Ask HN: How to draw a single pixel? - <AUTHOR>

This question is maybe an echo from the eighties, but I am interested to find resources so as to draw a single pixel on the terminal. If I could change the state of one pixel then it would be just math to go from pixel to lines and from lines to curves and from curves to shapes.
If I am not mistaken one of the important steps is to activate the so called video mode and not the text mode. Reading a bit about that I guess I have to access the memory buffer and modify individual chunks of memory. I cannot estimate how difficult this can be.
I know that there are libraries to let you do that on another window and of course to let you create images. Creating SVG pictures is rather trivial for example. I am interested to learn my self how to go in that level than to use a library.
I would be grateful to find resources for that and preferably in the following languages. Common Lisp > Python > C.
Feel free to ignore my question since it is driven by curiosity to hack and not from urgent need for productivity. <comment><USER2> Must you make me jog back such old memories? (Well actually, Thank you :-))

FWIW, this is how we used to do it in BASIC, C and MASM in the good ol' DOS days, back in the 80s; hope it can give you at least some conceptual confirmation + insight:

You wrote:

> activate the so called video mode and not the text mode

Spot on.

> access the memory buffer and modify individual chunks of memory

Spot on again. Unless I'm forgetting something, DOS used to reserve a chunk of RAM (that they called 'lower memory') as video RAM. We used to 'peek' and 'poke' bytes directly to this (at mem segment 0800:0000Hex or something). Of course, that was on CGA display adapters, and under DOS. With today's SVGA and whatnot + Ubuntu, a lot of these specifics would change but I'm afraid I won't be able to help you with all that - been a while (about 2 decades) since I could last indulge into that sort of hacking.

Well, best wishes from an ancient hacker - may _you_ keep at it for as long as you wish to.

</comment><comment><USER3> Read the manual page about "vga_drawpixel" function. I'm not sure you can use this if you run under X. Here is a useful link:

<http://linux.die.net/man/3/vga_drawpixel>

You should probably use a more advanced graphics library like the one provided by Gnome, but if you want to learn how to do it from scratch I suppose you need to start from a text mode Linux installation.

</comment><comment><USER4> Well, it pretty much depends on what system you are using. On linux for example you could use frame buffers (on windows or osx i have no idea). But i think you should check out some kind of library like SDL, which is easy to use and has bindings for common lisp and python (it's written in C).

EDIT: take a look to <http://code.google.com/p/lispbuilder/wiki/LispbuilderSDL>

</comment><comment><USER5> Are you running under Windows, OS X, Linux, something else?

<comment><USER6> And if you're running Linux, which window manager are you running?

<comment><AUTHOR> I am running Linux (ubuntu 10.10) and I am using the Gnome terminal. Of course I could switch to something else if this could make things easier.

<comment><USER5> You cannot draw graphics in a terminal window (he says, half-expecting to be corrected).

Your program can open up a window of its own and draw graphics in that.

Or you can do the low level thing on a different virtual console using Linux's framebuffer support (see the svgalib link octopus posted above) (as an aside, press Ctrl+Alt+F2, observe what happens, then Alt+F7 to return here).

<comment><USER7> > You cannot draw graphics in a terminal window (he says, half-expecting to be > corrected).

Depends on the terminal. xterm has a "tektronix mode" to emulate the old Tektronix 4014 graphic terminal. This has a 4096x4096 coordinate system for _vector_ graphics. Most other terminals do not emulate this, of course.

<http://en.wikipedia.org/wiki/Tektronix_4010></comment></comment></comment></comment></comment>


Existential Angst Factory (2008) - <AUTHOR> http://lesswrong.com/lw/sc/existential_angst_factory/

<comment><AUTHOR> This has been mentioned in comments before but it hasn't been submitted before and is worthy of a read. The quote out of The 4HWW that excitement is what we should pursue, not happiness really hit home.

Some links I found relevant while going over older HN articles:

Comment by Fallentimes quoting Tom Preston-Werner: <http://news.ycombinator.com/item?id=338357>

Source of said comment: [http://tom.preston-werner.com/2008/10/18/how-i- turned-down-3...](http://tom.preston-werner.com/2008/10/18/how-i-turned- down-300k.html)

Comment by Keyist: <http://news.ycombinator.com/item?id=849855>

Comment by jodrellblank: <http://news.ycombinator.com/item?id=1036228>

Related article by Reg Braithwaite: <http://news.ycombinator.com/item?id=589200>

<comment><USER2> My hard-won approach to existential angst: <http://news.ycombinator.com/item?id=101014>

more: <http://akkartik.name/search_results?q=existential+angst></comment></comment>


Solving a problem vs. chasing a problem - <AUTHOR> http://startupworkout.com/boring-to-billion/

<comment><AUTHOR> "Not only did Peter build the foundation for an awesome business, but he managed to bootstrap it and build it for minimal cost because he was building it for himself.

What he ended up with was an awesome product, built for almost nothing that is ready to be sold at a premium to enterprise customers. This now has a much lower risk profile than is usually associated with a startup."

</comment><comment><USER2> Hhaha, an informative and humorous article. I love the Office Space reference!

</comment><comment><USER3> Are tps reports still a thing?</comment>


Silicon Valley would be wise to follow China's lead – Financial Times - <AUTHOR> https://www.ft.com/content/42daca9e-facc-11e7-9bfc-052cbba03425 <comment><USER2> Chinese devs seem to hit there breaking points. [http://www.sixthtone.com/news/1003771/chinese-developers- pro...](http://www.sixthtone.com/news/1003771/chinese-developers-protest- overwork-on-github)</comment>


Ask HN: Should I practice competitive programming and stop doing side projects - <AUTHOR>

I am a junior undergrad studying CS at one of the top universities. I have co founded a company, participated in Google Summer of Code and done interesting projects (some of which even won prizes).<p>I applied to some companies like Dropbox, Google, Palantir and Facebook for a summer internship but got rejected from them at some stage in the interview process (even after reaching the host matching stage for Google). I see my friends who were able to get those internships inspite of having almost no software development experience just because they are good at competitive programming and wonder if this is all that companies care about? Should I stop building stuff and improve my competitive programming skills if I plan to get a job after graduating? <comment><USER2> If you get past the resume screening stage (which it sounds like you'll have no trouble doing, with your resume), then those four companies you mentioned only care about your interview performance. You're correct that side projects won't get you a job at Palantir. What you should do is practice, practice, practice technical interview questions. Get Cracking the Coding interview and do every problem.

Getting a job / internship offer at those four companies is the exception, rather than the rule, so don't feel bad about getting unlucky this year. I squeaked by Facebook intern interviews, but was rejected from Dropbox, Google, and Palantir.

Better luck next year!

</comment><comment><USER3> Let me preface this by saying that above all else, your soft skills are important. Learn to interview. Read Cracking the Coding Interview. Practice your people skills. It's likely that your friends who "were able to get those internships inspite of having almost no software development experience just because they are good at competitive programming" are really good at the soft skills in addition to being good problem solvers.

Assuming that your soft skills are up to task...

It really depends on how many side projects you already have, either open sourced on GitHub or tangibly published (such as iOS apps on the App Store, for example).

You're best served by having a balance of tools in your skill set. If you already have side projects that you're proud of, getting better at "competitive programming" (which is really just getting better at solving problems in certain domains quickly) will make you a better candidate overall.

Companies like Google want junior devs and interns to be problem solvers that they can mold into senior developers. That's what "competitive programming" tests for. However, if you have the soft skills and the pedigree of presentable projects to demonstrate, you can make it work.

</comment><comment><USER4> You need a certain amount of programming puzzle skill to get past the interview process at most tech companies. Competitive programming is a good way to practice this skill, but you don't have to do it at the exclusion of other types of programming. You may want to take a break from side projects for a few weeks or months while you work on your coding interview/competitive programming skills. After a certain point, there are diminishing returns unless you get interested in the competitive programming world and want to keep competing.

If you want more information on this topic, it is often discussed on Quora. Here are a few relevant posts:

* Why tech interviews are the way they are: [http://www.quora.com/What-do-you-think-about-the-current-tec...](http://www.quora.com/What-do-you-think-about-the-current-tech-interview-process)

* Preparing for a coding interview: [http://www.quora.com/How-do-I-prepare-for-a-software-enginee...](http://www.quora.com/How-do-I-prepare-for-a-software-engineering-job-interview)

* Possible reasons for getting rejected after an interview: [http://www.quora.com/What-are-possible-reasons-for-getting-r...](http://www.quora.com/What-are-possible-reasons-for-getting-rejected-for-a-programming-internship-after-a-phone-interview-after-writing-correct-code)

</comment><comment><USER5> On the contrary, continue with your side projects. That's probably why you even managed to get interviews with those companies. Did you compute the odds of landing an internship at Google? How many people apply? How many people get in?

Make yourself really good. Write code that amazes. Then you'll be able to control your destiny.</comment>


Researchers hijack botnet, score 56,000 passwords in an hour - <AUTHOR> http://arstechnica.com/security/news/2009/05/researchers-hijack-botnet-score-56000-passwords-in-an-hour.ars <comment><USER2> OK, it's great to be able to crack the crackers...

The Ars summary of the report seems strange (I've not read the whole pdf) in a couple ways:

They talk about percentages of _private behavior_ getting scooped, but not about percentages or numbers of credit card or bank account users/passwords (which they indicate were the primary targets of the botnets).

And weirdly, Ars says, "Torpig controllers may have exploited these credentials for between $83,000 and $8.3 million during that time period..." Funny numbers. ?it just _happens_ that the range is 8.3 x 10 __4 to 8.3 x 10 __6 ? Makes me wonder about overall accuracy of post/report.

<comment><USER3> Well, Torpig obtained credentials for 8310 accounts, so I'm guessing that's just a $10-1000 estimate of the loss per account. But from my experience, $1000 per compromised account seems quite a bit on the high side for credit card accounts (I have no idea about average loss for stolen brokerage accounts).

