Is Amazon's cloud service too big to fail? - <AUTHOR> https://www.fnlondon.com/articles/is-amazons-cloud-service-too-big-to-fail-20170801 <comment><USER2> This is (I was surprised) a pretty good article. Financial services are regulated and based on recent experience, they're concerned with systemic risk. Most industries do not have anyone responsible for worrying about this kind of thing.

It seems reasonable to start worrying about the fragility potentially introduced by these massive internet infrastructure companies.

<comment><USER3> If you wanted to blow something up to make the west suffer, an AWS datacenter would probably be a pretty good target. I wonder at what point that becomes a legitimate national security concern, and the government steps in to provide protection.

<comment><USER4> Wouldn't you have to blow up at least all the datacenters in a region to make an impact?

<comment><USER5> All you need to blow is a few cables.

<comment><USER6> Why blow up anything or damage any cables? Hack the computer of an Amazon employee and do your damage there. The last S4 outage was because of someone fat fingering a script, imagine what someone could do that really wanted to mess stuff up.

<comment><USER7> This. Could've saved myself a comment elsewhere on this thread.

But, yeah, I'm kinda' surprised that this HN crowd in particular is so focused on hardware vectors.

<comment><USER8> And ultimately it leads you back to targeting the IT operations centre for the business where they provision equally to say both AWS and Azure for redundancy. At that point you can knock all of the biz cloud capacity off.

</comment></comment></comment></comment></comment></comment></comment><comment><USER9> If your architecture means your system goes down if AWS is down, then the question becomes can you replace AWS with something better that you can build, have means to build, have time to build, can keep running, can get enough momentum in term of sheer size of customer base to fund the upkeep of the platform?

If you can't build/run a better AWS replacement then it's a mute point, isn't it?

Then the question turns into if you can't build better AWS, can you architect your application to handle AWS failures? AWS itself lets you handle many kind of failures at AZ/DC level. Are you using that? For global AWS outages, can you have skeleton, survival critical system running on GCP or Azure?

Have you thought about outages that would be out of your control and out of AWS's control e.g. malware, DDoS, DNS, ISP, Windows/Android/iOS/Chrome/Edge zero day? How are you going to handle outages due to those issues?

If you are prepared to handle outages (communication, self-preservation, degraded mode, offline mode) then can a serious AWS outage be managed just like those outages?

<comment><USER10> irrelevant points are "moot", not "mute"

<comment><USER11> I think you mean "moo".

It's like a cow's opinion, you know, it just doesn't matter. It's "moo".

<comment><USER12> Have I been living with him for too long, or did that all just make sense?

</comment></comment></comment></comment><comment><USER13> Even at a smaller scale it is a little nerve-wracking to know be so reliant on one provider. If AWS tanks there's a fair amount of code that'd need to be changed just to switch over to Azure or GCE. Failover with, e.g., email providers is easy enough, but the entire cloud stack (for lack of better terms) is a completely different ballgame.

<comment><USER14> I warn other developers at my company about this. When new projects spin up they're often very excited about using new Amazon services and will make any excuse to choose an AWS product over a stable open source solution. If I were a manager, I'd be very worried over the vendor lock-in.

I don't understand the preference for AWS over open source in many cases. Their services are "reliable", but they often have minute restrictions that will eventually bite you. You also end up having to pay for something you could get for free. Why use SNS/SQS when there are free pubsub/message buses out there? Most of the other devs justify this with the argument of not having to maintain the software themselves. "But RabbitMQ might crash! We don't have to worry about that with AWS!"

Anyway, I typically minimize the AWS services I use (S3, EC2, ECS) so I don't dread the day AWS blows up or, more likely, some VP or exec says we're moving to GCP/Azure because we got a better deal.

<comment><USER15> You're also forgetting that if you set up something on your own you also have all the hardware concerns as well. You need to procure hosts, provision them properly, deploy them, monitor them, scale them, fix them. That infrastructure cost doesn't go to zero but it is significantly reduced using a cloud provider.

<comment><USER14> I'm not arguing against cloud platforms in general; just the irrational use of very specialized services they offer. I can run a containerized service that uses open source packages on any of the cloud computing platforms. Now if I used Athena, SQS/SNS, DynamoDB, ELB, Lambda, EC2 that would make me very nervous, and I see other devs designing these stacks all the time. I guess I shouldn't care as much, because I'm not going to be the one to migrate that when the company gets a better deal from another platform service.

</comment></comment></comment></comment><comment><USER16> This goes to beyond having a plan-B for hosting your own stuff somewhere else. Think about all the 3rd party services you are depending on. Then think about how many dependencies those services have. How many trace back to Amazon on some level?

The connections that could cause problems may not be obvious. For example network provider running into trouble because a ticketing or monitoring system that depends Amazon does not work. Hardware supplier not being able to ship spare parts for your on-premise SAN because logistics company runs into trouble due to issues at Amazon.

</comment><comment><USER17> Personally as a dev, I find AWS's service in the middle of Paypal (shit, not sure why they're popular) to Stripe (Damn that was fast and easy) seeing as I used them both.

Their support is alright although you often have to pay for it but AWS docs are atrocious and remind me of university textbooks written by professors who like creating pseudo-scientific-sounding jargon which mixed with their huge array of features is quite un-comforting to use for even people with intermediate AWS experience (built some apps with AWS before kind of people).

I can see that there could be more specialized services like Firebase (which is built on Google Cloud) that should be built on AWS for the users. Firebase is a breeze to use and very responsive and I've used it to build real-time chat apps in a couple days.

</comment><comment><USER8> It took me three reads of the first couple of paragraphs to realise that "snowball" and "snowmobile" were actually hardware products that you can touch. Tech news publishers need to do a jargon check and use appropriate punctuation, formatting or something to call out terms that 90% of readers would not have come accross

<comment><USER18> Maybe its because I saw your comment before reading, but I had no problem understanding the first few paragraphs.

The author states that a "snowball" is a grey suitcase with 50tb of HDD space inside, and a "snowmobile" is a massive 18 wheeler with what I would assume is petabytes of storage.

<comment><USER8> It's probably because it's 5 in the morning here :-) But looking at Amazon's own references to the appliances, they always capitalise the name. I guess what I can only assume was intentional obscuring what are probably trademarks made it read poorly to me.

</comment></comment></comment><comment><USER19> When I was working as contractor for one of big banks, which dev was concentrated on Canary Wharf, they weren't able to successfully complete disaster recovery testing on their primary database cluster for 2 years in a row, I just don't remember, was is department-wide or bank-wide.

Basically, each 6 months DR testing was failing and it was accepted as harsh reality. After seeing how they're working inside, I don't think that moving their infrastructure to AWS/Azure/Google is worst that could happen.

disc: Currently working at Amazon, but not at AWS.

<comment><USER20> Why did they not redo the DR testing until it worked? Normally you iterate tests and bugfixes over and over until it works. Otherwise, what's the point of the test? Being confident that your stuff does not work at all?

<comment><USER19> It was bank-wide activity with defined schedule etc.

</comment></comment></comment><comment><USER21> That's why I think containerization and orchestration will be useful; open source orchestrators can standardize the infrastructure and make switching seamless. That way the infrastructure remains a commodity.

<comment><USER22> Except you can't containerize the huge amounts of data you are storing can you?

</comment></comment><comment><USER5> What would be great is the equivalent of the ACME protocol for cloud service providers. That will take a while and shouldn't happen until the offering matures and stabilises. But in an ideal world you wouldn't tie your application to a specific cloud provider. You should be able to lift and shift to another provider.

Which I think is a merit of using VMs as opposed to individual services.

<comment><USER23> _But in an ideal world you wouldn 't tie your application to a specific cloud provider._

You can do that easily if you just treat clouds merely as hosted hypervisors and think entirely in terms of VMDKs. But this doesn't make commercial sense to do at least in the short term - you need to utilise the layered services you are paying for anyway or you might as well just run your own DC.

<comment><USER24> It still makes sense for its elastic properties (from which EC2 got its name). You can't rent half a DC for an hour, but you can spawn generic instances from VMDKs on different providers with a fairly small abstraction layer.

<comment><USER23> Your data still needs to live somewhere and giant VMDKs being copied around aren't a reasonable solution, I'd argue.

</comment></comment></comment></comment><comment><USER25> Cloud services are concentrated by nature built with the same cloned DNA. Of course that is a systematic risk with so much it concentrated to fewer physical locations running on the same code.

Think Cloned bananas vs fingers disease but computers. [http://www.bbc.com/news/uk-england-35131751](http://www.bbc.com/news/uk- england-35131751)

</comment><comment><USER26> This does worry me. If there is a shortage of resources suddenly or a DC fire that takes out a region, then what?

We have contingency against this via our own infrastructure but I worry about organisations who don't have any.

<comment><USER27> One region isn't going to be effected by fire. And AWS have dozens of regions. They're even managed as separate units by separate people. You'll notice there's never been a large, multi-region outage of AWS.

<comment><USER26> Yet.

Some of the traditional apps we host are vulnerable hypervisor failure be that rack, DC or region.

<comment><USER27> Hardware always fails. That's why AWS has so many availability zones, regions and services that let you take easy advantage of HA across them.

</comment></comment></comment></comment><comment><USER28> The solution is pretty simple, AWS/Azure need to provide on premise versions of their cloud.. You'd probably get stuck with a particular version, but better than nothing.

