Confirmed: CMU Attacked Tor, Was Subpoenaed by Feds - <AUTHOR> https://motherboard.vice.com/read/carnegie-mellon-university-attacked-tor-was-subpoenaed-by-feds <comment><USER2> To me the most bizarre part of this story is the argument that this didn't constitute an unlawful search because there is no reasonable expectation of privacy for Tor users:

> [...] it is the Court's understanding that in order for a prospective user > to use the Tor network they must disclose information, including their IP > addresses [...] such a submission is made despite the understanding > communicated by the Tor Project that the Tor network has vulnerabilities and > that users might not remain anonymous. Under these circumstances Tor users > clearly lack a reasonable expectation of privacy [...]

<comment><USER3> They're giving over the information to a third party, which usually destroys any 4th amendment rights.

The fact that the third party was actually three different parties who only got a piece (or six, when using hidden services) doesn't seem like it would change the law.

If I split data into 6 pieces and handed it to 6 different people, the government can take those 6 pieces and put them together without violating my rights. I don't see why Tor would be any different.

In fact, this particular vulnerability IIRC involved the researchers acting as both the exit node and the guard node, and finding a way to pass a message between the two so they'd notice when they're in the same circuit. That seems even better legally than my analogy above. They didn't need to take any data, the victims connected to them and gave them the info.

<comment><USER4> >They're giving over the information to a third party, which usually destroys any 4th amendment rights.

Same reason that there is no need for a warrant to collect phone calls since you are handing data over to the phone companies to carry between you and the other party(ies). Also the same reason the government can shift through your mail, since the items are in the possession of a third party (you likely gave the items to the government itself).

To me this makes as much sense as the argument that since a plane carrying people can fly over you, it is perfectly reasonable to put a blimp with an extremely high zoom camera on that spies on your home constantly, detecting not just visible light, but also infrared. Also, since when you talk things vibrate, and since it is possible to view those vibrations though a window, I'm actually broadcasting my speech to the public and thus don't have any expectation of privacy.

<comment><USER5> These issues have actually been litigated in court. The broad consensus is that yes, the police can use a surveillance plane can take pictures of you without first obtaining a warrant (Florida v. Riley), but no, they can't use infrared camera to look inside your home without a warrant. (Kyllo v. United States)

None of these cases are really analogous to the Tor case. Generally speaking, you have no reasonable expectation of privacy that information that you voluntarily provide to a third party will be kept confidential. This is why the police doesn't need a warrant to get your phone records or to obtain your IP address.

You bring up mail, which is an interesting case. Conents of a sealed mail IS protected by the Fourth Amendment - it's just that the government usually relies on the "exigent circumstances" exception to the warrant requirement (basically, showing that there is probable cause to search the mail but that there is no time to obtain a warrant). The government can't just mass-open all sealed mails and look at their contents.

<comment><USER6> A helicopter with an infrared camera costs about $100.

<comment><USER7> I believe he is referring to a thermal imaging camera, which can see heat sources. They're still somewhat an expensive specialty item. The police used to use them to look for people growing marijuana in their attics, but higher courts now say that would require a warrant.

<comment><USER8> He may be, but over the last few years some models have come out with much lower prices: [http://appleinsider.com/articles/14/11/23/review-flir-one- an...](http://appleinsider.com/articles/14/11/23/review-flir-one-and-seek- bring-thermal-imaging-to-iphone)

I wouldn't be surprised if there are usable thermal imaging sensors out there for $100.

</comment></comment></comment></comment></comment></comment></comment><comment><USER9> From Tor's front page:

 _What is Tor?

Tor is free software and an open network that helps you defend against traffic analysis, a form of network surveillance that threatens personal freedom and privacy, confidential business activities and relationships, and state security._

So, if the users of a service whose explicit mission statement is to provide anonymity and privacy apparently do not have "reasonable expectation of privacy," who does? Are they going to argue next that the private owner of a wifi-capable laptop has no expectation of privacy in their own home because the webcam could be conceivably hacked and remotely activated?

<comment><USER4> Since they didn't verify all code on the laptop, and since the EULA said that they don't actually own the code, only rights to use the code, then there is no reasonable expectation of privacy using the laptop.

<comment><USER10> So anyone using a computer with any proprietary software on it has no expectation of privacy?

<comment><USER11> There is no clear line where total privacy starts and ends with technology currently available on the consumer market. Even if you don't use any proprietary software at all (which is very difficult to do for most people), your privacy could, in principle, still be compromised by the underlying hardware.

</comment></comment></comment></comment><comment><USER12> _> Jones claimed that IP addresses, and even those of Tor users, are public, and that Tor users lack a reasonable expectation of privacy._

This is an interesting judgment. Tor's purpose is to provide privacy. The fact that it may have vulnerabilities (as all software does) doesn't mean that a person using Tor doesn't expect that it will provide them with privacy.

<comment><USER13> I think you're conflating two different points. Just because providing privacy is Tor's intended purpose doesn't mean it's reasonable to assume it provides privacy in the 4th amendment sense, when it still involves sending your data to Tor nodes. The argument is that public IP's are inherently not private because you have to give that information up to a separate entity to make any sort of communication. I'd wager that's the "vulnerability" they're referencing - That you don't know who is running the Tor nodes, and by extension can't assume your IP will stay private if you're freely giving away your IP address to them.

By voluntarily giving that information up, there is no reason to expect that the Tor server you're connecting too will keep that information private anymore then a Facebook server would, even if we would like/hope that to be the case. The person who owns the Tor server is well within their rights to keep a log of every IP connected to their server.

You also have no control over the node which makes the actual connection to the outside world - In which case that server can equally log anything it wants about that connection. If the same person controls both servers and puts two-and-two together and figures out you made a connection to website X, they haven't violated your 4th amendment rights because you voluntarily gave that information up by connecting to the Tor network without checking who you were giving that information too.

Tor's intended goal is to provide privacy, but that doesn't mean it gives you a legal expectation to privacy, which I think is what they're getting at. The reality is that third-party entities that can do whatever they want with the data you voluntarily give them - The fact that they're Tor nodes doesn't change this.

<comment><USER14> I somehow doubt that if I as an individual performed these actions the government would hold back from charging me under the CFAA.

<comment><USER15> That's because you aren't backed by thousands of men in black uniforms with automatic weapons. And that's what it's _really_ about.

</comment></comment></comment></comment><comment><USER16> Why isn't the first line of the Tor EULA or info page (and I wondered the same about Lavabit email) "This software/service is intended to provide its users a reasonable expectation of privacy under US and international law." Or some such. It's unreasonable to expect every user of a tech service to understand how it all works so they can know their level of legal protection. Phone taps require a warrant even if the phone user doesn't know how switching or tapping works.

What's wrong with this idea?

<comment><USER17> (Not a lawyer but) I don't think it legally holds any water, once your data is out on the public network it's out on the public network.

It's the electronic equivalent of a sticker on your car that says "This car is intended to provide its users a reasonable expectation of privacy under US and international law."

<comment><USER18> When I make a phone call it routes through a public network. Tapping a phone is illegal due to my expectation that the call is private.

I dunno. I've seen some good arguments either way here, and I'm also not a lawyer.

</comment></comment></comment><comment><USER19> So the information was obtained by subpoena from a university research program that is federally funded.

