Should Google kill the Nexus One? - <AUTHOR> http://gigaom.com/2010/01/19/should-google-kill-the-nexus-one/

<comment><USER2> I don't know how many of you actually own a Nexus One, but I bought one, and I can't see why everyone is considering it such a failure. Having used an iPhone and an HTC Magic I think the Nexus is a big leap.

It does more than the iPhone out of the box - IM, free contact, calendar and Facebook sync, native Gmail, turn by turn navigation, and tons of technological improvements and finely tuned small details. Granted, it's not a revolution, just evolution, but it is the best phone out there right now.

Also, the 20,000 figure (for first week sales) that keeps being quoted everywhere is just a ridiculously inaccurate statistic.

</comment><comment><USER3> Absolutely not; however, I feel that Google made a big mistake. It released a Minimum Viable Product, which might have been okay for other companies to do, but because Google is such a large brand name- and such a large part of the internet- it is expected to come out with an amazing product.

A minimum viable product phone is simply not acceptable for someone like my mother who would by the phone because it has Google's name on it. (Yes. I understand that example has a fallacy or two, but it should make my point clear.)

On the other hand, I keep on getting more and more interested in this phone!

<comment><USER4> I think expectations need to be pretty stratospheric for the Nexus One to be considered a "minimally viable product".

<comment><USER5> The iPhone was over two years old and extremely common when the Nexus One was released. Its once-astonishing features are now considered kind of routine. Its level of polish is rapidly becoming the industry standard.

The minimum is always moving.

It would be a different story if the Nexus One were tailored for a niche market. And, in fact, it arguably is: for much of the _geek_ target market, the market of people who know what multitasking is and thrill to read the fine print on the contracts at the Android App Store, the Nexus One is far _more_ than a minimum viable product. And so it seems to get a lot of buzz in that market. Hopefully its market is large enough to sustain something like it.

</comment></comment></comment><comment><USER6> Killing it makes very little sense when the vast majority of the capital investment has been made already.

Further, whatever possible (unlikely) brand damage a moderately unsuccessful piece of hardware would do to Google it would pale in comparison to what would happen if they pulled it from the market.

Google isn't the kind of company that needs things to be an overnight success, I think in the long run they will gain ground.

</comment><comment><USER7> no one launches a phone (or anything) correctly off the cuff. Apple were simply clever enough to launch their first phone, the Motorola iTunes enabled phone, with a different brand.

Give Google a year and they'll be fine.

</comment><comment><USER8> They should brick the cell modem's firmware and sell them for ~$200 as iPod Touch competitors.

<comment><USER9> I also thought that after some guy's post asking for a $150 Android phone with no cell connection.

I wonder how cheaply one could be manufactured by someone that wasn't Google or an existing manufacturer. I wouldn't want to get in a business trying to compete with Apple based on price alone though. Maybe if your handset completely supported Google Voice for unlimited minutes over a T-Mobile prepaid data only SIM card for $30/month but I'm not sure if the carriers and Google would allow you to do that.

<comment><USER10> No need to manufacture it yourself. There are dozens of phones/media players on Alibaba which can be purchased cheaply and hacked to your heart's content. I actually considered picking up one of the existing Linux ones and making it run Android, then reselling it. You can get decent hardware from there for $100 for a single unit, even cheaper if you do it in bulk (even 10 units in certain cases).

<comment><USER9> Does anyone think that a viable business exists here? Happy to explore it with people via email.

<comment><USER10> I'd be interested in working on it. I think it'd be low cost to get it up and going; even if it doesn't work, you're out a few hundred bucks in dev units and a few weeks' work. The biggest problem, IMO, is finding a vendor that will dropship pre-flashed units to customers. If you can find that, the rest is cake. It's considerably more expensive if you have to have the units shipped to some central facility for flashing before they hit the doorstep.</comment></comment></comment></comment></comment>


Email campaign suggestions based on a Piazza campaign gone wrong. - <AUTHOR> http://jtfairbank.com/blog/piazza-email-campaign-suggestions/

<comment><AUTHOR> Hello Hacker News! This is my first blog post ever, so please give me feedback if you see anything wrong or that I can improve on. :)

Also, if anyone knows more about FERPA than I do, can you comment on if Piazza's use of student email addresses is illegal? What about its access to the classes students are taking and the use of that information in the email campaign?</comment>


Show HN: POSHPO learns your taste in fashion (women only) - <AUTHOR> http://www.poshpo.com/

<comment><AUTHOR> Hey guys,

We're a bootstrapped team of 2 from Israel, and we just launched our public beta today.

We think the experience of shopping for clothes online is far from ideal, due to the overwhelming quantity of items and stores, and a lack of intelligent personal recommendations. We're basically still browsing massive catalogs.

POSHPO wants to fix that. Using textual analysis, we identify every item's unique features. We then leverage machine learning (specifically, naive bayes) to learn every user's preferences and show them items we think they'll like.

We'd appreciate any feedback. We can also be reached at email@example.com

</comment><comment><AUTHOR> Since HN is very much male-oriented, this is a good place to ask - any guys who would like to see POSHPO for men?

We can quite easily integrate men's fashion into POSHPO, but I'm wondering about the actual demand.</comment>


Scaling web apps (sets of slides by Flickr architect) - <AUTHOR> http://www.iamcal.com/talks/ <comment><USER2> It seems like a lot of this information is pulled directly from Cal's book "Building Scalable Web Sites" (Amazon: http://www.amazon.com/Building- Scalable-Web-Sites-Applications/dp/0596102356/). If you are interested in gaining some of the spoken context behind the slides, this is a great read. It was reviewed on slashdot a while back (http://books.slashdot.org/article.pl?sid=06/07/26/1357210). If your venture is a site that is going to eventually need to scale due to high resource consumption from individual users (whether this be storage, CPU, or database requirements) I suggest you pick up a copy of this book to know how to better address this concern during design rather than in deployment!

</comment><comment><USER3> Cal Henderson also has a Carson Workshops 'survival kit' available. Its called 'Building Enterprise Web Apps on a Budget' and its available from http://www.carsonworkshops.com/shop/PHP_Henderson.html. I havent purchased it myself but Carson Workshops normaly produce some top notch kits.

</comment><comment><USER4> And Cal Henderson is a Brit too ;)</comment>


Staying at the forefront of email security and reliability - <AUTHOR> http://googleenterprise.blogspot.com/2014/03/staying-at-forefront-of-email-security.html <comment><USER2> So how does this work when the CA's are less than reputable, Google has to comply with various homeland security acts, they didn't notice people tapping their fibre, have had numerous problems with their own staff and they have done evil before?

Sounds like marketing fluff to me.

<comment><USER3> They have addressed and/or solved some of those issues:

>So how does this work when the CA's are less than reputable

Chrome has been using certificate pinning for Gmail for quite some time. Not sure what has been implemented in other browsers yet.

>Google has to comply with various homeland security acts

That's a legislative issue, and not something Google can fix. I would argue their track record on pushing for new legislation in that area is quite okay.

>they didn't notice people tapping their fibre

Traffic passing between their DCs is now being encrypted (well, it's been confirmed for Gmail.)

>have had numerous problems with their own staff

I can think of two cases from the top of my head. There's always going to be a small group of people who need full access to production data to do their job. All they can do is keep that group as small as possible and audit everything.

>they have done evil before?

please elaborate.

<comment><USER4> > Traffic passing between their DCs is now being encrypted (well, it's been > confirmed for Gmail.)

Encrypted how? With what keys? There's still a single point of failure to capture a huge amount of GMail traffic and an aggressive adversary who has penetrated Google's networks before. Google could be saying this and still handling over the keys to the gov't. The key is increasing the cost of bulk surveillance. This doesn't help. The only acceptable solution is one where I encrypt my data with my own keys.

> That's a legislative issue, and not something Google can fix.

Yes, but technical architecture changes what it means for Google to comply. If all they have is my encrypted data, that's all they can hand over.

<comment><USER3> Sure, that's a valid point. That's something that is true for any email provider though. Google isn't stopping you from encrypting your mail, and you can't really expect them to force their users to do that, because sadly, the majority doesn't care and would switch to other providers who wouldn't _annoy_ them with that whole encryption stuff.

<comment><USER4> That's the point: Google has their own interests, and they're not aligned with my privacy or security, except to not be embarrassed. There is a lot they could do besides forcing encryption on everyone, but I honestly think they have other priorities.

</comment></comment></comment></comment></comment><comment><USER5> Email security? How do they do that when they are data-mining everyone's inbox? Most of us have a choice on using Gmail, some kids don't [http://www.alternet.org/education/do-no-evil-google-sued- dat...](http://www.alternet.org/education/do-no-evil-google-sued-data-mining- kids-emails-its-education-app)

<comment><USER6> I guess the new changes are meant to guard against some external actors, while internal actors will continue to have unencrypted access like this fiasco from a while ago.

[http://gawker.com/5637234/gcreep-google-engineer-stalked- tee...](http://gawker.com/5637234/gcreep-google-engineer-stalked-teens-spied- on-chats)

<comment><USER7> Google has long since implemented other measures to safeguard against internal bad actors.

<comment><USER6> So if Larry Page wants to read my email, he cannot? I somehow doubt that.

<comment><USER8> He has greater disincentives than anyone else, and 3rd party hosts have the ability to read your email no matter where you host it.

</comment></comment></comment></comment></comment><comment><USER9> Encryption is irrelevant when one party will give out the info for a price.

<comment><USER10> Google does not, nor have they ever, as far as I'm aware, sell personal user information to third parties. Google sells ads targeted at keywords and other interests, and while in an indirect way, this is profiting from user behavior, it is not the same as claiming they give out your personal info.

Using third party hosted mail is a trade off, especially webmail. Unless you are using end-to-end encryption, intermediary servers will need plaintext access, not only to route the email, but to present it, to permit search, filtering, and other operations users value in the webmail client.