<comment><USER29> That's pretty much what Azure Stack is:

[https://azure.microsoft.com/en-gb/overview/azure- stack/](https://azure.microsoft.com/en-gb/overview/azure-stack/)

There might well be a commercial niche for providing Azure Stack hosting in non-Microsoft data centers.

<comment><USER30> I think there is a massive market for 100% cloud-compatible local deployments. In my personal experience every .Net shop I've seen would love to be incorporating more Azure goodness locally, but can't as they're cloud specific techs which bump into the realities of deployment and maintenance.

Personally, I think MS crapped the bed a little by taking Azure Stack off of commodity hardware and onto a combined hardware/software solution. Being able to deploy Azure-compatible solutions piece-meal locally would be a massive boon to governments, healthcare operations, and anyone working on a more thorough migration to the cloud.

Most of the EU, for example, has privacy regulation that makes cloud hosting impossible in some situations. Having a 'local Azure' would make it highly reasonable have all apps architected around Azures components and technology. Without the local deployment though you're kinda stuck with each foot in a different canoe... Hybrid infrastructures are highly favorable to DevOps and multi-party development scenarios.

<comment><USER31> From Scott Guthrie

""So if the performance is dropping, do you call the server manufacturer, do you call the networking manufacturer, do you call the load balancer manufacturer, do you call the storage manufacturer? They typically point the finger at the other guy and you spend weeks and months trying to debug and get your cloud to work."

[https://www.theregister.co.uk/2017/07/10/interview_with_micr...](https://www.theregister.co.uk/2017/07/10/interview_with_microsofts_scott_guthrie/?page=2)

We can all relate to that. A "cloud" is sufficiently complex that vendor blaming is an almost guaranteed outcome.

</comment></comment></comment></comment><comment><USER32> I think about this problem every now and then for my own business, but not sure what the right answer is. Supporting multiple clouds requires more involved management of some pieces of infrastructure (e.g., DNS + healthchecks, DB replication), which introduces another point of failure.

How do people who need to have more nines of availability manage this issue with cloud providers? (EC2 and RDS promise 3.5 nines per AZ, but I imagine outages are somewhat correlated across zones)

<comment><USER33> for people who need more 9s of availability on a single cloud provider, you have to start going multi-region. aws takes region isolation/independence very seriously, and along with geographic independence gives you effectively two entirely independent clouds which just so happen to have the exact same APIs. Some of the (really great) Netflix blog posts[0] have talked about multi- region services.

If you do go multi-cloud, I would be wary of picking regions that are located very close to each other. While you'll obviously get independent code and (likely) independent deployments, you're still susceptible to issues correlated with the physical location.

[0] [https://medium.com/netflix-techblog/global-cloud-active- acti...](https://medium.com/netflix-techblog/global-cloud-active-active-and- beyond-a0fdfa2c3a45)

</comment></comment><comment><USER34> Hasn't anyone heard of disaster recover plans? I used to work at a medium sized insurance company and every year we had a project to update our disaster recovery plans. Including our main inhouse datacenter going down. If it was a critical system you'd better have a plan to get it back up in like 4 hours. and those were business critical we didn't have any life critical systems.

<comment><USER35> What's the disaster plan for "DynamoDB doesn't exist any more"? There is literally nothing else like it in the world. I don't know of an idiot proof queue system that can handle the scales SQS can take either.

<comment><USER11> Cassandra?

Rabbit?

</comment></comment></comment><comment><USER36> Yes and no. By design it's not big, it just seems big. With relative RPO and RTO anyone can failover to other regions. And if you aren't leveraging multiple AZ's within a single region you need to rethink how you are using AWS.

The very nature of AWS requires Amazon to build in capabilities to handle failover. But, as they say at Amazon, "everything fails, always".

</comment><comment><USER37> Is it possible for AWS to have a multi-region outage - as in is there anything connecting them that could bring them all (or several) down at once?

(Apart from the result of a botched patching or update to the core software stack that was done worldwide at the same time and hopefully never happens).

<comment><USER38> A cascading electrical grid failure? I don't know if there are any interconnects between the regions with the DC's, but if there were that might be a concern. Though at that stage, presumably most of the US is without power, hence not so much need for AWS.

<comment><USER37> Well I guess a nationwide power outage will have bigger implications than Netflix going down...

<comment> yjftsjthsd-h Yeah, it might take down Netflix _and_ YouTube! Then what are we supposed to do while we wait for the electricity to come back on?!

</comment></comment></comment></comment><comment><USER39> Nothing is too big to fail. Society needs to be able to adapt and maintain a level of patience during transition times i.e., be patient when Amazon's cloud fails to a new tool.

</comment><comment><USER40> If Amazon's cloud service would disappear today, it would be a chaos for a week or two but most people should recover (as long as they have backups).

<comment><USER41> I'd wager most peoples' database backups live in AWS as well.

Plus, some people have huge, huge datasets. It could easily take weeks to migrate to, say, GCE, or to your own hosted servers. In the latter case, it would also necessitate a pretty large up-front investment.

</comment></comment><comment><USER42> For articles where the headline is a question, the answer is always "no".

</comment><comment><USER43> No.

[https://en.wikipedia.org/wiki/Betteridge%27s_law_of_headline...](https://en.wikipedia.org/wiki/Betteridge%27s_law_of_headlines)</comment>


Data Science with Python and R: Sentiment Classification - <AUTHOR> https://www.codementor.io/python/tutorial/data-science-python-r-sentiment-classification-machine-learning

<comment><USER2> I did something very similar for my blog last year with Twitter data. Used R, Tableau, and a package called Rserve that lets R handle numbercrunching while Tableau handles visualization.

catch it at haagajoe.wordpress.com/2015/01/01/change-of-plans/</comment>


Uber, AirBNB, and DropBox are each worth more than Yahoo - <AUTHOR>

Uber, AirBNB, and DropBox are valued at $10 billion each.
Yahoo has a market cap of $33 billion.  At first glance, it seems like Yahoo is worth more than all 3 combined.  But here's the kicker:
Yahoo owns 23% of AliBaba, which will debut as the biggest IPO in history,  with an estimated conservative market cap of $100 billion.  That means Yahoo's stake is worth $23 billion.
Even with that $23 billion windfall, investors are only valuing Yahoo at around $10 billion max. <comment><USER3> There was an interesting article [0] on Yahoo! about a month ago - <USER2> valued Yahoo! Core negatively. They have a large stake in Yahoo! Japan worth $10b at the time that article was written. Using your alibaba market cap (maybe too conservative, that article had $150b a month ago) that'd put them at about worthless.

The article calls it a conglomerate discount based on holding multiple companies with public price points, and claims alibaba/yahoo! Japan are probably deeply discounted due to tax. But it must be strange to an investor - the core ad business is profitable and it's $1b quarterly revenue (from the article) is imo probably a safer bet than at least 2 of them three $10b companies. Depending on alibabas ultimate IPO valuation Yahoo! could continue having a really bizarre valuation locking billions of dollars away for a while.. Which is at least something them 3 won't have to deal with.

[0][http://www.theatlantic.com/business/archive/2014/04/the- pecu...](http://www.theatlantic.com/business/archive/2014/04/the-peculiar- worthlessness-of-yahoo/360851/)

<comment><AUTHOR> Interesting, thanks for the link. Could Yahoo be a good buy considering its "book value"?</comment></comment>


Neanderthal Eustachian Tube: Insights on Disease Susceptibility and Extinction - <AUTHOR> https://anatomypubs.onlinelibrary.wiley.com/doi/abs/10.1002/ar.24248 <comment><USER2> As a pediatrician who talks a lot about ear infections with parents, this finding is fascinating. One of the facts that brings relief to parents of children with chronic otitis media is that they tend to grow out of it, due to the shifting eustacian tube anatomy cited in the article. Adults and older children get ear infections from time to time, but on the whole, they're rare. It seems this wasn't the case for Neanderthal.

I wonder if there's any evidence of rudimentary surgeries (ie, shove a small sharp stick through the tympanic membrane) to relieve the painful pressure. This would likely disrupt the bones on the middle ear, though I imagine this is difficult/impossible to study in the fossil record.

<comment><USER3> Perhaps their projecting jaws were less able to exercise and clear the eustachian tubes, as any modern child (or airplane passenger) discovers early. Add to this being by themselves on the European continent for a long while and reaching equilibrium with fewer sinus problems over time by adaptation. Then being attacked brutally by diseases from a new wave of settlement out of Africa.

In North America some elapsed ~13,000 years was sufficient for the paleo population to be almost wholly destroyed by disease at first contact with Spanish explorers, by many accounts 90% dead by 1620.

</comment></comment><comment><USER4> Is this the best that Occam's Razor can do here?</comment>


How to Center in CSS - <AUTHOR> http://howtocenterincss.com/# <comment><USER2> Can someone explain to me what is this for if selecting 4 x unknown in all questions leads to this?

 (DIV)
Text Content
 (TEXT)

If this is supposed to work, then by reduction, having more information about height/width is unnecessary for both browser and CSS programmer. Why not just always use those two forms?

<comment><USER3> What you've posted will only center a `<div>` with a known width (ie, for `margin: auto` to center a child element within its parent, the width of the child must also be specified).

Not sure if you're mistaken in your comment or there's a bug in the site. When I select all unknown dimensions and a block-level element, it gives me a flexbox output (the right answer, IMO).

<comment><USER2> Hm. I never get any flexbox output unless I tick "Vertically: top". Perhaps a bug then.

