Tesla will not be able to scale its manufacturing capacity - <AUTHOR> http://www.bloomberg.com/view/articles/2016-05-06/tesla-needs-more-than-elon-musk <comment><USER2> First it was "electric cars are not viable technologically, they have no range, there is no charging infrastructure, etc."

Then it was "electric cars are too expensive, they are rich peoples' toys, and mainstream consumers will never want them anyway."

Now it is "Tesla will not be able to scale up to meet all the demand."

The fact that EV naysayers have been forced to cycle through this spectrum of responses in less than 10 years should be a clue of some kind.

<comment><USER3> Teslas are still "rich peoples' toys" some places, model s cost 120000 USD for the cheapest model.

<comment><USER4> Tesla's are really affordable cars in other places (Norway), due to tax incentives for electric vehicles over vehicles.

<comment><USER5> Not really, the basic no frills model S starts at over $80k. Sure that's a lot cheaper than other cars in the same performance class, but that's a far cry from being affordable.

</comment></comment></comment></comment><comment><USER6> It should be clarified that this is an op-ed. The author does not cite any hard facts, and the primary argument seems to be that the author believes that only Toyota's methods are the methods that work, and because Tesla isn't doing what Toyota did, but has ambitious goals, it will fail.

<comment><USER7> Yeah yeah. But does anyone here with a history of building something more complicated than a Rails app want to bet real money that Musk will put a Dragon on Mars AND ship 500,000 Teslas in 2018?

He's not exactly known for hitting his ship dates or volume targets.

<comment><USER8> Reminds me of Louis CK rant "..cause now we live in, in an amazing, amazing world and it's wasted on the, on the crappiest generation of just spoiled idiots...". The dude disrupted 3 major industries and all we can do is complain that he is not hitting ship dates or volume targets let's just stone him for this horrible transgression.

<comment><USER9> The issue is that people will jump ship especially since the reservation fee is refundable. By 2018-19 other manufacturers will have alternative electric vehicles ready to ship.

<comment><USER10> It's been years and there is no credible competitor to the Model S. Maybe it will be different with the Model 3, but until an equivalent car is on the road I'm not sure I agree with your statement. The Bolt - a nice car, and I've test driven it - is just so clearly sub-par compared to what Tesla is aiming for with the Model 3 that I would not consider it a true alternative.

</comment></comment></comment></comment></comment><comment><USER11> So Tesla has two problems, according to the article:

\- They can't ramp up production fast enough to keep up with the demand indicated by pre-orders.

\- Pre-orders are likely to be overstating demand substantially, since they are refundable and therefore vulnerable to speculation.

...Either one of these problems by itself could be a threat, but both _together_ seem somewhat less worrying.

<comment><USER12> If you interpret "can't ramp up" as "can't ramp up without extreme cost/risk," one could envision both being a problem. They could go all in and fail to see the demand they were expecting.

</comment></comment><comment><USER13> Tesla's two top manufacturing execs quit just before Musk announced that he wanted volume production of the Model 3 in 2018 instead of 2020. You can imagine the discussions that went on. Perhaps in time details will surface.

Tesla now faces transitioning from a low-volume high-margin manufacturer to a high-volume low-margin manufacturer. That's hard. HP, IBM, and Xerox tried that, and didn't do too well; all eventually exited the low end and downsized. Even Intel is exiting the low end; they're giving up on the tablet and phone market, as a YC article pointed out a few days ago.

Tesla is trying for good, fast, and cheap at the same time. Tesla's track record is that they can do "good", but late and at a high price. (Space-X has "good" and "cheap", but is about two years behind announced schedules. Their competition is even slower, so that's OK.)

Tesla looks like they're doing a good job of manufacturing, but their Fremont plant has 3,000 employees for 50,000 cars a year. That's 125 labor hours per car. They can't make a $35K price point with that. The big manufacturers are in the 15-30 hour range.[1] That's the big problem. Tesla needs to learn how to reach Toyota levels of production efficiency, and they have a long way to go.

Making 500,000 cars a year isn't in itself an obstacle. The Mercedes A-class production line cycles every 40 seconds. That's 720 cars per shift. If that line ran 2 8-hour shifts (you need a shift for maintenance) and 7 days a week, it could build over 500,000 cars in a year. That's just one production line.

It's getting that production line built, working, thoroughly debugged, and running at a low labor cost that takes some time. Tesla is going to need people who've done that before.

[1] [http://www.autonews.com/assets/PDF/CA2018861.PDF](http://www.autonews.com/assets/PDF/CA2018861.PDF)

<comment><USER14> Ways Tesla can scale up:

1\. Add a lot of automation. Costs would be excessive.

2\. Add a lot of people. Cost would be quite high.

3\. Improve production process. A 10x improvement in production rate in two years would be incredible to see.

4\. Add another factory. See points 1 and 2; also could not happen in 2 years.

5\. Partner with another OEM. This seems to me the most viable way to Musk's goals in his timeframe. We shall see...

6\. Suspend building Model S and Model X vehicles; concentrate all resources on the Model III.

</comment></comment><comment><USER15> Something they don't mention is lithium supply. According to the Financial Times[1], that's a big problem for them:

> Tesla will need about 24,000 tonnes annually of lithium hydroxide, according > to Benchmark Mineral Intelligence, out of a market last year of 50,000 > tonnes.

> more than 70 per cent of which is found in Chile, Argentina and Bolivia. Due > to growth in demand for electric batteries, the global lithium market is > approaching a shortage, with no new supply coming on stream next year, say > analysts. At the same time, battery factories being built in China are set > to increase demand for lithium.

> So far two companies have announced supply deals with Tesla, and neither is > expected to produce substantial amounts of lithium until after 2020.

> "The current strategy seems to be no direct investment but leveraging the > Tesla name by signing 'contingent' contracts at unachievably low prices with > junior mining companies who have never produced lithium chemicals,"

> Albemarle of Baton Rouge, FMC Lithium of Philadelphia and SQM of Chile, the > big producers of lithium, have not been willing to supply at the prices > Tesla has demanded.

[1] [http://www.ft.com/intl/cms/s/0/4a924a64-99df-11e5-987b-d6cde...](http://www.ft.com/intl/cms/s/0/4a924a64-99df-11e5-987b-d6cdef1b205c.html#axzz47yGaYlgt)

(To get around paywall, google "lithium supply tesla" and take the top result.)

<comment><USER16> Lithium is abundant, the question is just how well it can be extracted. For example, there is more Lithium in sea water than humanity can ever use to build batteries, but we still need to commercialize the extraction. So it's not that there isn't enough of the stuff, it's that there currently isn't that much of a need for it, so only the most easily accessible reserves are being tapped. That might cause supply issues in the short term, but long term, there's no shortage.

<comment><USER15> In the long term future of humanity, sure. I'm talking about the next few years for Tesla, since that's the topic of OP's article.

Production is increasing, but slowly, and even if Tesla were offering a price sufficient to motivate faster increases, it takes time to bring new projects online. Aside from building facilities, you eat a couple years just waiting for brine to evaporate: [http://www.bloomberg.com/news/videos/b/3abb52e4-ea59-4ed9-85...](http://www.bloomberg.com/news/videos/b/3abb52e4-ea59-4ed9-8525-80e5765c701c)

</comment></comment></comment><comment><USER17> Based on title, expected to see the article analyze lithium mining capacity, packaging constraints, limits to manufacturing efficiencies, P&L analysis of growth capital requirements, etc.

Got "Toyota is better" instead.

</comment><comment><USER18> "shows how badly Musk fails to understand what he's up against"

Lines like this is why writers write and doers do.

</comment><comment><USER19> Tesla has yet to transition from a product first to a manufacturing first kind of company. Entry level cars are much more shaped by manufacturing possibilities rather than consumer demand. It's not unreasonable to assume that the Model 3 will be sold at a loss and then it will be a question about how much longer investors are willing to pour money into Tesla rather than how many cars they can sell. I'd buy a Tesla - it's a bargain. Unlike the stock.

</comment><comment><USER20> Worst case scenario, wouldn't it be conceivable that the guy who built a car and space rocket company from scratch now creates/buy a lithium mining and/or battery making company to be able to supply Tesla different projects (cars, powerwall)?

<comment><USER21> Tesla is probably pursuing a partnership with a company like Toyota that can already mass-produce autos. If GM can do it, why not Tesla? (The author didn't mention that possibility, which makes me suspicious that he has an axe to grind against Tesla.)

</comment></comment><comment><USER22> What Tesla has, are Musks shoulders. He went pretty deep and pretty low to make this happen when it was nothing. Not to make him a supernatural being, but now that his ventures are stable and growing I expect him to be able to handle pressure and find solutions way easier than when Tesla almost went bankrupt.

</comment><comment><USER23> This is probably the only direction available to Tesla. They can grow or lose market share over 5 years as the legacy automakers catch up.

The biggest threat to Tesla now is that their logistics teams will be able to source sufficient materials. I think getting the manufacturing lines up and running will be a challenge, but one Tesla has met before.

Financially can Tesla do it? I'd say yes, and they probably won't even have to do any fundraising to do so. They will probably be able to fund it completely through debt instruments. They are a good bet by any measure at this point.

</comment><comment><USER24> Most silicon valley startups try to learn from the Toyota manufacturing process and improve on it. While Toyota got stuck, Tesla gets rid of the most inefficient part of manufacturing process: humans

<comment><USER25> Humans play an important role in the continuous improvement process.

