Edward Snowden: The Internet Is Broken - <AUTHOR> http://www.popsci.com/edward-snowden-internet-is-broken <comment><USER2> Excellect! It's the most cogent analysis that I've seen from him. Damn, what a fucking hero!

A few comments, however ...

> ... we had to go to the dark side to be able to confront the threat posed by > bad guys. We had to adopt their methods for ourselves.

He's using "we" there in reference to the government. But it can also be read with "we" as you and me, and "bad guys" as the government ;) But then, I claim a broad "right to be left alone", one that doesn't concede any state monopoly on power.

> ... you can't opt out of governmental mass surveillance that watches > everybody in the world without regard to any suspicious criminal activity or > any kind of wrong doing.

Well, sure you can ... as he goes on to explain ...

> You would need to act like a spy to pursue a career in a field like > journalism because you are always being watched.

... and ...

> Instead of changing your phone to change your persona — divorcing your > journalist phone from your personal phone — you can use the systems that are > surrounding us all of the time to move between personas.

Right! Compartmentalization is for sure the way to go. There are numerous personas like Mirimir. Maybe I make it too distinctive. But I have no meatspace identity that goes on like Mirimir does. And Mirimir, ve has lots of vis personas. So hey, let's create a tangled morass of overlapping personas ;)

<comment><USER3> > ve has lots of vis personas

Are those typos?

You touched on the cyperpunk fantasy: using multiple online identities, all kept carefully separate from each other and from your real identity. (There's an excellent short story called True Names that explores this idea.)

For the majority of ordinary, nontechnical people, there are lots of simpler solutions.

* Use cash. In Berlin, many ordinary people have an awareness of and distaste for government surveillance. People remember East Germany. One result is that lots of people will just pay for everything in cash. In most other western countries, the norm is to leave an electronic trail of every single shop you visit.

* Use Signal or WhatsApp. WhatsApp rolled out strong end to end encryption to a billion people--most of whom have no idea what a "key" is and only the faintest sense of what "encryption" means.

The lesson I take from those projects is that whenever we can ship transparent, easy to use encryption that our users dont have to worry about, its a massive win.

If your app allows users to talk to each other privately, consider adding E2E encryption. It's the future.

If your app has some kind of cloud backup, like a password manager or a photo app, make sure that it's encrypted with a key that you don't have access to.

E2E comes with product tradeoffs. You may have to charge your users money, because you cant target ads against data you cant access. You'll need to make an installed app rather than a webapp. But its worth it -- and I think someday, hopefully soon, users will demand it.

<comment><USER4> You can't E2E with a web app?

<comment><USER5> No, not really. Until there's a standard that allows doing crypto in the browser, enforcing a higher security level for the page, and somehow verifying the hash of contents (so sites can "publish" an app) then web apps are basically useless for security.

I know this is as pathetic as "why aren't scientists working on cancer instead of X", but we have WebXXX including Bluetooth and USB, you'd think we'd have "WebVerifiedApps" or something. Even content-addressable URIs aren't being allowed.

It's funny, given the rise of things like Tutanota, which provide basically zero security over Gmail. (In fact, probably worse, since Google's sec team is way better.)

</comment></comment></comment></comment><comment><USER6> The EFF warned long ago something was going on when AT&T was putting beam splitters on Internet backbones to feed the NSA. Then Snowden revealed how everything is tapped. Then, be sure all mainstream encryption is "NOBUS". Nothing is truly random. Someone somewhere has the master key: elliptic curve cryptography using magic numbers from NIST? "Secure boot" by Intel? OpenSSL? Microsoft software? All backdoored. Trust no one.

<comment><USER7> I heard about those taps in 2008/2009 I think. Snowden hasn't really given us anything truly new. It's also bizarre how quickly everything he presented was/is accepted as fact immediately without question.

I think it's way more likely Snowden was intentional. He's still working for the Federal government and the leaks are intentional so that the Federal Government could announce to the world that they are spying on all their own citizens...and nothing happen. No real revolution, and no real end to the surveillance.

I mean yea, we have better security practices, more people use encryption, more people are aware about security ... but overall the landscape hasn't changed except in one crucial aspect: people are talking less publicly. People are afraid that what they say is monitored. There has been a chilling effect.

The Snowden narrative needs to be questioned. Since when does an NSA contractor working from home in Hawaii get VPN access to all the government secretes? Like...people actually believe that?

<comment><USER8> I hope you're being satirical. This is such a classic formulation of a conspiracy theory that I hope it's intentional. If so, bravo!

If not, then like all conspiracy theories you need to account for everyone who would need to be in on the secret, how they're all keeping the secret, and why --what's in it for them.

<comment><USER9> Just to be clear, a big chunk of what Snowden's leak revealed actualized a bunch of conspiracy theories. Do you see the disturbing irony of dismissing another conspiracy theory so flippantly? I don't believe it's true, but if it turned out to be, I'd hardly be surprised.

<comment><USER8> The difference is evidence vs no evidence.

</comment></comment></comment></comment></comment><comment><USER10> > But at the same time, we technologists as a class knew academically that > these capabilities could be abused, but nobody actually believed they would > be abused. Because why would you do that? It seemed so antisocial as a basic > concept.

I guess so? Not me though. Snowden literally only proved what I had learned on my own.

> But we were confronted with documented evidence in 2013 that even what most > people would consider to be a fairly forthright upstanding government was > abusing these capabilities in the most indiscriminate way.

Um. Who thought this? Ever? Since the 90s.

<comment><USER11> You knew GCHQ tapped Google's datacenter-to-datacenter links?

<comment><USER12> Definitely. They could, targets were using it, they were known to tap backhaul microwaves/satellites, their own guideance in high-assurance side was using link encryptors between sites, its in their commercial recommendations (NIPSOM Industrial Security Manual), and so on. Everything in the world to make you think _somebody_ was tapping your line and that they might.

So, some groups that were wise went ahead and deployed link encryptors. Black programs, follow NIPSOM and SAP supplements, sure as hell used link encryptors so good [1] we can't buy them because... national security. I sure as hell used end-to-end crypto and VPN's for anything significant. Google and Facebook... treasure troves of PII and I.P.... didn't for reasons I can't imagine. Result was they got intercepted in bulk by something that's been a known risk for 20+ years. Take NSA out of picture and they should've still thought the lines might get tapped by crooks or foreign spooks.

So, yes, Snowden leaks mostly just taught us what we already knew in greater detail. People ignored it then, some ignore it now, and yeah problems happened.

[1] [http://www.raytheon.com/capabilities/products/high_speed_net...](http://www.raytheon.com/capabilities/products/high_speed_network/)

<comment><USER13> Google's datacenter-to-datacenter links probably weren't going over the public internet, so they didn't feel the need to protect against man-in-the-middle attacks on physical lines that they owned. If you connected two computers to each other with a cross-over cable, would you feel the need to encrypt all communications between them, just in case?

<comment><USER12> I'm sure that's what they thought. It's so common it's in textbooks. As in, any point-to-point line running outside two buildings through public land and a third party network owned by sneaky, Tier 1 types could never result in eavesdropping by anyone with physical or logical access. It was ridiculous claim when I read it and wasnt doing INFOSEC at the time. Horrendously stupid. There were already link encryptors on market for those exact lines for a reason. A good one in this case.

Far as your contrived example, yes I did recommend Layer 2 or 3 encryption, authentication, and monitoring between all nodes for a variety of benefits. It was also in Red Book (Orange Book for networking) as a high-assurance security requirement due to malicious hosts or tapped lines. All the times I eavesdropped on and screwed with Intranets fully justified it. Moreover, reading the Security Monkey later showed he handled a situation where an intruder did a physical splice of the line into a nearby building for his attacks. Just more evidence.

So, yes, security must be applied to every layer inside of and around endpoints, networks, and more. The risk you mentioned, minus crossover part, resulted in numerous hacks in the real world that my methods and 80's era methods would've stopped. In a PCI form factor, too, as DiamondTEK secure LAN did exactly that.

</comment></comment></comment></comment></comment><comment><USER14> Well yes, the internet is broken. That article is inaccessible to me. I am redirected from popsci.com to popsci.com.au which, it appears, doesn't have the article in question. I just get a message telling me "Oops! Something went wrong. Please scroll down to find your content." The content isn't there and there is no way to select the non-au site. Very broken.

</comment><comment><USER15> I guess, the Snowden incidence is being used to hurl undue venom towards USA. But these people are ignoring or deliberately misleading other people to ignore the real dangers posed by extremists (including Islamists, communists, the far right Christians and so on). These ideologically driven criminals (called terrorists) live hidden in the general public. Their identification is a main problem. This "identification" problem is what requires mass surveillance.

The terrorists are significantly different than many other criminals. In the sense that terrorists are not mainly driven by personal and earthly goals but they are driven by the goals set by their ideologies. Thus terrorism (inspired by hate ideology or religion) is significantly different in a very important respect from other crimes; that is, the terrorist(s) generally find support and shelter amongst large number of otherwise normal citizens inspired/driven by the hate ideology or religion whereas a murderer or a pedophile generally doesn't find such shelter.

