Colombia referendum: Voters reject Farc peace deal - <AUTHOR> http://www.bbc.com/news/world-latin-america-37537252 <comment><USER2> I am Colombian, and is a shame with the victims that voted for peace, and in the cities that live without war vote for more war. Like in Brexit, stupid people see too much conservative media, and now we have this result, driven by fear and hate.

</comment><comment><USER3> As I'm living in Colombia, I'm glad to see this disastrous agreement was rejected by the majority of voters. It was a lot closer than I thought, and while the government, almost every political party and the media were all pushing as hard as they could for a yes vote, the people was not so easily bamboozled.

It's uncertain what will happen. The government was very proud of saying there was no plan B, but the people gave the establishment the finger leaving the government in a precarious position.

<comment><USER4> I'm curious. You state that you are glad that it failed, but you don't know what happens next. What if there really is no plan B? If war resumes, is that a better result or is the assumption that that there really is a plan B? (I'm not arguing one way or another, just trying to better understand the issue.)

<comment><USER3> The most likely scenario is the government will spend fighting for its own survival until the next elections take place.

War was not going to stop regardless of the outcome. Hell, FARC attacked a polling station just today.

<comment><USER5> If the reports are correct, it is a dissident group that had been previously dismissed by the FARC because they refused the peace. And nobody was hurt.</comment></comment></comment></comment>


Why You Love That Ikea Table, Even If It's Crooked - <AUTHOR> http://www.npr.org/2013/02/06/171177695/why-you-love-that-ikea-table-even-if-its-crooked <comment><USER2> I guess the same principle can be applied to software. Allowing people to change little things like the layout and colors make the software more lovable. Photoshop is a good example.

</comment><comment><USER3> [2013]</comment>


Rebuilding James Bond's Apple IIc – A Software Forgery [video] - <AUTHOR> https://www.youtube.com/watch?v=YGVfwEEjRfs <comment><USER2> As someone who coveted the Apple //c in high school, I absolutely loved this.

Does anyone remember Beagle Bros software?

<comment><USER3> I probably owe Beagle Bros most of the credit for nurturing my lifelong interest in computers. (My father gets the rest for giving me the things in the first place!) How many hours I spent poring through those charts and books of peeks and pokes and two-liners. I want a way to recreate that magic for the youth of today.

I had //e. The only thing I coveted more than a //c was a Laser 128EX/2\. (OK and maybe a IIGS and a Mac…)

<comment><USER2> Me too! They single-handedly got me interested in "making a computer do stuff" with those charts of peeks and pokes! Here I am ~35 years later and I'm still making computers do stuff.

Well I started on a TRS-80 but quickly became obsessed when I got my hands on a II plus and then an IIe. I never got to use a //c but remember a friend got one. It was as close to portable as you could get then and I remember wanting one really badly.

</comment></comment></comment><comment><USER4> The movie 2010 had another cool //c appearance—in that case Dr Heywood Floyd was shown using the //c with an LCD display at the beach. It seemed so futuristic back then. I don't think I ever took a laptop to the beach at any point in the real calendar year 2010, but I did do so in 1995 and that scene from the movie was on my mind the whole time.

<comment><USER5> That actually checks out, after a fashion - in full sunlight you could _just about_ make out the image on one of those old LCDs consistently. That said, [https://madeapple.com/apple-iic-flat-panel- display/](https://madeapple.com/apple-iic-flat-panel-display/) suggests it didn't mount securely enough for any kind of portable use, or fold down for transport. Good product placement, though.

I've never taken a laptop to a beach in my life. I'd worry about it ending up full of sand, although my cameras have so far managed not to, so maybe that's not such a huge risk. In any case, nothing worth doing at a beach seems likely to involve a keyboard.

</comment></comment><comment><USER6> Works great on a IIe, as well!

[https://www.flickr.com/photos/blakespot/49838052551/in/album...](https://www.flickr.com/photos/blakespot/49838052551/in/album-72157609631794748/)

I had particularly strong memories of that movie and that Apple //c scene. I was compelled to share some of them in a blog post about Max's achievement. What an effort he put in!

[https://bytecellar.com/2020/04/29/apple-c-scene- from-80s-bon...](https://bytecellar.com/2020/04/29/apple-c-scene- from-80s-bond-film-a-view-to-a-kill-perfectly-re-created-with-applesoft- basic/)

</comment><comment><USER7> The code and disk image are up on GitHub for anyone who wants to run it themselves: [https://github.com/MaxPiantoni/View-To-A- Kill](https://github.com/MaxPiantoni/View-To-A-Kill)

</comment><comment><USER8> That's cool! But it's clear he did not find the right font. What puzzles me when I look at the map screen from the movie is that there are two point sizes being used. "San Francisco" and "Palo Alto" use crisp lettering with 5 pixel tall lowercase characters, while the rest of the labels are slightly larger with more clumsy and distorted shapes. Maybe they scaled them up a little with simple nearest neighbor scaling?

<comment><USER7> Hi I'm Max, this is my project. As you say the text sizes on the Map screen are inconsistent in the movie. I did wonder if this could be to do with image/lens distortion, either from the camera or the glass on the CRT.

I considered drawing them out pixel by pixel to match the movie exactly but in the end I just settled for erasing the cap on the J in San Jose, so it would match the movie more closely.

I'd love to know how they actually did it.

</comment></comment><comment><USER9> Per his request after watching to leave a comment - imho it Is a great work. Some might say it is a total waste of time but what is a waste to one, is a entertainment with great value to others. Bringing a small picture around and draw it for 10 years is really a waste one may say. But to one it is trying to re-create a beauty of a woman called Mona Lisa. Cheers!

</comment><comment><USER10> I did a similar map on a Z80 machine running CP/M. I used the MS ROM BASIC that came with it. It had a PLOT command. First I would use BASIC to print the city names on the screen, then PLOT the dots representing the coastline. All in it's amber on black glory.

<comment><USER11> Amber monochrome was the "ergonomic choice" for working late back in the day. Decades later to be rediscovered with f.lux, redshift, et al.

</comment></comment><comment><USER12> This is amazing. I love the passion and dedication in projects like this. It is so easy to take a few seconds of film like that for granted, but this is a great reminder of how much work goes into the details.

<comment><USER13> The OP presentation is absolutely delightful. The challenge of (reverse) engineering to a visual spec, the presentation of programming with severely constrained resources, old school hardware, retro, egalitarian programming language--so many fun parts about this project.

And all of it comes out of, as you say, "a few seconds of film".

</comment></comment><comment><USER14> 1) this is an incredible effort

2) not to be "that guy" but technically it's Stacey Sutton's Apple ][c. As a kid I was shocked that she had a personal computer in the mid 80s. Underrated film in my opinion!

<comment><USER15> For (2), they say that at about 00:19 ("Stacy one of the main characters has one of these computers" according to the autogen CC). But would you have clicked the link if the title was "Rebuilding Stacey Sutton's Apple IIc"? I wouldn't have meant anything to me.

<comment><USER14> Of course, you're right. To be honest I clicked because I was confused as to when James Bond himself used a IIc - only film from the era that I remembered him using a computer was in the opening of License to Kill, and I was fairly certain was an IBM PC. What I got was a pleasant surprise!</comment></comment></comment>


Testing Socket.IO With Mocha, Should.js and Socket.IO Client  - <AUTHOR> http://liamkaufman.com/blog/2012/01/28/testing-socketio-with-mocha-should-and-socketio-client/

<comment><USER2> The visionmedia stack. Can't live without him.</comment>


Ask HN:How many screens for coding at one's best? - <AUTHOR>

Hi,
We are doing dev and are used to our 2 screens (2 * 19") but we are planning to buy new ones to improve our comfort.
Our work: 100% coding. No video. No image. Our OS: Windows 7 + VMWare (Linux)
We are unsure about the right move 2 * 24" or 1 * 27"?
What is your screen configuration now (Pros and cons)? By your experience, which screen type is better for reading code?
Thanks a lot for your feedback. <comment><USER2> Honestly I think more, smaller, monitors are better than fewer big ones. Given my choice I'd happily take 3 22" monitors or even 2 21" monitors + 1 19" monitor if push came to shove. I can usually see all the code I need in one 21" monitor just fine, but usually need another one for reference of some kind: docs or watching debug output, etc. The 3rd would be for collaboration: chat windows & email. If you can isolate distractions to their own monitor, they're easier to ignore while busy and require less window management and never cover up your real work.

Also in general it's more helpful to talk about monitors in terms of resolution rather than size; it's entirely possible to end up with a 27" monitor that is the same resolution as a 24" monitor, which means it doesn't actually have any more usable space, everything is just bigger, and that isn't very useful unless your devs are visually impaired.

<comment><USER3> I would argue that these problems are less relevant with a good window manager. Mac OS and Linux's GNOME and KDE both natively provide support for virtual desktops, which help reduce clutter and distraction.

Moreover, if you want to truly maximize a large monitor, Linux has tiling window managers which are a boon to productivity. Tiling window managers free you from shuffling windows around with the mouse, instead dynamically resizing windows to fill all available on-screen space using a "tiling" algorithm. I find that they work fantastically on widescreen monitors. See XMonad, AwesomeWM, etc.

On Windows, if you want virtual desktops, there are hacks such as VirtuaWin available: <http://virtuawin.sourceforge.net/> .

And don't forget about the Windows "tile windows" buttons, which are crucial for efficiently utilizing a large-format monitor: [http://lifehacker.com/287588/tile-windows-with-the- control-k...](http://lifehacker.com/287588/tile-windows-with-the-control-key)

<comment><USER2> To some extent that's true, but even with those solutions I think it's most convenient to manage your windows across multiple monitors. Perhaps I'm biased because I've never much cared for virtual desktops. I just tend to get confused/distracted trying to remember where I put everything, and then the annoyance of needing to see two things that are on different desktops simultaneously...I want to spend less time managing my windows, not more!

</comment></comment></comment><comment><USER3> Either go 2 * 19 + 1 * 27 or 2 * 24. I don't think that 1 * 27 is going to cut it, particularly if you're doing GUI development. I don't feel that the consolidated workspace makes up for the loss in total surface area.

