading/writing files it shouldn't is in itself helpful.

> A claim I often see, and that's repeated here, is that containers can run > anywhere. But can they really run in any more places than an ordinary > application with dependencies included, or even statically compiled into it? > You still need Linux and the same CPU architecture, right?

Try to get an application - statically compiled or not - to run across different Linux distributions, and you will see why this matters.

Needing Linux and the same CPU architecture isn't much of a limiting factor on servers. Being able to not having to account for distribution peculiarities or version differences is a big deal.

<comment><USER14> > Try to get an application - statically compiled or not - to run across > different Linux distributions, and you will see why this matters.

Done. A statically compiled application has no other dependencies.

<comment><USER13> Does it never do DNS lookups? Open files? Do you not want to tie into process management? Logging? Do you really have no dependencies on a functioning locale? Network settings? Are you sure it won't try to exec anything?

An application with no other dependencies is exceedingly rare. Small tools, sure. Sometimes. But even then I see people making silly assumptions all the time, which makes using a container as a suitable straightjacket very useful.

E.g. I run all kinds of tools "with no other dependencies" all the time, that turns out to have all kinds of dependencies when you actually try to put it in the smallest container possible.

<comment><USER14> > Does it never do DNS lookups?

Yes, it does.

> Open files?

Yes, it does.

> Do you not want to tie into process management?

I don't know what this means.

> Logging?

Yes.

> Do you really have no dependencies on a functioning locale?

What makes a locale "function"?

\---

Remember that the my standard C lib or whatever can be statically linked as well. At that point, I'm left with syscalls.

Docker containers depend on syscalls too; it's not like they ship with their own kernel. (If they did, they'd be VMs.)

</comment></comment></comment></comment></comment><comment><USER15> Weak virtualization often lacking security, resource metering/prioritizing/quotas. Hurray, zombie Docker instances needs a whole VM reboot yet again, still not fixed in several years. But look how fast I can deploy millions of containers without SELinux, monitoring, HIDS, SDN, billing, live migration, backup/restore/DR/data lifecycling and all the other things we just pretend to ignore when throwing away sensible production VMs on Type 1 hypervisors devopsec.

<comment><USER16> The smart use of containers is using it to specify the deployment. You should use proper virtualization as the environment to deploy into. Because you use containers doesn't mean you throw all that away.

</comment></comment><comment><USER17> Containers are often touted is this novel concept that's bound to revolutionise software development and software delivery in particular.

The general idea isn't all that new however. Java Applications have been delivered as containers since 1995 (although the concept isn't explicitly named that way with Java applications).

Each JAR / WAR is a self-contained application that can run anywhere where there's a JVM (which is pretty much everywhere).

From a feature perspective the only real innovation of Docker-style containers probably is that those aren't limited to the JVM but are (largely) language- and runtime-agnostic.

<comment><USER18> > Each JAR / WAR is a self-contained application that can run anywhere where > there's a JVM (which is pretty much everywhere).

Jar could be self contained or it could depend on 100s of other jars so it is not as straightforward as one assume.

War required a Java application containers to be deployed which is outside a War not inside. Also J2EE deployments can get pretty complicated with its infamous XML usage for configuring anything.

JVM is not everywhere by default or work without config by default for non trivial application. It is complex software which can lead to myriad classpath/ version issues related to jar files if not installed very carefully.

<comment><USER19> Containers are like that as well. You can have a container for your application, that doesn't really do anything unless you can connect to your database which runs in another container.

</comment></comment></comment><comment><USER20> These hand-wavy explanations that constantly avoids explaining how things work at low level are not adequate.

Here's short explanation for developers even with moderate understanding of how OSes work:

[http://stackoverflow.com/questions/16047306/how-is-docker- di...](http://stackoverflow.com/questions/16047306/how-is-docker-different- from-a-normal-virtual-machine/34757096#34757096)

</comment><comment><USER21> This is a pretty good analogy for containers but there's an unfortunate conflation of terms. There's actually a distinction with computing containers between the thing that you ship code around as and the thing that you run code in. The latter is the real container while the prior is called a "container image" or often simply an "image." This gets confusing quick if you apply this analogy since you assume that the thing you ship the code as would naturally be called the container.

</comment><comment><USER22> It's amazing how slow the development community en masse has been in "discovering" containers. I remember I worked for web hosting company that offered containers as a web hosting solution back in 1999, I then ran my own little host offering FreeBSD jails and then Linux containers (based on the excellent Linux-VServer project) in 2003, and I do remember how when I tried to explain to (pretty technical) people how this is way more efficient than stuff like Xen they'd go "but it's a hypervisor..." (as if that meant "magic"). I eventually gave up on it and sold my little hosting operation because it was too much work and not enough money, it looks like it was about 10 years ahead of it's time.

<comment><USER23> I think the same, i've been deploying containers or things that look like today's containers for the past 12 years, i even did a tool that manages containers with lxc that really look like docker, but 3 years before.

<comment><USER24> There were many solutions very similar to Docker, but you have to agree that they made some essential things the right way - UnionFS (e.g. OverlayFS), standardized way of building containers (Dockerfiles) and the right timing.

</comment></comment></comment><comment><USER25> I'm only a beginner, but the analogy that makes sense to me is that containers do for app deployment what npm does for Javascript development. That is, the magical part isn't that Docker simulates an operating system and so on - <USER2> magic is that it allows a chunk of logic to precisely declare its dependencies - including on other pieces of logic which declare their own dependencies - and then Docker knows how to (in theory anyway) run the logic in such a way that its dependencies are all satisfied.

And of course the meta-magic is then that there's a public registry of (in theory) solved problems, which one can build on top of by declaring dependencies against them.

I have a pet theory that this "declared dependencies + dependency wrangler + public registry" is a general formula which will keep cropping up as we find new places to apply it.

<comment><USER26> Not really - Linux package management systems do exactly that.

The magic - if there is any - is to combine it all together; separation, discovery, relatively easy packaging and dependencies.

<comment><USER25> Sure, at a different level. Package managers at the app level, docker at the deployment level, npm at the development level, or something vaguely along those lines.

I wasn't suggesting this was unique to Docker - precisely the opposite, that it's a generally useful pattern, being applied here to deployment.

</comment></comment></comment><comment><USER27> for the love of god - forget docker, use lxc containers - its simple, secure, goes with its own init, cron, and you dont need to do somersaults to achieve simple tasks. Included with linux kernel. Your own isolated linux system. We use lxc in production for over three years, and we have over 3000 of them. No issues whatsoever.

<comment><USER28> You're right that LXC containers have a similar API compared to Docker, but I think developers often underestimate the benefit of the community around a certain technology.

Docker has significantly better documentation, extensions, package management tools, and third-party integrations. Overall, Docker has an incredibly more robust community than LXC or closer competitors like Kubernetes, and those features are just as important as the API for developers.

<comment><USER27> The point of the LXC is, you get a full blown standalone linux, rather than a single process - this simplifies everything a lot, meaning you don't have to have that much documentation about it in the first place.

<comment><USER29> Can you clarify what "full-blown standalone Linux" means? It sounds like running a separate kernel, but since we're talking containers rather than VMs, this can't be it.

<comment><USER30> It is shared kernel, separate userspace.

It uses: X-namespaces (network, pid, user, ...) and cgroups to separate those userspaces from each other.

I have community server running debian in which there are 10+ LXC containers running in which people are given normal root access, one container per user.

<comment><USER29> So it's the same as with Docker.

</comment></comment></comment></comment></comment></comment><comment><USER31> I guess I'll never get it. Don't most OSs already run processes isolated from each other, have advanced process scheduling mechanisms and manage access to hardware resources? Also with static linking nothing stops you from creating huge binaries that "will run anywhere".

<comment><USER32> From my perspective, where I'm planning a hosting service with multiple customers, containers promise to allow me to slice machines into dedicated chunks. VMs could do this too, but they'd consume far more disk-space, which would mean my hosting costs would be comparatively higher.

