React VR - <AUTHOR> https://facebookincubator.github.io/react-vr/ <comment><USER3> For anyone wondering: 'Why JavaScript? Why React?', let me remind you, the goal of ReactVR is not to create the most performant game, but to allow the people that are creating websites right now, to create VR websites in future.

Using the same technologies is natural.

<comment><USER4> I would add that there is absolutely no technical reason why an application expressed in one language need not be as fast as an application expressed in another. First, compilers improve static analysis, and second, JIT analysis will also improve. For this sort of thing, _running on the GPU_ matters a lot more than source language, and WebGL has you covered there.

<comment><USER5> This is wrong. There absolutely are technical reasons why implementations of different languages perform differently- no amount of static or runtime analysis can entirely save you from performance-hostile semantics baked into the language spec.

WebGL is a huge bonus, but WebAssembly will also be important for a lot of web-based VR.

<comment><USER6> > no amount of static or runtime analysis can entirely save you from > performance-hostile semantics baked into the language spec

You can in almost all cases check for these semantics statically, and if not found, run a super fast path. This is the whole premise behind asm.js.

Heck, even C++ has plenty of features that have performance-hostile semantics. But the compiler checks for these and you don't pay the penalty if you don't use them.

Wasm will help, but I disagree that anything in the JS spec makes the _language itself_ inherently slower than any other language, if we disregard textual compilation overhead.

<comment><USER7> I'll give you one: value types.

Until you can specify memory layout you'll never come near a proper gamedev engine, regardless of GC issues(which are also a problem).

(source: I used to work on professional game engines)

<comment><USER8> asm.js and WebAssembly give you the same control over memory layout as C (in fact the memory layout is absolutely identical to a little-endian 32-bit host) and unless you need to call a lot out into HTML5 APIs the garbage collector will be idle. These two things together are basically the magic sauce why asm.js/wasm are faster than manually written JS and faster then most 'managed languages' where most objects are created on the heap and passed around by reference.

<comment><USER9> > asm.js and WebAssembly give you the same control over memory layout as C

That's a bold statement right there.

<comment><USER8> Not at all, both asm.js and wasm give you a flat memory region (in asm.js it's a single, big JS typed array), the stack and all allocations live in this 'heap', managed by emscripten's malloc wrapper (which is jemalloc I think), the resulting memory layout is the same as on a native 32-bit platform, with the same alignment rules. There are no 'managed' Javascript objects in asm.js or wasm (unless you need to call out into web APIs).

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER10> Jeeeeziz. HTML/JS were designed to display interlinked text documents. Now you can use them for VR. It's like building a spaceship out of bicycle parts. That's crazy. Crazy cool maybe, but definitely crazy.

Love React by the way, will definitely check this out.

<comment><USER6> Technically _all_ of our software comes from interlinked text documents. The magic is in the software that eats the interlinked text and makes it real. HTML/JS are no different in this regard, VR or not.

I'm constantly amazed and thankful to be living in a world of spaceships built out of bicycle parts.

<comment><USER11> I like this sentiment a lot, as it applies to most computer uses. A couple standout exceptions however are images, videos, 3d models and animations. It's certainly possible to represent these in text, but most uses and tooling respect their visual/spatial content. This seems a major criticism of the 'just use existing web tech to make vr'. The former really was about digesting and emitting text documents, but vr is more about models/layout/animation - <USER2> text really the right foundation for the job?

<comment><USER12> Sort of, binary formats are mostly optimisation for scene data specifically and working with human readable formats is quite normal for content creation. If you can put up with the time taken to parse then it's workable.

If you think of declarative vr in those terms it's a lot like a web page where a portion arrives as text that describes the layout of the bulk of binary data for rich applications.

Where it gets tricky is for large scenes and/or streaming scene data where generally you need better performance. But this sort of thing could still be pre-baked and live within a declarative wrapper.

<comment><USER11> My point isn't so much text vs binary. It's text==1D vs much of VR content which is multi-dimensional. And the more multi-dimensional, the more the most human readable format becomes the non-text version (text -> trees -> images -> models/videos/animations).

Honestly even html suffers from the translation between linear-text and the tree-like DOM. Many of the pain points of webdev are dealing with this boundary. Go even farther to scenarios where you'd want to interact with the 2D rep of a webpage and you're completely off the reservation. Imagine using javascript/dom to ask the question "what letter is below the 17th character of this this paragraph", the question almost comes across as absurd! "What about different fonts? What about phones? What if there's an image below, is that 'null' or should I skip to the text?" The question is meaningless! Then again, text selection is exactly this question... On the web we've found some very reasonable boundaries between webpage responsibilities, browser responsibilities, and accepted a large swath of functionality as impossible.

In VR those boundaries are still in flux. VR scenes are a combination of all sorts of content, of all sorts of dimensionality, often including temporal components as well. Certainly for storage and transmission 'linear' is the only option, but what is the best working representation? Is it a tree with rich nodes? Well maybe, but that's going to make it that much harder for those nodes to interact. On the other extreme is it a 4d array of temporal-voxels? Probably not until we have petabyte DSL. Imo this is why this is a hard problem, why VRML has never really caught on, why after 25 years of making 3d games/movies there's still no standard scene description, why Facebook is taking a stab at this with this project, and why VR is a pretty exciting place to work :)

<comment><USER12> Scene representations in game engines tend to follow the use case so there tend to be several generated from the same scene description. Generally because one representation that is useful for organising a scene isn't great for spatial queries. Likewise we need a representation that can be fed efficiently to graphics hardware. Or the use of voxels for simulation. My rambling description aside my point is that there isn't likely to be one working representation.

For WebVR hopefully we can steer a good path between that which should be represented in an HTML/DOM context and that which should be represented elsewhere. For example glTF looks quite promising both as a runtime format for models and for scenes.

</comment></comment></comment></comment></comment></comment><comment><USER13> Suddenly the snippet of code from Westworld makes sense

<comment><USER14> Apparently hosts are built with React.. good to know.

</comment></comment><comment><USER15> Any reason this was built instead of contributing to aframe[0]?

[0] [https://aframe.io/](https://aframe.io/)

<comment><USER16> I tried out ReactVR for a prototype and I liked that I was able to use my familiarity with React to set up a simple VR project in a few hours with no prior VR experience and without having to learn any new syntax, just a few new classes.

<comment><USER17> I tried out A-Frame for a prototype and I liked that I was able to set up a simple VR project in a few _minutes_ with no prior VR experience and without having to learn React. I'm sticking to A-Frame

</comment></comment></comment><comment><USER18> And thus, VRML was reborn!!!!!

Seriously, anyone remember VRML? It was so cool... it was technically junk and implemented horribly, but it was awesome still somehow. Like goat simulator.

<comment><USER19> That was one of my first forays into coding. I remember doing the basic examples and then finding some of legitimate worlds and having my mind blown.

The good old days!

</comment></comment><comment><USER20> I've used this for a couple of hobby projects and it's been fun. One thing I think it does need soon is a VR Browser for the Oculus Rift and/or Vive HMD's as well. Currently the use of the 'Carmel' VR browser is Gear VR only, and it would be nice to try some React VR on something with greater oomph.

<comment><USER21> During last year's absence of any WebVR or SteamVR support for linux and Vive, I cobbled together an alternate stack[0], using Valve's low-level OpenVR device driver, node.js electron as runtime and compositor, and a WebVR 1.0-ish api. I've used it with React and three.js.

No ReactVR. No A-Frame. No lens correction. Insecure. The device driver api has moved on, and current device firmware may or may not work. But fyi, fwiw.

[0] [https://github.com/mncharity/node-webvr-alt- stack](https://github.com/mncharity/node-webvr-alt-stack)

</comment></comment><comment><USER22> Extending VR to the web and to other sets of developers is great!

However, I don't see any useful abstractions here besides a bunch of declarative boiler-plate.

Creating something that allows more people access to a creative medium requires real abstraction, not just wrapping a bunch of Three.js API's in react components.

</comment><comment><USER23> Garbage collection and compilation operations can cause hard to predict, noticeable slowdowns for large real-time JS apps so I'm skeptical of the use for ReactVR right now. Perhaps I'm wrong though? Or maybe it will be useful for static, UI scenes?

Somebody convince me!

<comment><USER24> The React team has been working on an improved rendering engine called Fiber. This is an oversimplification but Fiber essentially breaks down per-frame rendering into several sub rendering tasks, allowing for smarter multi- threading (in the case of web workers) and even single threading (the renderer now returns control of the main thread much faster and more frequently, allowing for more opportunities to do GC and other operations without as much of a negative effect.)

An example of Fiber in action is here: [https://www.youtube.com/watch?v=Qu_6ItnlDQg](https://www.youtube.com/watch?v=Qu_6ItnlDQg)

What this amounts to for React developers is the introduction of explicit priority rendering, which can be very useful in VR environments. So for example, updates to your UI from external processes (such as an XHR) can be set to lower priority than updates to the hand model that's controlled by the controllers.

<comment><USER25> How does this relate to garbage collection?

<comment><USER26> I think maybe the basic idea is that by utilizing more cores and getting more done concurrently, they leave more idle time per frame for the GC to work. If that's the case, it doesn't necessarily solve the problem, but it may move the bar enough to be currently usable and useful.

