New Persona Beta: Millions of Users Ready to Log In using Any Browser - <AUTHOR> http://identity.mozilla.com/post/47541633049/persona-beta-2 <comment><USER2> I implemented persona for ASP.Net MVC3 and it was hands down the easiest login system I've ever built in my career. From a developer standpoint it's very intuitive, the documentation is great, and I loved it so much I open sourced my implementation.

<https://github.com/sergiotapia/ASP.Net-MVC3-Persona-Demo>

Please give this a shot! I would only like them to keep more information on hand, like a first name, or an avatar so I don't pester my user with such requests.

<comment><USER3> I don't think you've actually implemented the protocol. Like most of the other examples I've looked at, you explicitly check every login attempt with the hard-coded mozilla verifier. This breaks two of the selling features of browserid:

1) Your identity provider doesn't know where/when you login because the relying party (the website) is supposed to cache the identity providers public key.

2) When identity providers start implementing browserid, it's not going to make any difference because you're not checking back with the identity providers website, as encoded in the assertion.

What you've implemented here is more like Microsoft Passport - a single point of failure through which all logins flow.

So, as a bootstrap mechanism the Persona service fails, because assuming people jump on the browserid bandwagon, we'll still be stuck using Persona because all the websites have implemented the protocol wrong (as in this case).

<comment><USER2> You're correct. This is _not_ a persona provider. It would be more correct to call it "Here's how you can use Persona in an MVC3 application."

\---

>So, as a bootstrap mechanism the Persona service fails, because assuming people jump on the browserid bandwagon, we'll still be stuck using Persona because all the websites have implemented the protocol wrong (as in this case).

Please elaborate here. You can just switch out the provider (in my case Mozilla) for another one easy enough. You're not tied down to a particular implementation.

<comment><USER3> That's right, you're not a 'provider', you're a 'relying party' - but you are unconditionally relying on the bootstrap mozilla service. You're not supposed to swap that out and rely on some other service, you're supposed to look at the assertion provided by the browser (or the javascript shim right now, while we bootstrap). Who you verify the assertion with depends on the user's email address.

So, if tomorrow Google added support for browserid to Gmail, and email@example.com tries to log in to your website, he would claim to be firstname.lastname@example.com and pass you an assertion to that effect. You need to check that with Gmail. Of course, Gmail being popular you've probably already checked the assertion of many people claiming to have Gmail logins, so you already have the Gmail key cached, and can verify the assertion without any http requests to anywhere.

Right now, Gmail does NOT implement browserid, so the assertion which you receive will be that firstname.lastname@example.com is vouched for by the mozilla browserid service, so you will end up checking the URL you've hard coded.

But if it's hard coded we can't proceed to the next stage, which is the distributed promise of browserid. AND, it puts lets less pressure on the likes of Gmail to implement browserid because no one will be checking gmail.com/.well-known/browserid.

<comment><USER4> Actually, the the verifier (verifier.login.persona.org) runs code that could be run on any server. It _does_ check Gmail for the well-known file first, and then, since not found, uses the fallback of login.persona.org.

As soon as Gmail (or any id provider) implements a well-known file, the verifier will immediately use that instead.

And the script that does all this _could_ be run on your own server. The only reason we don't quite yet tell people to do that is to be absolutely sure the verifier is correct in every step. It's harder to get everyone to upgrade their own server, so while in beta, we offer the verifier.

<comment><USER3> I think this is a bad idea:

You are using marketing terms like "Persona is distributed. Today" (last weeks blog title) but it isn't, because every auth request flows through mozilla servers. You are also advertising that it is so simple, the entire website example is 70 lines of python (recent talk), but it isn't, because you aren't implementing browserid, you're delegating to the centralised mozilla server.

Advertising that it is distributed and simple does not accurately communicate the current state of the implementation. Look at the spec:

[https://github.com/mozilla/id- specs/blob/prod/browserid/inde...](https://github.com/mozilla/id- specs/blob/prod/browserid/index.md)

> This assertion is a Backed Identity Assertion, as defined above. We call it > assertion here for simplicity, since the Relying Party typically need only > pass this assertion to a verifier service without worrying about the > specific semantics of the assertion string.

It does not say that the centralised mozilla verifier is temporary, but expected.

This all leads to people getting the wrong impression. As you say, it is hard to get people to update software on their servers, but they don't even know that they have to - because it's distributed, today, and simple - so they aren't going to be looking. Another group of people are going to look at the spec and implementations and think: what is the point of yet another login scheme which just pipes everything through mozilla?

This is not going to help the adoption of browserid.

</comment></comment></comment></comment></comment></comment><comment><USER5> Here is my feedback.

Perhaps the marketing of "persona" to consumers should take a backseat. When I signed in to <http://123done.org/> the pop up* showing "sign in with persona" confused me for a moment. For a moment, I thought.. "but I do not have a persona account"

If there is a way for users to just sign in with their email without telling them how it is done, I am sure there will be even less friction.

Of course, the persona architecture could still be marketed to developers for integration purposes. But for users, let it just be like magic.

PS: I did not see the Firebase implementation they spoke of. I am still told to make sure my password has 8 characters. <https://www.firebase.com/signup/>

*<https://www.dropbox.com/s/4ay0qp434rqd0dm/persona.png>

<comment><USER6> The Persona branding is necessary because you _aren't_ creating an account with the underlying website--you're creating an account with the persona.org fallback identity provider (that is, unless you're using a yahoo.com email or another Persona identity provider).

Think about it this way: suppose you create a persona.org account at site X, then visit site Y which also uses Persona for login. It would look like site Y recognized you, but how? Seems like an incoherent user experience.

Does this help at all?

Firebase offers a login service which includes Persona alongside Facebook, Github, Twitter as login options. They've got a demo here: <http://firebase.github.io/firebase-simple-login/>

<comment><USER7> You're losing 95% of users right there, including many techies. What's "Persona" vs "persona.org" vs "Persona identity provider" vs "persona.org fallback identity provider"

<comment><USER8> I don't think any site using OpenID has a 95% bounce rate because of it. Persona is the name of the magic, you need a way to tell it from OAuth and other sign-in mechanisms.

</comment></comment></comment></comment><comment><USER9> I have to say that I'm really loving Mozilla/Mozilla Research these days. Their heart is in the right place, and their research projects like Asm.js, Persona, Rust, and Firefox OS are very cool. They are what Google was in 2005.

<comment><USER10> Rust is perhaps the only thing that you listed with any real promise. It is bringing in some good ideas from other programming languages, and it does appear to be a language that may eventually offer some practical value.

Asm.js is, at best, a very ugly hack. Instead of going in the right direction and eliminating JavaScript in favor of a proper embedded runtime or virtual machine, it's just promoting further use of bad (even if widespread) technologies.

Firefox OS doesn't appear to be anything but a me-too catch-up effort. Nothing suggests it can truly compete with iOS or Android, never mind the numerous other mobile OSes out there that are available on far more devices and actually have at least some users.

Persona is perhaps a good-hearted effort, but it's pretty clear that it isn't catching on. There are already too many other authentication systems out there, and many of them have far more traction.

The community as a whole would likely get much better value if Mozilla focused on the software that many people actually use on a daily basis, like Firefox and Thunderbird, rather than these side projects that don't really offer much at all.

<comment><USER11> > Persona is perhaps a good-hearted effort, but it's pretty clear that it > isn't catching on.

This is news to the Persona team.

<comment><USER10> That's unfortunate to hear. I would have hoped that you'd be more aware of its actual level of adoption.

Taking an objective look at the situation, as somebody who isn't tied to the project, I just don't see it being used. While so many web sites and applications allow authentication using Google, Facebook, Twitter and even some other more obscure providers, I never see Persona listed as an option.

The adopters listed in the article are minor, at best. Given that the BrowserID initiative has been public for almost two years now, it's not a very impressive list.

It's easy to write blog articles claiming that "hundreds of millions of Web users are now ready to log in with just a few clicks", but we just don't seem to be seeing that actually happening in practice.

<comment><USER11> I contest that GNU Mailman, the Eclipse Foundation, Firebase, the Born This Way Foundation, and Discourse are hardly "minor, at best." Not to mention extensive dogfooding within Mozilla itself.

Less flippantly, these things take time. While the initiative has been public for some time, it's only been in beta for roughly 6 months. It would be irresponsible for many organizations to jump on board this early, and taking that as a sign of failure is disingenuous.

<comment><USER12> Well, as both a developer and a user, I hope that Persona catches on. I certainly use it on all my new sites, and preach it whenever I can.

It's definitely still early. Hopefully it will spread quickly.

EDIT: Where's the Firebase signup? I only see a Github and a plain one.

<comment><USER11> Firebase added Persona support to their API for apps built on Firebase. It's not (yet) supported on their home page.

</comment></comment></comment></comment></comment></comment></comment><comment><USER13> Before they push Persona more, can someone walk over to the team that's running <http://www.getpersonas.com/en-US/> and either disconnect their servers or lock them to their chairs until they finish the migration?

I understand the pain of rebranding assets, I do. But if you're going to rebrand to a product your company is already using, it has to be fast. And Mozilla, the 2 year anniversary is in July...

<comment><USER14> The migration is actively underway! The site will be shut down in a time scale ordering on weeks.

<comment><USER14> Correction, getpersonas.com is now decommissioned!

</comment></comment></comment><comment><USER15> Persona seems terribly important. And well designed, particularly compared to the ad hoc social login systems. I don't understand why it doesn't have more mindshare. Is it not yet ready for use by consumer sites?

<comment><USER16> > I don't understand why it doesn't have more mindshare.

