Strongbox: a secret manager for AWS - <AUTHOR> https://schibsted.github.io/strongbox/ <comment><USER2> why not just use parameter store? [https://aws.amazon.com/ec2/systems- manager/parameter-store/](https://aws.amazon.com/ec2/systems- manager/parameter-store/). Plus: don't use credentials directly, use the assume role feature.

<comment><USER3> Is it possible to use Parameter Store without configuring System Manager for the instances where it's used?

I recently looked into SSM but was put off because the docs[1] suggested that you add the managed AmazonEC2RoleforSSM policy to instances, which among other things give them full read/write access to all S3 buckets. Edit: also discovered by others[2].

[1] [http://docs.aws.amazon.com/systems- manager/latest/userguide/...](http://docs.aws.amazon.com/systems- manager/latest/userguide/systems-manager-access.html)

[2] [http://www.daemonology.net/blog/2016-10-09-EC2s-most- dangero...](http://www.daemonology.net/blog/2016-10-09-EC2s-most-dangerous- feature.html)

<comment><USER4> Yes, you can - it has a separate API with its own separate permissions. There's no need to use the full SSM to take advantage of Parameter Store.

</comment></comment></comment><comment><USER5> The comparison with Vault is somewhat misleading.

\- There are several free UIs available for Vault like [https://github.com/djenriquez/vault-ui](https://github.com/djenriquez/vault- ui), they just aren't provided by Hashicorp

\- I'm not sure what "file secrets" might refer to other than storing the contents of a file, for which Vault's CLI provides shortcuts.

\- While Vault's generic k/v backend doesn't support purging expired values in order to avoid accidental data loss, there are plenty of other backends that integrate with AWS STS, Postgres, etc. to provide dynamic, short-lived credentials.

\- I'm not sure how Vault doesn't support encrypted backups seeing as the data is already encrypted on disk. Take EBS snapshots or something.

\- Versioning of secrets is a popular request and Hashicorp has some "vague plans" which is an improvement from "no plans." [https://github.com/hashicorp/vault/issues/1364#issuecomment-...](https://github.com/hashicorp/vault/issues/1364#issuecomment-328251464)

Plus you get a full REST API, a ton of auth methods, granular access policies, etc.

<comment><USER6> It also has that snarky little footnote saying that a "TTL" isn't the same thing as an expiration time next to the entry claiming vault doesn't support secret expiration.

<comment><USER7> The footnote and the entry was a bit rushed and was not intended to be snarky.

To the best of my knowledge - please correct me if I'm wrong - you cannot say a secret should be valid in a time period in Vault. The TTL will tell the client that they should check back with Vault for the most up to date secret when the TTL expire. If the client credentials are still valid, and the secret has not been revoked or updated in some other fashion, the client will fetch the same value again. Hence the claim that it does not support secret value expiration.

</comment></comment></comment><comment><USER8> Hi, this really needs a REST API.

Most secrets are injected in real time at the startup of of a container. For tools like this or plugins in k8 / docker to access your store you should support this. It's really bad practice to create a hard dependency on your secrets store by using the Java sdk directly in your application. If that's not the intent definitely provide a Golang sdk for proper plugin integration.

Can you explain how secrets are injected now?

<comment><USER7> Today people are using the SDK directly or injecting secrets via the CLI. Multi-language support and integration with e.g. Kubernetes is high on the wish list. The approach we are looking at for multi-language support is to drop the dependency on the AWS Encryption SDK. Creating a read-only SDK in other languages is then straight forward.

<comment><USER9> Sure, but what if the language I'm using is not high on your priority list? Isn't it easier to add a high level rest api?

<comment><USER7> That is certainly one approach we have looked at. The question then is where would you run the REST API? As a side car, as a separate service, e.g. using AWS API Gateway and Lambdas?

If you look at the work required to write a simplified read-only client using the AWS SDK for KMS and DynamoDB, while perhaps a bit more work than integrating with a REST API, it is not that far off, which is why we are considering that approach. That would of course not help if you are using a language that does not have an AWS SDK.

<comment><USER9> All AWS SDKs use the underlying REST(ey) API. The SDKs are literally machine generated. I can download the WSDLs or take these files [https://github.com/aws/aws-sdk- go/tree/master/models/apis](https://github.com/aws/aws-sdk- go/tree/master/models/apis) and generate one myself.

</comment></comment></comment></comment></comment><comment><USER7> I'm the creator of Strongbox. Feel free to ask me technical questions about the project.

<comment><USER10> Including the Spring-Cloud config server would have been interesting , because it has all the mentioned features, but is running on top of git. If you are on AWS, you can use one if the free CodeCommit repos.

The cool thing is obviously the spring integration, which pulls the secrets on app startup and overwrites or augments the values in the application.(properties|yml)

It can also run kind of serverless by embedding it in your app.

<comment><USER11> Yeah, we have the same features with the strongbox-spring-boot-starter, it injects all secrets as properties on application bootstrap: [https://github.com/schibsted/strongbox/blob/master/spring- bo...](https://github.com/schibsted/strongbox/blob/master/spring-boot- starter/README.md)

</comment></comment></comment><comment><USER12> If you're all in on AWS, just use parameter store. This scheme is just CredStash, and so is parameter store under the hood.

<comment><USER4> Even if you're not all-in on AWS, you can use Parameter Store for a trivial sum. The latency might be a bit higher, but in most cases it shouldn't matter since secrets usually have a nonzero TTL associated with them.

<comment><USER13> If you're not using AWS, the use of Parameter Store (or Credstash) becomes a turtles problem--because you need to provision AWS credentials. At that point, whatever you provisioned AWS credentials into might as well store your other secrets, too.

If you are using AWS, EC2 itself is a trusted third party that grants the appropriate permissions for your executing system (container, instance, whatever).

<comment><USER12> While this is true, it's something you can work with in the future, and it defined a secrets process earlier rather than later

If you do nothing you end up stuck with secrets in git history and you essentially have to roll them all.

So, my advice is generally SSM with no security is better than no secrets Management solution.

<comment><USER13> If you _do nothing_ , you end up with secrets manually provisioned by logging into a machine and splatting out a configuration file. Which is a more secure solution than a turtles-problem parameter store.

<comment><USER12> You're assuming readers are managing snowflake servers, and I'm assuming they are in an containerized/autoscaling/more modern environment.

SSM wins for mine. I think you're right that the file approach wins for yours.

<comment><USER13> I'm assuming readers are just starting out, where auto-scaling and bloggable container architectures make very little sense. Configuration management is a prerequisite for those. That said, having a CM in place also makes the please- invest-in-us container ecosystem much less attractive, given that you can easily fall back to singleton-container-on-an-instance patterns (which is a great one for deployment regardless of your approach).

To that end, yes, their servers are probably hand-rolled or provisioned with minimal scripting like Ansible. And so manual secret deployment is to be expected.

If somebody is attempting to autoscale without having this solved already, they are making mistakes.

<comment><USER14> "Bloggable" LOL

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER15> Charging $1 per secret is interesting. I wonder if that will affect how people design their application.

We've had a pretty splendid experience with Vault so far, so I'm not exactly in the market for another solution, but this looks interesting.

I assume you started development on this because Vault et al didn't exist yet at the time? Or was there another driver?

<comment><USER7> Strongbox was designed prior to AWS Parameter Store, and took its inspiration from projects like Fugue CredStash and similar AWS KMS based projects. While there are certainly pros and cons with the different approaches, which you can see in the linked comparison table, I think one of Strongbox' strengths is that it is easy to set up, and you get a lot of convenience functionality related to secrets management. Not having to maintain running services, and natural compartmentalization using both AWS IAM and AWS accounts was two of the drivers.

