AWS Lambda Is Not Ready for Prime Time - <AUTHOR> https://www.datawire.io/3-reasons-aws-lambda-not-ready-prime-time/?utm_content=buffer5d2eb&utm_medium=social&utm_source=twitter.com&utm_campaign=buffer <comment><USER2> We built Kappa[0] to handle our production Lambda deployment. It was built by the same person who wrote Boto and the AWS command line.

Here is an example[1] of a program built in Python that uses Kappa, and here is a video tutorial[2] on how I deploy that program with kappa.

Obviously I disagree with the premise. It's true that it is more difficult to use than other technologies and you'll certainly pay the pioneer tax, having to develop your own tooling, but it's ready for production traffic.

Error handling is ok, could be better (it takes a while for the cloud watch log to show up).

The real big problem is testing. It's _really_ hard to test if you have more than one function because there is no mocking framework (yet). It's fairly easy to deploy and test with a test account, but local testing still needs to be solved.

[0] [https://github.com/garnaat/kappa](https://github.com/garnaat/kappa)

[1] [https://github.com/jedberg/wordgen](https://github.com/jedberg/wordgen)

[2] [https://www.youtube.com/watch?v=JtLLkCt- lPY&feature=youtu.be](https://www.youtube.com/watch?v=JtLLkCt- lPY&feature=youtu.be)

<comment><USER3> We are finding that unit testing is pretty straightforward with Placebo [0] (also Mitch Garnaat!), for which we use a common "boto client getter" library that the unit test framework can hook into to inject Placebo.

The really hard part is integration testing. You can Chaos-Monkey your Lambda functions, but you can't Chaos-Monkey DynamoDB. We're looking at ways of building tooling to do that.

For deployment, we wanted to use Serverless, but as they started to move away from CloudFormation, that didn't work for our more enterprise needs, so we've been rolling our own, based on ideas from Kappa.

[0] [https://github.com/garnaat/placebo](https://github.com/garnaat/placebo)

<comment><USER4> > you can't Chaos-Monkey DynamoDB

I bet you could achieve this effect by either temporarily decreasing provisioned throughput, or inserting clientside middleware that occasionally refuses to do a DynamoDB op.

<comment><USER2> The middleware would be best option. Put it between your code and the calls and then have it able to throw random errors.

But it means you have to write the middleware and have it be it's own source of bugs, which is still better than nothing, but another risk.

</comment></comment></comment></comment><comment><USER5> When US east was freaking out last year, we found Lambda was unreliable. For days ahead of the outages, Lambda would take many hours to respond to S3 events.

When the events eventually came in and fired an event, the logs reflected the time, hours before, when it should have happened.

Sadly, I don't have a support contract so I couldn't get any help. The forums just assumed I was doing something wrong, until the outage which was linked to dynamo IIRC.

We moved on from lambda as well.

<comment><USER6> Was this when it was still in preview? Lambda is still pretty new having launched in November 2014. Reliability and features for Lambda are getting better though [1][2]. AWS seems pretty invested in Lambda, so I think it's just a matter of time until it feels like a 'mature' offering.

1\. [https://aws.amazon.com/blogs/aws/aws-lambda-update- productio...](https://aws.amazon.com/blogs/aws/aws-lambda-update-production- status-and-a-focus-on-mobile-apps/)

2\. [https://aws.amazon.com/blogs/aws/category/aws- lambda/](https://aws.amazon.com/blogs/aws/category/aws-lambda/)

<comment><USER5> No. This was last outage. I believe that was around September 2015.

</comment></comment></comment><comment><USER7> I think this is a bit too harsh. Sure, it has a few rough edges, and not everyone's idea of prime time is the same, but Lambda is perfectly suited for lots of use cases that do not depend on very low latency -- for example, file conversions, async tasks where users can wait a few seconds such as payment processing, automating incoming e-mail workflows etc.

We've been running APIs on it for six months with no issues, and are now in the process of moving the entire backend from heroku to Lambda. So far, no major issues.

Regarding Lambda being a building block, I actually like that. Werner Vogels points out [1] that one of the key lessons from 10 years of AWS is that the market wants primitives, and that the higher-level toolkits emerge from that. A ton of third-party helpful stuff is already out, such as apex, serverless and so on. We built a toolkit[2] that lets people use Lambda and API Gateway from JavaScript very similar to lightweight web frameworks (eg api.get('/hello', function (request) {...})

Documentation is there, just not in the most sensible places, and the whole pipeline is optimised for Java processing (eg Velocity VTL for API Gateway transformations allows people to do everything they need, as long they know the Java collections API executed below).

[1] [http://www.allthingsdistributed.com/2016/03/10-lessons- from-...](http://www.allthingsdistributed.com/2016/03/10-lessons- from-10-years-of-aws.html)

[2] [https://github.com/claudiajs/claudia/](https://github.com/claudiajs/claudia/)

<comment><USER8> The heroku-> lambda path is what I was considering - so would love to hear more about any pain points etc. _edited_ nvm read claudia.js. Reviewing that vs apex.run now. Thanks for open sourcing that deployment tool.

<comment><USER7> one potential pain point is warmup time. if your app isn't doing anything, the first request may take a few seconds. it seems that once it's running, this is quick, as the VM is reused.

another thing is that although Api GW can behave like a web server for most things, some things are more restricted than with a fully programmable server. for example, you need to declare all HTTP response codes upfront, so that the pipeline can be configured. There can be only one success code (so eg returning 204 when there is no content and 200 with content from the same endpoint isn't trivial).

the third thing, that several commenters mentioned on this page, is that if you want to use API Gateway, processing binary data requires S3 or something else for storage. We currently let people convert files by using ApiGW + Lambda to get a signed URL for S3, then post to S3, another Lambda converts it into PDF and saves back to S3, and the client polls S3 to pick up the result. It's fantastically scalable with that design, much better than posting a file to heroku and then getting a synchronous response, but it takes a bit of rearranging the code to work.

</comment></comment></comment><comment><USER9> Note that this indictment includes API Gateway. API Gateway is clunky, buggy, and underdocumented. It's useless if you're not using JSON. It doesn't implement HTTP properly (e.g., a body is returned with 30x and 204 responses). The web interface is buggy to the point of being unusable.

To top it off there's no way to report non-UI bugs unless you are paying $$$.

<comment><USER10> I think API gateway is the primary problem here. I've found writing Lambdas to be relatively fine, but turning those Lambda responses into useful HTTP responses is nothing short of a nightmare.

<comment><USER11> You are correct (Datawire.io employee here) and I work with the author of the article. Most of our shared frustration stemmed from the API gateway. Lambda as asynchronous event handlers for SQS etc are great. I used it at point to automate DNS assignment for autoscaled servers not behind an ELB.

</comment></comment></comment><comment><USER12> AWS Lambda is not ready for prime time, but not for the reason the author states.

Lambda are unpredictable which is probably its biggest downfall. You can get Super fast deployment and execution one second, the next you're getting random execution failures out of your control.

Lambda often feels like its unsupported by AWS. It took them over a year to support the latest version of node.

Java perf is terrible and support should either be dropped or fixed. Go really should be supported out of the box.

Responses from lambda are not flexible.

Deployment of lambda is frustrating, and the inability to execute a lambda from SQS is even more frustrating.

Could go on.

</comment><comment><USER13> I can empathize with the OP. Using Lambda in production still has some pretty rough edges. You basically have to use one of the deployment tools/frameworks out there[1]. There are also just certain things it won't do (someone else mentioned binary data). Learning some of the limits takes time and it is not always super clear.

But my personal experience says Lambda is ready for prime time. We use it in production. ~15 million API calls per day. Mostly user facing HTTP requests. Even with the rough edges I would prefer to use it for any new web development project. It feels like at least an order of magnitude reduction in risk/complexity of scaling and deploying code. Its not "zero" but that is huge for me and for my team. We spend more time shipping.

[1]We wrote one: [https://github.com/bustlelabs/shep](https://github.com/bustlelabs/shep) but there are plenty of others mentioned in the comments.

<comment><USER14> > ~15 million API calls per day

Isn't that horrifically expensive?

<comment><USER15> Guessing they use API gateway so that's:

$3.50(cost per million calls)*15 = $52.50

Lambda is pretty cheap.

For example a 256 memory function running for 300ms being called 15,000,000 times would cost 21.77.

All together that's $74 a day for just lambda and API gateway without any extras (cache, bandwidth pricing etc).

Maybe more expensive that raw infrastructure but it's a pretty inconsequential amount of money per day for close to no ops.

<comment><USER16> So, $2,257/mo for 15Mreq/day ≈ 174req/sec

Practically any smaller instance type (i.e. m3.medium) can handle this small of a load all by itself, without even breaking a sweat.. and instead of paying $74 per day, it would cost less than $74 _per month_.