Because all they've published so far is API specs and fluffy PR sites that try to portray it as "oh so much better" without offering any insight about why it is better. They can claim "more privacy" all day long, but without any details about what gets stored where and why it is supposed to be safer, they don't make a compelling case.

Look at this page for example: <https://login.persona.org/about> (the "how it works" page) - it has 0 details about these claims and unfortunately, we're already tired of reading how Google and FB respect our privacy. From "outside", it looks like we need to give Mozilla our (existing) credentials and trust them to handle them with care. Why should we? I feel safer making pwgen passwords for every new site I need to register at.

<comment><USER17> Er... "they" have also published the full source code involved (at <https://github.com/mozilla/browserid> ) and a privacy policy at <http://www.mozilla.org/en-US/persona/privacy-policy/> that you can compare to said source code as desired, if you're using Mozilla's identity provider.

As far as the architecture of the overall thing, there are also [http://identity.mozilla.com/post/7899984443/privacy-and- brow...](http://identity.mozilla.com/post/7899984443/privacy-and-browserid) and [http://identity.mozilla.com/post/11145921163/browserid- desig...](http://identity.mozilla.com/post/11145921163/browserid-design-for- privacy) and a technical specification at [https://github.com/mozilla/id- specs/blob/prod/browserid/inde...](https://github.com/mozilla/id- specs/blob/prod/browserid/index.md) that describes the exact data flow involved.

And if you read those, it should become pretty clear _why_ this is better for privacy than the FB or Google login systems. For one thing, the identity provider is never told that you're logging in.

<comment><USER16> Not even the links you posted tell me a) where certificates are stored and how they are protected, b) what measures are taken to prevent unauthorized use of those certificates by the ID provider, the browser (plugins?), other entities, c) how the act of entering an e-mail address is secure (other people may have access to my computer and know my e-mail address). Admittedly, I didn't watch the 1 hour presentation video, but I've come across HN-linked presentation web pages several times and tried to understand these issues every time, the result was always the same: Mozilla assures me it's all done properly, but does not provide the relevant details to back up these claims.

Mozilla needs to make a _very_ compelling case to web site owners for adoption, because FB and even Google has more users and oauth is at least roughly understood.

<comment><USER18> Let's see if I can help provide some answers here:

a) certificates are stored in localStorage for <https://login.persona.org>. They are very short-lived (hours), so that we don't have to deal with revocation, since that would likely be impossible on a per-user scale.

b) there's no way you can prevent an identity provider from misusing your identity. They're your identity provider. You chose them because you trust them to credential you and not let other folks impersonate you.

b') browser extensions already have full control over your life. That's something that should be addressed longer term, but Persona is not making this any worse.

b'') other entities cannot access the localStorage for login.persona.org, so that should be okay.

c) you're not just entering an email address. You're also proving you own it, for example by being logged into your Yahoo.com account, or by clicking the confirmation link we send you. What we're doing is minimizing the number of steps you have to take to prove you own an email address. But you still have to own it.

You should check out our documentation, which is quite thorough:

      https://developer.mozilla.org/en-US/docs/persona

I think we've provided a lot of hard data and docs to back our claims, but we're happy to provide more, of course.

</comment></comment></comment></comment></comment><comment><USER19> For this to be adopted, you need to have at least one major email provider implementing it, at least one major browser, and at least one major website. If you don't have the three corners of the triangle, people will inevitably judge Persona by its fallback implementation and will fail to understand the advantages Persona offers.

The good news is Mozilla have managed to implement a bridge that makes it look like one major email provider, Yahoo!, implements it.

Now you need the other two corners. Firefox OS is not mainstream enough, why doesn't Firefox for the desktop implement this natively yet? Isn't the whole of Mozilla behind this initiative? (Also, why haven't they fully retired the old usage of the brand Mozilla Persona yet?)

<comment><USER20> There's no reason for it to be integrated in the browser?

<comment><USER21> Browser integration is actually supposed to be one of the core pieces of Persona. The idea is that by building the Persona login process directly into the browser (as opposed to it requiring a popup/webpage) then phishing attacks may be somewhat mitigated.

<comment><USER19> That, and a better user experience. Have a look at this screenshot, doesn't it seem obviously more attractive and usable than a pop-up? [http://www.extremetech.com/wp- content/uploads/2011/07/firefo...](http://www.extremetech.com/wp- content/uploads/2011/07/firefox-account-manager.jpg)

</comment></comment></comment></comment><comment><USER22> Can I associate additional data to my profile? A lot of websites I use want to know my name, nickname, age, avatar-pic, timezone, etc. It would be nice if I could store it all with my Persona account and selectively allow access to sites that request it. I could even store my credit card info, and when the site wants me to fill in my address and such, I just click to allow access to that data, which can then autofill the forms.

I could even add things like have browsing preference data like "prefers-dark- on-light-theme", "no-video-or-audio-autoplay", or "no-nsfw-content". The site can add functionality for these preferences if it chooses to. Does Persona already have this?

<comment><USER23> No, we don't currently provide any profile information.

We'd love to see more experiments in this space. Get involved <https://github.com/mozilla/browserid>

</comment></comment><comment><USER24> This is fantastic! I'm really excited to see Mozilla improving the login experience for users across the web. It is a problem that is sorely in need of better solutions.

For the Node.js developers in the crowd, I'm happy to see Mozilla is using Passport.js (<http://passportjs.org/>) (which I'm the developer of) to power the OpenID/OAuth dances when doing identity bridging. You can see it in action at the BigTent repo: <https://github.com/mozilla/browserid-bigtent>

Passport.js can be used in your own applications to easily perform the server- side part of Persona/BrowserID as well as integrate with or transition from an existing login system.

<comment><USER23> Jared is also a great project maintainer. He has been very responsive to questions and stays on top of github issues. Go Passport!

</comment></comment><comment><USER25> Can someone recommend a good article about how Persona exactly works under the hood? I've seen zillions of news about Persona but haven't grasped the main concept. Comparison with OpenID will be appreciated also.

Many of articles say that Persona is great and awesome etc. but do not explain what are the advantages and security implications.

<comment><USER26> This is off the top of my head so maybe somebody will correct me, but:

Persona is a login system that cares about your privacy. With social login systems, the website you are logging into contacts the social login provider (Facebook/Google+/Twitter/what-have-you) when you attempt to log in. So you end up leaving a trail of breadcrumbs behind you of every site you visited (and used a social login on). Further, many people are not comfortable giving sites access to their social accounts because of privacy concerns.

With Persona, the idea is that your identity provider (can be your email provider, persona.org , or someone else) will have a key publicly available on their site. Your browser would generate a certificate that can be verified against that key. However, since the same key from the provider is used to authenticate all accounts on that provider, all the provider finds out when a website contacts it for the key is that _someone_ is trying to log into said website. Plus, the website could cache the certificate and now the provider does not know this either.

There is more to this so you're probably better off reading one of the other links.

<comment><USER27> If Persona would care about anyone's privacy, they won't use emails.

Logging in with, say, Twitter account is less secure in aspect Twitter knows what sites you log in, but more secure in aspect the sites can't spam you unless you allow them to do so.

<comment><USER28> I've been thinking about this, and I have come to the conclusion that it's less of an issue than I thought it was. For a simple reason: the "email address" you provide is _just_ an identifier. A string formatted as "user@domain", nothing more.

By _convention_ it's a usable email address, but there is literally nothing preventing someone from starting up an email-less Persona identity provider. You'd still log in with email@example.com, but that's just a formality that doesn't need to be hooked up to an actual mail server at any point.

Never using that account to actually communicate would put it on par with any other auth system you can come up with. Disposable when you want to dispose of it, and _no need_ to ever dispose of it unless you want to. The whole issue with some people changing their email addresses for spam-fighting / inbox- cleaning purposes is a non-issue with this kind of an account.

<comment><USER27> This is correct, but the whole thing is marketed as email address, so it will be used as an email address, i.e. means of contacting me.

Now, consider I want to try some service I don't trust. I sign in with a email-looking identifier (which doesn't work as email address) and use the site for some time. Eventually, I become fond of this service and want it to start contacting me. With 123done.org I can't do this, nor at the mineshafter.info, nor at crossword.thetimes.co.uk. Trovebox looks broken to me, so can't tell it works, and I was lucky with voo.st, as it allowed me to add more accounts. Don't know more sites using Persona. Considering, today when you register with only Facebook or Google account relatively many sites don't let you change that binding in the future, it's very likely the situation with Persona will be the same.

<comment><USER28> Hopefully, the existence / use of non-emailable browserid providers would encourage sites to accept alternate / custom 'primary' email addresses. It's definitely a chicken-and-egg problem though, and far from guaranteed that it would be resolved happily. And I'm in complete agreement on the marketing, and it's a problem for this setup - the system is young though, maybe this can be changed.

Though honestly I suspect browserid would encourage this _anyway_ , since people _are_ likely to use their primary email address, and they _are_ likely to change to a different address in the future. If sites want to keep people through such a change, they'll want to allow changing it (since I doubt I'm alone in resenting sites that require me to maintain an address I don't use. resentment isn't good for retention).

<comment><USER27> Found out that Persona team do encourage this: [https://developer.mozilla.org/en- US/docs/Persona/The_impleme...](https://developer.mozilla.org/en- US/docs/Persona/The_implementor_s_guide)

Personally, I wouldn't call email addresses identities, and just say they're credentials. But Mozilla clearly has another idea on what the identity is.

</comment></comment></comment></comment></comment></comment></comment><comment><USER29> I do see the huge potential benefits of the system but have a couple of concerns.

I'm concerned that a 'one password' for everything can be more of a liability if your password is stolen/lost and make phishing potentially more lucrative.