$1 per group of secrets, e.g. a service. In many cases I think this is fine, but it is certainly not a strength.

<comment><USER15> Thanks for the additional explanation, and for clarifying RE: $1/service; that makes sense.

</comment></comment></comment><comment><USER16> There's also [https://www.envkey.com/](https://www.envkey.com/)

<comment><USER17> Happy user of Envkey here. I was trying to get my head around AWS's secrets management, and even with useful blog posts from the likes of Segment.io etc., it was giving me a headache.

Envkey let me set up and deploy secrets management across 3 server groups (development/staging/production) for our web app in under 15 minutes. And I can add new developers and devops people to our app in seconds.

I normally don't like hijacking other people threads about their hard work like this, but I just thought this product should be mentioned as it was a _real_ time saver and headache reducer for us. Very happy to see people like the developers of StrongBox trying to solve this issue and make secrets management easier. The more players in this space, the better, IMO.

</comment></comment><comment><USER18> If you're comfortable with using KMS already, I recommend checking out SOPS: [https://github.com/mozilla/sops](https://github.com/mozilla/sops)

It can be versioned if you use git, access controlled via the KMS access privileges, and easily plugs into other tools because it uses YAML. Simplicity is the killer feature.

</comment><comment><USER19> How does SecretBox compare with Vault [0] or BlackBox [1]?

[0] [https://github.com/hashicorp/vault](https://github.com/hashicorp/vault)

[1] [https://github.com/stackexchange/blackbox](https://github.com/stackexchange/blackbox)

<comment><USER7> [1] Please follow the link to see a comparison table with Hashicorp Vault and AWS Parameter Store: [https://schibsted.github.io/strongbox/](https://schibsted.github.io/strongbox/) [2] One of the fundamental differences between BlackBox and Strongbox is that BlackBox is based on GPG, while Strongbox is based on AWS KMS for encryption. Also BlackBox stores secrets in VCS repositories, while Strongbox primarily use AWS DynamoDB (while files are also supported).

</comment></comment><comment><USER20> Current parameter store user - one feature not mentioned in the comparison is the fact that accessing / updating a secret in parameter store will show up in Cloudtrail. Is there a similar audit trail in strongbox?

<comment><USER7> For Strongbox CloudTrail logs are indirect: you need to look at the logs of the backends used by Strongbox, i.e. KMS and DynamoDB. Consistent naming of the resources (managed by Strongbox) should help you filter out the correct entries.

</comment></comment><comment><USER21> I prefer the RBAC and YAML policies Conjur provides... [https://github.com/cyberark/conjur](https://github.com/cyberark/conjur)</comment>


PHP to Node.js to PHP - <AUTHOR> http://blog.climbi.com/post/78289484368/php-to-node-js-to-php

<comment><USER2> As much as I hate PHP, I like Laravel.</comment>


Why Palmyra's ruins are so important - <AUTHOR> http://www.latimes.com/entertainment/arts/miranda/la-et-cam-five-reasons-why-palmyra-matters-as-archaeological-ruins-site-20150520-column.html <comment><USER2> There was an interview with a person from Palmyra. He was pretty bitter and said the world only cares about the ruins. Not much mention of people currently living in Palmyra in the media, it's all about the ruins.

<comment><USER3> Like it was all about the Buddha statues in Afghanistan... the people living in these areas and victims of the barbarians have "no face" and "no voice", and are not considered as worth as a few monuments protected by the UNESCO. That's the sad reality we're living in.

</comment></comment><comment><USER4> I have been considering going back to help the Kurds fight ISIS for some time now. I want to say stories like this highlight the urgency of the situation, but in the face of all the murder happening in areas controlled by the dark army of Mordor, it would make me appear to have the wrong priorities. ISIS needs to be destroyed.

<comment><USER5> My father have friends working in the IDP camps. There are plenty of Kurdish doctors from Sweden going there, doing abortions on 9 year olds. Some don't survive.

The thing ISIS did to the Yezidis.. the children, the female ones. It would kill your insides and want to set the world on fire.

In fact, it wasn't just ISIS, but their Sunni muslim neighbours. As soon as they heard ISIS were nearby, they started killing their Yezidi neighbours, raping their daughters on the streets. There were mattresses and used condoms lying on the streets when the HPG (Yezidi militia) came back to Sinjar... grim scenes.

It wasn't 3 or 4, but systematic abuse on _thousands_.

Christians (Assyrians) weren't spared either, but not as many as 7000 Yezidis females captive since last summer. The male children are being used as human shields and sucide bombers. The female (down to the age of 6) are being sold on sex-slave markets.

Edit: [http://www.washingtonpost.com/blogs/worldviews/wp/2015/05/22...](http://www.washingtonpost.com/blogs/worldviews/wp/2015/05/22/islamic- state-burned-a-woman-alive-for-not-engaging-in-an-extreme-sex-act-u-n- official-says/)

"They commit rape, sexual slavery, forced prostitution and other acts of extreme brutality. We heard one case of a 20-year-old girl who was burned alive because she refused to perform an extreme sex act. We learned of many other sadistic sexual acts. We struggled to understand the mentality of people who commit such crimes."

Set the world on fire.

<comment><USER6> Don't set the world on fire. Be a bastion for good in the world.

<comment><USER7> This story is remniscent of the 1948 Israel war of independance which was also full of stories about neighbours suddenly being given the change to rape, steal and pillage.

One can only hope it ends in exactly the same way : 5 more Israels in the middle east. A Yezidi one. An Assyrian one. A Shi'a one.

You can say whatever you want to say but this islam is an ideology which is centrally focused on it's supposed superiority and the focus is the reason for this superiority : that allah will guarantee military victory. Walk near any large station in a large Western European city and you can find out for yourself (if you look the least bit dark you will find out even if you don't want to, they'll walk up to you and ask). Paris - Gare du Nord, Brussels North, Amsterdam, ... you should go to Syria and fight and kill. Feign minimal intrest and you get to find out more. Why - because allah will make you win and we'll finally punish the infidels, and everybody you hate. They'll provide a wife, and openly talk about their "attitude" to captured women - what allah "allows". The main counterargument you hear on that street - it's not a way to victory, it's a way to death.

I don't know about if this is similar in America. Does anyone have similar experiences in, say, New York ? Given where the recruitment happens in Western Europe and how successful it is in these western states, I find it extremely difficult to believe that this ISIS will remain confined to the middle east. I am terrified what will happen in Western Europe in the large cities if ISIS appears to become more successful.

This ideology needs to die, if we are to have peace.

<comment><USER8> Why are European Muslims (admittedly the sad, hopeless losers) falling into this trap? Could it be a lack of civic, constitutional nationalism and Habermassian public civil religion as opposed to bog-standard ethnocracies?

<comment><USER9> It goes without saying that what ISIS is doing is against the teachings of Islam.

What's happening is that they are making propaganda to the uneducated people who "have nothing to lose". They tell them to go carry weapons, fight for glory, and they'll be rewarded with Heaven. Pretty good deal to get out of their circumstances, right?

The fact remains though that what they preach is not of Islam.

<comment><USER7> > It goes without saying that what ISIS is doing is against the teachings of > Islam.