Containers promise to allow me to limit the resources each of my customers can consume without killing the entire box. For example, I can limit RAM, CPU and disk-space per customer. If one customer goes rogue, the shared box remains performant for my other customers. Also there's the data protection: in theory customers would not be able to access each others' data, even if they tried to.

There are other considerations as others here have pointed out. This is just my primary concern at the moment.

<comment><USER33> All of your requirements can be satisfied with properly configured VMs.

<comment><USER32> Including total disk space consumed on the host? I can't see how. Containers are by definition far lighter.

<comment><USER33> It depends on what you build into your containers. Your customers will need storage at some point, unless they're just using the containers as processing engines. You'd also be surprised at how lean you can built a VM with Linux (or one of the BSDs) as the OS.

</comment></comment></comment></comment></comment><comment><USER34> Docker is the best thing since sliced bread! VM is much more resource and time consuming.

# We switched our dev/stage env to containers 2 year ago.

# We have made our own standalone app in Docker style. Once again - Easy as pie.

if you are a developer you should add Docker + Docker Compose to you working tools.

<comment><USER35> We moved over to Docker at the development process some time ago and it really speed up our work.

</comment></comment><comment><USER36> > The way virtual machines work, however, is by packaging the operating system > and code together. The operating systems on the virtual machines believes > that it has a server to its own, but in reality, it's sharing the server > with a bunch of other virtual machines — all of which run their own > operating systems and don't know of each other. Underneath it all is the > host operating system that makes all of these guests believe they are the > most important thing in the world. You can see why this is a problem. The > guest virtual machines basically run on emulated servers, and that creates a > lot of overhead and slows things down (but in return, you could run lots of > different operating systems on the same server, too).

Wait a second. Isn't this the whole point of hardware virtualization support? So that hypervisors don't have all those VM overhead slowing things down?

</comment><comment><USER37> On VM's: "Underneath it all is the host operating system that makes all of these guests believe they are the most important thing in the world. You can see why this is a problem."

Two paragraphs later (On containers):

"The only operating system on the server is that one host operating system and the containers talk directly to it."

</comment><comment><USER38> This is not quite related to Docker/Kubernetes, but a phrase in the article triggered memories about a very good book that I think everyone should read - The Box by Marc Levinson. It really is a fascinating book.

<comment><USER39> Definitely "not quite", as it is about shipping containers, but an interesting read.

</comment></comment><comment><USER40> The reason people don't get the advantage of Docker is because there is a weird (and in my opinion stupid) tabboo against putting all of your deps in one container. This is about 10-100X easier than trying to compose a bunch of containers.

Not everyone can do that, but plenty of people could. Except they don't not because of some actual ops requirement (in many cases) but because they don't want someone to say they did it wrong.

I am assuming this situation has actually changed now I hope and swarm/compose or whatever is built in is not too hard to use?

<comment><USER41> no it's worse now. There's also all the PKI required compounding the pain and suffering.

Phusion baseimage-docker seems to help.

Worth nothing Atlassian stepped back and does scaleout approach using regular cloud instead of container orchestration technology. [https://www.atlassian.com/company/events/summit/2016/watch-s...](https://www.atlassian.com/company/events/summit/2016/watch- sessions/build-deploy/scaling-your-first-1000-containers-with-docker)

Also worth noting you can take away all the PKI and registry pain and have instant scaling with the registry by using cloud store for registry and having Jenkins gatekeeper be the only writer, all dev and production nodes use the same store only readonly.

</comment></comment><comment><USER42> > The promise behind software containers is essentially the same. Instead of > shipping around a full operating system and your software (and maybe the > software that your software depends on), you simply pack your code and its > dependencies into a container that can then run anywhere — and because they > are usually pretty small, you can pack lots of containers onto a single > computer.

Already got it wrong. Current containers are exactly the OS and the kitchen sink for running 'printf("hello world")'.

<comment><USER43> It's up to you to make your containers bloated or keep them slim. You can use the alpine versions of the official Dockerhub images. Python on Alpine is 30 MB (vs 267 MB for the debian one). [https://hub.docker.com/r/library/python/tags/](https://hub.docker.com/r/library/python/tags/)

You can create containers that are just a few MB with compiled languages like Go (5 MB). [https://www.iron.io/microcontainers-tiny-portable- containers...](https://www.iron.io/microcontainers-tiny-portable-containers/)

From the article: "Rather than starting with everything but the kitchen sink, start with the bare minimum and add dependencies on an as needed basis."

<comment><USER44> If your app is a compiled go binary (so, it runs anywhere) why do you _need_ a container?

The whole point of containerisation is to group installed dependencies (as opposed to _installable_ dependencies like with a regular deb or rpm package) and configuration into a 'black box'.

If your binary is already a single-file distribution, why lump it in with the crapfest that is docker?

<comment><USER45> If "you" here is one person and "your app" is one app, then yes, why do you need a container. If "you" is 200 developers, and "your app" is 75 different applications written in Java, Java plus native libs, .NET, python, the other python, R, scala, NodeJS, and various C libraries, then docker containers, and more importantly images, are about as ideal as it gets. We're running Mesos so we don't _have_ to use docker to get containers, but packaging up the products as images is a significant advantage.

<comment><USER44> Both the post I replied to and my post explicitly talk about a go app, nothing else.

</comment></comment></comment></comment></comment><comment><USER46> Plain and simple: containers violate the KISS principal. While you are developing reams of domain knowledge working with this turd of a technology, others are making progress with non-self-created problems that matter in the real world. This is another case of the tech world developing pointless tech that can be ignored by those solving concrete real world problems.

</comment><comment><USER47> Putting a little bit more thought into naming things can help newcomers understand these concepts more easily. The word container is too generic, why not call it an 'application jail' or a 'virtual operating system' ?

Another word that is over used in our field is 'context'.

<comment><USER48> They were called "jails" long before "containers" became a thing on HN. Somehow "jails" didn't stick, so I'd assume it was even more confusing for newcomers.

<comment><USER49> Jail had no marketing hook. It's a very negative word. I'd guess that's Probably the major reason.

<comment><USER50> Well that and it wasn't done by a VC backed firm with strong press connections.

</comment></comment></comment></comment><comment><USER51> Guys, you really want to give a look to hyper.sh, if you are frustrated with running containers in production.

</comment><comment><USER52> The analogy in the article is inferior.

Here comes the standard HN automobile analogy.

The car makers eternally release little light weight cars that are fattened up with cruft until they're as heavy and expensive and complicated as the dinosaurs they were originally meant to replace. At which time car makers birth a new little stripped down lightweight simple compact car line. That design pattern is self similar and fractal in that even car engines and transmissions and car radios undergo a similar pattern of revolution to make something new, then evolution to slowly and methodically make it the opposite of the original goal, repeat forever. This design pattern also applies to computer architecture.

To fight the problem of hardware evolution making life pretty hard on programmers, source code compatible OS and libraries were invented that could run the same software on vaguely similar hardware, on mainframes in the late 60s at IBM and on PCs in the 70s CPM era, later extended into the "home computer" series era in the 80s, then into the msdos era. This became unwieldy and too complicated for the end users so it was replaced.

The same people implemented the idea of OS packages, again more or less in the 60s on IBM mainframes or the 80s on early unix boxes. The idea is to compile emacs to be integrated very deeply into the OS and cooperate with every other piece of software. This is contemporary. However especially in NON-FOSS it doesn't work and doesn't scale and is very expensive if not impossible to implement, being the only closed thing on an open system is a nightmare for everyone and everything involved. The stereotype in the 90s was only one service installed on one MS windows server, even if that meant it took 20 MS servers to do the job of one unix server. Anyway, expensive, complicated, hard for end users.

Again the same people implemented the idea of OS virtualization. Again, IBM mainframes in the 70s with VM, and early PC hardware experiments with TSRs and multiprocessing in the 80s to give "two computers at once". This is also contemporary, enormously more advanced today, of course. It turns out that running 50 OS kernels on a single piece of hardware is kinda wasteful although possible and cooperation gets complicated and unwieldy so time to replace again.