Tell this Snowden to do (or at least talk) a little bit about the dire situation of people's freedom in the country he has chosen to flee to, namely, Russia. And the people who are criticizing US way too much should do themselves a favor by looking at countries run by tyrants like China, North Korea, most Islamist countries and Cuba. The way the Chinese government does the _mass surveillance_ of its citizens on the Internet and the way the communists have installed the _reward /punishment system_ based on it will make you realize that what is happening in US is hardly even annoying.

I am not to say that US is innocent person but it has been receiving criticism way too much.

Edit: typo

<comment><USER16> > I guess, the Snowden incidence is being used to hurl undue venom towards > USA. But these people are ignoring or deliberately misleading other people > to ignore the real dangers posed by extremists (including Islamists, > communists, the far right Christians and so on).

Yeah, well, I don't think Cuban or North Korean spies are really at the forefront of anyone's concerns (apart from South Korea and Japan).

> Thus terrorism (inspired by hate ideology or religion) is significantly > different in a very important respect from other crimes; that is, the > terrorist(s) generally find support and shelter amongst large number of > otherwise normal citizens inspired/driven by the hate ideology or religion > whereas a murderer or a pedophile generally doesn't find such shelter.

Funny how pedophile rings are regularly dismantled (and made of "otherwise normal citizens" in majority). As for the "wolf in sheep's clothing" thing, it's not necessarily true (look at the profile of the attackers in France and Belgian, most of whom were linked to petty criminality - not to mention the guy who _actually went to Syria_ ).

> Tell this Snowden to do (or at least talk) a little bit about the dire > situation of people's freedom in the country he has chosen to flee to, > namely, Russia.

It was only a choice in the sense that the alternative was "kidnapping by the CIA". Russia was way down in Snowden's list of countries to flee to. What you don't seem to realize is that even if it's not abused _now_ , it could very well be abused _tomorrow_. You want a Donald Trump nominating one of his cronies at the head of the US intelligence services and starting to dig into untold amounts of already-recorded communications?

And it's not only the US. Us Europeans are doing exactly the same thing, just with less money. The potential of it being abused by organizations which by their very nature have little to no external oversight (or by their political masters) is absolutely frightening. And that's compounded by the panopticon effect: if you're never sure of how much you're being watched, you will self- censor.

<comment><USER15> >>You want a Donald Trump nominating one of his cronies at the head of the US intelligence services and starting to dig into untold amounts of already- recorded communications?

Still a Donald Trump _in USA_ is far better and very less dangerous as compared to the tyrants like Mao or Stalin or Castro, because USA has many good checks and balances in place. I do appreciate people's fears about state becoming tyrannical but people in USA should not allow its enemies to use (exploit) such fear to push forward their agenda and make US a weak and vulnerable state.

The people of USA should recognize this. The important point to note here is that the intellectuals (Snowden and his supporters) who are targeting USA both at national and international level _were_ silent about the extremely intrusive surveillance and other atrocities inflicted by the tyrants like Putin (at whose place Snowden may be currently enjoying his reward) and _are still silent_.

<comment><USER16> > Still a Donald Trump in USA is far better and very less dangerous as > compared to the tyrants like Mao or Stalin or Castro, because USA has many > good checks and balances in place.

How do you think Hoover stayed in place that long? You can pull a great many things without needing to disappear people at four in the morning.

> The important point to note here is that the intellectuals (Snowden and his > supporters) who are targeting USA both at national and international level > were silent about the extremely intrusive surveillance and other atrocities > inflicted by the tyrants like Putin (at whose place Snowden may be currently > enjoying his reward) and are still silent.

Snowden was not a public figure before. And you really think a life of exile in Russia is some kind of reward?

That said, I think Snowden is against global surveillance in general, but:

a) I can totally understand that you want to tread carefully in this kind of situation. You don't think he has already given up enough? What would you do in his situation?

b) While Putin is certainly more willing to suppress political opponents, I doubt the Russian surveillance network is even remotely in the same league as the NSA

c) Snowden is no doubt a lot more qualified to speak about Western surveillance than he is about Russian or Chinese efforts

<comment><USER15> >>How do you think Hoover stayed in place that long? You can pull a great many things without needing to disappear people at four in the morning.

Still Hoover or whoever in USA is no match for Mao or Stalin or Castro as far as their potential to inflict torture and control over their citizens is concerned. A president in US cannot be a president for his entire life, it's only 8 years max (that too if people wanted him/her to be).

While in Cuba we can see Castro remained in power until he couldn't move his body even so much and then also he put his crony (his brother) in power. That is dangerous and worrisome.

>>While Putin is certainly more willing to suppress political opponents, I doubt the Russian surveillance network is even remotely in the same league as the NSA.

The way Putin and his cronies suppressed homosexuals in Russia sends chills down the spines of free thinkers.

In short, with your neighbours and even family members spying on each other and reporting to Putin's people, you don't need sophisticated surveillance network in the first place.

In USA, the situation is far, far better than what the Snowdens and their supporters are trying to portray.

<comment><USER15> See [1] also

[1] [https://en.wikipedia.org/wiki/LGBT_rights_in_Russia](https://en.wikipedia.org/wiki/LGBT_rights_in_Russia)

</comment></comment></comment></comment></comment></comment><comment><USER17> > _But at the same time, we technologists as a class knew academically that > these capabilities could be abused, but nobody actually believed they would > be abused. Because why would you do that? It seemed so antisocial as a basic > concept._

What's with 'we?' The various classes of technologists that I've been a member of - from the teen hax0r BBS days thru the crypto lists and Usenet groups to actual working professionals have absolutely believed this. It takes a truly spectacular amount of naivety to believe the contrary.

I have a deep and profound respect for Snowden, who has certainly sacrificed any possible semblance of a normal life in his native culture and likely narrowly escaped a worse fate, something he must certainly have known was a risk. It is his very naivety that made him such a perfect whistleblower : he's in there looking around and he's like "Holy crap! These guys are into some profoundly bad shit! I have to tell everyone!"

There's probably a hiring policy moral for black ops shops in there somewhere.

<comment><USER18> I think he's right. His statement is carefully phrased. Yes, of course, all sorts of intelligent people have argued that the tools of mass surveillance _could_ be developed and _could_ be abused.

But only a very small number of people picked up on AT&T Room 101 and Echelon and so on, and saw their significance. Unfortunately those things were more like news stories than events that redefined people's thinking. Mass surveillance simply wasn't a part of the conversation for the vast majority of technologists _who mattered_ , i.e. the ones building the products we all use.

The NSA leaks changed all that. Now you have the guys running WhatsApp and Apple talking about this stuff. And even though for politeness reasons they sometimes talk in hypotheticals, "if we don't encrypt it _could_ be abused by _bad_ governments", it's as clear as day that what they really mean is "because we don't encrypt it _is_ being abused by _our_ governments".

<comment><USER17> Not could. Had been and were, for which there was growing evidence culminating with the Snowden files. I don't disagree that they had a considerably larger impact than what went before. You're absolutely right in the sense that once the stories of GCHQ's black boxes, the EUP's documented disclosure of Echelon [0], room 101 and so on and so forth got outside the circle of people who were familiar with them they became FOAF stories and conspiracy theories and weren't part of any mainstream discourse, but there was a bit more to [it] than abstract hypotheticals and general 'power corrupts' cynicism.

[0] An Appraisal of Technologies of Political Control. [http://www.europarl.europa.eu/pdf/jadis/2013_12/8.PE4_AP_PV!...](http://www.europarl.europa.eu/pdf/jadis/2013_12/8.PE4_AP_PV!LIBE.1994_LIBE-199801260050EN.pdf)

[edit]

</comment></comment></comment><comment><USER12> He's still not getting it or fully recommending it any more than most have. The funny thing is that I recently read a 150 page interview with one of founders of INFOSEC, Dr Schell, that showed his employer was the same way: ignored "COMPUSEC" as useless in favor of "COMSEC" solutions to all security problems. Schell, Karger, and Anderson's tiger teams smashed every mainframe and crypto using system put in front of them due to hardware and software bugs. They bypassed it.

Like Schell and Karger said for _30 years_ , what we need is to start deploying high-assurance security practices, protocols, systems, methods... everything that's proven to get the job done in various ways. We need them deployed pervasively. More private protocols and encryption by default, too, but who gives a shit if it runs on systems so insecure it doesn't need backdoors?

Let's go back to 1960's moving toward the 70's and 80's on hardware stuff. Burroughs stuff was tagged so everything in memory was code or data, pointers protected, arrays bounds-checked, arguments checked on function calls, and OS tried to isolate apps from each other. Some LISP machines had GC's for memory management. System/38 had capability-security & built-in database. Solo had safe concurrency at OS level. One had read-only firmware you couldn't change without physically moving it with a nucleus that handle protected functions that OS's built on. Two implemented a secure, Ada runtime that enforced the language's safety properties. SAFE (crash-safe.org), Cambridge's CHERI, and Sandia's SSP/Score processors follow these traditions.