</comment></comment></comment></comment><comment><USER27> Amber Roy will be giving a talk about this at the Google Downtown San Francisco office next Friday: [https://www.meetup.com/sfhtml5/events/237831559/](https://www.meetup.com/sfhtml5/events/237831559/)

</comment><comment><USER28> What device would you recommend for playing with VR? I've never tried a headset but 3D UI interfaces has been something I've day dreamed about for well over a decade now and it'd be fun to see it happen.

FWIW I'm on Linux & have an iPhone, if that matters.

</comment><comment><USER29> I'd love to see something like what Expo is doing for regular React Native for VR. Even them doing it would be great, I assume that might complicate their branding, but still.

[https://expo.io/](https://expo.io/)

</comment><comment><USER30> This is awesome, however I just spent a month making the exact same thing. Oh well, I might give this a go and see if this is more in line with what I want to do.

</comment><comment><USER31> Is this the return of VRML?

<comment><USER32> With a vengeance!

</comment></comment><comment><USER33> Obvious question : is it plan at any point to support Unity3D?

</comment><comment><USER34> This is one project that has changed my mind to finally get going with facebook's React framework. I would love to see VR development more simplified and accessible to web developers.

<comment><USER35> You're more than welcome to also try [http://aframe.io/](http://aframe.io/) That's exactly our goal, onboarding Web Developers into the new medium. Let us know what you think.

</comment></comment><comment><USER36> Reminds me of VRML.

</comment><comment><USER37> Drawing pictures by writing code is pounding a screw.

<comment><USER3> There are tools for 'drawing pictures' already. From Google's Tilt Brush, to Oculus' Medium and Quill. And game engines start supporting scene editing directly in VR.

This is not about pictures. This is about _interactive websites_ in VR.

</comment></comment><comment><USER38> oh bloody hell...is this an elaborate troll?

I get it...javascript is the universal language. It's also universally hard to fully understand, hard to scale to large codebases, has no shared memory parallelism, has a GC-heavy runtime, and is extremely hard to optimize for performance (both by humans and by compiler optimizers).

I appreciate what React has done, it's pretty impressive. But I can't help but think we're getting into parody territory here.

<comment><USER24> I don't think the other subcomments actually address your concerns, so here's my take: Javascript is the language known by every web developer. Right there, they're opening up their developer audience to a much larger group of people than is possible with C++ or even C#.

"Hard to scale large codebases" isn't really an argument, large code bases are hard in every language, JS isn't really an exception here.

Low level stuff (GC, perf, memory) has been, and will continue to be a problem for Javascript. You can mitigate a lot of the problems with well designed code. React attempts to minimize a lot of those problems with solutions that work for most general use cases (and now with Fiber, we're getting even more granular control.)

Until React moves to Web Assembly you're always going to have overhead when using JS. But let me know when you've got a solution for VR in a web browser that's not JS and I'll give it a try.

<comment><USER39> > Right there, they're opening up their developer audience to a much larger > group of people than is possible with C++ or even C#.

Maybe this is true, but I'd hazard a guess that most developers are not web developers. [1]

Most of us aren't questioning how VR can be done in a browser, but stopping to ask why.

[1]: [http://githut.info/](http://githut.info/)

<comment><USER12> Perhaps because it's a really accessible platform and by baking in support now it will be mature when VR hardware is more generally accessible (2018-2019 for mobile). I'm from a game development background but accessible, interconnected, multi-user VR for all seems like it's something that will come from the web rather than bespoke attempts. Perhaps a better platform will come along with time.</comment></comment></comment></comment>


Why Bebo Doesn't Owe Musicians Anything - <AUTHOR> http://mattmaroon.com/?p=342

<comment><USER2> I interact with a lot of small bands on the fringe of the music scene (death metal, thrash, black metal etc) some signed and some not. All but the very large are having a really tough time. While the internet gives them exposure it's not really giving them a revenue stream. Not everyone has the pulling power of Reznor.

A lot of these small bands can't see a future at the moment and whether you like this genre of music or not all the fringe genre's are suffering.

It's hard to see if things are worse in their world then ten years ago but according to them and their publishers things are indeed worse. I wish I knew the answer to this.

<comment><USER3> In the mid 90's MTV did a salary survey of moderately successful bands and found that the average yearly salary was about 30k, putting it in the range of an entry level office job. These weren't the biggest names in music, but they were definitely on the high end. This was long before the rise of peer to peer downloads, and even then professional music was not a viable career path. Blaming technology advancements for artists not being able to make a living off of their art is just a scape goat.

The concept of a "starving artist" predates the rise of computers and transcends all media. The only difference between the music industry and painting, sculpting, writing, or any other form of art is that a myth of past profitability has been propagated in recent years. The (unchanged) reality is that artistic expression doesn't generate revenue streams except for the very few, lucky artists.</comment></comment>


Securing a Linux Server - <AUTHOR> http://spenserj.com/blog/2013/07/15/securing-a-linux-server/ <comment><USER2> This falls a bit short.

You shouldn't just update, you should update regularly or better yet set up unattended upgrades[1]. Especially for your hobby projects or personal server because odds are that you won't always have the time to act on every security advisory. (Subscribe here[2] to at least hear about them.) Also, if something breaks once in a blue moon, it's not that big a deal.

Fail2ban is fairly heavy and only very recently supports IPv6 (which means the version from your repo may not). You can achieve similar results with something like

        -A INPUT -p tcp -m tcp --dport 22 -m recent --update --seconds 180 --hitcount 4 --rttl --name SSH --rsource -j LOG --log-prefix "ssh brute force: "
        -A INPUT -p tcp -m tcp --dport 22 -m recent --update --seconds 180 --hitcount 4 --rttl --name SSH --rsource -j DROP
        -A INPUT -p tcp -m tcp --dport 22 -m state --state NEW -m recent --set --name SSH --rsource -j ACCEPT

but if you disable password logins, no one's going to brute force their way in.

[1] [https://help.ubuntu.com/community/AutomaticSecurityUpdates](https://help.ubuntu.com/community/AutomaticSecurityUpdates)

[2] [http://www.ubuntu.com/usn/](http://www.ubuntu.com/usn/)

<comment><USER3> As a seasoned system administrator, I strongly advise you against unattended or automatic upgrades. In a Linux or FLOSS eco system components are very strongly coupled but loosely developed. Say glibc is base of nearly every server application but it is and server apps are not regres tested for each other. Which will or may lead to incompatibilities, down times or performance issues even on edge cases data loss. So please don't.

<comment><USER4> Your concerns are not an issue with a distro like Debian where the only upgrades are for backported security fixes (or, when an announced point release comes around, critical bug fixes). I worked for several years at a shop with dozens of Debian servers, and nightly unattended upgrades very rarely caused issues, and never caused anything truly serious.

<comment><USER5> > _Your concerns are not an issue with a distro like Debian_

Ten years ago, I had a Debian server completely wedge itself on an update. glibc was hosed, practically nothing would run, and I couldn't untangle the mess. Had it been unattended, downtime would have been even longer than the hours it took to rebuild the box from scratch.

This was not the first or last time such an event would occur, merely the most severe.

Updates break things. Anyone who claims otherwise is either incredibly lucky, or incredibly inexperienced.

<comment><USER6> But if you can't flip a switch to deploy an identical server and/or restore from a backup image, aren't you in deep shit anyway? Your failure plan is to rebuild the box from scratch?

<comment><USER5> For a one-off budget server in 2002-2003? Yes, yes it is.

For a highly-available mission-critical infrastructure in 2013, the failure plan is also to rebuild from scratch, because "failure" means redundant and backup systems have exploded. This is most likely to occur when you automatically roll out untested changes to your infrastructure.

In either case, you won't be sleeping tonight. Or possibly tomorrow night.

</comment></comment></comment></comment></comment></comment><comment><USER7> I find [https://wiki.ubuntu.com/UncomplicatedFirewall](https://wiki.ubuntu.com/UncomplicatedFirewall) to be much friendlier to use when setting up firewalls.

The big problem I have is securing my private keys. I use multiple devices, and haven't found a secure and convenient way to share the keys across devices securely. I'd love ideas..

<comment><USER8> You shouldn't try to share them, imo, and generate a key for each device. Yes, that may be painful to have to copy 5 public keys on each new server, but the day where, say, your laptop get stolen, you don't have to change the private key on each device : simply remove the laptop one.

If you want some kind of centralization, you could only add your keys on a single server, then add this server key on others. You log on first server, then use it to log on others. But that would be dangerous : if the master server crashes, you can't access other servers anymore. Redundancy is good, in that case.

<comment><USER7> I agree that key-for-each-device is probably best practice.

It just doesn't work for me though. I frequently need to log onto servers from new client computers, and the workflow of _connect from trusted device, generate new key for new device then use new device_ just isn't practical.

I've spent a lot of time thinking about this.

I think the biggest threat to security on my servers is brute forcing of ssh passwords. The best solution for that is key based authentication. (I deploy fail2ban as well though)

There is a non-zero threat of my devices being lost/stolen/accessed with my keys on them.

So key based authentication is the way to go, but I just can't get around the practical aspects.

In the end I often rely on long, random passwords kept in a KeePass database I sync (along with Fail2Ban). I've considered keeping my private keys in that too, and to be honest I think that isn't a terrible solution. It is certainly less than ideal, but probably mildly more secure than my current method (ie: really a private key shared across devices is acting as a _very long password_ )

<comment><USER9> "I frequently need to log onto servers from new client computers, and the workflow of connect from trusted device, generate new key for new device then use new device just isn't practical."

Agree. But wouldn't it make sense then to generate unique keys for all of your devices (still) and then have a key which is your "travel" key and change that periodically?