Again the same people implemented process jails / chroot on the BSDs and eventually after some decades linux finally caught up resulting in docker. So now your packages don't cooperate or interoperate at all with each other or the OS, which solves all the problems where the previous technology didn't work, and creates massive new problems that never existed mostly where the old technologies worked great. There are of course completely separate new problems. It turns out that a system designed to eliminate interoperability between packages interoperability a huge PITA and there are other problems that make use unwieldy and complicated, hard for end users.

Again the same people implemented (this section to be written after 2016). Maybe IOT. Maybe collapse of hardware prices faster than business demand means 20 rasp-pi cluster is cheaper and easier to maintain than a single beefy desktop running 20 virtual images or 20 docker containers. Maybe FPGA on the desktop means people will just synth up whatever matches this hours workload. Maybe cloud will finally work and no one will maintain servers anymore, it'll all be magic, or at least push the magic to someone else who now has the same old problems. Maybe SaaS means we'll all be customers and most productive software will run on internet scale clusters not individual machines, individual machines will be dumb webbrowser terminals. Who knows!

</comment><comment><USER53> IBM and Sun know.

</comment><comment><USER54> lol. read two paragraphs => click author's name to verify he's got no actual tech background. life is boring.

<comment><USER55> The author has been writing for TechCrunch for a considerable amount of time.

<comment><USER54> I have been singing in the shower for a considerable amount of time. Still no singing expertise.

In both cases it is immediatly audible/visible in the output.

</comment></comment></comment><comment><USER56> Hi there, good day fellows

I was expecting this kind of thread long ago, thanks guys for sharing your concerns, I am learning a lot from them!

IMO we can't compare containers vs VMs like many are doing now - and I was too when first heard about Docker and containers.

I hold almost all VMware certs (VCP/VSP/VTSP for 3.1/4.x/5.x and VCDX), I sign the 3 major VMware P2V migrations in BR/LA (287 P2Vs in 2005, 1600/2008 and 2500/2011). I was REALLY into VMware from 2000 to 2010, so I feel confident using it and recommending to many environments. I even manage some of them still today.

When we clone or migrate a physical machine to virtual, or whenever deploying a VM from scratch (or even using templates or copying VMdks etc) into production, we aim to develop the environment in order to see it lasting "forever". We want this to be flawless, because even with given most-players virtualization deploying resources (hyper-V, VMware, xen, kVM, vbox+vagrant, etc), nobody wants to troubleshoot a production environment, we cheer to see the VMs always up and running. I remember when P2V in mentioned projects during the night, and needed to fallback physical servers because the cloned VM didn't behaved accordingly. Please VMware, clone it ok, otherwise the troubleshoot for legacy shit will be a pain.

On the other side, containers are made to be replaced. They are impermanent. You can tune your images as your app/env needs. You can have an image for each service you have. You can have many images running many containers, and some of them providing services you have. You are able to customize an image in a txt file called Dockerfile, and generate an image from this file.

So imagine we got this infrastructure to "Dockerize" , a website with a DB. Does your webserver runs apache? so you can code a Dockerfile, that will deploy an apache instance to you. It could deploy FROM an ubuntu:16.10 or 10.04, depends on what is better for your app. OR, we could just pickup Apache's own image, like in FROM apache. You can save this image as yourid/apache. And you can do the same regardless of what DB you are using, just install it (the mysql using apt-get in a FROM ubuntu/debian based system), or use mysql images directly. You are able to publish the website cloning your site dev repo direct in Dockerfile itself, or you could have the website at some dir in your host, using ADD or CP to make it available in the right container dir (eg /var/www/) You could even use Volumes, to mount some host dir (or a blob, or a storage account, or a partition in your storage, something available in the host itself). This is specially interesting for DB in my opinion. Once you have your Dockerfile ok, you can name it yourid/db.

And if you have a main website, and a blog website, you could use the same apache Dockerfile changing only the git clone line, and save them as yourid/apache:website and yourid/apache:blog for example.

And when redeploying the container, you will have the same volume data available in the same container dir. Even if you redeployed it from ubuntu:15.10 to ubuntu 16:10.You can use the latest improvements from the freshest image (or patching some vuln), and redeploy all your containers that uses this same image at once.

The same goes on, you can test jenkins without knowing what OS jenkins image is made off. You dont have to worry about it. It will just work. You pull the image and run the container and voila.

NOW, my Docker instances are like this: I use Docker-machine, and locally I got the default and local envs. I got also an Azure instance at Docker-machine (that runs on Azure), and another instance configured in Docker-cloud using Azure as cloud provider (I use Azure due bizspark credits). So, 4 of them. All those instances, are VMs themselves. Ubuntu VMs to be sure.

You just replace the container (probably published in a cluster if you care enough your prod env). Not the same as with VMs at all.

I see Docker as a hypervisor for containers the same way VMware and hyperv are to VMs.

So I understand my Docker hosts VMs have the same HA, failover, load balance, resources allocation, and so many resources VMs have. I use Docker on those VMs to make easy deploys, images, tune images, really guys I was the VMware guy for so long, I went just crazy in the resources Docker gives to us.

Docker has many weak points indeed (NAT networking, privileged containers must be run sometimes, security concerns, etc), but again, I don't see Docker to be erasing VMs from my life and now on I can deploy everything that will run happy forever in containers. We still need HA, failover, load balance, resources allocation and so on. Docker needs to be used together with TOOLS that allows it to run smoothly, and allows us to maintain our environments easier.

One of those tools are containers clusters. I work mostly with Google Kubernetes, but there are other as Docker Swarm, Apache Mesos, DCOS... Azure has its Azure Container Services ACS, IBM has its BlueMix containers, etc. Using a cluster and a deploy methodology, you are able to deploy your containers in different namespaces such as DEV / STAGING / PROD. You can use a BUILD environment to read your Dockerfile, build the image and deploy containers to the namespace you need. You can configure this build to trigger with a commit in the git repo for exemple.

So lets say we have a developer, and he needs our yourid/apache:website to be deployed, with the new website version. If the website is already updated in your git repo, you just clone it. The Dockerfile would look like this:

      FROM apache
      MAINTAINER Your Name <firstname.lastname@example.com>
      WORKDIR /var/www/
      RUN git clone https://github.com/yourid/website/website.git .
      EXPOSE 80
      CMD ["/run.sh"]

This would be named as website.Dockerfile. If you change the project git repo to any of your other sites that runs on apache, you can SAVE AS other.site.Dockerfile, and always deploy this service from this specific repo.

You can customize your Dockerfile of course and add support to specific codes like installing PHP, Ruby, Python, etc. You could even use Configuration Managers (CMs) as Ansible, Salt, Chef, Puppet, juju etc to apply those changes.

Lets say we will start the build now. We are developing this image together. So I just changed my git url on the Dockerfile. When we commit, the autobuild triggers this build in our build system (in my case, Docker-cloud or jenkins). This is what Continuous Integration (CI) and Continuous Deployment (CD) are about.

So when build is triggered, it gets the Dockerfile from the repo, builds from its image, deploys the container in the namespace you wanted (our case, DEV). This service could be published as website.dev.mydomain.com for example. Same concerning to staging namespace. And to www.mydomain.com when ready to production, in the PROD kubernetes namespace for example. Kubernetes is a distributed thing, so you could have minions (nodes) splitted across different datacenters, or geo locations. This pretty much reminds me of VMware VMs running inside VMfs storage made available through a set of ESXi servers, all with access to the same luns/partitions/volumes.

This is just my point of view, so please feel free to comment and ask me anything.

Please, just dont blame Docker because you aren't aware of mainstream techs available nowadays. If you are comparing Docker to VMs, or SSHing inside the containers, and often mad cause your data vanished while redeploying your Docker Containers, believe me you are doing it wrong.

Being a pioneer is often the same: in the 90s we had to explain why Linux was good for the enterprise, in the 2000's we had to prove VMware was really going to cluster your legacy systems, and now we have to explain what's possible to do with Docker. And, as the tech is new (I know there were previously solaris zones, google borg, etc), but I see Docker will mature its features relying in other tools (and even copying features from k8s to Swarm eg). Docker is just one skill needed to run your stuff.

Cheers!