Google is taking steps to ensure all data is encrypted-at-rest and encrypted- in-flight. That's not a perfect defense, but it is an improvement. What is to be gained by bashing them for taking positive steps that everyone in the industry, we hope, are also taking?

<comment><USER11> For money, one could have Google provide ads to users who vote for specific party. After a few days, you look at the logs and create a database of people and their voting habits. Thus you will now have a database of personal information, created by the action of giving money to Google. When you pay money for a product, its called bought.

So I will call it bought personal user information, regardless if it has been laundered by advertisement clicks.

<comment><USER10> How is Google going to know what party you voted for, when votes are by secret ballot? Voter registration databases, which are public information available for a small fee from state governments, are far more likely to yield a profile of your voting behavior than your gmail contents.

Not only that, but anyone can opt-out of interest based ads for Gmail. Just go to Ad Settings ([https://support.google.com/ads/answer/2662922?hl=en](https://support.google.com/ads/answer/2662922?hl=en))

You have the choice of not seeing targeted and relevant ads, or of not using gmail at all. Try Fastmail for instance. I don't see the need to bash Google for doing the right thing on security.

</comment></comment></comment></comment><comment><USER12> I'd like to see Google evangelize and hand out to their competitors, no strings as with SPDY, any technology they develop or contribute to that helps people communicate securely, and their competitors doing that as well.

<comment><USER13> What tech would you like to see open sourced?

</comment></comment><comment><USER14> It is incredible that gmail even had HTTP enabled. It was an option in the gmail account settings. Honestly I am ashamed it took this long.

Their documentation stated that by default HTTPS was enabled, but this wasn't the case for me. Mine was set to HTTP and all my emails were disclosed whenever I accessed them from firefox (which I guess doesn't have the pins for auto https in gmail like I'm assuming chrome does).

<comment><USER15> You're ashamed it took this long for google, but not ashamed you didn't notice you were accessing with ssl?

<comment><USER14> Clearly I did notice otherwise I wouldn't have a personal story about how I noticed.

Also, there isn't much you can do. You type in gmail.com, and on one browser I would be automatically taken to https for years. I switch to a different browser (I only use burp with firefox) and it is suddenly http. Easy OpSec failure to make.

<comment><USER16> Gmail has defaulted to an encrypted connection for over four years years now, including redirecting if you attempt to access over http (yes, even in Firefox). Really the only way that setting could have been made is if _you_ made it at some point. Everyone else was opted in to https access.

 _" We are currently rolling out default https for everyone. If you've previously set your own https preference from Gmail Settings, nothing will change for your account. If you trust the security of your network and don't want default https turned on for performance reasons, you can turn it off at any time by choosing "Don't always use https" from the Settings menu."_

And seriously, you accessed your email for years over an http connection and never even searched to find out why that was happening?

[http://gmailblog.blogspot.com/2010/01/default-https- access-f...](http://gmailblog.blogspot.com/2010/01/default-https-access-for- gmail.html)

<comment><USER14> You clearly did not understand what I said. I wrote that I used chrome, which I assume has a pin for google sites because even when you allow HTTP in your Gmail account, you would be taken to the HTTPS site.

Then, when going to firefox, It would take me to gmail over http. This is because my account was set to http (by default) and chrome doesn't allow connections to gmail over anything but https.

I accessed gmail one time over http in firefox (when I was connected to burp) before I realized there was a problem. My account had been set to "Allow Connection of HTTP" for years, but chrome will only connect with https.

Despite what they say was default, a few of my friends and I experienced a bug where ours was set to "Allow HTTPS" but we didn't realize it since we were using chrome.

</comment></comment></comment></comment></comment><comment><USER17> > In 2013, Gmail was available 99.978% of the time, which averages to less > than two hours of disruption for a user for the entire year.

Does anyone understand why they use the term "averages" in this statement? What is being averaged? Isn't it just 0.022% * minutes in a year.

<comment><USER18> I think this means not all outages tracked affected all users equally. Some users would have seen more or less downtime than the 2 hours mentioned.

<comment><USER17> You are probably right. In which case they should also mention that 99.978% is also an average.

</comment></comment></comment><comment><USER19> Is really depressing reading the cynical comments right here.

<comment><USER20> Being cynical is the only way security works.

</comment></comment><comment><USER21> What are some good alternatives to using Hosted Gmail (custom domain)?

I know of Gandi and fastmail.fm [hosted in US though, so not much of an improvement].

<comment><USER22> zoho mail, it's a breeze (1-2 mins) to add in a new domain.

</comment></comment><comment><USER18> Am I the only one that's not that impressed by 2 hours of downtime a year? I've worked at other companies where I was responsible for running a service and 2 hours of downtime a year was considered a failure.

</comment><comment><USER23> Nice to hear they're reacting to the revelations by Snowden. I guess the government will have a harder time eavesdropping mails at Google without them noticing.

<comment><USER24> They were "shocked" and "outraged" at the NSA datacenter hack [0]

[0] [http://money.cnn.com/2013/11/04/technology/google-nsa- snowde...](http://money.cnn.com/2013/11/04/technology/google-nsa-snowden/)

</comment></comment><comment><USER25> And UI clutter</comment>


The most popular university major in the US leads to the least fulfilling work - <AUTHOR> http://qz.com/275139/the-most-popular-university-major-in-the-us-leads-to-the-least-fulfilling-work/

<comment><USER2> This is, I think, an interesting topic, but there are a few things I find troubling/puzzling about the article:

(1) It makes a big deal out of small differences.

> While computer scientists may make the most money right out of school, > business is a more lucrative path in the long run. The 95th percentile of > business majors (including graduate degrees) in terms of salary make $4.23 > million over a lifetime, compared to $3.93 million for computer science > majors, according to data collected by The Hamilton Project.

Okay, 7.6% more. Wow. The differences in the "strongly agree" percentages are a bit higher, but still not that big. I'm wondering whether the latter differences might be _entirely_ chalked up to cultural differences in the fields that make people assign different meanings to "strongly agree" and "deeply interested".

(2) Looking at that 7.6% salary difference again, I have to wonder whether it's even correct. Part of the point of a business degree (or so I thought) is that you get a chance at the high levels of corporate leadership, where you get to make the big bucks. And yet, the _95th percentile_ of business majors makes barely more than the same percentile of C.S. majors? That doesn't sound right.

And that 95th percentile makes $4.23 million over their entire lifetime. Counting the working life as 42 years, that's just a hair over $100,000/year. Sounds seriously low to me. We're supposed to believe that only 5% of business majors make more than $100,000/year?

Or maybe business degrees are just a gigantic racket. But somehow I doubt that, too.

<comment><AUTHOR> Your response was pretty well thought out.

I also immediately had a red flag with....

" We're supposed to believe that only 5% of business majors make more than $100,000 a year"

Totally Agree</comment></comment>


Windows 3.1 in my BIOS? It's more likely than you think - <AUTHOR> https://hackaday.com/2019/04/10/windows-3-1-in-my-bios-its-more-likely-than-you-think/ <comment><USER2> >"Windows 3.1 in my BIOS? It's more likely than you think".

That is a pretty misleading title to me, it sounds like they discovered many bios's have embedded windows 3.1 to run the user interface.

Instead its about someone purposefully loading windows 3.1 onto their bios flash chip, and how they made it functional. "How i embedded windows 3.1 into my bios" or something would be a more descriptive title.

edit: Or even "Windows 3.1 Flash edition", as the original page & hn post have, [https://news.ycombinator.com/item?id=19630502](https://news.ycombinator.com/item?id=19630502)

<comment><USER3> I seem to remember that Compaq business PCs in the late 1990s/early 00s had BIOS/NVRAM setup that looked suspiciously like a customized build of Windows 3.1. You held ESC or something during boot and you got a mouse-driven interface to set various hardware settings. I remember it being quite the contrast to the more common text-mode menu based BIOS setups.

I never looked into it whether it was actually in ROM/Flash or whether it booted off a special disk partition.

Here are some screenshots I found that kind of match what I remember:

[https://www.flickr.com/photos/55026075@N00/4140236576/in/pho...](https://www.flickr.com/photos/55026075@N00/4140236576/in/photostream/) [https://www.flickr.com/photos/55026075@N00/4139477409/in/pho...](https://www.flickr.com/photos/55026075@N00/4139477409/in/photostream/)

<comment><USER4> I remember some of those old BIOSs that were quite UI involved.

I always thought "This is really neat... not sure it was worth the effort for a BIOS..."

Granted in those days users were more likely to be in the BIOS to do something than today.

<comment><USER5> Yet, the BIOSes both of the last motherboards i bought (one recently, another 3-4 years ago) had some very elaborate UIs, with skinned menus, star backgrounds and a bunch of other frivolous stuff. I think one even had some sort of background ambient sound.

Keeping with tradition though, the "help" screens of every option was as helpful as the "help" screens of my 386DX, Pentium MMX and Athlon64 desktops of decades prior, with entries such as the help for "Select frobation mode: FOO" being oneliners such as "Frobation mode, can be FOO or BARF" (but what the hell does frobation mode do and what do the FOO and BARF options mean?).

<comment><USER3> I think I still have somewhere a pile of paper booklets that came with old motherboards that have similarly unhelpful descriptions of various settings.

</comment></comment></comment></comment></comment><comment><USER6> Please use the author's page directly: [https://sakamoto.pl/weblog/07-windows-3-flash- edition/](https://sakamoto.pl/weblog/07-windows-3-flash-edition/)

<comment><USER7> Why?

<comment><USER8> [https://news.ycombinator.com/newsguidelines.html](https://news.ycombinator.com/newsguidelines.html)

> Please submit the original source. If a post reports on something found on > another site, submit the latter.

(Except when the original source is not casually consumable without the context, but the original post is quite readable.)

<comment><USER7> Thank you! I did not know.

</comment></comment></comment></comment><comment><USER9> (Since this is a problem I've had also.)