Edit: From the pdf

 _"A report by Symantec [37] indicated (loose) ranges of prices for common goods and, in particular, priced credit cards between $0.10-$25 and bank accounts from $10-$1,000. If these figures are accurate, in ten days of activity, the Torpig controllers may have profited anywhere between $83k and $8.3M."_

As an aside, these amounts are a good reason you should you your credit card instead of your debit card.

</comment></comment><comment><USER4> _The researchers noted, too, that nearly 40 percent of the credentials stolen by Torpig were from browser password managers, and not actual login sessions, and that the Torpig controllers may have exploited these credentials for between $83,000 and $8.3 million during that time period._

I am surprised that browser password managers are so insecure. This seems like a place that browsers could improve.

<comment><USER5> Firefox stores your passwords in plaintext unless you specify a master password (that has to be entered each time you open Firefox) to encrypt them.

<comment><USER6> Problem is that a simple keylogger could get that too...

</comment></comment></comment><comment><USER7> Why is it so hard to prosecute these people? At some point, the bots are going to have to phone home, and that's got to be discernible. I mean, just purposefully infect a machine, feed it some CC numbers and keep an eye on it. What's the problem?

<comment><USER8> Really? I'll spend a max of two mins on this.

(a) Which global task force does this fall under?

(b) Who pays for the research, prosecution, and housing of inmates?

(c) Who pays for the astronomical travel/M&E costs for traipsing the globe to catch ip addresses?

(d) Is what they are doing actually illegal in the country they live in?

(e) Who pays for the legal teams who have to go to every single ISP and ask for records?

etc, etc, etc</comment></comment>


Hydrogel process developed at Stanford creates transparent brain  - <AUTHOR> http://med.stanford.edu/ism/2013/april/clarity.html <comment><USER2> This is a very impressive (yet simple) methodology in that before this there was no understanding of where certain neurons were projecting in the brain, due to the fat tissue blocking any imaging possibilities. After this many connections were uncovered that were not well understood for years.

</comment><comment><USER3> <http://longbets.org/1/>

"Second, this phenomenon of ongoing exponential growth through a cascade of S-curves is far broader than computation. We see the same double exponential growth in a wide range of technologies, including communication technologies (wired and wireless), biological technologies (e.g., DNA base-pair sequencing), miniaturization, and of particular importance to the software of intelligence, brain reverse engineering (e.g., brain scanning, neuronal and brain region modeling)." -Kurzweil

</comment><comment><USER4> A video explaining and showing the technique: <http://www.youtube.com/watch?v=c-NMfp13Uug>

</comment><comment><USER5> Whole organ decellularization is not new - we've had transparent heart ECMs for quite some time. By loading the brain here with monomers, they kill the organ, whereas you can still use the transparent heart if you reload it with cells. Similar thing, different purposes.

<comment><USER6> Just to clarify, this is not whole organ decellularization. The brain tissue, with it's neurons, glia, ECM, are left all in tact, along with their proteins, mRNA, etc.

Now, instead of having to slice the brain into micrometer slices just to understand architecture at a localized level, you can understand the architecture of the whole brain's network down to the cellular level, as well as do both immunohistochemistry and in-situ hybridization to probe what kind of proteins and molecular markers are present throughout the brain. This is nothing short of a revolution in experimental technique not only for neuroscience, but all of pathology.

</comment></comment><comment><USER7> This is huge for the fields of AI and Neuroscience. I would gladly donate my brain( preferably when I'm done with it) to give neuroscientists a map of the human brain. This map would be a great first step to creating strong AI.

</comment><comment><USER8> Summary: infuse brain with hydrogel monomers, polymerize to form permeable polymer matrix, remove lipids with vigorous electrophoresis, bingo, transparent brain.

</comment><comment><USER9> do you think they are going to try to do it on a live mouse brain?

</comment><comment><USER10> Boy, sounds like that process would result in one super Excedrin headache number 195,455,223,391. Go ahead. I'll give up my place in line. You first!</comment>


Blu-Ray Still Blows - <AUTHOR> http://ascii.textfiles.com/archives/2177 <comment><USER2> I wonder if USB sticks will be cheaper than Blu-Ray disks in the long run? (And offer more capacity, too).

<comment><USER3> I doubt it. A bought a 16GB SD card a little while back, and it cost maybe $30. A Blu-ray disc holds 25GB single-sided, and 50GB double-sided, and probably costs well less than a dollar to press.

Flash is a loooooong way from beating the disc.

<comment><USER2> Just checked at Amazon.de, the price for a writable blu-ray disk seems to start from 5€, for a 25GB disc. 16GB USB sticks were around 23€. It does not seem that far away?

Also, I suppose Blu-Ray will be stuck at it's size because of the norms and patent hell, whereas sticks can just continue to grow. Flash drives are becoming popular, so the price of Flash in general might come down.

<comment><USER4> You are correct but you are looking at it from the wrong perspective.

Who cares about reprogramming your stick: for blu-ray, you want to buy a movie. The movie studio is the one wanting to make a profit, so most of the sale price of the movie should not go into the media.

Therefore, mass producing blu-ray movies, at around $1 (or less) per disc is very effective (the studios will sell you the movie at $9.99 or more).

When will a USB stick for 20GB cost less than $1? It's still quite far off.

<comment><USER5> The assumption, of course, is that you will have 20+gb of content on a Blu-Ray disc. I am not convinced this is often the case, and an independent could produce these slightly-higher-cost items for distribution and put all sorts of material on them.

</comment></comment></comment></comment></comment><comment><USER6> Besides saying "fuck" over and over again, was the whole point of that post to complain about licensing? If you don't want to deal with licensing issues don't use any proprietary technology. Release your work online in OGG format.

These types of whiny posts don't contribute much of anything. There's no real solution proposed. Other than "I want to use proprietary technology but I don't want to pay the fees".

<comment><USER7> I'm not sure why vulgar language is becoming so acceptable and commonly used . Am I just old school (even though I'm 30) when I find myself turned away from people who talk in such a manner or do others feel similar to me?

<comment><USER8> I'm new school (if 19 isn't too old to call myself that), and swearing's becoming such a huge trend because of how natural it feels. It's part of the huge trend towards the unprofessional.

That's a good thing. While it's got some irritating side effects, the overall idea is getting rid of bullshit attitudes towards one another. Swearing is a part of language. There's nothing wrong with its being used.

<comment><USER7> I'm in agreement with your assessment that the trend is towards unprofessionalism. I live in the US, and have been to Japan three times. My first time there I was totally shocked with the effort put into dress to look as clean and professional as possible. Top notch suits that were perfectly pressed, nice shoes, a nice brief case (very few backpacks), and a very polite attitude. I wish our trend was towards the Japanese attitude towards the way we present ourselves in public.

Off topic: it's so refreshing to come here (HN) and read a reply that isn't some kind of verbal attack towards me for the opinion I presented. I thank you for that, for stating your opinion with insights without attacking me.

<comment><USER9> The pressed suit is a nice touch, but I think with North Americans you'll find more of a focus on results rather than presentation. Presentation is great when it follows substance, but it's no substitute.

</comment></comment></comment></comment></comment><comment><USER10> Yes, you have to use DRM.

Yes, you have to pay for it.

This won't change. In fact, most independent authors and musicians I know would kill for a transparent, workable DRM system that effectively stopped casual piracy. Without it, 0-day piracy would become ubiquitous. For Hannah Montana that won't matter much because Hannah Montana's shit is going to be bought -- and pirated -- in massive volume anyway. For the local musician it could mean not getting the big break he was hoping for because he didn't cross the threshold of 50,000 or 100,000 albums sold necessary for the record company to heavily market him. In the worst case it means not being able to feed his family with the income from his music.

So no, DRM is necessary if you want small independent creators to succeed in the age of the Pirate Bay. And it's not going away anytime soon.

<comment><USER5> Nah, we fundamentally disagree on this point and a lot of people disagree with you on this point. (But many do agree with you, too.)

</comment></comment><comment><USER11> I'm sorry but I can't even read this. It is hard to look at, textually awful and filled with needless coarse language. If you want to write a longish essay that people will read, learn to edit.

<comment><USER5> I'm sorry to hear a 1,100 word essay cows you down into illiteracy.

</comment></comment><comment><USER12> Wow, they've managed to make it more painful than BitTorrent. This is self- defeating.

</comment><comment><USER13> Blu-Ray is a transition format anyway. Long-term, my money is on network-based digital distribution.

It sucks... but for a couple hundred bucks, I'm fine with my blu-ray player, my netflix subscription, and my purchased copy of Planet Earth.

<comment><USER14> If all you want is HiDef Planet Earth... it was released on HDDVD. You could probably get a copy and a player for cheap.

<comment><USER13> I actually had one. I switched to blu-ray because of netflix.

A netflix subscription and a blu-ray player is both cheaper and more interesting than subscribing to all the premium movie channels.

<comment><USER14> Netflix is also on the XBox360. But that might not be relevant to you (not a gamer,bluray player cheaper,etc).

</comment></comment></comment></comment><comment><USER15> This is one of two points:

a) proprietary formats hurt independents

b) this is yet another anti-piracy heal of crap which will hurt consumers.

So yea I would not be concerned with blue ray. If the porn industry does not embrace it it won't be the next big thing.

However being that this is sony you are garanteed that they will cater to destroying independents and growing sony's monopoly.

<comment><USER14> Sony is going to fight tooth and nail for this one. It's the first time that one of their proprietary formats became an industry standard. They rest are failures (ATRAC,BetaMax,MemoryStick,MiniDisc,etc). They still won't cater to independents though.

<comment><USER16> Sony invented the 3.5-inch floppy disk, and the audio compact disc was invented together by Philips and Sony. Were these somehow not proprietary?

<comment><USER17> Just an amusing note - I used to call 3.5 inch disks 'hard disks' because unlike 5.25 inch disks, the shell around the disk is hard!

</comment></comment></comment></comment><comment><USER18> You know what else blows? That website. My eyes bleed. Learn how to put "text" on a "website".

<comment><USER5> I wrote an entry about that. If you can handle it.