M Matos [https://keybase.io/mmatos](https://keybase.io/mmatos)

</comment><comment><USER57> 'WTF' really?

</comment><comment><USER9> Take an operating system. Remove all the advantages of a shared environment like dynamic libraries, package management, clarity. Stick a chroot before every fork. Boom! Containers.

</comment><comment><USER58> I've read before on HN about 'don't use docker in production' can anyone elaborate on that for a newbie?

<comment><USER59> My understanding is that plenty of people do actually use Docker in production, but they use more than _just_ Docker. A docker container isn't quite the same as a VM.</comment></comment>


IBM Opens Social Software Research Center in Cambridge - <AUTHOR> http://www.xconomy.com/boston/2008/09/17/ibm-opens-social-software-research-center-in-cambridge/

<comment><USER2> The Many Eyes project that Irene led up before is a pretty neat data visualization experiment, analyzing large groups' activities on the web. It's worth a look.

<http://services.alphaworks.ibm.com/manyeyes/home></comment>


American Teachers Launch Cross Country Tour to Build Perfect School - <AUTHOR> http://www.psfk.com/2012/07/build-perfect-school.html

<comment><USER2> The perfect programming language is conceptually more plausible than the perfect school. There cannot be school that is perfect for one student; a school that is optimal for one student is likely to be less than optimal for the large majority of all students.</comment>


Clicksend has a joke on a song about domestic abuse on their website - <AUTHOR> https://www.clicksend.com/us/sms/ <comment><AUTHOR> It's apparently on visible on the desktop version, but its a reference to [https://en.wikipedia.org/wiki/Luka_(song)](https://en.wikipedia.org/wiki/Luka_\(song\))

</comment><comment><USER2> Hey, It's Matt from ClickSend. I'll arrange for the content to be adjusted within 24 hours.

</comment><comment><USER3> Did you contact them with your concern?

<comment><AUTHOR> Yes they eventually replied on twitter and, after making a joke about it, I told them the song they were referencing is very clearly about child abuse they said they'd change it. Shrug.</comment></comment>


Show HN: pinterest export - <AUTHOR> http://www.pinterestexport.com/

<comment><USER2> I would not pay for this. There are countless (FREE!) Chrome or Firefox extensions that allow you to do this (AGAIN, FREE!) by downloading all the images on the page and finding their source for the high res versions. If I were you, I would just offer this for free.</comment>


If seeing is believing... never point your smartphone's camera at a propeller - <AUTHOR> http://www.carrypad.com/2011/07/25/if-seeing-really-is-believing-never-point-your-smartphones-camera-at-an-airplane-propeller/

<comment><USER2> This isn't a revelation for most people (or maybe I'm biased, a lot of my friends are pilots), but the second video there is the best demonstration I've seen so far of why this occurs.

</comment><comment><USER3> From 15 months ago: <http://news.ycombinator.com/item?id=1301295></comment>


What Google Learned from Wave and Buzz - <AUTHOR> http://smarterware.org/8248/what-google-learned-from-buzz-and-wave

<comment><USER2> In one paragraph, the author lauds the fact that Google+ will send email to people who aren't on it, effectively spam for your friends: _G+'s email notification handling is particularly elegant. It gives you the choice—on by default—to let your friends who aren't on yet know there's something going on._

In another paragraph, the author lauds how Google+ doesn't clutter your mail inbox: _Don't mess with the Gmail inbox. When Buzz invaded my Gmail inbox with a flood of social-networky conversations, my first instinct was "Turn it off!"_

I guess the message is that if you sign up, Google+ won't annoy _you_ , but it will give you the tools to annoy your friends so their product can be "viral."

<comment><USER3> Gmail also allows you to send email to people who aren't Gmail users. I don't see how it's necessarily worse when Google+ does it. It doesn't sound like it's talking about Farmville here — more like what Apple does with iMessage, where it sends an iMessage to other users of Apple's service and a text to others.

(I'm not on Google+, so I don't speak from experience. That's just how it sounds to me.)

<comment><USER2> To be perfectly candid, I am not sure if I have an issue with Google+, with my friends who think I want to throw a custard pie at them, or with the author who both praises and lambastes products that send you unsolicited email. Perhaops I should have simply said, "Hmmm, that's odd..."

<comment><USER4> His criticism of Buzz didn't have anything to do with unsolicited email, but rather with the fact that Google integrated it into its gmail UI.

<comment><USER5> Correct, although the author is a her.

</comment></comment></comment></comment></comment><comment><USER6> If they don't give people invites soon Google+ will be DOA. People will stop caring before anyone gets a chance to use it.

<comment><USER7> _People will stop caring before anyone gets a chance to use it._

This point is brought up often, but I thought it worth reiterating here. One of the biggest differences between GMail and Wave was that even though GMail ended up being released (very) slowly to the public, you could interact with other email users without them needing to get on to GMail.

Unfortunately the same is _not_ true with their current offering of Google+. I wonder if there is anyway for them to balance "extensive testing, and careful releases" with "getting a quorum so that the early adopters find it useful". Perhaps allowing them to interact with Facebook so that they can still interact with their friends from Google+ without needing everyone on it (along the lines of GMail).

<comment><USER8> _I wonder if there is anyway for them to balance "extensive testing, and careful releases" with "getting a quorum so that the early adopters find it useful"._

There is a way, but they need to do more groundwork. Facebook started University by University. Even if it's only people at my University that can use Facebook, that's OK, because I have something in common with those people. I don't need everyone else in my life to be able to use it in order for it to be of value to me.

They need to find groups of people who have something in common.

This could be University's, companies, sporting associations, etc. Anything where there is a group of people who have a reason to communicate with each other and where it can reach a critical mass of usefulness relatively quickly.

Of course, it will require a little more hand holding, but it will give the product a greater chance of success.

Use Buzz and Wave as examples.

I have absolutely no interest in interacting with my friends and family using those services. None. My Mum wouldn't even know where to start with them. They require too much effort. Besides she's got Facebook and everyone else she knows does too.

However, I would have happily given Buzz and Wave a go through my companies Google Apps account with the rest of the guys at my company. We try new services as a team all the time to see if we can find something that will help us in some way. BUT, these services were not available to me through my Google Apps account. Only through my Gmail account. Which is a bit of a PITA since -- at the time -- you could not be logged into both Google Apps and Gmail at the same time. So it was a non-starter.

My point? Facebook started small with University's. Students who had something in common. Google should probably start with businesses. Work colleagues who have something in common. Roll it out to one Google Apps account at a time. Hold their hand. Gain traction -- then with a solid base, spread your wings and jump.

<comment><USER9> One suggestion posted, somewhere, was to cross reference the GMail contact list with people who requested an invite. Then send invites to people on both lists earlier in the process.

It may not be the best approach but it would help bring people into the system with something in common.

<comment><USER10> Alternatively, rank the people on the "keep me posted" list by their network centrality within their group of contacts, invite the ones of more centrality first, and give them a limited number of invites to give away themselves.

(That is: select evangelists from the "keep me posted" list, invite them first, and let 'em do their work.)

</comment></comment></comment></comment></comment><comment><USER11> "Wave was released in "limited preview:" too few real users not soon enough. Google+ is in "field testing" right now. The language here is important. "Field test" implies that a significant number of real users outside of the plex's walls are putting Google+ through its paces, and will find confusing UI around sensitive items like privacy before the product gets released to the public."

Using the right buzzword doesn't mean anything. And 'field testing' doesn't imply more users than 'limited preview'. In fact, I would have said it meant less, by my gut feeling. It probably doesn't have any relation at all in their minds.

For the rest of it, I think I can summarize with:

Keep it simple, while still implementing all the features necessary for social networks, especially Notifications and mobile access.

The only non-obvious thing is the feedback mechanism, which is apparently pretty rich.

I still say that it doesn't matter how nice a social network is if my friends aren't also on it. And if you let me in but make me wait too long for my friends, you'll lose us all 1 at a time, which is the same result as never having us in the first place.

<comment><USER12> It will be insanely foolish if ALL the first invites don't also get about 30 invites themselves, and for those we invite, allow us to send them whatever "share" of our invites we want them to have.