> I've tried changing the fifth case to 2 heads, 80 tracks and 72 sectors... > But it resulted in an I/O Error.

This happens because the BIOS (int 13) CHS read function encodes the sector number as a 6-bit value. (IIRC it's also 1-indexed, just to add insult to injury.) If you change the geometry to 2head/80[+]track/60sector, it works on everything I had on hand for testing half a decade ago.

+: Or more; it _should_ work with up to 1024 tracks.

</comment><comment><USER10> Regarding the audio: I don't know about that specific model but I believe it uses standard Intel HD Audio (Azalia) --- and someone has written an HDA driver for Win3.x that goes by the name of "HDADRV9J" (complete with source code, albeit somewhat messy, in Pascal):

[http://www.vcfed.org/forum/showthread.php?50867-Windows-3-1-...](http://www.vcfed.org/forum/showthread.php?50867-Windows-3-1-drivers- for-newer-hardware&p=511252&styleid=3)

[http://turkeys4me.byethost4.com/programs/index.htm](http://turkeys4me.byethost4.com/programs/index.htm)

(This stuff is notoriously difficult to find. I only found out about HDADRV9J from Google a few months back, and there were quite a few sites about it, now there's almost no results...)

</comment><comment><USER11> > This was achieved via a DOS USB driver (if the device got hotplugged, > R:\WINDOWS\USB\USB.BAT is your friend)

DOS has USB drivers. This is the weirdest part.

<comment><USER12> DOS is still surprisingly usable in the modern world with a little work. That isn't super surprising though given how simple a system it is and how ubiquitous it was in the relatively recent past.

<comment><USER13> Worth mentioning that there are many DOSes: [https://en.wikipedia.org/wiki/DOS](https://en.wikipedia.org/wiki/DOS) FreeDOS was shipped with Dell and HP computers as recently as 2012.

</comment></comment></comment><comment><USER14> First, see the screenshots / video in the original article: [https://sakamoto.pl/weblog/07-windows-3-flash- edition/](https://sakamoto.pl/weblog/07-windows-3-flash-edition/)

That's Windows 3.1? It has the window borders of 3.1 (the weird "—" in the upper left, the white menu bar) but we've got "My Computer" and "Recycle Bin" on the desktop — desktop icons weren't introduced until Windows 95. There were icons in 3.1, but they were minimized programs, since there was so start bar at the time. (But, his video and one screenshot also have a start bar in them?)

<comment><USER15> Windows 3.x had at least one third-party extension that gave it a bit of the Windows 9x look and feel, including task bar, start menu, and desktop icons.

</comment></comment><comment><USER16> There's something fishy here. start button is a windows 95 thing not windows 3.1

<comment><USER17> It says he's using Calmira, to make it look like windows 95. You can see that the padding on the start button and status bar are a bit off, if you look closely. (Also of course the minimize/maximize buttons on the applications are unchanged.)

</comment></comment><comment><USER18> Back in the late 90s the 1.44 MB QNX demo disk was quite a thing; it shouldn't be too hard to have it run from a BIOS flash. Found it here as I couldn't find a link on QNX site. [https://winworldpc.com/product/qnx/144mb- demo](https://winworldpc.com/product/qnx/144mb-demo)

</comment><comment><USER19> Personally I'd have gone with DOOM but cool project nonetheless. ;)

Not a fan of Calmira though, I do appreciate the original Windows 3 aesthetic.

</comment><comment><USER13> I get the retro chic of an old Windows OS, but you could also package a window manager, web browser, text editor, and more in a floppy disk into the late 2000s using Linux. Compared to the multiple gigs of OS files needed to run Android on my smartphone, it's almost inconceivable how wasteful modern software is.

<comment><USER5> That is what you get for using 4096x4096 sized alpha blended HDR bitmaps for the icons and animated emojis on your 5" QUHD phone :-P.

</comment></comment><comment><USER20> This brings up a question. Why haven't manufacturers put a basic kernel in rom so that computers power on instantly? Does anyone know?

</comment><comment><USER21> Such a great hack!

I wonder if we can put some modern-day OS in the BIOS flash.

I think the NetBSD kernel would fit, but I'm not sure how a GUI could be possible...

</comment><comment><USER22> Didn't Windows once ship on a ROM chip? I seem to remember PCs with Windows ROMS around the 386/486 era. Pre-Win 95

<comment><USER23> "Modular Windows"

As used for the Tandy VIS, MS's first console.

[http://www.computercloset.org/TandyVIS.htm](http://www.computercloset.org/TandyVIS.htm)

</comment></comment><comment><USER24> Anyone remember the DOS version of AOL that used GeoWorks for the GUI?

</comment><comment><USER25> MS Windows of some 3.x variety was apparently the original selected GUI for the Atari ST, intended to be running from ROM… however, MS couldn't apparently get it to fit in less than a couple of megabytes, hex dumps of the code would show a hell of a lot of redundant x86 stuff in there, like references to hercules drivers and all manner of bloat that they couldn't strip. They seemed to be disassembling the binaries to translate to 680×0 assembly and kludging it that way rather than from source, which was always rumoured to be a complete mess for the early windows versions. Anyhoo, apparently Trammiel got pissed at MS for lack of progress on shrinking and refining it and went with a version of GEM instead.

<comment><USER26> Windows 3.0 came out in 1990, whereas the Atari ST came out in 1985, so that story definitely doesn't check out. Windows 1.0 came out in 1985 (though still much later than the ST) so maybe it was that?

<comment><USER19> I just wanted to add that the TOS ROM chips in the Atari ST were 192KB in total which is an order of magnitude less than what Windows would require. I'm assuming GP is thinking of another machine (maybe the TT / Falcon?)

</comment></comment></comment><comment><USER27> Remember the Mac OS and MacWrite fit on a single LOW-density 3.5″ floppy in 1984.

<comment><USER28> That's not too surprising. Early MacOS didn't provide much more than MS-DOS under the hood (non-hierarchical file system, manual multitasking), and the graphics were all 1bpp.

<comment><USER29> I didn't realise it didn't have a proper file system. Games were more glorified as far as user interface was concerned, e.g. the 2000 planet system with 3D graphics of the BBC Micro's Elite, running on an 8 bit 6502 machine with 32K usable RAM.

You can see the Mac OS as an expensive 'game' with the objective to write a letter, running on dedicated hardware.

</comment></comment></comment><comment><USER30> Reminds me of the 486 motherboard which would boot DOS with no SIMMs (RAM) in it. It had 64 kbyte cache on the motherboard...

<comment><USER31> Wait, wow, I've never heard of this. Do you have a link of this phenomena?

<comment><USER32> Don't know about the 486 specifically, but this sort of thing wasn't unheard of. I have a pentium-era machine with 8MB EDO built into the board. It can stand alone or complement whatever you put in your DRAM slots (though curiously, if you max it out at 4x32MB, you get 128MB, not the 136MB you might hope for...)

Edit: wait... I thought we were talking about something unusual because he mentioned SIMMs, and the 486 specifically, but I guess he's just talking about the conventional memory on x86 that peaked at 640KB. This is _not_ what I was describing above (that system has extended EDO built in _in addition_ to the conventional 640).

Don't have a specific link for you, but just look into the memory model of the IBM PC, conventional vs extended RAM, etc... 640KB (or less!) was _all we used to have_ , plugged right into DIP sockets.

When, in the late 80s, computing technology started increasing in power like mad, we quickly needed access to more RAM, but the original memory model held us back, so we had to hack around it in various awkward ways. So we ended up with the original on-board chips + SIMM expansion slots.

Looking back, we were so terribly shortsighted in our designs, and Moore's Law just continually blew everything to hell.

<comment><USER33> That's not what this is about. OP is talking about booting with just the external L2 cache (which I've seen vary from 64KB to 256KB) when no RAM SIMMs are plugged in.

<comment><USER32> So the cache can stand in for main memory when none was present? I'd be interested to see the implementation details, but alas, I must be going about my search wrong =(

Will have to look into it more when I have some more time.</comment></comment></comment></comment></comment>


Raising Money: What Not to Say and What Not to Believe - <AUTHOR> http://blog.guykawasaki.com/2012/01/raising-money-what-not-to-say-and-what-not-to-believe-officeandguyk.html#axzz1rVAYlbYD

<comment><USER2> It seems a little sad to see Guy rehashing such tired material, even if it is relevant.

</comment><comment><USER3> "In a recession, people are cheap or free" would be a nice memory from 2009, but doesn't seem true now.

</comment><comment><USER4> "Promotional consideration paid by Microsoft." Curious.

<comment><USER5> Ah, not so curious. He's on the MS payroll now (as he's mentioned a good 4 times in that post).</comment></comment>


S3 trickery: using it as a scheduler - <AUTHOR> https://hackernoon.com/s3-trickery-using-it-as-a-scheduler-c618103b1cf2 <comment><USER2> We're taking this serverless thing too far. We're coming up with elaborate overcomplicated schemes to accomplish simple tasks just so we can say "we're not running a server for this".

Instead of doing the simple thing and running a server process that periodically checks some queue for tasks to execute, this "scheme" involves triggering a lambda function every minute, to do some IO operations on a distributed file store where the execution date metadata is embedded in the filenames to see if there is some task to execute. If there is, some more distributed IO operations are required to move the file to another part of the distributed file storage, where some listener will notice a new file was added and trigger the actual lambda function with the task-specific code...

But hey, you're not running any servers yourself...

<comment><USER3> Don't blame Serverless. Blame it on a poor implementation. AWS Cloudwatch supports cron rules that include the year that it should be scheduled and it can trigger lambdas directly. There was no reason he had to over complicate this.

As far as using a queue, lambda also supports triggering based on a queue.