Thinking back to the HeartBleed incident, does this set a precedent for the government to subpoena information related to private keys that may have been exposed due to a software vulnerability and recorded as part of a federally funded university security research lab investigation into said vulnerability? Given that HeartBleed was so public, the likelihood of private keys and certificates not being revoked is pretty low. But what about the next major software vulnerability that doesn't have the same publicity?

Or extrapolating even further, what about DNA that may be collected and kept by entities receiving federal funding. Say healthcare funding? Does that entitle the government to access?

</comment><comment><USER20> If you work in research like that - how can you sleep at night?

This is a real question - I haven't been able to ask someone directly involved in unmasking users like that.

<comment><USER21> From the perspective of a current CMU student: the Software Engineering Institute (SEI) here is the responsible party here. Note that they are separate from the main ("academic") school of CS. They are a federally-funded research and development center, essentially a computing-focused contractor and consultant for the DoD (see more here: [http://www.sei.cmu.edu/about/organization/workingwithanFFRDC...](http://www.sei.cmu.edu/about/organization/workingwithanFFRDC.cfm)).

So, in short, the people at the SEI sleep as well as the people at Raytheon or Lockheed Martin that build the drones, or the folks at Alcatel-Lucent who helped the NSA way back, or maybe even the guys way back at Los Alamos. It's not like some grad students or CS professor got strong-armed into doing this. It's literally their job to do this kind of work for the DoD and other government offices. While the ethics of this line of work are certainly up for debate, they knew exactly what they were getting into.

</comment></comment><comment><USER22> If you don't own the physical layer, sooner or later you're screwed. (My comment is not meant to reflect on the merits or dismerits of the particular use in question. It's a general statement.)

</comment><comment><USER23> One minor thing: consider showing motherboard.vice.com as a separate domain?

</comment><comment><USER24> Was the vulnerability made public? Was it patched?

<comment><USER2> It's covered in this blog post[1]. Some mitigations are in place now.

[1]: [https://blog.torproject.org/blog/tor-security-advisory- relay...](https://blog.torproject.org/blog/tor-security-advisory-relay-early- traffic-confirmation-attack/)

</comment></comment><comment><USER25> I must admit the description is pretty opaque for me. Can someone translate this to simple english? What "subpoena" is in this context? What most likely actually happened?

</comment><comment><USER26> I'm less interested in the courts interpretation of reasonable than why my personal liberty depends on such a subjective term. If the bill of rights is entirely subjective, it might as well say "We the people have rights.. and stuff. Y'know man?".

Note to the next framers of a constitutional republic. Include some notion of objective unit and functional tests.

<comment><USER27> You don't "have" any personal liberties. You are not born with rights, you are gifted them by a benevolent society. That society can easily lose its benevolence, and take your rights away, and there is absolutely nothing you'd be able to do about it.

You might hold a differing view, but the fact is, reality works as I've described. Delude yourself all you want, but your rights _do_ hinge on the imperfect and subjective manner in which your benevolent rulers have granted them to you.

They _have not_ granted you absolute rights, specifically laid out, but they _have_ done better than, "rights.. and stuff."

<comment><USER28> >You are not born with rights

This argument is really semantic.

The line always devolve to the tautological "the only rules of the universe are physical rules"

<comment><USER27> That's not tautological at all. Also, it's not really true. There are plenty of rules. What I'm saying is the only "unalienable" rules are the laws of the physical universe. Every other rule is a construct of society and people, and as such, is not guaranteed in the way as stated by the previous commenter.

It's just something I believe is worth keeping in mind when talking about your "right to privacy", specifically. There are many prominent public figures who actually don't believe you have that right at all, and when we remember that rights (as we're referring to them) are granted only by the grace of the state, if the members of the state don't believe you have a right, then you simply don't.

The argument here should be more about whether or not it's in the state's best interest to grant the right to privacy to its citizens, and I think there's a pretty strong argument in favor of that, but simply stating "I have a right!" doesn't illuminate that argument very much.</comment></comment></comment></comment>


Free Open Source VPN – Curve25519,ChaCha20 – WireGuard and OpenVPN - <AUTHOR> https://openinternetaccess.com/ <comment><USER2> Image logos weirdly stretched on landing page, header links reflowing strangely, same company also runs a "vanity crypto address" to "advertise your brand"?

And providing free vpn services?

Yeah, that's not sketchy _at all_....

</comment><comment><USER3> from the site:

> "Totally Free. No Strings Attached."

read as "avoid at all costs"

edit: oh boy, check out their "privacy policy" page. oh dear.

[https://openinternetaccess.com/privacy- policy.txt](https://openinternetaccess.com/privacy-policy.txt)

<comment> rlv-dan What's wrong with their privacy policy? It's clear and easy to understand for anyone.

<comment><AUTHOR> Agreed. It is the long, complex privacy policies that should make you question things.

</comment></comment></comment><comment><USER4> OpenVPN and WireGuard config pages download each other's configs.

Also, keys are invalidated weekly and behind a CAPTCHA, so good luck automating the process of getting new keys weekly.

<comment><AUTHOR> Could be automated by using a captcha service, I think just a few pennies per thousand of verifications.

</comment></comment><comment><USER5> People should be highly skeptical of "free" VPN and proxy services. They have the power to (easily) MITM you.

<comment> em-bee how so? they can track where i am connecting to, but that's about it.

<comment><USER5> They can intercept DNS, they can snoop on cert names, they can monitor any unencrypted traffic (you'd be surprised how much there is even when you think you're hitting every site with HTTPS..)

</comment></comment></comment><comment><USER6> Vancouver, WA, United States...

I guess that is where the Vanwa comes from in their name.

</comment><comment><USER7> Who are these people?</comment>


Why Apple is Trying to Kill NFC - <AUTHOR> http://blog.apptopia.com/why-apple-is-trying-to-kill-nfc/

<comment><USER2> Immensely surprised that Bluetooth 4 LE wasn't brought up in this article. The potential to replicate here, aslo triangulation possibilities is significant.

<comment><USER3> Could you elaborate on your comment a bit? I have no idea what you are referring to by "replicate" and "triangulation". (obviously i am not asking for definitions but rather what they have to do with BT4LE lol).

</comment></comment><comment><USER4> Can someone point me to some references for the following statement? I curious to read more:

      the revenue generated per active user by top apps on iOS is four
      times higher than the equivalent number on Google Play. The
      majority of publishers don't even bother to release paid versions
      of their apps on Google Play, opting to monetize using IAP and ad
      support, with the latter making up the lion's share of profits.</comment>


Ask HN: Non Americans: Do you care about SOPA? - <AUTHOR>

I understand that the people of the USA are having to fight this crazy battle with their tech-stupid, bribe taking government but what impact would this have on the rest of us?
So if SOPA passes in its current form and they start banning sites in the USA - what is to stop the rest of the world from just setting up their own new versions of websites? - free of this North Korea style censorship.
Is it the case that people in the rest of the world could really profit from this terrible (law) idea ?
Dare I say it - should we even support it? For non US entrepreneurs this law is potentially great news
Is it the case that other countries will just follow ? I really cant see a lot of European countries doing anything like this anytime soon but perhaps I'm wrong ?
Thoughts? <comment><USER2> While the threat is not so severe for us Europeans, I do fear that if the bill flies it will impact the internet as an entity. It will not just affect Americans, it will affect the world. I'm also baffled by the complete silence in our media about SOPA. 99,9% here is blissfully unaware of the beast...