So, I can invite a popular friend and give him 10 invites, and I can invite my other friend and give him 1 invite.

<comment><USER11> I think that would be a good compromise, but I'd rather see everyone start with 1 or 2 invites, and let things expand organically for a while, then add more invites to everyone when the capacity is there.

Even giving everyone 1 invite every day would be better.

<comment><USER13> > I'd rather see everyone start with 1 or 2 invites, and let things expand > organically for a while, then add more invites to everyone when the capacity > is there.

No, no, no. This is the problem I have with Diaspora. They gave me 5 invites. I used my first since I got mine as part of an invite chain. I have no clue how to best utilise the other four so as to maximise the usefulness of Diaspora (i.e. grow my own social network maximally). End result, I haven't used any of my other 4 invites due to analysis paralysis and my social network is basically dead.

Google+ seems to be off to a pretty good start so far. I'm not exactly sure how the invite structure works, but somehow a significant portion of my social network seems to already be involved. I'm assuming this just means I know a lot of connected people (most of my network is from college and we all know people who do or have worked at Google), but it means that, even within the first 24 hours, activity has been pretty decent.

</comment></comment></comment></comment><comment><USER6> Judging from the previews and looking over a co-worker's shoulder this finally looks like a social, singular interface for many of Google's products.

Iv'e been hoping they would stop thinking of themselves as many different products and start viewing themselves as users do: just one Google. Each product is really just a feature. Facebook does this right and I hope Google does too.

</comment><comment><USER14> Google Profiles is not available for your organization. nuff said

<comment><USER15> The lack of Profiles for Google Apps (for organizations) is a big annoyance. If I try sharing RSS fiends with friends in Google Reader, everyone shows up as "Anonymous". Many people complained about these problems on the Google Reader support forums last year, but Google still hasn't responded or fixed anything.. :(

</comment></comment><comment><USER16> It's surprising when people find it difficult to understand the importance of email/some kind of notification for the activity on your social profile, but the this cannot be the only reason to be credited with the failure of Wave. I still feel that Wave is a great product and it could not catch up just because it was ahead of its time. And the few admirers could not use it because others were not ready to use it. A lot of new age collaboration tools do the same what Wave did long time ago.

</comment><comment><USER17> I think they didn't learn from Wave exactly what is frustrating me now. Don't limit my ability to use a communication tool amongst my friends. With Wave, I thought "Hey cool, let me try this out with..." nobody, because it wasn't open to all. I had the same experience going to +1: "hey this is cool let me add my friends..." oh wait...

</comment><comment><USER18> 1\. Does Google have a "broadcast mode"? Because I think it's vital. The problem with Facebook is that it _only_ had a broadcast mode and not a "circles" mode. But does Google+ have only the Circles mode and not a broadcast one as well? All social networks need a broadcast mode (AND a circles mode).

2\. Does it have a real time communication tool, such as Gtalk, or maybe another chat program that works across the entire network like Facebook chat. I think IM features are important for a social network, too. If it does, how does it work? Does a different chat appear in each Circle? Or do I see all at once? I'm not sure I'd like to see all at once. It's acceptable in the beginning, but what if you have 10 groups of ~20 people each? I think I'd prefer to just go into each Circle when I want to talk to that group, rather than see them all at once, and having them all see me when I'm online.

<comment><USER19> 1 - Yes. You can share to specific circles, specific people, OR "Public" to everyone.

2 - Sort of. Through the "Huddle" functionality on the mobile client, you can do real-time group chats. But that might not be what you're referring to.

<comment><USER19> Sorry, answer to 2 is "YES". There's a chat bar, and you can select an entire Circle to chat with.

</comment></comment></comment><comment><USER20> ... but they still force you to make your profile public <http://j.mp/jQJ0LE> ... its like they learned nothing after all

<comment><USER21> The actual link that the above "minified" link goes to:

<http://dl.dropbox.com/u/804904/cropper/google_plus.png>

</comment></comment><comment><USER22> "The Google+ Android app is very well done, and it's made a few of my dual- using iOS/Android friends go all-out Android."

I didn't see it this way - I have more than one gmail address and after downloading the app it prompted me to associate Google+ with the account that didn't have Google+! There is no option to associate it with any other email address so it's completely unusable to me.

</comment><comment><USER23> I just got an invite tonight - a very slick system. Does anyone know if it is a GWT app?

I still miss Wave. I was not 100% enthusiastic about Wave's UI, but writing robots for Wave was fun and I was looking at it as being a good platform to write for.

Google+ does not look like a platform for 3rd party developers.

</comment><comment><USER24>
      I will love Google+ when and if all my friends show up and
      stick around.

Isn't the phrase usually "if and when"? I wonder if this was switched on purpose.

<comment><USER25> Yeah, i thought the same thing too. I did if the phrase was switched. Not sure why you got down-voted on this, its a fair point.

<comment><USER3> It was probably downvoted because it seems like, if you'll excuse the bluntness of the term, pointless pedantry. The reversed word order doesn't make any obvious major difference to the phrase's meaning, so whether it was done intentionally or by accident comes across as pretty academic.

(I hope this doesn't come across as overly hostile. I don't mean it as an attack. I'm just explaining my guess since I hate mystery downvotes.)

</comment></comment></comment><comment><USER26> Slightly off topic from the article, I'm curious when they're going to integrate their gaming platform into this, or any 3rd party development for that matter.

</comment><comment><USER27> You know what would be great? A new social network NOT created by Google. The company is the Wal-Mart of tech; the modern day Microsoft of the internet. Let's join something created by entrepreneurs, not conglomerates.

<comment><USER28> Why?

If someone produces a good product, and they have generally pleasant business practices (and don't have glaringly bad ones, too), why does it matter if it is a large company or a small one?

<comment><USER27> Exactly, Google doesn't have generally pleasant business practices. Maybe the Google of 1998, but the Google of today is a much different beast.

<comment><USER29> To my knowledge, Google has never offensively used a patent. A large percentage of their products are open source. They develop a lot of open technologies in an attempt to make the web better/faster for everyone (which, in theory, will be good for their business in the long run). Their privacy practices are going to be audited by a third party for the next 20 or so years.

Where exactly is the walmart/microsoft likeness?

<comment><USER27> The parallel between Google and Wal-Mart is how they both appeal to the lowest common denominator. And how their customers are oblivious (or knowingly apathetic) to the negative impact these conglomerates are perpetuating.

As for Microsoft, they were the dominant conglomerate of yesteryear. Today it's Google. Both companies wield different powers, and both have been abusing them in different ways.

<comment><USER30> What powers do you think Google is abusing?</comment></comment></comment></comment></comment></comment>


Ask HN: How to Emigrate from Europe to USA (Sillicon Valley)? - <AUTHOR> I found process of migration to USA quite complicated. I tried to do some research, but still I don't know how to approach it: 1. should I find a company in SF Bay, which sponsor visas? 2. should I find a company in USA and then migrate to SF Bay area? 3. or maybe should I find an international company in Europe (like Google), try to get a job there and then migrate to USA?
What's more, I don't know which visa should I get - H-1B or another one? Where can I look for housing? Where can I look for a company? Especially that even those big companies don't want to sponsor visas.
Any ideas and advices?
BTW I'm 24, with BSc in computer science and 2 years of experience as Scala developer <comment><USER2> So to start with you need an employer; you're not going to get anywhere without a company sponsoring you.

The problem with H1-B visas is that there is a cap on visas that only meets ~1/3 of the demand, and the way this is resolved is via a lottery system. You need your paperwork in on a given date in the year (Early April iirc), and it will take a few months to know if your application has been selected; if it's not, you have to wait until next year to apply again.

Another option is the O-1 visa. You don't need to have a Nobel prize to get one, but it's definitely the one where you have to show that you are special. As an example, one of the things they like to see is that your proposed pay would be at the 90th percentile of people of people with that role in that location, but there are other criteria.

L1 visas are great since there is no lottery, but you do need to work for the same company internationally for a year first.