</comment></comment></comment><comment><USER4> This website is needed.

The fact that this website is needed for such an extremely common use case is strong evidence that CSS is fundamentally broken.

<comment><USER5>
Hello World

This works in the latest versions of all browsers. If you need legacy IE support things may get tricky.

<comment><USER6> and blam, you blew your CSS framework XD

</comment></comment></comment><comment><USER7> Every time I need to center a div, I have to google how to do it. I really hope this site ranks above the fold... because i'm going to forget the URL, and in a few months i'm going to google the same stackoverflow answer I search for each time.

<comment><USER8> Upvote it and it will be in your list of saved stories.

</comment></comment><comment><USER9> There's a way to centre variable width block elements that doesn't depend on flexbox, which is:

        .centred {
            /* Make the element only as wide as it needs to be. */
            display: inline-block;
            /* Let us apply positioning. */
            position: relative;
            /* Move the left of the element to the middle of the container. */
            left: 50%;
            /* Translate backwards half the width of the block, thus centring it. */
            transform: translateX(-50%);
        }

It's a useful bit of CSS to have around.

<comment><USER10> I use a similar trick all the time, especially for vertically centering elements. Also, mine usually includes the various vendor prefixes for the browsers.

</comment></comment><comment><USER11> That reminds of Zed Shaw's angry CSS rant in [https://youtu.be/_CEBG_s92P8?t=525](https://youtu.be/_CEBG_s92P8?t=525) It's on the obnoxious side, and has a lot of foul language, but it's interesting.

</comment><comment><USER12> With flexbox?

<comment><USER13> Yup! I made flexboxpatterns.com, which contains many examples related to centering. Flexbox + PostCSS for cross-browser support and you're good to go.

<comment><USER14> I have checked your work out, I like it. Go further.....there's a real opportunity for someone to build deep and wide Flexbox development tools, which just don't exist right now.

</comment></comment></comment><comment><USER15> Or just use tables like we did in the '90s...

<comment> open-source-ux Tables are meant for displaying tabular data, they are not meant to be an invisible frame or grid for page layouts but this is what they were often used for.

Tables fell out of favour because many people used nested table structures which were messy and inaccessible to people with screen readers. (Note that non-nested tables are not inaccesible to screen readers.)

I actually think a table-inspired layout approach for CSS would have been simpler to understand and to implement than the clumsy, messy CSS methods we currently have. Even Flexbox has an over-engineered (or over-complex) feel for some of its rules. Oh well, the benefit of hindsight...

<comment><USER16> The hilarious part is the memo "don't use tables" was so completely absorbed it became rare to see a table even being used for tabular data. A whole slew of CSS to achieve a table-like effect was fairly common to see.

</comment></comment></comment><comment><USER17> Generate Code button not working? I am using Chrome on Ubuntu OS

<comment><USER18> Open the console window on chrome, it displays why it wont generate the code.

In my case, I didn't specify a value for H and V ALIGNMENT and I got "bundle.min.js:3 Uncaught Invariant Violation: No horizontal alignment"

Love this website nevertheless.

<comment><USER19> Yes.

        Error: No vertical alignment  bundle.min.js:3

It was easier with tables.

</comment></comment></comment><comment><USER20> I can't help but wonder why the committee behind CSS took so long to come up with a reasonable way to center content that works in all cases.

<comment><USER3> Maybe because HTML/CSS was intended to lay out and style documents, not support complex application layouts?

<comment><USER21> When specifically was CSS explicitly and officially said to be for layout?

As I remember, it began as styling, and people started using it for layout, and that became the best practice, though not official. I don't recall the announcement that its design was for layout, but I wasn't keeping up on the news at that point.

And since CSS is officially said to be supporting layout, why aren't they thinking of all web use cases?

If CSS is not for layout of complex applications, what should one use in that case?

</comment></comment></comment><comment><USER22> I would add some errors or indications of what's required before submitting.

<comment><USER23> Or some help text on what's required.

Or some inline validation?</comment></comment>


Android's Dirty Secret: Shipping Numbers Are Strong But Returns Are 30-40% - <AUTHOR> http://www.washingtonpost.com/business/technology/androids-dirty-secret-shipping-numbers-are-strong-but-returns-are-30-40percent/2011/07/26/gIQAC07iaI_story.html

<comment><USER3> I've seen this bouncing around for a while now. Numerous times.

I've yet to see it substantiated beyond "sources claim" and I tend to want data any time someone wants to claim numbers which seem unusually high.

Real issue? Attention-whoring bloggers? Impossible to tell without better data.

<comment><USER4> Exactly this. Some guy said a thing doesn't count as journalism.

</comment></comment><comment><USER5> Linkbait article's dirty secret: actually _some_ Android models have 30-40% return rate. Of course the article makes no attempt to estimate aggregate return rate rendering itself pretty meaningless.

</comment><comment><USER6> I think this is mostly people getting what they paid for. I'm sure lots of people who bought Androids said "oh, well, it's just like an iPhone and everyone has those" but what they were actually thinking was "damn this is so much cheaper".

You get what you pay for. Case in point: spring for a Nexus. No problems.

<comment><USER7> FWIW I love my Captivate (Samsung Galaxy phone) and I paid less than $50. I wish they were better about updating the Android version, but I wouldn't say the Nexus is the only Android worth having.

</comment></comment><comment><USER8> UI replacements, vendor bloatware, slow updates and variable quality hardware. Stick with pure android devices, they are better. The iPhone is clean - <USER2> bloatware,etc. Demand the same from Android.

</comment><comment><USER9> "By TechCrunch.com, Published: July 26"</comment>


Ubuntu Spectre and Meltdown kernel updates available - <AUTHOR> https://wiki.ubuntu.com/SecurityTeam/KnowledgeBase/SpectreAndMeltdown#Timeline <comment><USER2> Slight correction: The kernels released only address Meltdown, Spectre is yet to be fixed.

<comment><AUTHOR> Sorry about that, jumped the gun on the title—maybe an admin can update it for accuracy?

</comment></comment><comment><USER3> ...and it was as if a million people typed sudo apt-get update at once.

<comment><AUTHOR> So far the mirrors are coping; just finished updating all my servers in RamNode and DigitalOcean, going through AWS servers next.</comment></comment>


Why People Are Irrational about Politics - <AUTHOR> http://spot.colorado.edu/~huemer/irrationality.htm <comment><USER2> Let's face it, political parties are designed to divide the people. Why that ? Because political power like every power seeks its own limits. It looks to increase its own power. In a (so-called) democracy, government negociates the boundaries of its own power with the people. One way to get more power for the governement is to weaken the people by dividing them. Now you see the people divided in many different ways with engineered and/or mythical social struggles : poors vs rich, women vs men, young vs old, native vs foreigner, religious vs non-religious, black vs white, gay vs heterosexual etc...

Everybody want essentially the same things, to have their essential needs fulfilled : food, home, health, family, freedom

A minority divides the majority and acquires dominion and prosperity, achieving an effortless and comfortable life.

That minority has essentially created the initial Ponzi Scheme and they need division, wars and struggles so that they can maintain their dominion.

<comment><USER3> This implies that government, in and of itself, is a conspiracy to perpetuate consolidation of power. That's enough of a broad generalization that I can't take it seriously - while it may be true for some forms of organization, I don't think we have enough data (or the right KIND of data) to actually make a call like that, let alone claim that political parties in particular are defined by power orchestration by a central entity.

<comment><USER4> It's entirely possible for this kind of thing to fall out as a natural consequence of a set of constraints and institutions, without any central planning or conspiracy.

For instance, look at Duverger's Law ([https://en.wikipedia.org/wiki/Duverger%27s_law](https://en.wikipedia.org/wiki/Duverger%27s_law)), which says that the standard "one person one vote" voting system we use naturally tends to produce a two-party system. Beyond that, there are institutional tendencies towards compromise and centrism that will tend to make key parts of both parties similar to each other and drift towards each other, while roughly matching overall society sentiments, and emphasizing a handful of ideological differences that match/create those in society (with a feedback cycle). Put that together with standard political tactics like proposing an extreme position and "compromising" with what you wanted in the first place, and with the tendency of any system made up of people to perpetuate itself and give itself more power.

So it's entirely plausible that we'd naturally tend towards something like we have: a two-party system, with differences on some high-profile items that, common agreement between those parties on other issues (most notably on the self-perpetuation and growth of government and bureaucracy, even if in disagreement with substantial fractions of the public), near-impossibility of electing a third-party candidate, etc.

<comment><USER5> Is there reason to think that the two-party system emerged accidentally from the voting system?

(Nit: You mean "first past the poll" or something, not "one person one vote")

</comment></comment></comment></comment><comment><USER6> It's not that people are irrational. _People have different prefences_. There are winners and losers in politics, and peoples' preferences are often mutually exclusive.

The idea that there is some kind of "correct" political position is absurd and grossly ignorant of what politics IS.

Example: Some people think there shouldn't be an income tax. Someone else thinks there should be. There is no such thing as a "correct" position, just a winning position.

"War is politics by other means," as Carl von Clausewitz said.

<comment><USER7> There is no "correct" position. But there are positions that are objectively better if you measure outcomes like health, education, safety, prosperity etc etc.

<comment><USER8> They are not, in fact 'objectively' better, because the degree to which you prioritize each of those things differs based on each person's values. Take welfare, for instance. Social welfare programs help the vulnerable, and undoubtedly some non-zero percentage of people are taking advantage of said programs wrongly. In the US, people who are liberal are more interested in the former, and people who are conservative are more interested in the latter.