Yes and so is everything else muslims do. For instance, there is a death penalty for muslims who choose not to live under islamic rule. And the only thing that qualifies as islamic rule, of course, is a state ruled by a caliph. [1] And no, the law does not mention the case that there is no islamic state. So sharia quite literally states all muslims should kill eachother. For some reason this is not happening. So every muslim on the planet today has committed a sin in islam, punishable by death. Or to take another issue. There is not a single mention of a headscarf anywhere in either the quran or the hadith. It says to wear loose fitting clothes, the actual word used compares the clothes to being inside a tent. Now look around, do young muslim girls wear loose fitting clothes ?

I am making a somewhat disingenuous argument, but the point is that your argument is disingenuous as well, and for the same reason : when comparing reality with a set of laws, reality is found lacking. This goes for ISIS and for every other law, principle, design, guideline, ... on our little blue ball in the dark.

So your argument is wrong. Of course they don't follow islam perfectly, nobody does and everybody knows. The real reason is "goes without saying", of course, means that you're merely pointing out that there is massive social pressure on this board, and in this country, to agree with that assessment. That I am a racist if I think otherwise. But this is a bullshit argument. It is true, because it would be a socially very, VERY uncomfortable situation if it wasn't true ... which of course doesn't change the fact that it's utterly wrong.

So in short, it doesn't go without saying at all. How much does it really match the religion's instructions ? I would argue it matches it pretty well. They've got a caliph and are waging war against anyone and everyone else, just like their prophet did. That is the basic problem with islamic terrorism : the terrorists, while not 100% perfectly right about their ideology, have a very good point. Islamic ideology glorifies this war of the prophet against the Roman Empire, and the Jewish and other states bordering it, and describes it as a war that can and should only end with total worldwide victory of the religion.

This is what muslims are teaching their children (I hope we can at least agree on those basic facts). And like every other sane person on this planet, their children don't believe them. I didn't believe my parents when they talked about this sort of shit, and I've had a few talks with my daughter where she made it very clear she doesn't believe me either. But when they get excluded out of our society, hide in their religion for it's the only thing that hasn't completely rejected them yet (keep in mind that islamic marriages are arranged. If you have no money, no amount of good looks or talking can help you). And then these people who look like clerics read to them from the exact same books their parents are telling them to live by ... and those books say to fight and kill and you'll be rewarded. Those are the books their parents talked about when they were toddlers sitting on daddy's knee, when they were happy and provided for. Now they're criminals who failed with nothing to lose ... and these clerics read from those books, and those books say to fight and kill ...

The reason this works is the ideology. And I don't care how uncomfortable that basic piece of information makes anyone. Fighting the people who are already lost is a loser's game. You must prevent, so to speak, toddlers from being raised with those books anywhere nearby.

And given how this is escalating, it is a matter of time until we all agree on that point. The big question is, how many people need to die before we agree ? As I said, I have kids and find this "let's ignore it and pretend it doesn't exist" attitude EXTREMELY unacceptable.

And yes, this will cost me a lot of karma on this board. Fuck social pressure. I hope everyone who lowers the integer next to my name on an internet server feels really good about themselves and the actions they took.

[1] [https://themuslimissue.wordpress.com/2015/01/02/hijra-in- rev...](https://themuslimissue.wordpress.com/2015/01/02/hijra-in-reverse-the- muslim-duty-to-emigrate/) talks about this issue

<comment><USER9> There are lot of baseless and uncited claims in your post. The blog post you cited took a few verses from the Quran, and attempted to deduce rulings out of them, without going back to what scholars know.

> For some reason this is not happening.

Maybe something for you to research and find out why (hint, because Islam preserves life, and its goal is not to kill left and right, like how you're trying to make it seem to be). The death penalty in Islam is very, very strict, applicable to only a couple of situations, and can only be done by the government. Even then, people are encouraged to forgive if they are in a position to do that.

> There is not a single mention of a headscarf anywhere in either the quran or > the hadith.

If you're looking for the literal word "headscarf" then yes (at least for the Quran). However, covering up (what is known as the headscarf today) is required in Islam. There is not enough space here to discuss this issue, it is sufficient to know that the Muslim women during the time of the Prophet Peace be upon him, practiced this.

> For instance, there is a death penalty for muslims who choose not to live > under islamic rule.

I would like to see the source of that claim.

> And no, the law does not mention the case that there is no islamic state.

Just because there is no Caliphite state today, does not mean that there are no Islamic states. Nowhere in the sources is it stated that a Caliphite system is the exclusive way to have an Islamic state. In one Hadith, the Prophet Peace be upon him mentioned that the Caliphite period after him will be 30 years, then it will turn into kingdoms. There are dozens of Hadiths that tell people to have patience, and not to overthrow their governments, even if those governments are messing around with some religious rulings (e.g. delaying prayers until after their time). There are only two cases where it is permissible to overthrow the ruling government, none of which apply to any of the countries of the so called Arab Spring today.

We also have Hadiths that describe people with mentalities similar to what we see in ISIS today. One of these Hadiths calls such people the dogs of Hell fire.

> That I am a racist if I think otherwise.

I don't see what racism has to do with any of this. You're free to believe what you want, but it seems that the vast majority of what you believe about this topic is based on either no evidence at all, or on deliberately misconstrued "interpretations", which can be easily dismissed by a learned individual.

> How much does it really match the religion's instructions ?

It goes against it 100%. The Prophet Peace be upon him told us not to overthrow our rulers, regardless of how bad they get. They have absolutely no religious basis to their actions; none of the nearby countries recognize them as a legitimate government; we have Hadiths describing people like them.

> Islamic ideology glorifies this war of the prophet against the Roman Empire, > and the Jewish and other states bordering it...

He did not wage war for the sake of waging war. This is another misconstrued view you have of Islamic history. In ALL of the wars that happened during his time, it was to either fend off an attacking enemy, or it was after a peace treaty was broken by the other party.

> and describes it as a war that can and should only end with total worldwide > victory of the religion.

* [http://quran.com/49/13](http://quran.com/49/13)

* [http://quran.com/10/99](http://quran.com/10/99)

> keep in mind that islamic marriages are arranged

Again, more uncited claims. Arranged (i.e. forced) marriages are against Islamic teachings. Them happening in Muslim countries does not mean these practices were derived from the religion (basic correlation vs. causation fallacy).

That being said, I don't disagree that there are many misconceptions that are spread in the Islamic world, about certain rulings or teachings, that in fact, are not from Islam. It is important to educate people about what is and isn't from Islam.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER10> My wife and I had the opportunity to travel to Palmyra in 2010, and it was an extraordinary experience. Not only are they some of the most spectacular ruins in the world, but while we toured, there was almost no one else there. It's just crazy to take in vistas like [0] and feel like we're the ones there to appreciate it.

Nevertheless, the potential damage is insignificant compared to the human losses under both Assad's regime and ISIS.

[0] [https://www.dropbox.com/s/mc7jofyfhb36ozb/palmyra.jpg?dl=0](https://www.dropbox.com/s/mc7jofyfhb36ozb/palmyra.jpg?dl=0)

</comment><comment><USER11> I visited Palmyra in 2009 - it is truly an amazing place.

Politics aside this would be a devastating cultural loss for all of humanity.

</comment><comment><USER12> Reading this makes me sick to my stomach.

</comment><comment> guard-of-terra Historical ruins is our shared heritage and our countries should take blame for everything that lead to this situation, should they take harm. And I mean [almost] every country.

By playing petty and pointless political games we're about to lose things we have no hopes to ever have back. Will people learn? These days I think the only way for humanity to save face is to die off entirely.

<comment><USER13> Sorry but I disagree it's fault of everyone else. True Bush invasion started this. But as far as the collapse of security forces in Iraq (which allowed ISIS to gain infamy), most of the blame lies with the Iraqi govt.