In fact, ELB + an ASG of three t2.micro's running continuously would cost around $49 _per month_ , not per day, and possibly around the same amount of effort (or less) to create/maintain/manage.

It's somewhat apples and oranges, but there's no doubt that lambda is expensive compared to plain old EC2, and that cost disparity increases linearly with scale.

<comment><USER15> Yeah for sure, you're right in that a machine or even machines across different AZ for HA can have better economics for performance.

But you have api management to sort out and versions to solve which api gateway can do fairly easily.

API gateway is connected to Cloudfront for low latency.

You can simply add a cache for your API.

You have analytics already setup up and ready to go.

Also other things like API keys, auth and cognito integration with other integrations etc that API gateway has.

You can deploy and maintain tens of lambda functions fairly easy, to get something similar you would either have to use some container service like ECS or Kubernetes so have to figure them out compared to just deploying your code with one of the frameworks out there for lambda.

<comment><USER16> That's true, and also you can use all of those (Cloudfront, analytics, API gateway, etc) with EC2 instead if you prefer. API gateway has its own (strengths and) weaknesses compared to a probably more mature server-based API platform. (and don't forget about things like Elastic Beanstalk.)

I'm not looking to put down Lambda, although it could maybe be a bit cheaper; we use EC2/ELB/ASG extensively with Userify but we might use Lambda for eventing-based services in the future. Evaluating each on its own merits will probably give you the best picture of what's right for your project and team.

</comment></comment></comment></comment></comment></comment><comment><USER17> Amazon API Gateway supports OpenAPI ([http://swagger.io/](http://swagger.io/)) via Console and AWS-CLI.

([http://docs.aws.amazon.com/cli/latest/reference/apigateway/p...](http://docs.aws.amazon.com/cli/latest/reference/apigateway/put- rest-api.html))

This approach allows to avoid a lot of the mentioned Amazon API Gateway hassle.

RAML ([http://raml.org/](http://raml.org/)) seems to be also around the corner. ([https://github.com/awslabs/aws-apigateway- importer](https://github.com/awslabs/aws-apigateway-importer))

"API First" is in general quite promising.

</comment><comment><USER18> Lambda does have a ton of rough edges and documentation is one of them.

But we spent the better of 4 weeks figuring all of this out and automating it. Once automated it's pretty brilliant.

It's not just the automation of getting a lambda function and api gateway working together (though that's a royal pain). It's building the tools to develop and test locally (which we've also done).

The service we created to automate everything is called Joule (it's not ready for prime time but you can kick the tires here; [https://joule.run](https://joule.run) \- it supports node, python would be easy if we ever get around to it). Docs are here [https://joule.run/docs/quickstart](https://joule.run/docs/quickstart)

Anyways, the point is that it's possible and pretty amazing once you start deploying microservices using Lambda.

DDNS using Lambda and Route53 and Joule - [https://medium.com/@jmathai/create- a-serverless-dynamic-dns-...](https://medium.com/@jmathai/create-a-serverless- dynamic-dns-system-with-aws-lambda-fab5d0d02297#.n292gtfon)

Group Text Message Channel using Lambda and Twilio and Joule - [https://medium.com/@jmathai/create-a-group-text-channel- in-u...](https://medium.com/@jmathai/create-a-group-text-channel-in-under-a- minute-with-joule-using-twilio-and-aws-lambda-58a2d12450e8#.ostbr011a)

Sources on Github for the above Joules

[https://github.com/joulehq/joule-node-twilio-group- text](https://github.com/joulehq/joule-node-twilio-group-text)

[https://github.com/jmathai/joule-node-dynamic- dns](https://github.com/jmathai/joule-node-dynamic-dns)

Edit: Here's a Joule that takes an area code, looks up the city name by parsing Google search results and using that to get a creative commons photo from 500px.

[https://api.joule.run/jmathai/area- code-500px/lookup?number=...](https://api.joule.run/jmathai/area- code-500px/lookup?number=408)

Source (ugly but functional) - [https://github.com/jmathai/area- code-500px/blob/master/src/i...](https://github.com/jmathai/area- code-500px/blob/master/src/index.js)

</comment><comment><USER19> I've been building a production project fulltime with the [AWS Lambda/API gateway/S3 Website/Route 53/..] stack for about 3 months now. The idea of a holy grail type serverless application (high resiliency, high performance, low price, low complexity) was too attractive for me to ignore. Here's my two cents:

1) Documentation is bad, but not insurmountable. There's enough usage of these platforms now that you'll get pretty far searching for and adapting open source code.

2) Error handling is fine once your code is running, but getting execution there (and the response out again) can be painful.

3) Once sufficiently automated, all these woes go away.

This automation could be done with a framework, however I was skeptical of giving something like Apex[1] or serverless[2] access to my AWS account. Instead I've hand-written terraform[3] for all of my deployment. The documentation isn't great, but there are enough examples out there now to make it possible to glue something working together. I started with this project[4] and wrote a bunch of bash and terraform templates to make it extensible.

The main issues that I have run into haven't been with Lambda itself. Once your code is running, you can build appropriate error responses for all the edge cases. However the AWS API gateway seems to expect you to configure precisely what you want as an input to your lambda, and precisely how the lambda response maps to a HTTP output (the defaults are sane, but overriding isn't easy). I started with the Javascript AWS SDK on my frontend to just invoke the Lambdas directly, and have managed to ignore these problems but for my API integrations, which have ended up a bit more complex than expected.

[1] [https://github.com/apex](https://github.com/apex)

[2] [https://github.com/serverless](https://github.com/serverless)

[3] [https://terraform.io/](https://terraform.io/)

[4] [https://github.com/danilop/LambdAuth](https://github.com/danilop/LambdAuth)

</comment><comment><USER20> AWS Lambda is not good for microservice, it's more like nanoservice which is kind of anti-pattern – It is not good to draw proper context boundary to present a business model/domain.

Speaking in another way, AWS lambda is really good for coordinating/dispatching tasks based on events happened to S3, sns, dynamodb etc.

Overall, after I work with lambda for a while, I think that I am not a big fun of using AWS lambda for writing any services which hold business logics.

</comment><comment><USER21> We've used serverless framework [https://github.com/serverless/serverless](https://github.com/serverless/serverless) for automating it. Still has some kinks, but should be good to enable automating.

<comment><USER22> This framework looks great, thanks for pointing out.

I've used lambda for supporting a static website's need for storing and e-mailing forms, and collecting analytics events. It is very limited compared to what this framework provides, but I already see how helpful it could be.

</comment></comment><comment><USER23> This article really didn't resonate with me.

The first point revolves around AWS not providing tools they provide building blocks. To me this is true basically of all AWS, not just Lambda. If you come into AWS without understanding that they are building blocks meant to be used together, you will experience pain and suffering. If you want EC2 to be a virtual hosting service, for example. You are expected to use RDS if you want to store data, not put it on an EC2 instance. You are better off using their blocks together rather than trying to roll your own.

The second thing about the documentation seemed like a non-starter... I took him up on the challenge of finding out how to pass arguments to a python lambda, so I typed in "aws lambda python", which google suggested adding "example" to. The first hit showed "If you are passing in this JSON, your function will look like this".

Obviously, this guy had a hard time trying to deploy a Python lambda, and I haven't tried to do the same myself, but it felt a bit off base to me.

<comment><USER24> >If you want EC2 to be a virtual hosting service, for example. You are expected to use RDS if you want to store data, not put it on an EC2 instance.

Heaps of people run their own datastores on AWS, this doesn't feel like a great example.

<comment><USER25> The point was that it's lower friction to use the AWS services, and RDS is a great example of this - you can certainly run your own database in EC2, but if you use RDS it's far less work as many things are provided automatically or very easily. Of course, RDS doesn't suit all use cases, but that's true of many AWS services.

</comment></comment></comment><comment><USER26> For docs, here is a 350 page developer guide:

[http://docs.aws.amazon.com/lambda/latest/dg/lambda- dg.pdf](http://docs.aws.amazon.com/lambda/latest/dg/lambda-dg.pdf)

The "Programming Model (Python)" section addresses the OPs complaints about documentation.

<comment><USER26> For debugging, use the CloudWatch Logs FilterLogEvents API

[http://docs.aws.amazon.com/AmazonCloudWatchLogs/latest/APIRe...](http://docs.aws.amazon.com/AmazonCloudWatchLogs/latest/APIReference/API_FilterLogEvents.html)

It makes it trivial to tail, filter and range all the logs in a log group.

That plus some structured application logging that is lambda func, and request aware and includes backtraces and you can make sense of what's going on.