</comment><comment><USER3> From a Portuguese citizen living in the Bay Area. The idea that SOPA can benefit European countries is laughable to say the least.

Everyone benefits from freedom and openness. When I started my first company in Portugal, companies like Geocities, Yahoo and Download.com enabled my startup. Today Google, AWS and Facebook enable startups all over the world.

If you think that thwarting innovation in the US can benefit some other country, you're not seeing the big picture. It's not about moving servers or people, it's about destroying the most prolific tech ecosystem in the world.

<comment><AUTHOR> I understand what you are saying and I am not trying to thwart anything. The Americans are about to thwart themselves.

My question was based around the idea that by removing themselves from being the (and I quote you)

> most prolific tech ecosystem in the world.

\- if there is anything to gain from being somewhere else in the world. I dont actually live in a European country (not sure where you got that from) and I see SOPA as potentially a way to profit and get ahead, providing replacement services to countries cut of by the 'shoot yourself in the face' mentality that the USA currently has.

By the way, I don't think this is good. But I'm an entrepreneur and we thrive on opportunity and this is a place to discuss these things no ?

</comment></comment><comment><USER4> "For non US entrepreneurs this law is potentially great news"

That would be true if other countries wouldn't use USA as a role model. The way it is now, I think this is a big problem for the world...

<comment><AUTHOR> In what way? Can you be more specific with examples ?

<comment><USER5> Australia got its own version of the DMCA, thanks to the lovely Free Trade Agreement we have with the USA.

</comment></comment></comment><comment><USER6> It disgusts me.

I wish it was practical and possible to just dump the US from the internet along with other countries that oppress their citizens freedom online.

</comment><comment><USER7> All I have to say is "lol". I'm sorry. But it's great that you just made me think of an Internet Zerg rush.

I'm an American, of course.

Dammit...

<comment><AUTHOR> Being an successful entrepreneur is not always about having the best idea first.

Its about the implementation. You guys seem keen to make it hard for yourselves so we might as well do some implementing :)

We have pretty big markets over here too you know.

<comment><USER7> In a way, it'd be like the Tower of Babel.

I'm sure if DNS in its current form were to fragment like so, English certainly would have to take a couple of steps down from the throne.

I guess the throne would have to take a step down from the altar, too.

And the altar a step down from the turtle shell.</comment></comment></comment>


The Postal Service Deserves a Permanent Bailout - <AUTHOR> https://nymag.com/intelligencer/2020/04/the-postal-service-bailout-coronavirus-covid-19-congress.html <comment><USER2> I'm in favor of a bailout, but only if mail is substantially reworked to prevent the unbelievable flood of tree-killing paper spam I get deluged with.

It absolutely depresses me to think of how many hundreds of millions of mailboxes are filled on a daily basis with unneeded paper mailings.

We need some way of imposing additional costs on mail marketing, such as required payments to people if mail arrives at their mailbox. It is mentally taxing to sift through crap mail searching for relevance.

The USPS also needs to establish some sort of official email for people with similar spam suppression requirements, so that legal or official government messaging has an appropriate destination besides "kill tree, send mail".

In the 1990s I worked on a USPS project, and the sheer size of bulk mail processing (aka junk mail) in facilities was probably 100x what the mail processing for personal letters was.

<comment><USER3> > It absolutely depresses me to think of how many hundreds of millions of > mailboxes are filled on a daily basis with unneeded paper mailings.

This is a direct function of the completely misguided (IMHO) idea that government services need to be sustainable only on usage fees. That's a failure of understanding what government is _for_ and effectively a regressive tax. We need another mechanism for keeping the system efficient. Making it market-based isn't the only one.

<comment><USER4> That would be much less of a problem if bulk mailing rates were eliminated. As for the evils of government, I hesitate to even think about what the corporate solution to the coronavirus would look like.

</comment></comment></comment><comment><USER5> Repeal the PAEA, pass a postal banking act, and fund the USPS with taxpayer dollars as is allowed by the Constitution. Seems like a no-brainer to me.

</comment><comment><USER6> I am all for bailing out USPS. But it won't be permanent. They'll have issues again, their very nature of being a government-operated institution guarantees that.

This is not the first time the USPS is in trouble. After the financial Panic of 1837, the USPS almost collapsed. Congress had to step in to help it, and by 1845 they gave USPS complete monopoly, which killed the more efficient and cheaper private mail delivery enterprises. See "America's First Great Depression" by Alasdair Roberts.

<comment><USER7> It hasn't been government-operated since 1970.

<comment><USER8> It's an independent governmental agency under the executive branch. If the USPS isn't "government operated", then neither is the CIA, FCC, or Social Security Administration.

<comment><USER6> Great reply. That's exactly what I said. Fannie Mae isn't technically government-operated - but it's a government-sponsored enterprise.

</comment></comment></comment></comment><comment><USER9> The story really should have lead with "repeal the 2006 PAEA" which imposed funding requirements given to no other business:

[https://ips-dc.org/how-congress-manufactured-a-postal-crisis...](https://ips- dc.org/how-congress-manufactured-a-postal-crisis-and-how-to-fix-it)

The USPS would have been cash-flow positive for years had it not been deliberately sabotaged by Republicans seeking to privatize it.

</comment><comment><USER10> In any business, when demand shrinks, the business has to also shrink. I don't understand the need to have 6 day/week delivery in modern times when there has been such a huge decline if mail volume. It seems to me they should have cut this down to 3 days a week, then 2, and I don't even think 1 day/week would be unreasonable for 1st class mail. But maybe that doesn't work logistically because they still have to store the mail they're not delivering (even though there isn't much of it).

Doing the package deliveries - I dunno. It seems like if there was a demand for this service, more competition would have sprung up for FedEx and UPS without the USPS needing to get involved. Then again, maybe the USPS is helping to keep shipping rates down. Hard to say what prices would be if the USPS hadn't gotten involved in package shipping, overnight delivery, etc.

</comment><comment><USER11> I mean, it's not like the US would let the USPS fail, as that'd cause so many dependent businesses and services (if nothing else, the IRS and Census forms) to fail. Unless they plan on running a free internet line to everybody's house that can have messages jammed down it very cheaply, but that seems more expensive than keeping the USPS around.

<comment><USER12> How do you vote by mail (the most secure way to vote when one cannot vote in person) without the USPS?

<comment><USER13> UPS or Fedex, shockingly, can easily deliver envelopes!

<comment><USER14> Those don't have a legal mandate to deliver to every address in the US.

<comment><USER15> The USPS doesn't deliver to every address in the US.

I lived in a place with an address but no USPS mail delivery. UPS and FedEx got there.

</comment></comment></comment></comment></comment><comment><USER16> Can they simply offer a "no ads/no bulk mail" USPS+ option? $5/month? I'd be happy to pay it. It would save a lot of processing costs and trees too.

I'm not sure what they are making more than that off my mailbox per month now though.

</comment><comment><USER17> We need to bail out the Postal Service so they can stop needing to make money on junk mail.