<comment><USER7> That's a good compromise.

I just thought of enabling 2 factor authentication instead of plain password auth, which I think is probably reasonable too

<comment><USER10> Was about to suggest 2-factor auth as well. At least for the "first" machine, where the SSH key for the others is.

</comment></comment></comment></comment></comment></comment><comment><USER11> sudo, ssh certs, egress firewalling. Congrats - you've covered about 4 pages from the NSA's 200 page hardening benchmark. Off to a good start!

[http://www.nsa.gov/ia/mitigation_guidance/security_configura...](http://www.nsa.gov/ia/mitigation_guidance/security_configuration_guides/operating_systems.shtml)

<comment><USER12> This isn't intended as a be-all-end-all guide to security, like the NSA aims for. Instead, view it as a quickstart guide for those first five minutes on a new server, or as a starting point for beginners that have no idea where to even look.

<comment><USER13> Agreed.

</comment></comment></comment><comment><USER14> This is very lightweight.

There are many more steps used in more serious situations... chiefly, these come to mind: Validating installation media. Validating/upgrading firmware. Installing a minimalist kernel. Securing BIOS and IPMI. Taking an inventory of part numbers and identities to detect tampering at later stages. Locking down network access on the switch to the appropriate MAC address. Determining administrative access methodology and distributing appropriate keys or credentials. Testing.

Probably most servers today are automatically set up, and live in large scale server farms. They probably boot via PXE, using custom auto-provisioning code. Other than physically taking delivery of the unit and inspecting it and logging its presence in inventory, such machines are literally just plugged in and boot up. Probably most of them are preconfigured to PXE boot by the vendor. A strong setup will also override BIOS settings automatically upon boot, ensuring further boots have 100% pretested/tuned configurations.

</comment><comment><USER15> I used to think that the Redhat security guides were good [1], but would also go through the NSA guide to securing Redhat [2]. Seems a little ironic nowadays.

Recently, we had Bryan Kennedy's "first 5 minutes" [3], linked from Drew Crawford's guide to "NSA proofing" email [4] (pretty good guide to securing a mail server).

[1] [https://access.redhat.com/site/documentation/Red_Hat_Enterpr...](https://access.redhat.com/site/documentation/Red_Hat_Enterprise_Linux/) [2] [http://www.nsa.gov/ia/mitigation_guidance/security_configura...](http://www.nsa.gov/ia/mitigation_guidance/security_configuration_guides/operating_systems.shtml) [3] [http://plusbryan.com/my-first-5-minutes-on-a-server-or- essen...](http://plusbryan.com/my-first-5-minutes-on-a-server-or-essential- security-for-linux-servers) [4] [http://sealedabstract.com/code/nsa-proof- your-e-mail-in-2-ho...](http://sealedabstract.com/code/nsa-proof-your-e-mail- in-2-hours/)

</comment><comment><USER16> I've never understood the compulsion to restrict outbound traffic on an internet facing server that you do not intend to be used by other (untrusted) people.

If someone is good enough to own you with everything else locked down, they can change any firewall rules completely if they need to, or just tunnel out over an allowed port.

Creating a non-root user then giving them carte blanche sudo rights is similarly odd to me. I'd rather just use root and /etc/nologin (assuming no one else needed a login shell to run).

EDIT: Added paragraph about non-root users.

<comment><USER11> I've seen more compromised boxes than one can shake a stick at. There's all sorts of reasons that blocking egress is a great idea. Compromises are usually automated bots, and no, they're not smart enough to bring down iptables. Even if it's a human that's pwned you, it's frequently a stupid human, or a lazy human. It's just good practice to practice security in depth.

<comment><USER17> Or a non-privileged account is accessed and the kiddie just wanted to run an eggdrop bot. Plot foiled.

</comment></comment></comment><comment><USER18> It's usually also worth checking whether you need to generate new SSH host keys - a lot of VPS providers use the same host keys on all their deployed instances, which isn't secure, and the longer you leave it the more of a pain it'll be to change. If "ls -lh /etc/ssh/" shows that the host keys predate when your system was provisioned, change them:

        rm /etc/ssh/ssh_host_*
        dpkg-reconfigure openssh-server

Also, on some VPS solutions I've come across you can't use passwd to change the root password permanently; management software outside of the VM changes it back on the next restart.

</comment><comment><USER19> The first time I locked down a server I found iptables to be a little intimidating. If you're on Ubuntu then ufw is extremely easy to use - it's just a front end for iptables.

[https://help.ubuntu.com/community/UFW](https://help.ubuntu.com/community/UFW)

</comment><comment><USER20> I made the mistake of accidentally setting the firewall too strict on a remote server, killing my ability to SSH. A neat little trick I found was to setup a scheduled task to kill the firewall in 5 minutes, and _then_ restart it. If it's too restrictive and locks you out, wait 5 minutes. If you did it right, then kill the scheduled task.

<comment><USER21> You can just use iptables-apply. It achieves the same thing and is built-in. If you don't confirm the changes after they are applied, because you locked yourself out, they will be rolled back.

<comment><USER22> This is in the article FWIW.

</comment></comment></comment><comment><USER23> This is a good start, netstat -an to see what ports are open, to shut down things that open ports. Turn of xinetd if it is on, etc. There was a much more complete best practices document that came through here earlier.

<comment><USER24> And then realize you left all ipv6 traffic open (?)

<comment><USER25> Having separate iptables for IPv6 is painful. Are there any means to address this?

<comment><USER26> Simple. Disable IPv6 - it's probably not worth the tradeoff, and your network provider probably doesn't support it anyway.

<comment><USER27> Worst advice ever :-(.

Many ISPs (and hosters) do support IPv6, and it's worthwhile to learn a bit about it. If you are running an internet-facing server, I'd say it's part of being a good citizen to support the latest standards.

To address the parent question, the firewall rules actually need to be a bit different than for IPv4. As an example, IPv6 makes supporting ICMP (for ping and the like) mandatory.

I wrote a post with a simple ip6tables setup about 4 years ago (in German, though, and there might be better posts): [http://blogs.noname- ev.de/commandline-tools/archives/74-ip6t...](http://blogs.noname- ev.de/commandline-tools/archives/74-ip6tables,-grundlegendes-Setup-bei- IPv6.html)

</comment></comment></comment></comment></comment><comment><USER24> This article is letting IPv6 without a firewall.

A few feedback:

1) Start by the "lower layer"

If it's a physical server, start by reviewing all BIOS options, if it's virtual one you control, start by reviewing the host environment for the guest.

2) Follow from the bottom to the top

Follow by review and secure the boot process. (Grub password, kernel modules loaded, kernel module options, kernel sysctl options.

Follow by review the services started "even before starting nothing".

Review what is accessible in the system to "anybody".

Review what is accessible in the system to each "user". Many times a "user" is going to be listening to the hostile network in a port.

Review what the system is going to do across the time, what is scheduled, which resources are assigned to which users (and their processes), what is going to be registered.

4) Does not limit or scrub any traffic

It's not that we forget about IPv6

It's that such iptables, on any 1 core VPS, is vulnerable to DoS from a single IP (you don't need any distributed attack to put down that). A syn attack to the port 22 could be enough.

In resume:

When giving general security advisories, lets try that people build a secure system if they follow our tips. Not let open things like ping broadcast from our host, or IPv6

<comment><USER12> I haven't enabled IPv6 on any of my servers yet, as I can say with 99.9% certainty that my visitors do not know what it is, let alone have it enabled. Additionally, this is intended as a quickstart or beginners guide, and obviously leaves quite a bit out. That being said, it is definitely something you want to consider, and I've added a followup to the post mentioning that.

<comment><USER24> The problem with IPv6 was not that it could be enabled... it's that it is enabled by default. In all major linux distributions.

That being said, I've read your update, and that is the point that people seeking for "recipes" should get. If they are going to touch ssh or iptables, they need to be ready to explore the documented options (which are many), to validate that the changes are working, to dive into networking, etc.

</comment></comment></comment><comment><USER28> Guides like this are tricky. They secure one facet of lots of things, and not always the things you actually want.

If securing a server were as straightforward as changing ssh settings and firewall rules, distro providers would do this sort of thing out-of-the-box, or at the least there would be a script circulating on github for doing this specific setup.

</comment><comment><USER29> See also [http://plusbryan.com/my-first-5-minutes-on-a-server-or- essen...](http://plusbryan.com/my-first-5-minutes-on-a-server-or-essential- security-for-linux-servers)

Discussed here: [https://news.ycombinator.com/item?id=5316093](https://news.ycombinator.com/item?id=5316093)

<comment><USER30> Another good guide: [http://devo.ps/blog/2013/03/06/troubleshooting-5minutes- on-a...](http://devo.ps/blog/2013/03/06/troubleshooting-5minutes-on-a-yet- unknown-box.html)

Discussed here: [https://news.ycombinator.com/item?id=5361335](https://news.ycombinator.com/item?id=5361335)

</comment></comment><comment><USER31> I've never been a fan of shunning/blocking ip-addresses based on number of wrong passwords. It's to easy to exploit as denial-of-service attack and can be used to lock out legitimate users.

Possibly use a non-standard ssh port, make sure you disable ssh v1 and apply a password policy, allow password logins only for white listed users. Now you should be reasonably safe against brute force attacks and still have a system that is accessible.

If/when you disable root logins through ssh, try to have another way to login as root - maybe a console/kvm switch, prefferably with remote access through a secure network.

