Proposed privacy control UI for Facebook - <AUTHOR> http://youropenbook.org/proposal

<comment><USER2> I disagree with having a full-time UI element in place for a setting (well, series of settings) that should only have to be updated once. Certain things you can't retroactively go back and change (Example: another user shares a link you posted that's offensive to your new boss) or don't have immediate effect (Ex: search engine results), which this UI item might give the impression of having that kind of control. It also doesn't handle edge cases well (Ex: wanting contact info in the open, but not photo tags), instead covering them with blanket groupings and encourages users to be more ignorant of the intricacies of privacy really.

I think what Facebook should have done already is use one of their blue announcement boxes on the home page to notify users of their default "Everybody" status if they have it turned on and direct them to the privacy settings to adjust them.

Of course, I have everything set as openly as possible, so I really don't care anyways.

<comment><AUTHOR> The slider serves as a simple privacy reminder on your home page. It only takes a few moments at youropenbook.org to make it clear that many people could benefit from such a reminder.

It's not the intention that you would interact with the slider frequently. If you drag it to a different setting a dialog box would popup and explain exactly what the consequences would be.

Most people would be happy with simple privacy settings, and there's still a customize link for the power user.

</comment></comment><comment><USER3> Nice idea, but there's a lot less money in a closed facebook than an open one. It will never happen. The portion of users that are A. aware of the privacy problems and B. care at all is so so small, probably less than 1%, that Zuckerburg couldn't care less.

</comment><comment><USER4> facebook doing privacy UI is like philip morris doing anti-smoking ads. they hire the best minds, and have them use their skills to make things intentionally fail (ads, UI controls). what facebook calls "highly granular" control is a failure of UI thinking: fewer, more powerful and more simple options are what you get from good UI thinking. it's NEVER about giving the user as many options as you can, the entire point of UI design is to remove the number of choices a user has without removing the amount of things they can do.

this goes a long way towards that for sure, but it's just not in fb's self interest.

</comment><comment><USER5> It is in Facebook's best interest to keep privacy controls as complex as possible, and defaulted to openness.

</comment><comment><USER6> Actually, Facebook used to have privacy sliders exactly like this back in late 2007, early 2008. I think there were only three of them: profile, user info and pages.

<comment><AUTHOR> I had forgotten the sliders: [http://www.designaesthetic.com/2007/07/17/facebooks- ridiculo...](http://www.designaesthetic.com/2007/07/17/facebooks-ridiculously- cool-story-types-preferences-widget/)

I don't think they were a privacy control, just a (complex) way of mixing your newsfeed.</comment></comment>


Ask HN: Examples of java web-apps? - <AUTHOR> Any code examples of web-apps in Java? If any used dropwizard framework that'd be great. <comment><USER2> Hi, here is my DropWizard example application [https://github.com/javaeeeee/DropBookmarks;](https://github.com/javaeeeee/DropBookmarks;)

And a Spring Boot example [https://github.com/javaeeeee/SpringBootBookmarks](https://github.com/javaeeeee/SpringBootBookmarks).

<comment><AUTHOR> awesome thanks so much!

<comment><AUTHOR> also, was going to ask if you actually knew an example of an app calling an external api and then I happily found a walkthrough on your blog :) [http://javaeeeee.blogspot.com/](http://javaeeeee.blogspot.com/)</comment></comment></comment>


The Serif Test – Is your website fundamentally broken? - <AUTHOR> http://ecc-comp.blogspot.com/2015/07/the-serif-test-is-your-website.html

<comment><USER2> Cool. I want to test my sites. How were you able to force a site to use Serif font?

<comment><AUTHOR> In Iceweasel/Firefox you just go to preferences -> content -> advanced, and then tick the box that says "force sites to use my font".</comment></comment>


Keylogging Users via Slack Themes - <AUTHOR> https://fletchto99.dev/2019/november/slack-vulnerability/ <comment><USER2> How is it possible to patch this while retaining the ability for users to make custom themes? I'm genuinely curious what the right solution is. CSS is practically a programming language at this point (isn't it Turing complete?) so it seems hard (if not impossible) to accurately identify all of the features that might constitute a vulnerability when the script is deliberately loaded and run by a user.

Is there a way to tell a browser "this stylesheet can't make external requests"? Are they manually parsing the stylesheet to look for the naughty selector (on the textbox element, or on $=, etc.)?

Update: Oh, it looks like this is being entered via an input field in the settings meant to specify a color code. So not actually a fully-fledged user stylesheet. On that note, does Slack support those?

<comment><USER3> The correct way to prevent this would be to constrain the input and validate it on output -- so that users cannot enter anything that's not a hex value, and Slack won't send back anything that's not a hex value in the theme. Even limiting the length of the input (and output) would mitigate the issue to some extent...</comment></comment>


Robotics startup Anki is shutting down - <AUTHOR> https://www.vox.com/2019/4/29/18522966/anki-robot-cozmo-staff-layoffs-robotics-toys-boris-sofman <comment><USER2> Previously on HN 8 days ago [https://news.ycombinator.com/item?id=19782692](https://news.ycombinator.com/item?id=19782692)

</comment><comment><USER3> I wonder what will happen to the Anki population of robots. No official support probably, no speech recognition (voice commands?) when they shut down the servers.

But what about re-setup after reset or new robot setup?

If this will obliterate the Anki robot tribe, it brings a whole ethical aspect of creator responsibility.

</comment><comment><USER4> Url changed from [https://www.cnet.com/news/anki-maker-of-cute-mini-robot- vect...](https://www.cnet.com/news/anki-maker-of-cute-mini-robot-vector-is- reportedly-shutting-down/), which points to this.

</comment><comment><USER5> At least this repost clarifies that this is NOT the Anki flashcards program.</comment>


Sleeping over eight hours a day associated with greater risk of stroke - <AUTHOR> http://www.cam.ac.uk/research/news/sleeping-over-eight-hours-a-day-associated-with-greater-risk-of-stroke

<comment><USER2> Sleeping science appears to be the diet/nutrition science of the new millennium. Every week there's a new suggestion that mixes up causation with correlation, and in the process it diminishes the popular credibility of science, when it's not seen as self correcting, but simply unable to figure out what it wants to recommend.

Woody Allen had it right in Sleeper --

Dr. Melik: This morning for breakfast he requested something called "wheat germ, organic honey and tiger's milk." Dr. Aragon: [chuckling] Oh, yes. Those are the charmed substances that some years ago were thought to contain life- preserving properties. Dr. Melik: You mean there was no deep fat? No steak or cream pies or... hot fudge? Dr. Aragon: Those were thought to be unhealthy... precisely the opposite of what we now know to be true. Dr. Melik: Incredible.

<comment><USER3> Nutrition seemed to be fairly well understood until recently, and the advice was consistent. I am sure in the last couple of months I have seen different articles blame carbs, fat or protein for all our modern day ills.

</comment></comment><comment><USER4> Another view: [http://www.bbc.co.uk/news/magazine-16964783](http://www.bbc.co.uk/news/magazine-16964783)</comment>


The Art of Unpacking (2007) [pdf] - <AUTHOR> https://www.blackhat.com/presentations/bh-usa-07/Yason/Whitepaper/bh-usa-07-yason-WP.pdf <comment><USER2> Here goes the blackhat talk if anyone is interested: [https://www.youtube.com/watch?v=pnReLmt4tZU](https://www.youtube.com/watch?v=pnReLmt4tZU)

</comment><comment><USER3> A fun read and brings back memories, but ollydbg? That hasn't been updated in something like 20 years now. I don't see a date on here but I'm going to guess 2006 at the latest.

<comment><USER4> 2007, to judge by the URL. I've added it above.</comment></comment>


China's new intelligentsia - <AUTHOR> http://www.prospect-magazine.co.uk/article_details.php?id=10078

<comment><USER2> As with most of the west, the quoted opinions misunderstand the core strengths of western style of government. The issue of giving people a greater say in their society is of little consequence. If it was critical then the most successful nations would have something like the Athenian model of democracy. The strength of the parliamentary dictatorship models we like to think of as democracies draw their strength from a structure which plays powerful personalities against one another in a model that is non-violent and relatively cheap compared to known alternatives [1]; it gives these personalities motivation to find fault with one another rather than collude [2]; and it providers a resent mechanism for the situation that develops when the ruling grouping begin to take things for granted.

That evolution of the Westminster system is a narrative example I particularly like because it is one of the main models. The story is dominated by reforms aimed to prevent concentrations of power. Magna Carta, church separation (a change of convenience the the ruler of the time but - ultimately beneficial thanks to further developments under Elizabeth I that cemented religious freedom - retained), The Republic (a deliberate but failed attempt at beneficial reform - discarded), evolution of the bicameral parliament to add impediments to overbearing governments left in control of the lower house, evolution of the doctrine of separation of powers.