My setup currently consists of:

iPhone dev:

24" + 13" MacBook, Vim, XCode, and iPhone simulator. 17" Linux, using Synergy with the Mac. Browser + shells. Plus stuff like email, etc, because I detest the Mac OS UI (sorry guys).

Android dev:

When I'm doing Android work, I disconnect the MacBook and run 24" + 17". It's is not bad, but 2 * 24" would be even better, particularly when testing large/hi-res devices in the emulator.

</comment><comment><USER4> I find that the physical separation between two monitors helps reinforce the idea of separate workspaces for me. Running two windows side by side in a single workspace has never been comfortable for more than a few seconds.

<comment><AUTHOR> Good point!

However, for coding, you can display a lot more lines with a 27" than a 2*24" config.

</comment></comment><comment><USER5> Have you experimented with 2 x 24" (1920x1200, not 1920x1080) running in portrait mode?</comment>


Thinking to create your own social network, website or online classroom? - <AUTHOR> http://www.pesome.com PeSoMe lets users create their own platform and that could be either a Social Network, a Website or an online classroom in 30 seconds and it's free. Have you create your own platform yet? <comment><USER2> What is the pricing though? I see it says "Try for free" \- so I assume that's free trial, right? Good Luck!

<comment><AUTHOR> it's completely free and no string attached.

<comment><USER2> Ah cool, I would advice you guys to do some proof reading on FAQ and overall on the website - there are some serious typos here and there. I like the idea and I will bookmark it to see how it goes for now. Good luck on your start +

<comment><AUTHOR> Thanks, we will work on the proofreading sometime tonight. We're look forward to have your support.</comment></comment></comment></comment>


Announcing werf – a missing part for CI/CD systems with Kubernetes - <AUTHOR> https://medium.com/flant-com/werf-devops-tool-d3f1251a65ab <comment><USER2> What are the advantages of using ansible-based werf setup steps vs. the usual Dockerfile for image + entrypoint script for runtime config?

<comment><USER3> Entrypoint script for runtime config is a universal story for werf and docker. There is no difference between these two.

Werf uses Ansible as a declarative way to build images, not to configure them in runtime. Werf also supports shell scripts for builds.

The main advantages over usual docker build are: \- git history is used to determine what should be run to build image. This can be used to greatly speed up build process on changes. \- mounts of external directories to reduce image size without "apt-get update && rm -rf /var/lib/apt". \- templating in build configuration file (werf.yaml).</comment></comment>


GKE Sandbox: Independent operating system kernel to each container - <AUTHOR> https://cloud.google.com/blog/products/containers-kubernetes/gke-sandbox-bring-defense-in-depth-to-your-pods <comment><USER2> For anyone who hasn't seen this before. There is a pretty good gVisor Architecture Guide that explains how this works pretty well via a few diagrams [1]. Lots more info on these pages too [2, 3].

> _gVisor intercepts application system calls and acts as the guest kernel, > without the need for translation through virtualized hardware. gVisor may be > thought of as either a merged guest kernel and VMM, or as seccomp on > steroids. This architecture allows it to provide a flexible resource > footprint (i.e. one based on threads and memory mappings, not fixed guest > physical resources) while also lowering the fixed costs of virtualization. > However, this comes at the price of reduced application compatibility and > higher per-system call overhead._

From what I understand, basically a user-space program that wraps your container and intercepts all system calls. You can then allow/deny/re-wire them (based on a config). So, you have pretty much complete control over what your apps can do.

This for me, is sort of the key takeway from the blog post too: " _because we use gVisor to increase the security of Google 's own internal workloads, it continuously benefits from our expertise and experience running containers at scale in a security-first environment"_. So, Google's using something like this internally too for their own workloads, which should be a pretty good sign this works in real life.

[1] [https://gvisor.dev/docs/architecture_guide/](https://gvisor.dev/docs/architecture_guide/)

[2] [https://github.com/google/gvisor](https://github.com/google/gvisor)

[3] [https://gvisor.dev/](https://gvisor.dev/)

<comment><USER3> > From what I understand, basically a user-space program that wraps your > container and intercepts all system calls. You can then allow/deny/re-wire > them (based on a config).

gVisor actually intercepts and _implements_ the system calls in the user-space kernel. Two specific goals of gVisor are that (1) system calls are never simply allowed and passed through to the host kernel, and (2) you don't need to write a policy configuration for your application; just put your application inside gVisor and go. These are significant differences over simply using something like seccomp on its own (what the architecture guide calls "Rule-based execution").

Some of this is covered in our security model: [https://gvisor.dev/docs/architecture_guide/security/#princip...](https://gvisor.dev/docs/architecture_guide/security/#principles- defense-in-depth)

<comment><USER4> Reimplementing system calls is non-trivial, especially ones that have complex interactions with others (for example, the system calls related to process management). How do you prevent errors when translating this, and how do you implement features that ostensibly require calls to the OS anyways?

<comment><USER3> For sure, implementing Linux is no easy task, and there is no magic bullet. For compatibility testing, we have extensive system call unit tests [1] and also run many open source test suites. Language runtime tests (e.g., Python, Go, etc) are particularly useful. We also perform continuous fuzzing with Syzkaller [2].

> how do you implement features that ostensibly require calls to the OS > anyways?

gVisor's kernel is a user-space program, so it can and does make system calls to the host OS. Some examples:

* An application blocks trying to read(2) from a pipe. gVisor ultimately implements blocking by waiting on a Go channel. The Go runtime will ultimately implement this with a futex(2) call to the host OS. * An application reads from a file that is ultimately backed by a file on the host (provided by the Gofer [3]). This will result in a pread(2) system call to the host.

The purpose here isn't to avoid the host completely (that's not possible), but to limit exposure to the host. gVisor can implement all the parts of Linux it does on a much smaller subset of host system calls. Anything we don't use is blocked by a second-level seccomp sandbox around the kernel. e.g., the kernel cannot make obscure system calls, or even open files or create sockets on the host (those operations are controlled by an external agent).

[1] [https://github.com/google/gvisor/tree/master/test/syscalls/l...](https://github.com/google/gvisor/tree/master/test/syscalls/linux)

[2] [https://github.com/google/syzkaller](https://github.com/google/syzkaller)

[3] [https://gvisor.dev/docs/architecture_guide/overview/](https://gvisor.dev/docs/architecture_guide/overview/)

<comment><USER5> How is this different than a nicerUI over a seccomp filter for your container?

</comment></comment></comment></comment></comment><comment><USER6> This is a really interesting add-on to GKE and I'm glad to see vendors starting to offer a variety of container runtimes on their platforms.

That said, I'm really not a fan of the opening line where it references the old trope of "containers don't contain"

The idea that it's trivial to break out of any Docker style container just doesn't reflect reality.

Have there been vulns that allow for container breakout, sure there have, but every piece of software (including gVisor) has had vulnerabilities in it.

What you can say about gVisor is that it likely presents a smaller attack surface in its default configuration than a runc style Docker container.

However, of course, there's nothing to stop people tightening up on the defaults and still using runc.

As an aside for anyone who thinks container breakouts are trivially easy, you can go to [https://contained.af](https://contained.af) and win yourself some money :)

<comment><USER7> (I'm a co-author of the blog post)

I generally agree re: trope, but it's useful because I'm not sure the core idea is widely understood outside security circles. Many people assume that containers provide a strong isolation boundary, and while a break-out is not trivial, providing more isolation in some cases is important, as you allude.

While one option is certainly to provide a locked down policy, monitor the flow of kernel CVEs, and patch constantly, this may not be feasible for many organizations if a) they lack the technical expertise or b) don't know the workloads they're running a priori and can't apply a fixed policy.

So different container runtimes are about providing additional tools for defense-in-depth. (VMs are fantastic tool for this, but it's also nice to have tools that play well in containerized infrastructure other than custom security policies.) None of these tools will be perfect of course, hopefully they can make it easier to improve on the status quo.

Re: contained.af, this is a great example of the workloads problem. If you have a known workload where you can essentially disable all capabilities and access to system resources (e.g. no network), there are many options for securing that workload. They aren't all generalizable.

<comment><USER6> Oh I'd agree and gVisor provides (IMO) a smaller attack surface than a default runc container.

With that said both options, and indeed hypervisor based isolation, are generally one security flaw away from a breakout vulnerability, so the only difference in that respect is the incidence of those flaws.

My experience of people's expectations of container isolation is perhaps somewhat different to yours, which is what prompted my initial comment.

It's all too common (in my experience) to see container isolation dismissed using that "containers don't contain" trope, and for me that feels frustrating as the real picture is much more nuanced than that.

It's all about choosing the right isolation technology for a) a given workload and b) a given threat model/attack surface.

There are tradeoffs (both in terms of performance, and in terms of flexibility) in replacing the runc layer with a different container runtime. Sometimes those will make sense, other times not so much :)

All that said I'm very excited to see more options here, as it'll give everyone the choice of what mechanism works for them for specific workloads.

</comment></comment></comment><comment><USER8> GKE Sandbox/gVisor syscall performance is at least 100x worse than virtualization[0], which is huge. Why shouldn't I just run everything in a VM/lxc container instead? Is it worth proxying everything through your syscall broker when I can just trust my hypervisor to be a security boundary instead? [0]: [https://gvisor.dev/docs/architecture_guide/performance/](https://gvisor.dev/docs/architecture_guide/performance/)

<comment><USER7> (I am co-author of the post)

System calls are important, but only one factor. The linked doc is an attempt to clarify and delineate various costs. There are number of platform options (the platform is what does syscall interception), and I don't believe any of them are 100x so to say "at least" is a bit disingenuous. You may have confused the "runsc-kvm" number with "using a VM". "runsc-kvm" is the system call performance of gVisor using the kvm platform, which is not a full VM [1]. In general the syscall cost in a VM depends entirely on the guest OS, since there is no VMEXIT for this operation.

VMs are a valid choice depending on your workload, and this is providing an additional tool that provides an easy control for containerized infrastructure. You can use what works for you. Native containers certainly work as well, but you'll probably want to consider additional security controls of some form if you're really running untrusted stuff in there.