Also concerned about a centralised password store - people make mistakes and if there was some DB leak/hack it could be damaging as it would not be contained within one system (if I've understood how it all works correctly).

<comment><USER30> Persona should add two-factor authentication.

For that matter, any open-ID or similar technology should add that.

<comment><USER31> Persona is only handling authentication temporarily.

Once email providers start providing their own Identity Providers then the security falls entirely on them.

For instance, once GMail starts being its own authenticator, my two-factor authentication there will kick in.

<comment><USER11> Identity Bridging will eventually get 60-80% of users functionally off of our fallback and onto their provider's native authentication paths, but I do wonder if the Persona fallback support two-factor auth natively for the remaining 20-40% of users.

Thoughts?

</comment></comment></comment></comment><comment><USER32> Sorry crawled up from under a stone here. Asked myself how is this different from OpenID, then I found this (fyi).

[http://identity.mozilla.com/post/7669886219/how-browserid- di...](http://identity.mozilla.com/post/7669886219/how-browserid-differs-from- openid)

</comment><comment><USER33> I haven't been keeping up to date with Persona, but doesn't this open a window for email account breaching? I can picture some malicious websites mocking the "Sign in with persona" process and gaining the email AND associated password for that account without much trouble. Unless I've misunderstood Persona's point and the password is different from the user's email password.

<comment><USER23> Our team has thought a lot about this.

There are a bunch of angles to answer this from.

Short answer (assuming native browser, native webmail provider): The malicious website would have to fake browser chrome and fake the user's webmail login flow.

Long answers: Search through the mailing list and get involved! [https://groups.google.com/forum/?fromgroups#!forum/mozilla.d...](https://groups.google.com/forum/?fromgroups#!forum/mozilla.dev.identity)

<comment> w-ll What if I just want to collect emails and passwords, and with a free cert and a funky domain harvest (email, password)'s? I thought the whole point was to be password less?

Second, I wanted to play a crossword puzzle. I click login and am greeted with a popup window, I put in my email, then it asks for a password (ok whatever). So now I have to go to my email, and it says that I click the link and can go play the puzzle, but then it takes me to some persona account manager thing. I go back to my email, click the link again, this time with an error an no puzzle :(

Whats new here? That you guys plan is to just store logins for people? Do you share my email with the webapp I wanted to use? Seriously, whats new here?

<comment><USER11> Could you try going back to the crossword and trying to log in?

If that doesn't work, it sounds like you hit a bug -- could you file that at <https://github.com/mozilla/browserid/issues>, please?

The password stuff was because your email provider doesn't support Persona's protocol, so it fell back to asking Mozilla to validate your identity with a challenge email (and a password, so you don't have to use a challenge email when you come back next time).

</comment></comment></comment></comment><comment><USER34> Just one privacy question: Imagine If I log in using the same email to Service1 and post some comment. And later, using the same identity I log in to Service2 to post some pictures. Does Service1 and Service2 (imagine the share some data) know that it was the same person?

PS. Good work, it looks quite convincing!

<comment><USER35> They both know it was the validated owner of email@example.com, so if Service1 and Service2 compare their users, they will see the same e-mail address.

</comment></comment><comment><USER36> I like Persona a lot and I would love to implement it on some of my sites, but I wonder how to best describe what it does to the average user. "Sign in with Persona" will probably look just as bad as "Sign in with Facebook"...

<comment><USER23> "Sign in with your Email" is pretty clear.

via <https://developer.mozilla.org/en-US/docs/persona/branding>

<comment><USER36> Ah thanks for that

</comment></comment></comment><comment><USER37> I tried to log in to this site <https://current.trovebox.com/> which was linked on the Persona home page: <http://www.mozilla.org/en-US/persona/>

I tried to use my gmail address and it gave me this: <http://dl.dropbox.com/u/13941904/persona.png> Am I just making up a password for a Persona account and it's using my email address as the user id? I can see how some people would type in their gmail password in by mistake.

<comment><USER38> I found this bit confusing too, but in a different way.

The first time around, I knew I was making up a new password, just not where it would be stored.

Then much later I used a different computer (but firefox sync'ed) and tried logging in to Persona, got asked for a password, and thought "oh, so now I make up a new one because it's a new browser and this is BrowserID? Where is this password stored anyway?"

I'm guessing that password is stored on persona.org, not in my sync profile, but even after reading <http://lloyd.io/how-browserid-works> I still find this one point confusing.

EDIT: I now see that the creation bit has a "verify" field whereas the sign-in bit has only one field, I guess that should have been my hint to use the same password as before. I'm still wondering though how it works when you have several email accounts on one browser, do they all share the same password? Does persona.org know that I have all those email addresses?

</comment></comment><comment><USER39> Congratulations to the team, keep up the great work!

</comment><comment><USER40> Would Google ever allow this work with Gmail? Since they are trying to get sites to adopt the "sign in with google" option I'm curious if they would get behind this initiative.

<comment><USER18> You should tell them you'd like them to :)

</comment></comment><comment><USER41> I clicked on the first link, in the announcement of one of their adopters "The Eclipse Foundation" (actually their Orion project: <https://orionhub.org/>), to see what the sign in flow was like. I already had a Persona account from the early announcements but wanted to see it on a real site.

The experience was bad. I signed in with Persona on Orion to be greeted with "There is no Orion account associated with your Persona email. Please register or contact your system administrator for assistance." Isn't the whole point that I don't need to register?

I clicked the register button to see what more it would require and they wanted a user name, password, and email. With such a poor integration the whole idea of not having to remember another, username and password is lost isn't it? Obviously this particular failure is the fault of the integrating site and not Persona which seems really cool.

Screen shot after logging in with Persona; then after clicking register: <http://imgur.com/a/WCKnh>

<comment><USER11> Thanks for beinging that up. The specific implementation at OrionHub is Not Ideal -- they should kickstart account creation when you sign in with Persona, like at <https://voo.st> or <http://sloblog.io>

I'll reach out to the folks over there and see if that can get that fixed in their next release.

</comment></comment><comment><USER42> I don't like Persona, personally. Email is not an identity. When we connect with email and passwords, both fields are keys (in the open-the-door metaphor). To make the password a secret key, we can't check it for uniqueness so we need a less secret key that will be checked for uniqueness. I think it's important that users can easily modify both keys without loosing their identity.

</comment><comment><USER43> Does this work yet with Chrome on iOS? The last persona enabled web site I tried, simply threw an error when using the Chrome app.

EDIT: Here is a link to the progress on this issue, it was moved to the next beta <https://github.com/mozilla/browserid/issues/2034>

<comment><USER31> Here's the list of supported browsers: [https://developer.mozilla.org/en- US/docs/Persona/Browser_com...](https://developer.mozilla.org/en- US/docs/Persona/Browser_compatibility)

</comment></comment><comment><USER44> >> type in email, login to yahoo...

Wait. So, my email provider (Yahoo) can now keep track of _every_ website I login to, if he wants? How can I stop Yahoo being the middleman?

Second question, if an attacker knows my Yahoo password, can he potentially login to _all_ Persona-powered websites with my email then?

<comment><USER18> No, because Persona mediates, and Yahoo only knows that you're using your Yahoo identity with Persona, nothing more. That's a key privacy property of Persona.

However, if you use the "login with Yahoo" button (or Google or Facebook), then yes, they _can_ track all of your activity.

To your second point: great question! No, the attacker cannot. We still protect your other email addresses with a Persona password.

<comment><USER45> > Yahoo only knows that you're using your Yahoo identity with Persona

But Yahoo still knows that I'm on that website.

<comment><USER23> How?

</comment></comment></comment></comment><comment><USER46> So I can log in everywhere using the exact same username? This will make it SO much easier for the user data trackers to capture and aggregate all of the information they can about me. I think I'll take a pass.

<comment><USER23> You can choose any email address you control. Persona doesn't force you to use one identity.

Sites that use Facebook connect on the other hand...

<comment><USER47> Nowadays you can't get a gmail account without verifying using a phone number...

<comment><USER38> Good thing email != gmail, then.

</comment></comment></comment></comment><comment><USER48> If anyone's curious about using PHP and jQuery to integrate it into their sites, check out this article I wrote up: [http://websec.io/2012/10/01/Using- Mozilla-Persona-with-PHP-j...](http://websec.io/2012/10/01/Using-Mozilla- Persona-with-PHP-jQuery.html)

It's got curl and streams examples so it should cover 95% of the PHP installs out there. Its crazy how easy it is to drop in and implement...Mozilla's done a great job with it so far. I look forward to more integration of it in the future.

</comment><comment><USER49> The login on the Persona site (<https://login.persona.org/signin>) doesn't seem to work for me, using my Yahoo account. It pops up the Window, I login to Yahoo, that little window goes away, then ... nothing else happens. If I click "verify" again, the little window pops up momentarily and then just goes away. Is it supposed to actually do something, or was that the whole demonstration?

<comment><USER11> I've filed a new bug for this: <https://github.com/mozilla/browserid/issues/3225> Could you please chime in with your browser, version and OS over there?

</comment></comment><comment><USER50> When it works with Gmail, then the world gets better.

<comment><USER11> Though we might need a month or two to get a few last details ironed out, an identity bridge for Gmail is absolutely coming soon. Until then, we wanted to soft launch with a single bridge (Yahoo) before throwing the switch for everyone.

</comment></comment><comment><USER51> Oh neat, it seems my current Firefox (20) works with Persona now when third party cookies are disabled. This was a huge problem before when I was playing around with it a few months ago (it would flat-out never properly authenticate when I was testing it before). Didn't think the new cookie policy would roll out of testing so quickly.