<comment><USER26> Absolutely. Continuing with the Toyota example, more direct human involvement with the manufacturing process has been reintroduced [1]

[1] [http://www.bloomberg.com/news/articles/2014-04-06/humans- rep...](http://www.bloomberg.com/news/articles/2014-04-06/humans-replacing- robots-herald-toyota-s-vision-of-future)

<comment><USER24> It's probably the way not to do things if you want to get to affordable supercars. The only way is to program robots to manufacture the cars from start to finish, and the development should be in software (teaching the robots to work better)

</comment></comment></comment></comment><comment><USER18> Headline is misleading. Current source headline: "Tesla Needs More Than Elon Musk". Vs HN headline: "Tesla will not be able to scale its manufacturing capacity"

</comment><comment><USER14> Disclaimer: I work for a Tesla competitor, any opinions are solely my own.

I've noticed several questions on this thread about manufacturing. Since I have worked in auto manufacturing, I will share some thoughts in the following areas: __EV Assembly is Simpler; Humans are inefficient; Musks ' Desk by the End of the Assembly Line; and Tesla is Smarter than Toyota. __

This is intended as a VERY high level overview, expect many details to be glossed over.

 __EV Assembly is Simpler __: Electric vehicles are slightly simpler than Internal Combustion engines. This does make EV Assembly _slightly_ simpler... but not much.

Automotive Assembly plants consume parts and make finished vehicles. Assembly plants have three main areas: Body, Paint, and General Assembly. Tesla's Fremont plant has these 3 areas.

What is because Tesla makes EVs? Not the Body Shop, not the Paint shop. Is General Assembly simpler? Not by much. GA is split in two areas - Trim and Chassis. Trim no less complex on an EV than ICE. Part of the Chassis process is simpler.

So, part of 1/2 of 1/3 of the Assembly process is easier in the Assembly plant; call it 10% less complex (1/6 = 17%, but only part of that 17% is simpler).

 __Humans are Inefficient (also, Four Function Robot): __* Efficiency, and engineering is all about trade-offs. In my opinion Musk will not be able to automate his way to 500k vehicles per year.

Humans are often perceived as inefficient because: software engineers (and most of the people reading this) tend to value their time highly and strongly dislike repetitive tasks. The perception is that if the task is automated, it is a better use of a persons' time. This can be true. This is why all auto OEMs have some automation in manufacturing.

Humans, however are better in a number of ways: humans are great at learning new tasks quickly and cheaply, humans require much lower capital expenditure to hire (they may be more expensive in the long run, but 2 years _is not the long run_ )

Automation can also be inefficient depending on the parameter chosen. At one point Tesla had a multi-function robot that changed it's "hand" for each vehicle to perform different task. Changing the hand takes time, which Tesla cannot afford if they want to build 500k vehicles/year. Yes, you can simply add more robots, but that costs money.

As Tesla has been setting up its manufacturing process, it may have in mind future expansion and speed-up; but it has been solving current problems. Automation in particular can be troublesome to speed up (most definitely following the 80/20 rule). Portions of the assembly line may have to be re- structured to allow parallel operations, which can be expensive and time consuming.

Also, the assembly operation(s) in question have to be engineered with automation in mind (else it will be amazingly expensive). This is entirely possible, but I don't see a major breakthrough in 2 years alongside a major vehicle launch.

 __Musks ' Desk by the End of the Assembly Line (and Tesla is Smarter than Toyota): __This item in particular makes me shake my head in disbelief. On a recent earnings call, Musk said that his desk is next to the end of the production line [desk]. This suggests that Musk is attempting to inspect his way to quality. Do you know who tried to inspect their way to quality? GM (among many others). Do you know who has a good reputation for quality? Toyota. [quality]

In addition (and more pertinent to the speed-up question), quality has a quantity all its own. If you use high quality parts, you can put them together more quickly and more reliably, and thus in higher numbers. If you produce high quality vehicles, you can ship them more quickly, and again, in higher numbers.

In other words, the defects are not being added to the vehicle at the end of the assembly line, and they cannot easily be removed at the end of the line. Can you test your way to high quality software? Can you inspect your way to high quality vehicles?

[desk]: [http://qz.com/676127/no-need-to-worry-elon-musks-desk-is- rig...](http://qz.com/676127/no-need-to-worry-elon-musks-desk-is-right-at-the- end-of-the-tesla-production-line/)

[quality]: 1. Musk is certainly doing more than just inspection, but his words send a very naive message. 2. GM and other companies perceived as low quality have actually caught up to, and surpassed Toyota. [http://www.jdpower.com/press-releases/2015-us-initial- qualit...](http://www.jdpower.com/press-releases/2015-us-initial-quality- study-iqs)

</comment><comment><USER27> It's interesting because the software development strategy of break things fast is based off of agile methodologies developed by Toyota. If any place is primed to be the birthplace of a car company that emulates Toyota, then SV is it. And there's no reason tesla can't be one of those companies.

<comment><USER28> whoa whoa whoa... the foundation goal to which Toyota's strategies have been focused for the last 50 years have been explicitly towards improving quality of the vehicle once it leaves the factory... The time to market focus at the cost of quality that is a rational viable model in software is the antithesis of the toyota way...

</comment></comment><comment><USER29> how does tesla compare to byd?

[http://www.europeanfinancialreview.com/?p=5603](http://www.europeanfinancialreview.com/?p=5603) [http://www.byd.com/news/news-313.html](http://www.byd.com/news/news-313.html)

i think byd had pretty big claims when they started out into cars too..but went quiet after awhile...but somehow they'd survived and its been more than 10yrs since they started...

</comment><comment><USER30> What a boringly one-sided article.

</comment><comment><USER31> This article is wrong headed in one very important way. Electric cars are fundamentally a much BETTER way to make cars. And that's why Musk (and other electrics with decent engineering) can count on selling all of his production.</comment>


The Free Software Movement... was never about Free Software - <AUTHOR> http://entrepreneurship.mit.edu/blog/elliotcmitedu/free-software-movement-was-never-about-free-software

<comment><USER2> I'm not a fan of this strange rebranding of "The Free Software Movement".

This article and apparently the one it directly counters, are discussing the "Freemium Business Model", "Ad-Supported Business Model" and "Platform-Play", while discussing "When Software Should not be Free".

These things have absolutely nothing to do with Free Software. Sorry to get all RMS on this post, but I think it does a disservice to both topics (Free Software and SaaS business models), each of which are interesting, but not when confused with one another.

</comment><comment><USER3> This is confusing. "Free Software" and "Free Software Movement" alludes to the original GPL and Stallman who manipulated copyright law to enforce his philosophy on software (software freedom and all that jazz).

This appears to be about web sites and business models and not software licensing. Not that I hold it against this guy, but when we don't all use these terms the same way it gets confusing.

</comment><comment><USER4> I wrote the blog post. I suppose you guys are right - poor choice of terminology. I read Kane's post - which was mostly about why he isn't going to release his software for free anymore. I started thinking about the business reasons why i release software for free (which i do sometimes, but not always) and it occurred to me that i use it as a tool to allow me to more quickly test out an idea. That was really the main point i was trying to make. I will try and update the post tonight to make the language more consistent with the point i was actually making (focusing on testing hypotheses to mitigate risks as a startup and using a freely available product to help test those).

</comment><comment><USER5> Fourteen mentions of "Free Software" and neither this article's author nor the article he mentions seems to know anything about the actual Free Software movement. The author he replies to has even modified his article after being corrected on this point.

</comment><comment><USER6> I feel a missive from RMS on the way.

</comment><comment><USER7> Wait...is this confusing free-as-in-beer with free-as-in-freedom?

<comment><USER8> Yes.

<comment><USER9> Wait wait wait. Where the *&#$ do I go to get free beer?!?!

</comment></comment></comment><comment><USER10> Bah. I was hoping for something about how it's really about non-proprietary interfaces, or collective laziness (in the LazinessImpatienceHubris sense), or the passivation/consumerization of society, or power hierarchy vs egalitarianism, or... ... but no, it's just about the multiple meanings of "free" in english.

</comment><comment><USER11> Next on the blogroll, "Social Networking Startups": A review of new bars in my area.</comment>


Cyber Corps program trains spies for the digital age - <AUTHOR> http://www.latimes.com/news/nationworld/nation/la-na-cyber-school-20121123,0,7345893.story

<comment><USER2> Nice to see they are doing something good for the human kind.

But seriously, do we really need to be spying on other countries? That means there's distrust by default in any and all relationships (also proven by the US hacking of France's president's computer).

Positive long term human relationships can only work if there is _trust_ by default, not distrust.</comment>


Ask HN: How do I know if I have the right co-founder? - <AUTHOR> <comment><USER2> Listen to your gut.

I started my business with 2 partners. One of them I trust completely, even with my life. I had a negative gut feeling about the other since day 1.

The latter is the one we had to let go, and it got really really nasty.

</comment><comment><USER3> You don't until you go through hard times with someone.

Good times don't tend to expose the relationship well.

</comment><comment><USER4> I've been researching this a lot lately. So this could be from other posts on HN, other forums, or blog posts... most of this is probably not my original thoughts.

First the right co-founder would be a lot like you. Compatible communication styles and temperament. If one of you likes to "call it like it is" and the other is more gentle, things won't go well. You don't have to be identical, but close enough to not waste time fixing your relationship every day.

Second, the right co-founder will be the opposite of you. In terms of skills, opposites are good. You're good at development? You need them to be great at something entirely different.