</comment><comment><USER18> Props for the photo caption too</comment>


Seamlessly Buy with Bitcoin using Zinc - <AUTHOR> http://blog.zincsave.com/2014/03/the-most-seamless-way-to-shop-with.html

<comment><USER2> This looks awesome, as in, too good to be true. I don't get it...who's paying the difference?

And why would you not charge for a service like this? You're providing a service people should find valuable.

EDIT: I just checked the FAQs on the website and I'm still not convinced. Coupons? Promotions? What if I already maxed out on coupon codes? What if there are no more left?

<comment><USER3> We also source from other vendors. So you may order via a Walmart checkout, but find that your item comes in a box from Target. This is the largest source of per-order savings.

<comment><USER4> I'd be so confused when that box showed up.

</comment></comment></comment><comment><USER5> I can't find the exchange rate they use. It always makes me nervous when that isn't clearly shown.

<comment><USER3> Thanks for the feedback! It is the current Coinbase SELL price: [https://coinbase.com/api/v1/prices/sell](https://coinbase.com/api/v1/prices/sell)

We'll add it to the order confirmation page soon!

</comment></comment><comment><USER6> I'm still looking for an exchange where I can buy Bitcoins simply with a Credit/Debit Card. I hurriedly read the title as:

Seamlessly Buy Bitcoin using Zinc

Missed the "with"! Anyone else wanting this? Or if it already exists, can someone point me there?

<comment><USER7> The problem with cards and Paypal is chargebacks. You can't get your coins back if someone cancels his currency transaction.

Most people don't abuse them, but a handful does, and that's enough to wreak havoc.

<comment><USER8> The only way this could ever work safely is if you partnered with a credit card company prepared to treat a record in the blockchain as sufficient proof to refuse a chargeback.

<comment><USER9> Or if you treated credit-card bitcoin purchases as options. On the surface it's not a good idea for someone to accept credit cards for bitcoins, but why can't I use my credit card to purchase BTC at the current rate for, say, April 15 delivery? Of course, now _I_ have to trust the seller to follow through, but that's a tractable problem that can be solved with either reputation-based trust or escrow services.

<comment><USER10> I like this. Do you know how long one would have to wait for chargebacks to be no longer an option?

<comment><USER8> At a minimum, chargebacks can occur months later. The chances of a fraudulent chargeback would go down the longer you waited, though the changes of a legitimate "why don't I have my product yet" chargeback would likely go up.

</comment></comment></comment></comment></comment></comment><comment><USER11> I guess when you get to a point where you have enough volume with specific retailers ( e.g., Amazon ) you can start negotiating a discounted price if you pay cash. So the savings could be sustainable at that point (potentially). I wonder how you get there though.

</comment><comment><USER12> They are even giving you money back. Awesome

</comment><comment><USER13> I was hoping this would be a payment gateway that accepts bitcoin.

</comment><comment><USER14> Is this Zinc.io that never finished?

</comment><comment><USER15> Seems too good to be true...

</comment><comment><USER16> different from what snapCard offers?

<comment><USER17> Well, for now at least, they're not charging the extra 2% that snapCard takes.

</comment></comment><comment><USER18> Doesn't seem very innovative.</comment>


Ask HN: Error reporting software - <AUTHOR>

Can anyone recommend a service that monitors your website and notifies you if any errors occur? <comment><USER2> Depends on the monitoring that you want. Nagios monitors sites to the extent that they respond with a 200, but I don't think it will tell you if some part of the page is broken.

</comment><comment> brown9-2 <http://www.pingdom.com/>

</comment><comment><AUTHOR> Ps. Thanks in advance!</comment>


5x5 version of 2048 - <AUTHOR> http://kortaggio.github.io/2048/

<comment><USER2> Quite fun! Though the game is a bit easy (only took like 10 min to beat: [http://imgur.com/AMCuaUE](http://imgur.com/AMCuaUE))</comment>


Show HN: docker-show-context shows you why `docker build` takes so long - <AUTHOR> https://github.com/pwaller/docker-show-context <comment><AUTHOR> While making this I discovered a 5x speedup of build context creation with an 18 line patch to docker :) [https://github.com/docker/docker/pull/20088](https://github.com/docker/docker/pull/20088)</comment>


Ask HN: What would you want in an IoT platform? - <AUTHOR> Hello everyone,
I work at a startup that currently provides RFID solutions for mid-market businesses. We have an in-house API that interaces with Impinj and Invengo RFID tags and readers.
I have suggested to the team that we should also use our platform to enable developers to bring IoT into their own projects. My question for the HN community is, what would you guys/gals like to see in an IoT platform? Personally, I would like easy interfacing with my Raspberry Pi, but that's the extent to my hardware expertise. <comment><USER2> Had a look at the Invengo readers, they don't look like they are affordable enough for hackers - please correct me if I'm wrong. I would love to locate affordable multi-standard RFID readers.

I would like to see a compact, cheap RFID reader that connects over PoE (both passive and IEEE 802.11af spec). The unit would only have to read tags and either send the reading over MQTT and/or support HTTP - long polling or maybe even WebSockets.

Learning yet another in-house API, interface, etc is a stumbling block. That's why I prefer MQTT, it is well proven and easy to get going. Of course, the RFID reader would need to have a web interface for setup, diagnostics.

<comment><AUTHOR> I will research more affordable RFID readers, thanks a lot for your feedback! Everyone else on the team has more knowledge about RFID in general than I do (I'm the newest guy on the team).

Hopefully, I'll be able to come back here later on this year with a beta product for people to try!

</comment></comment><comment><USER3> I'd like to see interoperability and compliance to ETSI M2M standard and W3 WoT [0] in any IoT project.

The W3 WoT CG [https://www.w3.org/community/wot/](https://www.w3.org/community/wot/) does a lot of work here which is still ongoing and community participation is needed and welcome (especially around security & privacy).

[0] [https://github.com/w3c/web-of-things- framework](https://github.com/w3c/web-of-things-framework)

<comment><AUTHOR> I've never heard of this framework, but it looks/sounds awesome. Thanks for sharing!

</comment></comment><comment><USER4> A cool IoT product that I'd like to see is maybe a decent dedicated dashboard (this may exist but I don't know about it).

I want a simple dashboard for viewing (optionally interacting) with IoT devices, SOAP, REST, MQTT, uPnP..

It could also have features like maps, graphs, and charts for data that are simple to integrate (expl. provide a ressource URI, or drag-and-drop,...)

<comment><AUTHOR> I'm the one creating the front-end so I can personally guarantee that the dashboards will look awesome.</comment></comment>


PostgreSQL 9.4 Released - <AUTHOR> http://www.postgresql.org/about/news/1557/ <comment><USER3> Like every year before, the Postgres team has blessed us with an early christmas present. And like every release post before, I'd like to use this opportunity to say thanks to the team for the awesome job they are doing year after year.

It's not just the database itself (and that's awesome on its own right), but it's also all the peripheral stuff: The documentation is seriously amazing and very complete, the tools that come with the database are really good too (like psql which I still prefer to the various UIs out there).

Code-wise, I would recommend anybody to have a look at their git repo and the way how they write commit-messages: They are a pleasure to read and really explain what's going on. If everybody wrote commit messages like this, we'd be in a much better place what code-archeology is concerned.