You can't stop a few hundred (or a thousand) guys with AK47 with pickups when your solders have M1 tanks?

<comment><USER14> Political game playing by anti-Assad and anti-Iranian powers were also directly responsible for the rise of ISIS. These share a portion of the blame for some ISIS's misdeeds.

<comment><USER15> As long as we're assigning blame let's actually blame the people directly encouraging this, the wahhabist/salafi crusaders that are heavily funded and protected by the Saudi government and who have been at it long before Isis.

[http://www.cfr.org/world/cultural-terrorism-wahhabi- islam/p5...](http://www.cfr.org/world/cultural-terrorism-wahhabi-islam/p5234)

<comment><USER5> People keep forgetting that the Muslims all around the world are traveling there to rape children and murder civilian "apostates".

This isn't some "tiny" minority, they are over 100 of millions of supporters and people who approve of the doctrine that allows sex-slavery and killing apostates. In fact, according to Pew Research as of 2013, the numbers reach up to approx. 800 000 000 muslims who think that honour killings are justified amongst other things.

As an ex-muslim (much like an ex-smoker) I am rather biased, but here it is [http://www.pewforum.org/2013/04/30/the-worlds-muslims- religi...](http://www.pewforum.org/2013/04/30/the-worlds-muslims-religion- politics-society-overview/)

<comment><USER8> So your contention is that all these people's families are perfectly fine with them going to the Levant for a little sun and frolic? If they have such a support base for all these terrible things then why do they have to hide where they are going? I'm no friend to organized religion, but I remember enough about the so-called rules of jihad to remember that you need your father's permission. When you start going on about "the Muslims" you're the mirror image of all these assholes like Qaradawi that go on about "one Ummah" and the "rope of Allah"

<comment><USER7> I think the contention is that this does not matter - it is an intolerable situation. I think the contention is that having a subgroup in society with 1% of their people willing to kill cannot possibly be contained by a police force, and cannot possibly peacefully exist alongside other groups.

Add to that the fact that 50% or more of those muslims will protect the 1% extremists from the police force in all but the most offensive cases.

Let's face facts here : islam is a religion that was created in a massive war, that is on occasion blamed for starting the dark ages by cutting off all sea based trade in Western Europe and more than half of land based trade. The ideology internalized war during it's formation period. Hell, in the hadith you find plenty of references why the early caliphs "chose" islam, and the reason was they were at war. The religion survived only because it could convince large amounts of people to fight anyone else around them. Further in it's history it spread by war and it is absolutely unique in the sheer amount of genocides that just happened to take place just at the edge of islam, at the point where it was spreading. The biggest slaughter in history, the Mongol conquest of India, with the lower end of death toll estimates at over 3 times the WWII total death toll (over 30 times bigger than the holocaust), and may have killed half a billion (close to 100 holocausts), was an islamic expansion war.

And I wouldn't worry about them going to the middle east - or anywhere - that's temporary. This will spread, and the time will come when the fight is simply local.

THAT is the contention.

<comment><USER16> _The biggest slaughter in history, the Mongol conquest of India, ... may have killed half a billion_

Wow.. That's incredible considering that the WORLD population in 1200-1300 was only 400m people. In fact, it's so incredible, I think I'm going to need to see some references.

[http://en.wikipedia.org/wiki/World_population_estimates](http://en.wikipedia.org/wiki/World_population_estimates)

<comment><USER7> It is incredible. The reason they could kill so many is that they were at it for several hundred years and attacked different regions. So the population had some time to replenish before the next series of genocides started. Individual campaigns had death tolls in the 10-50 million range. There were 6 major campaigns. Several had multiple decades of genocide.

And of course, death tolls are a guessing game, as are population figures. So yes there are legitimate arguments about these figures.

[http://en.wikipedia.org/wiki/Mongol_invasions_of_India](http://en.wikipedia.org/wiki/Mongol_invasions_of_India)

<comment><USER8> I don't think "they" and "several hundred years" go together in a coherent sentence. What are we talking about here, the Borg collective?

</comment></comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER17> As somebody who used to work on Middle Eastern affairs for the U.S. government (and, full disclosure, a CSIS alum), I thought that this was a pretty solid op ed:

[http://csis.org/publication/defeat-ramadi-time- transparency-...](http://csis.org/publication/defeat-ramadi-time-transparency- integrity-and-change)

</comment><comment> anti-shill it's almost like the media wants ISIS to destroy palmyra

</comment><comment><USER18> Iraq is majority Shia. Iran is majority Shia. Isis is Sunni. Saddam was Sunni, a minority in Iraq, but saddam kept the Sunni in power. When he was deposed the Sunni were repressed and pushed into a repressed role. However they... Fuck it. It would take a week of Ivy League lectures to explain what's going on. My point is that we fucked things up by getting rid of saddam and not putting a powerful repressive regime in place. But, also, the people of the region want to live under Isis and if we're not willing to utterly destroy them (which I don't think we are) then we should just let the people of the region take care of it.

</comment><comment><USER19> Most of the ruins were looted by the Assad regime and its supporters. Leaving the area to be seized by ISIS on purpose.

</comment><comment><USER20> Yeah, fine. If we had any decency, we'd deploy the Marines to protect the ruins, sort of like we deployed the Coast Guard to protect BP's interests in the Gulf. Not.

<comment><USER21> I checked out your profile and it is apparent you are a smart guy. However, as a former Marine Science Technician in the USCG, your comment is not only insulting, but has no basis in reality. Marine Environmental Response actions are incredibly difficult, complex, and dangerous. I would recommend reading the Deepwater Horizon ISPR to get a sense of how challenging this incident was, what was learned, and maybe get a perspective of how serious this kind of mission is to the men and women of the Coast Guard.

<comment><USER22> I think you took the comment the wrong way. It wasn't to denigrate the Coast Guard, but to say we'll clean up BP's mess because we're a corporatocracy, but not send the Marines in to save something of historical value. It was a knock at what the US government puts value on.

<comment><USER21> Perhaps, but MER missions have zero to do with protecting corporate interests. They have everything to do with minimizing impact to the environment, the marine and coastal ecosystem, and our fisheries. The Coast Guard is also tasked with protecting the Maritime Economic Defense Zone, so I guess you could argue that there is a financial motivation to protect our nation's interests, but I don't like the implication that the CG is a corporate shill. I lived in that world and I understand the mission and the people. Maybe I'm just too sensitive...

<comment><USER20> At some level we're probably just going to disagree. There is ample video of various agencies of the federal government along with local and state law enforcement being used to prevent news organizations from filming the environmental impact across the gulf coast, and the Coast Guard was one of these. I also believe that injecting nearly two million gallons of Corexit was done without regard for the impact on marine life; it was done to ensure that the oil would settle on the bottom of the gulf. So less spoiled beaches was obviously good, but the impact on marine life and ecosystem made the spill much much worse. Read the Wiki page on Corexit (FWIW, I have a degree in chemistry from UNC-CH).

And since you mentioned the Marine Economic Defense Zone (otherwise known as the Exclusive Economic Zone), this is presumably what entitled a Coast Guard cutter to board my sailboat about 3 NM off the coast of Bimini in international waters? You all forced me to reduce speed to 3 knots and spent two hours searching my boat. So long in fact that you made me arrive in Miami after dark. You all kept telling me that it was a safety search (flares, life jackets, etc.), but we all know you were looking for illegal immigrants, drugs, and guns. And you found none. But you did endanger myself and my girlfriend. And for the record, my girlfriend attended the Coast Guard Academy in 1984.