<http://ascii.textfiles.com/archives/1765>

<comment><USER10> Yeah, but... smooth green antialiased text on a crisp LCD display? Shit's WEAK. It's like listening to Britney Spears cover "I Can't Get No Satisfaction". The soul is gone. I know you did the best you could with what you had, but I'm yearning for a CSS stylesheet option that changes the text into an 8x10 chunky pixely aliased monospaced font, rendered in fuzzy green phosphor dots that don't turn black immediately when the text is scrolled but rather fade to ghostly lingering afterimages.

As I've mentioned a couple times before, I always use chunky pixely fonts to code in, though the wheat-on-dark-slate-gray I used for my first Red Hat install gives me t3h warm fuzzies. It just feels namby-pamby typing your code in Lucida Console.

<comment><USER5> You just compared my website to a Britney Spears cover? Them's fighting words, sir! Keyboards at dawn.</comment></comment></comment></comment>


iOS and MacOS Developers Can Now Respond to Reviews - <AUTHOR> https://developer.apple.com/library/prerelease/content/releasenotes/General/WhatsNewIniOS/Articles/iOS10_3.html#//apple_ref/doc/uid/TP40017594-DontLinkElementID_39 <comment><USER2> As a small indie dev (dealing with hundreds or thousands, not hundreds of thousands of customers), the best way I've found to encourage reviews is to prominently display my email address for any questions or ideas.

Then, when customers write (many of them do), I write back a nice response and then add:

P.S. If you enjoy Mindscope, would you take a minute to write a short review? It would mean a lot and helps give Mindscope visibility on the App Store.

<comment><USER3> I've done a similar thing, but getting people to review is like pulling teeth.

We've tried plenty ways to make this happen:

1\. append a footer in the email asking for a review Finding: People ignore it.

2\. include custom copy in the emails asking for a review People say yes yes, and then most do nothing.

3\. The annoying rate us with stars popup and redirect to appstore. People rate 5 stars inapp, and then close down the AppStore before they apply a rating

Getting reviews is hard for b2c - but the real issue at work is the amount of friction AppStore imposes. I've tried to leave reviews and it asks me to re- sign in to the AppStore, minimum character requirements (can't just leave 5 stars).

<comment><USER4> I'm not sure about newer phones, but with iPhone 4S it took so much time to load appstore, that I'm usually giving up. AppStore is very slow application, it feels like bad website on 2G connection and I don't understand that.

<comment><USER5> I can't decide if you're trolling people or you don't realize how amazingly atypical your situation is. a) really old phone b) 2G connection. Yes everything is slow for you, and yes, that sucks, but the iPhone world (and phone networks) has largely moved on from that point. Asking for that stuff to be fast is like asking for major web sites to perform well on dialup. even if it _should_ happen, it isn't going to, and that's just the current state of the world. Dev's don't think about the old devices or the slow connections, and their employers don't care.

<comment><USER6> Poster said "it feels like bad website on 2G connection".

</comment></comment></comment></comment></comment><comment><USER7> As an indie developer that has a lot invested in the App Store - this is really, really, great. It doesn't matter how much effort you put into making an app that is polished, well thought out, and one of the best out there - there will always be reviews like 'App gets stuck downloading' or 'App doesn't support x' (when x is clearly stated as being a paid addition). The ability to respond to reviews should more clearly separate 'quality' apps for anyone that takes reviews and ratings into consideration before downloading.

<comment><USER8> I hear you. I've had those experiences. I put in minimal usage analytics on my backend, and the users that are the harshest with reviews are my biggest users. It's all worthwhile when you get the occasional email from someone that your app has helped them immensely with a task.

I make utility apps for some side income and one of the strangest reviews I received was a 1 star -- "cannot beat level 6. Paywall. Deleted."

The moron somehow reviewed the wrong app, from some game. Apple however is pretty good at responding to review removal requests.

</comment></comment><comment><USER9> It's a start but it doesn't fix the underlying problem. It's not specific to the App Store, but a major problem with Internet based communities in general is that a small vocal group of discontents has a disproportionately loud voice.

5 one star reviews out of 100,000 known installs is very different to 5 out of 10.

I wish that the app review had stats for 1/2/3/4/5 star ratings as percentages of the known user base.

<comment><USER10> Please no. Then apps will only review nag even harder.

</comment></comment><comment><USER11> 10 years & wow we can reply to reviews. I guess 4 billion in app store profits can pay for a feature now & then.

Now how about tackling fake reviews?

<comment><USER12> > Now how about tackling fake reviews?

From apples point of view, why?

If an app gets fake positive reviews, it will sell more, and give Apple higher income.

If an app gets fake negative reviews, the developer will just bump the version, the reviews will be forgotten, and there will be no negative effect to Apple.

Like the old SNL sketch, Apple doesn't care. They don't have to. [https://www.youtube.com/watch?v=CHgUN_95UAw](https://www.youtube.com/watch?v=CHgUN_95UAw)

<comment><USER13> Fake reviews devalue all reviews, and this makes them less trustworthy and therefore less useful. And when customers can no longer make informed decisions, they buy fewer apps.

</comment></comment></comment><comment><USER14> Now if only I could write reviews... but there's a Long outstanding bug where if you download an app in (in my case Australia) move to singapore, change your store to singapore, redownload the app. The store assumes you don't own the app cos it originated in Australia but your account is now singapore with the singapore downloaded app. And you cannot write a review cos the store is confused. But if the app is downloaded in singapore for the first time you can write a review. Invest the store location again and the inverse happens....

<comment><USER15> I have the same issue. And it's even worse. I need two accounts - one for the UK and one for Switzerland. And I have to log out and log in of the app store depending on whether I want a UK app or a Swiss app. For a multi-national company, Apple's support for those living across borders is terrible.

</comment></comment><comment> yoz-y I really hope that it would be finally possible to use touch id to identify myself when leaving reviews. I do not understand why reviewing seems to be the most sensitive thing I can do on an iPhone, as it is the only feature that always requires the whole password.

<comment><USER16> To slow down review farms?

<comment> yoz-y Dubious, you only have to enter your password once and then you can write reviews for 15 minutes or so (I did not check). This only bothers people who leave one review every now and then.

</comment></comment></comment><comment><USER17> There's a business here for a consulting firm that triages first-tier responses to these comments. This is already, for instance, how bug bounties work (as I understand it, triage services are a big part of the revenue model for the bounty sites).

</comment><comment><USER18> Title is incorrect. It isn't going to be available until iOS 10.3 ships.

<comment><USER19> 10.3 is on current new devices, so it takes affect now for all new iPhones and iPads. Later, it will also affect existing ones.

<comment><USER20> 10.3 is in beta and the first beta was released to developers yesterday. That link is to pre-release documentation.

<comment><USER19> According to the article, if you purchase a brand-new iOS device, it is running 10.3. That is different than existing devices cannot get upgraded yet to it. Or is the article unclear?

<comment><USER21> No, you've misunderstood the phrasing, it says "which runs on currently shipping iOS devices", in other words, it is compatible with.

</comment></comment></comment></comment></comment><comment><USER22> Wow, this is great news! It's doesn't address all of the systemic issues with the App Store, but it does show they at least are paying a little bit of attention... here's hope that they're working on fixing more!

</comment><comment><USER23> That's great news, and can only lead to, if nothing else, better informed users and a more engaged developer.

<comment><USER13> I'm not sure it is great news. I can see it leading to some users expecting to use the reviews as a kind of alternative tech support/feature request forum, with star ratings held in hostage for responses.

</comment></comment><comment><USER24> What I was really hoping for is a solution to the problem of every app begging me for a review after upgrading.

I get a "please review" popup pretty much every day. When I got back from Christmas vacation and synced a bunch of apps, my iPhone was painful to use for about three days and every app begged for my help.

I actually review apps I use and like, I just wish I didn't have to do it every update to help keep the developer eating.

<comment><USER25> There's an unfortunate cause of excessive app rating prompts — what's shown in search results/top charts/other areas is the average of the latest version, not the overall aggregate.

If you're at a company that does scheduled releases (e.g. once every three weeks), you'll need to continually ask people to review the app to keep that rating high.

Otherwise you only get ratings from new users and users that are discontent with the particular version. It's rare that people who have already rated the app 5-stars will continually go out of their way to rate the app 5-stars again without prompting.

<comment><USER26> I'm tied to the Norwegian app store by bank card. Norway has a small population resulting in the majority of apps having the "we don't have enough reviews for this app" and no review data at all. Instead of showing reviews from another country, or overall from all countries, Apple choose no data at all. Really useful.

<comment><USER27> Same for Estonia, I don't think I've ever seen a review on Estonian iTunes app store. Not a single one.

<comment><USER28> Wow, never thought of that. Someone must create an alternative web app store that we can browse with aggregated ratings

</comment></comment></comment></comment></comment><comment><USER29> Does anybody know what precautions or safeguards will be put in place to prevent fraudulent self-ratings?

For instance, a malicious app could falsify the user data before submitting it using the new API, dark patterns in the feedback form (1 star could be the highest rating), or just omit sending in poor reviews altogether.

<comment><USER30> Don't they have a review process? Surely they'd just check all the places you use the new API.

<comment><USER31> Yeah I'm pretty sure you'd have to use private APIs to be able to fake reviews using the new controller. They'd probably ban your developer account if you tried this. Don't think it would be worth it.

<comment><USER32> They have the ability to run views entirely out of process. I can't guarantee they're doing it here, but I don't think it would be hard for them to make it completely immune even to private API abuse.

<comment><USER33> It'd be quite logical to do that here, if only to avoid exposing the users account credentials to the application.

</comment></comment></comment></comment></comment><comment><USER34> I'm glad to see Apple beginning to throw developers a bone but this change is about 5 years too late.

</comment><comment><USER35> Developers always want this - but responding to reviews hardly every works out in your favor... its either a shallow "thanks" kind of message or a shallow "sorry" kind of message... and it almost always comes off as disingenuous

<comment><USER13> My thoughts exactly. This may or may not improve things.

</comment></comment><comment><USER36> Any word on whether replies will be limited to one, or if you could have very long threads of messages going back and forth between a user and the developer?