Given all of this, your best bet is to find a large international company you want to work for and apply there and try to work out a plan with their recruiter who should be able to tell you about how they deal with this situation since I'm sure it comes up very often. The most likely outcome is that unless you've nailed down a job before April and are fine with only a 1/3 chance of having a visa in ~August, they'll recommend working in their EU location and then transferring later.

Also, the "dual intent" doctrine allows you to get a green card from all of these visas, even if they are considered non-immigrant visas.

</comment><comment><USER3> The easiest way, and i say that with a big pinch of salt because migrating to the US is not easy in any way, is to come here for school, get a graduate degree, get a job through the academic environment (job fairs etc.) and then get that company to sponsor your H1-B visa.

Having a company sponsor you for a work visa while you are not physically present in the US is quite difficult, unless you are an expert in your field. In that case you can look at O1 visa which is meant for special talent.

Coming to the US and then looking for a job here is pretty much impossible (assuming you still want to be legal). L1 visas work for transferring from your existing employer to the same employer in the US but they are short term visas, not meant for migrant intent.

Even H1B and O1 are short term visas with no migrant intent. Depending on your country of origin, it could take anything between 2yrs to 9yrs to get a green card, which is the migrant "visa". During that time you have to maintain full- time, gainful employment in the US.

Although i should point out that 9yrs is only for Indians and Chinese but you are still looking at a multi-year process before being a full-time migrant worker in the US.

<comment><USER4> L1 visas immigration process is almost identical and sometimes (L1a) even better than H1b, so they are definitely the way to do it if you have a chance</comment></comment>


Discovery of a "Holy Grail" with the invention of universal computer memory - <AUTHOR> https://www.lancaster.ac.uk/news/-discovery-of-a-holy-grail-with-the-invention-of-universal-computer-memory <comment><USER2> More technical details at: [https://www.nature.com/articles/s41598-019-45370-1](https://www.nature.com/articles/s41598-019-45370-1)

</comment><comment><USER3> This could be important. Where can we find out more?

</comment><comment><USER4> How does this relate to HP's memristor ?</comment>


Cockroach Design Document - <AUTHOR> https://docs.google.com/document/d/11k2EmhLGSbViBvi6_zFEiKzuXxYF49ZuuDJLe6O8gBU/edit?usp=sharing

<comment> david-given Aw, man. I thought that this was the design document for cockroaches.

That is, someone had studied cockroaches and, pretending they were an engineering project, had written up the design document for that project. That would be a really interesting read.

</comment><comment><USER2> Wow...is this the same Spencer Kimball of GIMP and GTK+? Pretty impressive project portfolio there.

<comment><USER3> That explains the naming choice.</comment></comment>


What Would Jesus Disrupt? - <AUTHOR> https://www.bloomberg.com/news/features/2017-04-05/what-would-jesus-disrupt <comment><USER2> The article never addresses its title, but the answer there is "Money changers", and it would be best to remember that Jesus overturned the money changer's tables, and lashed them out of the temple.

But the article itself is a bit weird. Makes the Crossroads Church sound more like a venture capital/startup accelerator more than a megachurch. The article does not discuss this as a form of tax evasion, but it seems like the possibility is t here.

<comment><USER3> That is the wonderful world of 'prosperity gospel' churches.

</comment></comment><comment><USER4> Interesting on a sociological level perhaps, but is it really HN material? Would similar articles about about other religions be OK?

</comment><comment><USER5> Turning water into wine at the wedding surely disrupted liquor store sales in the Canaan area ;)</comment>


Facebook Privacy: Lessons Learned from Congress's 2000+ Follow-Up Questions - <AUTHOR> https://hackernoon.com/facebook-privacy-lessons-learned-from-congresss-2000-follow-up-questions-44d2dacd4634 <comment><USER2> Balanced and well-written</comment>


What are the bad features of Java - <AUTHOR> http://vanillajava.blogspot.com/2015/04/what-are-bad-features-of-java.html <comment><USER2> The BigDecimal examples are expected.

Also they are hard to read, but that's all. But that's cause of the formatting made by the developer.

Also I like the Scala Version most:

[https://gist.github.com/schmitch/f23e59d85c9fd84a347d](https://gist.github.com/schmitch/f23e59d85c9fd84a347d)

It's just what people want.. However sometimes compiling takes just too long. But still a good arithmetic combined with a rich rich type system = win. Mostly you can't calculate wrong.

Pythons Type system for arithmetic is good aswell, I mean all typ system which could create custom types and still use basic + - * / are good, however that could also lead to serious problems.

Also I also think that checked expressions are a real problem in java8. In scala the things are solved with Pattern Matching, however since java has no DTO classes, you need some kind of Checked Exception without loosing functionality. And even with pattern matching you still run into code which sometimes just needs a good Checked Exception</comment>


Creating a Startup - Choosing a Company Type - <AUTHOR> http://leadthinking.com/63-creating-a-startup-choosing-a-company-type

<comment><USER2> For a bootstrapping entrepreneur, LLC is clearly the way to go. If and when you do receive VC funding (which is difficult if not impossible to do these day), you can do a tax-free transfer from a LLC to a C-Corp. In the meantime, it allows you maximum flexibility. The only big concern with LLC is that any income is taxed as personal income (not investment income) and therefore you would need to pay payroll tax (about 15%, before Federal and State tax). Also, the annual franchise fee is calculated based on "gross" income and not "net".

This is an important subject. For those of us who are interested, I have written more on that in the following.

<http://www.startupforless.org>

<comment><USER3> With an S-Corp, you can pay yourself a "reasonable salary" subject to payroll tax, and then pay distributions to yourself over and above that. I've been told this is an audit flag, and it doesn't seem worth it for the minor gain.

There are also complexities to issuing equity from an LLC.

<comment><USER2> I agree. I have written about my own experience which is for an LLC to elect to file tax as a S-Corp (filing a Form 2553). It is the best of both Worlds.

<comment><USER2> <http://www.lovemytool.com/blog/2008/01/bootstrapping.html>

2nd part of the long article. Thanks, @bravura.

</comment></comment></comment></comment><comment><USER3> Isn't this basically a rehash of a Feld article, down to the "check box on the IRS form" and the "frowned upon" UBTI tax?

Does it actually matter what company structure you have when you go look for funding? I don't think it does. Everyone I've ever talked to on this subject says "whatever you do, they're just going to re-do it anyways."

<comment><USER4> Yes, it is a rehash of the Feld article.

The author clearly doesn't understand the nuances of the issues, and it just repeating someone else. This is evidenced by: "Incorporating a LLC". You can't _incorporate_ an LLC, you _form_ an LLC. An LLC isn't a corporation.</comment></comment>


The Netflix Prize (to go along with the Spock Challenge) - <AUTHOR> http://www.netflixprize.com/ <comment><USER2> Read the rules for both... For Netflix, it's a million bucks, and you grant them a non-exclusive license (meaning you let them do whatever they want with it, but you can, too).

For Spock, it's $50k and you give them all the rights, solely and exclusively (meaning you can't use your own work anymore), PLUS permission to "use the winner's name, photograph, voice, biographical information, and likeness for promotional purposes in television, radio, Internet, and print advertising without further compensation or notice, except where prohibited by law."

This is so open-ended, they could conceivably sell your likeness to Valtrex for billboards.

</comment><comment><USER3> For any companies with a specific, difficult technical CS challenge to be solved, sponsoring a contest seems to be a really cheap way to get great results.</comment>


Microsoft announces new solutions for IT professionals - <AUTHOR> http://news.microsoft.com/2015/05/04/microsoft-announces-new-solutions-to-empower-it-professionals/

<comment><USER2> The title is a little odd. Almost nothing on that page has anything to do with Windows 10 itself, and everything to do with server tooling and enterprise tooling.

Anyway, the most interesting and frankly groundbreaking thing on that page is the Microsoft Advanced Threat Analytics. Read about it here: [http://blogs.technet.com/b/ad/archive/2015/05/04/microsoft-a...](http://blogs.technet.com/b/ad/archive/2015/05/04/microsoft- advanced-threat-analytics-public-preview-release-is-now-available.aspx)

It is actually pretty cool.