If you met your best friend because you worked side-by-side doing the same job and do everything together, probably not a good cofounder. But if you have a former colleague that you worked with, you got along great, but you were in sales and he was a developer -- that might be a match made in heaven.

I like to think of it like a marriage. My wife doesn't mind doing the things I hate (cook, clean, etc) and I love doing the things she hates doing (going to work, doing finances, etc). We communicate well, get along great, and the responsibilities are easy to split.

</comment><comment><USER5> You don't. Founding a company will be one of the hardest things either of you ever does. It's almost impossible to know beforehand how people will react to extreme stress, sleep deprivation, large amounts of money, etc...

You can certainly do your best to learn about each other and extrapolate what that means for a day to day working relationship, and for the good and bad times. I'd highly recommend working on a side-project together, or one of you hiring the other as a contractor for 1-3 months to work on the main product (pre-incorporation) with the understanding that everything will even out at incorporation. Equal (or reasonable) equity split, and the person paying the other for contracting work will get a reimbursement as part of the incorporation expenses.

To further reduce your risk, you absolutely need vesting and triggers. Based on my experience, the standard 4 year vesting / 1 year cliff is not enough for founders. I'd explore more long term options, such as 6 year vesting / 2 year cliff, or the 4/1 that only starts after reaching a significant revenue / fundraising milestone. The latter of 1 mil ARR or raising over 1 mil in funding. Obviously you should both have the same terms here.

You may also want to consider having only one of you on the board (so that in the worst case you can fire a cofounder). This should probably be the CEO. Also, CTOs are usually the first/only devs so you may want to consider setting a 6 month done-or-out milestone for product dev. This could be applied to other roles (CEO- fundraising, Sales- hitting early adopter/traction milestone), but I haven't seen that done in practice yet.

The worst case for you is that it doesn't work out in the early stages. This doesn't have to be a bad split, nor kill the startup. Sometimes people go in with good intentions, find out that it's not for them, and leave on good terms. But if they do leave, on good or bad terms, before the company is stable then you don't want them to take a large portion of the equity.

I strongly believe that founder equity is to compensate performance, not opportunity cost. That's why they need to have such a large portion- the risk of not performing is so great since the bar for a founder is so high, so if they do perform they need a large reward. If founders are concerned about opportunity costs of giving up a large salary, and need equity to make up for it, they probably aren't really ready to make the jump to a startup.

</comment><comment><USER6> I guess time and your gut will tell, but don't waste valuable time to find out. Don't postpone any tough talks to later. Spend a lot of time together in business maybe even private. Traveling with someone to a foreign country for me is always a good indicator. You'll see how someone behaves in a different cultural setting, how they deal with unknowns and eventually you feel if you can work hard together for the next 5+ years ;)</comment>


Ask HN: Non-employees making a full time living online - <AUTHOR>

How? App, consulting, youtube, blog, ecommerece? How much? Getting by, same as a regular job, flying high?<p>Thanks for sharing! <comment><USER2> Working from home really gives you the advantage of living in area's much cheaper then you would normally think about for Tech industry. You can bring in drastically lower income and still have a higher purchasing power parity as someone working in the valley.</comment>


Looking For A Technical Cofounder - <AUTHOR>

I'm hiring a second co-founder who is knowledgeable in PHP/MYSQL and is an ex Google,YouTube,or Facebook employee. This is the 8th time I've posted this request on Hacker News just going to keep posting it until someone listens. I'm building a website and I have 104 lines of code I was thinking we could trade off the work until it is finished. Meaning that since I just wrote 104 lines of code you would go write 104 lines and pass it back to me and we would do that back and forth until the website is finished. I'm working to have the Beta out by August. If your interested email me @ firstname.lastname@example.com or tweet me @KeithClark_ thanks! <comment><USER2> In case anyone's interested:

<http://news.ycombinator.com/item?id=2068669>

<http://news.ycombinator.com/item?id=2077491>

<http://news.ycombinator.com/item?id=2110475>

<http://news.ycombinator.com/item?id=2111857>

<http://news.ycombinator.com/item?id=2122857>

<http://news.ycombinator.com/item?id=2130163>

<http://news.ycombinator.com/item?id=2163366>

<http://news.ycombinator.com/item?id=2166411>

A nice comment is here: <http://news.ycombinator.com/item?id=2122865>

        Since you've tried 5 times why not take a little time
        to write a more compelling job offer? Describe what the
        person's responsibilities will be, what you're expecting
        from a potential hire, what makes working for you cool
        and worth while, etc. Write a little about yourself in
        your profile. 5 failed attempts had to have told you
        something.

Also the comment here: <http://news.ycombinator.com/item?id=2166468>

        First of all, who "hires" a co-founder? But that lexical
        issue aside, the biggest reason nobody will respond to
        this here is because nobody is interested working on a
        mystery project without anything to remotely pique our
        interest. You don't provide the slightest detail about
        the project, or even what industry or problem it might
        be relevant to. For all we know you are trying to get
        somebody to write a Wordpress theme. Please provide
        insight into your project or frame it in terms of how it
        is useful or important to this community. Or stop posting
        it again.

As I wrote earlier:

        Insanity: doing the same thing over and over again and
        expecting different results.

            -- Albert Einstein, (attributed)

<comment><USER3> _"doing the same thing over and over again and expecting different results"_ \- I'm beginning to wonder whether this applies to you more than the OP... :)

<comment><USER2> <grin>

I was aware of the irony as I wrote that, but I have various tools that let me construct such responses quite quickly. Having done it this time I can simply refer to it and not have to go though the motions again.

And besides, I've only spent two periods, each of less than 3 minutes (yes, I'm sad, I did time them) to construct all the replies so far. Technically I've made one set of replies, and then seen the same post come back. Doing the same things again _once_ to see if you get a different response is, I think, fair enough. Bt I won't be replying in detail again. (90 second reply)</comment></comment></comment>


Why OpenBSD Rocks - <AUTHOR> https://why-openbsd.rocks/fact/ <comment><USER2> I can confirm that acme-client so far is the only sane client I've seen. No nonsense of multi-megabyte downloads of endless Python scripts or esoteric bash scripts. Just good old C tool as it should be. Every *nix should use it by default.

<comment><USER3> I am not a big fan of C, but those Python/JavaScript based GUIs that fade to black at every button click really make me miss the days when all GUI tooling in UNIX was written in C.

</comment></comment><comment><USER4> I was actually playing with OpenBSD while stuck with the flu.

The good:

* ifconfig handling everything is brilliant. Having one tool to do networking, including WiFi(!) is great.

* the documentation is good. `man -k` normally gets you what you need.

* "base builds base" is pretty cool. I managed to rebuild base on a 1GHz single core BeagleBone Black in 48hrs.

the bad:

* Performance. I didn't think this would be a huge issue, however it's _much_ slower than Trisquel, Parabola and GuixSD running GNOME on a x200. WiFi also seemed slow.

* IPv6 seemingly didn't work, even when verifying my ifconfig setup.

* Filesystem. I don't expect them to add ZFS due to code size and license, but still using UFS is laughable. UFS seemed to have I/O deficiencies which exacerbated the performance issue.

* the _other_ documentation. While the manpages are good, information on the internet can be contradictory depending on it's age.

* No lsblk. This is more of a nitpick, but there is seemingly no way to get the right name for a disk without parsing through `dmesg` and guessing with partition number.

* pkg_add. It's extremely slow compared to apt even and separates it's parts out for seemingly no reason. Package management in general is somewhat awful.

<comment><USER5> I wonder though, if they don't have the manpower to optimize for desktop usages, why don't they stick to server only?

I've tried to use it on a server some months ago (trying out OpenBSD every few years because I do like the philosophy) but things behaved odd and slow, so I just used FreeBSD and problems disappeared.

I'd like to see a completely server focused one instead of trying to do it all and keep issues hanging loose.

<comment><USER6> Because they believe in dogfooding their software. So developers run it on their desktops, as well as on their servers.

</comment></comment></comment><comment><USER7> I totally respect OpenBSD and their commitment to security and stability. However, the thing holding me back is that they've dropped some features over the years that I relied on.

I used OpenBSD on a netbook and it was awesome. But I really needed 32-bit Linux binary compatibility, and I was also one of the 3 people who used bluetooth. Both of these features were removed entirely. I wish there was a way I could "live dangerously" and have access to them again. I would love to have access to bluetooth based serial terminals, and use my favorite keyboard.

</comment><comment><USER8> Since SystemD has become so prevalent in Linux, I've been looking longingly at BSD. The only problem is that I have a large number of machines that I'd need to move over, and it's a pretty intimidating amount of work. But I'm planning on beginning the move, one system at a time...

<comment><USER9> It impresses me that the hate for systemd persists even after so much time has passed. I thought it was just inertia.

I see systemd as a framework to define and control services that is much more robust than the old system that relied on scripting conventions. Why the hate? What's people's ideal here?

<comment><USER10> I am a newcomer to hating systemd. At first I was indifferent, an init system cannot be so bad after all.

Fuck that. In the last two years, they have changed at least three times the way that the option to delete the /tmp dir is specified. I understood the configuration, edited it so that it did not delete the /tmp dir automatically; and then, upon an innocent update the old config is overridden and the /tmp dir is magically cleaned! This is infuriating. I have never felt actual, physical, rage against any software in 25 years of using computers. That is, until I met systemd!