</comment></comment><comment><USER27> I commented on this blog post when it first came out. I think the only point that really holds up is the documentation complaint, which can be made about pretty much any of the fast-moving cloud platforms. AWS is certainly no worse, and in some respects much better, than most. Beyond that I guess the main thing that struck me was the complaint about the number of manual steps. Anything you do in the console on AWS takes a lot of steps. The alternative is to avoid the console, and instead use the aws cli client and write scripts to automate the process of creating and configuring the lambda function and gateway. API gateway is a bigger pain than lambda, just because of the request and response mapping that has to be set up, but thankfully it can be configured using swagger, which is perfect for a scripted deployment.

</comment><comment><USER28> Most of the issues described in the article are solved by projects like [0], [1] and [2]. [2] was particularly easy to work with (tried it with a standard installation of Django CMS and it was working very well, only in US regions) and the advantage is that you can still work locally as you would usually do, even keep a testing environment for CI on a managed server, and just replace the production server with it.

[0] [https://github.com/serverless/serverless](https://github.com/serverless/serverless)

[1] [https://github.com/Miserlou/Zappa](https://github.com/Miserlou/Zappa)

[2] [https://github.com/Miserlou/django- zappa](https://github.com/Miserlou/django-zappa)

</comment><comment><USER8> (repost from the blog comment thread. Would dig any feedback with HN readers who use lambda in production)

Here's the setup I'm hoping to leverage lambda for: light workers. I have kue.js/redis for submitting jobs to, and creating workers. My subscribed worker listeners will simple trigger lambda.invoke with json packages (no need to call or support http endpoints etc). No need for api gateway either.

I'm starting with apex.run as a deployment tool and writing/running all tests locally. I assumed local testing is doable by hitting the same func exports with mocked inputs - this could be off.

See any big hurdles with that usage plan?

As an aside, I've got a backlogged task to explore serverless, and their moving away from cloudformation shouldn't be an issue (assume terraform?)

</comment><comment><USER29> Fair point in the article about SEO for technologies being an issue when trying to find help. "Lambda" has a good chance of leading to irrelevant results, even if there was a lot of experience with it documented online. It's a good reminder to try for high entropy names.

<comment><USER30> > _high entropy names_

This sounds like a useful metaphor, but I'm unable to fully comprehend it because I suck at thermodynamics and information theory. Could you please elaborate a bit and include some examples of high-entropy names?

(I'm asking because naming is hell, and I'll need to name three products very soon).

<comment><USER31> This should answer your question about entropy: [https://en.wikipedia.org/wiki/Entropy_(information_theory)](https://en.wikipedia.org/wiki/Entropy_\(information_theory\))

tl;dr If you use names that are similar to other names, you will convey less information every time you use such names. So pick a name which doesn't require additional bits to disambiguate.

Note that English conveys roughly 1 bit of information per word.

<comment><USER32> _Note that English conveys roughly 1 bit of information per word._

I think that's per character, not word.

<comment><USER33> Maybe he's using UTF-16.

</comment></comment></comment></comment></comment><comment><USER34> Don't want to hijack the thread (sorry) but I've been working for the last 10 months in a tool which might be of the interest of people reading this article.

This tool will be opensource in the following weeks, but at the moment is in closed beta. I'm looking for people interested in giving it a look. If you are interested, drop me an email to me[at]jorgebastida.com and I'll invite you to the repo.

tl;dr version: Dead simple Lambda+Kinesis+Dynamodb+S3+CloudWatch+Apigateway over Cloudformation with support for Python, Javascript, Java, Go etc... Lot's of examples including Telegram, Twilio, Slack... and quite extensive documentation (which I think is the key of adoption of a technology like this).

<comment><USER35> What does your tool do? Is it a replacement for all those AWS services you listed, or does it run on top of them?

<comment><USER34> It makes it easy to deploy Lambdas and integrate them with those services. Underneath uses CloudFormation to orchestrate it

</comment></comment></comment><comment><USER36> I've been using serverless - [https://github.com/serverless/serverless](https://github.com/serverless/serverless) which solves quite a few of these issues

</comment><comment><USER37> Has anyone used hook.io as an alternative? I have only built toy projects with it, nothing substantial, so I can't speak to important things like error handling, but so far I really like it and find it substantially easier to use than Lambda.

<comment><USER38> I used hook.io in its early days. It once lost the data in its internal data store when they were doing a database migration, rendering my hooks useless until I manually intervened. Haven't really used it much longer after that, but due to not needing it anymore.

<comment><USER39> Creator of hook.io checking in. Sorry to hear you had an issue.

We haven't had any recorded incidents of lost data. We did have an issue after a security upgrade where older accounts did need to be migrated with new access tokens. If you lost any data drop me an email and I'd be glad to find it.

The internal datastore is mostly for development purposes. We generally recommend persisting data to an external database like DynamoDB.

</comment></comment></comment><comment><USER40> (4) lock in to a closed mainframe when you can easily duplicate the same design pattern with open stuff.

<comment><USER2> You could make the same argument about your power company, but yet most people just go with the local utility and never complain about "lock in".

I wonder why that is...?

<comment><USER41> Choosing a different electricity company doesn't make you change all your plugs. Choosing a different cloud provider may require substantial rewrites.

</comment></comment></comment><comment><USER42> I've been a very happy lambda user (using Scala); serverless architecture is really nice. There are some remaining issues (e.g. cold start; although should not be an issue once you actually have decent amount of traffic); many of the issues are getting resolved rather quickly (e.g. API Gateway integration has improved dramatically). I am not aware of any alternatives that come even close to lambda especially if it needs integration with many other services.

</comment><comment><USER43> I used lambda to implement a loader from s3 to redshift. Serverless context and the ability to be triggered on event (i.e. on s3 file creation) are great but I found same problems described in the article.

I can suggest to give it a try to tj project apex.run, it saved me a lot of time. Also error and debugging are difficult but remember there is an ec2 instance at the end behind lambda. I just mocked the lambda function and debugged on a real server.

</comment><comment><USER20> One more experience I wanna share with HN fellows about Lambda Java and NodeJS: Lambda Java is slower than NodeJS either for cold start or response time in warm, however, if the NodeJS hits on rocks, then its response time becomes unacceptable with huge spikes.

Overall, Java is stable slow all the time under the same configuration, so, you might wanna to use higher config for Java to get stable and performance.

</comment><comment><USER44> It can't do binary data.

You can redirect to a file the Lambda function writes out. But that sucks.

AWS Lambda is the perfect use case for something like dynamic image sizing. Except if you use it for that you'll force all your users to do a redirect when fetching images. No easy way to clean up when you do it that way either.

<comment><USER45> > Except if you use it for that you'll force all your users to do a redirect > when fetching images.

???

I guess this depends on your setup, but I don't see why you would have to do this. Lambda takes the image in, resizes them and uploads the result to S3.

If you use predictable S3 paths, your clients can just look those up. Of course, there are things you'll need to watch out for, but no redirects needed.

<comment><USER44> Resizing on the fly. Think of an API that gets an image and desired resolution and sends it. It's a common enough use case. Compare Lambda as the entry point of this API compared to another framework.

Any other webserver is simply get image off S3->Resize it->Send raw binary data to the user (and optionally cache the resized image if you think it'll be requested in that size again).

The Lambda flow is as follows. Get image off S3->Resize it->upload to S3 and then redirect the user to that image via a cloudfront URL.

Unnecessary steps caused by the inability of Lambda get binary data out through the API Gateway. Particularly from the users point of view. You double the number of requests they have to make to fetch images.

<comment><USER45> Oh. Yeah, that's not a good use case for lambda. Resizing images, sure, but not handling requests like that

Lambda is great for running code in response to events (like SNS messages or S3 file uploads), but I really don't think it should be used for something like handling web requests. Just because you _can_ do something with a million steps and configuring 50 AWS services together, doesn't mean you _should_.

<comment><USER46> Except that on S3 upload there will be only three attempts to execute Lambda, and then it will give up. I can easily imagine a simple outage that will lead to three errors in a row, and the S3 files goes unaccounted.

You're far better of sending out an SNS or an SQS triggered by an S3 object creation event.

</comment></comment></comment></comment></comment><comment><USER47> > "Lambda is not well documented"

AWS in general is not well documented. Well-written drivel mostly.

My guess is that there's little to no feedback between documentation writers & developers actually trying to use that documentation to achieve real outcomes. Same could be said about many of the AWS UIs.

</comment><comment><USER48> I was planning on porting some short-lived but computationally intensive jobs to AWS Lambda. These run once per day so cost isn't an issue at all. The whole plan fell apart when I found that Lambda doesn't support more than 2 concurrent threads[0].

Is there _any_ service out there that does this? Basically I'm willing to pay $1 to rent a c4.4xlarge instance for just 1 minute. Keep in that the _hourly_ rate of c4.4xlarge is only $0.621 on US East, so I'm willing to pay a huge premium here.

[0] [http://stackoverflow.com/questions/34135359/whats-the- maximu...](http://stackoverflow.com/questions/34135359/whats-the-maximum- number-of-virtual-processor-cores-available-in-aws-lambda)

<comment><USER26> Herokus performance dynos might fit the bill. They are really fast to spin up.