[1] [https://github.com/google/gvisor/tree/master/pkg/sentry/plat...](https://github.com/google/gvisor/tree/master/pkg/sentry/platform/kvm)

<comment><USER8> You're right, that's not the chart I wanted to see. I'm just dubious that reimplementing lots of the Linux kernel in Go while paying the cost of the ptrace interception is worthwhile. It seems like you're just adding a lot of attack surface (admittedly managed code > native code) with a large perf impact. Do you have any docs on how the kvm-runsc platform works? Skimming the files, I don't see some of the bits necessary for a bluepill style hypervisor, so I'm not sure why parts are named bluepill in there. I also don't see a lot of the linux kernel paravirt vdev code I would expect, and you seem to imply that you're not telling KVM to enable syscall trapping for the guest.

<comment><USER7> I'm not sure what you mean by KVM syscall trapping for the guest. The bluepill refers to the fact that the Sentry runs transparently in VMX non-root ring 0 and regular host ring 3.

I'm not sure what to provide re: docs -- the code is all there, reasonably documented and there are discussions on the public groups of how the KVM platform works. I feel a bit like you're coming in with a specific set of ideas and skimming files (e.g. the performance guide and the code itself) in order to confirm an existing understanding, but it's just not working.

I'd love more precise criticisms re: adding to the attack surface, but otherwise I'm not sure how I can help.

<comment><USER8> I'm very skeptical about the platform and don't have the time to devote to reading the codebase or having conversations as I would like. The TL;DR is that the syscall interception technique seems expensive and I wonder if you will write all sorts of logic bugs in the sentry broker. It seems like you folks care about security, and have some good ideas, but if you really care about hostile multi-tenant containers, why not stick the container in a VM and call it a day?

<comment><USER9> I replied in other comments but our talk at Next'19 [1] includes a story by one of our customers, which may help understand the use cases. In a nutshell, GKE Sandbox should allow sharing the resources of GKE Nodes (VMs) among multiple tenants.

[1] [https://www.youtube.com/watch?v=TQfc8OlB2sg](https://www.youtube.com/watch?v=TQfc8OlB2sg)

</comment></comment></comment></comment></comment></comment><comment><USER10> Isn't this server-side react rendering? What are we doing?

We started with virtual machines and then thought, no, we can share a kernel and do this without the overhead. Now we want each of our containers to have their own kernel. This is full curcle... why not just fire up a VM? Am I missing something?

Firecracker doesn't have the product vision behind it to do this, but at some point we will have a microvm technology with the ergonomics of containers and then we'll be WAY closer to true portability and better security.

<comment><USER7> (I'm a co-author of the blog post)

Many functions of the kernel are still effectively shared: memory management (e.g. reclaim, swap), thread scheduling, etc. The application is simply limited in its ability to interact with the shared kernel, and functionality related to system APIs is isolated. Arguably I think this is closer to the ergonomics of containers, but with compatibility and performance trade-offs.

</comment></comment><comment><USER11> The only advantage I see to containers over VM is RAM sharing. Beyond that, hardware VM's are better performing and much more secure.

gVisor is just another flavor of containers that replaces kernel interfaces with a Go shim layer to reduce the attack surface in return for worse performance.

If somebody could hack ram sharing/overcommit into traditional VM's all this container nonsense could be dispensed with. Containers are a virtualization layer just like the old days when we used the JVM to run "safe" applets on client machines. Like the JVM, the attack surface will always be huge and security issues nearly endless.

</comment><comment><USER12> I have read that all containers at Google run inside of a VM and indeed that article mentions that gVisor is in use in things like App Engine and their internal workloads.

So if containers on GKE were already being spun up inside lightweights VMs what does allowing customer's to select the gVisor runtime offer beyond whatever Google's existing lightweight VM already provides?

<comment><USER13> Other way around: Everything at Google runs inside a container, including the VMs

gVisor lets you run multiple untrusted workloads on the same VM, in this case a GKE node.

<comment><USER12> What would running a VM inside a container provide in terms of security and isolation that just running a VM would not?

This ACM article from a few years ago written by folks that worked on Borg/Omega/Kubernetes states:

>"The isolation is not perfect, though: containers cannot prevent interference in resources that the operating-system kernel doesn't manage, such as level 3 processor caches and memory bandwidth, and containers need to be supported by an additional security layer (such as virtual machines) to protect against the kinds of malicious actors found in the cloud."[1]

Also see slide 13 of Joe Beda's talk from a five years ago shows the container running in a VM not the other way around:

[https://speakerdeck.com/jbeda/containers-at- scale?slide=13](https://speakerdeck.com/jbeda/containers-at-scale?slide=13)

[1] [https://queue.acm.org/detail.cfm?id=2898444](https://queue.acm.org/detail.cfm?id=2898444)

<comment><USER13> (I work for GCP)

It looks something like this:

your container -> Compute Engine VM (GKE Node) -> container -> Borg

The container on top of Borg is used for scheduling and management. Joe's talk has a slide on this. As a GCP customer, you never have to worry about this or care about it, as it is an implementation detail.

>"The isolation is not perfect, though: containers cannot prevent interference in resources that the operating-system kernel doesn't manage, such as level 3 processor caches and memory bandwidth, and containers need to be supported by an additional security layer (such as virtual machines) to protect against the kinds of malicious actors found in the cloud."

As a GCP customer using GKE, your applications are separated from other GCP customer using VMs.

However, if you want to run your OWN untrusted workloads, then in the past you would have to spin up a separate VM for untrusted workload A and a one VM for untrusted workload B.

This sucks in terms of resource utilization. It would be better in many cases if you could run workload A and B on the same VM. That's where gVisor comes into play.

your untrusted container -> gVisor -> Compute Engine VM (GKE Node) -> container -> Borg

I hope this makes sense!

<comment><USER12> Thanks for the explanation, this makes sense yes.

>"The container on top of Borg is used for scheduling and management."

Is this the "open source node container manager" box on slide 13 then? I'm guessing this is the Borg's version of the kubelet then?

[https://speakerdeck.com/jbeda/containers-at- scale?slide=13](https://speakerdeck.com/jbeda/containers-at-scale?slide=13)

<comment><USER9> That's a very old slide :) I "guess" the slide deck was talking about [https://cloud.google.com/compute/docs/containers/deploying-c...](https://cloud.google.com/compute/docs/containers/deploying- containers)

<comment><USER12> I see. So is "the container on top of Borg is used for scheduling and management" the Borg equivalent of the K8S kubelet then?

<comment><USER9> As you can see from the Borg paper [1] and the name, "borglet" is the most closest component to "kubelet".

[1] [https://pdos.csail.mit.edu/6.824/papers/borg.pdf](https://pdos.csail.mit.edu/6.824/papers/borg.pdf)

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER14> I quite like this defense-in-depth approach, but it's disappointing that it will only be available as part of the probably expensive GKE Advanced. I would have thought safety features should be standard..

<comment><USER15> I think either way control plane is free now?

<comment><USER14> Well gVisor doesn't use the control plane. It is free, but I wouldn't think it has a high cpu or memory load, and Google would make a lot of profit on the nodes.

<comment><USER15> I know but they may conceivably just charge fixed fee for enabling that option on the nodepool.

> it has a high cpu or memory load, and Google would make a lot of profit on > the nodes.

They currently solve that problem by having their node VMs melt down at like 50% utilization so you have to run everything with huge padding.

</comment></comment></comment></comment><comment><USER16> Sandboxed containers with kernels - so what's the difference now between this and fully isolated virtual machine?

Another approach might be to make virtual machine technology more like containers. Then the two shall meet.

<comment><USER17> I didn't dig into the implementation details but the term para-hvm came to mind, not quite para virtual but not quite full hvm. Perhaps if security is a real issue then HVM is the only real choice.

</comment></comment><comment><USER18> For those more familiar with Kubernetes and gVisor, would this allow me to build a CI/CD service that runs untrusted user code?

<comment><USER6> Well like all things in security, that kind of depends :)

What gVisor does is provide a smaller attack surface to a containerized process, when compared with a "traditional" Docker container using standard Docker setup (you can, of course harden Docker containers considerably from base, if you are so inclined).

However it doesn't affect anything outside of that interface so, for example, if your CI/CD process is running on a network that has other insecure services on them, then gVisor alone won't really help you if malicious code is executed inside a container allowing an attacker to start probing the environment from the perspective of that container.

</comment></comment><comment><USER19> gVisor is easy to run in on your local dev laptop Docker too. It's a nice alternative to running Docker in a VM, if you prefer a security boundary between random Docker containers you get off Docker Hub and your host machine.

After you built or downloaded the gVisor single binary to /usr/local/bin/ or wherever, just put a snippet provided in the gVisor README in the Docker settings file ("runtime": {...}), and bob's your uncle.

</comment><comment><USER20> At this point, why not just use a virtual machine? We've come full circle!

<comment><USER21> Mostly the performance characteristics. A virtual machine presenting as a _machine_ needs an operating system to be useful. Most operating systems have long-engrained assumptions about the nature of the world, such as:

"There is a time when I go from power-off to power-on, and it is rare, so I may perform expensive operations then to amortise their cost over running time".

or

"While running, time does not skip and hardware does not change".

The practical upshot being that the OS needs to be booted from scratch in a number of scenarios.

But it's not the OS that provides value. It's a means to an end, and that end is to run software. Most software written to run on OSes _also_ have engrained assumptions, such as "I will come to be launched on a fully-booted system".

Containers move the virtualisation up from hardware to the OS API surface. Because the cost of booting is now amortised over all containers running on the system, the original assumptions of both OS designers and software designers become, approximately, true again.

So you're right, we came full circle, but not to a point that means "use fully-dressed VMs again".</comment></comment>


"F# async on the server side" - node.fs in waiting? - <AUTHOR> http://lorgonblog.wordpress.com/2010/03/28/f-async-on-the-server-side/ <comment><USER2> The article compared "async" C# to async F# and makes the claim that F# is better because of the lighter syntax. The only problem is that they're using the wrong version of C#. C# is expected to get the same async feature in the next version. Version 4 brought dynamic features to C# and completely changed the language. Version 5 is expected to bring async and change how people use C# again.