<comment><USER3> Thanks, we updated the title from "Microsoft Offers New Security in Features in Windows 10".

</comment></comment><comment><USER4> SQL Server 2016 to include R language ! Interesting times!

<comment><USER5> Yeah that's pretty nifty.

I wish they'd support F# as one of the CLR languages. It seems ideal for SSIS, for example.

</comment></comment><comment><USER6> Interesting. I wonder if they'll make EMET 6 a core part of Windows 10? (It would be rather nice if they did!)

<comment><USER7> I agree, emet, despite its stilted name, should be a core part of the OS. Nicer would be to bring something like bit9 into the fold as well. MS should really stop acting like the specter of monopoly still hangs over them and just deliver the best possible solutions they can. I know they don't want to upset partners, but you have to shore up your product when it's missing something important like that. I remember it took them forever to consider bundling AV into their product when it was painfully obvious it needed to address that shortcoming.

<comment><USER8> I disagree with you on bit9. It heavily degrades performance on my work machine. I have nothing against the idea of bit9 but everything against its implementation.</comment></comment></comment>


Who's Afraid of the IRS? Not Facebook - <AUTHOR> https://www.propublica.org/article/whos-afraid-of-the-irs-not-facebook <comment><USER2> "Yet, in October 2008 when Facebook publicly announced its choice of what it grandly called its "international headquarters," Sandberg was quoted in a press release singing the praises of the Irish workforce. "After exploring various locations throughout the region, we decided Ireland was the best place," she said. "The talent pool in Dublin is world-class and recruiting local talent will help us better understand the needs of local users."

In a private email to an old Google colleague the previous day, however, she'd been frank. "Same decision process Google went through a long time ago," she wrote: "tax breaks to put international revenue through. Our operations there will be very small — maybe 10 people by end of this year and 30-50 by end of next year.""

Always fun to get a peek into the private thoughts of industry leaders.</comment>


A Potential Privacy Model for the Web - <AUTHOR> https://github.com/michaelkleber/privacy-model <comment><USER2> > The identity "Me while I'm visiting nytimes.com" is distinct from the > identity "Me while visiting cnn.com".

Trying to solve this through purely technical means is futile. If you block it at the user-agent, sites will share data at the back-end to create a super- profile.

Right now it's really convenient for advertisers to run an ad auction right in the user's web browser because all the context is there -- take that away and you'll see user data aggregated on the back-end instead.

Absent some type of regulation and enforcement, I really don't see how this puts a dent in the "reads a lot of articles on NY times about dogs, sees a lot of ads on cnn.com for dog food" profile aggregation.

<comment><USER3> > If you block it at the user-agent, sites will share data at the back-end to > create a super-profile

This needs a bit more technical detail. If you mean they'll combine IP + other fingerprinting, we can work on mitigation techniques there too.

> I really don't see how this puts a dent [...]

It does as it asks sites to more explicitly install something server side with their HTTP server instead of embed this one-line script tag. Changing from the browser being to store of cross-site identifiers to the backend has a chance to shine more light on the practice and increase the burden of tracking. It can make a real dent.

Regulation/enforcement are orthogonal to technical solutions. There are also varying levels of support for the former vs the latter and we shouldn't mix them nor should we blindly say "regulation and enforcement" without nuance. Many, including myself, are against most regulation/enforcement approaches due to implementation incompetence (intentions notwithstanding). But regardless of that debate, it shouldn't muddy the technical debate.

<comment><USER4> > This needs a bit more technical detail. If you mean they'll combine IP + > other fingerprinting, we can work on mitigation techniques there too.

Yeah, but instead of playing cat and mouse, just make it illegal and fine anyone caught violating it.

Honestly, banning tracking would end the race to the bottom and be good for publishers and consumers. It probably won't affect FB & Google because they are too big to be displaced. It may kill a bunch of middlemen, but they are leaches and should die anyway.

<comment><USER5> > just make it illegal and fine anyone caught violating it.

I agree that this should happen. Unfortunately, this requires a revolutionary political movement which has so far failed to materialise. When there isn't adequate appetite from the rest of society for the protections you want, your solution has to be a technical one.

Maybe another way to kill the middlemen is to develop technology which undermines their business model, e.g. DTube; YaCy.

</comment></comment></comment></comment><comment><USER6> A similar idea has occurred to me. I imagine a browser plugin that allows third-party cookies, but associates them per-domain visited. That is, the cookie that google analytics gets would be different when I'm visiting siteA.com vs siteB.com.

I don't share the author's optimism that dialogue will result in "a new identity end state that works for everyone." I believe on-line privacy has to be protected through non-negotiable mechanisms, against the interests that stand to profit from taking it away.

<comment><USER7> > That is, the cookie that google analytics gets would be different when I'm > visiting siteA.com vs siteB.com.

Isn't this part of what Firefox containers do?

<comment><USER6> I think of Firefox containers (and Chrome "people") as providing a little isolation, but not enough. If I browse HN in a container, I'm likely to follow links to a lot of different domains. I'd have to diligently select the right container each time.

I'm suggesting instead the browser never mixes a cookie I was assigned while browsing say nytimes.com with a cookie assigned while browsing washingtonpost.com. Even if I regularly browse these domains in my "news" container.

</comment></comment></comment><comment><USER8> Few problems that Web has for privacy:

\- IPs don't usually rotate often enough.

\- Browsers can share user data however they want.

\- User cannot by default choose what website is allowed to run or download. There are adblockers and such, but normal user doesn't know what needs to be allowed so that site works and it doesn't leak your data. And if developers choose to pass analytics data with actual content requests there is no way of preventing that while keeping site functional. \- User agents and other metadata (resolution, browser features, cookies, latencies to servers, etc.) are shared without user consent.

Browser vendors could make lot of information available only after explicit consent, but that would break a lot of websites. And its hard to say when and what should you consent. This is same problem as for Android and iOS.

There are also valid reasons to share data between services and domains: SSO, social media, etc. How to make that easy?

</comment><comment><USER9> Some of that seems OK, but a lot of it still seems unacceptable to me. Particularly, I disagree with these assertions:

> It is reasonable for the browser to relax its identity-sharing controls > within that expanded notion, provided that the resulting identity scope is > not too large and can be understood by the user.

> It may be OK for a site to learn the fact that a user has earned trust on > another site

But, as always, my attitude about this sort of thing as that everything hinges on informed consent. If I have not given my explicit informed consent, then there is no sharing of data about me that is acceptable.

</comment><comment><USER10> I seriously can't see any dialog working while one of the sides has a strong vested economical interest in keeping the status quo.

Even with all JS and cookies disabled, servers can still collect your IP and infer if it is indeed you visiting by analysing your usual visit times -- and likely a lot more other metrics.

Unless the browsers use Tor-like visitor source obfuscation, I don't see anything changing in favour of privacy.

<comment><USER11> With JS and cookies disabled and using a VPN you can get a decent browsing experience without tor slowness and blocks. At least your browsing is mixed with thousand people.

<comment><USER10> Sure. But lately I keep hearing that these users are implicitly under attack by constantly requiring them to fill CAPTCHAs.

<comment><USER11> I haven't experienced any captcha so far. I did when using tor.

<comment><USER10> That's exactly what I was saying: that many websites' algorithms punish you for choosing privacy (Tor) by making you fill captchas all the time.

<comment><USER11> Oh, now I get it. Great idea. Also implement Namecoin support would be great.

</comment></comment></comment></comment></comment></comment><comment><USER12> > Third Parties can be allowed access to a first-party identity

The problem with this, is that third parties can also be first parties and have their own data. The obvious examples are Facebook and Google today, when you use any service where they act as a third party, they may mix your identity with their first party id.

<comment><USER13> The first bullet point below that title is "First parties have a way to delegate access to a user identity to specific 3p's, as long as that delegated identity remains sharded by 1p." The model is proposing that if you allow Google to have access to user identities on your site, and I allow Google to have access to user identities on my site, the browser should prevent Google from joining those identities and detecting that the same user visited both of our sites.

(Disclosure: I work for Google, like the author of the article. Speaking only for myself.)