</comment><comment><USER52> So, openid by firefox is called persona? I would like to use google, twitter. What are the special features of this? I don't think anybody would like to use firefox OS. But it's good, but it has a heavy competition in the future.

<comment><USER53> 1\. Privacy: the identity provider can't tell what site you are logging in to.

2\. It's decentralized: any email provider can provide Persona authentication for the email addresses that it handles. You don't have to rely on Mozilla to do this except as a fallback for email providers who don't support Persona.

</comment></comment><comment><USER54> Sometimes I create accounts with email address like firstname.lastname@example.com. It is handy for filtering emails from thissite later.

Will this great feature of email (SMTP?) be available to me with Persona? I mean email address synonyms.

<comment><USER38> I already have three such aliases in my Persona account. I'd say Persona makes it easier to use the email@example.com method. Of course, if you add a hundred such, you'll get a very long list to click through when you log in …

</comment></comment><comment><USER55> The concept of putting <script src=> on my login page skeevs me out more than a little bit. This is a major security hole that won't be patched until there is native support in the browser.

<comment><USER18> or until we give you a library you can audit and host yourself, which we're working on.

</comment></comment><comment><USER56> > Ting, Tucows's mobile phone service

Off-topic, but wow. Blast from the past. Tucows is still around, and now has a mobile phone service! That was my go-to place for shareware games when I was a youngin'.

</comment><comment><USER57> Any plans to build this into Firefox? I could definetely see this as some kind of account to sync our Firefox, better browser integration.

IIRC Firefox had a plan for BrowserID something along these lines.

<comment><USER11> Yep! The Persona implementation of BrowserID is already built into FirefoxOS. It should come to Desktop Firefox later this year.

</comment></comment><comment><USER58> I'm confused - What is the difference between this and sites that let me login with my Google account?

<comment><USER11> Persona works with any email address, so the major difference is that you can get the "Sign in with Google" experience, with just one button, but without being forced to choose (and phone home to) Google.

</comment></comment><comment> robert-wallis Why promote Yahoo!'s email service? They still don't use SSL after you are logged in right? Sending your plaintext session cookie over the net, allowing people in your coffee shop to hijack your email. Nobody should be encouraging people to keep or get Yahoo email accounts.

<comment> robert-wallis Just checked, you can now enable SSL, but by default it is not enabled. No doubt most people don't have it on. Therefore, Yahoo is still an insecure email service.

</comment></comment><comment><USER59> Wow, I thought Personas were just stupid themes for Firefox, but this is actually pretty interesting.

</comment><comment><USER60> can somebody explain to me why this is so much better than openid ?

<comment><USER11> There are a plethora of links elsewhere in this thread answering that exact question, but in brief, the developer experience, user experience, and privacy model are all dramatically better.

</comment></comment><comment><USER61> Please, guys, change the pastel orange background of the blog to something a bit more serious. It gives wrong first impression and starts things off the wrong foot.

<comment><USER62> Blue or grey may be better suited to you? <https://developer.mozilla.org/en- US/docs/persona/branding>

<comment><USER61> I was referring to #FFFBED of the blog background.

</comment></comment></comment><comment><USER63> Why are they shitting on social sign-in when this works the exact same way, but with email providers? You still need a pop-up that takes you to several domains and makes you click Yahoo's "Accept" button.

I can see the confidence people might get from the added layer of Persona talking to the external service as opposed to the website that you've never been to before (given the Persona brand builds lots of trust), but the UX is still just as clunky and awkward.

<comment><USER23> Directly from the article:

Julius Schorzman of DailyCred, the instant CRM package for any web site, implemented Persona and remarked "We've seen from our internal metrics that more than 70% of users still prefer email and password authentication over social log-in like Facebook. Implementing Persona is actually easier than Facebook Connect, or any OAuth implementation we've seen."

People want control over their identity on the web. Social sign-in doesn't meet this need.

<comment><USER64> I'm personally not a big fan of social sign in, and i doubt i'm going to use persona (at this time).

Persona seems like to me kinda like what the chinese are doing with requiring people to use .gov ids on the web. Sure in china it will be by force and here it will be opt in, but in my eyes the result will be the same: making it easier to track people across the web.

I don't feel like persona solves the ability for a person to have control over their identity on the web any more than people do now, maybe just offer the same utility of social logins without trusting 3rd party(?).

Are all persona users data stored in a central location (besides websites that have multiple users sign up through persona?)

<comment><USER65> As I understand it, there's nothing to stop you using a separate Persona ID for each site you visit, and none of your IDs has to be tied to your real life identity. But most people already give the same username and same e-mail on loads of different websites, so we're happy to carry on doing that.

For now, most Persona users are stored in a central location by Mozilla. The idea is that e-mail providers take over authenticating users, so eventually there should only be a few users that Mozilla stores credentials for. I'm hoping that GMail will add support soon.

<comment><USER64> Hmm, I can see how this would be better than using facebook connect for the risk adverse (though I must question that if one is using something like facebook connect or google whatever in the first place).

But most web users aren't risk adverse, and I question the utility this will have over facebook connect when using it in some kind of application that the user wants to use that requires some kind of social data in order to get the most out of the app.</comment></comment></comment></comment></comment>


Bitcoin Is Less Secure Than Most People Think - <AUTHOR> https://marginalrevolution.com/marginalrevolution/2019/01/bitcoin-much-less-secure-people-think.html <comment><USER2> The title is clickbait trash, but the actual point in the blogpost is actually really good. So I feel like this deserves at least some discussion.

Proposed Alternative Title: "Proof of Work 51% attacks are far cheaper than most people think"

General point: When a BTC Miner creates a 51% attack, they get rewarded the block. Which means they get the 12.5 BTC (or whatever coin) associated with the blockchain.

In effect, the rewards of the 51% attack are not only the double-spends, but also every coin that is associated in the blockchain. Mining rewards are therefore, granted to the double-spend attacker.

To but it into more concrete terms. If a 51% attacker were to attack Bitcoin after 1-week (1008 blocks), then the 51% attacker not only gets to double- spend everything over the week... but the attacker ALSO gains at least 1009 blocks worth of reward from the blockchain (At $3500 / BTC, that's $3,531,500).

\</comment><comment>----

Once you account for the BTC that is mined by the 51% attacker, the effective profit margin of a 51% attack is far easier than what people seem to expect.

<comment><USER3> The mining reward is a special transaction in the newly mined block called the coinbase transaction. It's a transaction with no inputs, only one output pointing to an address of the miner.

Bitcoin does not allow these kind of transactions to be used as input for another transaction unless a certain number of confirmations has passed.

Currently this is set to 100 ([https://github.com/bitcoin/bitcoin/blob/1d9d314573ee48f6f511...](https://github.com/bitcoin/bitcoin/blob/1d9d314573ee48f6f51107265f1cf1fa9e36c998/src/consensus/consensus.h#L14))

So roughly 1000 minutes need to have passed before the network will accept a transaction with a mining reward as input.

<comment><USER2> Thanks for the additional technical details. But I don't think it changes anything.

> Bitcoin does not allow these kind of transactions to be used as input for > another transaction unless a certain number of confirmations has passed.

This means that in the hypothetical attack case, where 1008 blocks are replaced by 1009 blocks by the 51% attacker... then 909 x 12.5 BTC are immediately usable. While the last 100 x 12.5 BTC will be usable in 1000 minutes later.

In either case, the 51% attacker mines blocks faster than literally everyone else combined. So there's no period where of waiting that is safe against a 51% attacker.

The 51% attack is the end-all-be-all of a coin. If it happens, the coin is hopelessly lost. The entire cryptographical nature of the coin depends on the 51% attack remaining infeasible.

\</comment></comment></comment><comment>----

In any case, the 51% attacker's 1009 blocks is longer than the 1008 "honest blockchain". So the honest miners (by default) will mine the 1009-long blockchain after the 51% attack.

So the 51% attacker's coins are safe and will be spendable in short order. Perhaps the 49% honest miners can "blacklist" his coins, but with 51% of the hashrate, the 51% attacker can always legitimize his own coins by using his own 51% hardware (since he can build blocks faster than everyone else).

</comment><comment><USER4> Isn't Nano far better in terms of "One CPU- One vote"? The transactions are voted on by nodes, which are free/cheap to run.

<comment><USER5> That's also a problem, though, because an attacker just needs a large number of nodes to effectively control the currency, which is not challenging or necessarily costly (see: Mirai). Doesn't stop the hardware race that leads to centralization.

If the incentives promoted by cryptocurrencies inevitably lead to centralization, what's their benefit over the existing financial system?

</comment></comment><comment><USER6> I can't debate any specific point in this article. It seems well written and researched to me.

Here's what doesn't add up to me. If it's actually possible why hasn't it happened? It seems like there is all the monetary incentive in the world to get it done. It feels to me like the fact that it hasn't happened supports the idea that it isn't economically viable under the current conditions</comment>


Debian 9.2 released - <AUTHOR> https://www.debian.org/News/2017/20171007 <comment><USER2> When I run linux on servers, I always choose Debian. It is the best distro IMO. Glad to see that the project is still going as strong as ever!

<comment><USER3> As someone who has been choosing CentOS for the same purpose, what would be some reasons for me to switch off the top of your head?

<comment><USER4> I have a debian install that I've installed in 2001. It's clean, fully up to date and has never been reinstalled. It's not necessary. It had apache1 before, it had the old exim before, it had all kind of old packages and was gradually updated over the years. True, something like 'etckeeper' is a great boon these days.

Still, that's what I call a server distro ;-)

<comment><USER5> And yet, here I am running it on my laptop! :D

Debian is a great, stable distro. Even Sid, the unstable, rolling branch sees little breakage overall. Sane defaults, package maintainers who care about the minor rendering bugs in obscure packages and make the effort to patch said bugs. I'm continually impressed by the fit & finish of Debian, especially in context of how deep the Debian Archive is, with 68 thousand software packages in total.