Now let's look at how Schell et al said to do assurance. Precise, math/flowcharts/whatever description of functional and security requirements to avoid ambiguities & resulting vulnerabilities. Similar for design with attention to simplicity. Implementation in safest language you can with simpler subset and style easy to analyze. Every module proven to match a requirement/spec so no subversion (well, a start on it...). Strict modularity, layering, and interface checks all over the place. Success _and failure_ states modeled then shown to follow a precise, security policy. If you can't state it precisely, then you can't secure it because you don't know what security means for you. Code review, tests of each function, formal proofs if possible, static analysis if possible, _covert channel analysis_ of info flows, configuration management that _assumes malicious developers_ , source to object code verification, trusted distribution of HW/SW to customers, onsite verification/generation from source, and configuration guidance. All of this independently verified by at least one set of professionals that know what they're doing.

That was security in 1970's-1980's. Far from red tape some here claim, _every method above_ was proven by researchers, field users, and pentesters to catch serious problems. The only dispute was what caught most and where to spend most money. Even those questions had decent answers. Well, plus specific design and modeling decisions but INFOSEC was in infancy & that was evolving. I'm talking assurance activities: getting it done right whatever it is. Fast forward today to find that all the problems Schell, Karger, etc predicted have happened and consistently in systems that don't use those methods whereas systems that do avoid many more problems.

So, here's the solution: raise assurance of our systems across the board using methods that go back to _1961_. That's right, Burroughs engineers were doing a better job on security before that was even a thing just trying to improve reliability. This is 2016. We have better specs, better languages, better static analysis, easier formal tools, automated test generation, tons of sample code, fast dev machines... you name it. There's no excuse, outside willful ignorance or apathy, for security-focused developers (esp in FOSS) to not use everything at their disposal that's _proven to work_ at reducing risk. Even less excuse for the stuff they make to _still_ be less secure than tech from the friggin 60's and 70's.

Shout out to the exceptions that are trying to do it right. Groups like GenodeOS, Dresden, NICTA/OKL4, Carlisle's IRONSIDES DNS, Bernstein's stuff, Galois, JX OS, ETH, INRIA, Secure64, Sentinel HYDRA (minus bodacion crap lol), Combex, and even NativeClient since they knocked off OP browser. Enough stuff like this and NSA will be begging us to ban INFOSEC books and shit since their info will dry up haha.

<comment><USER19> I agree that software bugs are a bigger concern than encrypting everything. I think the problem is that not many people are starting companies around "high assurance." How do you get people to turn their PL research into startups?

<comment><USER12> Galois Inc is a perfect example of one that continually makes money on high- assurance R&D some of which they open-source. Others spin it off into useful commercial tools. INRIA has done that with Astree Analyzer for C. Other times they can just make the tools practical and available for a community that will then build on them alongside their students. INRIA w/ Ocaml and Coq come to mind again.

So, that's one route.

</comment></comment></comment><comment><USER20> I have absolutely no faith in any government that gives the impression that they will add tighter controls or a reduction on the collection of personal data.

They've been doing this for many years before Snowden and will continue long after any new laws are passed to give us the impression of an improvement.

</comment><comment><USER21> I'd love to be able to read this article, however popsci, in their infinite wisdom, redirect all Australian users to the .com.au site...which doesn't have the same articles. _Sigh_

US proxy it is then!

</comment><comment><USER22> Excellent points.

I think the other part which he hasn't discussed is the rise of Cloud companies like Google, Facebook. We should really be working towards an internet where people can keep the data to themselves and decide how it gets used. But now, the default is for these corporations to own all the data.

Of course, govt can still access the data (which is what snowden is talking about) but that is a different problem.

</comment><comment><USER23> Computers are also broken, and the Internet makes it more obvious.

</comment><comment> yoz-y Soo... roll out your own crypto?

</comment><comment><USER24> >hello,

>You are receiving this error message because your ip (126.96.36.199) is listed in the StopForumSpam.com database.

>You can check the status of your IP and have it removed by visiting [http://www.stopforumspam.com/removal](http://www.stopforumspam.com/removal). Thank you.

It's kind of ironical that they are quoting Snowden and their own site blocks Tor.

E: didn't HN used to have markdown quoting?

<comment><USER25> There's only been [https://news.ycombinator.com/formatdoc](https://news.ycombinator.com/formatdoc)

</comment></comment><comment><USER26> Broken for whom?

<comment><USER27> The Dutch for one, whose major ISP Ziggo still does not provide IPv6.

<comment><USER28> The only cable provider(charter) in northern MI doesn't support IPV6.

<comment><USER29> The largest provider where I live in Southern California does not support IPv6. The largest cloud providers don't either. Amazon, Google, and Microsoft all lack any IPv6 support at all.

<comment><USER30> Large cloud providers may have _poor_ IPv6 support, but they do have some support.

For instance, do a DNS lookup on netflix.com. You'll find IPv6 records pointing to Amazon AWS IP space.

</comment></comment></comment></comment></comment><comment><USER31> _" police and the government then have the authority to search through your entire life in your pocket just because you are pulled over for a broken taillight"_

This is the classic Snowden formula. Establish a false premise that has no faith in the government or constitutional rights, then continue to paint a picture of a dystopian future.

This guy should be writing sci-fi novels...

 _[edit: I predicted at least 5 down votes as I typed this. Don 't disappoint me ;-) ]_

<comment><USER32> What is the false premise?

Why do you think 'faith' is required in a logical argument?

What future?

<comment><USER33> "police and the government then have the authority to search through your entire life in your pocket just because you are pulled over for a broken taillight: "

Is false.

<comment><USER34> Isn't it routine?</comment></comment></comment></comment>


iOS7 is not about flat - <AUTHOR> https://medium.com/p/2aa9dba0d202 <comment><USER2> It's funny how all these things that have been in Android forever and were criticized for their battery draining powers are suddenly the latest and greatest reason why Apple phones are the best. It's just the way it goes, remember 7 inch tablets? Worst thing ever and everyone lists reasons why. Until Apple made one. Marketshare means everything! Until Android stole that, now market share is a false signal. King of profits! Until Samsung took that too. Keep moving that goal post.

<comment><USER3> You forget a few things. On Android can't the app just run forever and decide on its own how often to poll the servers? This is a different thing. The OS decides when to schedule things if the app supports it.

Also battery life has improved a great deal since the first Android or iPhone device came out. What may have been true years ago isn't necessarily an issue anymore.

<comment><USER4> You mean like using Android's SyncAdapter and setting inInexactRepeating()? Android has supported this basic type of background scheduling since the start of time. The main difference is that Android you can do more - which can be abused. And their solution for abuse is a battery monitor that allows you to see which app is using the most battery. In a way you can say Android is more superior/powerful or you can say that the iOS is more limiting and thus potentially more user friendly.

<comment><USER5> Unfortunately, I think many Android app developers either don't know or care about "API abuse". When my Android phone is sitting "idle" with the display off, adb logcat still shows _tons_ of debug logging from apps doing more work than they should. I like the freedom that Android gives developers, but, as you suggest, I think iOS provides a better user experience.

I can think of many ways Google could fix some of this bad behavior by throttling apps running in the background.

<comment><USER6> Yeah, some apps suck on Android, leave unnecessary services running etc. I uninstall them, and leave a review stating why.

</comment></comment></comment></comment></comment><comment><USER7> Firefox OS already uses the same model, push notifications will fire up the application, the application can then decide to create a notification, to update the internal cache to reflect the latest changes; it's called the Simple Push API[1]. It can also wake up the application every X minutes to pull the data (Alarms API[2]) and do the same thing.

[1] [https://developer.mozilla.org/en- US/docs/WebAPI/Simple_Push](https://developer.mozilla.org/en- US/docs/WebAPI/Simple_Push)

[2] [https://developer.mozilla.org/en- US/docs/WebAPI/Alarm](https://developer.mozilla.org/en-US/docs/WebAPI/Alarm)

<comment><USER8> The model is fairly similiar on Android too, for what it's worth.

<comment><USER9> This seems like something Apple would want to patent. I wouldn't be surprised if we saw some new Apple Vs. Android, Apple Vs. Mozilla lawsuit about "background fetching".

<comment><USER10> Android has had "Sync Adapters" since the beginning, a very cool and powerful framework that allows apps to piggy back off each other's data connections, reducing the number of times the cell modem needs to be fired up for background fetches.

Not a new concept, I'm sure the patent battle lines are already well drawn.

<comment><USER11> SyncAdapters were added in Android 2.x

</comment></comment></comment></comment></comment><comment><USER12> Just what I want: every developer of the 200 apps I have on my phone thinking theirs is the most important one and trying to take over my entire phone every 20 minutes to background process.