<comment><USER32> > It's to easy to exploit as denial-of-service attack and can be used to lock > out legitimate users.

Could you explain what's the "easy" way to DoS using fail2ban(or equivalent system)?

<comment><USER33> There's still a lot of ISPs that don't follow BCP-38 so source address IP spoofing is easy enough

<comment><USER32> SSH is TCP based, you need two-way handshake to construct the connection. Source address spoofing gets you only half-way there.

<comment><USER34> Unless your server's TCP stack has SYN-cookies enabled (and I think most do): [http://www.jakoblell.com/blog/2013/08/13/quick-blind-tcp- con...](http://www.jakoblell.com/blog/2013/08/13/quick-blind-tcp-connection- spoofing-with-syn-cookies/)

Law of unintended consequences strikes again.

</comment></comment></comment></comment></comment><comment><USER35> What's wrong with passwords ? The info is in your head and in a physical booklet secured at home for backup. Its only weakness is is keylogger. A secret key protected by password doesn't provide you more security. You can only connect from the computers having a copy of the key. If that computer is inaccessible or dead, or the private key is erased you can't log in. It also is exposed to keylogger. So I stay with password for now. It should be a secure password of course. Maybe use private keys and a password for backup recovery only.

<comment><USER8> Password authentication is prone to bruteforce. With public key auth, even if someone has your passphrase, he also needs the private key to break into your server.

Indeed, there's always the risk to lose your private key. That's why it's useful to have several : I have one on my desktop, one on my laptop and one on my mobile. If any get compromised, I only have to delete one public key in authorized keys and generate a new one. That's still open to some attacks, but way less dangerous than simply allowing anyone from anywhere to log in.

That's also better than allowing only a few IPs on port 22, because you'll never now where you will be and what IP your laptop will have when an emergency occurs.

<comment><USER36> _I have one on my desktop, one on my laptop and one on my mobile. If any get compromised, I only have to delete one public key in authorized keys and generate a new one._

Personally, I still don't like SSH keys. Yes, they are "more secure" in the sense of preventing others from breaking into your servers. But they are less reliable in a sense that they increase your probability of being completely locked out when shit hits the fan.

Laptop, desktop and mobile phone? If you can't imagine a situation where you will loose access to all three at once, you either live a very different lifestyle than I do or have a poor imagination.

For me, the expected loss (i.e. probability * damage) of loosing access to an important server because of some fire of flood is _far_ greater than the expected loss of someone guessing SSH port, my login, my password and then the root password.

<comment><USER8> Well, maybe you live in some place especially prone to natural catastrophes :) I live in France, and I certainly have lesser chances to loose all devices at once than to have a single one compromised.

</comment></comment></comment></comment><comment><USER37> Hmm, no mention of SELinux? It's a pain to get into though. Many just turn it off to make its errors go away, while they should actually configure their machine. But it is very convoluted and hard to get really into. IRC helped a lot here.

Another suggestion I miss is just setting the SSH port to something different than 22, while many will correctly notice that this comes close to security through obscurity, it does throw off some more mainstream attempts.

A third one is more web-server specific, if you have the option, make it hide its version number in its responses.

A fourth one would be to mask all errors to a 404 on a production server, the less an attacker knows, the better.

A fifth actually links to the person operating the server: 'know what permissions are, and what they allow/deny'. Too many people "solve" issues by doing a "chmod 777" on a folder, which might have solved one problem (in a very bad way) but probably set him up for a few nasty surprises down the road.

<comment><USER12> I've been tweaking a post on building a solid LEMP stack, that I hope to publish soon that covers your last three points. While security through obscurity isn't a solution, it does help thwart a large portion of the attacks, although it causes more headache than benefits in some cases (heavily restricted work networks for instance). When it comes to webservers, you don't encounter issues like that, and the less information you provide, the better.

</comment></comment><comment><USER38> Amazed that "Install grsecurity" isn't one of the key things listed here. Sure, you have to compile your own kernel, but the enhanced memory protections and many other hardening features make it an excellent addition to your security arsenal.

[http://grsecurity.net](http://grsecurity.net)

<comment><USER39> It's not just "you have to compile your own kernel". It's "you have to compile your kernel EVERY TIME there's a kernel update". If you forget one update and you leave an exploit on your system, you're screwed.

Having said that, I'm surprised Debian and Ubuntu don't have better support for grsecurity. If they'd provide up-to-date packages I'd switch over.

<comment><USER25> My dedicated server provider ships grsec enabled kernels by default. Admittedly, they tend to be a bit stale.

</comment></comment></comment><comment><USER40> Important caveat: fail2ban does not work for IPv6 connections yet (there are patches floating around though)

<comment><USER41> ty, i didn't know that was the case. are there other alternatives?

<comment><USER40> There is a quite straightforward patch[0], and since fail2ban is python, you can apply it on the installed package. Not the best for maintenance, so use your best judgement (and a few tricks to keep yourself safe and up to date), but it's certainly better than being exposed.

[0]: [http://www.fail2ban.org/wiki/index.php/Fail2ban:Community_Po...](http://www.fail2ban.org/wiki/index.php/Fail2ban:Community_Portal#IPv6_Experimental_support)

</comment></comment></comment><comment><USER42> I also always change the SSH port to 9922. I haven't seen any failed login attempts so far.

<comment><USER43> I would use a privileged port for ssh (different than 22). In case a hacker owns the process he would need sudo to open another connection if the port is <1024.

<comment><USER44> I wonder if it's ever happened that a hacker was able to pwn sshd only to be stopped by the lack of a local privilege escalation to root.

</comment></comment></comment><comment><USER45> I've found CSF is a great tool for securing a server if you aren't an IPTables expert: [http://configserver.com/cp/csf.html](http://configserver.com/cp/csf.html)

<comment><USER46> Ah, I'll second CSF! Love it, it wraps so much up into a sweet little bunch of scripts.

</comment></comment><comment><USER47> This article is okay, nothing against the author but the topic of securing a host depends on many factors and it's so extensive at so many levels that this post doesn't even scratch the surface.

Why is it in frontpage?

<comment><USER48> Because most developers have ~0 such knowledge...

</comment></comment><comment><USER49> Would automated security updates be an appropriate item to include in this?

<comment><USER50> I thought the same, since the OP has already installed and configured outgoing emails, I think using apticron[0] would make a lot of sense.

[0] [https://www.debian-administration.org/articles/491](https://www.debian- administration.org/articles/491)

</comment></comment><comment><USER51> Please do yourself a favor and instead of fail2ban install dome9.com. You'll have your ssh closed as well as all other non public ports, will not rely on funky failed login logic. As a bonus you will have clean logs. Also saw here a recommendation to change ssh port. Man, even kids today use nmap. It takes nothing to find your 'hidden' ssh.

Consider pimping this setup with external WAF such as incapsula.com or CloudFlare.com. Combined with dome9- there will be no entity connecting directly to your server (or even knowing its ip)

</comment><comment><USER52> Can I haz an Ansible playbook with good things?

<comment><USER53> If you allow some self-promotion: you can take a look at the ansible playbook repo I've been putting up (including some documentation and background in the doc directory): [https://github.com/pjan/the- ansibles](https://github.com/pjan/the-ansibles)

In all honesty; the steps in the TO's article are only providing basic security. Pointing the ansible playbooks to your server will further enhance it.

You should also consider changing the SSH port, but that's up to you (in which case you also need to change the firewall settings!)

<comment><USER54> Wow, let me say that if you're even kind of thinking about Ansible, you should star that. There's some very good use of vars going on, and I'm going to use some of these examples to improve my playbooks. Thanks! If you're thinking about using Ansible in any capacity, star/fork this project!

</comment></comment></comment><comment><USER55> LIFS (Linux Iptables Firewall Script) is aimed at what UFW does but it also provides NAT, port forwarding and allows you to work with groups of hosts and services.

[http://code.google.com/p/lifs/](http://code.google.com/p/lifs/)

</comment><comment><USER56> Where can I buy this as a service?

<comment><USER57> You could use Heroku, Amazon Elastic Beanstalk, or a myriad of similar services. You could also hire a consultant to secure the system for you.

<comment><USER58> The consultant route is a lot easier said than done; at least, if you want a good consultant.

Most truly competent sysadmins already have full-time employment by a product company or hosting provider. Most so-called sysadmin consultants are former web developers who taught themselves Linux and security, and don't know what they don't know.

</comment></comment></comment><comment><USER59> What is the purpose of creating a new user and not using root, assuming ssh password auth is disabled, and only I have the key. Making a new user that has sudo an attacker geting that user as opposed to root all they have to do is sudo anyway?

<comment><USER60> Sudo ask for your account's password, so it's a protection in case someone manage to get your private key (or manage to login with OpenSSH using an exploit).

</comment></comment><comment><USER61> There seems to be a lot of wasted breath in these comments about IPv6. Given that its unlikely that your provider even supports IPv6 on their networks, and that globally the traffic via IPv6 is nearly non-existent, I wouldn't spend too too much time caring about it.

Less than 2% of traffic to Google is IPv6: [http://www.google.com/ipv6/statistics.html](http://www.google.com/ipv6/statistics.html) Even the attacks CloudFlare sees are mostly DDOS: [http://blog.cloudflare.com/ipv6-day-usage-attacks- rise](http://blog.cloudflare.com/ipv6-day-usage-attacks-rise) Traffic through Akamai is minimal: [http://www.akamai.com/ipv6](http://www.akamai.com/ipv6)

Maybe someday it makes sense to spend a lot of time around IPv6 defenses, but today is not that day.