Patches from the community are always patiently reviewed and, contrary to many other projects, even new contributors are not really required to have a thick skin nor flame retardant suits. The only thing required is a lot of patience as the level of quality required for a patch to go in is very, very high.

Finally, there's #postgresql on Freenode where core developers spend their time patiently helping people in need of support. Some questions could be solved by spending 30 seconds in the (as I said: excellent) manual and some of them point to really obscure issues, but no matter what time it is: Somebody in #postgresql is there to help you.

I think there's no other free software project out there that just gets everything right: Very friendly community, awesome documentation, awesome tools, and of course and awesome product offering to begin with.

Huge thanks to everybody involved.

Also: Huge YAY for jsonb - I have many, many things in mind I can use that for and I have been looking forward to this for a year now.

<comment><USER4> > we'd be in a much better place what code-archaeology is concerned.

This sounds like a great setup for a sci-fi novel. 500 years into the future, the infrastructure their distant ancestors coded has begun to fail. Now Biff Miffington, code-archaeologist, must sift through millions of forgotten messages using a mysterious tool remembered only as "git." Its interface is arcane and the remaining messages broken, tainted by the destructive influence of Mountain Dew and Cheetos. Will he unravel the mystery that's causing Candy Crush Saga MCCXXXI to kill its users?

Edit: On what OP actually said, I'd also like to say that Postgres is an awesome product.

<comment><USER5> Testing the waters, I'd played with the idea of a story with basically this setup:

Two new developers start at a company/startup, and are brought in to do a six- month sprint to fix a stalled/broken product after the development team becomes unavailable because _reasons_. So, they're dropped into a codebase and are trying to pull everything together.

However, as they work through into deeper and deeper parts of the system, the commit messages and comments get more and more cryptic and unsettling, hinting at the reasons for the prior team's dissolution, the business forces that caused that to happen, and maybe something worse/better going on outside.

I'm really lazy though. :(

<comment><USER6> >after the development team becomes unavailable because reasons.

Every member of the programming team was attacked and killed by wolves in unrelated incidents on the same night.

And they said it couldn't happen...

</comment></comment></comment></comment><comment><USER7> Just want to say to the PostgreSQL and EnterpriseDB guys that it's always great to see the progress on this. My hopes for 9.5/10 is that we will see PLV8 and Replication baked into the actual release.

PLV8 is such a natural fit with the new JSON(B) types that it's probably going to become the most used extension with that data type... And imho sorely missing from the out of the box experience. I'm glad that they've concentrated on getting the data structure and storage right first. Hopefully we'll see this in vNext.

As to replication, I understand that this is part of EnterpriseDB's business model, just the same not having the basic replication pieces baked in, is still lacking compared to other databases. Even if the graphical tooling was commercial only, and all the knob frobbing via config or command line is more complex, having it in the box is a must imho. I actually really like how MongoDB handles their replica sets, and where RethinkDB is going with this as well. Though they aren't transactional SQL databases primarily, it's a must have feature these days. Replication with automagic failover is a feature that has gone past enterprise-only.

One last piece, would be if there were built in functions similar to the String.prototype.normalize that was added to JavaScript... so that input strings could be normalized easier for comparison/indexing, though PLV8 support could/would bring this readily.

All the same, thanks for all of your hard work, and I look forward to the future of PostgreSQL.

<comment><USER8> Yes, replication with auto failover is far away from enterprice-only today. If you pay 5$/month you can get a SQL Database in Azure running on 3 nodes with auto failover. One node is synchronous and the second one is async updated. I wouldnt choose a database today unless setting up somerhing like that is obvious and trivial.

</comment></comment><comment><USER9> JSONB is getting a lot of attention (and deservedly so) but logical decoding is much more exciting to me. Being able to capture postgres transactions to put into a durable log (like Kafka) for downstream processing is a fundamental tool needed to build a unified logging architecture. If you've worked with hadoop you've probably tried to approximate this by hand by taking regular snapshots of your database or something, but this is much, much more sane. Really exciting. Great work postgres team!

</comment><comment><USER10> Looking forward to when we move to 9.4 so I can start using "sum(foo) FILTER (WHERE bar)" instead of the ugly "sum(CASE WHEN bar THEN foo END)".

<comment><USER11> Wow, that's fantastic. My queries are littered with that type of construct. Unfortunately, we are using SQL Server and Microsoft hardly ever makes any developer-friendly enhancements to T-SQL.

<comment><USER7> True enough... I can't even begin to wrap my head around the XML wrangling functions in T-SQL, I feel like a n00b copying JS methods for jQuery when I go there. That said, it's probably one of the easiest RDBMS servers to administrate for small-medium sized deployments.

</comment></comment></comment><comment><USER12> Switched over to PostgreSQL for a personal project for the json datatype. Great if you want some mongo-esque document storage without losing out on having a relational database.

[http://clarkdave.net/2013/06/what-can-you-do-with- postgresql...](http://clarkdave.net/2013/06/what-can-you-do-with-postgresql- and-json/)

<comment><USER13> That info is for PostgreSQL 9.3 (and 9.2). 9.4 comes with other enhancements if you're using json. jsonb in particular opens up whole new possibilities if you're doing heavier work with json data.

</comment></comment><comment><USER14> Next year I really need to switch from MSSQL to Postgres. The work that the Postgres team have done in the last 2-3 years is really amazing.

They are also clearly reaping the benefits of some very smart architectural decisions, and that gives me the confidence that they will be able to continue innovating in the coming years.

<comment><USER15> If only there were a way to run performant Postgres on Windows. Maybe it's time learn Hyper-V so I can run it in a Linux VM.

<comment><USER16> That's close to what I'm doing, except running FreeBSD 10.1 in Hyper-V. It's actually pretty easy to set up since FBSD 10.1 is available for download as a VHD. Just need to specify the VHD image file as the disk to attach when creating a new HV VM.

It's somewhat more fun/challenging to configure network access for the VM. Once that's done it's very handy for developing web servers/apps. With the web server running in the VM, the client/browser on the host points to the VM just like any remote site. PostgreSQL in the VM performs quite well.

IMO this kind of development is much more satisfactory in a unix environment than under Windows and Hyper-V provides a convenient way to get there.

</comment></comment></comment><comment><USER17> It looks like PostgreSQL is on track to slowly succeed MySQL as the de-facto open source database.

Microsoft tentatively seems to be settling on them as the preferred RDBMS for non-Windows platforms [1]:

> Within ASP.NET 5 our primary focus is on SQL Server, and then PostgreSQL to > support the standard Mac/Linux environment.

I use EF+SQL Server and they're very much complementary and provide an excellent developer experience. NHibernate+SQL Server is woeful unless you want to use the loosely-typed Criteria stuff. NH's LINQ provider is terrible and it gets confused at the drop of a hat (call Distinct and _then_ OrderBy? "I'm sorry Dave, I'm afraid I can't do that"). At this point I'm convinced only MS know how to write LINQ providers that won't fall over the moment you try to do something useful with them.

Microsoft writing a LINQ provider for PgSql is a great thing for running .NET code on non-Windows platforms.

[1] [http://blogs.msdn.com/b/adonet/archive/2014/12/02/ef7-priori...](http://blogs.msdn.com/b/adonet/archive/2014/12/02/ef7-priorities- focus-and-initial-release.aspx)

<comment><USER18> > At this point I'm convinced only MS know how to write LINQ providers that > won't fall over the moment you try to do something useful with them.