I'm glad you were or are in the Coast Guard. I know you would have done your best to rescue me if I'd triggered my EPIRB. We're not debating that. But I do believe that the US military was essentially deployed to protect BP's image in the Gulf although there's an idiom that goes something like, 'never ascribe to malice that which can otherwise be ascribed to stupidity'. So maybe all that just happened because of the same incompetence that gave us Michael Brown as FEMA director for Katrina. It's not like I claim we have a functional federal government.</comment></comment></comment></comment></comment>


Ask HN: If HN were to disappear tonight whats your next fix? - <AUTHOR> I'm always worried about loosing something nice I've found. HN is so unique in that you have topics ranging from sea shells to semi conductors and beyond. 9/10 times I view the comments even before opening the article. It speaks of where my priorities are at and I'm sure it's similar for the others.
If for whatever reason HN changes, where will you be flocking to next for the goods that only HN could provide until then? <comment><USER2> Probably going through my HN favorite list and save as much content as possible. Like "Ask HN: What are some more authentic online forums?" [https://news.ycombinator.com/item?id=20941191](https://news.ycombinator.com/item?id=20941191)

</comment><comment><USER3> Reddit. It's still usable with a third-party app (Apollo) even though they completely slaughtered their web UI.

</comment><comment><USER4> [https://soylentnews.org](https://soylentnews.org)

[https://lobste.rs](https://lobste.rs)

If starting a new site, note that pipedot.org is a clean reimplementation of slashdot.org that didn't gain a critical mass of users. Source code here: [http://pipedot.org/source](http://pipedot.org/source)

An old version of the reddit source is still around. With the right moderation, that could be like HN.

</comment><comment><USER5> Ars Technica. Slashdot. Techmeme. Reddit has some good sub-Reddits.</comment>


Node.js Express API development security checklist - <AUTHOR> https://smalldata.tech/blog/2017/05/19/nodejs-express-api-development-security-checklist <comment><USER2> This is a great list but does not include solutions for a lot of the problems. Most web developers will already know basic solutions but it would be nice to see a github repo with checklist + solutions. Anyone know of one?

</comment><comment><USER3> I find it interesting that they assume that you treat passwords as plaintext in a security document :/

<comment><AUTHOR> That was just an example, you could just as well change it to an injection on a different resource/field!

</comment></comment><comment><USER4> Never considered a regex attack blocking the event loop. Not something you would consider with apache or nginx.

<comment><USER5> The web server doesn't matter since it isn't processing the regex. It's the application server that is being tied up. If you're using a multi-threaded application server, it would eventually get bogged down. See [https://www.owasp.org/index.php/Regular_expression_Denial_of...](https://www.owasp.org/index.php/Regular_expression_Denial_of_Service_- _ReDoS) linked from the original article.

</comment></comment><comment><USER6> The Express site itself has a similar list of security considerations. [https://expressjs.com/en/advanced/best-practice- security.htm...](https://expressjs.com/en/advanced/best-practice- security.html)

</comment><comment><USER7> Author is confusing prepared statements with parameterized queries/escaping in one of the first points. Prepared statements are not related to sql injections, ie. you can build them from interpolated strings as well.

<comment><AUTHOR> Yes you are correct there. In the context of Node.js and using the mysql package, prepared statements do the job :)</comment></comment>


Mathematical Hacker - <AUTHOR> http://evanmiller.org/mathematical-hacker.html

<comment><USER2> This is an excellent essay. I am coming from a math background and mostly picked up programming on my own. Even though I may not directly use algebra or analysis in my programming, usually what I see as elegant and neat from a mathematical perspective later turns out to be more efficient and readable from practical point of view.</comment>


Things You Hadn't Expected HTML/Javascript Would Do - <AUTHOR> http://zef.me/2950/10-things-you-hadnt-expected-htmljavascript-could-do

<comment><USER2> This list boils down to:

1\. Heavy-duty graphics, including video (canvas/svg)

2\. Collaborative text editing (canvas/svg/ajax)

3\. Read books in a mobile browser without a connection (localstorage)

I kind of expected a little more variety. Off the top of my head, here's what I didn't expect HTML/JS to do, in addition to the above:

4\. Work on almost all new phones, without converting to a special language (Remember WAP/WML)?

5\. Have open & standardized libraries that anyone can use to make coding easier (proto/moo/jQ).

6\. Enable anyone to write browser-plugins easily.

7\. Run as a server (node.js)

8\. Constantly improve in performance

9\. Be written using templating systems: SaSS, HAML

10\. Still be handwritten in 2010 and beyond.

<comment><USER3> Looks to me like "a list of things HTML was never intended to do", except #10 of course.

</comment></comment><comment><USER4> Man, I remember wondering if Javascript would ever be widespread or enabled enough for me to even make use of it. Not to mention how useless it was until the DOM got "sorted".

Everything since then has been a kind of slow, gradual surprise.

<comment><USER5> I made the same experience, especially when I discovered jQuery and other cross-browser libraries.

Before, most scripts went along the document.write(document.lastModified);-line. And if I remember correctly, not even that worked in all browsers correctly. Made me give up rather quick.

</comment></comment><comment><USER6> I started working on a Chrome "Installed App" for the upcoming web store and was surprised to learn about the File API and being able to access files through JavaScript. Certainly never expected that.

</comment><comment><USER7> All it needs some graphics acceleration so that it doesn't burn the CPU so much.</comment>


Facebook is giving advertisers access to your shadow contact information - <AUTHOR> https://daringfireball.net/linked/2018/09/27/hill-facebook <comment><USER2> [https://news.ycombinator.com/item?id=18082017](https://news.ycombinator.com/item?id=18082017)</comment>


How I Socially Engineer Myself into High Security Facilities - <AUTHOR> https://motherboard.vice.com/amp/en_us/article/qv34zb/how-i-socially-engineer-myself-into-high-security-facilities <comment><USER2> This was discussed 8 months ago (221 comments): [https://news.ycombinator.com/item?id=15516526](https://news.ycombinator.com/item?id=15516526)

</comment><comment><USER3> Dunno, I just didn't get the sense that this had the ring of truth to it.

It reads more like fiction.

<comment><USER4> Probably is, considering it's vice.com.

<comment><USER5> Sad but true. What's coming post-Vice?

</comment></comment></comment><comment><USER6> I think they went a little overboard on gifs for this article.

<comment><USER7> Today's equivalent of meaningless clipart? But a whole order of magnitude more annoying.

</comment></comment><comment><USER8> High Security? I suppose it depends on context. But for real high security facilities, a visitor is not getting past the first guard desk without an ID check with the visitor's name being on a list that is maintained via secure communication channels - facility to facility. And there are often multiple levels of guard stations to pass through where this is repeated.

</comment><comment><USER9> This reads like some bootleg Mr. Robot episode.

</comment><comment><USER10> 2017 blog post.

Gross. The author explicitly brags about being "a terrible human being."

Aside from the sociopathy and embellishment, I get unease about the legality of the means used, considering the agent was contracted.

I could've audited the security controls and arrived at the same deficiencies without abusing people.

<comment><USER11> I mean, the company pays them to do this. Thats the whole point of pen testing.

Nobody is going to pay attention to a 10 page report. They are instead going to pay attention to the fact that the person successfully got into the building.

<comment><USER10> You're assuming that a "10 page report" will not elicit a response? Are you addressing a hypothetical or the situation as described in the post?

If so, then that's mismanagement. Poor managers suddenly "paying attention" are unlikely capable of implementing proper controls.