<comment><USER4> Oh sure I also run it everywhere else -- sid on my workstation, 'testing' on my home server and laptop etc. It does cover pretty much all the bases!

But, the 'stable' server is rather amazing. I (used to) get into rpm-hell with centos/redhat in a matter of weeks. Even ubuntu will break stuff more often than not when crossgrading from 'major' versions.

</comment></comment></comment></comment></comment><comment><USER6> On a tangential note, I don't like how I get served the German version of the site with no obvious way to get the "canonical" one. And then I hate realizing how hard it is to combine support of multiple languages and still making everything transparent and accessible.

And also, what a huge effort it is to translate pages to different languages while (I think) almost everyone wants to read the English version.

<comment><USER7> This is determined by the settings in your browser. If you don't like getting German version as default, then change your browser config.

Not only you have links to different languages in the bottom of the site, you can even find a link to document describing how the standards works and how to change the settings in bunch of different browsers: [https://www.debian.org/intro/cn](https://www.debian.org/intro/cn)

<comment><USER8> And yet, a bunch of sites including Google don't give a rat's arse about the accept-language http header and do their own thing.

Wherever I travel, I get search results served in that language even though I have my browser consistently configured to want English.

<comment><USER7> I agree that in general the support might be better, but for me Google works as expected at least in my current location (Czech Republic).

If I set preferred language to Czech I get search form in Czech. After changing settings to English I get English search form (with link to the Czech version underneath the search bar). Just for fun I have also tried Dutch and it seems to work as well (there are some foreign words, but I don't speak Dutch so it might as well be Klingon).

Tested in Firefox and in newly opened private Window, so logon / previous sessions wouldn't affect the results.

</comment></comment></comment></comment><comment><USER9> A curious fact is that Debian name their releases after Toy Story characters.

Debian experimental is permanently named "sid" (the kid that breaks toys) and "stretch" (Debian 9) is a rubber octopus from Toy Story 3.

[https://www.debian.org/doc/manuals/project-history/ch- releas...](https://www.debian.org/doc/manuals/project-history/ch- releases.en.html)

[https://wiki.debian.org/DebianUnstable#Which_Toy_Story_chara...](https://wiki.debian.org/DebianUnstable#Which_Toy_Story_character_is_Sid.3F)

Other curious fact about Debian, is that there are 2 logos: the open use one, and the restricted use one. The restricted use one is a less known and includes a bottle.

<comment><USER10> I always like to point out the other two logos[1][2] that prefaced the buzz lightyears chin logo[3].

[1][http://ianmurdock.debian.net/index.html%3Fp=1880.html](http://ianmurdock.debian.net/index.html%3Fp=1880.html)

[2]see "old logo" at [https://www.debian.org/vote/1999](https://www.debian.org/vote/1999)

[3][https://images-na.ssl-images- amazon.com/images/I/81x4CGvFvNL...](https://images-na.ssl-images- amazon.com/images/I/81x4CGvFvNL._SL1500_.jpg/vote_0004)

<comment><USER11> I get an error for image 3 - what is the logo?

<comment><USER10> Sorry, its not really the logo, i was kidding with the fact that the current logo looks like buzzlightyear's chin.

<comment><USER11> Ahhhhhh I never noticed the swirl on Buzz' chin before!

</comment></comment></comment></comment></comment><comment><USER12> I wish Debian would adopt Ubuntu-like versioning number: "yy.mm". So easy to understand. Another good example is TeXLive, which simply uses "yyyy". Much better.

<comment><USER13> Ubuntu has made the commitment for 6-month releases, so that makes sense for them. Debian releases "are ready when they're ready", so they can't predict the month (or even the year) ahead of time, and the version number is needed well before the release is made official.

<comment><USER14> ...and the version number is needed well before the release is made official.

Ubuntu developer here. No, the version number is not needed before the release. All our infrastructure only uses the codename until release, since the final version name is not known for certain in advance.

For example, Ubuntu 6.06 LTS (Dapper Drake) was released late.

</comment></comment></comment><comment><USER15> Does Debian have the same support for AWS eccentricities that Ubuntu now does?

<comment><USER16> Can you elaborate?

<comment><USER15> Up until March of this year, the Ubuntu kernel was not tuned for AWS. This included not having support for Elastic Network Adapter, which limited network speeds when compared to Amazon Linux.

See here: [https://insights.ubuntu.com/2017/04/05/ubuntu-on-aws-gets- se...](https://insights.ubuntu.com/2017/04/05/ubuntu-on-aws-gets-serious- performance-boost-with-aws-tuned-kernel/)

</comment></comment></comment><comment><USER17> I have the impression that Jessie came out recently. Is time speeding up?

Meanwhile I'm happy on CentOS 7 since many years now.

<comment><USER18> > _Is time speeding up?_

I ask myself that every day, certainly seems like it getting older ;-)

On a more serious note: It's great that Linux is now sufficiently mature that even a 3 year old release is perfectly adequate and can do pretty much whatever you need. Maybe I'm misremembering here, but it didn't always used to be like that.

</comment></comment><comment><USER19> Will it work on AMD promontory chipsets?

</comment><comment><USER20> Time to upgrade my laptop</comment>


Caffeine boosts problem-solving ability but not creativity, study indicates - <AUTHOR> https://news.uark.edu/articles/52447/caffeine-boosts-problem-solving-ability-but-not-creativity-study-indicates <comment><USER2> Thank you for linking to the paper.

The study measures the effects of regular caffeine users:

> Participants were invited to participate if they were between 18-35 years of > age, consumed between 1-2 cups of caffeinated beverages per day at least 5 > days a week, did not smoke, were native English speakers, and took no > psychiatric medications or painkillers on a regular basis. > [...] > > Participants were asked to abstain from any caffeinated or alcoholic > beverages from 4 pm on the day prior to the session.

I recently listened to Michael Pollan's _Caffeine_ [0], which was on Audible's free monthly audiobook list recently. He argues (and I'm inclined to agree) that if you are a daily caffeine consumer, your daily cup of coffee does less in the way of cognitive enhancement, and more in the way of getting you back to your baseline (i.e. preventing caffeine withdrawal).

With this in mind, I think the study could be improved by having subjects who started off completely off caffeine for a few weeks. That way, we'd be more certain that the control group isn't going through caffeine withdrawal, and that the effect of caffeine isn't decreased by tolerance.

[0] [https://www.audible.com/pd/Caffeine- Audiobook/B083MVZ91Y](https://www.audible.com/pd/Caffeine- Audiobook/B083MVZ91Y) [1] [https://news.ycombinator.com/item?id=22503948](https://news.ycombinator.com/item?id=22503948)

<comment> salt-licker Yep, I almost never drink coffee more than 3 days in a row because it loses its affect. Luckily, intolerance comes back after only a day or two off.

<comment><USER3> I'll risk being downvoted for nitpicking in an attempt to be helpful about "affect" vs "effect":

Did it affect you? Yes, it had an effect.

The psych study showed the meds were effective in improving patents' affect (mood).

I want to effect (bring about) change by doing X.

HTH!

<comment><USER4> It really is a pain in the butt since both effect and affect have noun and verb forms. What a language.

<comment><USER5> I had a couple of teachers who were ridiculous sticklers about this in highschool. My hack is remembering the two phrases Affect _A_ change vs cause and effect.

</comment></comment></comment></comment></comment><comment><USER6> Ha, if true that would confirm Balzac's claim:

> Coffee is a great power in my life; I have observed its effects on an epic > scale. Coffee roasts your insides. Many people claim coffee inspires them, > _but, as everybody knows, coffee only makes boring people even more boring._

From "The Pleasures and Pains of Coffee, 1830, [http://blissbat.net/balzac.html](http://blissbat.net/balzac.html)

<comment><USER7> "The 200mg enhanced problem solving significantly, but had no effect on creative thinking," said Zabelina. "It also didn't make it worse, so keep drinking your coffee; it won't interfere with these abilities."

So not really I guess

<comment><USER8> You are missing Balzac's point. He is saying that it makes boring people more productive; not more interesting.

</comment></comment></comment><comment><USER9> At Game Jams I would always start things off with my "2 beers, 2 coffees" method. After the theme was announced, we'd go out and discuss ideas over a few beers (just not enough to get trashed), then, come back, flesh stuff out, get our coffee and go back to work. Worked out pretty well for generating some pretty wild ideas while not making ourselves disfunctional.

Drink responsibly.

<comment><USER10> Write drunk, edit buzzed, then?

<comment><USER11> Beer code tends to forget about edge cases in my experience, so yeah

<comment><USER12> My weed code is usually really creative but riddled with bugs

<comment><USER13> Does it help with solving hard problems ?

<comment><USER14> Personally, weed might help in the creative phase of problem solving, but if it requires working memory weed is a big negative(at least how it affects me)

<comment><USER15> I think including some CBD in there negates the memory issues.

</comment></comment></comment></comment></comment></comment></comment><comment><USER16> I own a coffee roaster with eshop and over 100 corporate customers. I love coffee.

At the same time, I believe none of the "studies" claiming health benefits of it.

One only has to study what it does to your brain to make a sound conclusion. (or read some of those studies and look at the bogus methods they often use)

It also affects sleep in a negative way, with poor sleep being at the root of most health problems including cancer ... (lookup stuff on sleep by Matthew Walker)

Likewise, I don't know what to think of all the "coffee is good for your heart" studies that surfaced in the past decade. It used to be that coffee was clearly bad for cardiovascular health then with the rise of Starbucks and global markets it became huge business and suddenly studies making ridiculous claims (like "10 cups of coffee a day is fine, science says") started to appear.