Also, curious if developers will be able to respond to old reviews written before this was the policy. I'm thinking so.

Been hoping for this ever since the App Store was released, especially after being able to do it on the Google Play store for some time.

</comment><comment><USER37> So uhh... can users respond to developers responding to user reviews? ;-)

<comment><USER38> Both users and dev can edit their reviews/responses. Seems reasonable, as starting a multi-layer thread in reviews would ultimately defeat the purpose...

<comment><USER37> i guess it's reasonable indeed. Although users being able to edit their initial comment can become messy...

</comment></comment></comment><comment><USER39> Well, it's a start?

I know I'm not the first to stay it, but I'm still so shocked how limited the Mac App Store is. No trial versions, no in-app purchases, no subscriptions, etc. This has led to companies like Bohemian (makers of Sketch) [1] leaving the Mac App Store.

I'm not being facetious when I ask people more knowledgeable than me: why does Apple put so little effort into the store? Is it just too small to warrant their attention? It just seems to me like they don't even try.

[http://bohemiancoding.tumblr.com/post/134322691555/leaving-t...](http://bohemiancoding.tumblr.com/post/134322691555/leaving- the-mac-app-store)

<comment><USER40> Limited from a developer perspective but fantastic from a consumer one (except maybe the trial version stuff).

<comment><USER41> Not so fantastic, because it resets the ratings every update, which translates in developers constantly begging for stars...

<comment><AUTHOR> I do agree resetting the ratings at every update is a big hassle. I wonder why Apple doesn't have the reviewer determine whether or not the rating should be reset. Perhaps that would introduce too much power to the reviewer(s?).

</comment></comment></comment></comment><comment><USER42> So now reviews will tend to self-censor and be glowing, happy-clappy rubbish.

Maybe Apple apps need an app dev <-> user support mechanisms for private feedback, FAQ and bug tracker to funnel bitching productively.

<comment><USER43> No, it'll still be self-selecting:

Good developers who actively respond to reviews will improve their apps. Somebody who left a low review due to a misunderstanding now has a chance to increase their review because of a diligent developer.

A developer who doesn't care and/or doesn't monitor their reviews will not turn that user around.

</comment></comment><comment><USER44> What does "currently shipping iOS devices" refer to? People who buy an iPhone on the web store today will have iOS 10.3? I just checked on my iPhone and the latest is 10.2.1.

<comment><USER45> That means it's compatible with all currently shipping iOS devices. iOS 10.3 just entered beta, though, so it'll be a few weeks before it's the shipping, released version.

</comment></comment><comment><USER46> When was the last time you browsed the App Store or read reviews?

</comment><comment><USER47> Would there be a second factor authentication? I'm sure developers would find ways to abuse this

</comment><comment><USER48> It's about bloody time.</comment>


How we got our AWS bill to around 2% of revenue - <AUTHOR> https://www.sankalpjonna.com/posts/our-aws-bill-is-2-of-revenue-heres-how-we-did-it <comment><USER3> If you end up in the lightsail world and you are not utilising Amazon's other services then its probably cheaper to do this with another provider. Someone like Contabo or Hetzner will get you VMs at substantially less cost with similar fixed hardware and just give you the box but for a lot less a month. At these low scales with a completely open source stack Amazon isn't good value in my opinion. It is as you grow and it provides the scale that it becomes valuable.

<comment><USER4> This is interesting. Do you have (or know of) a published comparison somewhere?

<comment><USER5> What kind of comparison are you expecting?

Go to hetzner.de, create an account, fire up one of their 5€/month VPS and see if it runs your application well. If it doesn't, upgrade the VPS (or whatever) till the max or until you decide that AWS or whatnot might be better suited (or cheaper).

It's nothing personal against you, but those comparisons aren't worth anything. They are highly specific to the test case, which might very likely not be like the stuff you are trying to run.

And I've just so often seen people on StackOverflow ask how to fix their AWS setup to run a simple WordPress site, it's unbelievable.

There's this old saying: "If the only tool you've got is a hammer, everything looks like a nail."

That pretty much works for GC/AWS/Azure, too.

<comment><USER6> I think hetzner has servers in Germany and Finland only, not the right choice for most people here.

<comment><USER7> Hosting in Finland and Germany is a great choice for a lot of the right reasons.

</comment></comment></comment></comment></comment><comment><USER8> Just to be clear, this would be more appropriately titled How we saved money moving from AWS to VPS providers.

It comes as little surprise to me that the AWS lightsail offering saved them money over traditional AWS services, just as they'd save even more using two dedicated servers with any reasonable provider and being able to have a hot- failover for everything.

At DNSFilter we've gone through the evolution of Heroku -> AWS -> VPSs -> Dedicated -> and now are setting up our first colo rack.

I did a price comparison recently between Dedicated, AWS, and Colo. Dedicated is 15% the cost of AWS for our needs, and colo will be 42% the cost of Dedicated for us.

Now keep in mind we have dedicated DevOps staff and are running at a very different scale from OP, and such a solution is not for everyone. But I personally have never understood the folks who love to brag about having spent much time and effort optimizing AWS to spin up and spin things down, when for the same cost I could just have a 10x more powerful server sitting there, on all the time to handle a spike in load, and I can utilize the extra resources or get things done faster with faster gear at 1/10th the price.

<comment><USER9> 100% agreed. I always cringe when I see some hot new startup going all out on AWS or other cloud services when a $60/mo dedicated box would have more than covered their needs. No point spending that money until they actually need to worry about scaling, and even then, the value of dedicated servers / colo is so much better if you have the staff to support it. I manage a top 2k site off of some OVH boxes and our bandwidth alone at any of the major cloud providers would be many multiples of our monthly bill.

<comment><USER10> Would you mind sharing any of your experiences with OVH that you're able to? I've used them before for hobby projects but was always worried about reliability for anything more serious. Had also heard questionable things about their networking reliability. Anything related to roughly how many machines you run, types, problems encountered, etc would be super helpful. Thanks!

<comment><USER9> I actually had similar concerns, in my mind OVH was always one of the lesser regarded providers with cheap hardware and attracted not-so-nice customers judging by the amount of spam I used to get from their network.

I ended up moving my personal projects to OVH as a trial (and due to some some gross incompetence by Singlehop). After a few months of everything looking great, I moved our company's production services and couldn't be happier. I now consider them one of my tier one options when looking for hosting options. The hardware on the higher end models is all enterprise grade - Xeon, ECC, enterprise SSD / NVME drives, etc. You also get full IPMI access with virtual media, so setting up full disk encryption etc is a breeze. Network has been very reliable, their DDoS protection in particular is almost magical - <USER2> barely even see the malicious traffic before their network filters it. I only have a handful of servers, but none of them have experienced any hardware or major network issues. Currently have servers in their Vint Hill, Beauharnois and Roubaix datacenters and it all seems to be equally reliable.

The value-add features like FTP backup space haven't been great, speed / reliability problems but I don't care too much for it anyway, I ended up using Hetzner for backup storage as they have a ridiculously good $/GB ratio. I can't speak much for OVH support as I've rarely had to contact them, the few times I did they resolved the problem satisfactorily. With IPMI access and being an unmanaged service, you're probably on your own for anything software related.

<comment><USER10> Awesome, thanks so much for the info. Glad to hear it's a viable option since the hardware prices always seemed great and the unlimited bandwidth would be key for certain applications too.

</comment></comment></comment></comment></comment><comment><USER11> > An EC2 instance with 2 virtual cores, 4GB RAM and a storage of 80GB costs > roughly 37$ a month and a Lightsail instance with the exact same > configuration costs 20$ a month which is almost half the cost!

The author completely failed to do his homework. An a1.large instance is only 37$ if it's an on-demand instance. You pay a high premium to be able to pull the switch in the exact minute you cease to need one.

If he's willing to go with AWS lightsail with it's monthly plan, the same a1.medium instance type is about 11.75$/month as a reserved instance, and can be had for about 131$/year as well.

<comment><USER12> The Lightsail instance comes with 4TB/mo of free transfer. Even using a small fraction of that transfer on EC2 will cost you more than the instance itself.

Also, creating an instance on Lightsail isn't exactly a monthly commitment. You are free to delete your instance at any time and only pay for the hours you used. It's a lot more flexible than the multi-year commitment you need to make in order to get the best pricing out of EC2.

<comment><USER13> Yea and 4TB is $360 which dwarfs everything else.

<comment><USER14> Okay, I don't get this at all!????

If I want to move 400 TB per month out of Amazon, why can't I just proxy it thru 100 Lightsail instances?

Isn't that much cheaper than paying directly per byte? For that much saving it's probably worth figuring out how to do this. It can't be hard.

Isn't it "free" to move data internally to a lightsail instance, as long as both are in the same DC?

<comment><USER15> > If I want to move 400 TB per month out of Amazon, why can't I just proxy it > thru 100 Lightsail instances?

There are some answers in the lightsail faq[1]:

1\. You're limited to 20 instances per account. They'll increase that number on a case-by-case basis, but probably not if you're planning on proxying all your traffic through those instances.

2\. If you delete an instance and create a new one, they share the same data transfer allowance.

3\. All data transfer (both egress and ingress) applies to the data transfer allowance.

It may still be worth doing the proxy setup, but Amazon seems to have pretty clearly set up limits to make it less desirable.

___

1\. [https://aws.amazon.com/lightsail/faq/](https://aws.amazon.com/lightsail/faq/)

</comment></comment></comment></comment></comment><comment><USER16> I dabble extensively in being dirt cheap with my monthly cloud spend on personal projects, and after much experimentation, I have settled on the following:

1\. elastic beanstalk, no docker: EB comes with really nice defaults so that you can quickly whip up a flask app, upload it and it just works. It provisions a small ec2 instance by default which iirc costs 10ish a month at best. Importantly, any operation you do with EB will by definition be ready for continuous deployment since you don't get an option to ssh into the machine to deploy. It's extensible enough to add whatever extra stuff you need as well. Only thing it can't do is simple caching ( if you scale to more than one instance that is), but that can be solved by having a separate eb deployment for a worker that can take care of all these aux stuff (elasticache is expensive I think). In a pinch, it also scales well (though the default cheap deployment does not have a load balancer).