Also, you're assuming these poor managers can contract well.

<comment><USER11> Yes, that's what would happen. People would not take a report as seriously as if someone actually went and broke into the system.

You can call it mismanagement, but humans aren't perfect. Humans are emotional being who, in many cases (but not all) will not take a threat seriously unless someone goes and does it.

It is not even necessarily mismanagement either. It could just be ignorance. IE, someone can talk all they want about hypothetical vulnerabilities, but if you aren't a security expert, you have no idea how realistic those threats are, no matter what the pen tester tells you.

Who knows, maybe the pen tester really is being paranoid.

It is much easier to actually convince someone that something is a problem by actually exploiting it. That's just an obvious fact.

And it seems like the pen tester in question agrees with me. Because she didn't right a report. She instead broke into the system, and what do you know it worked in their goal of convincing the company that their was a problem.

If you will noticez the company in question really did think that everything was secure. The pen tester really did need to do something extrodinary in order to convince them. So she did, and it worked.

</comment></comment></comment></comment><comment><USER12> Francesca Abagnale :)

<comment><USER13> Hired by Hom Tanks?

</comment></comment><comment><USER14> Kevin Mitnick said that too.</comment>


An Iraqi who saved Norway from oil (2009) - <AUTHOR> https://web.archive.org/web/20100123225932/http://www.ft.com/cms/s/2/99680a04-92a0-11de-b63b-00144feabdc0.html <comment><USER2> Thanks to everyone who mentioned this in previous comments. It's a fascinating bit of history.

[https://news.ycombinator.com/item?id=19593054](https://news.ycombinator.com/item?id=19593054)

</comment><comment><USER3> Little throwaway bit:

"Nor was it straightforward to resign from his job. When al-Kasim broke the news to his boss in London, "he said: 'Damn you, Farouk. We were counting on you. Now you are letting us down.'" The top director put pressure on him to stay, but al-Kasim explained that only Norway offered the care his son needed. In the end, his superiors relented. "My immediate boss said: 'I can't promise you that you will get a job, but I can say now that we will not stop you getting one.'"

And so no one interfered when Norway's Ministry of Industry hired al-Kasim as a consultant. His job would be to analyse the North Sea exploration results – at a salary just above that of the prime minister."

That he had to rely on the graciousness of his employer to refrain from blackballing him is still a reality for a lot of professionals.

</comment><comment><USER4> For those interested in what they invest in, that data is public: [https://www.nbim.no/](https://www.nbim.no/). They hold, for example, 0.86% of Amazon, 1,34% of AMD, 0,97% of Apple, 0,33% of Facebook, 0,95% of Microsoft, and 0,8% of Tesla.

<comment><USER5> Amazing dashboard

[https://www.nbim.no/en/the-fund/holdings/holdings-as- at-31.1...](https://www.nbim.no/en/the-fund/holdings/holdings-as- at-31.12.2018/?fullsize=true)

</comment></comment><comment><USER6> >their youngest son "completely transformed" by the treatment he received in Norway

Even though he didn't get enough credit for the work he had done, his goal to provide better health care for his son is fulfilled; that should provide him the satisfaction above everything else.

<comment><USER7> > that should provide him the satisfaction above everything else

Being a good parent above all other considerations is not a universally held moral.

<comment> village-idiot We can assume that it's one that the subject shares though, considering how much risk he and his wife were willing to tolerate to get their son better treatment.

<comment><USER7> What him and his wife were willing to risk: moving to Norway, when one of them was Norwegian, from Iraq.

<comment> village-idiot The article makes it very clear he had planned to give up his career, and they had to effectively smuggle themselves out of the country. The government was tracking him so they knew who to grab if they nationalized the oil.

</comment></comment></comment></comment></comment><comment><USER8> For the curious: the fund's current value is at $1.05 Trillion dollars (USD).

With 5.3 million Norwegian, that equates to $198k per capita. Impressive.

Also: "Since 1998 the fund has generated an annual return of 5.5 percent".

Well done Norway, and well done Farouk al-Kasim.

What a pity that the Iraqi government didn't let him run a similar scheme for the Iraqi oil. Things would be much different today.

</comment><comment><USER9> By coincidence, I recently watched the first episode of a TV show where Norway's oil resources contribute to a different kind of trouble.

[https://en.wikipedia.org/wiki/Occupied](https://en.wikipedia.org/wiki/Occupied)

<comment><USER10> Occupied is pretty good!

Check out Nobel if you want to watch another Norwegian political thriller with a focus on the interplay between energy resources and international relations- this time about a Norwegian guy who comes home from Afganistan only to become a pawn for international politics

<comment><USER11> It is russophobic.

The idea of Russia invading Norway to resume Norwegian oil production because the EU asked it is absurd.

Were it to happen in real life, Russia would be applauding Norway for rising the oil price and ramping up its own oil production as much as it can.

<comment><USER12> So you're saying that a fictional show is... fictional?

<comment><USER11> Imagine a movie depicting Jews baking matzos using the blood of christian babies.

Would you reply with the same "So you're saying that a fictional show is... fictional"?

<comment><USER13> Russia is a state that has occupied at 7/8 European countries in the last century.

Judaism is a somewhat vaguely defined cultural/religious grouping.

In European history the last large scale attempt to blur the distinction between race and state ended with attempted genocide. It's somewhat distasteful to continue repeating that mistake.

<comment><USER11> Your attempt to justify russophobia is distasteful.

All this nonsense like 'we don't like Russian state but love Russian people" doesn't fool anyone.

<comment><USER13> I watched the TV series and it was actually remarkably sympathetic towards the Russians involved. The Russian government obviously wasn't very pleased with it, but I doubt the EU were either (it portrays neither state in a good light).

The way America treats Russia (in TV, movies and the media, where it's the bogeyman du jour), on the other hand, is vastly different and arguably quite russophobic.

<comment><USER11> Well, I must admit I stopped watching it after several episodes, perhaps I should get back to it.

</comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER14> The province of Alberta, Canada does something similar with it's Heritage Trust Fund. 30% of royalties are put away.

Current balance is $120B which is actually a lot considering the province has only 3M people (~$40,000 per person balance).

However, it's be rife with mismanagement.

<comment><USER15> You're very wrong. The current bslance is about $15 billion Canadian. $190 billion was the non-renewable resource money generated. They only out 30% in, unlike Norway's 100%, and they stopped adding money in 1987.

Alberts has an estimated population of 4.3 million, so they have about $3500 per person only.

[https://en.m.wikipedia.org/wiki/Alberta_Heritage_Savings_Tru...](https://en.m.wikipedia.org/wiki/Alberta_Heritage_Savings_Trust_Fund)

[https://en.m.wikipedia.org/wiki/Alberta](https://en.m.wikipedia.org/wiki/Alberta) (For population stats)

<comment><USER14> Ahh.. looked at the wrong numbers.

Regardless, if Alberta had done the same as Norway (100% of royalties), they still wouldn't have as much money in the fund.

</comment></comment></comment><comment><USER16> Living in Australia it breaks your heart to see how much this country has squandered a similarly historic natural resources boom.

Instead of taxing it heavily and using it to build an enormous pool of money for the common good, we've simply handed it over to private interests.

Australia has also squandered opportunity in its retirement system: 2.6 trillion in high fee individual accounts (1% given away to the financial sector in fees every year!) instead of in a sovereign wealth fund like Norway's with a fraction of the admin costs.

Every country with an interest in a wealthy, fair society should be following in Norway's footsteps.

Fun fact: Norway is mostly socialist. The government owns the majority of the country's wealth.