This is a chief reason why one group is for it and the other is against it. It's not that liberals don't think welfare fraud exists at all, they just don't think it's a big problem compared to the good such programs do. And it's not that conservatives don't think such programs do help some deserving poor people, they just hate the thought of some of their tax money going to someone mooching off the system.

<comment><USER9> I'd hope that most conservatives don't attach that justification to welfare cuts. You effectively said that they would be happy to punish the vulnerable to ensure that those taking advantage of the system would also be punished. I Am Not A Conservative, but I'm fairly sure most of them would be horrified with that categorisation.

I didn't downvote you, I do agree that you can't just say one or other thing is objectivley better. I think your example missed the mark though.

</comment></comment></comment></comment><comment><USER10> The best thing I've read about political differences is the book Predisposed [http://www.amazon.com/Predisposed-Liberals-Conservatives- Pol...](http://www.amazon.com/Predisposed-Liberals-Conservatives-Political- Differences/dp/0415535875)

It makes the argument (supported by copious research) that there are biological correlations of conservatism and liberalism with disgust reflex, taste in food and art, perceptual cues and threat response. I'm not convinced that they have the direction of causation settled but it is interesting research. Conservatives and Liberals literally see the world differently. No surprise that logic doesn't work to help either side sway the other.

<comment><USER11> This sort of research only makes sense if you use an expansive definition of "liberal" and "conservative". From a historical perspective, it makes hardly any sense at all. For example, Englishmen in 1590 presumably split into "liberal" and "conservative" camps as defined by such research, and yet essentially _everyone_ was ridiculously reactionary by modern standards, in that most people were monarchists who supported the personal rule of a queen. This suggests that the liberal/conservative divide, while real, need not necessarily bleed into politics. It's democracy, of course, that changed the game.

</comment></comment><comment><USER12> > There are three reasons why I disagree with this explanation. The first is > that value questions are objective, and moral anti-realism is completely > unjustified.

This is probably the longest-running debate in human history, and he dismisses it completely with a link to his undergraduate paper on the subject.

Putting that aside, the problem with this argument is it doesn't allow for changing beliefs. If we are only driven by fitting in with our group, then no political views would ever change as they wouldn't ever reach critical mass.

Just look at the changing opinions of gay marriage. Political views absolutely do change over time, and they can change very quickly. Yet this paper is all about how that is impossible.

> I have witnessed few political conversions, so the most I can offer is > speculation as to how one might occur.

I feel like this is an admission that the paper is entirely speculative.

<comment><USER13> Looks like we have a political disagreement. Beliefs can change, but they usually do not change quickly or easily. That's why we call them beliefs.

<comment><USER14> I believe OP was referring more to the hockey stick model of wide-spread change in political beliefs. It is a very, very long road toward a change in the public's perception of some issue, such as equal rights or gay marriage, but there often seems to be some tipping point where the minority view becomes the majority in a very short amount of time. Also see legalization of marijuana, prohibition and women's suffrage.

</comment></comment></comment><comment><USER15> Is irrationality in politics a bad thing? The article seems to assume so, I'm not so convinced.

If you follow the "opiate of the masses" theory then the bigger the spectacle the better people are fooled into thinking their votes matter etc resulting in theoretically less social unrest, and the more yelling and sloganeering about politics, the less demonstrating and violence.

Another way to look at it is something that is rational is by definition no longer political. We can't have a political discussion about that subroutines memory leak, or how to fix it. Perhaps its not possible to have a rational discussion about an irrational lifestyle subject, aka a political topic. If it were not a non-actionable non-relevant opinion based evidence free discussion topic, by definition it wouldn't be political. So worrying about politics being irrational is like worrying about cats being excessively feline-like. Its not a bug, is the definition of the topic.

<comment><AUTHOR> You can't have a political discussion about subroutines memory leak because this is not about politics. But surely people get irrational about technical topics, from programming languages to the last gadget. I see these discussions all the time, even on HN.

People get passionate and irrational about a lot of themes, but politics seems to potentialize this and this article tries to discuss this topic. And the article makes a point of making a distinction about being irrational and having some preference or belief.

</comment></comment><comment><USER7> No mention of believing what your parents told you to believe (consciously or otherwise). This seems to be the biggest factor among people I know.

<comment><USER16> Or the idea that you rebel against whatever politics your parents held. Conservative parents? I'm a liberal! Liberal parents? I'm a conservative!

</comment></comment><comment><USER17> Because people selectively cherry-pick facts to support the narratives they are invested in, and in doing so become more invested. Both narratives can be supported using data, provided one interprets the data in a certain way. Same with religions. Very rarely does a slam dunk case appear totally disproving one particular explanatory narrative.

Karl Popper's "Science as Falsification" essay is very useful here.

And furthermore, many of the propecies are self-fulfilling. For example, if atheism were true, it is still the case that Jews around the world have never forgotten about Israel and Jerusalem and have at long last returned there.

You can also see this in technical fields. The Black-Scholes valuation model may or may not have been a good way to price derivatives, but once everyone started using it, it BECAME the best way to price derivatives because everyone used it.

<comment><USER18> Doesn't this imply that all political opinions and regimes are essentially equivalent?

<comment><USER17> No

</comment></comment></comment><comment><USER19> I'll give the OP points for ambition, but I believe the article leans too much on Psychology for explanations rather than Political Science. This makes sense, if you are looking for the conclusion that people are irrational, but I don't find this satisfactory.

My personal view, from reading Jonathan Bernstein's blog and his take from a Political Science view, is that people hold _strong_ and _weak_ political beliefs/preferences and people are rational about both, but apply different standards depending upon whether they are a strong or weak belief.

For example, a person may have a strong preference that abortion should be illegal. They would have thought about this issue a great deal and have rational reasons why they feel this way. However, the political party that is in favor of passing laws to restrict abortion is made up of constituents that are also in favor of less regulation of firearms and also capital punishment so the person who really cares about the abortion issue (their _strong_ beliefs) may also take cues from the party elites about gun control and capital punishment (as _weak_ political beliefs).

It may seem irrational/inconsistent for someone who argues about the sanctity of life when talking about abortion to also be in favor of capital punishment (which involves taking of lives) or gun control (which also can result in a number of deaths by firearms). However, if the person really cares about changing the laws on abortion and may not care as much about the other policy areas they are perfectly willing to go along with the position of the elites in the party/coalition and make these less rational arguments without too much dissonance since they don't actually care that much about the weaker beliefs.

So political change is both possible and rational. It can be effected either be getting a large number of people to care about this single issue (making it their _strong_ belief) or getting party elites/actors convinced your position is the correct one and knowing that the other people in the coalition will take your side as long as you also go along with the beliefs that they value most.

<comment><USER20> Using the word belief makes it sound like we're discussing religion here rather than politics. A belief is an attitude toward the likely truth of something. It isn't possible to literally believe in guns or abortions, one can only have opinions regarding their proper usage. This is likely why OP finds political discussions irrational - he is investigating political "beliefs" and when it becomes a debate of Truth by believers rather a debate about the best policy for the context from people with varying perspectives and opinions then of course nothing can be conceded; beliefs are fixed by faith while opinions can vary considerably.

</comment></comment><comment><USER13> Human rationality is a myth.

</comment><comment><USER21> Weird, this gives false choices. (Or I've missed the discussion of propaganda.) Massively-funded propaganda specifically promotes things like "Beliefs as self-image constructors" and "Beliefs as tools of social bonding".

<comment><USER22> Now propaganda makes it onto mass social media campaigns. Techniques include propagandizing "nudging" 'social influencers' who are hubs of social bonding and information. The US is known to use celebrities in their Twitter campaigns targeting the Middle East.

Can you speak more about what literature you are aware of?

<comment><USER21> Bernays' 1928 book "Propaganda" is an entertaining intro. He's considered the father of modern public relations. It reads like satire, except he was serious. ([http://www.historyisaweapon.com/defcon1/bernprop.html](http://www.historyisaweapon.com/defcon1/bernprop.html))

Many like the BBC documentary "The Century Of The Self", on the origins of modern PR. (Easy to find online.) Nowadays of course, the field is way more advanced.

Noam Chomsky's done well-known work in this area. His books are dry, but he gives enjoyable talks, zillions of which are on youtube. For example: ([https://www.youtube.com/watch?v=9RPKH6BVcoM](https://www.youtube.com/watch?v=9RPKH6BVcoM))

<comment><USER22> Thank you, I was aware of these. Chomsky is a must, but he's so anarchist its easy to fall into an intellectual trap. Great resources.

I would add, to understand propaganda's current direction, the work of Cass Sunstein (whose Wikipedia article also reads farcically) including "Democracy and the Problem of Free Speech" and "Nudge". The father of "liberal paternalism" and "choice architecture", the Wikipedia article is full of great nuggets: "in light of astonishing economic and technological changes, we must doubt whether, as interpreted, the constitutional guarantee of free speech is adequately serving democratic goals."

Cass Sunstein was the Administrator of the Obama Administration's Office of Information and Regulatory Affairs.</comment></comment></comment></comment>


Show HN: Ringo - Building access the way you want it - j-m-o https://www.tryringo.com

<comment> j-m-o Long time lurker, first time poster.

Around Christmas, my apartment building changed over their buzzer system to call a dedicated number instead of a phone in the unit. This made coordination of inviting guests over difficult for me and my girlfriend, as we had to choose whose number to use -- an idea born.