</comment></comment><comment><USER4> Azure's service bus queue has a much better solution for this: you can schedule an item to appear in the queue at any future time. [https://docs.microsoft.com/en- us/dotnet/api/microsoft.servic...](https://docs.microsoft.com/en- us/dotnet/api/microsoft.servicebus.messaging.brokeredmessage.scheduledenqueuetimeutc?view=azure- dotnet#Microsoft_ServiceBus_Messaging_BrokeredMessage_ScheduledEnqueueTimeUtc)

Like Amazon's new SQS Lambda trigger you can then schedule a serverless function that's triggered by new items in the queue to have arbitrary scheduling of tasks.

Using their Python API it's pretty nice:

        from datetime import datetime, timedelta
        from azure.servicebus import ServiceBusService, Message

        sbs = ServiceBusService('task-queue',  shared_access_key_name=key_name, shared_access_key_value=key_value)

        d = datetime.utcnow() + timedelta(minutes=1)
        task = {"some": "object"}

        sbs.send_queue_message(
            "task-queue",
            Message(
                task,
                broker_properties={'ScheduledEnqueueTimeUtc': d}
            )
        )

<comment><USER3> You can do the same with AWS...

\- set a CloudWatch scheduled rule to schedule a lambda.

\- or set a rule to send an sns, subscribe a queue to the sns topic and subscribe a lambda to the queue.

<comment><AUTHOR> CloudWatch is cron based, which means you can't schedule a one time event.

Agree regarding sns, but in our case sns == s3

<comment><USER3> AWS adds a year parameter to cron. You can specify the exact time.

Why use S3? S3 events aren't guaranteed. SNS was specifically designed for this use case.

[https://docs.aws.amazon.com/AmazonCloudWatch/latest/events/S...](https://docs.aws.amazon.com/AmazonCloudWatch/latest/events/ScheduledEvents.html)

</comment></comment></comment></comment><comment><USER5> This is misleading.

The title should be "Using s3 as storage and some side thingy that runs every minute as a scheduler".

</comment><comment><USER6> It's worth noting that there is currently a gotcha with S3 Event Notifications such that they are not guaranteed. As a result, you may end up missing out on events.

<comment><USER7> S3 also doesn't provide a linearizable consistency model or even a vague approximation of one. You can't rely on the events you try to schedule happening in the order you try to schedule them in, or even happening at all.

This seems overcomplicated compared to using a regular timed event to trigger a lambda and having it decide what to execute conditionally.

<comment><USER6> I wasn't really too worried about picking apart the approach. If order mattered, you'd be looking at other approaches anyway.

Mainly just calling out a gotcha where you might quietly miss out on scheduled events with no warning.

For example:

1\. Object written to successfully to bucket.

2\. `s3:ObjectCreated:Put` is _never_ delivered.

The possibility of duplicate events are warned about a lot in the AWS ecosystem, and this sets up an expectation of "at-least-once" delivery.

</comment></comment></comment><comment><USER8> This isn't using S3 as a scheduler. Cloudwatch already supports cron and rate expressions, as the post alluded to. This is a hack to schedule something once.

All Cloudwatch would have to do is implement a recurrence = 1 feature but I'm guessing it's not a common enough use case.

<comment><USER3> It supports the year it should be scheduled. You could specify the exact time for it to be scheduled.

<comment><USER9> I think there is a limit on a number of scheduled events per account per region.

So when doing one-time events (by specifying a year) - the triggered lambda need to delete it.

Or have a hourly scheduled lambda to delete already fired one-time events.

Or maybe CloudWatch is so smart it can delete them by itself?

<comment><USER3> You would have to delete the rule. In theory, it's just like deleting an item from a queue once it has been processed. Another advantage is that you could look in the console to see which overdue rules haven't been deleted.

And if you _really_ need more than 50 rules, it's just a soft limit. You send a request to support and they will raise it.

</comment></comment></comment></comment><comment><USER10> CloudWatch Events already supports triggering Lambda functions on a cron schedule. You don't even need S3. This seems like a ton of work to basically invoke a function every n minutes.

<comment><AUTHOR> If you want a reoccurring task then you are right, but if you want to run a one time task in a specific time in the future depending on internal logic, then it won't work

<comment><USER11> Isn't this a job for Step Functions?

<comment><AUTHOR> Step function is also a good idea

</comment></comment></comment></comment><comment><USER12> For a moment I thought this was going to be something totally silly like using lifecycle management with a feedback loop

</comment><comment><USER13> Dynamodb can also be used as a one-time scheduler and I will say it will look also a lot simpler than this example.

In dynamodb you can set TTL for a record. When the record expires it will fire event to your designated lambda. That's it. You simply write a record, wait for the record to expire and you get notified on your lambda.

<comment><AUTHOR> Correct me if I'm wrong, but s3 unlike dynamodb does not require a specific region, therfore it's more fault tolerance or it requires more work on dynamodb to achieve same level of stability

<comment><USER14> S3 is in regions, like Dynamo.

</comment></comment></comment><comment><USER9> S3 is Turing complete ;)

And as with everything overly flexible, people will abuse it and build over- engineered solutions on top of it, when simpler solution is already present, but possibly not obvious or poorly documented.

<comment><USER3> How much more obvious could it be? It's in the Cloudwatch cron rules that the last parameter specifies the year.

<comment><AUTHOR> Can you attach data to the event ?

<comment><USER3> Yes.

[https://docs.aws.amazon.com/cli/latest/reference/events/put-...](https://docs.aws.amazon.com/cli/latest/reference/events/put- targets.html)

The data you attach will be included in the SNS message or the data that gets sent to the lambda handler.

You can put static JSON as an event from either the AWS Console, the CLI, or CloudFormation.

</comment></comment></comment></comment><comment><USER15> Wait what? You can invoke lambda functions directly via the invoke api. No need to use the s3 api. Am I missing something?

</comment><comment><USER16> > What happens when you want to schedule a one-time event? You are stuck.

Or you create a rule for a specific date / time. Any reason why that would not work?

</comment><comment><USER17> I was expecting this to be about combining Lambda with S3 lifecycle management to make a poor man's cron.

Now I kinda want to try that myself.

</comment><comment><USER18> What is it you can achieve with this that you cannot with cron?

<comment><USER19> Multiple keywords on your resume (S3, AWS, Lambda, Serverless)

<comment><USER3> If I interviewed someone who explained that as a solution, it would definitely not help their case. The worse hire is someone who overcomplicates projects. It leads to "negative work".</comment></comment></comment>


Medication May Stop Drug and Alcohol Addiction - <AUTHOR> https://news.utexas.edu/2015/06/23/medication-may-stop-drug-and-alcohol-addiction <comment><USER2> Things like Memantine, robitussin (DXM), ketamine, ibogaine, etc can often help with addictions and cravings. Memantine and DXM are especially good things to research, as memantine is safe and DXM is something you can get over the counter at any pharmacy. If you use the proper dosage of DXM, then you could be rid of the mental aspect of addiction overnight.

</comment><comment><USER3> It's not really a surprise that this method outperforms the social campaigns, as "Society is fixed, biology is mutable"[0].

[0] [http://slatestarcodex.com/2014/09/10/society-is-fixed- biolog...](http://slatestarcodex.com/2014/09/10/society-is-fixed-biology-is- mutable/)

</comment><comment><USER4> We already know how to cure addiction, you cant make money off it though.

[https://en.wikipedia.org/wiki/Rat_Park](https://en.wikipedia.org/wiki/Rat_Park)

</comment><comment><USER5> Article dated June 2015</comment>


We've removed the Caddy-Sponsors header - <AUTHOR> https://twitter.com/mholt6/status/908539119306915840 <comment><USER2> This seems like good news to me. I like Caddy and use it all the time (for personal, non-commercial projects) but adding sponsors to a header was too much to stomach for a whole bunch of reasons, and I actually started moving my sites back to Nginx.

I have no objection to Caddy monetizing, and I hope they are successful, but don't penalize small users to get there.

In my day job, I work for a large company and we pay for OSS software all the time (RHEL, Nginx Plus, lots more), and if Caddy starts to get popular, I know we'll have no issue paying $10,000 a year or more.

Go after large enterprise, and keep it free for hobbyists. Small/Medium businesses are painful to deal with, and you might as well let them use this for free.

<comment><USER3> What was the actual downside to this?</comment></comment>


Donald Trump claims 'millions voted illegally' but offers no evidence - <AUTHOR> https://www.theguardian.com/us-news/2016/nov/27/donald-trump-scam-recount-jill-stein-hillary-clinton <comment><USER2> He doesn't need "evidence". He just _knows_.

</comment><comment><USER3> How dare Trump make unsubstantiated claims! Only Jill Stein and Hillary Clinton are allowed to make those.

The article does a fair job of pointing it there is no evidence for either sides claims, but the title is worded to mislead. Where is the title "Jill Stein claims vote hacking but offers no evidence"?

<comment><USER4> The difference is, one side says they think something may have happened, and want an independent audit (recount) to determine if it did.

The other side makes claims as if they are fact, to try and change people's opinion of what actually happened (ie who won the popular vote) and specifically doesn't want any investigation/recount.

<comment><USER3> Both sides are making unsubstantiated claims and speaking as if they are facts.</comment></comment></comment>


Server statistics in Excel with Python - <AUTHOR> http://mit.edu/~victorj/www/blog/2012/07/25/File-access-statistics-in-Excel-IronSpread/

<comment><USER2> "There is pretty much no decent scripting language available on Windows, so if you do not have immediate access to some unix (or at least cygwin), you're out of luck."

He seems to be fully uniformed about what he writes about. The graphs he produced in Excel can be produced without Excel and just with open-source tools on practically any platform. Python and Gnuplot can be installed anywhere:

<http://www.python.org/>

"Python runs on Windows, Linux/Unix, Mac OS X, and has been ported to the Java and .NET virtual machines."

<http://www.gnuplot.info/>

"Gnuplot is a portable command-line driven graphing utility for Linux, OS/2, MS Windows, OSX, VMS, and many other platforms."