<comment><USER17> Someone replied to you but he deleted it. I meant to continue the conversation with:

If this article (referencing a 2008 paper) [https://www.theguardian.com/commentisfree/2014/jan/13/north-...](https://www.theguardian.com/commentisfree/2014/jan/13/north- sea-oil-money-uk-norwegians-fund) is to be believed, the UK had the same thing, but the money went to tax cuts for the rich. So it does smell like corruption to me.

[He talked about some conservative governments being corrupt, to which I think:] Conservatism is a con anyway, selling austerity as a pain that the citizenry needs to suffer to get a "healthy economy", which means cutting budgets where somehow the solution is to outsource things (e.g. with the NHS), meaning the private companies owned by the elites rake in the money. And then they sell the "it's the immigrants who are overtaxing our resources" to get the public to vote for Brexit. (Where less EU regulations mean the elite will have more power to influence the government to allow worker exploitation)

<comment><USER18> In Norway it's EU regulations that makes it easier for the conservatives (and the last 20-30 years the social democrats) to privatize the economy and exploit workers. EU is a neoliberal project with some benefits for the common man.

<comment><USER19> Norway is not in the EU.

<comment><USER20> Nonetheless, plenty of EU driven rules apply in Norway. So gp's statement could be true.

[https://en.m.wikipedia.org/wiki/Norway–European_Union_relati...](https://en.m.wikipedia.org/wiki/Norway–European_Union_relations)

<comment> village-idiot Mostly around trade, so that Norwegian products can be sold in the EU and vice versa without secondary inspections. Only 21% of EU laws apply to Norway, and I don't see any evidence that the EU could do anything like force Norway to privatize things.

</comment></comment></comment></comment></comment></comment><comment><USER21> > Inflows of hard currency push up prices, squeezing the competitiveness of > non-oil businesses and starving them of capital.

This is true for any kind of industry that a country has a competitive advantage in.

<comment><USER13> There's a vast difference in the effect on a country depending on whether its competitive advantage comes from resources or people though.

If it comes from resources then the incentive to develop the people is lost and they're either bought off or ignored. Look at what happens in Russia or Venezuela or Saudi Arabia.

<comment><USER21> So what's wrong with being bought off? People in Kuwait have it very well.

<comment><USER13> In the 17th century Bolivia was considered the richest country in the Americas because of the Potosi silver mine while the eastern seaboard of America was basically a poverty stricken nowhere.

Now Bolivia is the poorest country in the Americas and the US is the richest. This is basically why.

The answer is - it works fine until the resource price drops or you run out of it.

Kuwait may be fat and content now but it has a dark future ahead of it once they stop being able to live off foreign cash.

</comment></comment></comment></comment><comment><USER22> To me this is a story of immigration.

Europe is currently 'struggling' with immigration, the subtext being they don't bring skills, lower wages for the poorest, etc.

Here you have an immigrant that brings massive wealth to a country, (and he's essentially a healthcare tourist!)

<comment><USER23> I think, you are missing half of the context.

He is Iraqi, but his wife is Norwegian. They met in London, during his study. They have a child together, who need cares only available in Norway.

In most countries this kind of immigration is doable (high skills and related to the country by marriage). Is it called immigration?

Migrants moving to a country without having an initial link with that country is a more complex problem.

<comment><USER24> I thought immigration _wasn 't_ possible in most countries if you have dependants with considerable healthcare needs?

</comment></comment></comment><comment><USER25> Such an inspiring story. And so frustrating given the political push by Trump and Brexit to make it much harder for talented foreigners to immigrate.

</comment><comment><USER26> >>Such resignation reflects bitter experience of the way that dependency on natural resources can poison a country's economic and political system. Inflows of hard currency push up prices, squeezing the competitiveness of non- oil businesses and starving them of capital. As a result, productivity growth withers (a phenomenon known as "Dutch disease" after the negative effects of North Sea gas production on the Netherlands).

That's an incorrect summation of the "Dutch Disease". Productivity growth doesn't suffer. Productivity growth, or GDP growth, increases with higher oil output.

The Dutch Disease is a politically slanted term to describe how other industries languish when one expands. But a rise in oil production is not associated with declining productivity growth, and the Dutch Disease theory does not include that proposition. A rise in oil production/exports makes an economy more capital-rich, which raises productivity.</comment>


Ask HN: Optimal number of employees? - <AUTHOR>

How do I determine how many employees I should hire for my startup throughout its lifecycle? <comment><USER2> Look for bottlenecks. Are you overwhelmed with work? Can you partition off some of the work and explain it to someone else to do in less time than it takes for you to do it yourself? Will the work bring in more money than that person will cost?

If the answer to all those is yes, it's time to hire. Otherwise, it's not.

<comment><USER3> This works in most cases but "Will the work bring in more money than that person will cost" sometimes isn't so cut and dry.

Customer service is a great example of this. A good CS person is going to create value for you in the long run (retaining customers, and preserving relationships). Your still going to be aligning income to staffing, but the numbers may be a bit less tangible in some cases.

</comment></comment><comment><USER4> I'm assuming you're asking how to do this in advance, rather than how to make each hiring decision. A few ideas:

\- Hiring is only part of your wider planning process. Do you know what you need to do in the future? If so, use that as a guide.

\- Hiring is only part of your wider budgeting process. You will want to create a financial plan for your business, in order to force yourself to be explicit about your assumptions, and to work out whether there is a viable business there.

\- Other similar companies may provide some indication of what you need, e.g. if you're a SaaS business then you could look at other SaaS business with similar customers and deal sizes, to figure out how many sales people you need for a given volume of sales. But you should probably do your own thinking bottom up first, rather than just triangulating from external data.</comment>


Show HN: Bitrated – reputation management and consumer protection for Bitcoin - <AUTHOR> https://www.bitrated.com/?v2

<comment><AUTHOR> So, after originally launching Bitrated as an MVP [1] more than a year ago and getting some very positive responses, I spent the last 10 months working on a new release at a full-time capacity. This is the result. :)

The new release is a complete rewrite of the original product, focused around identity & reputation, and with a much smoother user interface.

I would love to hear your thoughts and answer any questions you might have.

[1] [https://news.ycombinator.com/item?id=6842697](https://news.ycombinator.com/item?id=6842697)</comment>


Ask HN: As a senior systems administrator, should I get into programming? - <AUTHOR>

Hello everyone.  Let me start off with a little background about myself.  I used to do a lot of freelance IT work and now I'm working as a system administrator for a major healthcare provider.  I've been doing this for very long time and I feel like I really want to move on and do other things.
I am 32 year old college dropout that basically self thought myself computer repair, software, system management, web design, etc.  I like learning new things.  I have a loving wife and an autistic 3 year old child that I love very much.  I always feel like I want to do more and to better provide for my family.
During my spare time, I try to read up on things and learn as much as I can.  I've been dabbling with C# on and off for a couple of years, nothing serious.  I do have some C++ background from college.
I've been reading HN for many years now and sometimes I see topics that basically suggest getting into programming field, you really need to be a younger person since older folks seem to get passed by.  Is this still true today?  Should I completely delve into the world of programming or should I stay away from it? <comment><USER2> As a _senior_ systems administrator? I'm surprised you're senior _at all_ if you don't have any programming skills. You can't tell how the system works if you've never written a program that interacts with OS. Moreover, operatios is a field with still much, much to do; I often find myself writing missing stuff (I'm a sysadmin myself).