The self-centered perspective of the article is even slightly disturbing, basically implying that their app needs to pre-load data because it's so important and can't make the user wait. A common perspective, sure, but this is the tragedy of the commons in app form.

This will require some careful government.

<comment><USER13> That's the thing. It will be in the background. You won't even notice.

<comment><USER14> But we've been told for years that Android is fundamentally broken because it allows this. I guess everyone changed their mind?

<comment><USER15> As has been pointed out elsewhere in this thread, it's not exactly the same: iOS is still much more strict about what runs and when. Apps get woken up only when the system decides to wake them up, and it decides based on current battery life/power state, other system activity level, and the user's usage patterns of the app. Then, once woken up, apps get a limited time to run.

<comment><USER16> Android does this as well, so I guess like the guy you are responding to, i don't see a real difference.

<comment><USER15> To my understanding, Android offers something similar _and_ also allows apps to wake up arbitrarily in the background. Reasonable people can disagree on whether the latter ought to be an option or not (or, perhaps even more reasonably, can be happy that both types of devices exist so people can choose which they'd prefer). But the complaint regarding Android was that it let poorly-behaved apps drain significant amounts of battery in the background and it's not true that Apple has now added that possibility.

<comment><USER16> So you know all the technical implementation details of both?

Or are you comparing random API doc material and actual technical details?

Apple says a lot of things, not all of them turn out to be technically accurate.

For example, do you _know_ it actually will not allow poorly behaved apps to drain battery, or is this just an assumption based on what apple says will happen?

What always happens in these discussions is people say "apple's docs say x, so it must be like x". Quite often, when people actually go and look at how it operates, it isn't like x at all.

<comment><USER15> The discussion was around architecture. Of course it may not behave as intended when actually implemented because of bugs. Or because of Apple outright lying in their communications. Sure, those are possibilities, but they're irrelevant to architectural criticism.

<comment><USER16> But you have no real architecture details, only a small number of bullet points on how it's supposed to behave and a simple but not horribly descriptive API. That isn't an architecture, that's just marketing materials. They are completely irrelevant to anything.

Given only that, you cannot possibly make informed commentary on how it will behave in practice, you are just parroting a story.

In particular, you said "it let poorly-behaved apps drain significant amounts of battery in the background and it's not true that Apple has now added that possibility."

You cannot possibly assert this with any real details to back it up, because you do not know how this architecture operates past "apple says they won't be woken up enough or run long enough to drain battery". If you have the actual details necessary to back this statement up, please add them.

Unless you are talking at such an abstract level where everything that matters is an implementation detail, in which case it's very easy to design perfect architectures that have no problems!

We don't believe people when they make crazy claims about crypto, without seeing the actual details and implementations. We should not trust Apple _or_ Google's marketing points about their architectures when trying to make "architectural criticism".

In the end, if you really believe "architectural criticism" is possible without actual detailed design info, carry on.

But to me, that's a worthless discussion based on what are essentially talking points.

In any case, all that matters in the end is performance in the field, so this entire discussion is mostly technical masturbation until real users have phones in hands.

<comment><USER15> I'm not sure why you think I have no real architectural details. What do you know about what I know?

Regardless, I think your pedantry is based on a statement I intended to be read in a less formal fashion than you're choosing to read it. When I said that it was not a possibility for poorly-behaved apps to drain significant amounts of battery under iOS 7, I didn't mean that it was absolutely impossible _under any and all circumstances including system bugs, unforeseen architectural weaknesses, or gamma ray induced bitflips_. People say "Linux uses memory protection to keep processes from corrupting the memory of other processes" and we all understand that they don't mean that it's _literally impossible_ for memory problems to ever happen.

Likewise, my point was that it is generally true that iOS 7 doesn't allow apps to wake up as often as they want. That is a design goal behind its architecture. Doubtlessly, neither its architecture nor its implementation are perfect — I'd be surprised if it were utterly _impossible_ for an app to end up running whenever it wants in the background. But it'd be boorish to belabor that point.

The original post that has led to this discussion was saying that Android has been criticized for being designed to allow apps to run in the background arbitrarily and now iOS has been redesigned to allow that too. That's not true. And the conclusion of hypocriticalness that was drawn from this faulty premise was untrue.

<comment><USER16> "I'm not sure why you think I have no real architectural details. What do you know about what I know? "

They do not appear as supporting details of your argument, so ...

Again, you are trying to make it seem like pedantry and that i am addressing only extreme cases or bugs , and my point is you have offered no details to support any part of your argument.

"Likewise, my point was that it is generally true that iOS 7 doesn't allow apps to wake up as often as they want. "

I quoted your statement about battery life, and said you have offered no details to show this to be the case. Rather than offer details to refute that, you have now instead said "I said something different".

I'd appreciate it if you would stick on point and address my contention that you have not offered details about this statement:"it let poorly-behaved apps drain significant amounts of battery in the background and it's not true that Apple has now added that possibility."

Please offer details to back this up. IE what architectural details you know that you believe make it the case that apple has not added the possibility of apps using large amounts of battery in the background.

If the details are "apps can't arbitrarily wake themselves up", then your statement about the possibility of background apps draining battery life is easily shown to be wrong, and i'll be happy to refute it for you. If it is something else, i'd love to hear it, so i know exactly what argument i am addressing.

Let's stay with this one part of the argument, please.

</comment></comment></comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER17> I think this speaks to something really important that's rarely touched on directly; people hate waiting for software. I despise it. Many ordinary consumers use their phones as a way to solve "waiting" in general (just look what happens when you have a bunch of people in line: they take out their phones to pass the time).

To date, the way most developers solve this (Aside from optimizing for performance where possible) is to use loading indicators of some kind, but that's a bandaid at best. Some work will definitely have to be done to manage the battery drain concerns that can arise from this, but more time spent in your app actually doing stuff, and less time waiting for the app to update will be a huge gift of time back to users (basically 2 - 5 seconds every time you open an app is about to be given back to you). Add that up over many app opens every day over many days every year; its substantial.

<comment><USER18> Yeah, but let's be honest. It's not real productive time. It's Facebook, Twitter, and Candy Crush.

<comment><USER17> Agreed - definitely not real productive time. Most of the time it's just entertainment (which makes sense if you consider that no one ever has any idea how long they'll be waiting for whatever it is they're waiting for).

</comment></comment></comment><comment><USER19> Apple's guidelines have _always_ said that developers should avoid splash screens 'or other startup experience.' That's nothing new, but many developers ignore it anyway.

<comment><USER20> Easier said than done. This is trivial for single-purpose apps like Calculator or Weather, where it's easy to predict what the post-launch UI will look like (hint: there's only one screen...)

For much larger apps the "fake screenshot" is harmful. Take the Facebook app for example - what should the "fake screenshot" be? iOS does not differentiate between a completely fresh launch vs. a simple restore from background, and will show the same image no matter what.

So now you're in a situation where you've presented your users with a fake/blank Facebook stream, but really they were restoring to a photo they were looking at. Oops.

Or hell, do you even know if your user's logged in? Would be a shitty experience to show them the fake/blank stream but suddenly pop them back to the signup/login page no? What if they _are_ logged in? Would be a shitty experience to show them the signup/login page and suddenly yank _that_ out from under them.

This whole business is a shitty solution to a shitty problem: apps take forever and a day to launch.

<comment><USER21> Background fetch actually provides a solution this exact use case. If the user uses your app enough for iOS to let you run in time, the app should be able to "get ready" before the user opens it.

<comment><USER20> How so? You can know all the state you want, but iOS is still going to display that one static image. If the user is returning from background into a photo gallery, it's still going to show your default image. If the user is opening the app directly into a conversation, it's still going to show your default image.

I don't see how backgrounding solves any of this.

</comment></comment></comment></comment><comment><USER22> Sounds like another way for apps to drain my precious battery life.

<comment><USER23> ...and prefetch will drain the data plan by downloading information that may never be needed.

<comment><USER24> I'm sure data-sippers and battery-hawks can configure settings it so it's only when on wifi, or when-charging (or both).

Given about 90%+ of mobile users have access to a wifi point + charger on a nightly basis, this seems reasonable.

I'd mainly use it for podcasts and Audible - keep my casts and books updated so I don't have to sit in the car for 5min downloading the daily selections.

</comment></comment></comment><comment><USER25> The background behavior in iOS 7 is a great improvement but can't really be described by those of us who are still under non disclosure agreement. Beyond that there are lots of goodies for developers that have been added to iOS APIs.

<comment><USER3> Wait... there is still a developer NDA?

</comment></comment><comment><USER26> Forgive my complete ignorance on the topic: Can't you just push down the information the customer needs? I get that it might be more difficult to use the push API but could an app theoretically have achieved the same experience via push?