This is my first venture into entrepreneurship, so I'd really like to hear any feedback. For those curious, I'm using Play 2.0.x on Heroku. Twilio's the phone provider and Stripe's the payment provider. I started this project to learn some new things and break out of my J2EE dayjob doldrums.

Since buzzeromatic folded, there doesn't seem to be anything else in this space - although the real challenge now is how to get it to the consumers who'd find it useful. I'm thinking my main markets are college-aged people with roommates, as well as down-sizing couples moving into condos.

Thanks for taking a look!</comment>


Over 30% of Official Images in Docker Hub Contain Security Vulnerabilities - <AUTHOR> http://www.banyanops.com/blog/analyzing-docker-hub/ <comment><USER2> "Containers have revolutionized software development by providing a very efficient path to take software written by developers and run it in production in a matter of minutes or hours, rather than days or months using traditional approaches."

FUD. The technology of deployment does not change 'minutes or hours' into 'days or months' \- it's management red tape that does that. In fact, in my use case, Docker takes a similar time to build as a normal package (.deb) using an up-to-date base image, but is actually _slower_ to deploy, since now my servers have to download a stupidly large container with build-essential (npm doesn't really survive without it), python (because npm maintainers use python frequently), and graphicsmagick (for the in-house app), instead of 'just the app' that's in a _normal_ package.

If your environment is simple enough that you don't have to be concerned with testing in 'staging' against staging databases or similar, then you're definitely not saving 'days', because your env just isn't that complicated.

<comment><USER3> "The technology of deployment does not change 'minutes or hours' into 'days or months'"

I wouldn't say that's true. We're transitioning into multiple languages, and want to have an environment that will allow future languages to be added as required. Building a generic infrastructure to run containers lets us run everything on the same base platform. Otherwise, we'd need to tailor the images and configuration for the individual language type. When a new language is introduced, it can take 'days or months' to get everything working well.

That's not to say Docker doesn't require the same attention to security as other options. This seems to me akin to running a downloaded base VM image without first doing updates.

<comment><USER4> Or, you could do what HPC has been doing for years and seperate the config from the machine.

What do I mean by that? shared drives.

Seriously, install python$ver plus dependenceies into /mnt/bin add it into your path. You now have a single source of (readonly optional) each binary version.

this means that you can have many versions of the same software all compiled in a different way. But because they are in the path, they can be transparently managed. Also it means that much of the config management is now in one place, making joining nodes super simple.

<comment><USER5> We do this at my company and it is a fucking nightmare. Why? Because there are like 4 different operating environments and there isn't an _official_ way to do installations and you also have to manage site installations of various packages for each version of each language dependency. And god forbid some environment variable is pointing to the wrong version of something because it's _not_ just as simple as setting PATH and LD_LIBRARY_PATH when every thing and its mother tries to set its own fucking environment variables all pointing to wherever they think they were compiled at.

No, it is _much much MUCH_ better to actually have an application build with its dependencies and deploy with its dependencies. And you know how you fix issues with security patches? You have a real build system that rebuilds your binaries and you redeploy regularly.

</comment></comment></comment></comment><comment><USER6> Not surprised at all.

And here we have the prime example, why the Docker-model of building and distributing containers is horrible when it comes to security and maintenance.

Bundling dependencies for production environments has always been and always will be a terrible idea.

<comment><USER7> This sounds like an oversimplification, though:

> Bundling dependencies for production environments has always been and always > will be a terrible idea.

We're considering Docker currently -- not for the distribution model at all, since we'd only ever use our own internally built & maintained images -- but as a clean way to break apart dependencies, and make it possible to run a diverse multiple-server-type environment (production) in miniature (development, demo, UAT).

I quite like the idea of something that may occupy multiple VMs or dedicated servers in production be able to run as a lightweight app in a dev environment, with exactly the same dependencies in place -- that's quite useful.

If this kind of use case is also a terrible idea, I'm interested to hear more -- we're just now tinkering with the idea, and haven't yet moved from theory to practice.

My own concerns revolve around how easy it will be to keep updated on RHEL patches, for example -- apparently we should be able to keep both host and app dependencies updated without much trouble, but it adds more complexity to the maintenance cycle (it seems).

<comment><USER8> > My own concerns revolve around how easy it will be to keep updated on RHEL > patches, for example -- apparently we should be able to keep both host and > app dependencies updated without much trouble, but it adds more complexity > to the maintenance cycle (it seems).

That's about the "problem" with Docker – it's deceptively easy to roll out everything as its own containerized app. Updating? Not so much.

It turns Docker from a magical silver bullet into a slightly fancier way to handle reproducible deployments. Using it this way is fine, but not what Docker is marketed as by many.

<comment><USER9> Actually its pretty easy, I just did it yesterday for my PostgreSQL container.

Debian/Ubuntu example: sudo docker exec -it my_pgsql_container_name /bin/sh -c "apt-get update; apt-get -qqy upgrade; apt-get clean"

<comment><USER10> And what happens when you launch new container from the same image? You need to run apt-get/yum again. Or rebuild image.

<comment><USER11> That's why you keep everything with state in a separate volume container. Attach volume to built image and that's it.

<comment><USER12> Mount data, logs, configuration, eventual extensions in the data container?

For pg, there might be some migration needed when jumping from a major version to the next. Which requires both versions installed, on Debian at least.

<comment><USER11> >Mount data, logs, configuration, eventual extensions in the data container?

Many programs have their state represented as files that are stable across versions. If you have a cluster of the same image with different states it's more efficient to move volume containers across a network. Easier to backup/upgrade too.

pg is going to give you those problems whether you are using Docker or not.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER13> I have a few contentions with the study.

First, if you look at their own analysis the number drops from 30% to 23% when limited to only the latest tagged images in the official repository. I'd expect to see a higher rate of vulnerabilities in previous versions...that's why you rebuild. Find me a linux admin that would accept their OS is vulnerable if you're citing old, unpatched versions.

Second, they seem to virtually _all_ be package vulnerabilities. These would, ostensibly, reach parity with whatever the target distro is by simply updating packages on a rebuild.

Finally, I think one would be hard pressed to lay any vulnerabilities traced to updated, current packages at the feet of docker. That fault would seem to lie squarely with distro package maintainers.

So, two simple rules would seem to bring the security of container deployment in line with standard bare metal deployment (by the metrics applied in this research):

1\. Don't use old shit

2\. Rebuild your selected docker container to ensure packages are up to date. Why? See rule #1.

<comment><USER14> I thought the point of using docker containers was that they were pre-packaged apps. Not so you had to continually rebuild the container with your own updated packages. Doesn't having to rebuild the container to fix security vulns defeat one of the major reasons to have versioned docker images released for use? You could very well end up breaking dependencies.

<comment><USER5> You're sort of combining two things: 1) Docker makes it super simple for anyone to package software and run it 2) Dockerhub makes it simple to share software that you have packaged with other people.

Personally, my biggest gripe with Dockerhub is that a Dockerfile should be _required_ in order to upload to the hub, and it should show the Dockerfile that produced each version. The fact that people can create fundamentally unreproducible binaries is nasty (there's also the issue of not specifying versions in the apt/yum steps used in the Dockerfiles, but that's just a general problem with the way package management software is designed).

None of that's a problem with Docker itself though.

<comment><USER14> Ahh got it. I have only really used lxc, so not super familiar with docker other than it being a container tech. Thanks for the explanation :D

</comment></comment></comment></comment><comment><USER15> This isn't great, but it's not quite as terrible as its being made out to be for the official packages. The Mercurial bug is only relevant if you're using Mercurial with user supplied input on your production servers. Unlikely if you're not BitBucket. [http://chargen.matasano.com/chargen/2015/3/17/this-new- vulne...](http://chargen.matasano.com/chargen/2015/3/17/this-new- vulnerability-mercurial-command-injection-cve-2014-9462.html) Is a good read on the subject.

The libtasn1 bug seems to be only relevant if you're using GnuTLS. Again, not great but not the most widely used library either.

Cutting those two out cuts the number of vulnerable images in half and there's probably a few more rarely used programs with security issues further down the tail. Again, this isn't great, but it's not quite as terrible as the authors are making it to be.

The user supplied packages on the other hand seems to be quite a bit worse.

<comment><USER16> The take-home message is that you need to have a strategy for deploying updates. It's true that not all bugs are exploitable but there's a long history of people being catastrophically wrong in that kind of conclusion.

More importantly, however, you want updates to be a routine frequent thing so you don't train people to ignore them or let the backlog build up to the point where the size itself becomes a deterrent to updating because too many things will change. If you install updates regularly, you keep changes smaller and keep the focus on the tight reaction time which you'll need for serious vulnerabilities.

<comment><USER17> One of the authors here. I'd like to second this take-home message. The core of our work was to bring to the fore-front that package management using containers is important and we need to have sound operations management/security practices in place.

We think Docker, and containers in general, is a great way to deploy software -- the speed and agility is so much better than traditional approaches. This also means that we should have sound security practices in place from the very beginning, or else we could easily end up with insecure images floating around in several places (dev laptops to public cloud).

<comment><USER16> > the speed and agility is so much better than traditional approaches

Complete agreement here – Docker's strong points are exactly the things which make patch deployment easier than in legacy environments. Hopefully we'll start seeing orchestration tools which really streamline the rebuild/partial deploy/monitor error rates/deploy more cycle when updates are available.