Novelties such as policy elections do nothing to supply the necessary mechanisms. And they don't give particularly good outcomes - you only need to see the sorts of rubbish that people in the street consider to be important when they vote for someone to see that mainstream people are ill-equipped to make well informed decisions about complex policy arrangements. It is heresy to say this.

[1] The state in Australia with no upper house is the one that is most notorious for corruption and general shonkiness; it has a department to prevent corruption that costs twice what an upper house would.

[2] One of the disadvantages of this is that both sides have an interest in increasing the size of government. Ron Pauls are thin on the ground everywhere.

</comment><comment><USER3> Very interesting read; definitely different than the standard China bashing I've been reading.

I remember reading an article how the entire culture is different and where scientists don't disagree with their elders. ((<http://www.technologyreview.com/Biotech/16130/page2/>)

Nice to see that it's not as simple as that.

</comment><comment><USER4> Sounds like Animal Farm on a massive scale.</comment>


Scientists say signals from certain stars are "probably aliens" - <AUTHOR> https://techcrunch.com/2016/10/25/scientists-say-signals-from-certain-stars-are-probably-aliens/ <comment><USER2> _"The fact that they are only found in a very small fraction of stars within a narrow spectral range centered near the spectral type of the sun is also in agreement with the ETI hypothesis" the paper's authors, E.F. Borra and E. Trottier, wrote._

This is just poor science, right off the bat.

And given that there's hardly anything like an echo (let alone agreement) from other scientists in response to such an earth-shattering "finding" \-- poor journalism, as well.</comment>


Microsoft Has a Large Presence at This Year's X.org Conference - <AUTHOR> https://www.phoronix.com/scan.php?page=news_item&px=Microsoft-XDC-2020 <comment><USER2> Note how they don't contribute anything to X/Wayland, they only _extend_ it so that DX12 and other proprietary, Windows-only systems can interact with Linux. These are anti-features. Like they could also just use Vulkan and be done with, but they don't; EEE is in full swing.

<comment><USER3> Taking a guess, this seems mostly like a plan to get machine learning developers back onto Windows as main development boxes. If so, the first iteration of WSL itself was about web development. The integration of cross compilation and remote debugging for Linux into Visual Studio points into a similar direction.

MS seems to accept Linux on servers, but allowing Linux on desktop machines might actually end up eating a significant chunk of the Windows market share.

<comment><USER4> I think Microsoft's strategy (I work there, but I don't have any special knowledge of this) is to be the best possible platform for development in general, not just machine learning. That's why they bought GitHub, and it's also why they have WSL, remote debugging on Linux, etc. I expect they will go wherever they think developers want to be to achieve that goal.

I can see this hurting traditional Linux graphics systems and development tooling, but I think the main dynamic driving this is not proprietary-vs-open, it's Microsoft's ability to coordinate large numbers of developers, because they have a massively more united org than random hobbyists.

If you combined all of the efforts of all of the people working on Linux tools for the past 20 years and got them working on the same thing, it would probably be an _amazing_ stack, and Microsoft would probably just support it. Instead, the open source efforts have been scattered among a lot of different ideas, which means there hasn't been a single windowing toolkit, IDE, or whatever for people to rally around and all contribute to. And as a result, Microsoft can show up, get a few hundred people pulling in the same direction, and have the market-leading product not through any dirty tricks, but just by putting in more coordinated effort than anyone else.

<comment><USER5> Agreed - I will note however how badly Microsoft has bungled this same story on Windows itself. They went from a very high productive and unified development story in mfc/winforms to a super fragmented space.

I am getting going with WPF. (But that was then followed by maybe Silverlight? Then HTML with bindings?). Now we have been told that UWP is the big future (basically Windows Phone framework?). Gah! XAML? I mean, we went from a drag and drop unified and simple and extendable dev experience that was actually fast to develop into this GUI nightmare - all produced by ONE company with total command and control over their developers.

It tells you something that google web browser is almost a more stable and targetable platform than the native Windows platform (chromium / electron). I mean, that is desparation right there. At least someone was smart enough at microsoft to just give up on IE even on their own platform!

If QT had a bit of a simpler onboarding flow or linux was more unified I think there actually is an opportunity to actually be a good standard for line of business apps that want snappy responsiveness etc. But I just can't believe how badly Microsoft has screwed up their GUI story for the developers they claim to care so much about.

<comment><USER3> I think you forgot ASP.net, Blazor, Xamarin.Forms and MAUI. UI development with .NET is just incredibly fragmented.

If Qt had a good bridge to C#, they could probably get a lot of marketshare on .NET while this confusion lasts.

<comment><USER6> Add C++/WinRT to the mix, which dropped the productivity features of C++/CX, with the team that managed to kill it telling us to just wait for ISO C++ to catch up, while dealing with IDL files pre-.NET style.

Naturally the reception has been less than stellar and they are finally acknowledging that waiting isn't not an option and something is being discussed, however don't expect any improvements in 2020.

</comment></comment></comment></comment></comment></comment><comment><USER7> Any time now, "[https://www.lindows.rocks](https://www.lindows.rocks)" will happen. I hope it has the Lindows Rocks song on it :D

</comment><comment><USER8> > For XDC2020 there is Microsoft as one of the silver sponsors for the event.

Good for organizers. Dev conferences in Poland are not exactly a gold mine.</comment>


Linux desktop user experience - <AUTHOR> http://www.skillcraft.org/2012/09/linux-desktop-user-experience.html

<comment><USER2> While I agree with you that KDE is awesome, I feel as though you may be passing up a really great distro that IMO meets all your needs. OpenSuse is developed solely on KDE's latests and greatest. They extensively test on KDE making it the most stable KDE experience possible. I highly recommend you give them a shot. I feel that OpenSuse gets all the things right that Canonical gets wrong.

Ultimately your point about fonts in the linux world is true, however there is a reason for that. The reason is that most fonts are not free.

<comment><USER2> comming back to comment again and I'd have to say that I think instructing someone completely new to linux to use a more "stable" linux like CentOS or Debian can be just as damanging when they cannot figure out how to get java installed correctly or they need to connect a printer. I think the gnome shell is responsible for those things, however those things work less in CentOS and Debian than they do at distro's aimed at the desktop. You are recommending stable server distro's for desktop deployment... there is no crime there but I do question your logic (because I'm curious) about how CentOS would be better than Ubuntu for your typical desktop user.

I should note that I use Ubuntu 12.04 w/ Unity as my developer workstation at work but I use Arch linux on my home machines. Would I ever recommend Arch over Ubuntu? Only if you are a developer. And only maybe then.

I think Ubuntu is far from perfect, but it is rock solid stable by end users definitions.

<comment><AUTHOR> The reason I suggest CentOS (or Debian) is because it met the needs of a large majority of people I dealt with. Also remember that a lot of these people work in offices and having printers (or java) set-up correctly is integral to their work, which I haven't had any problems setting up thus far (or directing people "How to" on the phone) in CentOS. Every single one of 'em has then installed the same distribution they use at work at home as well.

One of the reasons why this all works really well is that, these distributions are installed on hardware which is relatively old (2-3 years), which is the case for the majority. Distributions need to realise that when an operating system is installed, it is supposed to run without issues for a very very long time.

P.S: I did test openSUSE (12.1), but, it had its own share of issues that I don't recommend it to newbies.

<comment><USER2> In the end which font(s) have you found that render well or that you recommend? Any monospace in particular?

Edit: P.S. I feel that I was too harsh in discounting CentOS as a "difficult" server distro. It is, for the reasons in your reply, probably one of the better choices. I can't knock that and it is a good enterprise recommendation - for older hardware in particular.

<comment><AUTHOR> Any font that doesn't ship with the default install needs some amount of tweaking to "get right". That said, like mentioned before, fonts in the Ubuntu family works well in all areas. Personally, I have been alternating between Ubuntu mono (bold) and terminus for a while now on the terminal and Ubuntu Regular as the system font.</comment></comment></comment></comment></comment>


Logo 15-word challenge (1997) - <AUTHOR> http://www.mathcats.com/gallery/15wordcontest.html <comment><USER2> These programs rely on Logo's turtle interface, which is a convenient and intuitive way to describe graphics imperatively. It's great for kids. These days, Python also has a turtle library (edit: built-in! part of the standard library, for some reason), heavily inspired by Logo, which means that the code on this page can be easily translated into Python. Here are some example that you can run at home (since I assume more people have access to Python these days than likely have a Logo interpreter installed). Edit: these are Python translations (by me) of the top three entries on the linked page.

        import turtle
        import math
        turtle.tracer(0,0) # remove this line to watch the drawing

        def spirals():
            # repeat 1800 [fd 10 rt repcount + .1]
            for repcount in range(1800):
                 turtle.fd(10)
                 turtle.rt(repcount+.1)
            turtle.update()

        def snowflakes(variant=6):
            # repeat 8 [rt 45 repeat 6 [repeat 90 [fd 2 rt 2] rt 90]]
            for _ in range(8):
                turtle.right(45)
                for _ in range(variant):
                    for _ in range(90):
                        turtle.forward(2)
                        turtle.right(2)
                    turtle.right(90)
            turtle.update()

        def orb():
            # for [i 0 420] [seth :i repeat :i [fd 2 rt 1] pu home pd]
            for i in range(0,420):
                turtle.seth(i)
                for _ in range(i):
                    turtle.forward(2)
                    turtle.right(1)
                turtle.penup()
                turtle.home()
                turtle.pendown()
            turtle.update()

<comment><USER3> I'm a Python newbie, running on macOS 10.13 with Python 2.7.10. When I save the above as turtle.py, and run with `python turtle.py` in the Terminal, I see an almost instantaneous flash of a tiny window, which then disappears.