Also, I'm not quite sure API enhancements are what a release is "about". Admitting that the crazy 3D designs were over the top and adopting a design _similar_ to Metro and Android Holo seems like a rather large shift for Apple.

<comment><USER20> Sort of. Yes and no. You can bundle whatever data you want on a push notification, but there are some restrictions:

\- Size limits. It's a push notification, so the amount of payload you can attach is pretty limited. Not the whole conversation history of a chat, for example.

\- Lack of guarantees or SLA means using it this for time-ordered information is a bad idea. For example, assembling a chat history from a series of pushes is generally a recipe for awfulness. Pushes are not guaranteed to arrive at all, nor arrive in a certain order.

\- No sensitive information in pushes, since it's (mostly) transmitted in the clear. Apple recommends payloads be IDs and such and the human-readable component be general. "You have a new message!" rather than "You have a new naughty pic from Jane!".

Long story short, when your app wakes due to a push notification it's almost always smarter to fetch the canonical state over the networking than try to piece it together from the push payload. This incurs a pretty hefty user- visible delay and results in a shitty experience.

<comment><USER26> Thanks for the excellent details. I thought that email also used push (on all platforms). Is that special cased? Or a different type of push?

</comment></comment></comment><comment><USER27> "Apple's guidelines for iOS7 developers actually demand we avoid splash screens 'or other startup experience.'"

This was an interesting line. I had a debate with my designer friend about this who pointed out that this wasn't new. Turns out, the line about no splash screens is part of the Human Interface Guidelines today. The splash screens seems to have been a community driven interface decision rather than an Apple one.

</comment><comment><USER28> IIRC, even J2ME MIDP had this feature on feature phones, see [http://www.oracle.com/technetwork/systems/pushreg-156557.htm...](http://www.oracle.com/technetwork/systems/pushreg-156557.html)

Circa 2002.

Everything old is new and magic and amazing now folks!

<comment><USER29> And I could have implemented this on any computer going back 30 years.

What exactly is your point ?

<comment><USER28> What you "could" have done, and what was actually done are two different things. Both J2ME and Android had this facility for a long time. Apple, like Microsoft, dragged their feet and badmouthed this feature, then finally ended up implementing it. Now we will be told it is amazing and magical. And of course, the usual excuse will be proffered "Apple held back on it until _it could be done right_".

Remember 7inch tablets would need you to file down your fingers to use? Or that "if you see a task manager, they blew it" and low and behold, a task manager appeared on iOS.

I'm all for Apple implementing these features, but I'm tired of them badmouthing things they don't have, only to trot them out as amazing once they do have them.

Microsoft used to badmouth HTML5 Canvas, then when they finally got a great implementation in IE9, all of a sudden, its WebGL that sucks.

Don't badmouth features just because a competitor has them and you don't, badmouth them if they are indeed, bad features.

</comment></comment></comment><comment><USER30> TLDR: iOS7 allows for background fetching when the app is closed. Allowing for smaller wait times when users open up an app.

Is there any way for users to manage this behavior? If not it seems ripe for abuse or just plain laziness.

<comment><USER31> A developer can't just set a background fetch interval in iOS7 and have the app fetch at that interval (i.e. fetch every hour). Rather you can set your app to background fetch, and when it fetches is at the mercy of the OS.

The OS tries to be smart about it, lumping fetches together when it can, and noticing things like when the user opens the app typically.

So say the user launches GREAT WEATHER app app normally at 8 am, the OS notices and performs a background fetch a few minutes before (for example).

</comment></comment><comment><USER32> "Even a five second delay"

Optimizing response times seems like a better, more universal approach.

<comment><USER21> Agreed, especially loading time to encourage repeat use.

</comment></comment><comment><USER33> IMO iOS 7 is a textbook case of fixing something that's not broken.

<comment><USER34> Have you used it? Are you familiar with what it's doing or how it's doing it? Or just immediately dismissing it for no reason? For me, as a developer, it's fixing tons of things that were broken and allowing me to do lots of amazing new things with my apps that I haven't yet - while still letting the user dictate behavior and usage.</comment></comment>


Ceph distributed object based filesystem - <AUTHOR> http://ceph.newdream.net/about/ <comment><USER2> This looks promising. I spent a few minutes clicking around and reading the wiki and about page and I couldn't seem to find the answer to this question: Case studies of any sites using this filesystem.

I did find this:

"A word of caution: Ceph is under heavy development and should not yet be trusted to reliably store data. That said, wider testing is the fastest way to stabilize the system and bring it closer to maturity."

But are there any real example cases of this FS in use? (in beta software or otherwise)

<comment><AUTHOR> I've been busy collecting data on all kinds of cluster file systems, this on looks like it's almost a drop-in replacement for amazons offering.

That by itself makes it an interesting development.</comment></comment>


How to lose fans and (falsely) influence people - <AUTHOR> http://redeye.firstround.com/2008/02/how-to-lose-fan.html <comment><USER2> The privacy implications and "unintended consequences" of participating in Facebook are shocking.</comment>


Facebook Partners with Stack Overflow - <AUTHOR> http://developers.facebook.com/blog/post/545/

<comment><USER2> I don't see the stack overflow model as being a great fit for what facebook api developers need. The main problem I saw with facebook api was that the right way to do things kept changing, and the docs and forum didn't keep up well. You basically needed to begin facebook API work by reading the entire blog in chronological order and then keep on scanning the dev blog daily, which may work ok if you're a fulltime facebook API developer but it is not a good fit for contract or part-time or hobby development.

I think changing APIs is begging for a wiki much more than a Q&A site. Facebook used to have a wiki for their api, but they went and deleted it, which I considered basically unforgiveable and proceeded to do my best to avoid having to touch the API after that.

In short, bringing back <http://wiki.developers.facebook.com/> and focusing on keeping it current would be a much better start than a Q&A site, even a really good Q&A site. You'd still have the need-to-keep-with-changes problem, but at least you'd have somewhere to start from, and wouldn't keep getting referred to out of date information when googling answers.

Yes I know Stack Overflow has community editable wiki question styles, but then you just compound the problem and now need to update 100 different 'how do I [x]' questions every time the API changes.

<comment><USER3> I disagree - I find the stack overflow model much better than a wiki. In practice the search on SO is much better than a wiki because of how the questions are phrased. Using your how do I (x) example that is how the SO title would be phrased and that is how a developer searches for a solution.

Facebooks API docs are improving too - so this combination of quality docs and SO could be great.

<comment><USER4> The SO model works better is the API never changes - but since it does, a Wiki would probably be best.

<comment><USER5> I've both responded to SO questions with updates, as well as had one of my top answers be replaced by a newer, better solution. In browsing questions, I've also seen a number of updates to existing answers.

I guess the point is, if you've spent a lot of time figuring something out, and you've proved that a number of solutions on the internet are now wrong, you're tempted to make it easier for the next guy. I think this is true regardless of the medium, but SO seems to have done well at creating an environment where it happens.

</comment></comment></comment></comment><comment><USER6> Should I feel better about Facebook trying to crowd-source their developer support? This doesn't address any of the _real_ concerns with usable documentation or proper API deprecation. I get the impression that this is an attempt to spin past bad behavior into acceptable future bad behavior.

</comment><comment><USER7> I don't love that facebook.stackoverflow.com looks exactly like stackoverflow.com — there's no easy way to tell where you are, or to get back to the main stack overflow.

Even more confusing, you can get to un-Facebook-related questions on facebook.stackoverflow.com (e.g. from your inbox, or from a user page). Since there are no redirects between regular and Facebook SO, this means that every question on Stack Overflow now has two URLs, and you might see links to both.

<comment><USER8> At first I figured they just created a separate SE site specific to Facebook development but it appears to just be a filter on all questions which have a tag that contains "facebook" while hiding all others.

<comment><USER9> Yeah, that's what I thought.

Why not just create another stack exchange just for facebook? I mean, they've already got that system working for other topics.

Putting a filter on all SO questions and slapping a subdomain on it feels like it's a solution they created in 30 seconds.

<comment><USER10> Well, first off Facebook API questions are still on-topic on SO, so they will have more eyeballs and therefore a greater probability of being answered.

Second, programmers can keep their existing reputation, while a new SE site would put everyone back to 100. Since the topic is a subset, keeping it makes sense.

I don't really see what problems this solution brings that can't be solved with a custom logo.

<comment><USER11> I agree with your second point, but your first point goes against established precedent at Stackexchange.

I mean, if it was about getting more eyeballs then I think the best way to go would have been to use tagging, so that questions would be posted to 'stackexchange' and would then be tagged with 'programming', 'codereview', 'superuser' etc and as they were tagged they would show up on the programming.stackexchange.com (and other) sites. IIUC the current way is that if I post a programming question to stackoverflow, it will get 'migrated' to programming.stackexchange. That works, but it detracts from the total number of eyes because it is removed from stackoverflow.

That design decision is something that has always kind of confused me about the Stackexchange sites.