It's really slick and MS should really be commended for their work on it. It makes writing asynchronous code as straightforward as writing regular code. No crazy callbacks. That's what is so great about the CLI. All the .NET languages get an upgrade when the CLI gets an upgrade. All the work done to support Python and Ruby on .NET led to the dynamic and functional features of C# 4.

<comment><USER3> But F# is stable, officially supported (as one of the three - VB.Net, C#, F#) - and comes with this _now_.

I like the language a lot and think that it has great potential. It's a shame that there's so little weight behind it so far, ignoring niche markets (banks for example).

<comment><USER4> It took Python and Ruby over 10 years to break into the "big time". F#, while really cool, still doesn't have its "killer app" to drive adoption.

Keep in mind, F# only _just_ became a first-class language in the MS suite with VS2010. Give it time.

<comment><USER5> And they didn't release an f# express, you have to install shell and then install the f# runtime on top of that, instead of just one simple install the way c# and vb.net is. It isn't the end of the world but seems stupid if they want to increase adoption of the language.

<comment><USER6> That's because it's not an Express -- i.e. stripped down -- version. It's the full package. You can easily use F# from the command line, as you can with Ruby and Python. F# is also open sourced [1], so you can also build and run it on *nix with Mono [2]. Why would I want an Express edition?

[1] <https://github.com/fsharp/fsharp> [2] [http://chrismarinos.com/f-on- ubuntu-linux-with-mono-and-mono...](http://chrismarinos.com/f-on-ubuntu-linux- with-mono-and-monodevelop/)

</comment></comment></comment></comment></comment><comment><USER7> As soon as I saw node.fs, I knew it had to be done in F# (preferably with Mono). It's just too good not to be done. All the goodness of functional- reactive servers with the .NET pantheon of libraries thrown in.

I especially like the code/time comparisons at the bottom. For those C# and other .NET guys, yes, you can do the same thing in any .NET language. That's not the point. What F# brings is the ability to think and write code in a quicker, more concise manner that's also more error-free. Modern coding environments are more and more lending themselves to FP.

</comment><comment><USER8> It would be great to see an F# aync http server combined with something like WebSharper(which allows writing a lot of javascript in F#).

<http://websharper.com/samples/Canvas>

<http://websharper.com/samples/WebGL>

Get it to work on Mono and it would be Mono and F#'s killer app(stack).

<comment><USER6> Working on it... ;)

<http://github.com/fractureio/fracture>

</comment></comment><comment><AUTHOR> NB I found this after listening to a podcast about IronJS, during which Fredrik Holmström mentioned that F# would be a much better starting point for an async http server.

<comment><USER8> He wrote this blog post today.

[http://ironjs.wordpress.com/2011/06/22/my-gripes-with- javasc...](http://ironjs.wordpress.com/2011/06/22/my-gripes-with-javascript/)

</comment></comment><comment><USER9> _cough_

There are things like <https://github.com/panesofglass/frack> already. That's not the only one. This entire approach running on the stack and frameworks it can is a massive deal, and running silent at present.

</comment><comment><USER10> For semi-related further reading, here is the second in a blog series extending async F# in the context of developing GUIs:

<http://tomasp.net/blog/safe-gui-async.aspx></comment>


Aphinity – Social meetup app – Find people and events based on similar interests - <AUTHOR> https://aphinityapp.com/ <comment><AUTHOR> I am working on a social platform to facilitate meetups based on similar interests and experience. This would be perfect for travelers wanting to meet locals, students, communities & organizations, and anyone else looking to expand their social network.

The design phase is done and we are launching a fundraiser soon to help with the development of the app. If you're interested, sign up to the mailing list for exclusive promos and to stay updated: [http://eepurl.com/gKz81H](http://eepurl.com/gKz81H)

</comment><comment><USER2> I'm genuinely interested but there are a few meetup clones on github, & getting traffic to an app like this is a hard task even in the best of times. Right now seems like a particularly rough time for this. Do you have any insights on how to get people using your app? Maybe all the events & meetups could be COVID safe?

<comment><AUTHOR> Hey, great question. I've spent a lot of time looking through all those meetup clones, I know what you're talking about. For me, they were very barebones and no different from regular facebook searches.

Our platform personalizes your experience. Matching up with others will take into account your personal interests so you will get curated results. You will also be able to see relevant events, rather than having to sift through hundreds of events. A curated feed means you might find something you haven't considered before. All in all, the aim is for a tailored experience.

Once the situation resolves, I think people will want to socialize more than ever, since we realize how different things can be without steady real-life social networks.

We already have several groups committed to using our platform for group coordination once we launch, and pre-existing groups will help gain traffic quickly. Definitely subscribe to our mailing list, as we plan to offer beta access and other perks. Thanks for your support!</comment></comment>


Taboo language turned the wolf into a monster - <AUTHOR> http://nautil.us/issue/81/maps/never-say-wolf <comment><USER2> We literally don't know the oldest word(s) for "bear" as a result of this sort of practice.

bear means "the brown one". The common explanation is that bears were either objects of cultic veneration or seen as kinda human or some combination thereof, so their true name was hidden — as a measure of respect or fear or honor. or some combination of the three.

Allusive and indirect names then got applied to "bear" too — a common scholarly opinion is that "Beowulf" is "Bee-hunter", a bear. (Though opinions differ there).

[https://www.etymonline.com/word/bear](https://www.etymonline.com/word/bear)

<comment><USER3> In Russian it's 'medved', i.e. the one who knows about the honey ('mead-wit' would be the exact English cognate).

<comment><USER2> is it "knows" or "eats" or "finds"? i've heard all three

<comment><USER3> ved = 'know' in Slavic, comes from this PIE root: [https://en.wiktionary.org/wiki/Reconstruction:Proto-Indo- Eur...](https://en.wiktionary.org/wiki/Reconstruction:Proto-Indo- European/weyd-)

<comment><USER4> Literally the same source suggests that "honey-eater" is a folk etymology, probably false: [https://en.wiktionary.org/wiki/Reconstruction:Proto- Slavic/m...](https://en.wiktionary.org/wiki/Reconstruction:Proto- Slavic/medv%C4%9Bd%D1%8C)

</comment></comment></comment></comment></comment><comment><USER5> I've heard this story a few times now, and every time I hear it I question it a little bit more.

Swedish has cognate "ulv" which is synonymous to "varg". It's not used much anymore, but I think it fell into disuse fairly recently. Reading fairy tales from 1800's and early 1900's you are bound to encounter it.

And alternate spelling "Ulf" is a top 50 first name in Sweden.

In summary I don't think a taboo is an explanation in this case.

EDIT: Oh and the word for werewolf is varulv.

</comment><comment><USER6> In the case of Latin, the word for fox is vulpus, which is a direct evolution of the indo-european root. In this case, the problem is less of a taboo word than of an appropriation of the sense to a different animal.

<comment><USER7> There's a comment on the story itself that says this, with a reply pointing out that it's not "vulpus" but "volpes", which evolved from a slightly different proto-Indo-European root.

</comment></comment><comment><USER8> In Hungarian it's a similar situation: the usual word for wolf is "Farkas", which means "with tail", i.e. "tailed one".</comment>


A Millionaire Mindset Never Made Anyone Rich - <AUTHOR> https://www.bloomberg.com/view/articles/2018-04-06/a-millionaire-mindset-never-made-anyone-rich <comment><USER2> This is a bit rambling, but I always find that whole genre of literature ("highly effective habits" style literature) to be really fascinating, mostly because it doesn't totally make sense to me.

My thinking has always been that the Gates/Obamas/RBGs of the world didn't overly concern themselves with trying to emulate previously successful people. Not that they didn't take lessons from them, but that it wasn't so overt. No sense of, "if I just imitate these 5 behaviors of Andrew Carnegie I'll be successful".

And maybe indeed the problem is that those individuals weren't just trying to be successful for the sake of being successful, which is sometimes the feeling I get from reading articles like the ones mentioned.

Obviously, I could be entirely wrong or missing the point of literature like that. And as the article notes, there's some generally beneficial advice in there (living below your means, for example).

Still, it seems like if your goal is to become the next Madeleine Albright, you should emulate her by not trying too hard to emulate her!

<comment><USER3> That's because (like many genres of literature that claim to know the secret to becoming rich and successful), the writers really don't know what makes that the case. So they're taking surface level qualities they see in successful people, and assuming that's at least part of the reason for their success. It's just cargo culting really, like those tribes who build airports out of wood because they think that causes supply planes to land.

<comment><USER4> I remember a great comment on HN once about this very subject.

They said it's like taking a 1000 people, having them flip a coin and eliminating anyone with tails. Once you're down to ten people, you ask them how they did it, what made them flip so many heads in a row.

I think the name of it is called "survivorship bias".

</comment></comment></comment><comment><USER5> Weird article. Seems to agree there is an effective version of a 'millionaire mindset' and then attacks a strawman version of it that only 'The Secret' types would promote. And even they probably aren't completely wrong.

<comment><USER6> While I agree that the strawman "hustler's ethic" presented by the article is false, there are mindsets that correlate with wealth.

There are numerous sociological studies presenting the high correlation between conscientiousness and income/wealth [1]. It would be very difficult to separate the cause and effect, but in action you are left with a Pascal's wager scenario:

Knowing that conscientiousness correlates to wealth, and knowing conscientiousness to be a virtue in and of itself, should you try build a mindset rich in conscientiousness?

The conclusion seems obvious to me. It's possible that you can't change your personality enough for it to matter, but that's just another facet of the Pascal's wager.

[1][https://www.ncbi.nlm.nih.gov/pmc/articles/PMC3498890/](https://www.ncbi.nlm.nih.gov/pmc/articles/PMC3498890/)

<comment><USER7> I'm curious that you're using Pascal's wager as an argument _for_ believing in something, when almost everyone uses it as an illustrative example of flawed reasoning. Do you also believe in God because of Pascal's wager?

<comment><USER5> I don't know about every objection to Pascal's Wager, but overall it's quite different. In PW it's the belief itself that might be the key to heaven, and you can't have an authentic belief that you adopted simply because you had an incentive to adopt it. With conscientiousness it doesn't really matter what you believe or how strongly, all you have to do is behave conscientiously and see if it helps.