When I remove the tracer line to "watch the drawing," I don't even get that. The Terminal just returns instantly.

Looking at tracer documentation, it's supposed to be `(which-frames-to-render, delay)`. If I set it to `turtle.tracer(1, 10000)` I get exactly the same flashing window as (0,0).

How can I see the result?

<comment><USER2> Don't save the file to turtle.py, because then the "import turtle" line might try to import itself. Call it turtlestuff.py. Then do this in terminal:

      python -i turtlestuff.py

Then you'll get an interactive Python prompt and you can call the functions directoy, e.g.

      spirals()

Hope this helps you!

<comment><USER4> >because then the "import turtle" line might try to import itself

Then you get turtles all the way down!

</comment></comment></comment></comment><comment><USER5> Logo was my first programming experience - my older sister(who had Logo in school) introduced me to a few basic commands.

These quickly turned out to be insufficient, so I reverse-engineered the examples shipped with the platform. We didn't have internet access, so that was the only viable option.

When that turned out to be insufficient I noticed that many Logo commands were three characters long and highlighted, so I generated all the three-character combinations and checked them out one by one.

Turns out you can make games in Logo, but sounds and keyboard interactions introduce pauses in the main loop.

Eventually this new browser named Internet Explorer 6, which shipped with a language called JScript, proved to be more interesting, even though I didn't understand what a "<div>" was and how to write a for loop properly.

<comment><USER6> Mine too.

</comment></comment><comment><USER7> While this challenge does show off the complexity and beauty of Logo's "turtle graphics", it has often struck me as a tragedy of the language that, for most people who have encountered Logo, they are led to believe that graphics is all it can do (or its only purpose).

<comment><USER8> Indeed. I've recently discovered NetLogo, which is a variant designed for making simulations, and it is amazing how you can get a sophisticated simulation in about a page of code.

[https://ccl.northwestern.edu/netlogo/index.shtml](https://ccl.northwestern.edu/netlogo/index.shtml)

</comment></comment><comment><AUTHOR> As a result of a recent thread[1] on HN regarding Logo, we now have a Slack workspace[2] and Freenode IRC channel[3] for Logo fans. Please do join them even if you don't remember Logo anymore. The intention here is not to discuss Logo but to share the joy of computing that we discovered through Logo and has remained in our lives.

[1]: [https://news.ycombinator.com/item?id=21374341](https://news.ycombinator.com/item?id=21374341)

[2]: [https://bit.ly/fd100slackinvite](https://bit.ly/fd100slackinvite)

[3]: #fd100 at chat.freenode.net

</comment><comment><USER9> Reminds me of Algorithmic Information Theory:

> Algorithmic information theory principally studies measures of irreducible > information content of strings (or other data structures). Because most > mathematical objects can be described in terms of strings, or as the limit > of a sequence of strings, it can be used to study a wide variety of > mathematical objects, including integers.

[https://en.wikipedia.org/wiki/Algorithmic_information_theory](https://en.wikipedia.org/wiki/Algorithmic_information_theory)

Cf. Chaitan, Kolmogorov, and Solomonoff.

Or Schmidhuber's "THEORY OF BEAUTY & LOW-COMPLEXITY ART" [http://people.idsia.ch/~juergen/beauty.html](http://people.idsia.ch/~juergen/beauty.html)

</comment><comment><USER10> Even simple thing like drawing the Euler spiral has much more effect, if you visualize the turtle motion, so you can see how the motion turns at some point and the turtle starts going back on the same way down.

cs repeat 360 [fd 10 lt product 2 repcount wait 5]

or a variant of David Eisenstat's code:

cs pu setpos [-100 -100] pd repeat 8 [rt 45 repeat 4 [repeat 45 [fd 5 rt 2 wait 1] rt 135]]

of course Logo is LISP, so you can do stuff like

? show map [[x] se sum # x ?REST] [1 2 3]

[[2 2 3] [4 3] [6]]

</comment><comment><USER11> Forth version: [https://forthsalon.appspot.com/](https://forthsalon.appspot.com/)

</comment><comment><USER12> Yehuda Katz's name is in there somewhere.

<comment><USER13> I like how it links to his Geocities page.

</comment></comment><comment><USER14> From one entry:

> The really interesting part is that the effect is entirely destroyed if you > replace "fd 40 fd 40" by "fd 80".

Fascinating...

</comment><comment><USER15> I wonder what would happen if you combined this with a Game of Life type algorithm?

<comment><USER16> My boss at Logo Computer Systems, Brian Silverman, produced a custom version of Logo with Life Game instructions included (implemented in 6502 asm for //e). This was never marketed.

<comment><USER15> What was it like? I see on his Wikipedia page that he's made a lot of discrete cellular automata over the years, but Logo seems more...analog and continuous?

<comment><USER16> It was basically a specialised version of Apple Logo // (which we produced) adding primitives for constructing cellular automata. You would basically define rules, which would be executed and displayed. It was very fast as the execution engine was written in 6502 asm.

</comment></comment></comment></comment><comment><USER17> How cute, each name links to their email address. Very 1997!</comment>


The Five Stages of Hosting - <AUTHOR> http://blog.pinboard.in/2012/01/the_five_stages_of_hosting/ <comment><USER3> This is an amazing article. I intended to write such a blog article myself.

One aspect I intended to cover (and will now do so here) is that of cost. I get very frustrated by cash-strapped startups which from day one are expecting to be 'web-scale' and need to turn up machines at the drop of a hat. Lets get real. I HOPE you have to worry about that... much, much later.

I'm quite pleased you started your article mentioning solutions like heroku. Unless you have some special-needs not met by a PaaS, this is where you should start. You should be writing code, not managing servers (this coming from an operations guy who has been managing servers for 12 years, and worked at a webhost). Once you scale far enough that its worth hiring someone to deal with the knowledge required to deal with the maintenance of managing your application stack, OS updates, security, etc -- THEN move on. Not a moment before.

Cloud servers are realistically not the price/performance/low-maintenance solution for MOST startups. You should get a VPS (Linode) or dedicated server (from a reputable company which can offer quick SLAs on replacing parts - <USER2> 2 hours at voxel.net). Dedicated servers are cheaper than you think. I pay voxel $180/mo for an 8GB quad core 1TB box on 100mbit/sec. It outperforms servers costing twice as much in EC2 - and thats not counting bandwidth or storage. Concerned about reliability? Buy TWO - In different datacenters. -- You're STILL saving money, and you have the exact same level of maintenance overhead as AWS (OS, Updates, full application stack); while reaping the performance benefits of bare-metal.

You do NOT want the headaches of colocation. You cannot pay your staff enough to stay local to the server 24/7 and the cost of extra parts on hand to make up the money over dedicated.

Your startup is not Google, so I won't get in to having your own datacenter. (Well done pointing out that they're not getting advice from your blog)

<comment><USER4> I had some poor experiences with dedicated servers at well known providers. Essentially if the hardware fails, they'd rather fix it than get you into something new so you can be back up and running. My site ended up offline for several hours, several times, so that some tech could run hardware diagnostics, etc.

EC2 may be expensive, but if anything goes wrong, I can boot another instance in seconds and abandon the old one. They fix it on their own time.

Sure, I could buy more servers so that one down one doesn't affect me, but that's twice as expensive. On EC2 I don't have any penalty for abandoning an instance for any reason. I've actually moved data centers in EC2 when the performance profiles were better on the other side for the same size instances. It was a temporary difference, but migration was pretty much painless.

You're voxel suggestion may have a 2 hour SLA for replacing parts, but what happens when they don't know what is wrong?

That said, I agree that a person should try for the PaaS and evaluate all the options fairly. I tried Linode, several dedicated hosts, and then finally moved to EC2 on a previous project.

<comment><USER5> I agree, I love EC2 personally, their mini server plan(or whatever its called) is great for keeping a production version of a project running while its still in an initial phase (very low user base) and then you can scale easily without having to learn anything new as you can run basically things the same as you do locally (I run Ubuntu locally and mainly develop for Tomcat so it makes it really easy to keep things the same on there). I looked at Heroku but as soon as I realized it would be rather expensive just to get regular datbase access (so I could run straight SQL if I needed to, etc) it was out.