Joyent's Triton is pretty interesting for running one off docker containers though last time I tried it took a variable number of seconds to start one.

<comment><USER48> Yep, this looks like exactly what I need. Thanks!

</comment></comment></comment><comment><USER49> Whether you agree if AWS Lambda is ready or not , AWS Lambda is an great new way for executing traditional server side code. I used to have several Linodes running java jms clients listening on a message queue. Balancing the number of client vms and message load was a pain.Now I am transitioning my jms clients to AWS Lambda and my costs have come down considerably.

AWS Lambda is only going to get better as even Google has come up with their implementation called Google Cloud Function [https://cloud.google.com/functions/docs/](https://cloud.google.com/functions/docs/)

</comment><comment><USER50> Obviously I disagree with the premise, you can work easily with Lambda and there's a lot of debugging methods you can use specially the cloudwatch attached to the functions.

It's more than ready for prime time! It's an awesome tool.

</comment><comment><USER51> Lambda runtime also does not have the scientific python libraries installed (numpy/scipy/pandas etc...). These cannot be just pip installed because of extension modules. You need some serious hackery like this: [https://markn.ca/2015/10/python-extension-modules-in-aws- lam...](https://markn.ca/2015/10/python-extension-modules-in-aws-lambda/) to get it working. Not something I am willing to do in a production system.

<comment><USER52> I have started the lambda-packages[1] project for use with Zappa[2] and other Python on Lambda projects.

[1] [https://github.com/Miserlou/lambda- packages](https://github.com/Miserlou/lambda-packages) [2] [https://github.com/Miserlou/Zappa](https://github.com/Miserlou/Zappa)

<comment><USER53> I've done numpy, pillow and scipy from scratch. Note that numpy+scipy is too big for 50MB zip file, so I had to prune out various sub packages I didn't need in order to keep the size done.

</comment></comment></comment><comment><USER54> The major thing missing IMO is "re-run on last input [because I've fixed the bug that made it crash]".

However, I suspect they don't do that because it's build to be fast on a streamed event from another of their service, and that if you want that feature, you're supposed to implement it yourself by dumping each event to S3 or something... but it should really be there as something you can turn on.

</comment><comment><USER55> I've only used lambda with Alexa skills and the linkage is nice. We let lambda handle the static responses and delegate the dynamic responses to a variety of endpoints that provide the natural language responses. We include requests to help with delegation and keep the logic as simple as possible.

My only two complaints, python 2 and code deployment. From reading the responses it sounds like there may be options for both.

</comment><comment><USER56> This does not mirror my experience at all. I've had great success with Lambda. I am running in production with millions of requests per day and will be ramping up to millions per hour in the next week. I actually found the documentation to be very good. Early on my misunderstanding of things gave me trouble, but that was all on me.

</comment><comment><USER57> I am really surprised that 4 months old article is so heavily discussed. Lots of things changed / improved / evolved since then and I'm almost positive that the author's opinion changed / improved / evolved. Would be cool to hear @_flynn's updated view on AWS Lambda!

</comment><comment><USER58> Seems similar to the concerns that we have on AWS lambda around the difference between proof of concept and software that is fit to run at scale in production. More specifically: From a lambda function, ow do we get the metrics into our statd server and the errors into our ELK stack?

</comment><comment><USER59> I'm still very suspicious of 'serverless' architectures and people trying to hammer Lambda into fitting that ideal.

Lambda seems best suited for data processing tasks, one off 'cron' style jobs and synchronous request/response tasks that don't execute frequently

<comment><USER60> Can you elaborate on why you don't think it's well suited for more frequently accessed resources?

<comment><USER59> I guess I didn't phrase myself well, I meant for things like web services.

Data processing (i.e. pulling events from Kinesis, responding to S3 events) seems like the perfect use case for Lambda, we have thousands of Lambda invocations a minute working against that and it works fine.

</comment></comment></comment><comment><USER61> webtask is pretty neat

      https://webtask.io/

As the website says - "Run code with an HTTP call. No provisioning. No deployment."

Just run javascript at an endpoint. Done. It was built to make Auth0 run and the whole thing runs from the cli.

</comment><comment><USER62> I've been using Serverless and I'm finding the request and response mapping to be extremely tiresome. If you're used to a modern HTTP framework like Express, Lambda+Serverless ain't even close.

</comment><comment><USER63> read the title, I thought performance might be one of them. fortunately it's not. I wrote a micro service and deployed to Lambda, it seems good. the documentation is poor, but anyway we figured it out. for error handling, we didn't put a lot of effort, if there's an error, the request simply fails. since it's not a core service, the behavior is okay. btw, we're using nodejs, the developing flow is okay - with the help of serverless

</comment><comment><USER64> Look at Azure Functions as an alternative. I don't yet have hands-on experience, but I plan on doing a proof-of-concept project shortly.

</comment><comment><USER65> I'll just wait for Serverless to become stable ...

<comment><USER66> Working on it :D. Just started reimplementing a lot for Version 1. Happy to share: [https://gitter.im/serverless/serverless](https://gitter.im/serverless/serverless)

<comment><USER65> Oh, no. I appreciate the work being done and I've been watching on GitHub. Just waiting on the sidelines going, "Not yet ..." for now.</comment></comment></comment>


Ask HN: Is Coinbase bugged? - <AUTHOR> Hey guys,
I just tried to send 2x €150 on Coinbase to another Bitcoin address.
I made sure to type correctly the amounts but afterwards I realised Coinbase only sent 2 x €25,- and I had to pay each time about €10,- in fees.
Anyone had experience with this? Please be careful guys since Coinbase seems bugged today.
(I contacted their support today but still no reply so far) <comment><USER2> I think you mean "buggy". "bugged" suggests the presence of a surveillance mechanism.</comment>


Ask HN: Any good UI/UX design resources for founders? - <AUTHOR> As we're designing our UI/UX for our analytics platform, wondering if there are any good resources, articles, etc. to help guide us. <comment><USER2> [https://www.nngroup.com/articles/ux-research-cheat- sheet/](https://www.nngroup.com/articles/ux-research-cheat-sheet/)

[https://news.ycombinator.com/item?id=12711060](https://news.ycombinator.com/item?id=12711060)

</comment><comment><USER3> [https://www.youtube.com/channel/UCxqiDtkXtOCNJdckODHk9YA](https://www.youtube.com/channel/UCxqiDtkXtOCNJdckODHk9YA)

This guy tells it pretty good. there are only 8 videos though

</comment><comment><USER4> [https://refactoringui.com](https://refactoringui.com) would be one worth checking out</comment>


Simplest way to take card payments online? - <AUTHOR>

I have been working on a few projects recently which are almost ready to start taking payments, but it seems that all payment gateways require a registered business for web payments - a lot of extra hassle/money/time. Are there any services which let you take card payments online as a sole trader or similar? <comment><USER2> paysto.ru, but seems it Russia only =/</comment>


Ask HN: What do you read - the article or HN thread? - <AUTHOR>

I am usually more inclined to thoughts shared here in HN than in the article under discussion. Sometimes, i completely ignore articles and satisfy myself with HN discussion on that topic. How do you do it ? <comment><USER2> I check the source of the article. I'm almost always interested in reading the article if it's from a professionally edited news media website. I'm often much less interested in reading the article if it's from some random blogger, especially a blogger I've never heard of before using a cheap blogging platform, or from a press release service. The best new news will be reported in multiple sources, and I prefer the most thorough and well informed sources.

</comment><comment><USER3> I almost always at least scan the article for context at least. Even when the HN thread veers, which is often.

</comment><comment><USER4> I tend to be more interested in the discussion here but frequently read at least part of the article to better follow the discussion. If I want to reply, I often feel obligated to read at least part of the article. Some of my favorite links, that I try to keep track of, appear in the body of the discussion.

FWIW: I'm a demographic outlier in quite a lot of ways. So I would tend to assume that my methodology/preferences are as well. It will be interesting to see if other remarks fit with that assumption.