<comment><USER8> The objection is that you have 5 major world religions to choose from, there could be 1,000 to 1,000,000 minor religions to choose from, the gatekeeper of heaven might be selecting only non-believers who non-believe for the right reason, the gatekeeper of heaven might have an even more arbitrary or unpredictable criteria than laid out by your geographically predetermined choice of religion. The religion could represent actual spiritual phenomenon, but the entities could have lied about who they are or what's to be expected. Not to mention that we could be a random occurrence of life in a universe created for a set of aliens we could never meet. The wager is flawed because you have to consider a near infinite number of evidence-less hypothesis about getting to heaven, which might not exist or might not even have a gatekeeper.

</comment></comment></comment></comment></comment><comment><USER9> Luck is the biggest millionare maker. Yes, preparation and opportunity do matter, but being born into the right circumstances is just plain old luck.

</comment><comment><USER10> > Millionaires don't waste their mental bandwidth on how much a caramel > macchiato costs.

This isn't exactly big data, but the few wealthy people I've met (single-digit millionaires) were extremely frugal people.

<comment><USER11> If you make 150k and frugally save over 20 years or so, you can be a single- digit millionaire. To be a billionaire, you have to play a different ballgame.

<comment><USER10> Are you either a millionaire or a billionaire?

<comment><USER11> Don't you think that a millionaire or billionaire giving you their experience and guidance would be subject to survivor bias?

<comment><USER10> Sorry, how did you jump from my question to asking a seemingly unrelated question?

</comment></comment></comment></comment></comment><comment><USER12> I suspect IQ plays into it, the ability to think.

But, very few people really want to be rich. They fantasize about it but then go about working a job that can never get them rich. It's probably better that most people's priorirites are family, friends, etc.. than just grabbing up money.

However if the goal is just to get rich, and my kid or something really wanted it, Id say,

1\. You have to be prepared to live your life in a way where you take complete responsibility for your actions and results. Most people cannot do this. Its always someone or somethings fault when things dont go well, or attributed to luck. Luck does exist in the world, but your goal is not to be lucky. Your goal is to control what factors you can so bad luck can't knock you off track.

2\. Pick the right job. You have to either be a person who makes money from others' labor (business) or have some very special talent where you as an individual contributor makes extremely outsized salary.

3\. If the goal is millionairre rich, get a moderately high paying job >100k, work for a couple decades, and live like a pauper. You'll become a millionairre. If the goal is billionaire rich, you need to be on the ground floor of something thats going to be huge in the next 20 years (ie.. the Internet).

Starting a business in a mature industry, you have more problems with competition, that is, pricing power, and competing against established players for customers, and also for labor, etc..

</comment><comment><USER13> A millionaire mindset has definitely made more than one person poor, though!

</comment><comment><USER14> Changing a mindset is the first step to something new.</comment>


Ink (YC S12) Releases New iOS Layer That Allows Apps to Interact, Share Data - <AUTHOR> http://techcrunch.com/2013/08/15/inks-new-mobile-framework-lets-ios-apps-talk-to-each-other-share-data-you-know-like-on-android/

<comment><USER2> I'm struggling to see what is the difference between the native iOS UIActivity vs Ink.

[http://developer.apple.com/library/ios/documentation/uikit/r...](http://developer.apple.com/library/ios/documentation/uikit/reference/UIActivity_Class/Reference/Reference.html)

I thought that's what UIActivity does and many applications are already using this particular feature to share photos between apps.

<comment><USER3> The primary difference is that Ink allows for applications to register new actions across applications, and to launch content directly into other applications as well. Think of Ink as a cross-application version of UIActivity that's open to anyone registering handlers, as opposed to only being able to use the UIActivity's of your own app or the system provided ones.

</comment></comment><comment><USER4> I wonder if Apple will approve this, as it seems to allow the iPhone to do something that Apple doesn't want it to do?

If Apple wanted apps to talk to each other in the (IMO very sensible) way that Android does, wouldn't they have done so?

<comment><USER3> We've been working with apple since WWDC, they know what we're doing and are fine with it.

<comment><USER5> Are you afraid they are using you for market verification?

<comment><USER3> Not particularly. In a sense larger, established companies are always looking at startups for market verification; the startups that succeed are the ones that can out-pace the established companies.

In addition, there are market dynamics that preclude any of the larger players truly building a platform for interoperability. See for example the recent Google/Microsoft turf wars, that Mailbox only supports attachments from Dropbox, iOS native composer only works with Mail and not gmail, etc.

<comment><USER6> I'm curious how the inter-device communication will work. Will I be able to send data from my iPad to my Android phone, for example? That would be pretty slick if so.

</comment></comment></comment></comment></comment><comment><USER7> Is this secure enough that a local password manager (like 1Password) could responsibly use it to pass credentials into apps?

<comment><USER3> The current release candidate (v0.4.0 - [https://github.com/Ink/InkiOSFramework](https://github.com/Ink/InkiOSFramework)) does not do end-to-end encryption between apps, so we would want to work with them to add in AES256 at a minimum before I'd recommend sending over passwords.

It's both technologically possible to make this secure enough and on our roadmap for the next major release.

</comment></comment><comment><USER8> The article brings up a great point. This tool is so esencial I wonder why is it that Apple and Android have not made this natively much simpler. Seems like a great venture to be a part of.

<comment><USER9> > Android have not made this natively much simpler.

This is already amazingly simple on Android natively though. This is an attempt to make it similarly simple on iOS.

<comment><USER3> Intents has done a great job on android - I have some minor quibbles with it, but it's light years ahead of what iOS had pre-Ink

Edit since I can't reply to milesokeefe: As an avid android user (Galaxy Nexus), some things about intents that I feel are poorly designed: \- No support for bidirectionality. There's no sense of "I'm done with this action, take the results and send it back" \- No sense of intelligence in terms of what actions are shown. As far as I can tell, it seems to be filtered by content type, sorted by Most Recently Used. \- Unclear actions - iOS suffers the same issue, where it's not really clear what it means to open in another application.

<comment><USER9> > No support for bidirectionality. There's no sense of "I'm done with this > action, take the results and send it back" -

Doesn't startActivityForResult fit this use case?

> No sense of intelligence in terms of what actions are shown.

I agree here, it can be annoying to pair down the list of applications which will handle an intent. If one wants specific applications one can use the package manager to check its existence and then use that.

<comment><USER10> You can also reduce the list before presenting it to the user.

</comment></comment></comment></comment></comment><comment><USER11> A short description of how it works would probably go a long way for developer adoption. There doesn't seem to be any.

The most obvious way to implement this might not work the same in iOS 7 -- I'd want to know more before relying on it.

<comment><USER3> Re. how it works behind the scenes, we do a streaming protocol over UIPasteboard, with actions being cached locally and periodically updated from the servers when connection is available. At least for now - we will continue to iterate on the underlying tech to make it faster/more reliable/more secure.

Re. iOS7, it required being a bit more clever, but Ink works with iOS7.

Give it a try, let us know what you think.

</comment></comment><comment><USER12> I wonder is this going via the internet anyway, or just using the pasteboard thing.

<comment><USER3> We do the data transfer locally on the device. We had an early prototype that did things over the web, but it was too slow and was frustrating to use on 3G.

Edit for clarification: the transfer occurs locally and works while offline.

<comment><USER12> Locally would certainly be preferable (especially for iPads, where the user may not even have an internet connection).

<comment><USER13> And let's not forget that even iPhones can be away from cellular coverage.

</comment></comment></comment></comment><comment><USER3> Our announcement at [http://blog.inkmobility.com/post/58338915828/announcing- the-...](http://blog.inkmobility.com/post/58338915828/announcing-the-ink- mobile-framework)

</comment><comment><USER14> Can't you just use IPC and basic file I/O, rather than tech bubble 2.0?

</comment><comment><USER15> Amazing job, excited to see where this goes.

</comment><comment><USER16> Isn't this Apples job?

<comment><USER17> I have a feeling it will be.</comment></comment>


What if middle-class jobs disappear? - <AUTHOR> http://www.american.com/archive/2011/november/what-if-middle-class-jobs-disappear

<comment><USER2> me thinks this is very important topic to consider...cause this is happening at an intensifying pace all over the globe

<comment><USER3> Are you sure? Is it a measurable phenomenon, or our perception?

I don't know where you are on the globe, but here in the US, the trades have increasing shortages. Even employers offering on-the-job training are failing to find enough qualified* applicants.

The problem is that the social status of these fields has fallen dramatically. The guy who pumps septic tanks in my hometown bills more per hour than the lawyer, yet nobody there hopes their kid will skip college and work on septic systems instead, nor would any out-of-work paper pusher I know consider taking the job (even if it meant making more money than he used to).

Our middle class is most hurt not by the changing nature of middle-class jobs, but the changing perception of them. As recently as the 70s or 80s, the guy who fixed your septic, installed your air conditioner, or fixed your car was considered an important part of society -- the very image of middle-class America. Now he's treated like a loser for not having a degree.

How many people who identify with the American middle class go seek new careers that they and their peers see as lower class, even for middle class wages? I don't know, but my gut and anecdotal observation say "not enough". Changing careers is _really_ hard for some people -- how many will make it while their friends and neighbors look down on them for working a dirty job?

* In this context, "qualified" is roughly equivalent to "will show up on time, won't steal or destroy stuff, will behave decently toward coworkers and customers, can read, can follow directions and learn to turn a wrench". So, not looking for rocket scientists, just basically hard-working folks.

<comment><USER4> OK, but the economy can only support a certain number of tin-knockers, plumbers, septic-tank cleaners, janitors, etc. These jobs exist because there are other people with other jobs that can pay for these services.

The reality is that when folks have bills to pay, considerations of "status" will only last for a few months. A few months of unemployment and depleted savings will make _anyone_ reconsider what jobs are "beneath" their abilities.