<comment><USER6> The micro instance seems incredibly slow for me running Rails. It runs out of memory while doing a git index-pack.

<comment><USER7> The micro instance seems to be routinely throttled, for random reasons. My vm was choked for days despite only pulling in ~200 visitors per day. Upgrading to the Small instance has removed all throttling.

I'm running a standard LAMP stack on it, nothing crazy.

</comment></comment></comment></comment></comment><comment><USER8> as someone that has done colocation, dedicated hosting, and VPS, i'm a huge fan of dedicated hosting.

colocation was expensive and the hardware problems were all mine. i was pretty much tied to my local datacenter because i didn't want to ship a server around (which would be at least a day of downtime). pricing can be hard to compare because of power/space/bandwidth. if the equipment i colocated didn't have IPMI support, it could sometimes take up to a half hour to have a datacenter tech be able to put a remote console online when there were problems. at the end of it, i had a bunch of servers that were worthless on the resale market due to their age.

VPSes were never a serious option for the reasons stated in this article. it's impossible to track down performance problems when a dozen other VPS customers on the same server are taxing the CPUs and disks. i do use one that i pay $10/month for just to run a network monitor for some off-network perspective. they can be useful for single-task servers that don't need a lot of processing power like dns servers.

with dedicated servers, though, you can signup on a website and within a few hours have a complete server with modern CPUs, disks, and lots of memory assembled, tested, and connected to the internet with a remote console waiting for an o/s installation. when hardware goes bad, the server provider has lots of spare parts waiting around to be swapped in for free. and the best part of all, when you're ready to upgrade or move to a different provider, you just cancel the account and let the provider worry about what to do with the old hardware. i have a handful of these on various providers costing between $140-$190 a month for something like a core i5 ~2ghz with 8gb of ram, 2 big sata drives, and 100mbit ethernet with more than enough transfer every month.

<comment><USER9> _i have a handful of these on various providers costing between $140-$190 a month for something like a core i5 ~2ghz with 8gb of ram, 2 big sata drives, and 100mbit ethernet with more than enough transfer every month._

This seems ridiculously cheap compared to something with comparable RAM/CPU on EC2.

Is there a catch?

<comment><USER10> No catch, you've just discovered how ridiculously expensive EC2 is.

<comment><USER9> Then why do so many startups (and even established businesses like reddit and Netflix) use EC2?

<comment><USER3> Reddit and Netflix have entirely different models at their 'web-scale'

They actually DO need to be able to scale servers up and down based on demand- usage, time of day, growth patterns, etc.

For them, the extra EC2 cost is negated by being able to spin up an extra 400 instances in the evenings, and turn them back down after everyone goes to sleep.

Under the dedicated server model they'd ALWAYS need to have an extra 400 dedicateds to handle that peak load (and in fact would need to have far more to handle additional spikes, projected growth, etc.) Those dedicated servers would sit idle, costing them money most of the time.

This is the difference between 'web-scale' and your typical startup's usage pattern.

<comment><USER11> > They actually DO need to be able to scale servers up and down based on > demand-usage, time of day, growth patterns, etc.

Cost wise, your best scenario is usually going to be dedicated or colo + EC2 or similar for overflow / peak.

If you do just dedicated hosting you need to leave enough spare capacity that you feel comfortable handling the spikes for whatever the worst case provisioning time your host has.

It's still cheaper than EC2.

But if you do dedicated + ability to spin up EC2 to take peaks, you can go much closer to the wire with your dedicated hardware, and increase the cost gap to EC2 massively. You don't need as much spare capacity to handle peaks any more. You don't need as much spare capacity to handle failover.

It's rare for it to pay off to spin up EC2 instances to handle inter-day "normal" load changes, though - most sites don't have differences that are pronounced enough over short enough intervals for it to be worth it. If you do the dedicated + EC2 model, your EC2 instances needs to be up no more than 6-8 hours or so on average per day before it becomes cheaper to buy more dedicated capacity.

</comment></comment></comment></comment></comment></comment><comment><USER12> TIP: I see _a lot_ of people calculating off-the-cuff AWS prices for comparable hardware somewhere else and declaring how expensive it is.

Don't forget that 3yr reserved pricing is 48% cheaper than the on-demand costs, so once you know what your hardware reqs are on EC2, you can purchase some reserved instance and more or less cut your costs in half. Pricing out any hardware configuration on EC2 using the on-demand pricing is tear- inducing.

For Day 1 release, probably not an option. But at the 6-month mark you probably have a much better idea of what hardware your startup needs and can adjust accordingly.

2 CENTS: For the folks that need something better than a Micro and less expensive than a Large, don't forget about the Medium instances.

They aren't in the primary section but down in the "High CPU" section; they are an excellent fit for work that isn't quite big enough for a Large.

</comment><comment><USER13> The hostel

You decide to run a site on 'shared' hosting (e.g. dreamhost, 1&1, godaddy (shudder), etc.) because it looks really cheap and they list so many "unlimited" things.

The good:

It's surprisingly pretty cozy for your startup wordpress blog about fish, although at that point you start wondering why you didn't just get a wordpress.com account instead, but you justify it by saying you were able to put your custom design theme with lasercats this way. You're not sure why your friends are saying the site feels slow.

The bad:

Oh, you like to program huh? Sorry our python version is 2 years behind. What's this ruby stuff you speak of? You're hosting user-submitted content on your bunk bed? Get out! Or upgrade to our overpriced "VPS" solution! You give up on the site and throw money away.

<comment><USER14> The thing is, the price difference between this and a vps is too dramatic. For example, I can get a Lunarpages basic hosting, with "Unlimited" Bandwidth and "Unlimited" Storage for $4.99/mo with support for rails apps and python (not django however). Not to mention a free domain name.

However the cheapest linode vps is $19.99/mo.

I would LOVE to have a vps to play around on, I would have so much use for it and yet I'm a student living in London and all my money goes towards the cost of living. It makes much more sense for me to go with the cheaper shared hosting as I just can't afford anything more.

As an aside, I found <http://virpus.com/> the other day and they are selling vps's starting at $3/mo. Does anyone have any experience at all with them?

<comment><USER15> I've heard good things about <http://prgmr.com/> and they have 5/6/8/12 -dollar tiers.

<comment><USER16> If the amount of traffic they offer feels adequate, good for you. Otherwise, practically anyone else will offer more traffic these days.

</comment></comment></comment></comment><comment><USER17> An important addition to the article is that, as you descend the list, you run out of people to blame.

<comment><USER18> "people to blame" only helps if you work for someone else. When you are the boss? more "people to blame" means more people that can cause serious problems if they can't do their job.

Having other people that can do something for you so you don't have to is a good thing. Having someone else to blame, if you work for yourself, is the downside to outsourcing, not the upside.

Outsourcing is great; but make sure you can always move to another provider if you have trouble with your current provider. Your boss might let you off the hook if a provider screws it up, but your customers won't.

</comment></comment><comment><USER19> I wrote a similar article trying to segregate hosting stages (though beware I'm a hosting company promoting a product) - [http://blog.bytemark.co.uk/2011/11/03/the-cloud-is-your- inst...](http://blog.bytemark.co.uk/2011/11/03/the-cloud-is-your-install- script) . tl;dr version is that I think the ultimate flexibility is in your application's install script. If you can deploy to one host, or several, and collapse or split out caching layers, databases etc. depending on resources available, you have a truly portable application that's ready to scale and/or move ISPs.

</comment><comment><USER20> An option was left out which is to have your own T1 running into your own facility (that is not a data center). We did this for years ('96 to 2004) and had much better up time than with colocation with diverse paths and biometric security. We didn't need a generator either. Just an array of industrial batteries hooked up to a power inverter with a line conditioner could keep the equipment running for 24 hours if utility power went down. (This is much cheaper than anything you would buy commercially from APC or Triplite).

<comment><USER21> Well, that does trade off risks to your T1 getting knocked out by a backhoe, perhaps power failures between you and the other end of it (e.g. if I bought a business DSL connection from AT&T to run a server at my apartment, I could lose it in a general power outage when the DSLAM's battery ran out).

But I can well believe it's better than many co-lo experiences, although all of mine have been positive. Right now I'm helping a friend with one: due to it housing Protected Health Information we pretty much have to run it on our own servers, which I built and he put into a co-lo that he's worked with before for this sort of thing.

<comment><USER20> "trade off risks to your T1 getting knocked out by a backhoe"

Well luckily no backhoe but I did keep, at my own expense, Westell DS1 NIU's around because I had a situation where one went bad and it took the Verizon tech time to go and find one. So I bought a few so he would have the parts around. I also made sure when they strung the fiber from the connection point to our office (several hundred feet through other offices in the ceiling) that it was in orange conduit as opposed to just strung through the building (they were just going to run it like phone wire). I also had them bring an extra fiber through, as well as a fishing wire in case it was ever needed for anything in the future.