</comment></comment></comment></comment><comment><USER18> It would be interesting to see if Docker could develop an integrated security scanner, checking the package lists of each image, and email out consumers of those images when security vulnerabilities come out.

If Docker Hub is a monetization strategy, I think a lot of people might be willing to pay for that -- though it's weird, because that's a problem golden images themselves created, so maybe it's not fair -- and the world would be better if security info was always free. Tracking security updates is hard if you use a lot of deps, anyway, this has the benefit of being a central place that can check these things. Most developers shipping software definitely do not track security history for most of their components, and this is a huge opportunity.

Problem gets harder when people get things from outside package managers and vendor stuff though -- which does not help.

I owe Red Hat for a large part of the way I think about things, and I do think the world would be better if package managers were used more extensively for exactly the reason of tracking vendor security. I also realize not everybody can package everything and do like to vendor deps (or similarly use language specific package managers often installed in arbitrary locations) or put them together _however_ (random internet tarballs), and this ironically is why things like Docker also exist too.

The immutable systems movement is good, but something to clean up security practices would be a huge plus to avoid the comparisons to regression back to "golden images". Using random base images vs distro base images makes it worse, but using stale distro images is itself a thing.

</comment><comment><USER19> A bit overstated. They definition of security vulnerable == got package which is vulnerable.

However, merely having some packages with vulnerabilities may not be enough. E.g. you have security in package manager (apt), but you never use it after building the image. Or even shellshock is no flyer, if you don't use CGI scripts and don't have ssh access.

In Virtual Machines this problem also exists. I guess it is more about how often you update your software than Docker itself.

<comment><USER20> Tell me about it!

Gotta love those security experts that your company hires when they say to you "your app has a security issue right here" and I say "alright then prove it, hack it, let's see if there really is a security issue" and they can't do it.

If I don't want to worry about deployment, there's Heroku. If I don't want to worry about testing, there's Circle CI. If I don't want to worry about scaling, there's AWS EC2. If I don't want to worry about security, there's... nothing. Because it's not a real product. At least not real in the way databases, deployment, testing and scaling are.

So when people say "programmers don't care about security" I honestly don't understand what they mean since I've never seen a secure app. It's like there's this mob of believers that want to convince you security is the salvation. OK, teach me by showing. Show me a bunch of secure apps and we'll learn from it. But those don't exist, so no one ever learns, but that doesn't keep "security experts" from blaming programmers building real things in the real world for not caring about their imaginary friend.

I'll believe security experts care when they create a _service_ and sell it for money to people like me.

<comment><USER21> Security Guy: Hey, bank, it seems like your vault is accessible via some old sewage tunnels.

Bank: So what? Nobody knows about those tunnels.

Security Guy: But someone who finds them, like me, but with less morals, could rob you.

Bank: Prove it. Rob the vault.

Security Guy: ..... ?

Finding a vulnerability isn't the same thing as exploiting one, and a lack of exploitation doesn't imply a lack of vulnerability. You also have to consider that a small portion of vulnerabilities are actually exploitable, but it's a very hard problem to find out which ones are and which ones aren't. Exploiting a single vulnerability is typically harder, in fact, than patching a dozen of them (for example, you can easily start using a secure version of strcpy(), but exploiting it requires an attacker to smash the stack or ROP their way into full execution).

The bottom line is that you're not only naive if you believe what you just said, but you're doing a _huge_ disservice to anybody who uses any code that you may write.

<comment><USER20> Security Guy: Hey, bank, it seems like your vault is accessible via some old sewage tunnels. But fret not, I as a security expert that goes around making sure places such as banks and schools can't have specific places accessed by entrances other than designated the ones, have a solution for you. Just put your safe inside this chroot building. What this does is makes sure only sewage goes through sewage pipes (not people). So all you have to do is purchase this solution and we will guarantee that no one will come into your bank through sewage pipes.

Why does that never happen? Why are security experts always consultants and they never have a product to sell?

Naive is a person that thinks just because they are a security expert, programmers will care. No amount of shaming will change that. If you're a security expert your job is to make this so easy that I almost don't think about it. Like I almost don't think about databases, deployment, testing, scaling. Getting on your high horse and begging programmers changes nothing.

Just look at RSpec. All of a sudden everyone wants to write tests because it's fun and easy and looks sort of like English. Now we don't have to care much about tests, we just write them and RSpec runs them, collects and reports errors, formats them nicely, tells me the path and the line number where each error occurred, etc. Now imagine you're a "testing expert" and there's no RSpec and you keep yelling at programmers to change their ways, to write and maintain tests, and so on. No one would do it (like few did before the recent craze). So please, learn from that lesson, round up some peers, and contribute to your damn field by letting me forget about it.

<comment><USER21> So a structural engineer shouldn't worry about the structural integrity of his buildings, only that they stand up under ideal conditions? A car manufacturer shouldn't worry about crash-testing or other safety concerns, only that their car moves?

HOW DOES THAT MAKE ANY SENSE?!?!

Like it or not, we're stuck on Von Neumann architecture, and as a result, data can be treated as code and vice-versa. The consequence of this is that, under certain circumstances, data can be carefully crafted to act as code, and can be executed in an unforeseen context. As a software engineer, _it is your job_ to take precautions when developing software. Precautions that prevent this execution. Security people do the best they can to make it easy to develop safely, but all of that is _useless_ if the developers ignore it. And, because security vulnerabilities are a manipulation of context-and-program-specific control flow, there's not a way to encapsulate all security measures in a way that is transparent. It's just not possible. Only developers know the specifics of their software, and only developers can protect certain edge cases. If you assert otherwise, you have a fundamental misunderstanding of the systems that you work with, and you need to re-evaluate your education before continuing to work in the industry (assuming you do). This isn't an opinion. This is a fact.

Lastly, us "security experts" do contribute to our field. Security is one of the hard problems in computer science - far harder than whatever you're doing that lets you _" not think about databases, deployment, testing, scaling"_ \- and there's a lot of solutions that have been engineered to deal with software that has been created by people like you. There's _static code analysis tools_ , which can detect bugs in code before it is even compiled. There's _memory analyzers_ that can detect dozens of different classes of memory-related bugs by just watching your software run. There's _memory allocators_ and _garbage collectors_ that can prevent issues with use-after-free and other heap-related exploitation bugs at run-time. There's _data execution prevention_ and _buffer execution prevention_ that, at run-time, help prevent code from being executed from data pages. There's _EMET_ and other real-time exploit detection tools that exist outside of your software and can still prevent exploitation. That's not even an exhaustive list. There are literally hundreds of tools out there that make finding and fixing security bugs easy, but those tools can't patch your code for you. That's why there are consultants, code auditors, and penetration-testers that can give advice on how to fix bugs, find bugs where automated tools fail, and even coach developers into writing more secure code; because having smart, security aware developers is one of the major ways to defend against security bugs.

<comment><USER20> > As a software engineer, it is your job to take precautions when developing > software.

On other people's software as well? Why was it not PostgreSQL's (random example) job to make sure their software rejects invalid input? All it would take is for them to use a typed language (given that the type system in Haskell, for instance, is enough to prevent SQL injection). So tell me, when does it become my job to patch whatever database code I choose because no database ever has concerned itself (it seems) with solving this for everyone else in one fell swoop (so we didn't have to think about it anymore for all these decades of dealing with SQL injection in every language that implements a database driver)?

Before the first million programmers had to write the same damn code to clean the input to give to these databases, the database coder should have fixed it themselves. But you weren't there to chastise him so we didn't get it.

Maybe the "mere mortal" programmers like me would be more excited about security if the industry standard software was also secure (we would want to mimic it, and keep it all secure, and not _introduce_ security problems). No security expert has fixed the SQL injection problem where it should be fixed, but they do charge by the hour to fix it in every company that uses a database.

<comment><USER21> That's a horrible example. SQL injection IS the fault of the programmer, not SQL itself. SQL injection is achieved by adding extra code to a query, which is only possible when a programmer allows inputs that can contain code to be concatenated directly into a query. Here's an example:

        query = "SELECT * FROM USERS WHERE NAME = '" + userinput + "'";
        exec(query)

This input can be given:

        ' OR 1=1--

To make the application show the entire list of users. If this programmer used parameter binding, which is supported by PostgreSQL, MySQL, SQLite, and any other SQL platform you can think of, then SQL injection wouldn't be an issue. They could simply do something like this:

        query = "SELECT * FROM USERS WHERE NAME = @:USER";
        statement = prepare(query, "USER", userinput)
        exec(statement)

Just because you don't know the right way to do something securely, doesn't mean it's not there. But you're right, no security expert fixed this problem. It was fixed by the library designers of these SQL platforms. Security experts just charge you by the hour to teach you that you're unfamiliar with the existing security mechanisms inside of these platforms.

Also, just to be pedantic, I'll point out that a type system wouldn't change how SQL injects currently work, lol, no clue how you think that's the case, but I wouldn't put it past you at this point.

<comment><USER20> I've programmed for a while now. I think I've heard vaguely of parameterized statements. :)

Just to be pedantic, I'll point out that maybe _your_ C and C++ "type" system wouldn't change how SQL injects currently work, lol, but the one I use can avoid not just SQL injection but XSS attacks: [http://www.yesodweb.com/page/about](http://www.yesodweb.com/page/about)

I'll say it again, you're wasting your time staying in that small rickety photocopy room called C/C++. But I wouldn't put it past you at this point. Whatever that means, hahah.