<comment><USER62> Their breath is not wasted! This is an article about securing a Linux server, and explicitly talks about adding a firewall with iptables. If it will only defend against IPv4-enabled attackers, then the server operator is at risk of leaving the system open to compromise.

Learning about ip6tables or turning off ipv6 entirely if not needed would be a better discussion topic, but people here are right to care about a major oversight in the security notes presented.

</comment></comment><comment><USER63> Very useful for any Linode user.. Compare to AWS, I find it hard to manage security on Linode boxes.. Need concept of security groups like AWS configurable and manageable from UI..

</comment><comment><USER64> Is creating a new group really necessary? Doesn't ubuntu have the 'sudo' group for exactly that purpose? And others have 'wheel'.

<comment><USER65> Yes it does, and Debian has staff.

<comment><USER66> The group in Debian is also sudo. The staff group is used to manage /usr/local (and is going away in future Debian releases, since it's root-equivalent anyway).

</comment></comment></comment><comment><USER35> Change the default ssh port and use .ssh/config to predefine connection parameters. This way you can write _ssh mybox_

</comment><comment><USER67>
      you'll want to lock down SSH access entirely,
      and make sure that only you can get in

This sounds like Ubuntu is by default open to everybody via ssh. I find this hard to believe.

The whole article sounds like a lot of fud to me. For example, what benefit is there in creating a new user with sudo privileges instead of using root directly?

<comment><USER68> > For example, what benefit is there in creating a new user with sudo > privileges instead of using root directly?

Users should run with as few privileges as possible. Logging in as root requires two sets of keys.

Sudo logs all commands. The commands usable when using sudo can be limited, whereas root gives access to everything. Using sudo creates heightened awareness of risks.

Root is a high value target. Giving it a strong password is important, but locking it is better.

</comment></comment><comment><USER69> The .ssh folder and the files inside it should be given the lowest permissions possible.

<comment><USER70> Just to avoid confusion, I would have said "most restrictive", not "lowest". At first glance, "lowest" might be taken to mean most permissive.

</comment></comment><comment><USER71> port knocking to open ssh can come in handy in certain setups as well...

</comment><comment><USER72> Is there any chance of getting a guide of this for FreeBSD?

</comment><comment><USER73> Change default SSH ports should be mentioned right away.</comment>


140 Characters Spell Charges and Jail - <AUTHOR> http://www.nytimes.com/2013/07/03/us/felony-counts-and-jail-in-140-characters.html?pagewanted=print

<comment><USER2> At least those agencies are not reading my private messages.

Oh wait.</comment>


Show HN: DocTemple – My first SaaS startup after 6 months of solo development - <AUTHOR> https://doctempleapp.com <comment><AUTHOR> Hello HN,

I'm Jan, creator of DocTemple.

The idea came from doing much more advanced version for one of my customers where he needed a tool to fill repetitive templates with data from the database. Employee enters database id and based on the data it filled it accordingly (with loops and conditional statements within document).

After working on it I was like "Wait a minute, there has to be more companies that are underserved in that specific area of filling templates manually." So I created a completely new app based on the same idea - to let people fill thousands of templates in minutes instead of hours. And to let them do it in simple fashion. I truly hope I achieved that.

After long 6 months of developing my own product (there where months that I had only 2 days to work on it because day job and life + never implemented payments before) and making sure everything works as I wanted I can finally say it's ready to show it to the world.

For sure the biggest challenge here will be to find the companies that actually need it.

I hope you will like this little tool! If anything you can reach me out here and on the chat on the site as well.

Thanks and looking forward to your thoughts and feedback!

</comment><comment><USER2> Nice work!

I believe you should make the video visible, many people prefer a short intro, and the link isn't that large. Also, I'm not sure whether you intended to have it play the music or that was what you were listening to while recording the screen cast, it was a bit confusing to me.

It's similar to Word's serial letters, only that it produces individual files, right? Maybe you can put that into simple sentence and why it's better than using serial letters. How does it prevent (common) errors? A short "don't you hate it when ... happens? We've got you covered by doing ...." or something similar will make it easier for people to understand the value, as if you're telling a co-worker about this new cool thing that solves/improves something you've both been working with.

Since data will be uploaded (which likely will include PII), especially in a corporate context, you might want to put more emphasis on being GDPR compliant, and offer an automated way to sign a data processing agreement so users can stay compliant as well.

It made me remember the first time I used the serial letter system to print a mailing and I somehow managed to edit some fields and turn them into text, so I ended up with "Dear {firstname} {lastname}", but only noticed it when I picked up the 500 pages from the printing shop.

<comment><AUTHOR> Thanks!

Yes, I was struggling with decision to make video more visible (under the headline) and I realized that on mobile then it would show in that order: \- headline \- video \- actual product

From what you are saying it might be actually better to do it like this. Will test that for sure. Also, the background music thing - it's little embarassing, but I originally put video without music and after I while I was like "Hmmm, it's seems a bit dull without music" so I added one from YouTube music library. Seems like that wasn't my best idea so far :D Should I take that music down?

Using Word so many years I must say I never really used serial letters, but yes - turns out to be the same idea behind it. Very good point about conveying value more clear - need to incorporate these as well.

Regarding GDPR compliance - actually files never even leave one's machine. It all happens in the browser (one reason is that doing it on the server was as fast so no point sending it over) so because of that I THINK (must check though) it's already GDPR compliant (because beside emails that are kept on Google Firebase I keep no data).

<comment><USER2> Music is fine, but something less niche might work better - it was almost in sync with the music I was listening to, but might be off-putting to people who aren't into electronic music. Maybe there's some elevator music that fits better - and a spoken message helps understand the concept, especially for normal people who aren't power users or developers.

GDPR-compliance sounds good when it all happens offline in the browser. I'd definitely make that a selling point. Everyone is on their toes about it, if you can take away the worry of "Where is that company located? Where are their servers? Do I need to run this by our data protection lawyers?", you've removed a lot of barriers.

<comment><AUTHOR> I didn't expect it to be such a big thing. I will definitely implement these today. Need to think now how to put it nicely together on the site.

"Where is company located?" \- well, formally in Poland, but server-wise it's all Google so what should I say here? Or it doesn't matter when it's all offline?

And just for the record, I really appreciate your valuable inputs!

<comment><USER2> You're welcome.

I'd definitely mention Poland, since "made in EU" is a big bonus for everyone in the EU (both for privacy and for billing/payments). If the data isn't uploaded, the servers don't matter for that part. They're relevant regarding you user's personal data (e.g. their IP), but if their CSV doesn't touch the server, that's ideal from a privacy perspective. You'll still need to put your use of Google into your privacy information, but that's a formality and very few people (especially in a company setting) care about their own PII being stored on your server - it's other peoples' PII that they get in trouble for.

At least for enterprise customers, you might also need to be more transparent about yourself, i.e. "Who's offering this service". You'll need to have it for billing anyways, and will also require it in your privacy notice ("who's responsible, who can I contact about my data").</comment></comment></comment></comment></comment>


Enterprise Ready SaaS Feature Guides - <AUTHOR> https://www.enterpriseready.io/ <comment><USER2> If you are a startup that is building a product you should consider these future wants when writing code.

Audit logging, different roles, teams, permissions, auth mechanisms etc.

Believe me when I say it is a lot easier to add these things in the future if you consider these future wants when building your abstractions. This may sound like a lot of work and accounting for unknown unknowns, but doing things like

        if (userHasPermission()) {}

instead of

        if (user->permission == 1) {}

will make your life much simpler down the line.

</comment><comment><USER3> I love this site. Change Management is a super important one that often gets missed. Enterprise customers will have strict workflows around migrating changes from Dev, to Test, and then into Prod. They'll need warning about upcoming changes so they can plan and train users as well, which is often overlooked.

A good example is a government client I recently worked for. For major application upgrades and changes (which they needed to apply to keep their SLAs in place with the vendor), they needed at least 12-18 months notice, because if they needed to re-train 15,000 users, that takes time and lots of money. And if they needed lots of money, they needed to submit a business case to the government and get funding in the next financial year.

<comment><USER4> but how does that work out for a SaaS app? (especially a startup that's always adding in new features?)

I mean, one idea is to create sub domains - each running a different version of your app...but at that point, you kind of loose control and companies would love to stick to an older version (and you'd have to support an older version).

<comment><USER3> The same way that Salesforce does it - allow you to flick a switch and transition to a new interface, or turn on a new feature, or whatever.

In terms of remaining on older versions, vendor typically restrict this through SLas - For example, you might only get your Tier 1 SLA response (acknowledgement of a serious issue within 1 hour, for example), if you're on the current version, or the previous version. Once you're on an older version those SLAs often don't apply, and large organisations mostly aren't ok with that.

<comment><USER4> Thanks for the reply!

> Once you're on an older version those SLAs often don't apply, and large > organisations mostly aren't ok with that.

Won't that just mean they'd not like the rate of progress (say daily updates for bug fixes, weekly updates for minor changes, and monthly updates for major changes), and just leave?

<comment><USER3> Ahh, now you're really getting into the world of B2E services!

They might just leave - but if it's a core service they need, it's a huge amount of effort to migrate users, data, implement a new system, rewrite all their process and documentation, helpdesk manuals, etc. They generally won't mind with general fixes and updates, but if you're changing existing workflows or features, or adding new capabilities in, they'll probably want control about how they roll that our to their users.