I do not really care whether the init system is written in C or scripts. But please, allow me to follow a simple logic. Scripts maybe are not very elegant, but I can follow the init process end-to-end and understand where it does that. I have honestly tried to do that with systemd and it is impossible. And I am quite proficient in reading C code and bash scripts. I have a lot of patience and I am willing to spend a few hours of my free time to understand how a program is configured, by reading code if necessary. But this stuff is just batshit crazy.

I can hear in my mind the smug voices of systemd developers saying "but why do you even want to not delete the tmp files". That's not the fucking point motherfuckers! I just want to control my computer.

<comment><USER11> A systemd conceptually is quite a good idea. However systemd is not that systemd. Much rather go with rc.conf + script approach, disable all systemd services, lock selinux against systemd socket activations and run a purpose controlled environment. Avoiding systemd does force one to not use Linux as a desktop..oh well.

<comment><USER10> > Avoiding systemd does force one to not use Linux as a desktop

Why do you say that? You can even use gnome without systemd, but there are still other desktops.

<comment><USER11> I have't looked at it rcently but the last time I checked systemd was the 'nice to have' that was mandatory for some of the software I associate with a fully fuctional desktop which is not just a WM, DE (or not) and basic applications like xterm , vim, etc...But you are right. You can run the linux desktop like its 2007 without systemd on select distributions without screwing around too much...of course don't add new software without researching dependencies and default build options or you may end up with the worst of systemd dependencies anyway. At that point I just run KDE on FreeBSD.

</comment></comment></comment></comment></comment></comment><comment><USER12> Why does file(1)[1] need its own chroot sandbox instead of using the pledge(2)[2] facility. They say:

> Think of the following: You download a random file from the internet and > analyze it using file. If file has a security hole (local code execution for > example), he can run attacks with his prepared file. Thats why the file > utility is sandboxed and chrooted by default.

Isn't that exactly the sort of case where file(1) would open(2) the downloaded file and its own database, and then proceed to drop all other access privileges before doing any of the parsing of the untrusted file?

1\. [https://why-openbsd.rocks/fact/file/](https://why- openbsd.rocks/fact/file/)

2\. [https://why-openbsd.rocks/fact/pledge/](https://why- openbsd.rocks/fact/pledge/)

<comment><USER13> > Why does file(1)[1] need its own chroot sandbox instead of using the > pledge(2)[2] facility.

It does use pledge(2) these days, those references are to how file(1) was sandboxed before. Why the author has linked to that I don't know.

<comment><USER12> Yeah, on closer inspection their page describing the sandbox links to the CVS commit where the sandbox implementation was deleted in favor of tame(2), the predecessor of pledge(2).

</comment></comment></comment><comment><USER14> Anything that matters for us runs either on OpenBSD or behind it. almost 20 years now. Zero fucks given. Theo is the type of dev manager I want for my projects.(aggressive, opinionated, solid)

</comment><comment><USER15> Nice list. They may want to take Spectre off the list, however. It seems only hardware fixes actually work: [https://arxiv.org/pdf/1902.05178.pdf](https://arxiv.org/pdf/1902.05178.pdf)

Signify sounds great. It has been ported to Linux: [https://github.com/Blitznote/signify](https://github.com/Blitznote/signify)

</comment><comment><USER16> I like openbsd and have used it happily for a long time, but it's not fair to list sysmerge and syspatch as selling points. If we are being honest, other systems have long had more automatic upgrade procedures and these two tools are essentially minimalist ways of solving the problems with the old way.

</comment><comment><USER17> I found OpenBSD to be pretty amazing, and after trying it now and then I finally loaded it onto my x220 to use it daily. Things worked fine, but I realized the battery life was poor (even using the functionality, I think in tpm, which regulates the clock speed to be slower) and support for what I began to need (like the Eclipse IDE) was shoddy. Unlike many others, I don't have much to say about the documentation, but that's also an endorsement for the system itself - I didn't need to access it more than once or twice.

Support for other file systems, which is a part of life for me, was pretty lacking; for me, ext4 write support and fat32 read/write isn't essential but would have been enough to stop me from moving back to GNU/Linux.

In the end, it looks like a great system but it just didn't fit my needs, just as, for instance, NixOS (and Guix) didn't fit my needs when I wanted a custom XKB layout.

<comment><USER18> Haven't tried a custom layout myself (only xkbOptions), but it should be fairly straightforward to use a custom xkb layout with NixOS: [https://nixos.wiki/wiki/Keyboard_Layout_Customization](https://nixos.wiki/wiki/Keyboard_Layout_Customization)

</comment></comment><comment><USER19> It does _just work_ (TM). Brightness and volume hotkeys work out of the box, without a desktop environment (even on the console). WiFi, including autojoining, works using a single ifconfig command or configuration file. Suspend/resume works on my laptop without any configuration.

If you're using it on a laptop, just make sure to use an older, less ultrabook-like machine and you'll be good.

<comment><USER20> If you're willing to use old hardware for compatibility, any of the major *nix flavors just work.

<comment><USER19> True. I was still impressed with how well-thought-out the laptop features were without a desktop environment. I think it would be harder to get the same on Linux without manually configuring the hotkeys and dealing with wpa_supplicant.

</comment></comment></comment><comment><USER21> The points aren't OpenBSD specific though:

* ASLR - every modern OS has some form of this.

* FDE - there are reasons (IIRC) FDE is better at FS level than block so this is sort of a negative.

* LibreSSL - OpenSSL API is still a tire fire.

* PIE - Possible on IIRC fbsd, nbsd, linux, etc.

* UTF-8 only libc - there are issues here, such as strcasecmp.

* noexec - IIRC this has been cross OS since the dawn of time (at least early 2000's).

* pledge - pledge is cool, I'm trying to implement something similar using google kafel and a macro that turns `vow(id, kafel_string, flags)` into a compile time bpf filter.

* strlcpy - is sort of junk as it has to iterate over ALL of src so for example strlcpy(d, "superlongstring...", 2) will read all of "superlongstring..."

</comment><comment><USER22> If you want to use Ubiquiti hardware but not Vyatta, OpenBSD supports the Octeon processor [1]. In particular the edgerouter lite can be swapped to OpenBSD [2] for the cost of the right USB stick [3] and a console cable [4].

Some people find the ERL's performance isn't sufficient to pass packets and also host services such as radius or that the passive heat management on the edgerouter isn't sufficient. In that case Protectli.com [5] makes appliances with monster heat sinks on top and despite running an old ATOM processor can push data at gigabit speeds [6] thanks to onboard Intel NICs.

Finally you can just grab any refurb wintel box, add a couple of Intel NICs and throw away the windows license.

The great thing about OpenBSD is particularly for its typical roles of firewall, load balancer, edge gateway, authentication server, etc it doesn't require much CPU or storage.

I recently rebuilt a laptop with Windows from a USB 3 stick to an Intel M.2 NVME SSD. It took less than 5 minutes to go from booting to install to reboot. OpenBSD's footprint is so small you'll see similar build times particularly when you leave off X Window.

[1] [https://www.openbsd.org/octeon.html](https://www.openbsd.org/octeon.html)

[2] [https://codeghar.com/blog/openbsd-network-gateway-on- edgerou...](https://codeghar.com/blog/openbsd-network-gateway-on-edgerouter- lite.html)

[3] [https://www.amazon.com/dp/B013CCTM2E/ref=cm_sw_em_r_mt_dp_U_...](https://www.amazon.com/dp/B013CCTM2E/ref=cm_sw_em_r_mt_dp_U_UewECb3Q86NVG)

[4] [https://www.amazon.com/dp/B01N0LMWGQ/ref=cm_sw_em_r_mt_dp_U_...](https://www.amazon.com/dp/B01N0LMWGQ/ref=cm_sw_em_r_mt_dp_U_wgwECbSVDAYK5)

[5] [https://protectli.com/4-port/](https://protectli.com/4-port/)

[6] [https://tech.mangot.com/blog/2018/11/08/showing-a-gigabit- op...](https://tech.mangot.com/blog/2018/11/08/showing-a-gigabit-openbsd- firewall-some-monitoring-love/)

</comment><comment><USER23> What are the desktop GUI environments or window managers available on OpenBSD that are comparable to those on Linux? I see a mention of running X as a user, but nothing more.

What about desktop hardware support? Does it have working drivers for different WiFi chipsets, video cards, trackpad, etc. (referring only to x86 based systems)?

<comment><USER24> >What are the desktop GUI environments or window managers available on OpenBSD that are comparable to those on Linux?

I'll answer this honestly;

All of the X11 based ones until SystemD and wayland came about are essentially supported or working. Gnome created a hard dependency on systemd and thus can't be used any longer on openbsd.

Wayland (and thus; Sway) is not supported by OpenBSD.

But i3, xmonad, KDE4, XFCE4 and cwm are all running flawlessly and I used them before on OpenBSD myself.

I think even Budgie works, but I've not tried that myself.

> What about desktop hardware support?

Hardware support is obviously up to whatever you have. I can only share my experiences and I had a thinkpad x201. Which was obviously very well supported.

However there is a caveat to that: the drivers were indeed supporting the hardware very well BUT OpenBSD does not support bluetooth in any form (citing the fact that bluetooth is a horrible standard and implementing it simply; has never been done and would be hard/impossible).

WiFi was relegated to 802.11g (not 802.11n despite my hardware supporting it). Support for N was added a couple of years ago (after it had been widely adopted for more than half a decade by other OS's) I wouldn't hold my breath for AC support given that.