<comment><USER21> I'm sorry, I thought we were talking about security? Are you leaking the other thread into here just so you can feel like you won both, instead of neither?

And I never said anything about any C/C++ type system doing anything? But okay.

Back to the topic: if you've heard of them, why did you insist that SQL is inherently insecure? Did you forget they existed, or did you just think I wouldn't notice? Are you that cocky?

I really hope your employer one day recognizes your incompetence and fires you, because the software world is plagued with enough bugs without people like you purposely and gladly laying out a red carpet for them to walk in on. I can't continue to argue with what is either a relentless geyser of misinformation or a brilliant troll, so I'm done. Maybe one day you'll come to your senses, but I doubt it.

<comment><USER20> The way a strong type system solves this SQL injection problem (despite your saying it's impossible and ignoring my having shown your wrong) is by automatically escaping arguments before binding them to parameters.

Well guess what, you don't need pre-compiled statements to benefit from this feature - all you need is the hoisting aspect of it. In other words, if SQL drivers did not offer the _unsafe_ function exec_query that takes the whole query as a string and returns a result, and instead they only exposed a hoisted version of that function that takes a list of arguments and a placeholder query as a string...

      exec_query ["john", 12] "SELECT ... WHERE... = $1 AND ... = $2"

Then there is no SQL injection problem, as the SQL database driver would always automatically escape the arguments before binding the parameters.

So if only SQL database drivers did _not_ offer exec_query but instead forced the user to provide the _whole_ query string in one go with placeholders, then the driver would be able to enforce security at the proper software layer - which is not everyone's program that interacts with a database.

</comment></comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER22> It might be interesting to have a gate on publishing images that explicitly runs tests for major known vulnerabilities. You could at minimum flag images as "known vulnerable", or reject publishing attempts.

The flag might make sense on a new vulnerability, and it could be applied automatically. Imagine [Tag: Heartbleed - Untested] when the vulnerability happened, then as the automated process rolls through the images [Tag: Heartbleed - vulnerable] [Tag: Heartbleed - no vulnerability detected]. Future images are required to pass first.

We have to be careful with widely distributed images.

</comment><comment><USER23> Based on their definition of vulnerable the Ubuntu 12.04LTS installation image is also vulnerable. I think this is only news to anyone that hasn't setup a fresh install of Windows. I remember some presentation from the Honeynet project circa 1999 about how a new win98 installation, without updating service packs, took less than N (N<24) hours until compromise. Still I guess it is worth reminding people to not trust official containers without first applying security updates, and maybe never trusting unofficial containers, depending on your project

</comment><comment><USER24> Great article. We'll need a better integration of security tracking and handling in our containerized infrastructure soon.

You have to be a little bit careful when it comes to version numbers and matching them to security issues. Most linux distributions for example apply security patches to older releases.

E.g. Ubuntu 14.04LTS comes with Apache 2.4.7-1ubuntu4.4 which one might parse as 2.4.7 which has multiple security issues.

The article references to distribution specific vulnerability ratings so I assume they als matched those versions correctly.

<comment><USER25> Study co-author here. We did observe that it's essential to be careful about comparing package version numbers on a per-bistro basis, and there are some tricky cases such as the one you pointed out, and rpm epoch numbers as another example. I believe we handled them correctly in the study.

</comment></comment><comment><USER26> An issue I have with both official docker hub images and dockerfiles provided by software developers is that almost always they run their software inside the container as root.

</comment><comment><USER27> I wonder what would happen if you attempted the same study with AWS AMI's on the official images. Get the latest versions, don't update your distro, and see how many vulnerabilities you get. How often does AWS really rebuild their official AMIs?

Ultimately keeping your OS completely up to date is on you, not Docker, not Amazon, _you_. VM's suffer from the exact same problems as Docker containers.

 _Edit_ : Also, security issues with using community AMIs are already well known, should be no surprise the same applies to Docker community images.

</comment><comment><USER28> They should do the same study for VM images on Vagrant Cloud (aka Hashicorp Atlas), or any other repository of binary software/images built by untrusted third parties.

I thought it was obvious that public images on Docker Hub were to be used for experimentation only--even in that case I only use the "official" Docker images in the library namespace. Anyone using Docker for serious purposes should build their own or at least vet the pre-built images.

</comment><comment><USER29> Docker Hub as a build service doesnt make it very easy to update older images; you can set manual triggers to rebuild current if the FROM container changes, but thats not automatic. Other dependencies are not very easy either as you only get one FROM, then everything else is probably from git repos, packages, language packaging tools or tarfiles, which obviously need checking for updates.

</comment><comment><USER30> docker hub: the petri dish of choice for malware

<comment><USER30> dockers biggest strength is also its biggest weakness IMO. they did lots of changes to the default capabilities (linux capabilities) to improve security. But the underlying problem of fixing old bugs in images remains, along with that its contents are often a disorganized mess: Coming straight from the developer as a black box (more or less) into production environments (yeah when has that ever been a good idea?).

Docker IMO creates a "never touch a running system" attitude. The "running system" in this case is the docker image which nobody dares touching after the developer has left the company. (or the developer themselves have no idea anymore what it contained 3 weeks later)

Also the overhead of setting up containers in a secure way is even more work than not using docker in the first place (ever had too look seriously into SElinux? not something you do casually on the side as it's massively complex).

So the justification that "by using docker we save time on deployment" is a farce. I guess it creates new jobs though for container specialists.

to paraphrase Theo de Raadt:

"You are absolutely deluded, if not stupid, if you think that a worldwide collection of software engineers who can't write operating systems or applications without security holes, can then turn around and suddenly write virtualization layers without security holes."

EDIT: is it still possible in Docker/LXD to access /proc/sys/kernel/panic or /sys/class/thermal/cooling_device0/cur_state ? And how about consuming all the entropy of the host via /dev/random ?

</comment></comment><comment><USER31> I'm confused.

Looking at the top vulnerability CVE-2014-9462 in mercurial.

It affects mercurial clients that access crafted repositories as far as I understand.

[https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-94...](https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-9462)

Even if I use mercurial in my Docker image to get my app and not prepackage it (what I do), and I know this is about public images, how is this "high" vulnerability? I don't deny it's one I would just like to learn why it is classified high if e.g. I use Docker for my HAProxy.

</comment><comment><USER32> As a workaround, update/rebuild your containers more often and deploy more often.

</comment><comment><USER32> So, what? Everything is vulnerable.. You're not restricted by official images, just create your custom image that is not vulnerable ;)</comment>


Ask HN: Biz owners – What problems do you have using/accepting cryptocurrency? - <AUTHOR> I'm guessing it's mostly tax, regulatory, and operational issues but would love to hear specifics. <comment><USER2> What's my motivation for accepting cryptocurrency in the first place? Real money is much easier to deal with.</comment>


The Story of Kony2012 (uncovering Invisible Inc) - <AUTHOR> https://www.youtube.com/watch?v=Y7nymZEXjf8 <comment><AUTHOR> I was watching this other show from arte (Investigative Journalism] how the NGO "Invisible Children" manipulated the public with the viral video "Kony 2012", supports corrupt government and enabled the US Army to enter Uganda

Unfortunately German only: [https://www.youtube.com/watch?v=UqP99TK51RU](https://www.youtube.com/watch?v=UqP99TK51RU)

the submitted link is in English but unfortunately only has a subset of the allegations against what seems to be a biggest scam / grift by evangelicals running operations overseas via Africom.

<comment><AUTHOR> further evidence after quickly googling (to feed one's confirmation bias):

(source: An assemblage approach to liquid warfare: AFRICOM and the 'hunt' for Joseph Kony [https://journals.sagepub.com/doi/full/10.1177/09670106187778...](https://journals.sagepub.com/doi/full/10.1177/0967010618777890))

ABSTRACT:

> _The Western state-led turn to remote forms of military intervention as > recently deployed in the Middle East and across Africa is often explained as > resulting from risk aversion (avoidance of ground combat), materiality ('the > force of matter') or the adoption of a networked operational logic by major > military powers, mimicking the 'hit-and-run' tactics of their enemies. > Although recognizing the mobilizing capacities of these phenomena, we argue > that the new military interventionism is prompted by a more fundamental > transformation, grounded in the spatial and temporal reconfiguration of war. > We see a resort to 'liquid warfare' as a form of military interventionism > that shuns direct control of territory and populations and its cumbersome > order-building and order-maintaining responsibilities, focusing instead on > 'shaping' the international security environment through remote technology, > flexible operations and military-to-military partnerships. We draw upon > assemblage as a heuristic device and the case of the US Africa Command > (AFRICOM) to flesh out the complex and fluid nature of liquid warfare and > the ways by which power operates across space. We outline how the forging of > a transnational military assemblage in the name of 'hunting Kony' allowed > for the buildup of an archipelago of military bases and operational > capabilities across Africa, which serve as hubs for the monitoring, > disrupting and containment of potential risks and dangers._</comment></comment>


Introducing Relay, by Republic Wireless - <AUTHOR> https://relaygo.com <comment><AUTHOR> From email to Republic Wireless customers:

> Republic Wireless will soon be launching our new product, Relay, a device > that gives families a safer way to stay in touch. It's as simple to use as a > walkie-talkie, but works wherever a cell phone works, includes location > tracking, and will in the upcoming months have other fun features such as > music, games, and voice assistant functionality.</comment>


"I Emailed 97,931 Users Their Passwords" - <AUTHOR> http://atechdad.com/i-emailed-97931-users-their-passwords/ <comment><USER3> Nice work! At a glance, the email you sent out does look sort of spammy. If you plan on doing it again you might get better feedback by making it a bit more human - ie "I'm just a guy/gal trying to help yall out - hope you don't use this password everywhere because someone posted it to pastebin.... - <USER2> a good one!" or something like that. Out of curiosity - what did you use to scrape pastebin?