I can't see how something that unnaturally raises your adrenaline, cortisol and blood pressure (on daily basis for most) can be that great for your heart.

Finally, most people drink coffee on empty stomach, something that can easily lead to ulcers or even worse. Caffeine irritates it and high acid doesn't help either (reason why we add milk to coffee - it neutralises the acid) ... I find the rise of the hipster coffee brands pushing highly acidic brewing and roasting methods problematic.

But the fact is, nobody is telling you the full truth. Take top 1000 google results for coffee, it's 90% sellers, affiliates and journalists. People either make money from coffee or are addicted to it.

I love coffee myself, but I don't believe none of the proclaimed benefits. I consider caffeine a stimulant ... it's good to stay off it and use it's power selectively ... at the right time for the right kind if work, not mindlessly every morning.

Finally, I appreciate the cultural aspect ... like hanging out in Viennese style cafe, read something or engage in 'stimulating' conversations.

<comment><USER17> I always daydreamed about roasting and selling coffee online as some kind of side-hustle. Would you mind commenting a bit about your daily life, the amount of time spent / money earned? My oven roasts were quite tasty so far, and I'm not sure what's hindering me from scaling up..

<comment><USER16> I'm happy to share everything, but short on time to write everything down ... if you like drop me an email on hello () quantitup.com with your Telegram or whatsapp profile or similar where I can send a voice message

</comment></comment></comment><comment><USER18> Ah, the classic confusion between not finding enough evidence to disprove the null hypothesis, and finding enough evidence to prove the null hypothesis.

The caffeinated group outperformed the noncaffeinated on all 5 creativity metrics. The sample size and effect size were too small to prove caffeine caused an improvement.

How did that turn into this title?

<comment><USER19> Right. These results could equally well be interpreted as caffeine have the same effect on both convergent and divergent thinking, but divergent thinking (renamed "creativity" in the title) is harder to measure because it has more variance. If anything, it provides mild evidence _in favor_ of the hypothesis that caffeine improves divergent thinking and calls for further study with a larger control group.

</comment></comment><comment><USER20> As a graphic designer my advice for people looking to convert a stimulant into divergent thinking fuel is building yourself a framework for developing creative ideas. Not exactly rocket science, but I do see where this article is coming from.

Lots of thumbnail drawings and constructive criticism from a teammate is the meat of it.

Also... be naturally good at divergent thinking I guess? I love working with people who are naturally divergent. They tell the funniest jokes.

<comment><USER21> Sure, and if you find yourself getting stage fright, you can use something like Brian Eno's Oblique Strategies.

</comment></comment><comment><USER22> Erdos[0] certainly felt his creativity was helped by caffeine (and amphetamines). From personal experience, math professors seem to be the most reliable academic users of nicotine and caffeine. I'm skeptical they are all deluding themselves.

[0]: [https://en.wikipedia.org/wiki/Paul_Erd%C5%91s](https://en.wikipedia.org/wiki/Paul_Erd%C5%91s)

<comment><USER23> From my experience, amphetamines make the crazy ideas you've had all along feel actionable. You then put a lot of work on them and they produce fruits. Then you get off amphetamines and you're amazed at how much you accomplished. I still go back to some projects that I did while on Adderall and am in awe of how much I accomplished in a few months on my own, and how many of my ideas that I had simmered in my head for decades were doable once I sat down and worked on them.

However, after months of amphetamines I felt like I was a workhorse with no novel ideas or approaches, but still very efficient.

I've heard that mathematicians carry a well-tested mental toolset that enable them to solve all kinds of problems. So, perhaps if you have the right toolset and you just need to put work on an problem, amphetamines can work great.

<comment><USER24> I like how you put that "the crazy ideas you've had all along feel actionable". This is the only way I can write anything- with caffeine all the crazy ideas in my head seem worth expressing.

</comment></comment></comment><comment><USER25> I think focusing your mind is like focusing a magnifying glass, you can go broad, or narrow, but not both. How far do you go down a path till you switch and try another? I think stimulants increase how far you'll remain engaged on one idea. Related: [https://en.wikipedia.org/wiki/Pathfinding](https://en.wikipedia.org/wiki/Pathfinding)

</comment><comment><USER26> The paper in question: [https://citationsy.com/archives/q?doi=10.1016/j.concog.2020....](https://citationsy.com/archives/q?doi=10.1016/j.concog.2020.102899)

<comment><USER27> It's a pretty poor study, to be honest. The pattern I tend to see on Hacker News with studies is that they go unread beyond the abstract (often not even that when a press release is linked, like here) and people just chime in with their anecdotes that confirm their own personal beliefs.

<comment><USER28> At least they read the abstract!

I can't really determine what the right cost/benefit trade-off here. Reading beyond the abstract is rather time consuming and is not something I can afford for every paper.

</comment></comment></comment><comment><USER29> So do the ADHD meds I take; huge gains in problem solving and execution, not so much in the creativity front. I wonder if this is a general psychological feature of stimulants

<comment><USER30> I still remember one of the funniest lines from the old movie "Dead Man On Campus":

"This is my brothers Ritalin, It's great for staying up and studying just don't try to write an English paper on it"

<comment><USER31> Fortunately, delirium sets in during an all-nighter and you can get creativity from that.

Not that you should strive for that scenario though.

</comment></comment></comment><comment><USER32> On a side note, I really enjoy the taste of coffee. I try not to drink more than one cup a day, but I wonder now about what would happen if I stopped cold turkey.

Maybe a couple days reset wouldn't be such a bad thing.

<comment><USER33> I usually take coffee tolerance breaks, 3 days withdrawal symptoms like headache and 20 days coffee-free, when I come back, it hits better than if I were stayed so it is rewarding.

<comment><USER34> I used to do this too. You know instead of cold-turkey with withdrawal symptoms you can just gradually lower your intake.

On the first day or of the break I'll just drink half the amount I normally drink. Then by day 2 I'll drink a third. Probably nicer to ease into it.

</comment></comment></comment><comment><USER35> For me, caffeine is "focus juice". Makes it possible to care about solving tedious work problems. I can see how the same would apply to writers and artists, who have tons of creative ideas but have a harder time battling through the "war of art" without a little help from our friend Coffea arabica.

Creativity tends to flow best standing in the shower, lying in bed, or out for a run or a bike ride.

<comment><USER36> Creativity can really only happen when the mind isn't doing anything in particular. Only then can it wander, and only in wandering can it arrive at novel combinations or alterations of ideas.

</comment></comment><comment><USER37> Psychedelics, and maybe weed, boost creativity. So which class of compound depends if you're writing a novel or painting an album cover, or writing code or solving NP =?= P.

Btw, caffeine is an anticholinergic; too many or too much of this class of compounds leads to dementia and other permanent problems. Anecdotal example: ex-stepfather abused diphenhydramine, had a personality change and acted erratically... he eventually gave up, left my semi-disabled mom without any notice, just an email.

[https://www.healthline.com/health/anticholinergics](https://www.healthline.com/health/anticholinergics)

<comment><USER38> Let's not compare apples and oranges. Caffeine has been studied much more than diphenhydramine, and diphenhydramine's senility-inducing behavior is now pretty strongly documented while there's absolutely no such indication of the same for caffeine.

</comment></comment><comment><USER39> I wonder how they establish a control group. Most people regularly consume caffeine, so this is most likely measuring the effects of caffeine withdrawal, since the control isn't necessarily people who never consume caffeine. I guess you could test on Mormons for this.

</comment><comment><USER40> Someone oughta research the differences between coffee and other caffeinated drinks. My experience says that there are huge differences there.

<comment><USER41> It's the different caffeine dose plus all the other chemicals. L-theanine in green tea, for example. I think I've seen some research on the difference between green tea and coffee somewhere.

<comment><USER40> Sure, but the effects of coffee against the digestive system are entirely different from tea. That supposedly has some psychological effects.

<comment><USER41> Oh good point.

</comment></comment></comment></comment><comment><USER42> What boosts creativity?

I sometimes used alcohol for song writing purposes. Are there healthier methods?

<comment> 52-6F-62 Some writer and artists would use the following:

Hold a key in one of your hands and hang your hand down by your side while you let yourself fall asleep while sitting in a chair (honestly this first part sounds the most difficult).

When you fall asleep—or rather the trance-like borderlands between awake and sleep— you should naturally drop the key (or whatever metallic, noise-making object) which should spring you back awake retaining some of that state you just fell into, or any insights sprung into mind during that state.

I'm sure everyone's had mornings where they woke up after dreaming but without feeling quite awake—it's related to that feeling that they'd chase.

Maybe someone has a link on hand to a better write-up about it. I don't.

<comment><USER43> Didn't Benjamin Franklin sleep at his desk with a stick propped under his elbow, so when the stick fell out he would invent stuff? I remember hearing that somewhere but now I can't find it

<comment><USER44> Maybe but IIRC Tesla would hold a ball in his hand before dozing and dropping.

</comment></comment></comment></comment><comment><USER45> Looking at Table 3, it seems like there is a consistent improvement in divergent problem solving, but it's well within the standard deviation for each row. So it may actually help with that and we just need many more data points.

The other thing is, for me caffeine results in more ideas bubbling out of my subconscious. This can be great for brainstorming-type creativity or getting unstuck while working on a creative project - but it's like operations research where you're solving the problem by adding another variable. It's not useful for more specific, constrained problems like the "divergent" tasks in the paper.

</comment><comment><USER46> I would have thought that problem solving abilities necessitated creativity?

If the solution was obvious, where's the problem?