<comment><USER10> It's about the topic of the site. FB API questions are on-topic with SO, others aren't. The Code Review is debatable since it's arguably a subset of SO, but other SE sites (like Programmers) don't really intersect that much.

</comment></comment></comment></comment></comment></comment><comment><USER12> "We have been ignoring you developers a bit much on the existing forums, so, how about a do-over where you guys help yourselves?"

Accurate or no?

<comment><USER13> Very accurate. Facebook makes it clear that they don't give two shits about developers because they're top dog and they don't have to. This just solidifies that impression.

They should improve the clarity of their the documentation and add more examples, in addition to keeping them updated... or pay a couple people to answer questions. God knows they have the money.

</comment></comment><comment><USER14> See also the blog.stackoverflow.com side of the partnership here:

[http://blog.stackoverflow.com/2011/08/facebook- stackoverflow...](http://blog.stackoverflow.com/2011/08/facebook- stackoverflow/)

Basically, it's a siloed version of stackoverflow.com containing only the tags relevant to Facebook. They're thinking about creating mini-sites for other major subdomains (see also [http://meta.webapps.stackexchange.com/questions/913/is- this-...](http://meta.webapps.stackexchange.com/questions/913/is-this-site- not-running-as-well-as-it-deserves/915#915)).

<comment><USER15> Hate the idea. SO's search is decent. This is just the kind of fragmentation that I already don't like about programmers. _, unix._ etc.. You can easily filter your lists by tags, you can easily search by tag.

Where's the benefit?

<comment><USER16> Facebook will likely benefit a lot more.. They had a crappy forum, and they can let the rest of the folks actually do their support work I think :)

Well, come to think of it, I think google's support forums suck even more. You can post a problem on google support forums, and pray and hope for an answer from their developers.

</comment></comment></comment><comment><USER17> I would imagine that facebook actually writing non-terrible documentation for their API would be a better strategy then integrating with stack overflow.

This can't hurt, but hopefully they don't see it as an replacement for real documentation.

</comment><comment><USER18> I dont think there was anything missing from the existing FB developer forums except for the main missing ingredient - active participation from FB itself.

If they are going to be unresponsive on SO as well, migrating to the SO platform doesnt make sense at all.

</comment><comment><USER19> Omg, this is pretty awesome. Facebook API is terrible, and having one, unified and usable channel to bounce questions would be great. Given that we are all used to Stack model, this should really help at speeding things up.

</comment><comment><USER20> This is awesome. I develop quite a bit on facebook, but turn to SO for most of my needs. The forum is terrible, but it really does not make sense for them to build a new system from scratch.

</comment><comment><USER21> It's really just a view into Stack O. A set of filters and customizations under a subdomain. (It took quite a bit of work under the covers, natch.)

If you're already a Stack O user, this will hopefully provide a focused experience if you're also a Facebook dev. Or not. In which case it's ignorable.

If you're a Facebook dev who isn't involved with Stack O, it's a curated experience and hopefully better than what existed previous.

</comment><comment><USER22> I would love to see companies with APIs and active developer communities provide rewards to high reputation developers.

e.g. Facebook offers devs with over X reputation access to alpha APIs, devs with over Y reputation direct email support, devs with over Z reputation are recommended on the Facebook.com site as developers to hire for freelance work, etc.

<comment><USER23> Yeah, right. But still, better to have help from ourselves than no help at all.

</comment></comment><comment><USER24> I like the documentation model of API pages with comments allowed, plus a semi-protected wiki model to edit the API pages. This allows the API maintainer to easily update, provides change history, plus allows the community to step in and provide corrections or code examples without the burden of rewriting the article.

</comment><comment><USER25> damn..

Joel and friends, Google+? ;(

</comment><comment><USER26> This is a huge improvement over their developer forums, which are a mess of unanswered duplicate questions, terrible search, and didn't even support Facebook login.

</comment><comment><USER27> I'm not sure I like the way that my personal and professional life are suddenly becoming intertwined ... I want a few online identities dammit, not one!

<comment><USER28> Im sure I dont want that.

Does this mean stackoverflow will share their user data with facebook? If so, thats a disaster.

<comment><USER29> Of course it doesn't mean that, but even if it did, what user data are you talking about? The only non-public info that Stack Overflow has from (some) users is their email address and real name, which Facebook already knows.

<comment><USER30> But facebook can't associate Real Names with questions asked on stackoverflow.

If they had data-sharing in place, they could.

<comment><USER31> Oh my god, Facebook will know that you asked a question on how to write Hello World in lisp!</comment></comment></comment></comment></comment>


Ask HN: What are the best digital tools for activism things? - <AUTHOR> <comment><USER2> What is meant by "activism things"? I have a list of open tools here - [https://colet.space/alternative-tools/](https://colet.space/alternative- tools/)</comment>


Ask HN: Reliable and cheap root server, 1GB+ RAM – which provider to choose? - backend-dev-33 For years I used Hetzer VQ12 (unmanaged virtual machine with root, Single Core, 1024 MB RAM, 40 GB HDD) for experiments and to run some Java processes.
Nothing special, nothing fancy, just a relatively cheap (12,90 € per month) and relatively reliable (one or two times per year notifications about scheduled downtime for about 15-30 min) hardware.
At the moment there is a cronjob on this machine. Every hour it triggers a Java process which runs for about 5-10 minutes.
Now Hetzner going to discontinue these servers (they notified me in advance) so I want to move either to another Hetzner product (probably their "cloud" CX11 or CX21) or to another hosting provider.
Please share your experience. I heard some positive feedback about digitalocean (droplets?)
UPDATE: I do not want to have dependencies on cloud infrastructure. Just plain old Linux command line, nothing more <comment><AUTHOR> This sounds like something you could easily spin up on demand in AWS instead of aiming for reliability. Either an autoscaling group or a spot fleet that activates every hour, runs your job on startup, and kills itself. Micro is 1gb memory and costs $0.0104/h. Running that for 15min every hour is $1.8 a month. (+whatever storage space you need)

You could probably use a heroku task as well.

<comment> backend-dev-33 And Hetzner CX11 is €2.49 monthly and you have peace of mind regarding pricing (the price if FIXED).

Probably I have to rephrase the question to something like "Alternatives and side effects of Hetzner CX11 ?"

<comment><AUTHOR> The per-hour pricing I mentioned is fixed for the micro instance. (Well... It can go lower :-) ) I'm taking about normal EC2 instances here, so that is a cx11 alternative.

</comment></comment></comment><comment><USER2> Last year I used a VPS with specs similar to yours at LeaseWeb, for around €50/year. They're OK. I don't remember any downtime but I wasn't monitoring that VM 24/7.</comment>


Which Programming Language did you pick for your idea? - <AUTHOR>

<comment><USER3> Started out with Ruby on Rails, changed to Python (pylons) + mako + toscawidgets + postgres for more flexibility. Considering giving Common Lisp (Uncommon Web) a try, but the documentation scared the heck out of me.

<comment><USER4> We are currently looking at both Ruby and Python... What made you change, what makes you feel more flexible? We have been evaluating some of the Python frameworks and are currently trying to weight the positive and negatives of all the options... Any huge issues or just a bunch of different little things?

<comment><USER3> To be honest the different isn't that huge. The major reason I chose python is because there are many python web libraries that conform to WSGI standard, which means I can easily swap out components (routing, template, widgets, database mapping, etc.) that suites me the best. As a result there is a broader variety of each type to choose from in python.

Rails, as stated by its creators, is opinionated software, so you're stuck with their preferred way of doing things, which fortunately is not too bad as of now. So if you're a control-freak like me who also wants to squeeze more juice out of your CPU cycles, then go for python. If you want to put your trust in a well-integrated framework of components cherry-picked by smart folks, then go for rails or django (also python, but a little less flexible).

Here's a fairly up-to-date overview of python web dev options: <http://jesusphreak.infogami.com/blog/vrp1>

<comment><AUTHOR> I feel horrible for not giving python a chance .... but then there are only so many languages one can do mock-ups in .... before making a decision

</comment></comment></comment></comment><comment><USER5> PLT Scheme + PLT Scheme web server + flat files (actually serialized s-expressions on disk. Which aren't very flat.)

<comment><USER6> Why not use a database?

<comment><USER7> You're asking "why not add complexity?" Not a good place to start.

If a project needs a database you'll know it pretty quickly...and it's easy to convert to using a database at that point. The only time I've ever regretted a decision about databases was when I designed a log processor that didn't immediately have relational needs...over a couple of weeks of implementing the requirements I ended up writing a relational layer in Perl against a Berkeley DB backend. That was stupid, and I should have thought a little harder about the requirements. But it was my first big solo project, so I blame inexperience for not recognizing a relational problem from the start. Luckily, SQLite had just been released, and converting my app to use it (and losing a hundred lines of code) was a one day operation. It made the app approximately 100 times faster for my data set.

But, well over half of my applications since then have not required a database and have been well-served by flat files.