</comment><comment><USER5> I read the article, roll my eyes, then read the HN discussion and roll my eyes again.</comment>


These mice went from couch potatoes to marathon runners with an exercise drug - <AUTHOR> https://www.theverge.com/2017/5/2/15518252/exercise-fitness-mice-running-health-drug <comment><USER2> Cyclers are already ahead of the curve and were caught using this substance: [https://cyclingtips.com/2013/04/the-new-epo-gw1516-aicar- and...](https://cyclingtips.com/2013/04/the-new-epo-gw1516-aicar-and-their- use-in-cycling/)

<comment><USER3> Ouch:

 _The trials delivered some success [...] but when high-doses of the drug were linked with increased rates of cancer in animals, GSK decided to scrap further development of the drug for humans._

Is there some indication of a new approach without the increased cancer risk? Not seeing it from the Verge article, though I could have missed something.</comment></comment>


Great user experience with gradual engagement sign ups - <AUTHOR> http://www.leemunroe.com/gradual-engagement/ <comment><AUTHOR> One great example I have seen are websites that prompt you to sign up only after you have already engaged with the site e.g. on some sites, you can initiate an action but to complete it, you need to create an account. This has the double benefit of enabling users to try out the functionality of the site without the commitment of signing up and also harnesses the momentum of the users engagement to get them over the hump of completing the sign up process.</comment>


Show HN: I released a witty narrative driven puzzle game Hello Human - <AUTHOR> https://apps.apple.com/us/app/hello-human/id1501313357?ls=1 <comment><AUTHOR> Not sure? Try the free demo: [https://kinorogames.itch.io/hello- human](https://kinorogames.itch.io/hello-human)

Or watch the trailer: [https://youtu.be/Vd79K8o095g](https://youtu.be/Vd79K8o095g)

On android? [https://play.google.com/store/apps/details?id=com.kinorogame...](https://play.google.com/store/apps/details?id=com.kinorogames.hellohuman)

Thanks for your support! \- Russ</comment>


Landing.ai announces tool to monitor social distancing via CCTV - <AUTHOR> https://landing.ai/landing-ai-creates-an-ai-tool-to-help-customers-monitor-social-distancing-in-the-workplace/ <comment><AUTHOR> I was working on a tool to do this via open CCTV feeds from Shodan to help the respective govt. deal with physical distancing.

But, the problem of detecting distance between two bounding boxes not in same plane without depth was a hard problem[1]; Landing.AI has solved this by using top-down view from homography.

Bit unfortunate that this has not been made open-source. If anyone has open- source alternative to solve the distance problem, kindly mention it in the needgap[1].

[1][https://needgap.com/problems/111-detecting-distance- between-...](https://needgap.com/problems/111-detecting-distance-between-two- bounding-boxes-artificialintelligence-socialdistancing)</comment>


Show HN: Predicting duration and complexity: Apache Projects use-case - <AUTHOR> http://devduckydemo.com <comment><AUTHOR> Hi HN! :) I developed this cool tool that can get insights about an issue for a software task such as its complexity level and estimated duration. To showcase the ability, I am giving everyone the ability to test it with Apache Projects. So if you got a feature/bug you wanted to work on at one of Apache's projects, you can enter its info at the website and get its complexity and estimated duration. you can also just test it with an already existing issue. waiting to hear your feedback and results!</comment>


Twitter-Based Hedge Fund Claiming 87.6% Accuracy Set To Launch - <AUTHOR> http://www.finalternatives.com/node/15021 <comment><USER2> It's funny I was just pondering this one the other day. Twitter would be a smaller and well organized (relatively) data set, given the brevity of it's messages. Look for symbols, parse for a set of negative or positive markers in the remaining text. Add weight based on those markers and you could have a fairly accurate prediction engine. You could also track users over time, and their positive and negative indicators gauge for accuracy and add weights based on their record of picks. It would be a fairly simple system to write.</comment>


Why Is High School Four Years? - <AUTHOR> https://www.insidehighered.com/blogs/confessions-community-college-dean/why-high-school-four-years <comment><USER2> It's not. It's six years. (Years seven to twelve. After that comes University.)</comment>


Why We Keep Playing the Lottery - <AUTHOR> http://nautil.us/issue/17/big-bangs/why-we-keep-playing-the-lottery-2 <comment><USER2> I'm finding this a depressing read.

Hooray, we're figuring out all of the tricks to push people into "thinking myopically" and buying what we want them to buy.

Here are the triggers; here's how people make mistakes in buying decisions, and how to exploit that. Here's how to frame your sell (Get them to focus on loss! Remind them of their poverty!), here's how to get them to buy more tickets instead of just one.

Lottery tickets aren't too bad; they're harmless for most people buying them, there's a fun little kick of "what if...?", but (as the article points out) as revenue for the state, they are a regressive tax; poor people pay a much larger percentage of their income into lottery schemes than people who are better off, and of course some of them pay enough to really harm themselves, going for the "Hail Mary" solution to their money woes but just bleeding themselves slowly instead.

Winning isn't actually a positive result, either -- the article _doesn 't_ get into stats on attempted suicide, etc. for lottery winners, but they're not good.

Is there anyone out there using this kind of research to actually help people? Or to let people who're just playing a fun game, play it; but still protect the people who are grabbing at a false life preserver?

<comment><USER3> I wonder if the government could use some of the same marketing for income taxes to feel like they are fun and interesting rather than being such a negative experience. Something like 100 people each year never have to pay taxes again.

<comment><USER4> Has been tried in somewhat different context:

[http://www.kornferryinstitute.com/briefings- magazine/summer-...](http://www.kornferryinstitute.com/briefings- magazine/summer-2013/gamification-everything)

"Swedish National Society for Road Safety created a "speed camera lottery" in Stockholm. At select traffic spots, drivers would see a digital display of their speed, as measured by radar, and a camera would snap a picture of their license plate. If they were over the speed limit, they got a ticket in the mail. However, drivers who were at or under the limit were automatically entered into a lottery to win money at the end of each month. The amount of money depended on the speeders – their fines went into the prize fund. The results were impressive. Over three days (24,857 cars photographed), the average car's drive-by speed went down from 32 kilometers an hour to 25 – a 22 percent reduction."

</comment></comment></comment><comment><USER5> This is the article's key insight:

 _"It's not an investment. It's entertainment. For a very small amount of money you might change your life. For $2 you can spend the day dreaming about what you would do with half a billion dollars—half a billion dollars!"_

You're not making a bet with negative expected value, you're purchasing an entertaining daydream to help you through your miserable day.

<comment><USER6> Why pay for it though? I can daydream that a billionaire will randomly decide to give me half his fortune, for free!

<comment><USER5> Because although you _can_ , you _won 't_ \- probably because there's not 'news' every week about a billionaire randomly giving a person half his fortune. The lottery win happens to _somebody_ , while the billionaire scenario doesn't.

If someone established a reality TV version of something like The Millionaire [[http://en.wikipedia.org/wiki/The_Millionaire_(TV_series)](http://en.wikipedia.org/wiki/The_Millionaire_\(TV_series\))] then I bet people _would_ start having that sort of daydream. Perhaps such a show would even lead to a decline in lottery ticket purchases, since the get- rich daydream would be available from another source.

<comment><USER7> I think an important piece missing is the active vs passive decision making. When you purchase a ticket your are actively triggering the thought process.

In your scenario there would be a passive trigger that would dull the entertainment affect.

I wouldn't discount the little piece of paper with numbers on it.

</comment></comment></comment></comment><comment><USER8> When someone tells me they play the lottery for entertainment, I lose a serious amount of respect for them. There's being irrational, and then there's _understanding exactly how your irrationality is being exploited_ and just going along with it!

The negative expected value in dollars is enough by itself, but the "how happy will I be?" calculations are even more depressingly bad. The utility of money is usually measured on a log scale, because your first thousand dollars does a _lot_ more for your happiness than your first ten thousand. By that measure going from ten thousand dollars in the bank to ten million wouldn't make you a thousand times happier, it would make you twice as happy. At least until you get used to it (see: Hedonic treadmill [1]). There's a surprising number of bankruptcies caused by lottery winniners, too [1]. Also the whole stressed friendship thing.

So... yeah, playing the lottery gets you negative respect from me and I think that's justified.

1: [http://en.wikipedia.org/wiki/Hedonic_treadmill](http://en.wikipedia.org/wiki/Hedonic_treadmill) 2: [http://papers.ssrn.com/sol3/papers.cfm?abstract_id=1324845##](http://papers.ssrn.com/sol3/papers.cfm?abstract_id=1324845##)

<comment><USER9> When someone gets entertainment value from playing the lottery, is it really about the chance of winning multiplied by the amount of happiness the money would bring? Or does it have more to do with the excitement that comes with each drawing? (Similar to how I can enjoy watching a football season even if my team doesn't win the Super Bowl.)

I think it's more likely the latter, though I don't personally see the entertainment value of playing the lottery. I wouldn't lose respect for someone for having a hobby I don't share or understand, though.

</comment></comment><comment><USER10> I don't play for expected value, I play for variance.

And I'm tired of people telling me that it's irrational to play the lottery, it isn't.

<comment><USER11> Putting down money and expecting to get less money back _is_ irrational, unless you're rationally pursuing some higher goal (in the case of lotteries' education funds, more efficiently obtained by writing checks to the appropriate agencies as donations.)

Of course, there are worse things in life than being irrational, and a variety of human beings' irrational instincts form incredibly useful heuristics for long-term value maximization (on both individual and societal levels) which might otherwise be difficult to attain, given the limitations of the rational brain: love, patriotism, et cetera.