<comment><USER3> This post uses Python. As far as Gnuplot, command line tools are not that powerful on Windows.

<comment><USER2> When you really need to script any VBA enabled application on Windows (Excel, Word, you name it) they can be scripted with ActiveState Python or ActiveState Perl which are free and moreover exist for more than a decade:

<http://www.activestate.com/>

But to solve the problem described in the article Excel is just not needed.

<comment><AUTHOR> Unfortunately with activestate you can't run python from _within_ excel, you've got to somehow run the script at the "outside" (be it shell, some other program etc.)

<comment><USER2> You can: with a few lines of text a script (be it JScript, Active Python, Active Perl) can be made a COM accessible "object" and can be run from Word and Excel or any other program which has VBA.

Visual Studio had that too until Version 2012. Now MS removed VBA infrastructure from the Visual Studio 2012 -- although since 1998 I was able to assign a keypress to run a Perl code from a VS editor to, for example, modify the selection of a C code I develop (I really use such tricks to do non trivial modifications over some bigger piece of code -- pure magic!) So only now in 2012 they killed that in VS. Stupid MS, destroying the best features they already had.

</comment></comment></comment></comment></comment><comment><USER4> _First, there is pretty much no decent scripting language available on Windows_

PowerShell?

<comment><AUTHOR> Let me tell you what's wrong with PowerShell - I've been using it for a while (yes, it's much more useful than the regular cmd), BUT it has multiple inconsistencies with the regular windows shell, in particular when it comes to file paths and escaping white spaces & other characters. I've spent ages debugging such issues and trust me, you don't want to repeat this (also, it's slow, doesn't come with ssh or most other unix tools). Other than that, I have yet to meet anyone who knows how to script in powershell. Of course if you want to, go ahead, but from my experience I'm not going to use it for anything too serious.

<comment><USER5> Powershell is being used for very serious stuff (IIS, Sharepoint). And you can take advantage of any .NET library.

</comment></comment></comment><comment><USER6> I'm all in favor of better python interfaces for excel, but you need a better example, computing rolling time series statistics, and visualizing them? That's a job for pandas.

If you want excel as the front end (I understand why you would want that) you could use pandas to process the data, and use excel as the frontend, instead of writing all that code.

</comment><comment><USER7> I've played with gltail (can be found at <http://www.fudgie.org/>) since yesterday. It should do what you want to achieve and run under Windows as well, though it's written in openGL and Ruby.

</comment><comment><USER8> I don't understand why the author is using 'IronSpread' which is available on Windows only. For python there are modules like xlwt (www.python-excel.org) and openpyxl (<https://bitbucket.org/ericgazoni/openpyxl/>) using which one can generate excel files from python.

</comment><comment><USER9> This looks like a good way to design reporting dashboards - it's too bad Excel can't update in real time.

<comment><AUTHOR> <http://ironspread.com> can update Excel in real time as well - that's what I'm working on for my next blog post, which will be available sometime next week.

<comment><USER10> What are the advantages of IronSpread over traditional Python COM access? The API appears only marginally better than Excel's VBA interface, and it looks like IronSpread can't interact with multiple workbooks.

The benefit of having the shell launched from within Excel, with no setup needed, disappear when you want to run more complex functions like continual updates. And on top of that IronSpread doesn't support Office 2003.

<comment><USER3> Regular COM calls can fail (when Excel is busy, for example), and you can't just click "run" from within Excel, you have to start python from a shell, etc. VBA, on the other hand, is hard to extend - getting it to pull logs from a remote server would be painful.

As far as interacting with multiple workbooks, that's something we're working on.</comment></comment></comment></comment>


Ask HN: Setting up an affiliate program? - <AUTHOR>

I'm spinning up a marketplace site for plants (http://doleaf.com), and we'd like to offer an affiliate program.
We had it on our long-term roadmap, but recently found a site that's such a perfect fit that we want to bump it up and push out a basic program now. The owners of the other site are eager to integrate our listings, so we want to get moving quickly.
What's a good way to go about setting this up?  We want to offer a % of the sale price, but don't want to deal with sending checks, managing analytics, or anything like that. Is there a 3rd party service that will handle all that stuff?  I'm imagining some kind of service that handles redirecting to us, keeping track of who sent us the traffic, and sends the check. In return, we just get a monthly bill with the affiliate fees.
Anyways, I'd love any sort of advice on setting this up. <comment><USER2> Sounds like you want an affiliate network rather than setting it up inhouse. These networks handle all the tracking, invoicing, etc and just send you a bill (well usually they ask for a deposit up front).

CJ mentioned above is the biggest but they tend to have restrictions like minimum traffic, sales, etc. Depending on where your traffic is, you can also try Clickbank, Clixgalore, Pepperjam, Zanox, to name a few.

Tip 1: be very sure how much each sale is worth to you, taking into account refunds, cost of sales, operations, etc. You don't want to be paying out more than your margin...

Tip 2: watch your cashflow. You don't want to pay out before you collect from your customers.

Good luck!

</comment><comment><USER3> There are affiliate program code bases for sale, they're pretty dependent on your platform though so make sure you take a good look at what it takes to get them up and running before you order something.

Third party is possible but not a requirement, though it does have the added benefit of having 'hands off' reporting, which increases the trust factor with your affiliates.

</comment><comment><USER4> You might want to checkout out services like commission junction (<http://www.cj.com/>) that focus on this sort of thing. Never used any of them from the seller side though.</comment>


What Nikola Tesla vs. VCs video says about the state of Silicon Valley - <AUTHOR> http://gigaom.com/2013/05/19/what-nikola-tesla-vs-vcs-video-says-about-the-state-of-silicon-valley/ <comment><USER2> If you want to hear how Tesla, Edison, etc. actually went about funding / building their companies - check out: "American Genesis"

It's a history of the human / social part of this period of technology. So interesting to hear about J.P. Morgan essentially angel investing in Edison / Tesla + all the other unknowns like Elmer Sperry, etc.

[1] [http://www.amazon.com/American-Genesis-Invention- Technologic...](http://www.amazon.com/American-Genesis-Invention- Technological- Enthusiasm/dp/0226359271/ref=sr_1_1?s=books&ie=UTF8&qid=1369077550&sr=1-1&keywords=american+genesis)

<comment><USER3> Noblesse Oblige is dead. The ultra-rich hoard their wealth. They won't even invest in their own country by paying their taxes without tax shelters. What makes you think they would invest in something that might benefit others?

<comment><USER4> Bill Gates? Warren Buffett? Laurene Jobs? Zuckerberg? Ron Conway?

I don't know what qualified as ultra-rich, but "investments" the wealthy/rich bracket in SV (including new-comers) also fails to back up your assertion.

<comment><USER5> The problem is, we let them choose where to spend their money, so everyone in need depends on their mercy. They're like the Kings and Queens of our time.

</comment></comment></comment></comment><comment><USER6> _They're all looking for the next Facebook or the next Twitter, but no one wants to look for the next Juniper or the next Intel or even the next ARM._

The author didn't substantiate this claim. The only actual example he came with was the Tesla hypothetical. I'm sure it is true that there is a lot of money chasing easy short term ideas right now, but his only real world example of clean tech shows there is money out there for big ideas. Even bad big ideas. I'd like this article if it were actually about some companies with big ideas who needed money and couldn't get it.

</comment><comment><USER7> The internet and mobile have created opportunities to make large amounts of money faster than ever. You can't blame the VCs for choosing a quick billion vs a slow billion. Along the same lines, the referenced VC deals of the past (Khosla + Juniper) were not comparing those opportunities with the hyper growth startups that we see today.

</comment><comment><USER8> You change tack not tact although maybe some companies should change both

</comment><comment><USER9> This begs the question, how did Tesla actually do it? Ultimately he was driven by the inventions themselves, not the business models. This was his genius and his failure.

Licensing the patents worked but it's also worth looking at Tesla's relationship with George Westinghouse who became a patron more than an investor.

What's the avenue for a Nikola Tesla today?

<comment><USER10> >> What's the avenue for a Nikola Tesla today?

Not sure you want to end up like Tesla. He died broke and alone. I wouldn't try to emulate his avenue, only his genius... If such a thing is possible.

<comment><USER11> Maybe (eventually) crowdfunding, assuming it ever gets through the rulemaking process of the SEC. And it's not just the $1M from unaccredited investors, you can raise unlimited amounts of money from accredited investors, so the amount of capital you need wouldn't be a limiting factor. Given the numbers of investors who are looking for large returns, plus those that have an affinity for a particular technology, idea, or solution to a social problem, this could be big competition for VC's and maybe the only route to funding for some ideas/industries/technologies.

</comment></comment></comment><comment><USER12> If you're wondering, here is the kickstarter to the video. [http://www.kickstarter.com/projects/dorrian/a-statue-of- niko...](http://www.kickstarter.com/projects/dorrian/a-statue-of-nikola-tesla- in-the-silicon-valley)

</comment><comment><USER13> 62% unrelated: Nikola Tesla vs Thomas Edison (Epic Rap Battes of History):

<http://www.youtube.com/watch?v=gJ1Mz7kGVf0>

</comment><comment><USER14> Venture capitalists these days go on social proof largely because of their career incentives. You don't "make it" as a VC unless you get into a black albatross deal early, and there's one of those per decade. That's why all the horrible note-sharing and co-funding goes on. All the VC resources are chasing the career needs of the agents, not maximizing return on investment (which is impossible to predict anyway).

Someone is going to win big by working with the mid-risk/mid-growth "lifestyle" businesses (that currently make most of their money consulting) but it's not going to happen in VC-istan, nor will it be in Silicon Valley or New York. Boston has a shot; I'd also say Austin, Seattle and Chicago are in the running.

<comment><USER15> Isn't the entire premise of venture capital that you only make money off the big winners? Assuming lifestyle businesses fail at similar rates as venture- backed companies, the way to maximize returns is to invest in the companies with the biggest potential upside.