I would argue Revenj + Postgres provide much better developer experience. But as you said, it's not written by Microsoft so that attitude doesn't help it out.

I'm 100% sure Microsoft can't write LINQ provider which actually understands Postgres and can use it to the fullest (as Revenj can).

<comment><USER19> The problem with Revenj is that it seems to tied to dsl-platform, which looks like an online service. People would rather to have their compiler tools with them. You don't want your code investments to go 'poof' should the online service fails.

<comment><USER18> While that's a fair criticism (to have compiler offline), dsl-platform can be licensed for an offline use.

It's not like Revenj needs dsl-platform, but rather that dsl-platform integrates into Revenj.

So to make it blunt, would you try/use Revenj if it had part of dsl-platform compilers available for offline use?

<comment><USER19> It's a surprise to me that RevenJ can be used without dsl-platform because the readme makes it look like it is dependent on dsl-platform.

Yes, i would try dsl-platform if it's available offline. Online compilers are pretty much deal breakers for me.

</comment></comment></comment></comment></comment><comment><USER20> I'm really pumped about the update to GIN indexes, and the ability to concurrently update materialized views. Both enhancements are huge for the postgres ecosystem, and especially for productionizing postgres databases.

</comment><comment><USER21> Postgres is about to be the new hotness. I mentioned to our hosting provider that we were looking into moving our in-house Oracle and MySQL to Postgres (off Oracle because it's expensive, off MySQL 'cos it's shit) and he said more than a few customers were looking into this precise move.

We're just getting into PG now, and it's just _really nice_ to set up and use. I really wish more web stuff properly supported PG and didn't pretty much require MySQL.

</comment><comment><USER22> Congratulations to the PostgreSQL team for continuously supporting and improving what is in my mind the best all-round database server out there.

</comment><comment><USER23> EFF launches an iconic case and PG 9.4 on the same day? This is probably the best day in the year and its not even christmas yet.

</comment><comment><USER24> Did PostgreSQL just kill MongoDB?

<comment><USER25> No.

<comment><USER26> You're right, lots of amateur-hour developers might still be using mongodb

<comment><USER25> Yep. MySQL isn't dead yet, either. :-)

I'm not familiar enough with MongoDB (or Postgres 9.4) to really answer the original question. My guess is that Mongo will still be applicable to certain use-cases, but—like you mention—the majority of users will be those who really don't understand the technologies and their strengths/weaknesses.

</comment></comment></comment></comment><comment><USER27> There are a lot of things that have changed since my first programming job, back in 1997. Things that I still use and love: Postgres, and Emacs.

</comment><comment><USER28> Is there an equivalent to the MySQL handlersocket stuff in postgresql?

[http://www.percona.com/doc/percona- server/5.5/performance/ha...](http://www.percona.com/doc/percona- server/5.5/performance/handlersocket.html)

[http://www.slideshare.net/akirahiguchi/handlersocket-2010062...](http://www.slideshare.net/akirahiguchi/handlersocket-20100629en-5698215)

It might go against the "no transaction" crowd, but seems useful for performance-critical needs. I'm scheduling a bit of testing time with it next week to see if it's something I'd roll out in production (Maria 10 system)

</comment><comment><USER29> I really wish someone would update these benchmarks to the latest releases of Scientifc Linux, FreeBSD & Dragonfly

[http://www.dragonflybsd.org/performance/](http://www.dragonflybsd.org/performance/)

</comment><comment><USER30> With JSONB here, JSONPath starts to become very interesting...

[http://goessner.net/articles/JsonPath/](http://goessner.net/articles/JsonPath/)

[http://blog.redfin.com/devblog/2012/03/json_in_postgres.html](http://blog.redfin.com/devblog/2012/03/json_in_postgres.html)

That article was written before JSON/JSONB showed up, but the idea remains the same.

I didn't have plv8 installed, so I did some plumbing code in plpython. plv8 would be more suitable though.

[https://github.com/jvinet/pg-jsonpath](https://github.com/jvinet/pg-jsonpath)

</comment><comment><USER31> Bye bye MongoDB.

<comment><USER32> How do you cluster in postgresql? Serious question, my prefer noSQL is cassandra and clustering is pretty easy.

I ask this question every year and postgresql have not deliver this. If there is any, there are hardly any documentation on it.

<comment><USER33> Clustering is really, really hard.

Cassandra is one of the better ones out there, but you have to deal with its data model and weird consistency promises (which however weird you think they are, are weirder)

The correct way to cluster also changes dramatically depending on your use case. Sure there are things like RAC that promise to make it just work, but those don't scale more than a few nodes.

Mongo is kind of the worst in this - it clusters in one weird way, has bad tooling, and subtly destroys your data at scale.

The general philosophy with postgres is to do it right, or not do it. There are ways to do specific kinds of clustering, but all of them (just like mongo, oracle, etc) have a lot of nuances to them.

If you have a natural shard key, use a bunch of schemas and table inheritance, and eat the downtime during re-shards. Check out citus as well. They have their issues, but they can help you hook up what you need.

<comment><USER34> > Cassandra is one of the better ones out there

I take it you haven't actually used Cassandra much in the last few years. It's data model is almost identical to a typical relational one and it's consistency promises are quite clear:

[http://www.datastax.com/documentation/cql/3.0/cql/aboutCQL.h...](http://www.datastax.com/documentation/cql/3.0/cql/aboutCQL.html)

And I've scaled Cassandra clusters from 1 to 100 nodes in hours with no issues. It really is quite simple. Likewise have had no issues with MongoDB replica sets. It is definitely not "really, really hard".

> postgres is to do it right, or not do it

What a pathetic cop out. PostgreSQL has been around for decades they've had plenty of time to have a proven, stable solution implemented.

<comment><USER33> Cassandra avoids some of the really visible issues by being AP instead of CP. Hbase hits them, but dodges a bit by only having row level consistency. They are solving very different problems.

The lack of vector clocks in Cassandra can lead to some very non-intuitive (possible wrong) behavior - check out their counter implementation for some rage on that. It's pretty well made though, and I think C*, Hbase and Postgres all have great uses (along with Redis, and a lot of others)

Mongo tends to get things subtly wrong in ways that corrupt data, or that don't scale, and it gives up both A and C.

</comment></comment></comment></comment></comment><comment><USER35> Great news! I'd love to move over to this from MongoDB for a project that has high uptime requirements. But while I think the JSON will really replace it, does PG have a solution for High Availability (like replica sets) in the works?

I'm newer to Postgres so am not sure. Replica Sets are the killer feature for me, more so than just storing JSON documents. I'd appreciate if someone can chime in. I've done some googling but there seem to be multiple strategies for replication.

<comment><USER36> PG has async/sync/hybrid replication for years already. It's not as tooled as MongoDB but there's some tools like [http://www.repmgr.org/](http://www.repmgr.org/) to amend it.

<comment><USER8> Every time I look into tools like this they are quite far behind for example AlwaysOn in MSSQL. For example, with PG I have to reseed the original master if it comes back online after an outage. It's as far as I can tell not fully automatic and transparent to me as the guy responsible for managing it. With SQL and elasticsearch+ZooKeeper for example nodes can go up and down without anyone noticing it and me not having to do anything. Is this still a place where PG is behind?