<comment><USER47> Anecdotally, I was recently cramming a lot of "Leetcode medium" questions to prepare for job interviews, and after a couple of weeks, I was drinking Starbuck's coffee and solving those problems like a machine... seriously, _like a machine_.

I found I did get better (or at least much faster) at recognizing subproblems and quickly composing an overall solution, even if none of the steps was particularly creative.

After about 3 weeks I had to ditch the coffee, I was getting too addled.

(Not a controlled experiment, of course, just conveying my impression of the experience).

<comment><USER48> Another anecdote, but when prepping for any sort of competition I used to be a hard-core caffeine consumer (measurable in grams, instead of mg) and it sometimes led to some weird effects.

After a day or two of that level of caffeine intake, I go into an almost trance of productivity and performance. It feels like I'm watching myself do what I need to do, not that I have to 'do it' myself. It's a very strange sensation. It's the same sensation I get when I'm 'in the zone' and competing in something with 100% of my focus on it (emotionally engaged, you might say).

I don't get into that state anywhere close to as easy without caffeine. I've been off caffeine for about 4-5 months now and I've noticed a change. My productivity isn't _worse_ in any measurable way, but it _feels_ different. I wish I could describe it in more relatable terms but I have nothing I can really relate it to.

<comment><USER49> I know exactly what you mean. My theory is that getting amped up on caffeine keeps you from getting decent sleep, which means your cortisol/whatever hormones are still kinda high when you wake up, so when you take even more caffeine upon awakening, your body seems to move forwards from a different baseline than when you drink coffee after completely resting. This along with the fact that for me personally, being tired makes me more focused in a very one dimensional way, i can be very immersed in what im doing without ever really questioning if what im doing is even worth doing in the first place.

<comment><USER48> I think there's a kind of 'loading' period where your body absorbs caffeine and normalizes into a caffeinated state. I don't know if the sleep cycle has much to do with it though. In my case, I sleep _much_ better after I have caffeine. I've been sleeping poorly for several months now because of my decision to cut it out.

I might be abnormal (people I live and work with certainly think so!), but I basically never feel 'tired.' I go from feeling 100% to "I need to sleep." This has remained true even after I cut out caffeine, so I can't really relate to how you describe working while tired.

<comment><USER49> No kidding huh, sleep better after grams of caffeine? Yea, i guess my experience wouldn't apply to you.

<comment><USER48> Definitely not a healthy habit, but I used to take an energy drink to bed at night because without the caffeine it would take forever to fall asleep. I'd believed it was an addiction, except now I have been 'clean' of caffeine for so long (without any urges to consume it) and still suffer the same difficulty of falling asleep.

</comment></comment></comment></comment></comment></comment></comment><comment><USER50> Excerpts from Balzac's 1839 essay 'Traité des Excitants Modernes'('Treatise on Modern Stimulants')": [https://www.bookofjoe.com/2020/01/experts-expert- honor%C3%A9...](https://www.bookofjoe.com/2020/01/experts-expert- honor%C3%A9-de-balzac-on-how-to-prepare-coffee.html)

</comment><comment><USER51> This is why I drink Irish coffee when I want to solve problems creatively.

</comment><comment><USER52> Caffeine accumulate tiredness continuously. It booms after something small leak happened. It is not "boost" problem solving, but "carry on" from future.

</comment><comment><USER53> I find the headline misleading regarding the effect on creativity. In fact, no effect was found. Hence:

Caffeine boosts problem-solving ability and shows no sign of altered creativity.

</comment><comment><USER54> Of course. Creativity is not a matter of more brain activity, more synapses etc. It comes from elsewhere. One could say we have two brains, the one that is active while we're awake and the one which activates when we sleep and dream. It is known that some painters deliberately entered in a dream like consciousness state, and from there they took the creativity and inspiration to paint out of the box things;

</comment><comment><USER55> How reliable are these double blind studies? How do they know they are guaranteeing that only caffeine is impacting their abilities at that moment? There could be a ton of other factors that could be playing a part here. Can we be sure that x number of users is enough to remove those extraneous factors? These kind of studies feel very odd.

</comment><comment><USER56> Some definitions of these terms are in order, because many aspects of creativity certainly involve problem-solving on a massive scale. 'Inspiration' may not be boosted, but without execution the inspiration isn't realized.

Consider e.g. a concert pianist (interpreting a score) or a visual artist (choosing paint, brushstrokes).

</comment><comment><USER57> I guess I never assumed it did. For me, the experience of caffeine is more or less that it just wakes up my brain. Whatever type of thinking I was already capable of or inclined toward when my brain is engaged, it just enables me to actually do it.

It is nice to have a more scientific basis to back that up, though.

</comment><comment><USER58> Personally, I prefer slowly sipping tea when thinking about _how_ to solve a problem that I haven't figured out yet, and burning through Red Bull when I already know how to do it and it's time to put that solution down in code etc.

</comment><comment><USER50> [https://www.sciencedirect.com/science/article/abs/pii/S10538...](https://www.sciencedirect.com/science/article/abs/pii/S1053810019303435?via%3Dihub)

</comment><comment><USER59> Why would it? It would be like saying caffeine boosts your personality or social skills.

</comment><comment><USER60> Duh. Marijuana AND caffeine!

</comment><comment><USER61> THC boosts creativity but not problem-solving ability, stoner indicates.

</comment><comment><USER62> Then smoke some weed, or eat some 'shrooms with your latte.

That seems to randomize and reorganize your brain cells, that you start to think of weird things that you would've never thought of otherwise.

</comment><comment> bright-augura So caffeine doesn't improve creativity, but it boosts problem-solving and focus. Wouldn't someone who wants to improve their creativity want both of these?

</comment><comment><USER63> How do studies like this purport to quantify creativity?

</comment><comment><USER64> you gotta smoke a joint with your coffee before work too

<comment><USER29> In college we called that the "hippie speedball"

<comment><USER65> We would take adderall to work and study, and then smoke weed at 3am to go to sleep. Very fun but not very effective (for academic success)

</comment></comment></comment><comment><USER66> Weirdly enough, being tired boosts creativity for me

<comment><USER67> For me, its being relaxed but not necessarily tired. I tend to get a second wind after dinner, at a time when there is no pressure just my personal interest, and I'm more creative during that time.

</comment></comment><comment><USER68> Interesting study. I wonder what "enhanced problem solving significantly" means?

Also first time seeing my alma mater on HN :)

</comment><comment><USER69> Stimulants increase focus; it triggers leaning in. Creativity is about de- focusing; leaning back and away.

</comment><comment><USER70> Caffeine combined with L-theanine is supposed to increase focus but I'm not sure about creativity.

</comment><comment><USER71> TIL , use caffeine to solve the problems and weeds to create new ones :)

</comment><comment><USER72> What other common ways are there to improve problem solving or creativity?

<comment><USER73> Marijuana

<comment><USER74> Maybe creativity but at least for me definitely not problem solving. Modafinil on the other hand...

<comment><USER75> >modafinil

Has an interesting side effect of screwing with threshold of movement, particularly finger movement.

I play rhythm games (sifac, llsif, deresute, mirishita...) regularly and tried modafinil. My fingers wouldn't auto-move anymore, and furthermore even if I moved them consciously, it took more effort to do so.

At everything else, it puts caffeine to shame, with no tolerance buildup or withdrawal symptoms.

</comment></comment></comment></comment><comment><USER76> Trying to problem solve my lack of creativity, guess I need more coffee

</comment><comment><USER77> Caffeine: brute force.

</comment><comment><USER78> Why can't problem-solving be a part of creativity?

<comment><USER79> Did you read the article? Convergent vs divergent thinking.

</comment></comment><comment><USER80> Carbs > Caffeine

<comment><USER67> Consuming copious carbs creates correct code.

Though I still prefer caffeine. Hey, why not have both?

</comment></comment><comment><USER81> I agree.</comment>


Moot v1.2: SEO, 14 languages, image posting - <AUTHOR> https://moot.it/blog/release/v1.2.html

<comment><USER2> The last time moot.it appeared on HN: <https://news.ycombinator.com/item?id=5486786>.

</comment><comment><USER3> Is this from the creator of 4chan?

<comment><USER4> creator of redis and node.js are involved.

<https://moot.it/about/>

<comment><USER5> Read that again. They are thanked, nothing more.

<comment><USER4> right</comment></comment></comment></comment>


Visual Studio 2015 RC Now Available - <AUTHOR> http://blogs.msdn.com/b/vcblog/archive/2015/04/29/visual-studio-2015-rc-now-available.aspx

<comment><USER2> TLDR ( VS 2015, .Net 4.6, TFS, ... );

.Net 4.6 -> HTTP/2 support and IIS 10 supports it ( Windows 10)

Milestone for .Net core ( will probably be released here : [https://github.com/dotnet/core](https://github.com/dotnet/core) )

F# 4.0

Build vNext is in private beta, send a mail ( [http://blogs.msdn.com/b/bharry/archive/2015/04/29/visual- stu...](http://blogs.msdn.com/b/bharry/archive/2015/04/29/visual-studio-and- team-foundation-server-at-build-2015.aspx) )

Team Project Rename ( TFS )

Docker Support in Build Deploymenet ( i suppose TFS)

Better agile project management (kanban, ...) -- screenshot: [https://i3-vso.sec.s-msft.com/dynimg/IC795776.png](https://i3-vso.sec.s-msft.com/dynimg/IC795776.png)

For VS 2015 RC itselve, it's mostly an iteration on improving the Visual Studio ( previous version of Visual Studio was CTP 5)

<comment><USER3> I suppose C# 6.0 is worth mentioning :).