Funny enough, being sysadmin I'm not seen as a programmer, so I'm not tied to any technology my employer is attached to and I can use any programming language I find appropriate (Python, Perl, Ruby, Erlang, C, you name it). A freedom that is rarely found among regular programmers.

<comment><AUTHOR> Why does that surprise you? I do a lot through powershell. I oversee and manage our Active Directory, Exchange, Citrix, and System Center Configuration Manager. We're a Microsoft shop.

</comment></comment><comment><USER3> One of my companies recently hired a 58-year-old who had majored in electrical engineering, worked as a project manager for decades, and then wrote a few iOS apps in his spare time before applying to jobs as a developer.

It turned out that he was absolutely terrible at coding, but my point is that we gave him the job regardless of age and unrelated experience. Since he had been working for so long, we paid him a much better salary than an entry-level person might have gotten.

My suggestion is to write code in your free time, complete some real (hopefully interesting projects), commit to a few open-source projects, and then give you resume to some recruiters.

<comment><AUTHOR> Thanks for the info. I may have to look into some open-source projects and maybe make a few of my own and release it out to public.</comment></comment>


The Urban Legend of the Government's Mind-Controlling Arcade Game - <AUTHOR> http://www.atlasobscura.com/articles/the-urban-legend-of-the-governments-mindcontrolling-arcade-game <comment><USER2> Before The Last Starfighter was made, I once read a legend about the Defense Department using arcade games to recruit pilots for interplanetary combat. Omni magazine had asked readers to send in the best urban legends. I don't know what issue it was or the exact text of the legend.

</comment><comment><AUTHOR> If its not been referenced by the Simpsons, is it a real urban legend?</comment>


IBM at CES 2019 outlines Q System One quantum computer - <AUTHOR> https://www.zdnet.com/article/ibm-at-ces-2019-outlines-q-system-one-quantum-computer/ <comment><USER2> It's really nice to see a good-looking computer. Not that the Z's aren't cool, but they are, essentially, large black bricks.</comment>


We just got a web site takedown request. Not entirely sure how to proceed: - <AUTHOR> http://blog.bytemark.co.uk/2014/06/09/live-railway-cameras-from-yo26-in-york#comments

<comment><USER2> _groan_

Times like this I miss working at Bytemark!

<comment><AUTHOR> But now you can have the view out of our window permanently on your screen!</comment></comment>


An Introduction to Decision Trees with Julia - <AUTHOR> http://bensadeghi.com/decision-trees-julia/ <comment><USER2> "Also, keep in mind that even though the construction of decision trees may be expensive, the classification of a new sample is just a walk down the tree, and so, is very fast."

I would say decision tree training is very fast compared to other methods. That's the main benefit of decision trees vs. neural nets (iterative back propagation), MCMC (sampling), SVM (O(n^3)).

I can't think of any mainstream technique that's faster to train. (k-nearest is fast in training but slow in prediction so that doesn't count).

<comment><USER3> For what it's worth, I don't think it's fair to claim that SVM is O(n^3).

From [1], LibLinear trains linear SVMs in O(nd log (1/p)) time, where n is the number of examples, d is the number of features, and p is the optimization tolerance, and Pegasos/FOLOS and other subgradient methods can do online kernel SVM training in O(s / λ p) iterations, where s is the number of non- zero features in each example, p is as above, and λ is the regularization parameter.

There are also lots of ways to speed up decision tree training from the naive approach - I explain/implement some in [2] (and in the Go decision tree library I worked on [3]), and there are many more (bucketizing, presorting, etc). The bound I've seen is O(mn log m + mnT) with T rounds, m examples, and n features.

[1]: [http://cseweb.ucsd.edu/~akmenon/ResearchExam.pdf](http://cseweb.ucsd.edu/~akmenon/ResearchExam.pdf)

[2]: [http://tullo.ch/articles/speeding-up-decision-tree- training/](http://tullo.ch/articles/speeding-up-decision-tree-training/)

[3]: [https://github.com/ajtulloch/decisiontrees](https://github.com/ajtulloch/decisiontrees)

<comment><USER2> Oooh that's some cool stuff. Incremental Tree training is really nice!

I generally use random forests so I can control the subset sizes pretty easy. Its generally not worth me tweaking stuff beyond that. I am generally applying techniques rather than doing machine learning research so the gains are not really worth it for me.

</comment></comment></comment><comment><USER4> The expressiveness of Decision Trees lends itself to other applications. I'm looking at how we might apply the ideas behind Decision Trees in UI/UX modeling and UI testing. (Slightly off subject but) [https://github.com/Huddle/PhantomFlow](https://github.com/Huddle/PhantomFlow) attempts to do this. Breaking away from conventional testing approaches is interesting enough, but having the tests produce mine-able, visualize-able data is a great way to better understand system complexity.</comment>


Facebook is predicting if you'll kill yourself. That's wrong - <AUTHOR> https://www.theguardian.com/commentisfree/2019/jan/30/facebook-is-predicting-if-youll-kill-yourself-thats-wrong <comment><USER2> The never-ending seesaw of responsibility: years ago, people complained that Facebook was doing nothing despite having access to critical information, at the right time, that could save lives by preventing suicide.

Now that Facebook responds to those criticisms - that's wrong too.

I've never seen such a clear demonstration of "damned if you do, damned if you don't" over the last few years as criticisms toward Facebook.

<comment><USER3> Are you seeing these criticisms from the same people, or from different groups, who might have differing opinions?

When you become as big as Facebook, there are going to be arguments about your moral responsibility, and not everyone will agree.

</comment></comment><comment><USER4> I think the comment around HIPAA is particularly important: hospitals and other entities collecting health information are required to have extremely strict data privacy standards. Suppose Facebook started selling your suicide risk to insurance companies? Suppose they leaked? For those individuals, it would be a disaster, and one they had no control over. Regulation must come to Facebook and all the major tech companies that forces them to treat their data akin to personal health data.

</comment><comment><USER5> > Some of those risks include high false positive rates leading to unnecessary > hospitalization and forced medication, potentially violent confrontations > with police, warrantless searches of one's home,

None of these are a problem of Facebook identifying people at risk for suicide.

All of them are American problems that are outside Facebook's control.

It's ridiculous to me to suggest someone is going to be forced into hospital against their will because of a Facebook algorithm. That cannot happen in England. The US system is hopelessly broken if it happens over there.

</comment><comment><USER6> > "Ever since they've introduced livestreaming on their platform, they've had > a real problem with people livestreaming suicides," Marks says. "Facebook > has a real interest in stopping that."

[https://www.npr.org/2018/11/17/668408122/facebook- increasing...](https://www.npr.org/2018/11/17/668408122/facebook-increasingly- reliant-on-a-i-to-predict-suicide-risk)

<comment><USER7>
      "Facebook has a real interest in stopping that."

Stopping the _live streaming_ , not the suicides themselves.

</comment></comment><comment><USER8> Next step: Facebook detects you're at risk of committing suicide and starts increasing the influx of positive posts to your timeline.

<comment><USER5> They already target adverts for talking therapies to this group.

<comment><USER9> I would think that adverts for talking therapies should go to any friends of the suicidal person.

The suicidal person would be much more interested in purchasing stuff like rope, pills, life insurance, inert gas, and firearms.

<comment><USER5> Weirdly, because I research suicide a lot I do sometimes get adverts for rope.

There doesn't seem to be a way to tell ad-tech companies about this.

Here's one example: [https://imgur.com/hhOYUJb](https://imgur.com/hhOYUJb)

</comment></comment></comment></comment><comment><USER10> This sounds similar to "swatting". Facebook can now order the police to come into your home without a warrant.</comment>