<comment><USER4> I created a Twitter bot called @dumpmon (recently suspended for no apparent reason) that scraped paste sites looking for password dumps and tweeting if one was found.

You can find the code here: [http://github.com/jordan- wright/dumpmon](http://github.com/jordan-wright/dumpmon).

Here are some stats if anyone is interested in what it collected over approx. 2 years: [http://jordan-wright.com/blog/2015/05/26/two-years-of-at- dum...](http://jordan-wright.com/blog/2015/05/26/two-years-of-at-dumpmon/)

<comment><USER5> I remember chatting with you a while back as I was also working on a pastebin scraping project. [http://github.com/shayanjm/pasteye](http://github.com/shayanjm/pasteye)

Glad to see dumpmon is still going strong :)

<comment><USER4> It is... just not on Twitter anymore. The account was suspended about a week or two ago and I haven't heard anything back on my appeal from Twitter.

</comment></comment></comment></comment><comment><USER6> Go careful. This is probably against the ToS of whatever internet services you're using.

> The thank you notes I got were sincere. One of them validated the entire > effort when the person indicated that they use the same password for > everything and wanted to know which account had been compromised

I hope they don't only change the password on that one site!

</comment><comment><USER7> > Including one request to F __k off.

If someone had just sent me an email letting me know that my email and password are out there in the wild, "fuck off" would not be my first reaction. That's just rude.

<comment><USER8> Sending unsolicited automated emails, even for good, may be considered rude as well.

<comment><USER7> Really? Do people seriously have this notion? Yes, sending actual spam is rude. But an unsolicited automated email can _easily_ be deleted, especially if it's one time. I would never associate "rude" with that, maybe "annoying" at worst.

<comment><USER6> But this is actual spam! It's bulk, and unsolicited. The content doesn't matter.

<comment><USER7> Well, it really depends on one's definition of spam. I personally consider emails that are bulk and unsolicited, but provide some sort of actual information or help to not be "spam" but instead just call it what it is, a bulk, unsolicited email. To move it over to the spam category, I also would require it not be at all useful to me. Of course, that's just me, which is why I asked the question.

<comment><USER6> Sure, that's one definition. Your definition would get you kicked off many service providers and is illegal in some jurisdictions.

<comment><USER8> Plus, there was a donation button. A lot of companies are sure you are honestly better off with their services as well.

</comment></comment></comment></comment></comment></comment></comment><comment><USER9> cached version -> [http://webcache.googleusercontent.com/search?q=cache:tQP6ur9...](http://webcache.googleusercontent.com/search?q=cache:tQP6ur9of4IJ:atechdad.com/i-emailed-97931-users- their-passwords/+&cd=1&hl=en&ct=clnk&gl=us)

<comment><USER10> Thanks :) Since it says "Error establishing a database connection", I wonder if someone misused the password of their database?

<comment><USER11> Naw, that's what happens when WordPress is overtaxed.

<comment><AUTHOR> Yeah-- I was not expecting this kind of traffic- I am reizing.... the box, hopefully this resolves the issue very soon.

</comment></comment></comment></comment><comment><USER12> This is a pretty useful service. I do check sites tracking these compromises on occasion, and I know at least one password I used before has been compromised, but it wasn't one I'd used in years.

My biggest concern is that your subject line sounds like plenty of spam/phishing emails, and your URL may get blacklisted by email services if you do this often enough.

From a slightly higher effort standpoint, you might be able to work with major email service providers to ship these notifications to users in a more official capacity.

<comment><USER13> The problem isn't that the subject line sounds spammy, it's that the spam mails try to sound legitimate. This may in turn create problems for actually legit messages.

Maybe putting the scraped password in the subject line catches the recipients' attention.

<comment><USER12> That would probably help. "Your password, xxxx, has been compromised." Even if they think it's spam, they should immediately realize they do need to change their password.

<comment><AUTHOR> That's a good idea. Maybe a subject line like your password p __ __*rd has been compromised.

<comment><USER12> Password is already compromised, so this is a worthless step. And only seeing part of the password may cause them to think it's largely still secure or something. (Some people don't understand wildcards.)

<comment><AUTHOR> Good point

<comment><USER14> Nonono really bad idea, because of shoulder-surfing!

<comment><USER12> Since their password is already compromised publicly on the Internet, it's silly to worry about shoulder-surfing. In fact, if someone shoulder-surfs, and sees the password, the user is even more encouraged to CHANGE it.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER15> This is a cute experiment, but unfortunately the integrity of the service is is easily corrupted.

The biggest problem is being prone to misinformation. There's nothing to prevent people from posting arbitrary e-mail lists to pastebin, with purported matching passwords, as an effort to provoke your service to cry wolf.

A few suggestions to harden the service:

\- provide integrity when sending the message by including a PGP signature. what's to stop someone from running an e-mail server and spamming mass e-mail lists with message headers that spoof your mail domain, and proclaim bogus security lapses?

\- in general, e-mail itself is not assuredly secure. sending people an e-mail is not enough, since the message might be intercepted as plaintext, and altered in transit. furthermore, those intercepting the e-mail might scoop up credentials and use them. if your service is a reliable source of working credentials, who better to attack? maybe you risk making the problem worse?

\- consider hosting a secure web page over SSL, and mail links to your site. if your service gains a positive reputation, users might be able to acknowledge past leaks, but elect to receive further notices if other leaks recur elsewhere. maybe users can see links to the source someone is using to post their info, and whether the situation has been remedied by a take-down. this might be a questionable activity: if you send people to that same breach, will they look at the same list and abuse other users on the list? but what better way to demonstrate the breach?

\- provide a means to verify the level exposure. what if someone's account was listed for 24 hours, and then the leak was taken down. they might still wish to know they were exposed, so they can take action. also, is the resource you're linking to confirmed as related to a known/verified data breach? who confirmed that this was a real breach of security? are you a first responder to the leak? has the leak been responsibly disclosed to the providers of the accounts tied to the leaked passwords?

<comment><AUTHOR> These are very good points. 1\. Good idea 2\. Good point, however, these credentials are usually already posted in public forums. My thoughts were that the risk was already present-- and the person who potentially didn't know was the user. 3\. I am patiently waiting on let's encrypt. As a side project with no income, I cannot justify the cost of a certificate. 4\. I found based on some responses that some of the credentials were old. It was not my intention to verify exposure, but let the user know that I found a password. If the person recognizes it for any account, change it.

I don't know if this is a service that can be maintained for any period of time, but hopefully the unexpected emails helped someone before the service could be abused.

<comment><USER16> While we wait for Let's Encrypt, you can use a free certificate from StartSSL.

<comment><AUTHOR> I have looked at StartSSL when I registered my domain. I was turned off when I was told my domain wasn't old enough. I understand why-- I just decided to wait then.

</comment></comment></comment></comment><comment><USER14> Beautiful effort, nice work!

If you're going to continue doing this, you might want to take a look at the message you're sending (or have someone else do that for you). Remember that a large segment of your recipients are probably not the most tech-savvy (or brightest). Do not overestimate random users reading comprehension. Without clear explanation where these passwords came from the natural assumption is that you did it, and you're warning them as a threat. No that doesn't make sense but remember who you're talking to.

One more thing:

> the person indicated that they use the same password for everything and > wanted to know which account had been compromised.

If you answered that, you may just have got social engineered.

</comment><comment><USER17> While I support this valiant effort, aren't there often legal implications to doing this?

<comment><USER18> It might be considered spam for one thing. The emails are unsolicited and it might be seen as a subtle promotion of the urhack project. I'm not sure that collecting and sending the passwords is illegal but I'm sure that wouldn't stop some litigious person from causing grief.

<comment><USER19> They're definitely unsolicited. If they are also promotional, that would make them illegal -- at least in the EU.

</comment></comment></comment><comment><USER20> On a related note, how safe is it to do a Google search of your password?

<comment><USER21> This is actually a really interesting idea. I'd love to know how possible it would be for someone to scrape recent google searches, somehow. I'd think it would be relatively safe, but I'm still hesitant.

</comment></comment><comment><USER22> Did you track open rates? I would be curious to see what those numbers look like.

<comment><USER23> Is there any reliable way to do this? Most mail clients will block receipt- type stuff by default...

<comment><USER24> I believe the trick is to put a hidden, 1px image in the email. Then you can track how many times it was requested.

<comment> semi-extrinsic Assuming people read their email in HTML and has their email client set/defaulting to automatically requesting external content. Sure, for a large sample from non-technical audience such as here it's probably a good assumption, but it may not be for e.g. a small sample from a tech-savvy audience.

<comment><USER16> Most modern email clients (and webmail clients, and smartphone clients) hide webbugs by default, so the 1px image technique won't work.

This'll only work on very very old desktop clients, or users that actually click the "show images" button.

</comment></comment></comment></comment></comment><comment><USER25> This is awesome, very nice of you. Many thanks to you!

</comment><comment><USER26> The database error is such a touche right now in this post :)</comment>