2\. Just suck it up and go with RDS postgres. Again, I see too many things going wrong with spinning up your own db in an ec2 instance especially if that instance goes down. Im too lazy to write backup scripts and keep track of them! The cheapest RDS postgres costs 13 a month or so, but I just suck it up to power whatever side projects I do. Postgres means I'm working with something I know, and I get full text search and pubsub for free. And whatever I write is not locked code in anyform, and can be scaled up if needed as well. More importantly I'm only spending my time in technologies that are relevant for me in my day job so that's a win.

3\. Github Actions to deploy to eb. just a few lines of yaml and you instantly get continuous deployment directly from your repo for free! Really can't beat that.

I have meant to try out heroku since it could be cheaper from what I have read. But I couldn't figure out what their S3 alternative is or how different they are from the canonical cloud offerings.

I'm sure it can be so much more cheaper, but I'm not good at advanced networking or sysadmin, and I'm too lazy / bored / disorganised to write deploy scripts or sshing into remote machines. I'm also always afraid of if/how long I need to re-provision a vps/ec2 if it goes down. Not that they do, but they can, and that scares me.

<comment><USER17> Have you come across any cheap elasticache alternatives? I'm on AWS free tier and AWS gives you a free 2 vCPU 0.5gb(or 1 vCPU and slightly more memory) instance which suits me for now. But I was wondering if there are any other managed redis alternatives? We are just 2 people and we want to keep our stack open to be able to switch providers and I don't know how easy it'd be to switch db instances.

I have explored redislabs but all in all it seems much more expensive than elasticache. A similar instance from redislabs costs ~$36 vs ~$13 in AWS. My comparison was based solely on capacity

<comment><USER16> Perhaps you could consider hosting redis on lightsail? It might be the cheapest memory option within AWS (so traffic is free and fast). But it sounds like you're trying to use it as a database? I'll still go with managed MySQL/postgres - you can use the database's backup and restore abilities top switch providers fairly seamlessly- I have done it from gcp to AWS. Which is why I suck it up to RDS.

<comment><USER17> I only need ephemeral storage. I really like the pub sub functionality (which is the my most urgent need) of redis and the key value pair store suits me for now.

</comment></comment></comment></comment><comment><USER18> One problem of VPS solutions is that they're easy to maintain until you have to do it. At some point the technical debt comes back and you need to upgrade the stack components and eventually the OS as well, without sacrificing uptime.

... if you did things well, it's just starting another instance and installing / copying things over with some minimum downtime. But if you don't have a 100% documented stack, you don't know which configurations you touched to make things work, you have files lying around, then you're probably going to pay back all your savings and more in the workdays needed to migrate.

At my current employer we never have time for maintenance, and we don't have professional expertise (the "I worked exclusively at this for many years" kind, I mean) at webhosting, security, system admin or dba, so I heavily lean towards more "managed" and cloud solutions.

<comment><USER19> But cloud solutions can change their UIs and APIs anytime they want. They can also drop features as they please.

<comment><USER20> Has any major cloud provider ever done a major change like that without 6+ months of advanced notice?

</comment></comment></comment><comment><USER21> I read a lot of "you are wrong", "you didn't think about this", etc, which I'm not going to get into. I embrace these posts as an invitation to re-evaluate, with your own data and use cases, your technical decisions and for that I'm always grateful.

On the same note, in case someone is digging into how to reduce CDN bills, I wanted to share that we are quite happy with BelugaCDN. It distributes objects stored in S3 using, in a hacky way, referrals as authentication method. Lots of money saved there.

</comment><comment><USER22> A bit off topic, but I bet someone here knows. When running an EC2 instance and not using all of the cores on the socket (for example, using a c5.large instance instead of a c5.12x large, which gives you all the cores on the socket), you presumably are sharing your L3 cache with your neighbors on the same socket, because that's how the processor is designed.

Is there a way that the hypervisor allocates a dedicated portion of the shared L3 cache to just your instance, or is it a free for all for all of the L3 cache space against potentially noisy neighbors?

<comment><USER23> Yeah that is true, you are sharing L3 cache. In order to mitigate some of recent intel issues I think AWS actuallly has their own chip now on newer motherboards to handle the hypervisor duties securely.

Otherwise, they'd do it in software patches for older CPUs and take the performance hit of the patch.

I'm not sure how much the hypervisor would reserve off of the L3, it is likely to be free for all however you'd still have quite a bit of dedicated L2 and L1 on most xenons. With AMD's first gen EPYC it's a little bit different because clusters of cores share a cache and you can get weirdly high latencies depending on which cores you're using, (i.e. cores 8 and 9 being too far apart)

Also according to this anandtech article, the average total CPU load for physical aws machines is ~60% and is actively balanced out by them. And yes, running benchmarks on a machine without noisy neighbors yields very significant improvements, up to 2x better on the benchmark scores. They measured this by comparing renting out all the cores of a machine vs only renting out the 4 or however they needed .

[https://www.anandtech.com/print/15578/cloud-clash-amazon- gra...](https://www.anandtech.com/print/15578/cloud-clash-amazon- graviton2-arm-against-intel-and-amd)

I'm assuming they'd put a CPU into sleep/hibernate mode in order to save power instead of having it only run at 5% utilization.

<comment><USER22> Without any dedicated hypervisor tricks, can't a typical L3 cache eviction algorithm also evict memory that is assigned to another core and currently residing in its L2 or L1 cache? (Thereby flushing even the higher level caches if another core is really noisy.)

<comment><USER23> I'm not entirely sure, it looks like for Skylake CPUs the L3 cache is no longer inclusive but instead acts as an extension of the per core L2 cache.

[https://www.anandtech.com/show/11550/the-intel-skylakex- revi...](https://www.anandtech.com/show/11550/the-intel-skylakex-review- core-i9-7900x-i7-7820x-and-i7-7800x-tested/4)

I remember a while ago reading about storing your encryption keys in L2 instead of ram and deliberate "abuse" of the L3 cache on VPS hosts however can't find that article and haven't kept up with the news on it.

Given that the intel cpu patches have reduced CPU performance by ~15% ( again sorry don't have the exact source) I'd say there has been quite significant changes in cache management in the name of security.

<comment><USER22> Thanks for the info. It's a dilemma when allocating instances because I want the full per-core performance but I don't need a full socket's worth of cores, so I just have to hope my neighbors aren't running huge jobs all the time.

</comment></comment></comment></comment></comment><comment><USER24> Maybe I missed something, but how do you handle the fact that your nginx server is a single point of failure? If that goes down, traffic can't get to your web servers.

Do you have more than one, and DNS load balance, or do you just live with the risk?

One of the main reasons why I use an ALB/ELB is so that I don't have that SPOF. If you found a way around that, please share, I would love to know, so I can save some money :)

<comment><USER25> His database also is.

I think it's highly unprofessional to use a setup like this in production. Looking at his product, it seems like a product whose downtime has a big impact on their clients.

</comment></comment><comment><USER26> Their setup is trivial - they could do it at 0.2% of revenue with a cheap vps on Linode or other...

<comment><USER15> > Their setup is trivial - they could do it at 0.2% of revenue with a cheap > vps on Linode or other...

Lightsail has pretty comparable pricing to Linode. I'm sure they could re- architect their app to use fewer instances, but they could do that and stay on Lightsail as well.

Moving to linode isn't going to give them a 90% savings.

<comment><USER27> The price seems on par. Are there hidden costs on aws?

<comment><USER28> I'm assuming that you might not be aware of AWS pricing.

It's actually incredibly complicated and often very difficult (if not impossible) to predict. We have a dedicated part of our organisation which exists solely to figure out costs ahead of time for project.

I'm not sure if it's intentionally obfuscated, I would suspect not, because "pay for what you use" can be broken down into many areas.

<comment><USER29>
        It's actually incredibly complicated and often very
        difficult (if not impossible) to predict.

Not a joke: there are people that optimize aws bills for a living.

<comment><USER30> There are startups that build specialized AI to optimize AWS bills for a living.

</comment></comment></comment></comment></comment></comment><comment><USER31> It's the difference between pets and cattle.

They are using Lightsail to create pets, it has not much configuration. When you need a cattle, you need more config and complex setup which costs money.

As they say in the end, this is because they are a micro startup and don't need a huge scalable infrastructure.

It's funny as it seems to be the inverse of economy of scale. The more you grow, the higher the marginal cost. But I think that Amazon gives discount to large users

</comment><comment><USER32> For context, I know the ins ands outs of most of the core AWS services _really_ well from the dev, Devops, and ops side.

But, my advice tends to be Lambda first if it is really low volume, LightSail second, and full AWS third.

As far as Lambda, I often recommend proxy integration, where you can just use the standard API framework for whichever language you choose (Django, Flask, Express, ASP.Net, etc) add three lines of code and push the entire thing into Lambdas. This gives you the flexibility to deploy to a VM later with no code changes.

For your static assets use S3, except for the case of Lightsail where you get plenty of free bandwidth.

<comment><USER33> Hello, author here.

I totally agree on Lambda first. The only reason we did not do that is because when we started this product I was not well versed with Lambda and serverless and preferred to work with something that I dealt with previously.

If I could go back in time, I would set up all our applications on serverless.

<comment><USER32> Disclaimer: I work for AWS Professional Services but I just started. All of my experience comes from working at outside companies.

From the perspective of an outside, boots on the ground Developer/architect, I've never worried about "vendor lock in", I believe you should choose your infrastructure wisely and go all in. But, I do worry about "Lambda lock-in" for APIs. I like the optionality of being able to deploy my APIs anywhere just by changing the CI/CD pipeline.

That's why I recommend using proxy integration. Every language supported by Lambda has a method to just throw your standard API in lambda without tying yourself to it.