</comment></comment></comment><comment><USER8> Rails + Mysql

My webapps are requiring a lot of client side logic to be really interactive, so I've found that the biggest producivity factor is what I'm doing with Javascript. The Rails code I've been writing is mostly trivial; as long as it lets me talk to the database easily, I feel like any language could be used on the backend. However, I do love scripting in Ruby, and Rails makes it easy to use its DB abstractions in external scripts.

The best gains on the client-side come from using a good library. I've gone from Prototype/scriptaculous to YUI-ext to Mootools. I love Mootools. I've never been able to bring myself to try Dojo; it seems like it's trying to put the Java back into Javascript. What do you think?

</comment><comment><USER9> Ruby on Rails and Merb.

I'm actually just starting to use merb for simple requests that don't need the full rails stack (merb being threadsafe whereas rails is not, so it's useful to delegate some of the simple stuff to merb).

I still plan on investigating flex and seaside in the short term, just to see if there is any good ideas I can learn... (in a longuer term, I'll dedicate some time to lisp)

</comment><comment><USER10> I started out using java with WebObjects for a year, then found Django, never look back again.

Python is a lot better than Java for agile startups.

</comment><comment><USER11> My current project is in RoR, but I've not ruled out other languages/frameworks for other projects, depending on what suits the task best.

</comment><comment><USER12> Lisp + MySQL

<comment><USER13> me, straight Common Lisp (SBCL)

<comment><USER14> Do you guys use a web framework, like kpax, or straight CL?

<comment><USER15> We use Allegro Serve's webactions, though we've customized (bypassed) it to the point where we now only use their session feature.

<comment><USER3> Did you guys buy the Allegro suite or are you using portable allegroserve?

<comment><USER15> We actually bought Lispworks (half the price of Allegro), and are using portable allegroserve. My partner (who is a software architect by trade) learned lisp for our current start-up and is using slime on Emacs for his interface so we can switch to Allegro if we want later on, which we are considering for their native high-speed mysql interface assuming it performs as advertised - we're using ClSQL right now to talk to MySQL.)

He is extremely happy about lisp, especially after hacking java for years. (The code-base I had built up over the last few years as well as PG's writings helped convince him to give it a try even though he was very skeptical about lisp at first, There is no going back now :)

Ironically, we decided on a different (more focused) idea to pursue for the current startup for which my architectural firm is the current first customer (my hair was on fire for this app), so the initial code base is waiting for a later date. (It will be used to extend the feature set of the current app by adding a conceptual interface)

My partner is concerned about Aserve's ability to handle massive numbers of sessions at the same time, so we are considering going to a java websever and using the lisp side to generate all the html. (The html macro in Aserve is proving very fast and reliable) We're definitely looking for the best solution out there right now as we are planning to go live in about 2 months.

<comment><USER3> I'm fairly new to Lisp, this is encouraging to hear! :) Just a few technical questions:

Is there any specific reason to use Lispworks as oppose to a free implementation (say SBCL)?

I remember the author of portable allegroserve mentioned that he wrote it mostly for demonstration purposes, and might not perform well. Are you guys finding this to be an issue at this stage?

As for session, would it be possible to store session objects in AllegroCache, which comes with the paid version of AllegroCL? (I'm just a newbie speculating :) )

</comment></comment></comment></comment></comment></comment></comment><comment><USER16> C# and .NET framework, because my project is a distributed multi layered app. Plus I know it too well to use sometings else

<comment><USER17> Stating your chosen platform, and then feeling the need to defend it (twice) in the same sentance.. not a good sign.

</comment></comment><comment><USER18> Python on Planes

<comment><USER19> intentional double pun? pure brilliance.

<comment><USER18> Got it from Slashdot.com

</comment></comment></comment><comment><USER20> Since nobody mentioned it: I plan to at least evaluate Groovy+Grails - <USER2> it might be a smoother transition coming from a Java background than going to RoR directly. Also, some things just work better with Java, and Groovy might allow me to build on that (what things? Getting a database driver for example).

</comment><comment><USER21> Ruby (on Rails) for the web interface, I love it! :-)

Java for data mining, image manipulation and data shoveling, like in xml transformation. You can't really use Ruby for this... We also chose a servlet for one of our web services for performance reasons.

</comment><comment><USER22> My idea is a web application that manipulates a particular set of data, so of course I use BRL.

</comment><comment><USER23> Python, C, C++ (Django, PostgreSQL)

</comment><comment><USER24> C++, C#, ASP.NET 2.0, MS SQL 2005, IIS 6 on Windows C++, PHP, Ruby, MySQL, Memcache, Apache on Linux

I try to pick the best tool for the job and run with it.

</comment><comment><USER25> Trying to get HAppS to work. <http://www.happs.org/>

Of course, I'm about ten lines of code in, so I probably don't count.

</comment><comment><USER26> PHP, if ROR would be more supported here, than ROR

</comment><comment><USER27> Application : C#/F# Web : asp.net 2.0 with C#/F#

<comment><AUTHOR> Are you serious?? I didn't know people actually used F# ... are you using it for the Java Syntax or any other reason??

</comment></comment><comment><USER28> Python (Pylons, Mygthy), MySQL, ActionScript.

</comment><comment><USER29> \- python, c (django, wx)

\- sql, (mysql)

</comment><comment><USER30> C++ I need to support embedded systems, servers and everything in between.

</comment><comment><USER31> Seaside (because I want to implement some heavy desktop-like capabilities)

<comment><USER32> How does seaside help with that? Do you code all of the client logic in Smalltalk instead of Javascript?

<comment><USER3> I guess seaside's continuation passing style helps to reduce complexity in managing states, which is a major requirement in desktop-like apps.

</comment></comment></comment><comment><USER33> Perl w/ Catalyst/DBIx::Class/Template Toolkit and MySQL

</comment><comment><USER34> I'm going to build an ultimate web forum with Python

</comment><comment><USER35> PHP and openlaszlo

</comment><comment><USER36> Python.

</comment><comment><USER37> Python and web.py

<comment><USER38> python, webpy, binding in code from just about every other language.

</comment></comment><comment><USER15> Lisp (with MySQL)

</comment><comment><USER39> Python & Django

</comment><comment><USER40> PHP5 (as fastcgi w/ lighttpd and sqlite3)

<comment><AUTHOR> What is your experience with FastCGI??? I am running ROR off it, but lighttpd throws quite a lot of 500 Internal Server Errors.

<comment><USER33> FastCGI is super lightweight and very powerful. If you're seeing errors like that you likely have a problem that requires fixing. Judging from your post it might involve excessive question marks in a regex.

<comment><AUTHOR> I am running some basic stuff ... but notice the occasional 500's ... IRC / Web states that Pound with Lighttpd and Instances of Mongrel is really the best solution ... however, mongrel's site states that Lighttpd's mod_proxy still has issues....so I am really baffled with what is a proven solution... I am just gonna run some tests before I conclude...

</comment></comment></comment></comment><comment><USER41> RoR fits perfectly for my project

</comment><comment><USER42> Perl - Catalyst and PostgreSQL

</comment><comment><USER43> Java + gwt + eclipse + derby db

</comment><comment><USER44> PHP

</comment><comment><USER45> Python & C

</comment><comment><AUTHOR> Flex on Rails = ROR + Flex

</comment><comment><USER46> Ruby on rails + Postgres

</comment><comment><USER47> Lisp and Javascript

</comment><comment><USER48> Ruby on Rails

</comment><comment><USER49> php 5 and mysql 5 w/ zend platform

</comment><comment><USER50> Ruby and Java

<comment><AUTHOR> Are u considering JRuby ??

<comment><USER50> I might be. but for the mean time I'm exploring Rails :-) and gettng my Ruby skills up to match. Although I can't seem to shake Java's verbosity out my system and it reflects on my Ruby programs. :-)

</comment></comment></comment><comment><USER51> Java + GWT

</comment><comment><USER52> rails + postgres

</comment><comment><USER53> Rails

</comment><comment><USER54> PHP</comment>


Seamless SPDY support for existing web servers (SPDY-HTTP reverse proxy) - <AUTHOR> https://github.com/pquerna/spedye

<comment><USER2> I had a look at the code on GitHub and could only find code that seems to start and stop threads. Is there more coming?

<comment><USER3> I was scratching my head looking around the code until I saw this huge text in the README:

STATUS: incomplete, prototype, work in progress, non-functional, etc, etc

The rest of the README is aspirational. It's a little confusing.

<comment><USER4> Author here: Yes, the README is aspirational, its a checklist for myself. I put the STATUS line there for everyone else, but it appears no one actually reads it. (Heck, not one other person on HN actually tried it out, because it sure as heck doesn't work yet).

I hadn't put any publicity out about the code yet, I had just pushed it up to github a few days ago because I wanted to move the code around to some other machines, I didn't expect anyone to pick it up.