In other words, how many $10/month SaaS companies would it take getting acquired to match the return of your average $300M VC-backed exit?

Don't say 37signals. 37signals is an outlier in the same way Instagram is an outlier. The existence of either of these proves nothing.

By definition a mid-growth business will NEVER generate the returns needed to sustain a venture fund.

I don't think it's fair or the most beneficial to society that VCs only invest in high-risk, high-potential businesses. But that's the only way the math could work. You can't argue with math. The only exception would be funds like YC that can invest very small amounts at very low valuations and make money from acqui-hires.

<comment><USER16> _Assuming lifestyle businesses fail at similar rates as venture-backed companies_

Why would you make such an assumption?

 _You can't argue with math._

I can when you get the math so wrong, like above.

<comment><USER15> Most businesses fail because they run out of money. Do you think getting an infusion of millions of dollars makes a business more likely to fail?

<comment><USER17> Lifestyle businesses are usually about a modest initial investment by the founder and then reinvesting modest profits into raising the hot air balloon a bit. VC backed companies usually start out losing tons of money and hope they achieve flight by the time they reach the end of the runway.</comment></comment></comment></comment></comment>


An X86 Design Flaw Allowing Universal Privilege Escalation - <AUTHOR> https://www.blackhat.com/us-15/briefings.html#the-memory-sinkhole-unleashing-an-x86-design-flaw-allowing-universal-privilege-escalation

<comment><USER2> _to demonstrate how to jump malicious code from the paltry ring 0 into the deepest, darkest realms of the processor._

So you already have to be in ring 0. Pretty click baity title.

<comment><USER3> Intel CPUs support Ring0-3. But...

[http://en.wikipedia.org/wiki/Protection_ring](http://en.wikipedia.org/wiki/Protection_ring)

Multics supported 8+ rings, OpenVMS 3 rings, OS/2 3 rings, Windows NT and Unix only 2 rings. Some hypervisor like XEN use afaik ring 1 (Intel VT-x "Vanderpool").

We need better ring support in modern operating systems and hypervisors (VM hosts).

"The x86-processors have four different modes divided into four different rings. Programs that run in Ring 0 can do anything with the system, and code that runs in Ring 3 should be able to fail at any time without impact to the rest of the computer system. Ring 1 and Ring 2 are rarely used, but could be configured with different levels of access."

<comment> j-pb Actually we should abandon the ring concept all together for more promising security models.

[https://www.destroyallsoftware.com/talks/the-birth-and- death...](https://www.destroyallsoftware.com/talks/the-birth-and-death-of- javascript)

<comment><USER3> The suggested solution is to have process isolation implemented using software - namely asm.js-enabled JavaScript virtual machines embedded in a Linux kernel, which save you from needing hardware isolation, reducing overhead. Gary calls this idea "METAL".

I found little resource about the project, but there is a discussion on Reddit: [http://www.reddit.com/r/compsci/comments/25w7vt/javascript_b...](http://www.reddit.com/r/compsci/comments/25w7vt/javascript_based_os_what_do_you_think/)

And we had the discussion on HN too: [https://news.ycombinator.com/item?id=7605687](https://news.ycombinator.com/item?id=7605687)

Nevertheless an interesting topic, that doesn't deserve a downvote of my parent.

</comment></comment></comment></comment><comment><USER4> I remember a post a few years ago about running code by triggering page faults in the MMU. Basically they created a single instruction computer (which can be Turing complete) out of the MMU, hence allowing processing to occur with the MMU that is invisible to the CPU and everything else. I wonder if related.

[http://en.wikipedia.org/wiki/One_instruction_set_computer](http://en.wikipedia.org/wiki/One_instruction_set_computer)

<comment><USER5> (author here) [https://github.com/jbangert/trapcc](https://github.com/jbangert/trapcc)

We did get a few hypervisor crashes and the Intel architecture has all sorts of subtle behaviour that is often not modelled properly. It would be good to see someone build on my work.

</comment></comment><comment><USER6> The worst case is a VM escape for hardware accelerated (VT-x/AMD-V). So does this exploit work under virtualized ring 0? That would be a disaster for many cloud providers and for virtualization in general.

Maybe this is something about controlled change of flow of execution in SMM mode?

<comment><USER7> My guess is that if you have a universal hardware hypervisor escape, you write the abstract for that talk much differently.

</comment></comment><comment><USER8> Earlier work from the ITL/Qubes team, including SMM attacks: [http://invisiblethingslab.com/itl/Resources.html](http://invisiblethingslab.com/itl/Resources.html)

</comment><comment><USER9> I wonder if this is SMM or something even darker and deeper.

<comment><USER10> SMM was my first thought too, although "gone unnoticed for 20 years" (1995) suggests something newer; SMM was introduced in 1990 with the 386SL, and this suggests P6-level.

Microcode seems about right - that was introduced in the P6. But, it's also signed (at least Intel ucode is - not sure about AMD) according to previous research... either way, this is going to be interesting.

<comment><USER11> Signed _how_ , though? A crypto scheme that Intel came up with 20 years ago is probably not secure, and if they haven't updated it since then, well...

<comment><USER10> [http://inertiawar.com/microcode/](http://inertiawar.com/microcode/) suggests a variant of SHA1 or SHA2 with 2048-bit RSA. No doubt it's changed since the P6, probably with different private keys for each CPU model/family, but the public key must be present in the hardware in order to verify, so theoretically it could be extracted...

Edit: _public_ key. There might be a test mode which bypasses this or something.

<comment><USER12> No, the private key doesn't have to be present. They sign with the private key, the CPU verifies with the public key.

</comment></comment></comment></comment></comment><comment><USER13> "deepest, darkest realms of the processor..." is it the ME? [https://recon.cx/2014/slides/Recon%202014%20Skochinsky.pdf](https://recon.cx/2014/slides/Recon%202014%20Skochinsky.pdf)

<comment><USER14> It's kind of scary that there's a micro-JVM on my chipset that allows new code to be loaded in to such a privileged system dynamically.

<comment><USER15> Makes me think of this guy who managed to install linux on his hard drive: [https://spritesmods.com/?art=hddhack&page=7](https://spritesmods.com/?art=hddhack&page=7)

</comment></comment></comment><comment><USER16> Is this about the IA-32 debugger? There's a Phrack article that describes something similar: [http://phrack.org/issues/65/8.html](http://phrack.org/issues/65/8.html)

</comment><comment><USER17> Strangely, when I clicked the link my Macbook Air kernel-panicked. This is the first time it happened in maybe 2 years.. I though the website was actually using an exploit to kill all PCs kernels.

After a reboot all went fine, though.

</comment><comment><USER18> This sounds _very_ significant to me.

Basically this vulnerability affects multi-tennant systems where if you have a VM, you can then expoint this vulnerability to take control of a VM of somebody else.

This type of vulnerability, however rare, could be an argument why you should run systems with different security classifications on different physical hardware (different physical virtualisation clusters).

</comment><comment><USER19> Wow. Ok so given that this is a hardware flaw and not a software flaw is this kind of disclosure reasonable? In the case of software vulnerabilities, researchers typically inform vendors and allow them time to distribute a patch. Is there anything analogous here for hardware? If yes how does intel (or any hardware vendor) get ahead of this by distributing a fix?

<comment><USER20> If its an unfixable problem then there's an obligation to disclose. Else only the 'bad guys' know.

<comment><USER19> But doesn't this assume that the 'bad guys' have knowledge of the exploit. This feels like a faulty assumption. However after disclosure the bad guys will definitely have knowledge.

Also after disclosure what is the right course of action? We certainly can't require the replacement of all vulnerable hardware.

<comment><USER21> Let's break it down for examination. Before disclosure, the bad guys _may_ know and the good guys _certainly_ do not know. After disclosure, both bad guys know and good guys know. Good guys who know can take protective steps.

Who gains the most?

</comment></comment></comment></comment><comment><USER22> What is more privileged than ring 0? Microcode?

<comment><USER23> A hypervisor runs below ring 0 and system management mode runs below that.

<comment><USER24> ... sort of.

"Ring 0" is a historical abstraction from the 80286 protected mode model. There was a two bit field associated with segment and gate descriptors that enforced privilege separation, so you couldn't load segment registers with data at a higher priviledge level, and were disallowed from making traps into higher levels except as specifically allowed (we call those "syscalls" today).

None of this stuff is used anymore. We have the kernel in ring zero and we have everything else.

A hypervisor is absracting the whole CPU, so the guests have their own rings, etc... SMM is likewise outside the ring model.

And of course we have all sorts of __other __priviledge abstractions in modern hardware: iommu 's exist for this purpose of course (though with a different threat model), as does memory mapping handled by microcontrollers on the fabric of modern SoCs. The NX bit doesn't fit into "rings" but is clearly related technology, etc...

Basically we need to stop talking about 286 protected mode except when that's really what we mean. Frankly I have no idea what this attack means by "ring 0", but I'm guessing like everyone else this is an exploit in SMM code.

<comment><USER25> _None of this stuff is used anymore. We have the kernel in ring zero and we have everything else._

Not using two of the four rings does not really mean nothing is used anymore. The reason only two are commonly used is probably to a large extend due to portability to processors with only two rings and maybe also architectural simplicity.

<comment><USER26> Even x86 barely supports rings 1 and 2. The modern (386+) paging system only recognizes two privilege levels, and the fast privilege change instructions (SYSCALL, SYSRET, etc) are only useful when switching between rings (really "CPL") 0 and 3.

If you're programming a 286, then you can go whole hog with 4 rings.

</comment></comment></comment></comment></comment><comment><USER27> Am I missing something here? It's just a couple of sentences of some BS about negative rings.

<comment><USER28> It's an exploit that'll be presented at the upcoming Blackhat conference.

<comment><USER27> Thanks, it makes much more sense sense now.