</comment></comment></comment><comment><USER22> No-one has mentioned mixed hosting, whereby you pick from each category.

Something like Varnish you want a lot of RAM for, dedicated suits that well.

Web servers tend to be numerous and are just computational power (stitch all this gubbins together and return a string), their number vary according to demand and they suit virtual servers really well.

Now databases, these really need good disks, lots of RAM, decent CPUs. They are best dedicated or colocated. When things go wrong with a database server you _really_ want to be able to rule out the invisible magic of other hosts, and the voodoo of being a virtual machine.

The best thing I can hope for whilst I scale is to find a provider that will sell me dedicated and public cloud instances that can live on the same VLan and still be reasonably priced.

I'm currently still totally with Linode, but with 9 instances, and an over- heated database server I know I'm getting close to the limits of what I can do there without re-focusing on splitting up the app when I could be adding new features.

</comment><comment><USER23> This is an excellent write-up; I like the metaphors, and it doesn't feel too much like it's trying to force a preordained conclusion.

One option I have trouble fitting in, though, is the "run your own server locally". This might be #5, except it's often seen as actually a lower-class option than #4, rather than a step up: before you go all out with a colocated server, how about just a machine with Apache sitting in the office hooked up to your office's business-SDSL line?

<comment><USER24> it's probably not included because keeping your production server outside of a datacenter is kind of a silly idea. you save some money, but you don't have the cooling, the power conditioning, the network redundancy, or the security of a proper facility.

<comment><USER23> I suppose it depends on your use case, but I don't see those as necessarily worse failure modes than other options. For example, Reddit has in the past been down for >20 hours at a time with its cloud solution. With a local solution, you would want offsite backup for the catastrophic "building burned down" failure mode, but most local failures can be solved in that kind of timeframe with the "drive to Frys, buy new server, and restore from backup" recovery plan.

Now if you can't afford _any_ downtime, a local server is probably not a good idea, but then neither are many of the cloud alternatives. Also depends on size, of course; one or two local servers is a more reasonable proposition than 35 servers randomly thrown under desks. (Though the "so uh, does anyone remember which room 'thor' is in?" moment _used_ to be a classic startup rite of passage.)

<comment><USER25> You've raised what I consider to be the elephant in the room, and you can see all the responses quick to tell you why can't do that> It simply doesn't fit with what most people consider acceptable, which is that one must be a user for everything internet related.

Most of us have at least ~5Mbps/ 2Mbps (up/down) connections at home that are always on with minimal latency. The gaming service OnLive shows that these connections are adequate for most people's needs. Home/ office connections will only get better, and I think the idea of running one's own server(s) for things like family and/ or small offices will make more sense than some 3rd party corporation's "cloud." PIM, email, IM, pictures, videos etc. simply don't need to be subject to the whims or TOS of a company or outside one's own control.

This is what I do currently, and it certainly is a kludge at the moment, but I believe it can be improved to the point of appliance-usage eventually.

<comment><USER26> This is against many consumer ISP ToS and they can/will arbitrarily start blocking traffic on certain default ports depending on how draconian they are about it. I agree that hosting on a home server is an option (even a good one) for some people and usecases, but you are still subject to the whims of someone else, and in this case you often have no recourse as you are violating the ToS.

</comment></comment></comment></comment></comment><comment><USER27> You forgot another popular option that a lot of people use as an alternative to the "monastery" stage: shared hosting (shudder).

<comment><USER28> Agree. I was surprised they overlooked this one. Perhaps they couldn't think of an appropriate metaphor. Prison? Orphanage?

<comment><USER29> I'd suggest slum. It's a place to sleep, but you have no security and no property rights. It's generally unpleasant, and the whole thing could burn down at any moment. And you have (practically) no recourse if you don't like what you're getting. Even the best hosts have laughable SLAs (if they have one at all), and no meaningful performance guarantees.

<comment><USER18> Show me any reasonably priced service that has a SLA worth reading.

Nearly all retail providers have some sort of "if we have downtime, if you complain, we will refund you for the time you were down" SLA. The pennies you get don't compensate you for the time it took to complain, much less the lost business from being down. Look at all the companies advertising a 100% SLA; I mean, even 99.9% is unrealistic in most cases without some very expensive hardware or application-layer redundancy.

</comment></comment></comment></comment><comment><USER30> One thing no one has mentioned is the tax implications of the different choices for startups - something which can be as important as the technical side of things.

The OECD model tax convention, which has been adopted by many pairs of countries for their double taxation avoidance agreements (DTAAs) uses the term "permanent establishment" - "a fixed place of business through which the business of the an enterprise is wholly or partly carried on". If a business derives income attributable to a fixed place of business in another country, they will likely need to deal with the tax department of that country. At best, this will mean considerable expenditure (by a bootstrapped startups' standards) on legal compliance, and at worst, could mean considerably more tax is paid.

For hosting stages 1-2 in the article, no fixed place can be attributed to the business purchasing the hosting (CPU resources are shared and no CPU fixed CPU is assigned to the business). Disk space may temporarily be associated with a business, but this is under the control of the service provider - it is disk space and not physical disk sectors which are being rented, and the provider is free to move data.

However, stages 3-5 mean that a business has a very definite physical location (i.e. place of business) in another country.

These types of non-technical issues can often outweigh the technical ones in terms of business priority.

<comment><USER31> Have you seen this be an issue in practice? Our place of business is our registered office.

<comment><USER30> It is a place of business if it meets the definition, and there can be more than one.

The definition is somewhat ambiguous, but it is likely that if there is an actual physical place (even if it is just a server) used to offer goods or services for sale to the public, there is a good chance that those sales are attributable to that server, and will be taxed in the country that server is located in.

This might not be a problem for an established corporation with the sales volume to justify the tax accountant expenditure and payment overhead needed to comply with tax law in multiple countries, but for a bootstrapped startup it can be an important consideration.

</comment></comment></comment><comment><USER32> Aww, this is a gem. Beautifully written and none of the bias and factual errors that you commonly see in articles on this subject.

<comment><USER33> Plus the metaphor pretty much holds up. That is rare in this kind of post.

</comment></comment><comment><USER34> The article isn't completely accurate in that it states that you need to build your application in a certain way in order to host it on Heroku, which isn't true. I just don't see Heroku in same category as something like GAE.

Heroku places no requirements on your code that you wouldn't find through general best practise when building scalable applications. A lot of people will cite the read-only filesystem as a special requirement (which requires S3 or similar), but this is a common requirement with clustered systems. Yes you might have a local SAN that you can use as a local filesystem but the point is the same.

With the multiple applications I've deployed to Heroku I don't think any would not run on a 'regular' VPS as is. There's no Heroku specific code in there period. In fact, if I have changed my approach to better suit hosting on Heroku, it's generally been changing it to a better approach that would suit all types of hosting.

</comment><comment><USER35> I'd like to add that for different parts of your application, or website, it's ok to use different services.

For example, a large majority of tech startups have a WordPress blog that is totally separate from their actual web application. In many cases it also drives the marketing front-end of their website.

So while my main application may be on Heroku or AWS, I like to fire up a free PHPFog (I don't work for them, you could use DotCloud, or likely another alternative as well) account, and have my WordPress install setup there. It's insanely easy to setup (it's all Git based), and the free account will get you a long way.

It's also nice to know that the WordPress install lives on an entirely different server, so if you get slammed with great press, your entire stack isn't feeling the heat. There are security fears here as well, so I like having it separate.

<comment><USER36> Or, if your Wordpress site gets hacked, your entire site isn't p0wned. I have a friend who had his WP site hacked last week. Fortunately, he hosts his application on a separate server, so there were no (major) security issues.

</comment></comment><comment><USER37> No one seems to be commenting about the Stately Manor :) Datacenters come with their own set of interesting problems that are just as much fun to solve as programming puzzles. Thermal imaging goggles to design airflow.. Designing extra redundancy into power systems while adding alternative energy to reduce power costs. In this category, rack space and power consumption are almost as important characteristics as ram/ghz.

</comment><comment><USER38> The best part? There's no one "right way", each one has it own ups and downs. Too few authors do this these days and think they have all the answers to everyone's problems.

</comment><comment><USER39> I've been stuck between #3 and #4 for years. I could really, really use more than the 8GB of RAM my largest (rented) servers have. Not being able to build high-RAM servers limits the sites I can build and the features I can offer on the ones I already operate.

For example, I built something like Mixpanel 2 years ago, but I never launched it because in load testing it really didn't take a very large client's worth of data to exceed the 4GB of RAM I could afford for a server, and hitting disk would make reporting far too slow. Buying a new server for each client (who may decide to cancel the next day) was not something I wanted to commit to. <http://i.imgur.com/DAOEA.png>

I've ended up at Softlayer after trying a number of hosting companies over the past 10 years. They want $25/mo/GB for RAM. It's almost like they want you to pay the one-time cost of the hardware _every month_... and then some!