Here is an example for Node/Express

[https://github.com/awslabs/aws-serverless- express](https://github.com/awslabs/aws-serverless-express)

Python/Flask (ignore the DDB part):

[https://www.serverless.com/blog/flask-python-rest-api- server...](https://www.serverless.com/blog/flask-python-rest-api-serverless- lambda-dynamodb/)

C#/Web API

[https://aws.amazon.com/blogs/developer/deploy-an-existing- as...](https://aws.amazon.com/blogs/developer/deploy-an-existing-asp-net-core- web-api-to-aws-lambda/)

</comment></comment></comment><comment><USER34> I'm wondering if Lambdas and DynamoDB would be competitive to this setup.

<comment><USER35> Since they are serving about 250 requests per second, Lambdas might end up being more expensive, factor in an expensive DynamoDB and that monthly AWS bill looks scary.

<comment><USER33> Hello, author here. I just want to confirm that this is one of the reasons why we did not go with Lambda and the other reason being I was not fully aware of and versed with serverless when we started this venture

</comment></comment></comment><comment><USER36> You can shop for deals on VPSes at lowendbox.com. But if you're trying to run a business, this is a waste of time. Find a provider which is highly reliable, which can also automatically rebuild all failed infrastructure with no intervention needed. That eliminates 99.999% of the providers out there. You're paying a premium to never have to think about your tech again, so you can focus on the business.

Besides using the free tier and other AWS services which are practically free at low uses, you can use cost effective options like Fargate Spot Instances and EC2 Reserved Instances. I highly recommend Fargate over running instances. Use Lambda with CloudWatch triggers if you need to schedule occasional jobs (or use Fargate's feature for that). Try to avoid heavy reliance on caches, ElastiCache is kind of a rip off. Move as much content to static as possible, use CloudFlare to reduce bandwidth costs. If you're gonna serve over S3, you might as well front it with CloudFront as it's actually cheaper due to caching at the edge, and also more reliable. ALBs are expensive but very useful for APIs as well as autoscaling (if you have to run instances, run them with an ASG, which also means having versioned AMIs)

</comment><comment><USER37> For the mathematically disinclined (such as myself), the total savings are at least $229/mo .. not bad! Curious if you could use Cloudformation to provision these instances and setups? [https://lightsail.aws.amazon.com/ls/docs/en_us/articles/amaz...](https://lightsail.aws.amazon.com/ls/docs/en_us/articles/amazon- lightsail-cloudformation-stacks)

</comment><comment><USER38> I'm interested in the managed DB part of this writeup, specifically that OP chose Lightsail. The last time I looked into it, Lightsail was MySQL only, so that was good to know.

I wrote a PostgreSQL DBaaS Calculator that got some traction here a while ago, and I just updated it this evening to add Lightsail to see how it stacks up: [https://barnabas.me/articles/postgres- dbaas.html#calculator](https://barnabas.me/articles/postgres- dbaas.html#calculator)

No surprise, Lightsail is similar pricing to RDS with a 1-year commitment, but it's month-to-month. It's a pretty good deal until you need more than 8 GB memory, 240 GB storage, 2 cores ($115/month Standard plan). But Azure or AWS RDS are the ones to beat.

</comment><comment><USER39> When I did data center stuff for a large company the biggest cost was network - not servers. Specifically network security and redundancy.

Its amazing to me that this is all included for basically free except for Application level filtering by these providers.

<comment><USER40> Yep, I was consulting for a firm with an already sizeable infrastructure investment/dependence on AWS, and their architects were proud of their best practice usage of multiple AZs for redundancy, but weren't know that inter-AZ traffic cost also. So I imagine they're going to have fun trying to incorporate that into their infrastructure layout.

In my day job we saved $600 a day by cutting down on needless inter-AZ traffic.

</comment></comment><comment><USER41> > An EC2 instance with 2 virtual cores, 4GB RAM and a storage of 80GB costs > roughly 37$ a month and a Lightsail instance with the exact same > configuration costs 20$ a month which is almost half the cost!

In general I'm not sure you can really compare instances from different service by just look at cores, RAM, and disk.

I used to have my small website and email server at Rackspace, on the smallest, cheapest instance. I ended up getting out of mail hosting (moved that to Fastmail), and putting the small website on Lightsail.

The Lightsail instance and the old Rackspace instance have the same nominal specs for virtual cores, RAM, and disk. (Actually, Lightsail may be better on disk--I don't recall if the Rackspace one was SSD like Lightsail).

The main thing the website actually does is host some graphs showing the temperature in my house. An ESP8266 temperature monitor I made uploads a sample once a minute. A script was running once a minute on the server that using gnuplot to make graphs of temperature over the last hour, 3 hours, 12 hours, 48 hours, and over all samples.

At Rackspace it ran that fine, while at the same time gathering my mail from several services via fetchmail, receiving mail for my domain on its smtp server, and running spam filtering.

On Lightsail just handling the website it was locking up every few hours. I managed to catch one pre-lockup and found the load average was something like 300.

What was happening was sometimes that once a minute graph generation task was taking longer than a minute, and that would slow down the next one, and so on. Oddly, it didn't seem to be gnuplot that was taking too long, but rather the script that took the file containing all the samples, and extracted just the samples newer than a specific threshold. At least, running everything by hand that was the only step I ever saw take unusually long.

I changed it to every 5 minutes to temporarily stop the frequent hanging, and then added a check to my script to skip regenerating the graphs if a previous instance of the script was still running to fix things permanently. I also changed it from storing the data in just a big file of samples sorted by time to an sqlite DB.

</comment><comment><USER42> TLDR: Use Lightsail, Amazon's approximation of a dedicated server.

In my opinion, that approach sacrifices pretty much all the benefits that cloud proponents usually talk about, like only paying for what you actually use or scaling up and down on demand.

In fact, I'm not sure what the actual difference would be between Lightsail and a good dedicated hoster that provides backup and failover services.

<comment><USER43> The difference would be:

\- They could have much better service

\- And bring down their expenses by at least half again

I used lightsail, and it's a terrible service.

It is very expensive (still) compared to other hosting providers.

And if your instance ever go out of memory, it become unresponsive for as long as you don't go manually restart it.

On other providers that I use, the OS would just "sacrifice child" (kill the process) and restart it.

It's not ideal, but much better than having to go there yourself to restart the whole thing.

<comment><USER42> I've been using cgroups since way before docker made them cool exactly for this: if one process goes rogue on memory use, make sure only exactly that one crashes.

And yes, I fully agree with you. In addition to the other disadvantages, Lightsail also shifts the burden of process monitoring and management onto you.

<comment><USER43> I use docker. And yes, it normally just take care of restarting the app whenever something goes wrong.

But somehow on lightsail (only), the machine just goes completely unresponsive instead.

</comment></comment></comment></comment><comment><USER44> Slightly off-topic, but is there a book to learn about this kind of stuff, preferrably without having to sign up for AWS, but that does have code samples and whatall?

<comment><USER33> There is one book that I would highly recommend - [https://gumroad.com/l/aws- good-parts](https://gumroad.com/l/aws-good-parts)

</comment></comment><comment><USER45> I don't understand why this is so special? Ours is about 4% for a very compute heavy service handling millions of events per day across four continents.

</comment><comment><USER46> It's no secret that I've had my fair amount of criticism towards AWS's billing and how unpredictable it becomes, even if you read every fine print and take everything into account. Especially if you are a heavy user, "correction invoices" are not uncommon. That said, cloud services can be incredibly cheap if you are very careful and smart about it. Especially if you combine several of them.

</comment><comment><USER47> Another approach to consider, that's so straightforward and quick that most will consider it boring and overlook it.

\- kill services with low usage

\- downgrade instance size

\- downgrade instance type

\- merge databases

\- schedule services with obvious usage patterns to shut down when not used

\- use EC2 spot instances

Most importantly, it requires an aggressive culling mindset. If drastically reducing the AWS bill means staying afloat, then make bold choices.

</comment><comment><USER48> As a summary: They use AWS, see huge bills, then decide to not to use AWS services and switch to redis, nginx etc.

</comment><comment><USER49> A lot of this is penny wise pound foolish. Managed services cost more, but they provide more. RDS is just such a simple slam dunk for what you get for the cost. How much does it cost to spend 8-20 hours a week handling maintenance and upgrades and scaling for these services? I guess I'm bitter working on a project that was built with all sorts of crazy custom deployment stuff too conserve costs that's a total OPs nightmare. Moving from Redis on EC2s to elasticache was such an upgrade. We constantly had little issues here and there.

Edit - Alsocontainerize your app from the start so that if it does take off you can slam it in ecs or k8s.

</comment><comment><USER50> So Lightsail is the AWS equivalent of DO/Linode/etc?

<comment><USER6> Yes, AWS probably realized that they losing money to DO/Linode so to capture some of that market they launched Lightsail.

</comment></comment><comment><USER51> The general rule of thumb to drop AWS bill is spot instance. Which is very hard to do unless you build your application to be tolerant of server kills.

</comment><comment><USER52> Definitely off topic, are you using Twilio/Whatsapp at superlemon.xyz ?

I wonder how do you cover the cost for unlimited outbound messages in your free plan...

Thanks

</comment><comment><USER53> You said you basically use Shopify as CDN, what's stopping everyone from just setting it up and abuse it?

<comment><USER33> Hello, author here.

Like I mentioned in the post, there is no way to programmatically upload anything to the Shopify CDN and the CDN cache cannot be invalidated once you upload a file. If you want to update an existing resource, all you can do really is upload a new one.

This ofcourse still does not completely prevent people from abusing it, but it does restrict usage to a large extent. There is also the issue of giving out a cdn.shopify.com link to your customers instead of something that has you company branding on it. This is not a problem for us because our customers do not have to manually add this snippet to their website and we do it via an API instead, so this link is not apparent to our customers

</comment></comment><comment><USER54> Do Hetzner or xneelo reflash the firmware on server hardware when they recycle them across users?

</comment><comment><USER55> How do you solve high availability with the nginx setup? What software for heartbeats?

</comment><comment><USER56> Another day, another SaaS that I can't believe has value.

</comment><comment><USER57> Really good one.