</comment></comment><comment><USER14> On top of all the things people mention here there is a huge vulnerability in Chrome that is undermining the whole thing. They mine data at the browser level and sell it to advertisers. This is in addition to what tons of advertisers do on individual web pages. So irrespective of what we do as long as Google and other browser manufacturers mine user data there is not much progress.

I should add that Safari and Firefox (?) seem to be the only exception.

<comment><USER15> > They mine data at the browser level and sell it to advertisers

Go you have any actual proof of this?

<comment><USER14> Read Google's own proposal for privacy on the web. The first thing they talk about is differential privacy when collecting user data in chrome.

<comment><USER15> Can you point to the specific part? I really don't see what you're talking about.

<comment><USER14> I am on my mobile and the chromium blog doesn't quite work. So go here and click on the link in the page that says "we have announced a plan".

[https://www.blog.google/products/chrome/building-a-more- priv...](https://www.blog.google/products/chrome/building-a-more-private-web/)

</comment></comment></comment></comment></comment><comment><USER16> This all seems like part of the tracking arms race.

The way to end it is to stop tracking in the first place.

</comment><comment><USER17> we designed www.abine.com's Blur to enable users to implement some of these "compartementalization" techniques in practice. web traffic, fingerprinting, and tracking is one layer, but stateful registration, login, and payment is a whole other layer. tldr: it is a tough problem to deliver a simple experience on.</comment>


Show HN: Visually Create, Fork, and Share Bootstrap Themes (Critique My MVP) - <AUTHOR> http://www.forkstrap.com/ <comment><USER2> The idea is awesome for developers with basic knowledge of bootstrap, and seems to make most people gain time too. The only bad thing is that your website doesn't seem fully responsive, especially with the left iframe-like menu. It's bad for a boostrap theme maker...

</comment><comment><AUTHOR> Feedback welcome!</comment>


Paul Graham is now tweeting - <AUTHOR> http://twitter.com/paulg <comment><USER2> It's interesting how different it feels from commenting on HN. The box is so tiny, and you can't edit stuff afterwards. But you also don't have to deal with replies or worry about getting downvoted if you say something unPC.

I'm still not sure what to use it for, to be honest.

<comment><USER3> You could do some tweets about your amazing, beautiful and talented wife.

<comment><USER4> He'll tell you he can't do that in only under 140 characters!

</comment></comment></comment><comment><USER5> Surprising that it took this long. PG's quotes page includes several by "Tara Ploughman", an anagram for "Not Paul Graham". When this was discovered, PG lamented the lack of a socially acceptable way to publish "single sentence essays". Twitter fills the gap nicely.

<comment><USER6> Nicholas Nassim Taleb (author of _The Black Swan_ ) uses Twitter for exactly that purpose: <http://twitter.com/nntaleb> "(I use twitter to test philosophical aphorisms/epigrams)."

<comment><USER7> "This person has protected their tweets."

Strange.

<comment><USER8> You have to be logged in to Twitter to see NNT's tweets. I think that has something to do with scraping/copyright and that his aphorisms are going to be published as a book.

</comment></comment></comment></comment><comment><USER9> Be still my throbbing heart

(down-vote me all you want, this title was hero-worship lame)

<comment><USER10> <http://www.youtube.com/watch?v=0uMJYQ9LKGQ>

it's just so funny how they use the same verb for it. God bless Pythons for Life of Brian!

      "I'M NOT THE MESSIAH!!!"
      "Well I say you are and I should know, I've followed a few."

</comment></comment><comment><USER11> I think it is cool his web tweets are "via web"... very close to viaweb...

</comment><comment><USER12> His first tweet: <http://twitter.com/paulg/status/22300310058>

Pretty sure he meant @avibryant, not @avi.

<comment><USER13> If only I could get @avi for myself as easily as I got @paulg for Paul.

<comment><USER14> Any idea when the process to claim inactive accounts is going to be fixed? My startup owns the domain associated with its name (which is pretty unique), but someone is squatting the relevant Twitter account without any activity. I already contacted Twitter but they said basically they can't do a thing unless I trademark the name, which is cost-prohibitive.

<comment><USER15> The cost of obtaining a trademark in North America is well under $500. This is very much doable for any "startup" unless it's a disposable toy project of some kind.

<comment><USER14> $500 for something non-essential? Startups are launched with a budget of $5000, and you think spending 10% on a trademark should be possible?

</comment></comment></comment></comment></comment><comment><USER16> you are welcome HN:

<http://news.ycombinator.com/item?id=1632531>

<comment><USER17> That's either pretty prescient or they followed your suggestion to the letter.

<comment><USER18> Or pretty obvious ;)

</comment></comment></comment><comment><USER17> It's funny to watch the follower count shoot up.

A lot of HN'ers are out of 'stealth' mode on twitter after this.

<comment><USER19> the human addiction to statistics :-)

<comment><USER17> I know... I'm really bad. If I see a counter somewhere I start tracking it. Professional disease.

<comment><USER20> You should post a plot of it somewhere 8-)

(That's not creepy, is it?)

<comment><USER21> <http://twittercounter.com/paulg> should do that, although its not updated yet

<comment><USER22> Looks like the old owner was a Paul Gardi.

<http://www.flickr.com/photos/amirmc/4933057153/>

<comment><USER17> google:

[http://webcache.googleusercontent.com/search?q=cache:D6NCNnz...](http://webcache.googleusercontent.com/search?q=cache:D6NCNnzcXM0J:twitter.com/Paulg/status/75944372+%22paul+gardi%22+http://twitter.com/paulg&cd=2&hl=en&ct=clnk&client=firefox-a)

<comment><USER22> much better. didn't think of google cache.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER23> Who?

</comment><comment><USER24> Get pg's tweets pushed to your phone with Push.ly and Notifo :)

<comment><USER25> Or just use Twitter's SMS feature.

</comment></comment><comment><USER26> Good timing, just days after announcing a deal with Facebook :-)

<comment><USER27> The day after, in fact.

</comment></comment><comment><USER19> how do we know it's him?

<comment><USER28> <http://twitter.com/avibryant/status/22303889283>

</comment></comment><comment><USER29> I hope he didn't put a real email address on his twitter account cause that just got flooded ;p

<comment><USER30> Not really, being mailbombed with 1k emails was a dramatic and painful experience in the early 90s, tho. Some ISPs had only POP3 access back then, and many MUAs didn't had a "delete without retrieving" feature.

</comment></comment><comment><USER31> I'd like to think I had some small hand in this: <http://news.ycombinator.com/item?id=1640314>

i.e. I offered the "thepaulgraham" account, since deleted.

</comment><comment><USER32> Write Haikus with it:

Start a company / listen to your user base / create destruction

</comment><comment><USER33> Twitter is great to share links and short messages/news. It is not intended to be used as a conversation tool or long comments. Use it you feel the need for it, or don't.

</comment><comment><USER34> Wow I don't think I have seen follows grow by double digits live before. Might be a first. At 4pm was just over 300

<comment><USER35> Pretty sure <http://twitter.com/oprah> was well in the 6 digits in her first day.

</comment></comment><comment><USER36> I remember following PG long time ago.. and then finding out he was a fake.

<comment><USER37> As long as it wasn't a fake account a la @fakecarolbartz or @fakeparamount I'd guess PG wouldn't have that much of a problem with it.

</comment></comment><comment><USER38> He should use identi.ca :)

</comment><comment><USER39> Wonder how many of those followers are real and how many are spam...

</comment><comment><USER40> This is awesome news! I hope Paul will have the time to tweet often

</comment><comment> mkr-hn I wonder how many are people, and how many are followbots.

</comment><comment><USER41> Even that will not make me create a twitter account ...

</comment><comment><USER42> 30 new followers in one minute? PG gets the HN effect!

</comment><comment><USER43> I now know about convertible notes, so there you go.

</comment><comment><USER44> Some of the 600 best friends you'll ever have! ;)

</comment><comment><USER45> I don't want to rain on anyone's parade... but how do we know this is the _real_ Paul Graham?

Call me a wee bit skeptical.</comment>