Finally, its not like anyone can be a septic tank cleaner. It takes a bit of knowledge, the ability to develop a customer base, significant equipment, and is restricted to certain geographic locations (where people don't have sewers).</comment></comment></comment>


Metro UI on iPhone & Android using HTML/CSS & JS - <AUTHOR> http://m.microsoft.com/windowsphone/en-us/demo/index.html

<comment><AUTHOR> This is just a demo for iPhone & Android owners but fairly convincing none the less.</comment>


Ask HN: Best Back end web-frameworks for startups in 2017? - <AUTHOR> <comment><USER2> It's still Django obviously. You can never go wrong with Django. Mature and battle tested.

I think it will be easier to hire for Django as there are more Python devs and they can learn Django quickly if they don't know it already.

Second choice would be RoR if you want to be fancy but might be little it harder to hire for.

</comment><comment><USER3> I'm partial to Compojure API ([https://github.com/metosin/compojure- api](https://github.com/metosin/compojure-api)). The thing I like about it, is at the point where I've just scaffolded a barely functional prototype, I also have a spec and interactive documentation. That documentation serves as the service's first UI. UX peeps think I am sadistic, but I like having the controls embedded in the manual.

It is also very beautiful. If you look at the examples, there are few forms (keywords, in other languages) that are not related to the domain of an HTTP API. The code is dense, but rich in relevant information.

If you want to explore the underlying architecture, look up the Ring project. It contains the lower level server primitives that several web frameworks are built on top of.

</comment><comment><USER4> Ruby on Rails! It's a beautiful framework. It's nice to work with and batteries are included. It is well tested and battle hardened in many production environments. Give it a shot!

</comment><comment><USER5> The ones you feel the most comfortable with.

<comment><AUTHOR> You need to take into account new hires, development speed, community, maintainability, etc...

</comment></comment><comment><USER6> Laravel

Tons of PHP programmers and PHP is a lot more mature language now.

<comment><USER7> Recently used Lumen in a project. Very nice microframework based on laravel packages and a faster router.

With PHP7, I recommend reading the RFCs too. Some nice stuff on the way.

</comment></comment><comment><USER8> Intersystems Cache ObjectScript and Ensemble! The language is battle tested (~60 years old) and no need to worry about setting up database connections because the language has a persistence built in!

The Ensemble integration engine has adapters for almost any web protocol you can imagine and make it a breeze to create microservices.

</comment><comment><USER9> I'm really productive with Symfony, so Symfony it is.

</comment><comment><USER10> I'll vote for Ruby on Rails unless my app has heavy frontend requirements (Single page apps, complex ui interactions).

<comment><AUTHOR> what's best for complex UI interactions?</comment></comment>


NSA song - <AUTHOR> http://www.youtube.com/watch?v=cVUIk6nXVcw

<comment><AUTHOR> Strange, how comes that Youtube deactivated the rating for this song?

This can be interpreted as a kind of censorship, which is really not a good sign for Google.</comment>


Get Facebook friends data and save them as json file - <AUTHOR> https://twitter.com/blaz_boy/status/445954978063319040/photo/1

<comment><USER2> I wrote this script in order to create a friend list which excludes my parents: [https://gist.github.com/mdesantis/9638125](https://gist.github.com/mdesantis/9638125)</comment>


Show HN: Dongxi – a place for sharing and tagging - <AUTHOR> http://dongxi.co <comment><AUTHOR> Why we have such a product?

Dongxi means thing(s) in Chinese.

Everyday we are surrounded and eroded by numerous information, passively accepting a variety of sources of information. We cannot deny those sources, or deny those information. Information should be valuable, should have specific value for people with distinct background. Then should we have that RIGHT to make the decision that what is valuable or what its value is for what we see and what we hear? At least I hope so. That's why I make Dongxi.

What can you do with Dongxi?

First of all, sharing. You can publish articles to share your points. You can just send a few words to share your life. And you can also publish photos. But we limit it to one picture per time. Since we believe that valuable Dongxi (things) should be picked by heart.

Second, tagging. We play with tags here, and basically only tags. You will find out that we have no comments, no heat, no specific voting, and no simple tags you see from elsewhere. Because interactions here are tagging. Dongxi's tagging is combined with commenting, heat, voting and tagging. Just a few words or simply a tap, you can share your ideas and point of view with other people. You like something, tap it, tag it. You don't like something, also tap it, tag it. You agree with someone, tap it, tag it. You disagree with someone, also just tap it, tag it. Plain and simple.

Finally, searching. 20 years ago, when search engine came out, there were a few hundreds or thousands of people using Internet. So people needed search engine to index. Desktop operating system enabled people to generate information, and search engine helps people to index the endless information. Now, we need a product to tag everything with its own value. We need crawlers to get information, we need more that people behind computers and phones to share and tag those websites, links and things that are useful. We have billions of people using Internet, they are sharing intelligence to provide value to the connected world.

What does Dongxi want to do?

Dongxi hopes to tag everything on the Internet, helps people to find what exactly what they want. Providing a value platform to people to use, to share, to tag, to search, to acquire information, to exchange point of view.

Dongxi's adventure begins here. Hope every one of you can join us and grow with us, sharing the value behind Dongxi.</comment>


Show HN: Electricity price API for Bitcoin mining and data scientists - <AUTHOR> http://wattpricer.com <comment><AUTHOR> Still working through some of the kinks on this, curious how other HN members pull this data.

We built some of our own custom stuff for trading leveraging utility prices, but found it laboriously manual....</comment>


Ask HN: How to Uniquely Identify a Person? - <AUTHOR> Let's say I want to create data for every single person in the US, but I want to give that person (and that person only) the ability to delete their own data.<p>Is such a thing possible? Or is the best approximation forcing people to register with a phone number and pretend that it's an ID like everyone else? <comment><USER2> Would a UUID work? Databases use a unique ID to identify data, but I'm not sure why you're asking so maybe your issue is more complicated than I understand?

<comment><AUTHOR> I could make a GUID, but it doesn't do me any good. My goal is for a person to be able to come to my site, and find the record for "Bob Smith, born in 1978", which was automatically generated.

Then, "Bob Smith" would have to prove he is Bob Smith (without me asking for a driver's license or passport, preferably automatically). Once Bob Smith proves he is Bob Smith, he would be able to delete or modify his data on my site.

Basically, I want the user to have the capability to opt out or make adjustments, but I don't want random people opting out other random people.

<comment><USER3> ...I still have the remnants of an RFID device in my left love handle... its now a cyst about an inch in diameter... authentication is a big elephant to eat... lets start from here...

1]- something you know ....e.g a psword or passwd , hash, modulus

2]- something you have ...rfid tag, keyfob

3]- something you are ... biometrics

 _and the ball is served_ [P ' TING ]

...lets look in the mirror

        something you dont know, something you dont have, something you are not...

</comment></comment></comment><comment><USER4> What are the standards for identity elsewhere?

How do you plan on verifying these?

What is the value in the data? Risk?</comment>


Show HN: Hacker Hall - Virtual Coworking - <AUTHOR> https://complice.co/room/hackers <comment><AUTHOR> I got a ton of signups to Complice yesterday via the IndieHackers HN launch ([https://news.ycombinator.com/item?id=12269425](https://news.ycombinator.com/item?id=12269425)) so I thought it would be cool to see if we could coalesce a new little community of people doing pomodoros (25/5 work/break periods) together online.

One of my favorite features of HN is that it lets you limit how much time you spend on it per day. I love systems that work with the users' interests in mind, and I think that this coworking chat does so more than almost any other chat app, because it has clear work periods where people can be productive.

<comment><USER2> I was skeptical but its seems like a tool worth trying. Bookmarked the page and will share it with the rest of my team. We tend to use Zoom todo the same thing. This might turn out to be better.

<comment><AUTHOR> Awesome! Yeah I find it can work very well with teams, including in-person (you don't use the video or chat as much, but it's still cool to be in sync and see what each other is working on.)

</comment></comment></comment><comment><USER3> Cool idea, hope it gets traction.

Somewhat related: I think VR is going to be huge for coworking. If you've used BigScreen ([http://store.steampowered.com/app/457550/](http://store.steampowered.com/app/457550/)) you'll know what I'm talking about. While you can't see peoples faces yet, and resolution in VR is still low, it really does feel like you're working right next to somebody, and I could see it be a thing.

<comment><AUTHOR> Totally agreed. I think I have a few years at least before I need to worry about VR market saturation crowding me out though :P

It's an interesting question of whether it might make sense for me to get into that space with Complice (which is mostly a productivity app—the rooms are just one feature). I can see reasons why that might make sense but I think it's ultimately pretty far from my central value proposition and it would make more sense to partner with BigScreen or something instead.

</comment></comment><comment><USER4> I tried some experiments like this between hackerspaces in Austin and Houston. What I found is that there is little engagement, unless images are "eye level" and at the apparent size of a present person. I'm not sure how well this would work with video chat on the desktop.

<comment><USER5> When actually interacting directly is not the point, it's pretty effective.

<comment><USER4> In that case, let's save some bandwidth and just synthesize the facial expressions. Mostly, it would be work/concentration, with occasional glances of affection towards the "viewer." Of course, we'd probably get this slightly wrong, fall into the uncanny valley, and everyone would be left with the subconscious impression that everyone else hates them, and furthermore is actually an alien doppelganger posing as a an actual human. (Or that everyone else is a grievously defective human who needs to be shunned/euthanized for the good of the species.)

<comment><USER6> I've been curious about what the bandwidth would be like to image recognize my facial expression, encode it and then just send the event stream to a virtual avatar.

<comment><USER7> :)

</comment></comment></comment></comment></comment><comment><USER8> This is a fun app! I love the restrictions of no audio and disabling chat during work periods. Good work!

A nice excuse to try out pomodoros again, too.

</comment><comment><USER9> I first read it as "Don't talk during pornos."

</comment><comment><USER10> Some time ago I saw this similar project posted on HN:

[http://lapface.com/](http://lapface.com/)

Here's the thread I saw:

[https://news.ycombinator.com/item?id=9764241](https://news.ycombinator.com/item?id=9764241)

<comment><USER11> Interesting concept! Too bad lapface isn't working for me. Webcam won't connect.

</comment></comment><comment><USER11> Like someone else said, I enjoy the silent cams and any chatting occurring only during the breaks. Even if you don't care for the pomodoro technique, it can still be nice to sometimes use the breaks of the app as your own breaks.

</comment><comment><USER12> What exactly is a "pomo"?