</comment></comment></comment><comment><USER29> So guy's did I understand correctly ? They found a flaw in x86 so the guest can exploit host ? ( Maybe much restricted than what I said , but the main idea is correct ?)

</comment><comment><USER30> Regardless of the content, white text on black background is VERY BAD for reading. Please make this text more readable.</comment>


Ask HN: What is your primary database? - <AUTHOR> Really curious to know your single, most important database tech? SQL or NoSQL? Postgre, MySQL, Mongo, Elastic, Redis, ...? Are you happy? Would you choose differently today? Thank you for sharing! <comment><USER2> Single most used is PostgreSQL with Redis as a cache store for most cases.

But the more nuanced answer is, it depends on the project and the goals. I have used MSSQL, MySQL, PostgreSQL, Mongo and Cassandra all as primary data stores. I have utilized ElasticSearch, Redis, couchbase and memcached for specific caching or search purposes but never as a primary data store as they aren't designed for that IMO.

Today, primarily I rely on PostgreSQL as a default, with other databases used for specific purposes. I follow a different convention than the one large database for everything, even if I have a monolith application. I like to use small independent databases that are designed for the specific type of workflow for the task. e.g. user auth has different needs than say logging data or any high write low read datasets. Also, I personally like this because it forces defined lines in the application space for where data resides and the intended uses.

I think the thing I have learned to be better at over the past say 10 years especially, is to use the right datastore for the right job, versus a one size fits all. At the same time, I still try to keep the number of different type of data stores to the shear minimum required. So sometimes it maybe multiple instances of say PostgreSQL but each setup differently based on workload and access needs, or maybe it is PostgreSQL and Mongo for the strengths of each. Redis is almost always my caching engine now for any data stores.

In the 80's and early 90's nearly everything was file based in small companies (e.g. we wrote our own data stores), then we moved to ISAM then SQL in the mid-90's. In the 80's and early 90's SQL was out of the reach for a lot of smaller companies, license cost + dba etc. In the mid to late 90's we got distributed object stores (the first real NoSQL databases IMO), like Versant (still around) which we used too.

<comment><USER3> Would be great for you to mention what kind of tweaks you do in postgres depending on the workload. Really curious about which settings to optimize for what.

<comment><USER2> To be fair there are people far more of an expert to provide guidance on postgres tuning, but here is a slide share (near top google result) I have used for some high write ideas: [https://www.slideshare.net/GrantMcAlister/tuning- postgresql-...](https://www.slideshare.net/GrantMcAlister/tuning-postgresql- for-high-write-throughput) . Not advocating everything said there, but it has quality points to utilize.

The idea, is for example on high write loads, I don't really need to index for read, and indexes in general will cause slower writes in any SQL system. In addition I might choose different types of disk to store data on depending on durability and load. High write, SSD optimized (with high IOPS) for write and lower durability is probably ideal, yet for high reliability needs, high durability magnetic slower disks is likely a better choice. Stuff like that makes a huge difference, in fairness AWS (and other cloud providers) make it easy to make the choice today, but it makes a huge difference in performance capabilities and so many people don't understand the details of the selection they make.

This also leads us to adjusting the parameters for the Postgres install, which of course if you use RDS or similar you are more limited on, but it is still critical to weigh.

If you have questions in specific I am happy to try and help or I will ask one of my teammates to respond that has more specific knowledge. As an example, my consulting team a few years back scaled a Wordpress install using MySQL to millions of requests but did so using EC2 instead of RDS and used way less resources because we tuned the database and queries to be efficient for the hardware. It goes back to the old adage, for a 10x increase in hardware, there is likely a 100x increase in software if you just look. Our client at the time kept upgrading the hardware on AWS to the next larger instance for RDS, and we instead moved off RDS to EC2 and then tuned the instance and MySQL install to be more efficient for their specific workload. Obviously highly tailored to their specific use case but we saved them a HUGE amount of money and still provided the same scalability and reliability.

</comment></comment></comment><comment><USER4> SQLite for little apps that are easily deployable, and PostgreSQL for more serious applications that would benefit from its extensions.

I haven't changed that setup for years, even when people tried to convince me that Mongo was the superior way to store JSON, which I do in Postgres very easily. (I also don't need Redis because most of my applications are in Erlang/Elixir, so we already have a bunch of Key-Value solutions available)

So yeah, pretty happy :)</comment>


Fighting vendor lock-in and designing testable serverless apps - <AUTHOR> https://vacationtracker.io/blog/big-bad-serverless-vendor-lock-in/ <comment><USER2> This is what I call _fake work_.

This company builds a team vacation tracker. As long as it's reliable, their customers could not give a rat's ass whether it runs in AWS, Google, or Joebob's House Of Ill Compute. Every engineer hour spent creating abstraction layers and docker containers and whiz-bang multiplatform plumbing is an hour that could have been spent working on something your _users_ actually care about.

Switching clouds is a cost optimization. You have to be an enormous company (or in a resource-intensive domain) before this is more productive than building features. It means you've moved out of the growth phase and into the "how do I milk what I've got" phase.

Vendor lock-in is something that engineers care about because they like playing with tech. It's cool switching platforms or databases or whatnot because it really feels like hard, sophisticated work! But it doesn't move the needle.

<comment><USER3> > Due to a change in how they report data usage, our monthly costs for > Firebase, a SaaS provided by Google, has increased from $25 a month to what > is now moving towards the $2,000 mark — with no changes to our actual data > use. This change was made without warning.

ref [https://news.ycombinator.com/item?id=14356409](https://news.ycombinator.com/item?id=14356409)

Vendor lock-in can make or break startups if you're not careful enough.

<comment><USER2> Perhaps this is the "exception that proves the rule"? That situation was unusual enough that one of the Firebase founders reached out and gave them a bunch of credits and helped them work through the issue.

There's certainly a continuum here. The most minimal risk mitigation strategy is simply to use your own domain (as opposed to the vendor's domain), and that requires nearly zero effort. Unfortunately the team in that article made that mistake, and they're pretty honest about admitting it.

Assuming you don't make rookie mistakes at the beginning, you always _can_ move to another platform - it's just a question of how much work it will take. Is it better to put that work in up front for the 0.01% chance you'll need it? I think not.

<comment><USER4> > Is it better to put that work in up front for the 0.01% chance you'll need > it? I think not.

Over a sufficiently long time horizon, the chance is much greater than 0.01% and the longer you go without doing the work, the more it costs to do the work.

Sure, it's more a problem that bites you when you've become a big enterprise, but it bites hard, and some of us work in big enterprises on systems that could reasonably be operational for generations going forward (and perhaps have been going backwards.)

<comment><USER2> I would happily accept that problem if skipping the extra work enhances my chance of becoming a big enterprise in the first place.

<comment><USER4> > I would happily accept that problem if skipping the extra work enhances my > chance of becoming a big enterprise in the first place.

And that's the right choice in some cases. But the added up-front effort can be a lot less than the added reengineering effort, and growing into a big enterprise doesn't mean you are immune to disruption by more agile startups.

And, of course, those who are already in big enterprises have different concerns (while premature adoption of the mitigations at issue can be engineering resume padding in startups, deferring it with the hope that it won't be a crisis until it's someone else's problem in exchange for short-term metrics can just as easily be management resume padding in enterprises.)

<comment><USER5> But how much less work is it do it up front, and continue to maintain and test a multi-provider platform?

I don't think it's 100x or even 20x less work.

</comment></comment></comment></comment></comment></comment></comment><comment><USER6> I like the idea of multi-cloud very much, kudos to the author for pushing for it.

One crucial issue that isn't addressed by a hexagonal architecture however is data egress charges.

Data egress is the gravity of the cloud services world, and it's are an insurmountable barrier for many services. The moment you start planning a multi-cloud deploy, and start looking at shifting services that are tightly coupled, or require data replication (databases, logs, storage) between clouds, you're going from low or no cost data charges, to paying egress on -both sides- of every transaction.

I know first-hand that these costs can quickly out weigh any disaster recovery / eggs in one basket argument you might put forward. It even dominates an "this cloud provider will probably be our competitor in 2 years or is our competitor right now" argument, and my guess is data egress has strongly contributed to companies like Netflix continuing to use AWS.

<comment><USER7> Once you're big enough you can start talking about having a direct interconnect to the cloud provider, which helps.

</comment></comment><comment><USER8> I find it funny cause Microsofts serverless infrastructure and co source code is on GitHub it may not be as pretty as a real Azure service but they let you take the damn thing with you. Not sure about other cloud providers. How the tables have changed. Hell I convinced my old boss to selectively use Microsofts Azure Functions because they were open source and we needed a slightly longer running process not part of our typical web service.

<comment><USER9> I didn't realize this was a thing and had to look it up.[0][1] This seems pretty great if you were considering Lambda but had concerns over portability.

[0] [https://github.com/Azure/azure-functions-core- tools](https://github.com/Azure/azure-functions-core-tools)

[1] [https://medium.com/@raduvunvulea/how-to-run-azure- functions-...](https://medium.com/@raduvunvulea/how-to-run-azure-functions-on- aws-and-on-premises-4bba4ba392ec)

<comment><USER8> You should of gone a little further, the core tools are for local testing if I remember correctly, but the back-end is here:

[https://github.com/Azure/azure-functions- host](https://github.com/Azure/azure-functions-host)

</comment></comment></comment><comment><USER10> Vendors have already come up with a way to fight the vendor lock-in dodging that this article recommends: data egress charges.

Whenever you are trying to take your data out of one cloud into another one, you're going to be charged heavily, and these costs will likely exceed the costs of accepting vendor lock in and keeping your data housed in one location.

The only realistic way to fight vendor lock in is to keep your code as isolated from proprietary API's as possible (e.g. deploy containers, or use interfaces to isolate proprietary calls in your app).

<comment><USER11> And while you're adding the extra complexity just to avoid lock-in, you're not adding features that can acquire customers or get your existing customers to pay more.