</comment></comment></comment><comment><USER5> It's a neat trick but I'd need to see benchmarks that prove this is beneficial.

Natively sure, but through the overhead of a reverse-proxy? Hmm.

<comment><USER6> The overhead of a reverse proxy in terms of latency is essentially zero. Just think about it like this: with HTTP sometimes you need to wait for some extra packages to go back and forth. These packages need to travel over the _Internet_. You can trade in these packages with packages, which travel though your _loopback device_. Seems like a good bargain to me.

Also to make benchmarks, it helps to have a working product first.

</comment></comment><comment><USER7> seems to me that one of the main ways SPDY speeds things up is by sending of hints and attached content all in one connection. If you are proxying over http, you can't have access to any of the domain specific information, and thus you won't see hardly any of the SPDY benefits

<comment><USER8> I don't know the details of how SPDY works, but could this proxy be taught some custom HTTP headers (X-SPDY-Hint: /static/site.css) which can be trivially sent by the proxies application and could be used to enable advanced SPDY features?

<comment><USER9> Yes, this could totally work in SPDY.</comment></comment></comment>


Ask HN: EU Banks and Their APIs - <AUTHOR> I'm starting a project that needs reliable interaction with a bank (for buying ETFs) in the EU (Germany, but preferably EU wide).  I was surprised to find that there are some banks that don't even have an officially supported public API, and it makes me a bit nervous what the others are like.  Does anybody have any experience of which banks offer reliable, easy to use APIs? <comment><USER2> Look into OpenBanking and PSD2.

<comment><AUTHOR> I've been looking at both - as far as I can tell, OpenBanking is UK only, and PSD2 only applies to personal data, not making transactions. Am I mistaken?

<comment><USER2> OpenBanking is what the UK implementation of PSD is. PSD, as far as I am aware, allows you to do payments, and is not limited to just PII.

</comment></comment></comment><comment><USER3> I'd be more surprised to find a bank with a public API.</comment>


Women's quest to be 'romantically desirable' conflicts with scientific pursuits - <AUTHOR> http://www.sciencedaily.com/releases/2011/08/110815101540.htm

<comment><USER2> Is this different than for men somehow? I don't remember seeing math and chess teams having the most romantically desirable boys at my high school. Yet I (for instance) did these things as well as programming just because I needed to and liked it so much. If it was the reason I was picked on and a social outcast, it didn't really make a difference. I don't see many women like this. Why not?

It didn't change much in adulthood either, at least for me. Yet if programming has any connection to my complete inability to attract a woman (it's clearly not the whole story) it still doesn't matter because it's such a great career and hobby for me that I love passionately. So why are there so few adult women like this too?

<comment><USER3> One of the points the article made was that women "experience backlash for violating societal expectations", which might play a big role why there aren't many female programmers. This also could explain why I often come across female programmers from India, which is possible they are encouraged more.

But regardless, I personally don't entirely agree with the article's conclusion that the difference is purely dependent external factors like culture. I think guys like to tinker with tools more often than girls, and this interest is influenced by genetics.

</comment></comment><comment><USER4> I seriously wonder what would happen if we ran a similar test on women who'd read lots of Hermione Granger-centric shipping fics in which the male romantic interest is attracted to her because of her intelligence. Of course this wouldn't disentangle causality from correlation.

</comment><comment><USER5> A great counterpoint experiment would be to similarly expose young men to images, verbal cues and goals of physical fitness and competitiveness and then measure their interest in STEM achievement.

If there is no negative impact, you overturn the long-presumed jock-versus- nerd social paradigm. If there is a negative impact, you overturn the presumed masculinity and gender norms cited here as being associated with STEM and force a little more nuance into this argument.

</comment><comment><USER6> While I have obviously self selected my population ... I don't know a single guy that doesn't find female intelligence enticing. Women that use their brains to do what they want are attractive and albeit in short supply.

Women in the US aren't allowed to smart or funny. They can be hot, but not smart or funny. This isn't true in other places. Eastern Europe for one afaict doesn't discriminate against female intelligence.

<comment><USER7> > Eastern Europe for one afaict doesn't discriminate against female > intelligence.

Former Eastern European here -- not sure I would single out Eastern Europe as being "better" in gender norms. How do you explain the Devushka phenomenon? [http://www.carpetblog.typepad.com/carpetblogger/2006/07/devu...](http://www.carpetblog.typepad.com/carpetblogger/2006/07/devuskha_style.html)

Going into STEM fields may anticorrelate with pursuing romantic interests -- but it doesn't imply that it correlates with intelligence/strength. I have encountered many more women with strong personalities who think for themselves among art students than among math grad students, for example. As a matter of fact, as a male, I am attracted to the "strong woman" type -- but paradoxically I find more women of that type among those who have liberal arts degrees. I believe this has something to do with engineering degrees being perceived as ones that "train you to be a corporate slave" rather than ones that strengthen your personality.

</comment></comment><comment><USER8> So, women don't know how to express themselves romantically using math. The answer seems simple enough: a few romantic mathy role models should fix that quickly. We could start with Vi Hart's videos. <http://www.youtube.com/user/Vihart#g/u>

</comment><comment><USER9> The study is likely specific to the country where it was conducted (I'm guessing the USA). I believe there are studies showing that while girls in the US are socialized to think of math and science as "masculine", which consequently affects their willingness to learn said subjects, things are much more equal in countries like Japan.</comment>


If I Had $50 Billion Dollars I Would Complain About Your Taxes Too - <AUTHOR> http://davidshipper.tumblr.com/post/8965883938/if-i-had-50-billion-dollars-i-would-complain-about-your

<comment><AUTHOR> I guess I was trying to draw the distinction between a legal obligation and any other kind. The moral imperative to save money on your taxes is the same one that drives someone to do their best everyday and not be a slacker!

</comment><comment><USER2> > Lets face it, I have a legal obligation not to evade taxes and a moral > obligation to avoid them and I like to fulfill all of my obligations!

I don't understand where this moral obligation comes from, in fact I'd argue the opposite. You have a moral obligation to pay taxes but with tax vehicles and loopholes you have a legal opportunity not to pay them.

[EDIT] Obviously some people disagree. Ho hum.</comment>


Code Valley: Join the New Industrial Revolution - <AUTHOR> https://pilot.codevalley.com/ <comment><USER2> As a developer, im really not sure how, what or why I would use this.. or even what this is.

I watched your video, read your intro, went into the hello world. Yet im still confused.

I believe im your target market as a developer. So just wanted to express my point of view.</comment>


Ask HN: We got an invite to TechStars for a day, should we go? - <AUTHOR>

I created a new account for obvious reasons.
In light of this:
http://blog.aisleten.com/2009/04/06/what-we-did-to-not-get-into-techstars/
I think that we have about a 5% chance of getting in even if we go. Would it be better for us to just stay home and work on our product? <comment><USER2> (I'm with TS)

Keep in mind that attendance at TechStars For A Day is not required in order to receive an invitation to participate in the program. It can obviously help, but there are plenty of examples of companies that didn't attend and were still invited to the program subsequently.

It is also a really fun day filled with a lot of smart people looking to help. Plus Boulder is a fantastic place to visit (and live).

Let me know if you have any more questions or anyone wants some offline answers firstname.lastname@example.com

</comment><comment><USER3> you should probably go. you'll certainly meet some new smart people, get to talk to other entrepreneurs, and have some sort of experience. It's good to put yourself out there and experience new things. your product will still get done, don't worry.

</comment><comment><USER4> Reasons to go: \- Meet new entrepreneurs in your physical location or technology space. \- Get free advice from great mentors. \- Be involved in the community. \- Increase your chances if you apply next year by learning about TechStars. \- 5% is significantly more likely than life happening, and yet here we are.

Reasons not to go: \- You miss 8 hours of development, of which you'll probably work for 4 at best. \- Might catch a cold from all the hand-shaking.

Seems like a no-brainer to me, but I'm biased because our company got in to last year's Boston program.

</comment><comment><USER5> You may as well go. One day won't make any difference to your development in the grand scheme of things. Better to go along and at least have the opportunity to meet someone interesting.

</comment><comment><USER6> with an attitude like that, you wont get very far with your business. Figure your startup has an even smaller chance of being successful but you still want to pursue it, correct? Have faith in yourself because no one else will.

</comment><comment><USER7> Come out, we'll have a beer :)</comment>


Beer for charity - <AUTHOR> http://www.beerforcharity.org

<comment><USER2> Could work. The price of a pint or a glass of wine at the bar is actually one of my current "what's that worth" metrics. I know that my wife does the same thing, "That's nothing, just a glass of wine I could do without," etc. In reality, of course we still end up buying that drink.

When I was in my late teens, everything was judged in terms of CDs - $100 was three and a bit CDs, for example; in Australia, a new CD at the time was about $30. The first paying job I had on the web, I remember instantly thinking "Wow, x CDs per week; this is going to be great!"

Now it's either drinks while out or international flights.</comment>