It sounds like the unpredictability of the results is something you value, perhaps because it's exciting. That's a pretty irrational thing to value, but not intrinsically harmful in small doses; people put down money for plenty of ridiculous forms of entertainment.

But you could own up to it. :b

<comment><USER12> I play sparingly and it's irrational if you expect to win more than you spend on the tickets.

It's not irrational if you're playing for fun.

The $10 that I spent on PowerBall tickets provided me with much more enjoyment than the $10 that I spent to see The Blair Witch Project.

<comment><USER13> Irrationality by definition is a big part of fun by the way.

It can be irrational if you're playing for fun!

I think there's some kind of a mistaken association between irrationality and "goodness" \- like anything irrational is not good. That is what you are trying to argue against!

<comment><USER12> I think that you're misunderstanding the motives of some players.

I fully concede that some people play because they think they're going to win. They had a dream or some charlatan has convinced them that this is their lucky day to play. That kind of thinking is not rational.

People like me, exchange money for entertainment. It's no different than paying to see a movie or to listen to a streaming music service.

It's entertainment, not investment and it's not irrational.

</comment></comment></comment></comment></comment><comment><USER14> Most of this makes sense, but I have a problem with the often-repeated assertion that humans can't handle large numbers. We might not have an intuitive sense of astronomical odds, but that's why we developed mathematics. We have the ability to compensate for our lack of numeracy by thinking through problems with structured languages. We can do much stranger things than calculate whether we should play the lottery. With math, we can calculate what it would be like to navigate in four-dimensional space.

When I hear that people act irrationally when it comes to probability, I feel like it should be replaced with the assertion that people tend to act irrationally when they have not been trained to think methodically in a particular situation or because of circumstances rely on primitive approximations. The first assertion sounds like an immutable property of human nature, when it is more of a cultural and educational issue.

<comment><USER15> > The first assertion sounds like an immutable property of human nature

If you are not reading a formal thesis, you should not interpret statements formally. Doing so will only lead to a lifetime of frustration. The author probably agrees with you. The vast majority of the audience probably understands that the author is simply being brief and does not have the "audience attention span" budget to more formally describe the assertion that you take issue with.

My interpretation of the author's intent with the statement "humans can't handle large numbers" is "Large numbers of humans have been presented with large numbers of problems involving large numbers. In practice, the vast majority of them fail. Thus, humanity at large does not handle large numbers well." I.e. "humans" refers to the current mass of humanity, not the theoretical possibilities of an individual.

<comment><USER14> You might be right, but I have seen this trend before without mention that people tend to handle these things badly because of the environments they live in. Most people seem to have pretty poor training when it comes to probability, but the reason for this is presented as an evolutionary trait. I'm sure evolution plays a part, but I think it's mostly in terms of initial, untrained states. When people talk about how people do things because they evolved to do them that way, it sounds like something insurmountable. Humans have been bad at probability for hundreds of thousands of years, so of course they are now. But people are constantly the victim of marketers trying to confuse them with numbers. The lottery is just one of many ways this happens. It's no wonder that people are bad with numbers when there's so much obvious manipulation to try to get people to make irrational purchases. This isn't avoided by the article, but I feel like any mention of a trait people have inherited by evolution needs to be accompanied by an analysis of just how immutable it is. For example, desire for sex or food are pretty difficult to train out of, though not impossible. Poor aptitude with probability is pretty easily remedied. The fact is, not many organizations are motivated to fix it, and lots are more than willing to exploit it.

</comment></comment></comment><comment><USER16> "It's a game where reason and logic are rendered obsolete, and hope and dreams are on sale."

For a second there I thought the article was about one of the below:

\- Starbucks

\- BMW

\- A diamond ring

\- iPhone

</comment><comment><USER17> I like lotteries that are basically just fundraisers. At least I know most of my money goes to a cause that I support.

<comment><USER11> Most lottery games these days are state-owned lotteries, fundraisers for the government which also spend a lot of money on their own logistics and advertising.

</comment></comment><comment><USER18> Most lotteries are not 1 in 175 million.. using the hardest-to-win lottery skews this article a bit..

I don't really understand the point of this article. Is he trying to expose the "morons" who play the lottery for being just that? Maybe the $2 or so bucks means nothing to people playing. Maybe the excitement of the lead-up to the drawing and the checking of the numbers is more fun than $2 in my pocket. You can barely even buy a soda with $2 now.

If those jackpots swell over $200M, betting $1 to win against 1:175M odds is a good bet. If I could bet $1 to win $15 and I had a 1 in 10 chance of winning, I'd do it every time.

In the end, the lottery funds go towards the city/state, and usually education. It's a fun form of charity.

</comment><comment><USER19> > To get your chance of winning down to a coin toss [...] You will have to > plunk down your $2 at least 86 million times.

What am I missing here? $2x86 million gives me a 50% chance of getting $590 million? 172 < 295!

<comment><USER20> You're not missing anything. It is technically possible to design and build a business focused solely on buying lottery tickets for profit (i.e.: buy enough to ensure good enough odds to win) But there are a number of risks. The list below isn't exhaustive:

      * sharing the winning number with someone else
      * do you buy every single ticket or enough to "virtually guarantee" a win? (and the fewer tickets you buy, the more risky it becomes)
      * the logistics of purchasing that many tickets

I have even read stories of people trying this before - but haven't been able to find the link. The story I remember best is one man hiring a bunch of people to buy lottery tickets on his behalf.

Anyway. I'd love to see someone make a go of doing this "professionally", but when you have 172 million or more, the incentive isn't really there anymore.

<comment><USER21> You also have to pay tax on your winning.

<comment><USER22> If you bought tickets systematically with a reasonable expectation of making a profit, then the tickets should be tax-deductible as an expense.

Normally lottery tickets aren't tax deductible because of the 'reasonable expectation' test.

<comment><USER4> But this assumes consistent buying in the past, while the original poster's statement assumed one-time buying binge once the jackpot hits the level to make it worthwhile.

</comment></comment></comment></comment></comment><comment><USER23> Why we keep paying for insurance, when the expected value is negative ? To reduce the variance of the money we lose.

With lottery is the same, I pay to increase the variance of the money we win.

<comment><USER24> However, with many forms of insurance the expected value is very nearly 1. Term life, for example, pays out 90%+ of premiums as death benefits. You are unlikely to get any of that money, as most policies do not pay out; but the low probability of a payout multiplied by a comparably high death benefit results in E(X) not to far from 1.

Another reason we keep paying for insurance even with bad expected values (e.g., title insurance) is because we have no choice about the matter. If I want a mortgage, I need title insurance, even though only a small fraction of the premiums are actually paid out as claims.

</comment></comment><comment><USER25> This was/is key to why I play: "For many poor people, he adds, there is "no scenario they can come up with in which they are suddenly going to get very rich." To them, the lottery may be a low probability event—but so is getting a job that pays six figures."

Even in the case of you making six figures a year, 100,000 dollars, a $2 million dollar win is still 20 years of your life earnings all at once.

</comment><comment><USER26> Of cause people don't react to the statistics that proclaim that they won't win, because someone won the last time.

It doesn't matter that the chances are 1 to 175 million, because someone did win, that's all that counts. The only guaranteed result is not to play, that will ensure that you do not win 100% of the time.

<comment><USER27> _The only guaranteed result is not to play, that will ensure that you do not win 100% of the time._

Not quite true; every time you don't play you win $1. If you don't play often enough, that can really add up.

<comment><USER28> Given that every week you put that $1 aside.

</comment></comment></comment><comment><USER29> Best definition I've heard on the lottery and I wish it came from me.

"The lottery is a tax on the innumerate"

</comment><comment><USER30> I enjoy playing Virginia's New Year's Millionaire Raffle lottery which sells a finite number of tickets. They cost a decent amount (I think $20) but it brings me excitement on the day they release the numbers.

</comment><comment><USER24> The "postcode" lottery is interesting. I'm glad that it doesn't exist in the US, because I expect it would get even more people who can't actually afford it to play.

</comment><comment><USER31> Being professionally involved in somewhat similar industry, this is definitely one of best articles I've read about lottery. Well done!

<comment><USER32> The stock market?

</comment></comment><comment><USER33> Anyway it's cheaper than bootstrapping a startup and has similar odds to succeed.

// pessimistic mode off

</comment><comment><USER34> Its nothing more than state sanctified crack cocaine. Yeah, somebody is going to win eventually. Just not you.

<comment><USER35> That's not a good metaphor. If I buy crack I can get high right now, guaranteed. It's a much wiser purchase.