No, your CTO is no more going to uproot your entire infrastructure from AWS/Azure because you promised that it will be "seamless" than they are going to replace their six figure Oracle installation with Postgres because you used the repository pattern.

</comment></comment><comment><USER12> > This leads us to my favorite architecture for serverless apps: hexagonal > architecture, alternatively called ports and adapters. As it's creator, > Alistair Cockburn, explains, the hexagonal architecture allows an > application to equally be driven by users, programs, automated test or batch > scripts, and to be developed and tested in isolation from its eventual run- > time devices and databases.

[https://vacationtracker.io/wp- content/uploads/2019/04/hexago...](https://vacationtracker.io/wp- content/uploads/2019/04/hexagonal-architecture.png)

This seems like a new buzzword for an existing (but still very good) thing, abstraction layers.

The original article ([http://alistair.cockburn.us/Hexagonal+architecture](http://alistair.cockburn.us/Hexagonal+architecture)) is down though, so it's entirely possible it was was written in the late 90s when these practices started becoming widespread particularly with Java and Gang of Four ([https://en.wikipedia.org/wiki/Design_Patterns](https://en.wikipedia.org/wiki/Design_Patterns)).

Edit: dzone says 'Hexagonal Architecture' was from 2005. [https://dzone.com/articles/hexagonal-architecture-what-is- it...](https://dzone.com/articles/hexagonal-architecture-what-is-it-and-how- does-it) Make of that what you will.

<comment><USER13> Hexagonal arch is a very old name, another popular name is "ports and adapters". Alistair's article on the C2 Wiki suggests 2005 as the origin of the name ([http://wiki.c2.com/?PortsAndAdaptersArchitecture](http://wiki.c2.com/?PortsAndAdaptersArchitecture)), but that the pattern was identified in the 90s.

btw, wayback machine has a copy from 2009 of Alistair's page: [https://web.archive.org/web/20090122225311/http://alistair.c...](https://web.archive.org/web/20090122225311/http://alistair.cockburn.us/Hexagonal+architecture)

<comment><USER12> Yep, that's mentioned in the comment you're replying to. 2005 is still a long time after the Adapter pattern became popular [https://en.wikipedia.org/wiki/Adapter_pattern](https://en.wikipedia.org/wiki/Adapter_pattern).

I definitely do think one should avoid service provider lockin by using abstraction, I'm just not going to use the awkward sounding name coined by someone who doesn't seem to be adding much to the concept.

</comment></comment></comment><comment><USER14> IMO, deciding to go "serverless" or not usually ends up with about the same amount of work as far as writing code and configuration goes.

Things like "serverless" or firebase data stores or even html hybrid app frameworks, for example, are designed more so for simple proof of concept apps. As soon as you begin any sort of serious pipeline development, deep configuration for special case, scaling, etc. you'll find these easy to use services and ideas limit your control overall. Vendor lock-in is just a benefit of "configuration-free" systems which is a side effect of people not willing to rtfm.

<comment><USER15> Serverless guy here. You're on the right track. I'd just add that it's more about ops burden than anything else.

iRobot is a $3bn market cap company with 23 million robots in the wild. Their entire IT estate for managing 23 million robots including the communication and systems is $15k a month. They can see their costs down to the function, they can see where every cent is spent and they do this with 10 engineers, 8 of which are in development, 2 in Ops.

 _shrug_

<comment><USER14> Until a rearchitecture is needed. Then you'll either need all your developers in ops or vice versa.

(Assuming your response implies iRobot uses serverless)

</comment></comment></comment><comment><USER16> Is vendor lock really an issue that needs to be solved? I am wondering if one had to ever switch vendors in practice. It sounds like over optimization to something that might not even be in the requirements. I remember a few years ago when infrastructures were designed to be able to handle 1m+ requests per second long before market validation. Keep it simple and focus on getting your app to the market.

<comment><USER17> > Is vendor lock really an issue that needs to be solved?

I don't think so, not at this point. Workloads are more portable today than they ever were, as long as you're not using XaaS from your cloud provider.

Compute has become entirely commoditized. I think in the next 10 years or so, with lower power/instruction and ubiquitous 1G internet links, it will become cheap enough to start running workloads in-house again.

</comment></comment><comment><USER18> For me, my main problem with "vendor lock-in" is not the switching cost. I'm not planning to switch vendor any time soon. For me it's more about the black- box nature of their solution. It's usually proprietary, closed-source solutions that put you at their complete mercy when things go wrong. It's not debuggable, I can't run it on my laptop, I can't look inside how it works, I can't make changes to it, I can't run my own, slightly modified version of it, etc...

<comment><USER11> Out of all the open source code you use, how much of it have you ever inspected and not treated as a "black box"?

Most of AWS's proprietary services have a way that you can simulate running them on your laptop.

<comment><USER18> Many.

100% of the times I've used one of those local versions, I've ran into incompatibilities with the real service.

<comment><USER11> Which ones?

<comment><USER18> Not sure what you mean here but OS projects that come to mind that we haven't treated as a black-box at some point are kubernetes, docker, node, chromium, rabbitmq, postgres and every JavaScript module we use. Two local services that come to mind that we have used and that didn't work like the AWS equivalent is dynalite and fake-s3.

<comment><USER11> I mean have you actually inspected the source code and/or made changes to suit your needs for infrastructure level resources where there is a managed equivalent?

<comment><USER18> Yes

</comment></comment></comment></comment></comment></comment></comment><comment> village-idiot I still just don't understand why I want serverless, especially as my main request serving mechanism. Every investigation I've done into it revealed a lot of issues around function management and latency that always seemed harder to deal with than just writing a server in <language> and deploying it on ECS or fargate.

<comment><USER19> Serverless backends tend to work quite well when paired with a Single Page Application on the frontend – e.g. Vue.js or React. That way your frontend can be served from a static host – e.g. S3 or GitHub Pages – almost instantly. And so the perceived performance of your application isn't harmed (as much as you'd think) by the latency of your backend, since other aspects of the application's interface can load and continue to be responsive.

<comment><USER20> To me, that does not seem to describe anything specific to "serverless"?

You've always been free to serve your static assets in any way you like, so I'm unclear as to how the way the backend is architected comes into play here.

<comment> james-mcelwain I think they're suggesting that bad latency from a serverless architecture is mitigated by a SPA, since the application can render and appear functional while it's fetching data.

Still, not sure how damage control for poor performance is a "pro" of serverless design.

</comment></comment></comment></comment><comment><USER21> I created bigcgi.com largely in reaction to vendor lockin. I use the CGI standard and open source the whole platform. It allows for serverless apps to run locally, with or without the platform, because any valid CGI binary/script (which communicates via stdin, env vars, and stdout) should run on the platform.

<comment><USER22> Please don't take the following as personal slight.

Not sure if it's a joke or long term project... because the descriptions, while perfectly true, feel a bit like snark and sneer. "CGI: We are the original pranksters", right as it may be, doesn't exactly feel like an enterprise sales pitch.

Other than that, and the single tier, tight RAM provision effectively precluding any hosted language like PHP, I applaud the initiative.

<comment><USER21> No offense taken. I see it as an exercise of tech minimalism and exploring the boundaries of how much "obsolete" tech can really achieve.

I'm not really interested in enterprise customers (too much pressure and liability). I envision it for students, side projects, and small operations.

It is also currently in invite only beta while I continue my experiments with the platform. I have been meaning to work with the homepage; I do not want it to seem snarky.

Thanks for checking out the site, I appreciate the feedback!

</comment></comment></comment><comment><USER23> "fighting vendor lock-in" by surrendering your data to one multinational out of 4? Oh the sad, sad irony.

</comment><comment><USER24> I was hoping to see the Serverless framework and possibly using the OpenFaaS plugin thats in incubation - [https://github.com/openfaas- incubator/serverless-openfaas](https://github.com/openfaas- incubator/serverless-openfaas)

Big bad vendor locking is fine in some cases, perhaps smaller shops who don't need multi-cloud or the time investment, but if it's greenfield, then perhaps above worth considering (if not now, when matured)

<comment><USER12> Architect Serverless ([https://arc.codes](https://arc.codes)) is currently AWS-only, but also avoids adding anything that's specific to AWS, so in future your .arc file (that does all your API gateway, lambdas, queues, etc) will work on Azure etc.

</comment></comment><comment><USER25> There are a few vendors built on top of multiple cloud vendors however they themselves become the lock in, zeit or Joyent are good examples of this.

</comment><comment><USER15> Vacation Tracker hasn't raised much money. What a way to waste what little they've raised. I feel like someone should tell their investors.

</comment><comment><USER26> To prevent vendor lock-in and still go serverless, you could look into using a service like Now. Under the hood, it switches between AWS, GCP, and Azure based on whichever edge is closest.

[https://zeit.co/now](https://zeit.co/now)

<comment><USER27> Does Now support self-hosting? If not then you just vendor locked yourself to Zeit :P

</comment></comment><comment><USER28> In summary:

If you depend on cloud services, a good idea would be to write tests when planning the system so you can easily switch vendors later if the business relationship sours. Poster thinks "hexagonal architecture" is flexible enough to do this.

</comment><comment><USER29> What if your main concern isn't switching cost but rather giving your users the liberty to run their own instance of the service on a provider of their choice?

</comment><comment><USER30> Website is down, not serverless I guess :)

<comment><AUTHOR> It's up again. It's WP, and not serverless unfortunately haha</comment></comment>


Is it a dog or is it a wolf? 18,000-year-old puppy leaves scientists baffled - <AUTHOR> https://lite.cnn.io/en/article/h_798fb63696b010e550c126dd91d61c00 <comment><USER2> Waw good</comment>


AWS e-learning course – interested? - <AUTHOR> We are planning to develop a MOOC for AWS. Would anybody here be interested in joining it? <comment><USER2> Count me in</comment>