<comment><USER13> Term taken from [https://en.wikipedia.org/wiki/Pomodoro_Technique](https://en.wikipedia.org/wiki/Pomodoro_Technique) meaning a short period where you're working hard. The basic idea of the technique is that you dedicate 25 minutes to strictly working, and then explicitly give yourself a 5 minute break to do whatever. The idea is if you carve out frequent break time you'll be more efficient and focused than if you're trying to sustain 8 hours of solid focus.

<comment><USER14> It's never worked for me. It takes me 15 minutes to get into a flow. Then the timer rings in 10 minutes and breaks it. An hour of solid work before a break might make more sense for programming.

<comment><USER12> I think there's something to be said for breaking perseveration. I frequently find myself repeating the same wrong solution to a problem, then breaking for the day and solving it in 5 minutes when I start the next day. I don't think a timer is necessarily helpful. Rubber Ducking, pair programming or the venerated technique of asking for help work pretty well too.

</comment></comment></comment></comment><comment><USER15> i think it works better with people you know than looking at strangers working ...

<comment><AUTHOR> Strangers has worked in some of the earlier rooms I've worked with... I think the issue here is that it's basically all strangers to start.

It's easy to add a few new people to some who already know each other, but harder to just throw a bunch of strangers (some of whom are more in troll- mode) into a room together.

</comment></comment><comment><USER16> two years ago we built something similar during the rails rumble: [http://www.higuys.io](http://www.higuys.io)</comment>


Pymake: A Mostly GNU-compatible `make`, Written in Python - <AUTHOR> http://benjamin.smedbergs.us/blog/2009-02-13/pymake/ <comment><USER2> What an excellent piece of documentation on why you should not roll your own build system.

"because I can" is right next to the reasons the author gives:

"Why don't you just hack GNU make itself?

There are some improvements we're interested in doing which just aren't possible within a C codebase:

        * implementing rules directly in Python
        * Condensing multiple invocations of make into a single process

. Python is also about a zillion times easier to hack quickly."

What a totally pointless exercise, if anything he should have spent the time to make the build process _less_ dependent on other packages, not more.

Same with javas 'ant', why on earth does everybody and their brother feel the need to reinvent the wheel.

If you're going to roll out some package try to keep your dependencies to the absolute minimum.

<comment><USER3> According to the comments on that post, building mozilla already required python, so it's not a new dependency.

<comment><USER2> I read those comments before making my post here, I realize it was not a new dependency, hence my 'less'. By adding more cruft that makes the mozilla build more dependent on python there is not 'another dependency' created, but it is harder to get rid of that dependency.

</comment></comment></comment><comment><USER4> See Waf: <http://code.google.com/p/waf/></comment>


The Invention of Nature – The Adventures of Alexander von Humboldt - <AUTHOR> http://sydneyreviewofbooks.com/the-invention-of-nature-andrea-wulf-review/ <comment><USER2> There's a nice article from The Economist about the same book: [http://www.economist.com/news/books-and-arts/21677608-why- pr...](http://www.economist.com/news/books-and-arts/21677608-why-prussian- scientific-visionary-should-be-studied-afresh-man-world)

</comment><comment><USER3> Embarrassed to admit I'd not heard of Humboldt. What an astonishing man, and those are some powerful ripples from his life.

The description of the late 1820s has some notable parallels to today's mood. Gives me some comfort to be reminded there have been dark periods before that we've overcome.

</comment><comment><USER4> This is not so much a review of the book, but a summary of it.

Coincidentally, I'm reading this book right now - my advice would be to read the actual book as opposed to this summary. It is much more lucid, and gives you a deeper sense of the man as a human rather than a list of facts and accomplishments.

</comment><comment><USER5> Anyone know if there's a connection with Mary Shelley? His early childhood, motivation, and preparation for travels (from the article and Wikipedia) reads similarly enough to that of the protagonist of the framing story in Frankenstein that, were his history widely known at the time, it must surely have been an inspiration for it. Either that or there was _something in the air_ and that kind of story was (relatively) common.

<comment><USER6> Google reveals this mention:

[http://darwin- online.org.uk/EditorialIntroductions/Chancello...](http://darwin- online.org.uk/EditorialIntroductions/Chancellor_Humboldt.html)

"Humboldt's world view of one vast interconnected system, through which he drew three-dimensional lines tracing, for instance, rock formations, atmospheric and oceanic currents and ecological communities is probably the most impressive feature of his Personal narrative. The book is a rich store of facts, history and observations which Darwin and many other writers have been plundering for almost two centuries. While still a great travel story, it is perhaps too prolix for modern readers and the ratio of science to (somewhat tedious) history certainly shrinks in the later volumes. Nevertheless, few books can provide such an insight into a world divided between 'Old' or 'New' in a way very hard to appreciate today. When Mary Shelley wrote Frankenstein in 1818 she had his 'creation' declare that he and his bride 'will go to the vast wilds of South America', a place as far from 'civilisation' as possible where they can do no harm. Those vast wilds were probably known to her from the Personal narrative."

</comment></comment><comment><USER7> I second the recommendation of this book. I also read this year a historical novel that features Humboldt which provided an engrossing opportunity to experience his world in a different way. Also highly recommended.

David Kehlmann, Measuring the World [https://www.amazon.com/Measuring-World- Novel-Daniel-Kehlmann...](https://www.amazon.com/Measuring-World-Novel-Daniel- Kehlmann/dp/0307277399/)

</comment><comment><USER8> This was in my top 5 books I read last year. Highly recommend it.

One good thing about it is it also includes biographies of lots of other interesting greats like Darwin and Muir.</comment>


Thread about China, Culture, Huawei, IP Theft and 5g - <AUTHOR> https://twitter.com/adamscrabble/status/1126902416492855297 <comment><USER2> Just go on the twitter thread. There's plenty of actual articles to do the same on here...</comment>


Y Combinator's winter class - <AUTHOR> http://www.siliconvalley.com/venturecapital/ci_5657754?nclick_check=1 <comment><USER2> It's the same thing that was posted here last week, just a list of names of the companies and a one sentence description.

If you go to the homepage and search for "combinator" the article will come up and you don't have to register.

</comment><comment><USER3> Can someone paste the article--or excerpts from it? Login required.

<comment><USER4> _Login required._

Use this: <http://www.bugmenot.com/></comment></comment>


Show HN: Unit Testing an Express.js Middleware with Sinon and Mocha - <AUTHOR> https://github.com/alexellis/express-middleware-sinon <comment><AUTHOR> This is a really practical worked example of using Sinon to test a middleware. If you want to get started... give this a read and let me know what you think.</comment>


Facebook recommends psychiatrist's patients friend each other - <AUTHOR> http://fusion.net/story/339018/facebook-psychiatrist-privacy-problems/ <comment><USER2> Moral: don't use users' contact lists to bootstrap or enhance social services. Barring strong differential privacy implementations, it will cause problems.

Implementing a 'what friends do I have on this service?' feature is one thing. Retaining that data and feeding it in to the recommender is very likely to cause this kind of problem.</comment>


Ask HN: Does anyone else also have a thick black line at the top of the screen? - <AUTHOR> <comment><USER2> Yes, it's an HN tradition to acknowledge the passing of notable figures in the community. On this particular occasion, the individual is Larry Tesler.

[https://news.ycombinator.com/item?id=22361282](https://news.ycombinator.com/item?id=22361282)

<comment><USER3> And/or Bert Sutherland.

[https://news.ycombinator.com/item?id=22370667](https://news.ycombinator.com/item?id=22370667)

<comment><USER4> And Peter Montgomery.

<comment><USER5> This has been a tough week losing more than one of our industry pioneers.

</comment></comment></comment></comment><comment><USER6> HN does that when somebody important to tech has died.

</comment><comment><USER7> Yes. Looks like the culprit is:

</comment><comment><USER8> I was about to ask the same. I assumed it is because of Larry Tesler's death.</comment>


UK government releases scientific evidence supporting Covid-19 response - <AUTHOR> https://www.gov.uk/government/news/coronavirus-covid-19-scientific-evidence-supporting-the-uk-government-response <comment><USER2> I don't think I've ever felt as proud of my university - Imperial - than right now. Their research is making a big difference in the actions government is taking, and it could save many thousands of lives.

<comment><USER3> If you read/watch/listen to Peak Prosperity, Imperial pretty much copy/pasted everything what was said before by them, plus added some charts which everyone can understand. Nothing to be proud of to be honest, especially coming from university.

Link: [https://www.peakprosperity.com/](https://www.peakprosperity.com/)

Edit: for downvoters, would be happy to hear your thoughts. Especially let me know if you have followed Peak Prosperity info since January and if you read Imperial report.

<comment><USER4> With so much noise it's understandable that people are dismissing information from less known third-party sources in favor of very well established higher learning institutions. I am also critical of the way Western governments handled the situation, but these are two orthogonal concerns. Maybe you could link to particular information rather than their homepage. I am always willing to give a fair chance but please help us first :)

</comment></comment></comment><comment><USER5> Does anyone have access to good data? There is so much fake news that is hard to trust any articles. If somone is 30 years old, healthy, workout, don't smoke, what is the probability of hospitalization, serious injury, icu or death?

Previous link [https://www.imperial.ac.uk/media/imperial- college/medicine/s...](https://www.imperial.ac.uk/media/imperial- college/medicine/sph/ide/gida-fellowships/Imperial-College-COVID19-NPI- modelling-16-03-2020.pdf)

<comment><USER6> In Italy there were no deaths for people under 30 so far.

<comment><USER2> The youngest I've heard is a 14y/o in China.

<comment><USER5> Are we able to know that for sure? What if he died of autoimmune disease, flu etc. But just happen to have covid19?

</comment></comment></comment></comment><comment><USER7> Really interesting to watch the evolution of the advice on Behavioural and Social interventions. It is absolutely clear from this that the idea of "flattening the curve" rather than completely suppressing an outbreak was being seriously considered until very recently. Luckily, this is not something being pursued anymore and they moved away from it in time but you can certainly understand the attraction when you consider the consequences of the almost total shutdown required to suppress.