<comment><USER36> Selling crack to pay for schools; our next great social program.</comment></comment></comment>


U.S. spy agencies mounted 231 offensive cyber-operations in 2011, documents show - <AUTHOR> http://articles.washingtonpost.com/2013-08-30/world/41620705_1_computer-worm-former-u-s-officials-obama-administration

<comment><USER2> These sort of attacks need _much_ more public scrutiny. The US government is performing covert attacks in the US public's name, and potentially start international conflicts, like they did with Iran decades ago because of the coup. At the very least the public needs to know about them. But US is increasingly using CIA and NSA more to attack other nations, so the public is not even aware of it.</comment>


Tech Firms and Lobbyists: Now Intertwined, but Not Eager to Reveal It - <AUTHOR> http://www.nytimes.com/2014/09/25/upshot/tech-firms-and-lobbyists-now-intertwined-but-not-eager-to-reveal-it.html

<comment><USER2> Very excited to see how the tech world will shape government policy/infrastructure now that they have the cash to change things.</comment>


The Nakamoto Signature - <AUTHOR> http://financialcryptography.com/mt/archives/001572.html

<comment><USER2> There is no "Nakamoto Signature" entry on Wikipedia yet. Perhaps one with a tractable explanation would help get it going as a readily recognizable stand alone notion.

</comment><comment><USER3> > When a new form of cryptography turns up and it lacks an easy name, it's > very often called after its inventor. Famous companions to this tradition > include RSA for Rivest, Shamir, Adleman; Schnorr for the name of the > signature that Bitcoin wants to move to. Rijndael is our most popular secret > key algorithm, from the inventors names, although you might know it these > days as AES. In the old days of blinded formulas to do untraceable cash, the > frontrunners were signatures named after Chaum, Brands and Wagner.

Ok but those are all real people who anyone can look up and go talk to about their invention. "Satoshi Nakamoto" is almost certainly an alias, and maybe even an alias for a group of people.

<comment><USER2> > "Satoshi Nakamoto" is almost certainly an alias, and maybe even an alias for > a group of people.

Which would make it all the more appropriate.</comment></comment>


Code Splitting for Fast Javascript Application Startup - <AUTHOR> http://perspectives.mvdirona.com/2009/09/13/CodeSplittingForFastJavascriptApplicationStartup.aspx

<comment><USER2> The upcoming GWT 2.0 supports code splitting (including resources splitting)

<comment><USER3> True, although GWT uses manual splitting, Doloto is profile-driven automatic splitting.

Of course, arguments can be had over which is better, but this certainly appears to be a neat and quick solution to a common problem.</comment></comment>


K-12 student database jazzes tech startups, spooks parents - <AUTHOR> http://www.reuters.com/article/2013/03/03/us-education-database-idUSBRE92204W20130303

<comment><USER2> The positives for having a standardized, compatible, usable national data bank are amazing...but the negatives for giving such unprecedented access to privatized ventures scares the hell out of me and seals the deal on deciding to send my children to private schools when it's time.

</comment><comment><AUTHOR> To me, this is creepy beyond belief.

"OMG This is SOOOO cool" should not be allowed to trump privacy interests.</comment>


Engines of our Ingenuity - <AUTHOR> http://www.uh.edu/engines/

<comment><USER2> Love these radio segments. I listen all the time on Houston's NPR station

Mod, please change the link to [http://uh.edu/engines/](http://uh.edu/engines/). HTTPS does not work for that page

</comment><comment><USER3> I love these too. I did a small but not horrible project a while back with permission from Dr. Lienhard.

[http://geekwagon.net/projects/eistreamer/](http://geekwagon.net/projects/eistreamer/)

</comment><comment><USER4> This broadcast was an essential part of my daily life when I lived in Houston. It's one of the most inspiring productions UH does

</comment><comment><USER5> ingenuity 404</comment>


A/B Testing Service Leanplum Raises $4.8M Series A Round - <AUTHOR> http://techcrunch.com/2014/07/28/ab-testing-service-leanplum-raises-4-8m-series-a-round-adds-marketing-automation-tools/

<comment><USER2> Woot!</comment>


Google's smart city dream is turning into a privacy nightmare - <AUTHOR> https://www.engadget.com/2018/10/26/sidewalk-labs-ann-cavoukian-smart-city/ <comment><USER2> The conflict of interest is pretty obvious when you think about it. Google is in the business of getting as much data as it can on people so it can show them "relevant" ads. Would you trust organizing the elections and counting the ballots to the majority party? Would you ask the oil industry to organize climate change research? Would you trust big tobacco's studies that cigarettes are healthy? Of course we do these things to some extent already, and we can see how skewed the results are because these parties aren't neutral when it comes to these issues. So yeah, trusting google related companies with any kind of privacy concerns can't lead to anything good (for the rest of us, not for Google of course)</comment>


1993 AT&T Vision of the future video nails it - <AUTHOR> https://www.youtube.com/watch?time_continue=19&v=fq7FgV8iAe8 <comment><USER2> I remember seeing a _demo_ of video conferencing over fiber optic lines back in '89</comment>


Apple's Biggest Design Crime - <AUTHOR> http://www.fastcodesign.com/3034796/why-apples-biggest-design-crime-is-the-ios-keyboard?utm_source=facebook <comment><USER2> In the short time that I used iOS devices, I was amazed at how absolutely asinine it was that they could design a keyboard which didn't show the capitalization state of the keys. Here we are 8 years on, and they still haven't fixed it. It is such a minor thing to fix, and yet such a major faux- pas.

<comment><USER3> It is too obvious to have been overlooked (Windows Phone for example has this from very early). Could it be to do with that somebody has it patented and Apple doesn't want to license that? Quite often these kind of simple ideas are not implemented due to IP issues.</comment></comment>


Ask HN: putting single quote character in an HN comment. How? - <AUTHOR>

Certain wikipedia links and such contain apostrophes, and I can't seem to figure out how to make HN not erase them and make the link invalid. <comment><USER2> Like this? <http://en.wikipedia.org/wiki/Baumol%27s_cost_disease>

</comment><comment><AUTHOR> Example: [http://en.wikipedia.org/wiki/Baumol(apostrophe_should_go_her...](http://en.wikipedia.org/wiki/Baumol\(apostrophe_should_go_here\)s_cost_disease)</comment>


Music boss: we were wrong to go to war with consumers - <AUTHOR> http://www.pcpro.co.uk/macuser/news/138990/music-boss-we-were-wrong-to-go-to-war-with-consumers.html

<comment><USER2> Wow. This is practically the first intelligent thing I have ever heard from anyone in the record business.

This guy is smart enough to realize how much power well-designed software gives Apple. I wonder if he has realized yet that, even though they now know where the road is, the music industry won't be able to follow Apple down it. They're not the right kind of people. They're dealmakers, not hackers.

<comment><AUTHOR> Bronfman's not smart. It took him 8 years to figure out what he just said. Arduous 8 years filled of declining profits and pissed off customers. He destroyed the industry by always pushing the same crap. He's one of the people that Benjamin Franklin talked about when he said: "The definition of insanity is doing the same thing over and over and expecting different results."

<http://www.slate.com/id/1862/>

Finally, when the industry is close to being destroyed and all of his ships have sunk, does he wake up. Too little, too late.

</comment></comment><comment><USER3> That bit about "inadvertently" going to war really sticks in my craw.

These are the same people who decided to _sue_ their own customers. How inadvertent is a lawsuit?</comment>


Rape victim jailed to ensure she'd testify against her attacker - <AUTHOR> http://www.slate.com/articles/news_and_politics/crime/2016/07/a_texas_prosecutor_jailed_a_rape_victim_to_ensure_her_testimony_against.html <comment><USER2> This is WRONG. Morally wrong.

<comment><USER3> Is it? Aren't all measures necessary to stop the "1 in 5" epidemic?

<comment><USER4> Even without knowing what your '"1 in 5" epidemic' means, the answer is clearly no.

Some methods are not effective.

Some methods may be effective for the short-term goal of putting a given serial rapist in jail, but end up making it less likely to find others who will testify for other cases, so end up with fewer convictions, or more likely for the defendant to accuse the witness of lying in order to avoid additional harsh treatment.

Some methods are simply immoral and/or illegal: it is abhorrent to rape or threaten to rape a woman in order to get her to testify about a rape case.

This account appears to combine aspects of the last two.</comment></comment></comment>


WBox - HTTP testing tool - <AUTHOR> http://hping.org/wbox <comment><AUTHOR> I wrote it in the free time of the last few days, still a bit primitive but I'll try to improve it, please feel free to post feature requests (and bug reports as the only beta tester for now was valgrind ( <http://valgrind.org/> )</comment>


The Realtime Engine - <AUTHOR> http://www.devthought.com/2012/07/07/the-realtime-engine/

<comment><USER2> Nice that they're going to write the connection part properly. I had to switch from socket.io to sockjs a long time ago because socket.io was just too flaky. The code was pretty ad-hoc with its state (mishmash of .reconnecting, .reconnected, .disconnected, etc. predicates), and clients would randomly get stuck in in-between states if they were on 3G etc.