Yet, supporting all this on my own, I can't really colocate -- I don't have the expertise or the money to get it off the ground, nor can I be there to drive to a data center and fix things if something breaks 24 hours a day. I have no employees. I have 60k users to support myself.

It seems like I'll be stuck here for a long time.

<comment><USER40> Hetzner offers Servers with 16GB of Memory at 49€/month (~$64) or 1and1 starting at $129.99. I don't know the current state of dedicated server hosting in USA but you can nowadays can get a lot of hardware very cheap

</comment></comment><comment><USER29> The may be off topic, but... At the moment we're mostly using option two (Linode VPS), and it's working pretty well. I've been repeatedly tempted by option option four (colo), but I'm kind of daunted by the task of getting started. I've been burnt by option three (renting a dedicated server) before - it seems like the worst of both worlds.

Can anyone recommend a good guide to getting started with colo? Obvious questions include:

Where do you go to buy a cheap server? Can you just have it shipped direct to the data centre, or do you need to configure it yourself? How does that even work for startups in a different country to the data centre? Is there anything I should look for in a data centre to make it easier? Do any offer out of band consoles? What sort of costs are we talking about? Is there a break-even point beyond which you really should colo instead of using VPS? Is there a detailed tutorial anywhere on "getting your first coloed server up and running without bricking the stupid thing and needing to spend thousands of dollars getting a data centre technician to fix it"?

And so on. :) It seems like there are a LOT of resources to hold your hand as you get up to speed with Linode-type services, but colo is dark magic.

<comment><USER41> Maybe you should test the waters with <http://macminicolo.net/>. I haven't used them (yet) but it's relatively cheap, and they will handle lots of things for you (including buying the mini). A dual-core mini can do a _lot_ of work.

<comment><USER42> Neat idea, but their bandwidth overage charges are brutal. .80c/GB?

</comment></comment></comment><comment><USER43> This is a great list. I've noticed that I always hate whatever option I'm on that's short of "the condo." And even if you have a condo (or a subdivision of blades), there are still the inevitable screwups that leave you cursing your colo. But we live in an imperfect world. We just have to spend money engineering for it.

</comment><comment><USER44> Love the article, just one note: I think #1 is not necessarily constrained as it may sound. Especially with Heroku, I think it is very easy to upgrade later on for most set ups, not too much special code or conventions. The major one would be probably the read only file system, but I'm sure using Amazon S3 is not that bad

</comment><comment><USER45> Great article and this thread is great for checking out some new hosts for dedicated servers. Pricing has gotten pretty good in the last year so I think it's a good time to upgrade from PaaS to Dedicated hosting again.

Has anyone had experience with a hybrid dedicated/cloud model? I'd love to stick our Postgres servers on dedicated hardware but then be able to spin web servers as cloud servers when needed for traffic spikes.

</comment><comment><USER46> Going along with the metaphor, shared hosting is like crashing on your friend's couch while you get your life in order and look for a place to live.

</comment><comment><USER47>
        the homeless
        -- (*.tumblr, *.posterous and *.wordpress.com)

        the billboard space
        -- stackoverflow, facebook, twitter

</comment><comment><USER48> I don't currently host anything with them, and I do find the prices a little much (especially RAM, what are they thinking?!), but for dedicated hosting, I think Softlayer has to be mentioned. Their network connectivity and multiple data centers (including Europe and Asia) make them, in my mind, the best alternative to AWS.

</comment><comment><USER49> As a small web shop, we went the other way. From 3 (dedicated hosting) to 2 (VPS). It's quite nice to know that when a piece of metal breaks you just get a new machine on the fly.

You do need a good host though. Quick e-mail replies and pro-active management of server load is absolutely vital. Happy to have found it (in NL) :)

<comment><USER50> Feel free to mention the name of your hoster.

</comment></comment><comment><USER51> I think the secret is dedicated server costs can only come down so far but VPS prices should get better and better for even better hardware as time goes by.

$50/mo can get you a 4-core raid10 xen VPS which is plenty powerful and almost as flexible as dedicated.

</comment><comment><USER20> I'm thinking of getting another rack at the colo place that I use now. Anyone looking for space on that rack that doesn't have high bandwidth or power needs needs feel free to contact me and I will see if this makes sense for both of us.

</comment><comment><USER52> One missing advantage in #3 is the ability to launch instances across continents

</comment><comment><USER53> I'm a brazilian and EC2 just opened in São Paolo (then I realized its kinda expensive).

I'm not sure if 40ms vs 160ms latency is so important for many kinds of web sites.

I'm considering a Linode VPS in Dallas.

What are other brazilians using?

<comment><USER54> O que exatamente você quer fazer?

</comment></comment><comment><USER6> Where would you go to find a "condo"? There are no links in the article. What is the pricing/reliability/support like having your own server in someone else's data center?

<comment><USER55> What this (very good) post calls the "condo" tier is what the hosting industry calls "co-lo" or "co-location". Search that term and you'll get more options than you can probably wade through. The "rackspace" option (biggest name for good quality mid-tier sized setups) is <http://www.equinix.com/>

Huffington Post, Gawker, BuzzFeed, CafeMom and AdMeld all co-lo with <http://www.datagram.com/>, most of them are within a few feet of each other.

<comment><USER56> Equinix is a little on the expensive side... Just a little bit.

</comment></comment></comment><comment><USER57> They forgot my preferred hosting method from my pot smoking college days.

A second hand Pentium II in the corner of the lounge, running Slackware with ports 80 and 21 forwarded to it from a cheap belkin router off your domestic DSL connection.

Good: Basically free (assuming the power bill is in your landlord's name) , host whatever the hell you like.

Bad: Someone might spill the bong water over the power strip and ruin your uptime.

</comment><comment> rafael-minuesa Regarding the DataCenter, yes, correct, you will need some divine help ...

</comment><comment><USER58> The power of strong metaphors strikes again.

</comment><comment><USER59> Why is it that a well written site can't scale quite large on heroku? (or similar - I use heroku so I'm biased) Perhaps I'm naive, but I feel one can go from heroku to stage 5 if you truly have a blowout.

According to their website (<http://success.heroku.com/>) some pretty large websites run there, including Urban Dictionary and Rapportive.

Sure, it may cost more, but not more than a full time sysadmin and you are buying efficiency and flexibility. You can buy a lot at heroku for $10,000/month (the minimal cost of a full time deployment / sysadmin / dbadmin,) including I'd imagine some rather hands-on support.

This article seems to downplay the great advances that have been made in "cloud" deployment. IMO, a cloud service like heroku beats the pants off of self-operated virtual servers and debatably some of the higher "stages."

<comment><USER60> _Why is it that a well written site can't scale quite large on heroku?_

Is anyone claiming that? The linked blog post doesn't make that claim.

<comment><USER59> It doesn't directly claim that, however calling these "The Five Stages of Hosting" implies that an application will likely progress through these stages as it grows, and that application platforms will be quickly outgrown when any sort of scale is reached. That's a pretty clear implication from the title and I'm calling for counter-evidence, because I don't think it's accurate.

I also host on Heroku applications that I hope will grow, and if that's a bad choice, I'd like to know others opinions.

<comment><USER44> I think you pointed it out, it's the cost. I love Heroku too, however, I can definitely see how Heroku can be much more expensive in the long run. 37signals just recently showed how their recent RAM addition was just a tiny fraction of what they would have payed at Amazon.

</comment></comment></comment></comment><comment><USER61> Pinboard needs to filter some of the bookmarks that are coming in the site. In the recent stream I constantly see links to depraved sexual acts, including physical and sexual abuse.

Often these links are fan fiction but sometimes they are not.

Who is reading this stuff and why? What kind of behaviour does this inspire? And why do all Pinboard subscribers need to be exposed to this?</comment>


Steve Jobs Stopped at Japan Airport Over Ninja Stars, SPA Magazine Says - <AUTHOR> http://www.bloomberg.com/news/2010-09-14/steve-jobs-stopped-at-japan-airport-over-ninja-stars-spa-says.html

<comment><USER2> Apple claims this is a made up story:

[http://digitaldaily.allthingsd.com/20100914/qotd-the- ninja-t...](http://digitaldaily.allthingsd.com/20100914/qotd-the-ninja- throwing-stars-they%E2%80%99re-for-my-friend-larry-ellison/?mod=tweet)

</comment><comment><USER3> Maybe a made-up story to find out who is leaking info to the press?

[http://www.fakesteve.net/2010/02/just-for-the-record-i-am- no...](http://www.fakesteve.net/2010/02/just-for-the-record-i-am-not-running- around-new-york-in-a-top-hat.html)

</comment><comment><USER4> I desperately want for this to be true. It's too awesome not to be.

</comment><comment><USER5> The title of this article is a garden path sentence! <http://en.wikipedia.org/wiki/Garden_path>

</comment><comment><USER6> i've always known that steve is a ninja. and of course they deny, he's undercover.