<comment><USER2> It isn't released with VS 2015 and stuff... But in that line, i could also mention VB 14 ;)</comment></comment></comment>


Storage is Cheap, Don't Mutate - Copy on Write - <AUTHOR> http://hashbo.posterous.com/storage-is-cheap-dont-mutate-copy-on-write-te <comment><USER3> There's a problem here in going from their specific case to where this may make sense, to the more general case they're trying to make, where it doesn't.

For instance, if you're mapping disk space to memory addresses and have large blocks of data, this would mean that every time you needed to update a single byte, you'd either have to duplicate the entire block (possibly several mega- or giga-bytes) or give up linear access. Yuck. There are a lot of use cases that would absolutely be miserable for.

You can get away with such things a lot further if you're implementing these things at the file-system level.

<comment><USER4> There's a great presentation of these types of issues in the book _Purely Functional Data Structures_ :

<http://www.cs.cmu.edu/~rwh/theses/okasaki.pdf>

<comment><USER5> This is a great read for any programmer, not only those interested in functional programming.

Also related (HN discussion): <http://news.ycombinator.com/item?id=1138979>

And Cris Okasaki's blog: <http://okasaki.blogspot.com/>

</comment></comment></comment><comment><USER4> I'm all for finding ways to avoid locking and using immutable objects is one way to help, but this:

      Remove the mutation part and now you have a version history,
      allowing conflict resolution.

is a little too "hand-wavy" for my tastes. Conflict resolution is not an easier problem than resource contention.

<comment><AUTHOR> Fair point, maybe I should have been clearer (and an edit will be forthcoming). My point is that with a version history it's possible to let the content originator know there is a conflict and allow them to choose which version they wish to go with. This can be as simple as diplaying an icon to show there has been a conflict and giving the choice to keep or revert, showing the other users changes, like most wikis. Or much more complex like in a version control system.

My point is more the negative here, you can't do conflict resolution if you write over the previous state.

Sorry if it was hand wavy, was just a quick Friday afternoon blog :-)

<comment><USER4> Fair enough. I'm on your side about keeping a version history and using immutable data (for some things). Its just that my biggest question when I was reading (as it is any time someone discusses concurrency) is: how does he handle updates to the "same" data? Because, ultimately, you will have state somewhere in your system.

<comment><AUTHOR> So the simple answer is that right now we use a most recent wins strategy because our data is not critical or highly correlated like relational data. For us it's simple to add at a future date UI features to allow wiki style history. Obviously with correlated data it's not so easy :-) and that is, as I believe you were implying, where versioning gets tricky! Of course point still applies about the need to avoid mutation :-)

</comment></comment></comment></comment><comment><USER6> I followed the link at the bottom, and it made me pretty angry. Hashbo is a very neat example of the kind of bullshit I hate in upcoming software products and services.

The only information available before asking for signup is this;

> Hashbo is a simple innovative, new way to communicate, collaborate and > curate.

What the hell is that supposed to mean? Is it a blogging system? Microblogging? A social network? IM? Is it some combination, or a new thing?

People come to a site like this with the question "What is this and _why should I care?_ ". At the end of that (quite nice) animation, I have no idea, and that doesn't make me intrigued and curious, it makes me annoyed and frustrated at not getting a straight answer.

 _Nobody cares about your buzzwords_ , they care about what your site is, and what it can enable them to do that they couldn't do before.

<comment><AUTHOR> Hey Robert

It's not attempting to give intrigue, I just really haven't figured the right copy out yet:) Take a look at some more of my blog articles if you like, they explain at least the general idea of what we're doing. We hope to get everyone on the beta soon.

The problem for me is that it's actually difficult to describe what it does and is better experienced then you can make your own valuation as to whether it suits you or not. Much like when the Internet started, it was easier to show than explain. So while we're just in the early stages of beta I didn't want to prejudice people by giving partial information.

So I'll see if I can get some feedback from early beta testers to find out what words they use to describe it - that may help me get a more unbiased view.

Glad you liked the animation btw., we're (mostly) a one man band in reality, and I'm a techy at that, so any complement towards design is gratefully accepted.

All the best and thanks for the feedback, it's really helpful to know what people think, Neil.

<comment><USER7> Yeah, don't mind the haters. I haven't read the copy from your page - <USER2> from the op, it does look lame. But that's fine. Work on it, make it specific, and pitch concrete benefits.

If you product involves education (new model, etc.), you should be pitching to everyone, counting the mean-time-to-understanding, and relentlessly honing it downwards.

<comment><AUTHOR> Really appreciate the combination of honest and helpful feedback. I will certainly keep doing exactly that :-)

</comment></comment></comment></comment><comment><USER8> Ironic that SQL is mentioned here - I think the idea is close to Multi-version concurrency control, which "real" databases have been doing for years now.

[http://en.wikipedia.org/wiki/Multiversion_concurrency_contro...](http://en.wikipedia.org/wiki/Multiversion_concurrency_control)

<comment><AUTHOR> Absolutely but that is internal to the database and cannot be cached locally. With copy on write semantics being at the application level it means you can cache your data locally and not have to worry about distributed cache invalidation etc.

<comment><USER9> How do your distributed nodes figure out which is the most recent version of a particular object?

<comment><AUTHOR> Hiya, by an index. The index of course isn't cached. This model applies equally well to RDBMS as well as non-RDMS systems. You can index which is the most recent version without losing the benefit of caching the data (and potentially it's de-serialized form within the application). Not suggesting one size fits all, just highlighting a useful strategy.

<comment><USER9> And how do you keep this consistent across different objects? IE object A and object B are updated at the same time, going from generation 1 to generation 2. I am on a remote machine reading from the cache. How can I ensure I don't get a view where I see object A at generation 1 and object B at generation 2?

IE the basic point I am making here is that MVCC does a lot of relatively complicated stuff to handle this for you. I don't disagree that you are gaining a lot of power at your remote nodes to do things that would increase performance, but for 99% of applications I think it a huge amount of work for a small amount of benefit.

<comment><AUTHOR> Hi so I believe you're asking how does CoW solve consistency issues. This seems to be a recurring theme. I suspect and correct me if I'm wrong this comes from the fact we're using a non-RDMS database or is it because our actual caching is by nature distributed. In either case the questions being asked are applicable to all distributed caching, if you need to have an absolute guarantee of consistency (nuclear power plant, large financial transactions) then I would personally avoid using caches anyway and reconcile these relationships in the database anyway. I might add this is not our use case :-)

My experience has been in both high volume financial systems and consumer startups and I personally have found that sometimes ACID behaviour is near essential. Or at least near essential to keep the implementor sane :-) And other times it's just a hinderance. Nothing in my article implied that I'm out to solve all these, interesting cases I hope - rather that a particular pattern which can be implemented in different ways has a set of benefits. For the record Neo4J supports ACID transactions, in case I have inferred otherwise.

What's interesting to me is that in various of the comments I have received seem to extrapolate my article into, I believe an attempt to remove or somehow change the working of RDMS systems. Which I can honestly say has me at a loss, goodness knows what I said to trigger that view. No offence to the commenters I just am uncertain where this came from. What I was discussing originally was a design pattern which I have had recent experience of within the context in my case of persistence.

Again forgive me if I misunderstood but I believe you are talking the internals of your database when you're talking MVCC. This wasn't the problem we're trying to solve. In fact Neo4J is a very high speed transactional database that we're more than happy with.

In fact we're not trying to solve a problem, we needed versioned data so we implemented that, now we're getting lots of benefits including zero cache invalidations which means we have a safe write through cache, which of course can be caching application style representations of the data (i.e. objects). And the various other benefits I mentioned.

I can only state my practical experience here, which is that we do get a massive benefit from being able to arbitrarily cache data without fear of stale data.

But hey horses for courses, enough from me for tonite - a huge pile of code awaits me and a beta needs to get underway - if you'd like to get back to me, please drop a comment on the original article and I will be pinged. Always happy to chat.

Thanks for the discussion!

Neil

</comment></comment></comment></comment></comment></comment><comment><USER10> This is what bugs me about state machines (like <https://github.com/pluginaweek/state_machine>).

Adding a history or audit always seems like a giant hack.

<comment><AUTHOR> Actually a history on a state machine give's you undo functionality a fairly common pattern, no? You have a stack of states instead of a single state. Trouble is though inter-related states isn't it :-) things can get messy if you don't have atomic states.

Actually someone else just pointed me in the direction of Event Sourcing - every pattern has a name somewhere - <http://martinfowler.com/eaaDev/EventSourcing.html>

<comment><USER11> There is a lot of complexity in that Event Sourcing document. The pattern can be simpler: <https://github.com/iriscouch/follow/blob/master/README.md>

</comment></comment></comment><comment><USER12> One of the most versatile ways to have scalability and partition tolerance while also having consistency is having eventual consistency.

And having eventual consistency with MVCC implemented with vector clocks really rocks.

Riak takes Brower's CAP theorem seriously and even lets you configure the values per bucket so that you can get more of C, more of A or more of P.

You don't need to store all the history, just the contentious history. Riak pretty much rocks in the sense that you can add nodes to it and it just works, or take them away and it just works. Just like Dynamo. (Not like Cassandra.)

</comment><comment><USER13> Just thinking out loud: does doing copy on write result in less filesystem fragmentation (assuming the data is not held in RAM)?

<comment><AUTHOR> In theory yes, as it avoids holes in the databases or files used for storage. It's also the semantics of ZFS - <http://en.wikipedia.org/wiki/ZFS>

<comment><USER14> ... and ZFS copy-on-write has been known to cause severe performance degradation for databases. Not to mention that too many SAs keep the default ZFS block size, which is far too large for OLTP databases.</comment></comment></comment>