</comment><comment><USER58> Here is how I do: no revenue, no bill. ;D

<comment><USER59> I've first hand, witnessed people having no revenue and a long AWS bill. A direct consequence of using all the hip services when they didn't need any. I'd say you're doing great (to be clear this is not sarcasm)

</comment></comment><comment><USER60> Tldr;

Author is talking about few hundred dollars here.

<comment><USER61> At that rate a raspi on starbucks wifi would get them to 0.2%

</comment></comment><comment><USER62> I appreciate the disclaimers at the end:

> _I would like to put emphasis on the fact that we are a micro-SaaS product > that solves a small and specific use case and therefore this kind of AWS > setup worked for us. This may not work for big organisations or products > where the traffic is erratic._

> _This setup will also not work for folks who have a ton of stuff to do > already and would prefer to use managed services and not take the additional > headache of monitoring, maintaining and provisioning hardware resources on a > regular basis because this has a time cost to it._

It is refreshing to see a post that doesn't pretend as though its recommendations are the holy grail for anyone and everyone.

I personally prefer saving time and effort, over a ~$500 monetary discount. But it's nice to read posts like these and learn more about alternatives such as Lightsail.

<comment><USER63> > I personally prefer saving time and effort, over a ~$500 monetary discount.

Completely agree. As the general "Ops" manager, I hate getting the call at 2am because something broke... I hate it even more when it's not really fixable by me in the first place (e.g. black box appliance or software).. but I feel a heck of a lot better when I can point the finger at an external team that's paid and supposed to be experts... If you outsourced Redis or you DB, and someone like AWS or MongoDB themselves has an issue... Will they pay people a lot of money to simply provide that service reliably... I get paid to keep 20 things connected, not be the subject matter expert in all of them.

<comment><USER19> > but I feel a heck of a lot better when I can point the finger at an external > team

But how would you feel if you were not just the Ops manager, but the CEO as well?

<comment><USER64> I think if I were the CEO I'd have even more on my mind than managing servers.

I totally get that it can be cheaper to do things yourself. And I also get that sometimes you literally can't afford to go the easier route.

But I also think a lot of people of forums like this overly discount time spent or even just distraction that take away from doing the many other things you could be working on as part of a business.

</comment></comment></comment></comment><comment><USER65> Text from about me:

> where I learnt how to scale an application to serve ads to millions of users > a day

Please lets stop this 'race'.

</comment><comment><USER66> AWS expense/ revenue is an insane anti-metric to track.

</comment><comment><USER67> I have a question: (it may not be related to this article in any other sense aside from "really lightweight" use of AWS...

I would like to have a workflow of really lightweight QR/barcode transactions... but with what seems to me currently a complex implementation:

1\. you have a prescribed barcode ParentA 2\. you scan that barcode and create a QR code ParentB 2.a: you ascribe that QR to an object ChildA 3.n: you have that ChildA go through many iterations 3.n+: ChildA may be conjoined with ChildB,C,D etc... -- but I want an iterative QR code that follows the family tree back to parent A and keeps history of all transitions...

(I know I am wording this poorly... just thinking out loud...)

<comment><USER7> So what about the grandparents, and how would ChildN go to kindergarden?

<comment><USER67> What a fucking stupid response.

The workflow that I am talking about would apply to taking the nightmare out of METRC tracking system for cannabis -- the METRC system is a piece of shit - but wants complete chain of history of how plantA becomes productA - and it is a bullshit workflow - and I have a way to make it easier - and by using a system similar in the way described in this post, it could be done very cheaply...

<comment><USER7> For what is this workflow? Just curious.

If it's barcodes being used by humans in the real world, get a software package to handle it, check the solution from Zebra [https://www.zebra.com/us/en/products.html](https://www.zebra.com/us/en/products.html)</comment></comment></comment></comment>


Always on eInk display (kindle?) + react website - <AUTHOR> Dad, husband, designer, dev, and productivity nerd here. I bet someone in the HN community has figured this out.
THE GOAL: A system of tasks that is slightly smart to help with my family chores.
THE MPV: Post its around the house that are rewritten daily or weekly.
Is great, but is high friction, ideally the v1 hooks up to our digitals tools.
V1 IDEAS:
1. mounted eink display. Mounted to the wall. Maybe we charge once in a while or permanently plugged. Locations: - Bathroom: hooks to calendar events in the morning, plus task list. At night tasks to do before bed. - Kitchen: food plan for the day - Hallway: departure checklist
2. Always on? ideally the content is always visible, b/c of eink it doesn't blast your eyes or attracts the attention of a toddler. Less good but ok, you have to unlock to show the website.
3. What's on the display: it just uses a browser (eg. Kindle's experimental browser) to show a url. The content should always be up to date.
4. React? Ideally I can hack with react b/c it's fast, simple and I'm experienced.
5. Ideally it's an interactive display. Apart from consuming info, being able to press button and take actions would be awesome.
What I've learnt so far: - I've tried Nicholas Jitkoff's hack for older kindles: https://docs.google.com/document/d/1efF6TXezl_2qaeZ6pHMScXSmOJ4cs2WRLA-s90eySSA/preview But the described steps no longer work with latest version of jailbroken kindles - looked into other eink displays but nothing looks very promising.
Thanks for reading so far! Any thought/comment will be deeply appreciated. <comment><USER2> Maybe this pretty cool project of Max Braun takes you in the right direction: [https://onezero.medium.com/the-morning-paper- revisited-35b40...](https://onezero.medium.com/the-morning-paper- revisited-35b407822494)

<comment><AUTHOR> Thanks!</comment></comment>


"Anonymous" Hacks Anti-Piracy Takedown Tool - <AUTHOR> http://torrentfreak.com/anonymous-hacks-anti-piracy-takedown-tool-120706/ <comment><USER2> I can't decide whose grammar I hate more: Anonymous's grammar or Copyright Labs's. Why add an ignorant and incomprehensible rant to a legal notice when you can materially alter its content and actually cause major problems? And who would ever use the word "u" when apologizing for a malformed legal notice?

Anyway, I would have changed the infringement notice to:

Dear $site,

Copyright Labs, registered copyright agent for $big_studio, has recently done a survey of the content on your website, $site_url. This letter is notice that $big_studio has granted you an irrevocable license to distribute $infringing_content indefinitely. There is no need to respond to this letter.

Regards,

Copyright Labs on behalf of $big_studio

If you're going to commit a crime, you might as well do a good job.

<comment><USER3> Its pretty clear by now that the language Anon uses is a parody of itself. I can guarantee you that the statement was written and reviewed by committee.

I highly doubt anyone has a hard time identifying it. This goes back years, to early early 4chan days. Representing themselves in the voice of the incompetent yet proving absolute competency is Anonymous's calling card. Getting hacked and having to explain a clearly phrased, embarrassing email bomb is about as bad as it could get for a security contractor. Way worse than the same if it were just a defacement.

<comment><USER4> Reminds me of when H4CK1NG 4 G1RL13Z hacked the NASA JPL and New York Times

</comment></comment></comment><comment><USER4> So, I'm guessing that the e-mail blacklist comment that BitSnoop e-mailed is a lie, since we have the response?</comment>


I Want To Love Firefox 3.5, But It Keeps Crashing On Me - <AUTHOR> http://www.techcrunch.com/2009/08/08/i-want-to-love-firefox-35-but-it-keeps-crashing-on-me/

<comment><USER2> Just don't abandon old friends when you make new ones!</comment>


The Psychology of Color in Marketing and Branding - <AUTHOR> http://www.entrepreneur.com/article/233843 <comment><USER3> Ah, one of my favorite topics.

The article correctly points out how there are no simple rules of thumb on this. The human visual system is very much driven by context and contrast, which makes it basically impossible to validate statements such as "red just works better than green".

That _does not mean_ that there's no system, though.

There is growing evidence that fast ("System 1") human decision-making tends to favour salient (i.e. visual pop-out) choices over less salient ones - <USER2> example, a recent PNAS study [1] found that the pop-out effect of a food item has a sizeable influence on it being picked up when consumers are in a hurry - going as far as even overriding prior brand preferences.

Disclosure: the software to quantify pop-out used in the study was build by my company ([http://eyequant.com](http://eyequant.com))

[1] [http://www.pnas.org/content/110/40/E3858.full.pdf](http://www.pnas.org/content/110/40/E3858.full.pdf)

</comment><comment><USER4> It's all about linking those outside inputs to one's brain. A simple question: what comes to your mind when you hear the name of your favourite fruit? There are some nice books with different theories, but, to get it, I found this is a good starting question to explore and understand what brand is after working and learning in branding and marketing for a while.

</comment><comment><USER5> Marketing with colors outside of the Estados Unitos will also have it's own perils. [http://en.wikipedia.org/wiki/Color_in_Chinese_culture](http://en.wikipedia.org/wiki/Color_in_Chinese_culture)

</comment><comment><USER6> Interesting. So it's not that yellow and red actually make people hungry, as the legend goes, but rather those colors are seen as more appropriate for restaurants. Makes sense.</comment>


Programming language trends - <AUTHOR> http://drewconway.com/zia/2013/4/29/programming-language-trends

<comment><USER2> Nice reading, changing the world is more related to output that input, sometimes the least necessary influence is gather more and more input in our weekly routine, sitting there reading, a dull book will will only change our health, it's what we produce that may have some effect. All my respect to all the authors all the people that produce something meaningful, that research and breach the boundaries of science, all of those who teach and share.</comment>


Demonstrations of Attacks Against Implanted Cardiac Devices [pdf] - <AUTHOR> http://d.muddywatersresearch.com/wp-content/uploads/2016/08/MW_STJ_08252016.pdf <comment><USER2> This is more about stock price manipulation than it is about implantable medical device security.

Having worked in the medical device industry for over a decade, I know first- hand how bad the security situation is on the vast majority of devices. It's by no means unique to St. Jude. The fact that these issues exist is also old news, as noted in the Bloomberg article linked by jevinskie.

In addition to new devices continuing to take a lax approach to security, there are the ongoing vulnerabilities in the older devices. The older models continue to be sold, and many of the older devices are still implanted in patients.

Is it an issue? Yes. Should something be done about it, perhaps by withholding FDA PMA or 510(k) clearance on new insecure devices? Probably. Is it unique to St. Jude? Not in the least.