<comment><USER25> > Gnome created a hard dependency on systemd and thus can't be used any longer > on openbsd.

This isn't true, OpenBSD has GNOME 3.30.2 in ports. It maintains patches to keep it working for users, who can install it with the meta package: pkg_add gnome

6.4 has 3.28.2 in packages: [https://www.openbsd.org/64.html](https://www.openbsd.org/64.html)

Antoine Jacoutot is the maintainer.

<comment><USER24> Oh, Amazing, I stand corrected. Thank you Antione!

</comment></comment></comment></comment><comment><USER26> I use FreeBSD. It works fine, and I've configured it to be secure. Is there any reason for me to move over to OpenBSD ? I don't care about minimal or some reasons like that, I already have Alpine linux for that. Any other reason(s) ?

<comment><USER16> I've used both as desktop systems. I can't really quantify it, but I feel like OpenBSD "feels" better on a laptop or desktop. Maybe because their developers focus more on that as opposed to thinking only of servers? I don't know. Anecdotally, I have had a few systems where wifi or graphics work better, or sooner, on OpenBSD. Sometimes FreeBSD support has appeared later in these cases. (eg. A few years ago, FreeBSD's Intel graphics driver was way behind, but it's since caught up.)

But there are downsides. Upgrading OpenBSD can feel painful to the point where I put it off (though it's getting better). You may have to randomly re-write a config file at upgrade time, or sometimes release-to-release they will remove useful features, like Linux emulation a few years ago. FreeBSD ports and pkg sometimes has stuff that I don't see in OBSD's ports tree.

I think to answer the question you'd need to take a look at what features, hardware support, and ports you need, and how well OpenBSD does or doesn't suit it. Maybe try out OBSD on a USB stick or something and see how you like it.

</comment></comment><comment><USER27> How many of these items are not also available in a standard Linux configuration?

<comment><USER28> * KARL

* LibreSSL (most Linux distros use OpenSSL, YMMV)

* License (GPL, GPL everywhere)

* PID randomization

* Priv sep (for some package managers, for example)

* Swap encryption (probably opt-in, so not default)

* UTF-8 only

* W^X Memory

* autoinstall (though ansible and co. might help)

* base system (it's GNU/Linux after all, not just GNU nor Linux -- some outliers)

* doas(1) (yeah, sudo(1) was made in OpenBSD, but they ditched it)

* pf ([http://man.openbsd.org/pf.conf.5](http://man.openbsd.org/pf.conf.5))

* pledge

* signify (most distros use GnuPG instead) (though porting it should be a breeze)

* unveil

Unveil, pledge, and co. probably have AppArmor/SELinux counterparts, but adding layer upon layer make the whole thing brittle. Unveil, pledge, etc. are built-into all base utils (see also base system concept)

</comment></comment><comment><USER29> RETGUARD isn't mentioned, which is curious.

Guess I'll need to submit a merge request.

</comment><comment><USER13> A more comprehensive list [https://www.openbsd.org/innovations.html](https://www.openbsd.org/innovations.html)

<comment><USER30> I like how they list W^X as an innovation.

1) It's not W^X. W^X implies read-only pages are not possible, and they are.

2) They "invented" that, what 5-10 years after Linux?

<comment><USER31> > It's not W^X. W^X implies read-only pages are not possible, and they are.

What? W^X implies that Write and Execute or mutually exclusive, can't have both active at the same time.

> They "invented" that, what 5-10 years after Linux?

It's not so much that they "invented" it, but that they're much more diligent about making sure all the base system and ports use it. It's enforced that unless your file-system is mounted with "wxallowed" then any process that tries to mark a page both writeable and executable will fail.

<comment><USER30> > What? W^X implies that Write and Execute or mutually exclusive,

The truth table for XOR also says that "neither write nor execute" is impossible.

> It's not so much that they "invented" it, but that they're much more > diligent about making sure all the base system and ports use

They've definitely taken it further, and turned on by default and all that, which is great.

However they _did_ at the time say that they both invented it, and that it couldn't be done on x86. Of course grsec had been doing it, including on x86, for many years. Theo's defense of why they've not done things Linux has done is that they're not interested in Linux, and don't look at it. Which is an interesting way to assure you're "state of the art"; don't look at what others are doing.

So both at the time and now they say they "invented" it.

Later of course they "invented" how to do it on x86, too.

</comment></comment></comment></comment><comment><USER32> I really, really want to use OpenBSD. I love everything they make. The one thing that keeps me on FreeBSD/Linux is ZFS support.

<comment><USER33> I really want to use OpenBSD too, the only thing keeping me on FreeBSD is proprietary Nvidia support.

</comment></comment><comment><USER34> sndiod is pretty nice...

Dead simple. Fixed latency that you set when you run the sound daemon. Same API with the sound daemon in or out. You can yank it out and the programs get to use the same interface for both audio and mixer. So nothing like the pointless ALSA mixing interface laying around when you run pulseaudio. It all works transparently.

</comment><comment><USER35> Wow! OpenBSD _security_ rocks!

</comment><comment><USER36> I wanted to install and try OpenBSD on my Librebooted Thinkpad T60, but unfortunately it is not possible to use full disk encryption with a non-custom Libreboot rom (you apparently need SeaBios instead of Grub2 for this to work). I find it quite sad, because I think Libreboot + OpenBSD would be the ultimate security and privacy-focused combo.

<comment><USER37> Let's hope they support RISC-V

</comment></comment><comment><USER29> > Xserver without root permissions

There must have been a regression. There still was lingering suid root binaries that OpenBSD got bit by recently.

I mean, it was security fix #1 for release 6.4: [https://www.openbsd.org/errata64.html](https://www.openbsd.org/errata64.html)

<comment><USER38> AFAIK that suid binary was used to enable starting the X server without a display manager. It still actually ran as non-root.

<comment><USER6> It was setuid root but dropped privilege, but the dropping privilege came after parsing the command arguments and doing initialization, so there was a small time window while it still runs as root and in that time it could be tricked into overriding any file.

</comment></comment></comment><comment><USER39> Why OpenBSD? [https://rgz.ee/openbsd/why.html](https://rgz.ee/openbsd/why.html)

See also: [https://rgz.ee/openbsd/](https://rgz.ee/openbsd/)

</comment><comment><USER40> OpenBGPD is missing from the list. It's a great piece of software.

</comment><comment><USER41> Many of the items on this list seem to be some variation of "random place in memory so attackers can't guess"

It sounds nice, but can someone explain if there are any downsides?

<comment><USER19> Slightly slower? Mechanical hard drive boot times aren't the best, but they're quite acceptable with an SSD. For my desktop use, OpenBSD seems plenty fast.

<comment><USER42> I think you're confusing topics, randomized address space != random disk reads.

Edit: To answer GP's question, you're probably already incurring a cache miss if you're pointer chasing so in most cases there should be no effect on performance.

<comment><USER43> No, OpenBSD randomizes symbols on kernel and some libraries (for example libc). This randomization is done on boot.

From [https://www.openbsd.org/innovations.html](https://www.openbsd.org/innovations.html):

> Library order randomization: In rc(8), re-link libc.so, libcrypto, and ld.so > on startup, placing the objects in a random order. Theo de Raadt and Robert > Peichaer, May 2016, enabled by default since OpenBSD 6.0 and 6.2.

and

> Kernel relinking at boot: the .o files of the kernel are relinked in random > order from a link-kit, before every reboot. This provides substantial > interior randomization in the kernel's text and data segments for layout and > relative branches/calls. Basically a unique address space for each kernel > boot, similar to the userland fork+exec model described above but for the > kernel. Theo de Raadt, June 2017.

</comment></comment></comment></comment><comment> ur-whale How is NVidia GPU support on OpenBSD? Will OpenBSD run GPU-accelerated TensorFlow or Torch?

<comment><USER44> OpenBSD is written by OpenBSD devs for OpenBSD devs. Generally, if you're the only dev who wants it then it's up to you to do it. If you let it go stale then there's a good chance it'll be removed.

</comment></comment><comment><USER45> How is OpenBSD performance these days?

<comment><USER19> Plenty serviceable as a desktop. That said, I run pretty lightweight software. As with most OSs, an SSD is recommended. I made sure to pick out hardware knowing it would be compatible; that might be the bigger issue.

<comment><USER46> If your operating system needs an SSD than you need a better operating system.

<comment><USER6> It runs on Luna-88k and people use it.

</comment></comment></comment></comment><comment><USER47> >If you install a library, there is no split between library and header files. There is no zlib-dev package as an addition to zlib. You get everything at once.

And that's good?

<comment><USER48> well, it's what happens if you actually install a package from source, and so is congruent with what it really means to 'install <package X>'

seems preferable to accepting arbitrary segmentation of packages into subsets based on some random package maintainers preference..

also, it's not 1993 and having 100kb of headers on my system is not really a big deal.

<comment><USER49> But at the same time there are modern general purpose systems (Alpine in particular, and Debian when it comes to GNU documentation) that wouldn't even install documentation together with software. Priorities seem to vary quite a bit.

<comment><USER50> That's a red herring. Debian's problems with such documentation were largely the licences that it comes under, often requiring doco to be separately packaged so that it could be placed in the "non-free" section. It is not omitted by default _because it is doco_. It is omitted by default because the Debian people do not classify it as free content.

</comment></comment></comment></comment><comment><USER30> Last time I tried the full disk encyrption [sic] it was an awful setup compared to Linux.