</comment><comment><USER7> Apple is enormously popular in Japan - I wonder if his temper might affect sales.</comment>


Obama Encryption Policy Rejects Laws Mandating Backdoors - <AUTHOR> https://www.eff.org/deeplinks/2015/10/partial-victory-obama-encryption-policy-reject-laws-mandating-backdoors-leaves <comment><USER2> Deceptive title, unintentionally.

FTA: "Instead, the Post reports, the "administration will continue trying to persuade companies that have moved to encrypt their customers' data to create a way for the government to still peer into people's data when needed for criminal or terrorism investigations."

While eschewing attempts to legislatively mandate that tech companies build backdoors into their services, the president is continuing the status quo – that is, informally pressuring companies to give the government access to unencrypted data."

Status quo is that the government doesn't respect the privacy of its citizens.

<comment><USER3> We've agreed as a country that the ability to get a warrant in the case of probable cause is a good thing. How is this not just maintaining that?

I find it hilarious how often privacy advocates manage to forget that we've had this conversation before, and while the government can and has overstepped in many ways, lets not throw out the ability to investigate at all along the way.

<comment><USER4> Because breaking encryption breaks it for everyone. If the cops can get your data, so can a hacker. There is simply no way to compromise. You either are encrypted, in which case nobody but you can decrypt your data, or you're not encrypted at all.

Remember the "TSA locks" we're all required to use on our luggage at the airport? Nobody but the government was supposed to be able to unlock them. But now anyone who wants to ruffle through your luggage can get universal keys for all TSA locks. What happens when that same scenario plays out with your bank account, your company emails, or any online store you've made purchases from?

<comment><USER3> I'm not arguing to break encryption. And neither is the white house. They want ways around this stuff- ways that don't break encryption, but if the information is available, then the ability to get to it if necessary.

Backdoors don't work because yeah, it breaks the whole system. But not everything is encrypted with these companies, that's just plain.

<comment><USER5> Perhaps I am not versed well enough in the subject, but I have a hard time envisioning any kind of system that allows government officials to get around the encryption and peer into the contents but not hackers.

There will always be some sort of secret only the government has access to, and once that secret is leaked it's game over.

<comment><USER3> You don't give the government access to their own door. The company simply retains the right to access things- you know, the same way we have it now.

All it's arguing, is to say "You don't have to encrypt literally every part of your system and delete the rest" a la what Snapchat suggests they're doing(though we don't have proof).

</comment></comment></comment></comment></comment></comment><comment><USER6> This is mostly good news. A few thoughts:

* The FBI-NSA-etc. axis already tried to ban nonescrowed crypto. This was in 1997, when far fewer products relied on it, far fewer people used the Internet, and far fewer groups mobilized to oppose it. If even _that_ effort failed, this one was likely to fail as well.

* Excerpt from that 1997 proposal, which was actually approved(!) by a House of Representatives committee: "It shall be unlawful for any person to manufacture for distribution, distribute, or import encryption products intended for sale or use in the United States, unless that product..." [http://thomas.loc.gov/cgi-bin/cpquery/T?&report=hr108p4&dbna...](http://thomas.loc.gov/cgi-bin/cpquery/T?&report=hr108p4&dbname=105&)

* I disclosed in 2012 that the FBI had drafted a proposed law to require backdoors; that legislation was never introduced, even as a placeholder. My 2012 article: [http://www.cnet.com/news/fbi-we-need-wiretap-ready-web-sites...](http://www.cnet.com/news/fbi-we-need-wiretap-ready-web-sites-now/) Of course the FBI's bill could be kept in reserve to become Patriot Act 2.0, just like the FBI-NSA-etc. axis had EPPSCA in reserve, which morphed into Patriot Act 1.0 a month after the 9/11 attacks, as I wrote about here: [http://www.cnet.com/news/how-bin-laden-and-911-attacks-shape...](http://www.cnet.com/news/how-bin-laden-and-911-attacks-shaped-electronic-privacy/)

* If the legislative approach is now off the table, as the WashPost piece indicates, look for the FBI-NSA-etc. axis to try more creative approaches. "Oh, you want that $2 billion government contract? You want your new device to be FIPS 140-2 certified? How about that merger or FTC antitrust review? Environmental reviews? Trade? Taxes? It sure would be a shame if things didn't go your way. Maybe you can help us and we'll help you..."

This is why it's worth supporting groups like EFF (I donated last year and need to again before the end of this year). They provide a _moral_ argument that counters that of the Washington establishment--and also provides guidance for tech firms when they're faced with challenges like those above.

</comment><comment><USER7> "Persuade."

How can we know that NSL's aren't being used right now to "persuade" or coerce companies to cooperate? Who needs legislation when you effectively don't have to reveal anything?

</comment><comment><USER8> I am surprised the petition has yet to reach 100k signatures.

Is it optimistic to think that most of the tech community at least should recognize the significance of this? Even if you doubt its effect on real policy.

<comment><USER9> I'm not. Who has time to fully comprehend (and act upon) this? Especially when we're already working >50h a week to maintain household status quo. It's hard to focus on the state of society's infrastructure when I'm spending every waking moment working to maintain my own. Yes, I know what is at stake, but one avenue is a long burn and the other is a short fuse. I'll tackle the more pressing issue first.

Disclosure: I work in the netsec industry and only signed this because HN brought it to my attention in the rare spare moments between my daily tasks. To use an analogy, I feel like I can't worry about putting out the forest fire if my house is already on fire in the midst of it. At the same time, I'm throwing money at someone that says they'll help me free up more time to do the forest fire fighting. We'll see if I've made a grave mistake in how I prioritize things.

<comment><USER10> This is my reaction whenever I hear someone suggest that "we should be rioting in the streets." I have daily personal struggles and work that I'm trying to pin down every day with all my energy. And my remaining time/energy go into finding a mate if I even have any at all.

<comment><USER11> So it turns out the real way to prevent riots is to make sure everyone is running in the rat race. Or in other words, jobs that only meet ~99% of their needs.

</comment></comment></comment></comment><comment><USER12> The Obama administration has continued flawed policies in many areas, especially those infringing on the 4th Amendment.

<comment><USER13> Government basically exists to maintain the status quo. Anyone who might really change anything really won't get far enough in order to.

Meet the new boss, same as the old boss.

<comment><USER12> Wouldn't it be good to have hope, and expect change? Our government, our country, our people can change, for the better, or for the worse. I'm sad that you think the status quo can't be changed. It can and should be.

<comment><USER14> And it is. How is it in the interest of TPTB to have weed legalized? Yet it is happening.

<comment><USER12> I'll be your Huckleberry. Why are we seeing advances in drug legalization and LGBT rights, but erosion in others?

<comment><USER15> Because the drug legalizers first disobeyed, then circumvented, and finally ignored the law, and the LGBT groups cheerfully use personal intimidation and group shaming rather than wasting their time putting their faith in politicians?

The status quo can be improved but it's a process of beating the system and the people in it until they stop resisting, not choosing better ones or convincing them you're in the right.

</comment></comment></comment></comment></comment></comment><comment><USER16> Meta: We might have more respect -- in limited measure -- for the government's position if they actually cleaned up their own malfeasance, instead of persistently, predictably trying to bury it.

You want transparency? Lead by example.

</comment><comment><USER7> > the administration will continue trying to persuade companies that have > moved to encrypt their customers' data to create a way for the government to > still peer into people's data

If you are one of these companies that are informally cooperating with the government on this, please state so publicly, in the signup process and by message to current users, so that we can avoid using your services now, or at least when it's discovered later if you weren't honest about it up front.

<comment><USER6> Well put. We tried to take a very privacy-protective stand when building Recent News ([https://recent.io](https://recent.io)) because of the amount of personalization we do. This warrant canary is part of our privacy policy:

 _As of [date], we have not received any legal process or demand from any federal, state, or local government that includes a gag order. We have received no National Security Letters, civil subpoenas, search warrants, Foreign Intelligence Surveillance Act orders, grand jury subpoenas, or any other form of compulsory process accompanied by a gag order.

As of [date], we have received no legal orders requiring us to monitor users' future activities or to modify our service.

If we do receive any form of compulsory process from any government entity, we will do our best to ensure that our users' legal rights and privacy rights under the Fourth Amendment to the U.S. Constitution are protected. That includes challenging overly broad orders in court._

It is still valid, I'm happy to say, for [date] values of today.

<comment><USER17> IANAL, but the judge may order you to keep the warrant canary or find you in contempt. Law is based on intent and if your intent in removing that clause is in broadcasting you are under gag order, when the gag order restricts you from doing exactly that, you may find that will be taken as a breach.

This should not be taken as legal advice, YMMV, yadda yadda.