<comment><USER8> > It is absolutely clear from this that the idea of "flattening the curve" > rather than completely suppressing an outbreak was being seriously > considered until very recently

Wait I'm out of the loop. The #FlattenTheCurve campaign is already wrong?

<comment><USER7> It's not wrong, necessarily, the issue is that ICU admission rates even in young people are high enough that you need to flatten the curve an incredible amount in order not to overwhelm ICU capacity. (They're not high in absolute terms, but an arithmetically small change in a small number can have massive effects)

</comment></comment></comment><comment><AUTHOR> This does give me some relief that Boris is taking little or no part in the important decision making and just rubber stamping what experts agree on.

<comment><USER2> I think our government is taking some good actions, but I'm concerned that people aren't actually complying. Their modelling relies on 75% decrease in social interaction. I think some enforcement will be needed.

<comment><USER9> There's no sports, no events, huge numbers working from home, pubs and restaurants very quiet. Picadilly Circus currently has only a few people walking about. I think more extreme measures would be counterproductive, because clearly there's been a massive decrease in social interaction already, and people are already panicing.

<comment> barry-cotter Sounds fantastic. Glad most people are doing their part. If only Western governments were encouraging their citizens to wear masks. I know there aren't enough even for healthcare workers but people in vulnerable groups should really be encouraged to wear makeshift masks. There's no shortage of tea towels and if you strap one to you face you're at 70% effectiveness catching virus sized particles when surgical masks are just under 90%. Decreasing the viral load that gets into your lungs decreases the possibility you'll actually get infected.

> Professional and Home-Made Face Masks Reduce Exposure to Respiratory > Infections among the General Population

> Principal Findings

> All types of masks reduced aerosol exposure, relatively stable over time, > unaffected by duration of wear or type of activity, but with a high degree > of individual variation. Personal respirators were more efficient than > surgical masks, which were more efficient than home-made masks. Regardless > of mask type, children were less well protected. Outward protection (mask > wearing by a mechanical head) was less effective than inward protection > (mask wearing by healthy volunteers).

> Conclusions/Significance

> Any type of general mask use is likely to decrease viral exposure and > infection risk on a population level, in spite of imperfect fit and > imperfect adherence, personal respirators providing most protection. Masks > worn by patients may not offer as great a degree of protection against > aerosol transmission.

[https://www.ncbi.nlm.nih.gov/pmc/articles/PMC2440799/](https://www.ncbi.nlm.nih.gov/pmc/articles/PMC2440799/)

<comment><USER10> It might be difficult for governments to admit that they were "lying to you for your own good." No official is going to want to suffer that embarrassment, and even though this is an emergency situation the normal laws of bureaucracies (avoid embarrassment at all costs) still apply.

</comment></comment></comment></comment></comment><comment><USER11> There's 100+ undeveloped/underdeveloped countries that Covid is currently ravaging through. Their response will be the same as the Spanish Flu. They have no adequate medical authority to test and release numbers for the media to currently obsess over, but in a few weeks (months?), we're going to get status on how post herd-immune countries are doing. Their demographic pyramid skews young, so the numbers might not look as bleak. That said, many countries are going to have to start seriously considering the unpleasant calculus between (old) lives and economic cost because it's increasingly obvious we're not capable of enforcing a proper quarantine.

</comment><comment><USER12> People seem really positive about this, but I don't see anything here that seems actionable or materially different from what we've seen elsewhere. Can someone point out why this is noteworthy?

<comment><USER13> It's important because it is political. There have been widespread calls for government to show it's working, and a really determined campaign to show that the strategy is ineffective and is the thing of the prime minister. The document is a chance for the government to try and change some of these perceptions.

<comment><USER14> Also it is pretty impressive how transaprent the UK prime minister has been in dealing with this pandemic.

\- 100% scientific driven approach

\- Daily briefings and updates addressed to the public

\- Daily Q&A where the PM addresses questions from the press

\- Publication of all scientific papers and studies conducated in this short amount of time which are fundamental in decision making

Nobody has a crystal ball to look into the future and therefore nobody can say if what the UK gov has done so far and when they have done it and how they have done it was any good or bad, but I rather have a government which takes such a scientific and transparent approach than anything contrary.

Mistakes can happen regardless which approach one takes, but I rather have a mistake done based on best scientific effort than through negligence.

</comment></comment></comment><comment><USER15> This title is a bit confusing. It sounds like this provides evidence showing that their response was effective, but it is the evidence they used to draw up their response.

<comment><USER14> It's not misleading if the former is logically impossible and therefore it is clear that the latter is clearly what is meant.

No single country can at this point in time yet provide any evidence if their response was effective, because in order to do that you'd need:

\- Be past the pandemic

\- Have other data points of other countries to compare

Both are not true yet.

<comment><USER15> It is confusing though, my initial reaction was that such evidence should not exist and I only realized my error after browsing it for a few minutes.

Replacing "supporting" with "provided to draft" would prevent my problem.

<comment><USER16> I agree … it seems like a poor word choice, given nothing can really be certain at this stage. I think a term like _rationale_ would be more suitable …

</comment></comment></comment></comment><comment><USER17> To illustrate why this lockdown really needs to stay as short as possible and why Trump and Boris are aggressively pushing for a test and anti-viral alternative, economists are forecasting jobless claims in the US to be in the 2-3m region next week vs 150-200k a normal month.

<comment><USER18> To put things into perspective, in tiny Norway companies have issued warnings to 170k, in one week. In six days they received 105k applications for unemployment benefits.

The government is paying full salary (capped at ~600k) for the first 20 days. After that you receive either 62,4% of your salary up to 600k, and if you make less than 300k you receive 80%.

But it's not just Trump and Boris pushing for it. Trials of anti-virals are pushed heavily by the WHO in all countries.

<comment><USER17> Not in all countries. In France the gvt and newspapers have been downplaying the benefits of these anti-viral drugs. They are launching trials but it feels like it is doing under the pressure of the opinion. They are adament that lockdowns are the only efficient long term solution.</comment></comment></comment>


The Black Swan Theory and Why Agile Principles Fit Better - <AUTHOR> https://ulsoy.org/blog/the-black-swan-theory-and-why-agile-principles-fit-better/ <comment><AUTHOR> I see Taleb's ideas more and and more frequently applied to software development e.g. by authors such as Kjell Jorgen Hole in his "Anti-Fragile ICT Systems", and Michael T. Nygard in his "Release It!: Design and Deploy Production-Ready Software" (2nd Edition).

I think it's a little risky to transfer concepts from one domain to another, without taking into account the working assumptions and the surrounding context. For example something as fundamental as the definition of the concept of 'Black Swan' à la Taleb, is a tricky one, let alone its application to the world of software development. Maybe the best we can do so far is to take this in a very broad sense, and interpret it as a general principle: "first, avoid ruin". But, almost by definition, the events outside the control of a software development/project team can be so extreme that it might render the practical application of the principle almost meaningless. (Think about it: what does it really mean in the context of creating a software product really?)

There are of course meaningful principles that apply to creating investment portfolios, strategies, etc.; do they really apply to software development? Are we using similar data sets and statistics for software development and combination of financial instruments? Can we? That's something I can't say "yes" immediately.</comment>


J.Bridenstine/NASA: Katherine Johnson passed away this morning at 101 years old. - <AUTHOR> https://twitter.com/JimBridenstine/status/1231946829962584065 <comment><USER2> I highly recommend watching Hidden Figures (2017) which tells an amazing story about how the human computers of the 60's emerged from obscurity and ultimately introduced NASA to software development. Katherine is at the center of the story, the rest is history.

</comment><comment><USER3> [https://news.ycombinator.com/item?id=22404733](https://news.ycombinator.com/item?id=22404733)</comment>


Pennsylvania decides whether to subsidize nuclear energy as "clean" - <AUTHOR> https://thebulletin.org/2019/04/pennsylvania-decides-whether-to-subsidize-nuclear-energy-as-clean/ <comment><USER2> This debate is happening in a lot of jurisdictions. Here in Ontario we're refurbishing our older reactors, at a massive expense, in order to get off of coal, and reduce dependance on gas.

It's resulted in very high energy costs (especially compared to our hydro- power rich neighbour, Quebec), drove the provincial government out of office, and is one of the things driving energy-intensive industry out of the province.

<comment><USER3> Let's look at the bigger picture.

Ontario is one of only a few regions in the world that decarbonized their electricity generation. All of these regions did this with a combination of nuclear and hydro (and a small contribution of other renewables). Unfortunately you can't build hydro everywhere and you have to take into account that it's not environmentally neutral too.

On the other hand, Germany closed some of their nuclear power plants and invested billions in renewables, which resulted in very high energy prices too, but they are nowhere near meeting their emissions reduction targets, and are facing billion-euro fines for missing their targets. They are increasing their dependence on gas (this is inevitable because intermittent renewables like wind and solar require a power source that can be fired on demand, or a very expensive storage). Germany committed to end their reliance on coal by 2038, but they are still building coal power plants.

Another example is California. Just like Germany and Ontario, they had a fleet of nuclear reactors and planned to build more. But they decided to close about half of their nuclear power plants and invest in renewables instead. What happened is very high energy prices and emissions even a little higher than in Germany.

Should Pennsylvania subsidize nuclear energy as clean? Yes, because it's the only big source of clean energy in Pennsylvania. Renewables won't be able to fill the gap if nuclear gets closed. And we should be replacing fossil fuels, not one clean source with another. Nuclear is the biggest clean energy source in United States. It's bigger than all renewables put together, but it gets the least amount of subsidies and tax cuts. Even less than fossil fuels.

<comment><USER4> The biggest problem regarding electricity costs in Germany is the fact it has too many underutilized power plants. 28GW of mostly unused gas plants that could have reduced CO2 emissions years ago. Meanwhile coal workers have to be protected just like in the US and therefore 46GW of coal capacity gets used instead to make sure coal towns don't disappear.

When you look at this turning off 10GW of nuclear starts to make sense, it's expensive, there are no suitable storage sites in Germany, people don't like it and finally: Germany doesn't need it because it has too much anyway. The dark side is that coal gets to live another day because nobody wants to be personally responsible for the loss of thousands of jobs.</comment></comment></comment>