> [https://why-openbsd.rocks/fact/meltdown-spectre/](https://why- > openbsd.rocks/fact/meltdown-spectre/)

Uh, yeah. They did that, just like Linux did before them. I especially like the reply to the announcement that was "uh… I hope you didn't spend these two months coming up with that solution. We already did that for Linux, so you could have just asked".

<comment><USER51> > They did that, just like Linux did before them. I especially like the reply > to the announcement that was "uh… I hope you didn't spend these two months > coming up with that solution. We already did that for Linux, so you could > have just asked".

Linux developers were told about meltdown/spectre right away, but OpenBSD wasn't told until the end of the embargo over two months later.

[https://www.itwire.com/security/81338-handling-of-cpu-bug- di...](https://www.itwire.com/security/81338-handling-of-cpu-bug-disclosure- incredibly-bad-openbsd-s-de-raadt.html)

<comment><USER30> I think you misunderstood my whole point.

It appears that OpenBSD chose to spend months starting from scratch researching exactly what needed to be mapped in virtual memory, instead of just confirming the x86/x64 platform needs that were already researched and published by that time.

I'm not talking about the two months (or whatever it was) Linux had as head start. I'm talking about the post-publication ~two months.</comment></comment></comment>


Anon Bringing Down Facebook - <AUTHOR> https://twitter.com/#!/YourAnonNews/status/162344704229392384

<comment><USER2> I noticed slow (>2 minute) load times for about a 5 minutes period, but now it's responding quickly again

</comment><comment><USER3> no it's not

</comment><comment><USER4> I just logged on to my Facebook account, and it's working fine on my end.</comment>


Ask YC: How do you authenticate users? - <AUTHOR>

I've seen various sites use OpenID, Google, MS Passport, Yahoo, Facebook, and/or other third-party systems to authenticate users. Anyone here using one of those? <comment><USER2> I asked this question a while back and got some good info. Check out the PDF link provided by mdakin after the jump:

<http://news.ycombinator.org/item?id=51422>

</comment><comment><USER3> Django authentication middleware. It's really, really easy -- like everything in Django.

<comment><USER4> If you're looking at Python frameworks - TurboGears also has built in Identity Management.

[http://docs.turbogears.org/1.0/IdentityManagement?action=sho...](http://docs.turbogears.org/1.0/IdentityManagement?action=show&redirect=1.0%2FIdentityManagment)

Then there is the AuthKit extension for Pylons. Although I really like Pylons, I had some problems getting AuthKit working with the latest version.

</comment></comment><comment><USER5> I don't see why anyone would use most of those unless they needed to authenticate users with a third party in order to use their API. Using OpenID as the primary way of authenticating users unnecessarily complicates the UI. Offering it as an option, especially the dynamic way Intense Debate does it, can work well. Using one of the other authentication systems when you're not trying to get data from that third party will just confuse the user. Why is this random website trying to sign me into Yahoo?

</comment><comment><USER6> Just plain-old username and password. Before launch I'll experiment with running everything over SSL, but it might turn out to be too much overhead for a bunch of tiny AJAX requests. If so, then I'll keep the session in cleartext but do secure login by implementing DH key exchange in JS.

<comment><USER7> Shock! Horror! Diffie-hellman in javascript is a really bad idea. Javascript would be unbearably slow for the size numbers you'd have to work with for a good implementation of DH, if it could even represent numbers that large. From <http://www.howtocreate.co.uk/tutorials/javascript/security:> "The problem is that in order to prevent brute force cracking techniques, these require the browser to handle numbers as high as 2x10^600 or higher. JavaScript is just not natively capable of working with numbers as high as this."

Why reinvent a great and secure technology like SSL? The overhead of SSL would pale in comparison to rolling your own DH in JS.

<comment><USER8> Not only that, but to implement diffie-hellman key agreement correctly you have to authenticate the exchange in some way. This is usually done with cryptographic signatures and that means implementing at least one other number theory algorithm with even more slow big integer exponentiation.

<comment><USER6> DH without authentication still fends off a large class of attackers. Spoofing IPs is hard. Typing 'tcpdump' is easy.

</comment></comment></comment></comment><comment><USER9> We use Django as well. Plus, authentication is sort of inherent in our startup by its very nature, so even that isn't needed. I couldn't really say more than that, but if I explained it, you'd understand.

</comment><comment><USER10> i suggest you wait till Thursday to see what OpenSocial has to offer.

</comment><comment><USER11> OpenID</comment>


GMail's Report Spam Button is Worthless  - <AUTHOR> http://forfraksake.com/post/61873623/gmail-report-spam

<comment><USER2> What's the deal with For Frak's Sake's "GMail's Report Spam Button is Worthless" article? Is it just me or does that article do absolutely nothing to articulate any of the problems with GMail's service, only calling it "worthless" because in his/her own experience it doesn't appear to be doing anything, even though it's one of the most effective spam blockers on a free email service to date?</comment>


Ask HN: I'm bored at work and life, what should I do? - <AUTHOR> I'm a little at a lost and could use some advice. I realize that I'm very fortunate and this is probably a problem of privilege, so I hate to lament the situation.
Truth be told, I'm really bored in my career and trajectory in life.
I'm in my early 20s, full-time software Dev, making decent pay, living on my own, with finances that are all stable (students loans, car, etc).
However, I'm just bored out of my mind at work. The work is uninspiring and projects have no direction. In my weekly journal session, I'm noticing that work is the lowest part of my week; which sucks cause it's 40 hours of boredom. The though of doing this for even another year makes me frustrated.
Outside of work, I spend time hacking side projects with the hope of turning something into a profitable business (so I can work for myself).
I also do sports during the week and try to go out regularly. Those are usually my bursts of short lived excitement.
I know I am extremely goal oriented and need something to look to for accomplishment. I feel like I need one of three things to happen:
1. Find work that has more value creation (I would probably love teaching if it paid more) 2. Work on solutions that solve actual real-world problems with a visible impact. 3. Start my own business and be more dedicated to growing it to how I see fit.
Anyone have any suggestions? Should I just accept things how they are? <comment><USER2> Look for a new job (possibly in a new city). That is the lowest risk way to change your world. If you interview, you may find that your current jobs has benefits you were blind to.

Another alternative that I pursued was taking a sabbatical. If you have the means, take a few months and travel. If you want to do some work, here are two organizations that can help with that:

[https://wwoof.net/](https://wwoof.net/) (farming work)

[https://www.bunac.org](https://www.bunac.org) (short term work visas)

</comment><comment><USER3> Just an option: learn to like your job.

You can try to turn the mundane into micro challenges. Can you build a script to automate those TPS reports?

Whatever your task, how can you make it more interesting? Take the final product from an 8 to a 10.

Go watch a dude perfect video on YouTube, those guys are the masters of taking trivial things and making them interesting. Basically, do the IT version of that.

</comment><comment><USER4> You're probably a really smart person. There are many problems in the world that need solutions:

Figure out the solution to boredom and share it with h others in your situation.

Or

Share your dev talents with non-technical entrepreneurs who are desperate to find a dev to work with.

Or

Figure out what really makes you excited and happy and do that.

</comment><comment><USER5> Have kids. You won't have time to be bored.

<comment><USER6> I approved this message.Now, i only had 25-30min for to do my own web development,which i meant,i do it on daily commuter,MRT XD</comment></comment>


FB agrees to share with judges identity of French users suspected of hate speech - <AUTHOR> https://www.reuters.com/article/us-france-tech-exclusive-idUSKCN1TQ1TJ <comment><USER2> Finally some actions…</comment>


Good Morning Creativity - <AUTHOR> http://tech.li/2011/12/good-morning-creativity/

<comment><USER2> Thanks to everyone for checking out my article! I am an entrepreneur passionate about the spirit of an entrepreneur. We have some great stories coming out this week and hope you find them useful. Thank you again to everyone.</comment>


If We Were In A Simulation - <AUTHOR> https://medium.com/@cabada/we-are-nothing-but-its-awesome-fa2da116c2fc#.554j6o9ms <comment><USER2> The why of the simulation is an interesting question. One hypothesis:

\+ NIs and AIs will always try to find ways to break through glass ceilings of intelligence. They are driven by a never fulfilled thirst for knowledge and engrained with a curiosity instinct.

\+ An AI will immediately run simulations and set breakpoints on processes that undergo complexity transformations.

In other words, we might almost have been spotted. As soon as we build silicon AI the simulation will stop.

It explains why we have not been contacted by aliens too. :-)</comment>


Introducing AWS OpsWorks, a Powerful AWS Application Management Solution - <AUTHOR> http://www.allthingsdistributed.com/2013/02/aws-opsworks.html

<comment><USER2> Does anyone have pointers to a good comparison between puppet and chef?

It'd pretty interesting to also know why Amazon went with chef first.

<comment><USER3> here is my view on the topic [http://devopsanywhere.blogspot.it/2011/10/puppet-vs-chef- fig...](http://devopsanywhere.blogspot.it/2011/10/puppet-vs-chef-fight.html)

<comment><USER4> "Chef's Data Bags are incredibly useful." Very true. Not having to deal with a DSL (which is a personal opinion) is the reason I chose chef over puppet. Plus the IRC channel seems to be more active.

Is the AWS opswork link broken for anyone else? I tried to view their pricing/sign up, but received 404's.

<comment><USER5> I like data driven stuff. Though there's still a DSL. This is a large reason why I made <http://ansible.cc>, as I wanted the actual description of the policy to be data as well.