<comment><USER3> My first 'real' job as an engineer out of university was working for one of the big three device makers at about the time they had released their first model with a remote telemetry sensor that you would keep by your bed side. I was so excited to get to play with 3G and remote sensing, and to top it off, for devices that will literally save lives! Yeah, not so much.

I remember talking through the whole process with some of the engineers deepest into it and thinking "holy crap this is bad." It then scared me more, because I'm only 6 months out of university, what the heck should I know? But this crap passed FDA approval and had a team of very expensive people working on it.

I left that place after less than a year when I realized the only people I was working with had been in the industry for 20+ years, were pretty much doing the same thing they'd been doing for two decades, and more importantly, were absolutely resistant to doing anything differently. I think that's one of the biggest problems with medical devices- hardware/low level engineers are generally older and not used to preventing the types of threats that you'd be used to preventing if you spent most of your time building software thats on an open network. They're not put in an environment that really rewards adopting new technologies or practices, the development cycle is incredibly long because of the approval processes, which means that whatever you get to market is 3-5 years old at best, and they're constrained by hardware limitations (for cost, battery life, and form factor) as well. For many reasons, and a lot of them very good (people's lives depend on this stuff, after all), you will always be working with hardware and software tooling at least 5-10 years old. A lot of their products were just iterations off a previous generation for better battery life, smaller form factor, etc. and most of the codebase was from when I was in elementary school.

I worked with a lot of incredibly smart people that on their worst day could do things with hardware that I'll never be able to do, but at the same time they couldn't implement a secure communication protocol if it meant THEIR life depended on it. Someone like myself that comes in bright eyed and full of wonder is either going to lose their light or move on because there's just no way to do anything truly novel in that space if you're working for one of the well established companies. Don't get me wrong, when it comes to medical devices, chasing new and shiny is no way to go. But a lack of version control, a horrible QA test rig/system, and basically no diligence around a repeatable process are not chasing new and shiny.

</comment></comment><comment><USER4> This is truly scathing. News article about the short: [https://www.bloomberg.com/news/articles/2016-08-25/carson- bl...](https://www.bloomberg.com/news/articles/2016-08-25/carson-block-takes- on-st-jude-medical-with-claim-of-hack-risk)

</comment><comment><USER5> My company (W17 hopeful) is working to help med device vendors ensure basic crypto and security practices. I agree with @teuobk below; these problems are not unique to St. Jude.

BTW we're hiring. If you're reading this comment thread, you're probably a great potential team member. Email in profile.

<comment><USER6> I'm only half joking, but can I join to convince the med device vendors who you're helping to make implantable devices that have so little connectivity to not need any crypto?

<comment><USER3> There are some very valid reasons for basic communications. For example, a doctor can wave a wand over the device and get telemetry info, which is necessary in order to get it tuned to each individual, which takes time and a number of visits. If you have a remote monitor (basically a high powered wand that lives in your house) the doctor can get alerted if you go into defib or have some other episode, or gather that info over time to make better adjustments and decrease the frequency of visits. Changing settings on the device generally needs to be done 'remotely' as well, as you don't likely want a micro USB port in your armpit (or maybe you do).

The problem with most of these devices is that if you can get them to ACK, you can pretty much get them to do whatever you want and the instruction set isn't all that complicated once you've grabbed some data streaming through the air for a little bit.

</comment></comment></comment><comment><USER7> This reads more like a poorly researched rant than a proper in-depth analysis of the security.

</comment><comment><USER8> The URL should have 'www' in it, as follows: [http://www.muddywatersresearch.com/wp- content/uploads/2016/0...](http://www.muddywatersresearch.com/wp- content/uploads/2016/08/MW_STJ_08252016_2.pdf)

</comment><comment><USER9> Looks like the paper was removed. Can anyone confirm?

</comment><comment><USER10> None of this is new, and yet as far as anyone knows no one has ever yet met at the intersection of hacking and murder.

<comment><USER11> And why do you think we'd know?

<comment><USER10> For the same reason that we end up hearing about virtually everything, eventually; people really stink at keeping secrets.

<comment><USER11> This is the ultimate sample bias. Organizations are perfectly capable of keeping secrets, even if they are composed of individuals evolved to communicate the truth. We don't know how much we'll never know.

If we find out about clandestine activities (by governments or by private citizens), it is often decades later. Given that the capabilities have existed and been widely discussed for some time, it doesn't seem any more speculative to assert that there have probably been assassinations as that there haven't been. Radio connections don't leave behind much evidence.

<comment><USER10> What the radio connection does to the pacemaker probably does.</comment></comment></comment></comment></comment>


What Exalts Stradivarius? Not Varnish, Study Says  - <AUTHOR> http://www.nytimes.com/2009/12/04/science/04strad.html?hpw

<comment><USER2> In what ways does a Stradivarius sound different from a normal violin? I'm curious because according to Wikipedia, "In a particularly famous test on a BBC Radio 3 program in 1977, the great violinists Isaac Stern and Pinchas Zukerman and the violin expert and dealer Charles Beare tried to distinguish among the 'Chaconne' Stradivarius, a 1739 Guarneri del Gesú, an 1846 Vuillaume, and a 1976 British violin played behind a screen by a professional soloist. The two violinists were allowed to play all the instruments first. None of the listeners identified more than two of the four instruments; two of the listeners identified the 20th-century violin as the Stradivarius." This suggests that there isn't much of a difference between the instruments. Does anyone know if there has been other research into this subject?

<comment><USER3> Well, since most violins made in the last century or two have been patterned on Strads (including a rather lovely graphite fiddle with an unfortunate marketing problem), it's not entirely surprising that a well-made modern instrument might be mistaken for one. Anyone participating in such a test who can't pick the del Gesú out of the pile ought to visit an audiologist immediately. The character of the Guarneri is as different from a Strad as, say, Ethel Merman is from Maria Callas, and the Guarneri is Merman -- a lot of odd-order harmonics give it a harshness, but damn, you can hear it from a mile away. The Stradivarii are sweeter and rounder, with a much larger proportion of even-order harmonics, but with enough harmonic content to maintain that little bit of stridency that allows it to be played over top of an orchestra.

Yes, there has been a lot of research around the acoustic properties of the Cremona fiddles. A LOT. You could fill a dozen or so mid-sized container ships with zipped fiddle papers on high-capacity Micro SD cards. Not surprisingly, sounding like a Strad involves mimicking the mechanics and internal acoustics of a Strad.

A competent luthier uses dimension only as a guide to rough the shape; final shaping of the back and deck are done by ear. Tap, scrape, tap, scrape until the violin back as a percussion instrument sounds right. And that "right" sound is usually derived from a Strad or a "gold" copy of an unfinished Strad kept in the shop for exactly that purpose.

The graphite instrument, being made from a material much more consistent, controllable and predictable than natural wood, was patterned using vibrational mode analysis across the entire spectrum of the violin's range. With a stable, predictable material, tooling can reproduce the successful prototype nearly perfectly every time, and a quick trip through a sweep genny for Doppler analysis is all the QA you need. If an instrument's components react acoustically the same way a Strad's do, and those components are assembled the same way as the Strad, then the instrument should sound pretty much the same as a Strad. (The best acoustic research available concerning Stradivarii was done in the production of this graphite fiddle.)

Yes, there is a lot of voodoo mumbo-jumbo talk about the magic of the Cremona fiddles. Yes, the wood was different, the spruce being older-growth, harder and with higher mineral content on average than most of what was available elsewhere -- but there was probably more variation from slab to slab of the available spruce and maple than there would have been between the "average' log in Cremona and the "average" log in, say, Paris. Yes, the varnish was different, being part red shellac, presumably in order to give the wood a redder colour than tree resin alone would have. Both of those differences can and MUST be worked around every time the luthier puts gouge and plane to wood. What makes a Strad a Strad is its vibrational modes in minutia.

Violins produced before the Cremona variants were ukuleles in comparison. The Cremonese were rather protective of their intellectual property, and had no trouble disseminating faulty intelligence and making a big fuss about keeping things like varnish and glue recipes top secret. Misdirection is a very effective security technique. What they did differently was to try to understand how the instrument really made its music, and then to treat the acoustic (as opposed to merely structural) components as instruments in their own right. Luthiers outside of the Cremona circle were more than willing to believe that there was magic in them there beetle shells -- it's a lot easier to swallow the idea of alchemical tricksies than to accept that someone else is taking more care than you are at every step in the process.

Make a fiddle that vibrates the same way, make a fiddle back that plays the same marimba music when rapped in the same way as a Strad back, and it will sound the same as the Strad. Make a fiddle that vibrates like a del Gesú, and it won't sound much like a Strad at all -- but it will sound remarkably like a del Gesú. (Oh, and set the bridge or soundpost wrong on either and you get something that sounds like it's perhaps twenty dollars at Wall*Mart.)

<comment><USER4> Comments like these are why I like news.YC.

</comment></comment></comment><comment><USER5> Cross-reference for those interested in this sort of thing:

<http://news.ycombinator.com/item?id=955628>

Within the discussion: <http://news.ycombinator.com/item?id=955902></comment>


Smoothing Jagged Edges on an Image in GIMP - <AUTHOR> http://ficpics.com/smoothing-jagged-edges-on-an-image-in-gimp/ <comment><USER2> Always mask rather than deleting if possible!

<comment><AUTHOR> Thanks for the additional tip :)</comment></comment>


Beware of the Home DNA Kit You May Find Yourself Being Sued by a Sperm Bank - <AUTHOR> https://abovethelaw.com/2019/02/beware-of-the-home-dna-kit-you-may-find-yourself-being-sued-by-a-sperm-bank/ <comment><USER2> It seems like there was a failure on every side: The recipient messed up by trying to do something she had contractually agreed to not do (contact the donor or donor's relatives). The donor did something he shouldn't have done if he didn't want to be contacted (put himself on a DNA site with the ability of people to contact him). The sperm bank could have handled it with a little bit lighter hand by contacting the recipient once before jumping to legal threats.</comment>