<comment><USER3> I had the same experience. socket.io was too flaky. Also I didn't need Flash support etc. In the end when I started to fix socket.io code to suit my needs and to handle the weird errors, I simply hacked together something in Go that pulls messages from Redis and writes them to Websocket or as HTTP GET response. It has only Websocket and HTTP POST/GET support but who cares. The simpler the code for handling these things, the better. Maybe socket.io got too complicated or something.

In my experience, Websocket is not something to depend on. But it's really nice to have and should be used as an upgrade if available.

</comment></comment><comment><USER4> Wise decision to extract out browsers and environmental dependencies into Engine.IO. Apart from decoupling concerns, both these libraries become simpler and can attract more contributors with relevant experience. Socket.IO can now focus on important features like JSON encoding / decoding, custom events, automatic reconnection with exponential backoff and multiplexing etc. It would have been nice to show some before and after code examples and stats on performance under websockets, long polling etc. scenarios.</comment>


Free MyOperator virtual number for startups - <AUTHOR> https://myoperator.co/startup-program <comment><USER2> Using their services for 2 months now for free. support is very helpful and product very easy.

<comment><AUTHOR> Great!</comment></comment>


On the philosophy behind Android - <AUTHOR> http://blog.morrildl.net/2008/08/while-back-one-of-my-colleagues-charles.html <comment><USER2> 'Neither approach is inherently "better", and when it comes down to the daily business of writing code and building UIs, the experience probably isn't that different. But in terms of the big picture, that is the satisfying meaty answer that I've been looking for.'

Hmmm, I suspect that one of these two approaches _is_ inherently better than the other - though I don't know which one is which, just that they won't be equal. We'll just have to wait and see what the market decides.

</comment><comment><USER3> The article also seems to ignore the looming issue that phone companies will still be able to completely lock down phones with Android, so end users may not see any of the benefits of that framework at all. What good is an "open" framework/platform if you're not allowed to access it?

</comment><comment><USER4> very useful article!</comment>


Libswarm – Docker Orchestration Announced by Solomon Hykes - <AUTHOR> http://www.activestate.com/blog/2014/06/libswarm-docker-orchestration-announced

<comment><AUTHOR> Git repo is now public [https://github.com/docker/libswarm](https://github.com/docker/libswarm)</comment>


The Bus Pirate universal serial interface - <AUTHOR> http://code.google.com/p/the-bus-pirate/

<comment><USER2> Get this, plus their Electronic Brick starter kit, and you have some great tools to hack hardware.

</comment><comment><USER3> Group pre-order for the hardware though, 8-9 weeks</comment>


Peinjector: MITM PE file infector - <AUTHOR> https://github.com/JonDoNym/peinjector <comment><USER2> Doing some testing of my own using BDFProxy opened my eyes as to what large sites are using http vs https for downloading files. If your primary reason for existing is providing binaries for download, you have no excuse for serving them up over http. I'm looking at you SourceForge.

</comment><comment><USER3> Here's another good reason to encrypt everything. With letsencrypt.org coming online soon, maybe browsers can start providing warnings to users that try to download files from regular HTTP connections; though that wouldn't prevent this problem if the originating website itself is nefarious.

<comment><USER4> It'll take a while, but this does remove the last excuse sites might have for not encrypting _everything_.

I'm hopeful that in the next decade any use of unencrypted HTTP will become suspect, such that browsers can start showing unencrypted HTTP as explicitly insecure, rather than just as the absence of signs of security. But it'll take many years to get to that point.

</comment></comment><comment><USER5> Anyone with a key for a root cert in your trusted list could apply this to https as well I betcha. Lenovo comes to mind.</comment>


Comodo attack appears to have originated from Iran - <AUTHOR> http://www.comodo.com/Comodo-Fraud-Incident-2011-03-23.html

<comment><USER2> It has always been "believed" that nation states are using MITM attacks based on "legit" certificates and a single pipeline. This however provides stronger evidence that that belief is well founded. (versus just being paranoid).

Combined with the Ars article [1] on those certificates that come bundled with the browser and the circumstantial evidence begins to pile up.

Presumably one can delete various CA's they don't trust from their cache, but that just makes the browser complain that mail.google.com is using a certificate that isn't trusted, it doesn't let you connect to a server from Google that is using a certificate you trust.

[1] [http://arstechnica.com/security/news/2010/03/govts- certifica...](http://arstechnica.com/security/news/2010/03/govts-certificate- authorities-conspire-to-spy-on-ssl-users.ars)

</comment><comment><AUTHOR> Also, ioerror has posted an update in response to Comodo's disclosure:

[https://blog.torproject.org/blog/detecting-certificate- autho...](https://blog.torproject.org/blog/detecting-certificate-authority- compromises-and-web-browser-collusion#Update)

Bottom line is certificate revocation lists and OCSP don't mean anything to an attacker like Iran who is MITM'ing the relevant traffic.

<comment><USER3> Yea, did the OCSP designers even thinking about the possiblity of MITMing the OCSP itself?

</comment></comment><comment><USER4> This is a bit of a mess. I wouldn't trust the revocation to work, since that involves a request over a network that has already been compromised.

Interesting to find what the Chrome team did to fix this:

[http://src.chromium.org/viewvc/chrome/trunk/src/net/base/x50...](http://src.chromium.org/viewvc/chrome/trunk/src/net/base/x509_certificate.cc?r1=76824&r2=78478&pathrev=78478)

Good reason to upgrade!

(Edit: this happen a few weeks ago, it has apparently taken the browser makers 8 days to issue an update while in the interim there were rogue signed certs out in the wild)

</comment><comment><USER4> I just got sent this screenshot from an Indian tech co who say they were hacked only a few hours ago, from an Iranian IP address:

<http://imgur.com/qj1Ak>

Turns out the IP address is being misreported as from Iran, so i'm wondering if the same thing happen in this case to point the finger at them

</comment><comment><USER5> Does anybody find it ironic that this guy from the TOR project (great work by this guy) uncovers this and we take it at face value that the IP address that this attack _appeared_ to be coming from is the actual attacker? The attacker couldn't possibly have been using a proxy, could he have? </sarcasm>.

</comment><comment><USER6> Did anyone ask the ISP (Pishgaman TOSE Ertebatat Tehran Network) to investigate which subscriber was using the IP address at the time of the attack?

<comment><AUTHOR> I think when there is presumably a state actor involved, the issue comes up of how you could possibly trust any answer you got. If the iranians told you oh we traced it back to joe in columbus or victor in st. petersburg would you say "oh, thanks" and go knock on their doors? Pretty sure no one has been bothering to ask the CIA who they think made Stuxnet either.

</comment></comment><comment><USER7> This is proof that nations are hacking and spoofing SSL keys in order to spy on its citizens.

<comment><USER8> No it's not. Even if "most of the IPs involved in the attack came from Iran" constituted proof that the attacker was Iranian, it would not be proof that (1) the attacker was the Iranian government, or that (2) they intended to use the stolen SSL keys to spy on the citizenry of Iran.

It is, at best, _evidence_ , not _proof_. Reasonably strong evidence, mind you.

<comment><USER6> Not that strong if you consider this:

"The attacker was well prepared and knew in advance what he was to try to achieve. He seemed to have a list of targets that he knew he wanted to obtain certificates for, was able quickly to generate the CSRs for these certificates and submit the orders to our system so that the certificates would be produced and made available to him."

This makes me think that this could've been prepared anywhere in the world and was made from an Iranian IP address to make it look like it originated in Iran.

If they were that prepared why not use a host in a different country?

<comment><AUTHOR> It is the classic "China IP" issue, in that China has become such a famous source for penetrations that other actors appear to prefer Chinese IPs as effective cutouts. But the other side of the coin is that a substantial number of attacks from china IPs do actually get tracked back to individuals or organizations inside China. That would lead one to conclude that if it quacks like a duck, it is, often, a duck.

</comment></comment></comment></comment><comment><USER9> Goes to show that you need to know/trust your certificate chain, and not some "padlock" piece of browser chrome. Continuing my irritation with the way browser presentations de-emphasize the actual chain and certificates involved.

Even if the certificate labeling is copied, the actual cryptographic values will change. (If they were readily reproducible, the cryptography itself would be useless.)

So... notify the user when those values change from previous sessions, or at least when the fingerprint changes. This still assumes the ability to establish the legitimate values during those previous sessions or via other means. And it appears that trusting the original browser installation is not adequate. (E.g. dozens of "built-in" certs, some from who knows where. Or now, apparently, attempted forgery of Mozilla certificates.)

Of course, I guess most users will refuse to deal with such details, anyway. Until it hurts enough...</comment>


Twitter doesn't know how to search Twitter on Twitter search engine - <AUTHOR> https://twitter.com/search?f=tweets&vertical=default&q=twitter&src=typd <comment><USER2> Care to explain?</comment>