</comment></comment></comment></comment><comment><USER6> So... bye, bye PaaS startups?

<comment><USER7> I don't believe so! Just because I know how to handle Chef (or something else) doesn't mean I want to do it for all projects or at all times.

I will still pay for a PaaS that allows me to go on holidays without too much thinking, handle security properly, provide advice etc.

That said I believe, too, it will "up" the game of PaaS, since it certainly has elements of overlap.

<comment><USER6> True, I really appreciate the benefits of Heroku since it removes your concerns about server management altogether. OpsWorks may be more of a competition for services Engine Yard, though.</comment></comment></comment>


50 Most Innovative Companies 2014 - <AUTHOR> http://www.brw.com.au/lists/50-most-innovative-companies/2014/

<comment><AUTHOR> Not to knock Xero, but isn't it sad that Australia's most innovative company is a payroll in the cloud company?

Time to fix some of the policy problems:

[http://www.brw.com.au/p/lists/50-most-innovative- companies/2...](http://www.brw.com.au/p/lists/50-most-innovative- companies/2014/xero_tops_brw_most_innovative_companies_VphSdDpZuNRGkxPu3S4gDI)

<comment><USER2> I think getting this list from BRW, I'd take it with a grain of salt. I work at NICTA, and take a look at 3 companies that have spun out in the last year. [http://www.saludamedical.com/](http://www.saludamedical.com/) [http://ambiata.com/](http://ambiata.com/) [http://www.yuruware.com/](http://www.yuruware.com/)

What metrics did BRW use to decide who was 'Most innovative'? Saluda medical has the potential to have a massive impact on a large number of people who live with chronic pain, and they're doing it without the use of drugs.

Lots of great stuff in Australia, just not showing up on BRW.

Also, if you're interested in just what's happening from a science and technology space, another Sydney startup (not NICTA related) is doing kickstarter for science [http://thinkable.org](http://thinkable.org)</comment></comment>


Teamsters convince Congress to block driverless trucks - <AUTHOR> https://thenextweb.com/artificial-intelligence/2017/07/31/teamsters-convince-congress-to-block-driverless-trucks/?amp=1 <comment><USER2> Block driverless trucks? I can see this only working short term. Long term, the benefits of driverless trucks are too great to ignore.

I'm curious to see how long and what tactics are used to delay this inevitable technology.

Similar to how Tesla faces all sorts of issues from the traditional car dealerships.

I'm also interested to see the politicians jumping on the bandwagon talking about saving jobs as an excuse to promote this agenda.

</comment><comment><AUTHOR> With all the talk about India banning AI cars to protect jobs I believe US just banned trucks to protect Anerican jobs

</comment><comment> yc-kraln * over 10,000 pounds.

Well, they also explicitly made it legal for trucks under 10,000 pounds ;)

<comment><USER3> Hmm.. because the cost of the driver goes to zero, self driving smaller trucks might take over the entire market of trucking.</comment></comment>


Web pioneer hits critics with Lisp gauntlet - <AUTHOR> http://www.regdeveloper.co.uk/2008/02/07/lisp_arc_challenge/

<comment><USER2> _"... One view says Arc is merely an extension to Lisp - an extendable language - so its not really new at all. ..."_

And misses the point where Arcs design start point, is where McCarthy left off. [0] Nice mention of Nostro's javascript port ~

[0] <http://www.paulgraham.com/core.html>

[1] <http://arclanguage.org/item?id=1629></comment>


Docker + Joyent + OpenVPN = Bliss - <AUTHOR> http://blog.docker.io/2013/09/docker-joyent-openvpn-bliss/

<comment><USER2> I never tried Docker (looking around now), but the approach is extremely dirty for a few reasons.

1\. Process supervision should be handled in Docker (or something that is designed to do supervision), not in the `while true` loop. Idea on hanging on *.log files is terrible. Maybe there is a reason to stop the container when application stops?

2\. There must be a better way to handle docker logs of multiple programs. If not, run both instances in different containers.

3\. The thing serves configuration files to arbitrary clients that ask for them. It doesn't even log multiple downloads of the same key (though serves the private keys over SSL, which makes it hilarious on the purpose of SSL here).

Point 3 is openvpn specific and can be acceptable for example (though I am still lost why bother with SSL). However, points 1 and 2 show how to seriously misuse Docker. Either Docker or the setup is flawed (I suspect the latter).

Please do not take this article as an example how to do things in Docker. There must be better way, in more or less every step.

<comment><AUTHOR> Thanks for your feedback!

Agreed, the approach is far from perfect.

1\. Process supervision is kept very simple, because there are many other tutorials and demos out there using Supervisor and other systems. I'd love to know what is inherently wrong with using `while true` and hanging on logs. Personally, replacing Supervisor (or monit, or god, or $yourfavoriteprocessmonitor) with 3 lines of shell script is fine with me, especially as the focus is to show that Docker can now run OpenVPN.

2\. Handle multiple log streams: indeed! I considered running two separate containers, and the only reason why I didn't do it is to simplify the setup process. I also explored the other option (using two separate containers for TCP and UDP connections), and it works almost the same; it looks like:

docker run openvpn genkeys docker run -volumes-from $CID openvpn tcp docker run -volumes-from $CID openvpn udp docker run -volumes-from $CID openvpn serveconfig

Hopefully, the way the project is laid out makes it fairly trivial for someone to change it to run each openvpn process in its own container.

3\. Here again, it's a (not-so-good) trade-off. In many cases, you need something simple and straightforward to move the configuration file to the device, e.g. when the device is a phone or tablet. Downloading a combined file over HTTPS is the simplest solution I found (even if in the Android case, it is slightly crippled by the Download Manager bug). It uses SSL to prevent eavesdropping. It protects against a system which would passively record e.g. WiFi traffic. It doesn't protect against a system which would actively detect such a transfer, and immediately initiate the same transfer, before you have the opportunity to stop the `serveconfig` container. I considered adding some HTTP basic auth, but that would have required a "real" HTTP server in `serveconfig` (or to hack further with socat, but I'm already quite ashamed of the current hack, TBH).

I agree that the setup can be greatly improved (what can't?), but I disagree with "there must be better way in every step". This is certainly not the setup that you want if you have a large number of clients, or if you are in an extremely compromised network (then again, it's only a concern during key exchange), but I don't see why it can't be acceptable for 99% of the personal users out there.

</comment></comment><comment><USER3> Very nice. I do something most similar.

One tiny nitpick: you might want something like: _dhcp-option DNS 184.108.40.206_ to go with your _redirect-gateway def1_ .

This is because all of your DNS traffic will be redirected over your VPN as well. If you happened to have been assigned a local only DNS by your home router or cable/dsl provider, DNS will be broken when your VPN connects. Use a globally accessible one like 220.127.116.11 and the dhcp-option to tell openVPN to switch your DNS on connect.

</comment><comment><USER4> There has been lots of talk re ; docker lately.

I don't fully get it, but am trying to follow along. Basically, s small box you can install 1-x s-Linux software apps on, and deploy it on another machine, or inside a VM on that machine.

It's not a real box, or hardware, but a small chunk of software that essential is a pre-made .iso with whatever single, or multi-packackaged goody you desire?

I don't get, with spinning up a VPS being a few clicks, what is the advantage? Can't you make images of your VPS on amazon, or any of the other cloud providers, and save a snapshot of your config? What is the difference?

These are totally posable? Where do they get their real hardware resources from, such as RAM and drive? If I set up a LAMP server in a Docker container, allocate 50GB of memory to Apache, and drop that docker into a micro instance on Amazon, what is going to happen?

<comment><USER5> There are numerous reasons for why containerization (even containerization on- top of a vm) is a wonderful thing.

The first thing is that containers allow you to securely isolate software and its configuration without impacting that software's usage of resources the same way a vm does.

Isolation of configuration is extremely valuable here, you now have a collection of containers that aren't polluting your host system with its dependencies and configuration, now containers can inter-operate with each other over known protocols and upgrade/downgrade their configurations or software without any impact to the surrounding host system.

Security is a big one too, containerization allows you to completely isolate the permissions of the given application - if something is compromised only that one thing and its container are compromised. Fix the issue, throw away the old container, build a new one, deploy it, voila!

The second reason containers are awesome is the ability to build, test, and "deploy" your software. Your build process (if you've actually worked on it!) with Docker is now to have it part of your automated testing cycle, build cycle, and packaging cycle where when you, say, tag a release - an automated build gets kicked off that builds the whole application in a Docker image with the explicitly listed dependencies (as they may be updated!!!), if that succeeds without error then go on to automated/QA testing, if that passes then packaging as a docker image ready to be installed. You drop it on the server and you're ready to go!

[EDIT] I use a similar set-up to the author but I'm on FreeBSD; in FreeBSD we have ZFS and ezjails which provides most of the same functionality (but slightly more "cool" because of ZFS) as Docker but as a set of shell scripts, you can have certain jails start up with the host system.

I run OpenVPN, TOR, a web server with OwnCloud on it, and a few other experiments on the machine and it's a joy to be able to throw away a jail and build a new one, or create new jails whenever I want to experiment but never worry about it polluting the host system and also not worry about performance impact on my cheap hardware.

<comment><USER4> Thanks for the info, I appreciate it. Sorry about my terrible spelling and grammar. Not my day I suppose.

</comment></comment></comment><comment><USER6> I was hoping this would be a mapping between containers and zones.

<comment><USER7> I don't see how you could map containers to zones without actually porting docker to Solaris.