<comment><USER37> Yes and no. There are differences in the data guarantees that something like elastic search and postgresql give. So it's not really appropriate to compare those.

MS SQL does have easier tooling for replication. The setup for postrgresql is complex and it doesn't come with out of the box tools to easily manage failover and recovery as you mention. Progress is being made in making this easier, but it's still mostly in the low level functionality:

[https://wiki.postgresql.org/wiki/What%27s_new_in_PostgreSQL_...](https://wiki.postgresql.org/wiki/What%27s_new_in_PostgreSQL_9.4#Replication_improvements)

[https://wiki.postgresql.org/wiki/What%27s_new_in_PostgreSQL_...](https://wiki.postgresql.org/wiki/What%27s_new_in_PostgreSQL_9.3#Replication_Improvements)

</comment></comment></comment></comment><comment><USER38> Full notes here:

[http://www.postgresql.org/docs/9.4/static/release-9-4.html](http://www.postgresql.org/docs/9.4/static/release-9-4.html)

My favourite parts:

Allow views to be automatically updated even if they contain some non- updatable columns

Allow control over whether INSERTs and UPDATEs can add rows to an auto- updatable view that would not appear in the view. This is controlled with the new CREATE VIEW clause WITH CHECK OPTION.

Allow security barrier views to be automatically updatable

</comment><comment><USER39> Whats a good place to suggest a postgresql [json] improvement, my message was intercepted when posting to pg-performance. A major one at the moment is that offset does the select projection on discarded rows (common to use offset in paging), under normal circumstances this isn't a problem, however when does a json operation such as reading a field ->> this causes major performance degrading. Note of course only immutable functions can this optimization apply. There are several workarounds but if PostgreSQL wants to win back some nosql heads it should be straight forward.

In addition to update a json field isn't straight forward, these operations should be supported by first class inbuilt functions.

Its getting close but its not quite a nosql killer yet if they are targetting people who didn't originally come from rdbms background..

</comment><comment><USER40> How long till someone creates a library with the mongo api?

<comment><USER41> Actually ... [https://github.com/umitanuki/mongres](https://github.com/umitanuki/mongres)

</comment></comment><comment><AUTHOR> Are there any good books coming out that cover Postgres 9.4? I know the docs are okay but I want something with more of a narrative structure as my history with Postgres is spotty. The only one I've found so far is O'Reilly's "PostgreSQL: Up and Running, 2nd Edition" coming out this month but would prefer a personal rec.

<comment><USER42> I have O'Reilly's "PostgreSQL: Up and Running, 2nd Edition" (You can buy the ebook already) and it's mostly about setting it up and administering postgres and a look at the tools around postgres. It's not a book that goes in depth on actually on how to write SQL for postgres, although it has a secton on this, or develop applications with postgres. It's more of an ops book. Anyway, I like it because coming from MySQL I was unfamiliar with how to set up and use postgres and this book set me straight.

<comment><AUTHOR> Thanks to Safari, I'm now several chapters into the book and it's perfect for me - thanks :) It was the ops side of things that was the biggest sticking point for me, although it seems like it'll dig into the JSONB stuff later on too.

</comment></comment></comment><comment><USER43> Quick question regarding JSONB:

Is attribute order stable? Obviously, order is not preserved, but if the order changes on subsequent accesses, this causes problems if you ever serve content directly from a jsonb field without sorting the attributes manually.

<comment><USER44> Why would this cause problems? Order is irrelevant in JSON. "An object is an unordered set of name/value pairs."[0] From a there is absolutely no difference between {"name": "Patrick", "age": 24} and {"age": 24, "name": "Patrick"}.

[0] [http://json.org/](http://json.org/)

EDIT: Well, now four of us have replied at the same time saying the same thing, I'd say this topic is now well covered.

<comment><USER45> Sometimes it matters whether serialization to a string is a deterministic function. If the JSON is the same, you want the output to be the same. A JSON parser won't care, but it's useful to do a string comparison without parsing (for example when diffing output).

<comment><USER46> But that's not really a correct thing to expect is it? If an object is an unordered set of name/value pairs then multiple serialized versions of the object may indeed be the same object data.

<comment><USER45> It's not something you can assume, but sorting the keys is sometimes a desirable feature in a JSON serializer. (Just like pretty-printing is.)

<comment><USER47> AFAIK the default serializer does not guarantee the order to be stable, but I haven't participated in the development of this feature that closely. So maybe I'm wrong.

Anyway, it should be possible to write a simple serializer on your own - <USER2> trivial PL/V8 function should suffice, I guess. And then you can define a CAST using that function (but generally adding casts is a bit dangerous, as it may have unexpected consequences).

</comment></comment></comment></comment></comment></comment><comment><USER48> I am pretty happy about the addition of ALTER SYSTEM. I haven't tried it yet, but I think it will make automatic failover to a standby easier to implement. Does anyone have experience with this?

</comment><comment><USER49> Even though rails hides it from me, I honestly don't mind directly working with the SQL interface on this db, and it's language interfaces are awesome. Thanks, team.

</comment><comment><USER50> So when can we expect AWS RDS to support it? :)

<comment><USER51> Not trying to be mean but, why wait? If you're stuck on AWS it's not impossible (though difficult and annoying certainly) to get a decently- performant Postgres instance going. The experience setting it up will lessen the vendor-lock that Amazon has on you (convenience always has a price).

<comment><USER52> Outside observer: Man, I figure setting up a "decently performing" Postgres instance on AWS would be such a common thing to do that it would either be known to be impossible, or have cookie-cutter instructions, if not a script. How is it that it's "difficult and annoying" still?

Not trolling, genuinely curious :)

<comment><USER53> It isn't "difficult and annoying" anymore, it used to be before SSD backed EBS and/or provisioned IOPS because you had to RAID0 together a dozen or so magnetic EBS volumes to get decent disk performance and then deal with the annoyance of sorting out a way to take consistent snapshots of the RAID array for backups.

Now you can just toss a single 1TB SSD backed EBS volume on an instance and get ~3k iops, or use provisioned iops to get almost any performance level you need.

<comment><USER54> That performs decently now?

I got scared off using EBS a few years ago and use only the ephemeral storage + failovers.

<comment><USER51> Regardless of whether they're backed by SSD, all EBS volumes on an instance sit behind a 1 Gbps pipe (except for the more exotic and expensive instance types). That's part of the reason why Amazon talks about IOPs instead of raw disk bandwidth.

Go ahead and run:

      $ sudo du -hs /*

..on a vanilla m3.* instance and run iotop in a different session. You'll see bandwidth numbers that 2002 would be embarrassed about.

<comment><USER55> Bandwidth available for EBS volumes varies. For instance, with EBS-optimized volumes it can be 500Mbps, 1Gbps, 2Gbps, or 10Gbps, depending on the instance type, as shown in this chart from an Amazon presentation:

[http://cl.ly/image/440b142t0T1x/Screen%20Shot%202014-12-18%2...](http://cl.ly/image/440b142t0T1x/Screen%20Shot%202014-12-18%20at%2013.16.23.png)

The "NA" of the 8xlarge instance types is because there's no ebs-optimization as an optional feature on that instance type; you automatically get access to 10Gbps.