</comment></comment></comment><comment><USER18> Why does the Apple one get special kudos? They just say they "don't allow government access to their SERVERS" \- they never say anything about the data.</comment>


Get it while it's cheap: Pinboard's revenue model - <AUTHOR> http://news.cnet.com/8301-19882_3-10310347-250.html <comment><USER2> If he's using PayPal's micropayments pricing (Fees = $0.05 + 5%), he's made just shy of $12,000 on the site so far.

I can't decide what I think about that number, except that I expect it goes farther in Romania.

<comment><USER3> One of the wonderful things about being a small business on the Internet is that there are several favors (SEO considerations, viral marketing, word of mouth, network effects) which make double-digit YoY growth practically a given. (You are more or less incapable of saturating your market, something that larger businesses have to worry about -- what does Facebook do after signing up nearly every American who uses a computer regularly?)

If you keep at it, the miracle of compound interest will do all the rest.

Compare that to a more traditional day job, which typically gives you a higher starting salary and then increases at 2 to 4% a year, with SHARPLY limited options for ever getting out of that bracket no matter how good your performance is.

</comment></comment><comment><USER4> This payment method is doomed to fail.

Once it goes over $10, maybe $20, it's dead. No growth. This is NOT one of those "everyone is doing it" kinds of services.

After this, their only hope is to turn to the current active user base and start all over at $0.05 and make it a mandatory subscription payment instead.

Reason being: once it reaches the "it's not worth it" threshold, a new clone will pop up and there just won't be any reason to use pinboard. At all.

<comment><USER5> I have better idea.

You could lower the price day by day when nobody registered and raise again if there were registrations in last few days.

</comment></comment><comment><AUTHOR> I would love to give this as a try as an experiment for a social news site for technology. "Digg without the 17 year olds in mom's basement"

<comment><USER6> I'm considering it for a side-project I'm working on now -- but, man, it's so hard for a site to gain traction even with free accounts, I'm not sure I have the stones.

<comment><USER3> Try building something which provides value even if you're the only person using it. (I have always admired Delicious for this. If every other person on it died tomorrow it would still be an excellent bookmark manager.) Then you don't need "traction", you just need more customers tomorrow than you have today. Repeat times a few hundred.

<comment><USER7> Agreed. Plus, if you build something that you would still use even if no one else did, you're guaranteeing that at least one person wants to use what you're making. Doing otherwise is surprisingly common, judging by some of the products out there.

The reality, of course, is that you aren't a unique snowflake; lots of other people are like you, and if you really like a product, chances are someone else will too.

</comment></comment></comment></comment><comment><USER8> I was considering doing something like this for a site I made one weekend for myself and my friends: limited spots. 5$ a spot per year, 1000 spots only. In the end I couldn't be bothered setting up the payments because it was not really worth it for small change, so now I just host it on our internal network.

Pinboards pricing strategy might have worked better - great idea!

</comment><comment><USER9> This is something like we did with 200nipples.com (t-shirts that start at $1 - my buddy build an amazing shopping cart for it). It's always fun to watch the mad dash for the first few shirts</comment>


Someone Can Change Your Facebook Credentials by Just Sending in a Fake Passport - <AUTHOR> http://imgur.com/a/L0pTI <comment><USER2> Context: [https://reddit.com/r/technology/comments/4q8ywp/til_that_som...](https://reddit.com/r/technology/comments/4q8ywp/til_that_someone_can_change_your_facebook_email/)

Latest update is that Facebook restored access.

</comment><comment><USER3> This is well known in the transgender community.

Facebook has a history of forcing trans people to verify their names by providing legal ID. This hurts people who haven't yet been able to legally change their names for one reason or another even if they go by their new name exclusively in real life.

So to deal with this, the community discovered a while back that you can just scan your ID and Photoshop in whatever name you'd like, and Facebook will accept it. They don't look too closely.

</comment><comment><USER4> _...lost_ all _my business pages..._

In future perhaps one's businesses will use and publicize their own domains, rather than Zuck's?

<comment><USER5> And then the domain registrar will be the one duped ;)

<comment><USER6> My personal favourite was the guy who stole sex.com using only a fax on company letterhead.

[https://en.wikipedia.org/wiki/Stephen_M._Cohen](https://en.wikipedia.org/wiki/Stephen_M._Cohen)</comment></comment></comment>


Show HN: Lizard – Fast, Extensible Code Complexity Analyzer written in Python - <AUTHOR> https://github.com/terryyin/lizard <comment><AUTHOR> Linux code-base with ~12 MSLOC is analyzed in less than 10 min with pypy.</comment>


Drug Compound That Kills Cancer Stem Cells Identified - <AUTHOR> http://www.bloomberg.com/apps/news?pid=20601087&sid=aQCyVkyA3AIA

<comment><USER2> If my Swiss cheese like memory doesn't fail me:

I think it was Israeli scientists who were first able to separate regular cancer cells and stem cancer cells in the lab.

It turns out stem cancer makes regular cancer. If you implant regular into a cancer free mouse it almost never develops cancer. But implant stem and you've got cancer.

Further more, regular c. cells grow too fast and are thus more susceptible to treatment then healthy cells. But stem c. cells don't, and they often survive treatment.

And stem c. cells tend to be in the center of tumors, surrounded by and protected by regular c. cells.

Makes you be in awe of cancer a bit a more doesn't it?

I am not impressed by promising results in mice, mice are a terrible model for human cancer. But what I found interesting is this:

 _They then used rapid screening techniques to test 16,000 commercially available chemical compounds._

This is a brute force search and I hope we see more of it. It can be automated and done by machines.

</comment><comment><USER3> Bloomberg presents the research finding in a different light: the article focuses on the fact that 1 compound out of 16000 researched was identified as the most effective at targeting cancer stem cells. However, the main outcome of the research, as NYTimes[1] points out, is that a new screening method has been developed to be able to quickly identify drugs that effectively target only the cancer stem cells. In fact, 32 chemicals were identifed as effective at killing stem cells. Only 1 of these is an approved drug.

The NYT article is more interesting because they mention two schools of thought among cancer researchers: on the one hand, there are researchers who think that only the stem cells must be targeted in order to completely kill off the cancer. They believe chemotherapy is ineffective because it kills all types of cells but fails to completely kill all the cancer stem cells. Even if 99% of the cells are targeted, the presence of remnant stem cells may result in the cancer returning. The other camp takes the view that it is not sufficient to kill stem cells only.

This is just my understanding of the articles. I'm not a biologist in any way & I'd love to read the views about the significance of these findings by hackers more versed with the topic

[1] [http://www.nytimes.com/2009/08/14/health/research/14cancer.h...](http://www.nytimes.com/2009/08/14/health/research/14cancer.html?hp)

<comment><USER2> _However, the main outcome of the research, as NYTimes[1] points out, is that a new screening method has been developed to be able to quickly identify drugs..._

This is definitely a big one.

As to the question of do we only kill stem cells or both types of cells. That's mostly an academic debate, because your doctor won't hesitate to give you both kinds of therapy, just in case.

</comment></comment><comment><USER4> The article is unspecific about what these compounds do to regular stem cells. It would be interesting to know if the most effective compound also kills regular stem cells, or if it somehow distinguishes between cancer and non- cancer cells.

(What happens to tissue when you take away its stem cells, anyway? Does it just age more rapidly? Or die off?)</comment>


I'm hiring a personal iOS prototyper - <AUTHOR> http://37signals.com/svn/posts/3307-im-hiring-a-personal-ios-prototyper

<comment><USER2> Wow, gotta love the 37 signals guys and Jason Fried. This is a killer job posting.

Salary, location are clear.

Job skills required are clear.

Boss/employee relationship is clear.

Vision/motivation is clear.

Ok, well it might not be perfect but it's a lot better than a stale typical job posting.

</comment><comment><USER3> Anyone who is as talented as they need can already earn more than $100k, especially in a major metro area in the US.

<comment><USER4> sounds to me like he is open to that possibility...

</comment></comment><comment><USER5> He seems to be looking for the mythical developer/designer hybrid. Is $100,000 a decent salary for someone with that skill set?

<comment><USER6> In Chicago? I doubt it for anyone else, but someone might do it for this opportunity. I'd hope that this is just in line with what 37 signals pays -- they have other benefits.</comment></comment>


Going to College Is Selfish Let's stop pretending education is a public good - <AUTHOR> http://reason.com/archives/2018/03/11/going-to-college-is-selfish <comment><USER2> "Let's stop pretending education is a public good", now that's a dystopian phrase if I've ever heard one.

edit: sp

<comment><USER3> The author has a degree in Economics. When it comes to pulling crap out of your ass, he's a professional.

</comment></comment><comment><USER4> The author goes on and on about the purely financial advantages or disadvantages of society's cost of Education. Given the fact that all US citizens have the option to vote on complex social issues, I would rather that each citizen get the most education possible.

Also, the idea of budgeting education to only what we think will be useful is a bad path. We just don't know enough about what's useful to make proper decisions about what to study and who should study.

Dollars and cents is not the only way to measure a social good.</comment>