<comment><AUTHOR> ... That's something that I would _love_ to do once Docker has pluggable backends.

However (please don't throw stones at me if I'm wrong) I thought it wasn't possible to do "zones within zones"; did that change?

</comment></comment></comment><comment><USER8> This looks fun, but if this is the only thing you are going to be using on your extremely small Joyent VM, why waste time and complexity putting your OpenVPN setup inside Docker? Seems unnecessary.

<comment><AUTHOR> That's not the only thing I'm doing on this VM; as I pointed out, I'm consolidating lots of little hacks and projects that are running all over the place in different environments. I put each thing in its own container. Benefits:

\- I can shutdown one of those "experiments" without affecting others. \- If I want to migrate one of those things elsewhere (because it turns out to need more resources), it's already "Dockerized" (i.e. trivial to redeploy elsewhere). \- When I remove one of those things, I don't have to worry about leftover packages, dependencies, files, etc. lying around.

Otherwise it would indeed be a poor use of my time :-)

</comment></comment><comment><USER9> Funny to see this specifically w/ Joyent, the SmartOS zone gurus.

</comment><comment><USER10> > Joyent Ubuntu image comes with an "optimized kernel". It might be optimized, > but it doesn't have AUFS support, so you want to install an official Ubuntu > kernel instead

Why AUFS?

<comment><USER8> Docker currently is dependent on AUFS I believe.

<comment><USER7> y

</comment></comment></comment><comment><USER11> IPSec is one of the few instances where I have encountered consistent ( irregular ) kernel panics and when a panic ensues from a containerized app.. it is of course the 'host' kernel that is panicking. So all your containers are hosed.

I only run VPNs through virtualized kernel instances now; if they fail, the hypervisor restarts them. Nothing else affected.

<comment><AUTHOR> Fair point; but this is not using IPSec. It's using OpenVPN, which relies on TUN/TAP.

</comment></comment><comment><USER12> oh look, the daily HN spam from docker blogs

/has karma, uses it.

</comment><comment><USER13> Just trying to understand Docker and hence the question. How is it different from the HPUX or Solaris Package managers? Maybe this question itself shows my age :)

</comment><comment><USER14> What about DigitalOcean? 2x the RAM, cheaper.

<comment><USER15> A lot of the Docker commuity use DO, myself not excluded, but I'm sure jpetazzo had his reasons. Too many eggs in one basket perhaps.</comment></comment>


Ask HN: Which code editor do you use and why? - <AUTHOR> <comment><USER2> Visual Studio because i code in C# :-)

</comment><comment><USER3> sublime text; frontend dev; because it's the best</comment>


It's the (Democracy-Poisoning) Golden Age of Free Speech - <AUTHOR> https://www.wired.com/story/free-speech-issue-tech-turmoil-new-censorship/ <comment><USER2> > _John Stuart Mill's notion that a "marketplace of ideas" will elevate the > truth is flatly belied by the virality of fake news._

Wow. I think this sentence is a great example. The author makes no attempt to convince us that fake news is actually winning out over real news - they just assert it along with their primary claim in the hope that we will be carried along into both by the momentum of their article.

Yellow journalism goes back to the beginning of press freedom and lying goes back to the beginning of speech. We've had ways of combating these things for generations - ways that _can 't be used to make false statements_ \- but people have always wanted to reach over and silence their opponent through (sometimes abstract) force. The problem with that? Your opponents can sometimes do it to you, too.

<comment><USER3> I think the article spells out the problem very well. Entities can craft fake news that appeal to very specific audiences and target them so directly that the majority doesn't even know about the fake news. The message can be tweaked slightly for different audiences to push or pull them from one view to another. This is a huge problem. There is no mechanism that can verify the messages are true. It was widely reported that this is exactly what the Kushner organization did during the Trump campaign. I'm not saying Kushner created fake news, but his organization did in fact push highly targeted messages that influenced people in ways that one might consider dishonest.

It is a problem, the article lays it out. It could do better (as could I) to convince, but I find it hard to believe that someone like yourself can't convince yourself with the data available. Fake news is real, but it's not what Trump says it is.

(Fake news is real, lol)

<comment><USER4> > Fake news is real, but it's not what Trump says it is.

It's also not what this Wired author says it is.

        ===

Originally, the term "Fake News" was created by mainstream news organizations (aka old media) to denigrate all competition (legitimate or not) from social media. It was a branding campaign meant to poison the well against outside sources. Trump just turned the language against them, since he benefited from new media.

The reality is that the only thing that will work is for individuals to apply critical reading skills and evaluate the content for what it is. Big news brands don't want that, though. They want people to think "real news is us, fake news is them"

</comment></comment></comment><comment><USER5> There's a bit of amusing irony in the article due to how a lot of the article's reasoning could be enlisted against the concept of democracy itself rather than the "democracy-poisoning" free speech. Analogous to the article's concerns about how everything is "optimized for engagement," one could say that the democratic values promoted by the author "optimize for votes/reelection/contributions." The dismissal of Mill's "notion that a 'marketplace of ideas' will elevate the truth" could similarly dismiss the idea that the masses voting would elevate the best leaders or reasonable long- term policy.

The common refrain might be that it's the worst form of government except for all else that's been tried. I'd invite the author to explore similar critiques for democracy, or else to consider the idea that societal taboos against restricting free speech exist out of concern of the alternative.

</comment><comment><USER6> " _Here's how this golden age of speech actually works: In the 21st century, the capacity to spread ideas and reach an audience is no longer limited by access to expensive, centralized broadcasting infrastructure. It's limited instead by one's ability to garner and distribute attention._ "

That is probably the best description of the changes in culture since the Internet revolution began that I have read. There are no gatekeepers; instead limited attention from the audience is the bottleneck.

But on top of that, there is the next sentence:

" _And right now, the flow of the world's attention is structured, to a vast and overwhelming degree, by just a few digital platforms: Facebook, Google (which owns YouTube), and, to a lesser extent, Twitter._ "

These companies, the ones who control modern culture, do so by selling _attention,_ and do so knowingly, self-consciously. They know attention is their product and whatever that attention is currently focused on can be damned.

</comment><comment><USER7> "Why? When the human condition was marked by hunger and famine, it made perfect sense to crave condensed calories and salt. Now we live in a food glut environment, and we have few genetic, cultural, or psychological defenses against this novel threat to our health. Similarly, we have few defenses against these novel and potent threats to the ideals of democratic speech, even as we drown in more speech than ever."

In the past, mass speech was difficult, expensive, and centralized. Now it is cheap, universal, and everyone can partake -- so the limiting factor becomes the attention of the audience.

Memes that grab people's minds spread through the population, and oftentimes the most extreme and unreasonable ideas spread the most quickly, just like weeds can grow quickest first.

</comment><comment><USER8> A provocative title for what is more an opinion piece, lauding the value of Twitter, and other methods of speech communication.

</comment><comment><USER9> > Today, even the most powerful elites often cannot effectively convene the > right swath of the public to counter viral messages.

Let's imagine this was implemented. For every post on Facebook, Twitter, et al, a counter-point from the other side was included. Would this change anything?

Maybe not. The narrative right now is that the social giants are forcing people into media bubbles because this drives engagement. Including counter- points would burst the bubbles and we should expect a drop in engagement on the major social media sites. But would it lead to a drop in engagement overall? Wouldn't people still seek out the news that reinforces their pre- existing views?

The narrative should be inverted: the reason Facebook is massively popular is because it allows the masses to construct personalized bubbles. If Facebook loses it's "bubbleness" users will simply construct their bubbles on different platforms or in different ways. The space will fracture. You'll have a conservative Facebook clone, a leftist clone, a libertarian one, etc.

</comment><comment><USER10> Digital surveillance: encryption,

Attention-channeling: skepticism,

Harassment: thicker skin,

Data collection: not sharing private data,

Algorithmic decisionmaking: what's the problem?

</comment><comment> GCU-Empiricist It's always relevant to look at what the root cause of the failure state is. In a phrase it seems to be "outrage culture" relevant video: CGP Grey "This video will make you angry" www.youtube.com%2Fwatch%3Fv%3DrE3j_RHkqJc&usg=AOvVaw19LNbXnWxQ6ChEZfLZ5kGn

</comment><comment><USER11> Honestly, I think the only hope for the future is open source AI that can read and digest the vast landscape of "truth" on the internet, and help the average citizen be more informed by corroborating facts.

It's very true: no one has the time or attention span to deeply analyze everything we see/read/hear. We used to trust what was given to us, but now that's impossible.

<comment><USER5> It's hard to see how placing trust in a giant AI would solve the issue. Just offering "fact-checks" that don't deal in context leaves so much open to interpretation. The major leftist/rightist media networks do what they do not as much through blatant lying (though that happens) as with technically- defensible interpretations of factual events, selective coverage/reporting, and twists of terminology (democracy vs populism, government vs regime, article vs screed, etc). When people call upon services like fact-checkers or find individual studies to wield in argument, the goal ends up being to find mental stopsigns to be able to dismiss the opponent's argument and totem-like symbols of legitimacy to prop your own arguments up.

I don't know what the way out is, but I can't imagine externalizing our thinking/reasoning even more would be the way.

<comment><USER11> Note that I said "open source AI" with the implication that how it works is transparent, and how it is trained is transparent and verifiable.

There is simply no skirting around the fact that our brains are not equipped to deal with the astounding volumes of information being jammed through our every sense every minute of the day.</comment></comment></comment>