Enterprises generally don't sign up to SaaS services through a webform and a manager somewhere punching in their Amex (although it does happen sometimes). There'll be a proper contract, with lawyers, and negotiations, etc. There'll be clauses in the contract that most enterprises don't want and they'll try to negotiate away - for example, under what circumstances can the vendor (you) terminate the service? If the Enterprise has spent heaps of money to move onto your service, they'll want assurances that you can't terminate the contract because you feel like it - and if you do, that they can sue you for damages.

As you can see it's definitely a conscious decision that you'll need to make if you want to target these Enterprise customers - it's a big investment, and often (particularly in government or if your service is going to be a core platform) you'll get contracts that commit you to 5+ years of service, but the flipside is that now you've locked in 5+ years of revenue from that customer.

<comment><USER5> I love this conversation. @ohstopitu thanks for asking great questions & @NeutronBoy thanks for providing great answers.

</comment></comment></comment></comment></comment></comment><comment><USER6> This is a great guide. It also underscores why it is so difficult for young startups to unseat big incumbents like Oracle in Enterprise. Not only you have to compete with every corner case features, but also have all the other stuff done. Other things I would add to this list are: Accessibility and RTL readiness, configuration / implementation guides, Text replacement guides

<comment><USER5> Thanks & you're right these are all the things that are easy to overlook when eyeing up an incumbent. Accessibility - great call - did this at our last SaaS company (for mobile too!). A few questions... I'm unfamiliar with RTL readiness, can you elaborate? Same with text replacement, are you referring to internationalization?

<comment><USER6> As the poster said below, text replacement gives customers the flexibility to brand things differently internally. For example, the app label says "chat", but customers want to re-label that and say "conversations". This is at the basic level. You also have to think about internationalization - can you replace chat in Spanish with conversation in Spanish.

RTL = Right to Left. If the customer has operations in Middle East, they would need to display Arabic or Hebrew text, which unlike English, goes from Right to Left. Which means your screen orientation should be changed as well. If you have a screen with a picture on the left, for an Arabic user, the picture needs to move to the right.

I also should have added internationalization to my original comment. Asian characters, especially Japanese, can cause a lot of challenges.

<comment><USER5> Thanks for clarifying. Text-replacement makes sense in that context, definitely related to both white label & internationalization.

RTL... most browsers have some sort of RTL support, correct? `dir="rtl"` (I'm not an expert on RTL... I'm confident that given a piece of paper with Hebrew text on it I will still rotate it 3 times before realizing that it is not upside-down English).

I'll get these all worked into the guide soon (or if you're feeling enterprisey... it's open source and we'd love contributions: [https://github.com/enterpriseready/enterpriseready/tree/mast...](https://github.com/enterpriseready/enterpriseready/tree/master/content/features))

</comment></comment></comment></comment><comment><USER7> I really like B2B SaaS. As long as you can show reduction of cost or labor, a business has a clear reason to make the buy.

Awesome to have so many real-world examples in this guide, and not just generalized advice.

For another example, here is Sidekiq's Commercial FAQ for customers looking to decide between 'Pro' and 'Enterprise' subscription levels. It gives some insight into the tradeoffs that make sense for both sides at the Enterprise level: [https://github.com/mperham/sidekiq/wiki/Commercial- FAQ](https://github.com/mperham/sidekiq/wiki/Commercial-FAQ)

This is particularly interesting to me as I previously co-founded a B2B SaaS and am currently launching a copy of Sidekiq's model for NodeJS.

<comment><USER5> Agree, I moved away from consumer stuff primarily because I think that enterprise buyers are more rational & logical (not completely... but more than consumers).

If you're looking to create an enterprise installable version (a la Sidekiq)... well... read the deployment options post: [https://www.enterpriseready.io/features/deployment- options/](https://www.enterpriseready.io/features/deployment-options/) (we run a company that helps other companies do just that).

</comment></comment><comment><USER8> I work in a heavily regulated industry and we cannot even consider a SaaS application until it does nearly all of these things. If an application doesn't have SAML, SIEM ready audit logs and RBAC it can't even be added to RFP consideration, let alone bid for our business.

I have sat through a number of startup SaaS pitches where the product looks interesting and would solve one or more active business problems, but when I ask about roles or audit logs it hasn't even been considered and I cannot consider it any longer.

One item lacking from the list is tenant isolation. We don't always require a fully isolated tenant (though we often do if customer data is going to be stored in the cloud), but we do require whatever isolation there is be fully documented and provided.

I'm also noticing a trend among SaaS providers to have what they consider strong SLAs we find laughably weak. If your SEV1 SLA is more than 30 minute response time you're not ready to pitch me anything. This isn't beating up on the new guy; our internal business-critical applications all have 15 minute response requirements for the internal support teams.

</comment><comment><USER9> One thing that I'd suggest adding is the ability to ship logs to external destinations.

Platforms like Splunk and SIEM tools are really common these days and analysis often takes place there for large companies. Coordinating user access activity in the cloud against employee termination, for example, is something that is high value and usually cannot take place in a cloud service.

<comment><USER5> Totally agree on that being super important and often overlooked. We tried to cover that in the section about audit logs being accessible from an API: [https://preview.enterpriseready.io/features/audit- log/#key-f...](https://preview.enterpriseready.io/features/audit-log/#key- functionality) is there additional detail you think we need to add to that section?

<comment><USER9> I somehow missed that section.

That pretty much covers it I think. We have a few services at work that I thought were sending native syslog, but it turns out we have a daemon pulling those logs from an API.

</comment></comment></comment><comment><USER10> This is also about enterprise in particular, distinct from ordinary B2B. If you don't work enterprise, the distinction can be lost. The sales process can be long and slow, with lots of customization and seemingly arbitrary requirements.

On the other hand, if you can build an enterprise-worthy product and a sales team that can handle it, it's an incredible cash cow. Six and seven figure contracts.

</comment><comment><USER11> This is a really good overview of some features that are common in enterprise SaaS, but I would caution against thinking that they're necessary to be successful in enterprise SaaS.* My experience has been that if you have a really compelling core feature set, most everything else is negotiable. Some are nice to have, some are regulatory, and some are just something someone added to a list because they thought it sounded like a good idea. Even the ones you do decide to implement, make sure you do enough customer discovery to figure out how it relates to your market.

* Except security. Always be thinking about security.

<comment><USER5> I appreciate your level response. You're correct that these features are not absolutely, always necessary for success. I would caution that even with a an incredibly compelling core feature set, you still have to negotiate yourself out of not providing these features. Even when you win you might be creating a maintenance nightmare for someone down the totem pole within your customer's org. Part of what we're trying to do with EnterpriseReady is show that many of the non-core (yet common among many enterprise customers) features 1) aren't that hard to understand 2) can be built really well in a way that will delight your users.

* As the OP, when you say: "some are just something someone added to a list because they thought it sounded like a good idea" \- I genuinely hope that I did not do that.

 __100% - Always be thinking about security.

<comment><USER11> I could have worded that better, I was referring to someone within the client organization adding on requirements arbitrarily.

<comment><USER5> Ha, makes sense... I didn't really take any offense.

</comment></comment></comment></comment><comment><USER12> This is a really great guide... as a consumer/startup person, I never would have realized some of these things are features larger companies need (audit logs, how pricing forms should be laid out, etc)

</comment><comment><USER13> It is pretty interesting. Nice guide.</comment>


Mocks Aren't Stubs (2007) - <AUTHOR> http://martinfowler.com/articles/mocksArentStubs.html <comment><USER2> I feel like this distinction is arbitrary and unintuitive. A mock is literally just something that mimics something else. All "doubles" can be considered mocks. Claiming that mocks _insist_ on call verification seems like a very forced categorization. If there's value in this distinction, maybe we need new terminology instead of asserting that everyone who's conflated "stubs" and "mocks" for two decades is wrong.

As a side note, verifying call patterns makes for terrible, brittle tests that cost far too much to maintain. This pattern is great for enforcing call patterns that truly that matter for, e.g, performance reasons (no unexpected cascade of DB calls), but is typically just a giant pain that provides little to no value, because instead of testing that the code does the right thing, you're testing that _it doesn 't change_.

<comment><USER3> There are objects that demand to be interacted with; there are objects that allow only certain predefined interactions; there are objects that allow any interaction and record them all for later inspection; and there are objects that are simple implementations of interfaces whose "real" implementation is more complex. Each of these object types exists in practice, and each is clearly an example of some larger category.

One group of people says "these should all be called mocks". Another group says "these are mocks, stubs, spies, and fakes, respectively, and collectively these are called test doubles". You can prefer the simplicity of calling them all "mocks" (simplicity is nice) but that leaves you with no way to distinguish between the types.

These categories seem like hair-splitting if you've written relatively few tests using test doubles. Once you've written a few thousand, you start to wish for even finer-grained distinctions. This is how basically everything works as you get deeper into the details: you need words for the fine-grained distinctions.

As far as I know, there has never been a competing set of terms. The only major positions are "we should use [the words I mentioned above]", which is mostly favored by those who have used a lot of doubles; and "we should not use separate words at all", mostly favored by those who haven't used a lot of doubles.

<comment><USER4> One of the things that programmers do that I find most frustrating is proclaim that the definition of words that they use is the objectively correct definition, and frame their entire discussion as an argument that other people aren't using words correctly. Pick any term and the kind of argument comes to mind - "type," "object," "metaprogramming," "dependency injection," "design pattern," etc.

This article has a lot of good content about testing strategies, as well as an introduction to some of the jargon used in a certain testing discourse, but the argument is framed as telling you that _mocks aren 't stubs_, and you, the reader, have been using these words incorrectly. But the reader has only been using these words differently.

This is a very common pattern of behavior among programmers and I think it is worthwhile to push back against it, separately from acknowledging the useful information in this article. (And the grandparent comment you replied to also did some of this as well, of course!)

<comment><USER3> I agree with you in general. In this case there's only one coherent taxonomy in widespread use so I think it's reasonable to say "just use it".

It's unfortunate that people who aren't already experts on a topic can't tell whether that kind of decree represents consensus or someone's idiosyncratic opinion (and there's plenty of both in general).

Framing is a different thing, though, and I can't comment there since I haven't re-read the whole article recently.

</comment></comment></comment></comment><comment><USER5> I often found that these terms are not very usefull when explaining the concepts of IoC in testing (which is essentially what they do) to colleagues who were unfamiliar with it. Programming in .NET I usually tried to use frameworks that avoided the terms, such as NSubstitute where you create an object by substitution:

var format = Substitute.For<IFormatCode>();

I haven't used it in a while but I remember that Rhino Mocks asked for ridiculous code like

var format = MockRepository.GenerateStub<IFormatCode>();

(Which one is it, a Mock or a Stub? And: Does it matter?)

I recommend Gerard Meszaros excellent book XUnit Test Patterns, he makes more fine grained distinctions between different aspects of testing. I liked his notion that you simply create objects that produce or react to "indirect input and output" (i.e. exceptions, opcodes, sideeffects) rather than "direct input and output" (which is what "arrange" and "assert" are checking). Mocks and stubs are only realizations of different patterns.

[http://xunitpatterns.com/](http://xunitpatterns.com/)

<comment><USER6> That's an outstanding book. I'm not a Java programmer and that still might be the best book on testing, how to design tests, what to test and how think about testing at a high level that I've read.

</comment></comment><comment><USER7> Every validation you do on a mock is an assertion on outside behavior that is in no way coupled with your test. If that behavior changes, your test is now false. Not failing. False. That concerns me.

<comment><USER6> Yeah, maybe there is an approach that works well with mocks but this has always concerned me as well. It's rare (for me anyway) that I want to test which calls a function makes rather than if the function returns the correct result.

I can imagine scenarios where that is useful and I know how to use mocks when that comes up ... but the examples are always a system where mock based testing is strangely coupled to implementation, very fragile and have the scary failure mode you describe.

<comment><USER8> Typically, I find that I'm concerned with what calls a function makes when those calls interface things external to my program. I.e. I'm asserting that a request to a given http endpoint is made, or that an smtp client sends an email. I assume the external libraries work and am testing my interface to them.

<comment><USER7> This is where I find myself having to use these. Though, I greatly prefer to have the test merely check for the result of the call, if I can. e.g., if I have to post to a url to delete something, check to see if said something exists. In the end, it is not the call that I care about, but what the call was supposed to do.

This way can lead to brittle tests, clearly. But the reality seems to be that brittle systems lead to brittle tests. There is no testing panacea.

</comment></comment></comment></comment><comment><USER9> This article is almost universally cited when a book or article on testing or TDD begins the inevitable discussion of mocks/fakes/stubs. But in real life, this is a distinction without difference. I have never once heard someone use the term 'mock' and be misunderstood because he/she should've used 'stub'.

</comment><comment><AUTHOR> How do you test your code that interacts with external components, like sending emails to a mail server or making an external API call without using some sort of test fake or stub? (using the definition of them from the article)

I'm new to TDD and refactoring legacy code for testability. With the code architecture I have it looks and feels like I need either a mock, fake, or stub.

I'm using an IExternalComponent interface as a parameter and for the concrete implementation I can either pass the real thing (it's non deterministic, this works if the service is up) or I can pass a test double that allows me to throw exceptions at will and force failure conditions to be tested.

Is there another way of doing this that I am missing?

</comment><comment><USER10> Love this article.</comment>


Evil.js: A JavaScript library for thwarting hot-linkers - <AUTHOR> https://github.com/kitcambridge/evil.js <comment><USER2> Reminds me of a script I wrote when a site based in China cloned our entire domain and put it up at a new URL, complete with clumsily photoshopped logos. They left a single stray call to our ad server, though, and I was able to "hack in" and randomly flash a "This site is stolen!" message or insert an auto-playing Youtube clip of my choice.

<comment><USER3> YouTube is blocked in China...

<comment><USER4> He could link to Falun Dafa exercise videos and watch as their customers disappear one by one...

<comment><USER5> That will get his ad server blocked in China, which he might not want.

<comment><USER6>
        window.location = "http://someone-elses-site.com/Falun_Dafa_exercise_video.mpg";

<comment><USER5> Trolling the GFW... that could be an interesting experiment :) [http://gov.cn/taiwan-is-a-sovereign-state/](http://gov.cn/taiwan-is-a- sovereign-state/)

</comment></comment></comment></comment></comment></comment><comment><USER7> I did not realize until checking out this source that dividing by zero in JS outputs "Infinity".

[https://github.com/kitcambridge/evil.js/blob/gh- pages/evil.j...](https://github.com/kitcambridge/evil.js/blob/gh- pages/evil.js#L87)

<comment><USER8> And, awfully-enough, even though Infinity is a required part of IEEE754, and happens all the time in Javascript, _JSON doesn 't recognize it._

<comment><USER9> IIRC, JSON is a strict subset of JS _and Python_.

<comment><USER10> is it? "null" is not valid python, I think

<comment><USER11> It isn't. It would be _None_. I believe parent is mistaken.

<comment><USER9> I stand corrected; I am not that familiar with python. Though I remember reading somewhere that JSON can be _eval_ ed in both JS and Python. Perhaps the python bit is not true.

<comment><USER12> JSON looks more-or-less like a Python dict, but you still wouldn't be able to parse {"x": NaN} or {"x": Infinity}

<comment><USER8> Oddly, there's actually no language that I know of that has NaN and Infinity constants. Many languages pretty-print those float values that way, but none of the parsers can interpret them back in.

<comment><USER13> ...do you mean other than JavaScript? They're not actually parser-level constants, they're just defined as globals/on the window object, but they work.

</comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER14> Very cute. :-)

Now that we've all had a laugh, wouldn't it make more sense to have the server respond with a redirect to a shared copy of the script hosted somewhere that provides bandwidth for free? (Perhaps this is a sign that the script should be open-sourced as well.)

<comment><USER15> If someone hotlinked one of my scripts, I'd update the head of the script and use the opportunity for free marketing:

        if(!window.location.host.match(/(www\.)?myapp.com/)) window.location = 'http://www.myapp.com';

I bet they won't hotlink after that.

<comment><USER16> I know someone who had, of all people, Facebook hot-linking to his stuff. He redirected all visitors to his homepage. Then Facebook's legal department called his home number, his wife answered and got nervous, and it all ended there.

<comment><USER15> Interesting! I personally would have loved to have a chat with Facebook's legal team about the issue. Although I'm a bit surprised they'd actually call him instead of either a) not hotlinking anymore (seems to be the most obvious solution) or b) just sending a quick C&D.

I'd be surprised if they actually have a leg to stand on legally if they are hotlinking off someone's site, especially if there's have no prior agreement to allow them to do so.

<comment><USER17> Sounds fishy. It would take days for any kind of legal action like this. Doesn't FB push code like every couple of hours? A code patch would have been many times quicker.

</comment></comment></comment></comment></comment><comment><USER18> What if someone hotlinks evil.js?

</comment><comment><USER19> So we can check the hostname from our code and hot-link evil.js from [http://kitcambridge.be/evil.js/evil.min.js](http://kitcambridge.be/evil.js/evil.min.js) :)

</comment><comment><USER20> The documentation is lacking.

<comment><USER21> The non-minified source is pretty self-explanatory. It modifies a lot of the standard javascript functions. My favorite is the document.write(element) is modified to surround the element with <marquee> and <blink> tags and then write that to the DOM.

<comment><USER22> I like Math.pow = function() { return "pow pow pow!"; }

</comment></comment></comment><comment><USER23> Can we get a demo?

<comment><USER24> From the github page: [http://kitcambridge.be/evil.js/](http://kitcambridge.be/evil.js/)

<comment><USER23> Is something supposed to happen interaction-wise when I go to that page though?

<comment><USER25> No, it just prevents other scripts linked from the same page from working via sneaky, nefarious means that make it hard to debug.

<comment><USER23> Oh! OK. cool.

</comment></comment></comment></comment></comment><comment><USER26> As a "bonus" you will make your site unusable for suffix proxy users.

</comment><comment><USER6> And the logical follow up, evil.css: [https://github.com/tlrobinson/evil.css](https://github.com/tlrobinson/evil.css)

</comment><comment><USER27> To stop leechers - couldn't you just, in your script >

        (function(){
          if(document.domain != 'mydomain.com') return;
        // my script
        })();

<comment><USER28> Why be nice? >:)

      (function () { if (document.domain !== "mydomain.com") { while (1); }})();

</comment></comment><comment><USER29> Not to be confused with evil.js: [http://andjs.com/code/eviljs/](http://andjs.com/code/eviljs/)

</comment><comment><USER30> combination and minification also prevent hot-linking

<comment><USER31> I've had experience where someone doesn't just hotlink a resource, but they "clone" it, and replace our ads with their ads. Assuming evil.js works by detecting host names, this would help prevent that.

<comment><USER4> It doesn't, as a cursory glance at the source would show.

<comment><USER32> The server could check which page is embedding the script and then server evil.js instead of good.js :)

<comment><USER33> Better hope they don't visit the real site after the fake site!

<comment><USER34> Don't cache the fake version?

</comment></comment></comment></comment></comment></comment><comment><USER35> Better not minify the library with JSMin.</comment>


Surviving Burnout – Learning to Identify Burnout - <AUTHOR> https://spin.atomicobject.com/2020/07/09/identify-burnout-signs/#.XwdMETkB25c.hackernews <comment><USER2> I think this is a really important topic with people working from home now- and really worth periodically reminding people of. No longer are there the social barriers to staying at work until midnight and then getting up at 6am.

I would not say I suffer from burnout, but I would say that I sometimes work too hard. The difference is that I'm not sleep-walking into an unhealthy situation, I'm making a pro-active decision to sacrifice some parts of my personal life for career progression(well, not really career progression, but doing a good job and getting rewarded for it). Sometimes the difference is being concious of what you're doing, and setting boundaries in terms of how long you commit and how much you work. I'll admit, it may be easier for me to do that than others, it's often difficult to take a step back and really realise whether what you're doing is life or death.</comment>


Entanglement distributed over 1200 km by quantum satellite - <AUTHOR> http://physicsworld.com/cws/article/news/2017/jun/16/entanglement-distributed-over-1200-km-by-quantum-satellite <comment><USER2> Active discussion: [https://news.ycombinator.com/item?id=14566173](https://news.ycombinator.com/item?id=14566173)

</comment><comment><USER3> "The test verifies a mysterious and long-held tenet of quantum theory, and firmly establishes China as the front-runner in a burgeoning "quantum space race" to create a secure, quantum-based global communications network—that is, a potentially unhackable "quantum internet" that would be of immense geopolitical importance."

<comment><USER4> I was under the impression this was just not possible and not how entanglement worked.</comment></comment>


Scribd Had A Blowout Year, And So Did the Web Document - <AUTHOR> http://www.techcrunch.com/2008/12/31/scribd-had-a-blowout-year-and-so-did-the-web-document/

<comment><USER2> I realize that someone, somewhere, is running webtv and would love a service like Scribd. That person is not able to use it because it's a flash and javascript nightmare.

The rest of us, who have regular PCs with the modern software that scribd requires, have document readers for all of the various file formats. The very worst of these readers is faster and more pleasant to use than the best scribd rendering.

Lastly, as usual, TechCrunch measures success in terms of users and investor capital. Ask yourself: Does it really make sense to measure the success of a free hosting service in terms of unique users?

<comment><USER3> About the speed issue - how is a 20 MB reader (Adobe Reader 9) plus the cost of downloading the entire pdf faster than a 200 kb swf file and having the document streamed? That makes no sense.

<comment><USER4> Half of the "documents" seem to be either plain text, or a plain image (porn).

The most viewed "document" on scribd of all time: <http://www.scribd.com/doc/26896/SUING-FOR-TOO-MUCH-SEX>

Do you think it's sane to "stream" that document? What the hell are these people thinking??? They're wrapping plain text inside flash. One can only imagine their warped mentality. Why not convert plain text to a video, upload it to youtube, and embed the video. It'd make about as much sense.

<comment><USER5> This is the modern version of people emailing each other Microsoft Word documents with photos in them. I never understood that either.

<comment><USER6> That is because some corporate email systems block attached image files.

</comment></comment></comment></comment></comment><comment><USER4> This is sad news. Just when you thought flash was dead for all but video, it's now being used to show text.

<comment><USER3> Have you ever thought about using flash for your web chat service? I'd actually prefer it over standard javascript, especially because it would have a real socket connection.

Also, flash has pretty good support for text rendering. You can embed any font into any swf file, and it has anti-aliasing and effects. There was a presentation about the new flash 10 text features recently - <http://is.gd/ejKj>

<comment><USER4> From a user point of view, why do you care if it has a real socket connection, or a emulated connection that does exactly the same thing? I'm not sure any user anywhere would notice the difference. There is no noticable difference in terms of latency, negligible difference in terms of bandwidth. I have thought about the possibility of using it where available, but I don't think it'd really be worth the effort and potential issues.

Fair enough for text rendering, but html is getting better font rendering also. I know which I'd put my money on. I can't even select the damn text on scribd.

<comment><USER5> The real place I could see Flash being great for mibbit is it would allow you to build an embed that could be used on sites like Myspace which allow Flash but not Javascript content.

Let me know if you ever want me to show you how to get a sane Flash dev environment set up - I have the war-wounds from writing most of Justin.TV's Flash code ;-)

<comment><USER7> Make it a blog post of some sort? I'd read it.

<comment><USER8> I'd be interested in reading that as well.

</comment></comment></comment></comment></comment></comment><comment><USER9> I will be charitable here (you can tell I am not a huge fan either!). I have seen a couple of people use the site, and they use it to publish short stories and such. They could always post it to a blog, but I think Scribd gives them nice search engine optimization. Even for this legitimate use case, the flash player is a bit of a turn-off for me.

But the reason I am not a huge fan is the sheer extent of copyright abuse going on there. Turning a blind eye to it - hiding behind DMCA really - is not kosher, and I frankly wouldn't want to do business that way, no matter what the profit.

<comment><USER10> Guess you are anti-ISP too?

<comment><USER9> Exactly the response I meant by "hiding behind the DMCA". To call Scribd an ISP is a stretch. They pretty much _invite_ anyone to upload anything, and it is not clear they take any step to take out copyrighted content ( _entire_ books can be found there) until someone sends a DMCA notice. An ISP is a transmission service, while Scribd is a stateful, long lasting, very search- engine optimized storage service. An ISP doesn't by _design intent_ (SEO!) carry traffic to copyright infringing content. Some day a distinction like that could come back and bite them in the ass, but their hope must be to "exit" before that happens.

</comment></comment></comment><comment><USER11> i wonder how many of those visits resulted in a comment on the referring page complaining about scribd and asking for the actual pdf...

</comment><comment><USER12> Man, you guys are harsh. Even if it isn't a service you yourself would use, why bash a service useful for others? The first goal of many Y Combinator startups is to make something people want, and Scribd clearly fits the bill if millions of people are using it.

<comment><USER4> I disagree.

ONE person decides to use scribd to show some text on techcrunch, and suddenly the whole readership of techcrunch are "users" of scribd? Measuring success in terms of pageviews in a passive widget isn't a good measure.

<comment><USER13> I highly doubt comscore is claiming to be tracking embed/widget traffic. Those numbers are supposed to be for the site itself.

They are quantified, and quantcast shows the vast majority of their traffic is to their destination: <http://www.quantcast.com/scribd.com>

see scribd.com vs The Scribd Network

<comment><USER4> True, so people are linking instead of embedding. But the point is the same... If one person makes the decision to link to scribd instead of the pdf, and 100 people follow that link, it doesn't really mean 100 people value the service.

<comment><USER12> The traffic isn't just from people following links. What about the people uploading 50,000 documents every day _?

_ Source: Scribd says so, according to washingtonpost [http://www.washingtonpost.com/wp- dyn/content/article/2008/12...](http://www.washingtonpost.com/wp- dyn/content/article/2008/12/19/AR2008121900462.html)

<comment><USER4> True, although I'd guess a fair amount is webmasters trying to cross promote their content. Seems like if you own a porn site, you may as well post some "tasters" to scribd with your web address on, etc etc

</comment></comment></comment></comment></comment></comment><comment><USER14> Flash provides a PDF viewer component. I'd like to use it because I intend to adorn documents on my pages with additional controls and interactions. I can't inject my own UI and logic into your desktop PDF viewer.

Unfortunately, this Flash component only handles PDFs, not the wide spectrum of document formats. If I could reliably convert Word docs, Excel spreadsheets, etc. server side to PDF, then I would be a very happy boy.

Does anyone know of any such software that can do this? I doubt Scribd would be the one to provide it, but I would really love a simple `anything2pdf` that "just works": `cat foo.doc | anything2pdf > foo.pdf`

</comment><comment><USER15> Screw scribd. Give me something that converts pdfs into straight (x)html, and I will be happy.

<comment><USER16> > soffice -headless -accept="socket,host=127.0.0.1,port=8100;urp;" > -nofirststartwizard

> java -jar jodconverter-cli-2.2.1 yourpdf.pdf yourpdf.html

Happy now?

</comment></comment><comment><USER17> Fuck the haters. Scribd is awesome because it's a great utility for easily sharing your shitty Word docs and PDFs, and there is obviously demand for it as Scribd and all the Scribd-like knockoff sites each have more users than your worthless websites. Complaining about Scribd putting text in Flash is like complaining about how ugly Myspace pages are: while you were out bitching, a few talented people were out giving the masses what they wanted, no matter how many standards got violated, and will subsequently get paid for it.

<comment><USER4> If they get bought, I'll gladly eat my hat. If they become profitable by sharing documents free, whilst expanding the documents size massively by wrapping it in flash, I'll eat another hat.

<comment><USER18> So, wait. If they become profitable WITHOUT being bought, you still eat two hats? Or are they entirely separate hat affairs?</comment></comment></comment>