Here's a video of the whole talk: [https://www.youtube.com/watch?v=3OH4-Hx3tlE](https://www.youtube.com/watch?v=3OH4-Hx3tlE)

Here's the slides: [http://www.slideshare.net/AmazonWebServices/stg302-28617072](http://www.slideshare.net/AmazonWebServices/stg302-28617072)

</comment></comment></comment></comment></comment></comment></comment><comment><USER56> Anyone has a performance benchmark and/or has experience on the scalability on this version?

<comment><USER47> That really depends on what version you're using now, and what exactly you mean by scalability.

If you're using 9.1 or older, you may see a significant improvement in OLTP workloads on many-core machines (making it linearly scalable to >64 CPUs). This happened in 9.2 (i.e. ~2 years ago).

The main improvement in 9.4 I'm aware of is the GIN fastscan, which significantly improves performance of applications using GIN indexes (e.g. full-text).

Of course, there are many other performance improvements on various places - the principle is not to make the new version slower.

Some interesting numbers were presented in this talk at pgconf.eu 2014, including 9.4 beta (but there should be no significant differences): [http://www.slideshare.net/fuzzycz/performance- archaeology-40...](http://www.slideshare.net/fuzzycz/performance- archaeology-40583681)

</comment></comment><comment><USER57> Best news I've heard all week. Awesome. Time to update my servers :D

</comment><comment><USER58> we currently use 9.4 beta, and it's been rock solid for us. We chose it because of the jsonb data type. JSONB has been a great fit for the type of work that we needed it to do.

</comment><comment><USER59> I just recently began using PostgreSQL albiet an older version. Does this 9.4 mean that MongoDB is now pretty much a dud? Being able to store, manipulate, query JSON data AND have SQL on a established wheel that have been proven reliable and polished far longer than the age of most other databases?

Are there any code examples (preferably Python) that show how to use JSONB? I'd love to see some examples on how to query every record that contains a key in a json, or order rows based on a value in a json object.

off topic: If Meteor.js implements PostgreSQL 9.4 I would seriously consider using it again. That and maybe make DDP scalable.

<comment><USER47> I'm not a big fan of MongoDB, but I don't think the introduction of JSONB in PostgreSQL 9.4 makes it a dud (which does not mean MongoDB is not a dud for other reasons).

JSONB allows you to do a lot of things that people are often doing with MongoDB (or document databases in general), but there are still some features not available in PostgreSQL. Built-in sharding, for example. There are external tools to do that with PostgreSQL, and I do have my doubts about MongoDB (partially because I only hear about the horror stories), and I expect similar features in PostgreSQL 9.5 / 9.6, but at the moment it's not there.

Not sure what you mean by Python examples - you can either fetch the data as 'text' and convert it in the application (e.g. json.loads) or just use psycopg2 with an adapter ([http://initd.org/psycopg/docs/extras.html](http://initd.org/psycopg/docs/extras.html)) and you'll get the data as Python dictionaries.

The best source of examples is the official documentation ([http://www.postgresql.org/docs/9.4/static/datatype- json.html](http://www.postgresql.org/docs/9.4/static/datatype-json.html)) and the "NoSQL on ACID" training from Bruce Momjian and Thom Brown ([https://wiki.postgresql.org/images/d/de/NoSQL_training_- _pgc...](https://wiki.postgresql.org/images/d/de/NoSQL_training_- _pgconf.eu.pdf)).

</comment></comment><comment><USER60> What a joke. There's not even a working MySQL => Postgres 9.4 migration tool that works. Try them.

On paper, Postgres sounds great. But of all the people on here cooing about it, how many are actually using the tool?

I don't know who has the stronger hype machine on Hacker News: Postgres or Rust.

<comment><USER47> We certainly are. We're operating an analytical service operated on PostgreSQL - tens of TBs of data, hundreds of machines, tens of thousands of clients. Initially it was running on MySQL, but because of various reasons we migrated to PostgreSQL ~3y ago and never regretted that.

The reasons were both technical (better performance with this kind of workload, great reliability, excellent code quality, ...) and political (we have contributed numerous patches to PostgreSQL - not sure if you ever tried to do that with MySQL).

If you think there's a simple MySQL -> PostgreSQL migration tool (or a migration between arbitrary databases), you're foolish. Databases are not that interchangeable - all databases have some issues with specific workaround, and the 'good bits' are database-specific too. And those things are anchored in the application code, so if you think there's a simple migration tool, you'll be disappointed.</comment></comment>


Instagram for Babies? Seriously? - <AUTHOR> http://piicaboo.com

<comment><USER2> Why wouldn't someone just use Instagram and take pictures of their babies?

<comment><AUTHOR> I agree. But it seems like it would be a great niche. kinda like a virtual timeline of your child's life. I could see baby/kid brands signing up on the service.

<comment><USER2> Hmm.. I guess you are right. I suppose there will always be a market for "X for Y". Take successful "general" product and specialize it.

<comment><AUTHOR> Yep. Could be interesting.</comment></comment></comment></comment>


Need career advice: which job should I take? - <AUTHOR> Throwaway account and I've tried to avoid giving details of specific companies.  Here's my situation:
I have two job offers in front of me, both for startups in NY.  I am a software engineer that has been working in the industry for about 5 years.
#1
Very early stage, seed-funded start-up.  I would be joining along with two or three other engineers.  My role wouldn't be as clearly defined as in #2; I would be working with this founding team to build out the product.
The company is building something in the social media space (which I'm not crazy about).  I have some doubts about the viability of the idea and the future prospects of this company.  However, the founders are both impressive guys who I would like to work with.  One is a successful entrepreneur with one previous exit, and the other is a very strong engineer with a really impressive resume.  They have expressed to me the intent to hire a really strong engineering team, and I believe they will.
Opportunity would probably have me growing into new areas/technologies.  I would be apart of building something from the ground up.
#2
Also early-stage start-up, but slightly further along.  Was founded < 1yr ago and the business is already picking up speed.  They are looking to do Series A in the coming months.
The company is in the FinTech world and is also a consumer-focused product.  I would be joining the team to own a specific part of the platform and have a role/title that makes this very well-defined.
The team is about 5 engineers already.  The founders have backgrounds in finance; two of them are previous entrepreneurs with successful exits as well.
This job is paying about 10% more than the second.
<comment></comment><comment></comment><comment>-
The equity stake I would receive is the same percent of each company.  Which job should I take?  Which job will be better for my career long term? </comment><comment><USER2> > building something in the social media space (which I'm not crazy about). I > have some doubts about the viability of the idea and the future prospects of > this company.

Being able to buy into the company's near/long term vision is vital for start- up life. That vision gives you juice!

Areas to consider-- which role will provide greater career leverage 24-36 months from now? Which role will truly stretch you professionally?

</comment><comment><USER3> I would go with second offer. Looks to be an overall better deal, especially if youbare not hyped about social media stuff. I consider these bubble companies. Everyone living ofd eqch other's platforms, integrating services and offering little that is fresh or truly useful.

Fintech is solid. Wish I worked there.

</comment><comment><USER4> The finance domain, esp. in NYC, puts you on a much higher lifetime income trajectory.

If the role is well defined, that means you know how to succeed. If the tech is modern and sought after (and it damn well better be at a startup), that will position you well for your next job.

Biggest concern is if you think #2 has a weak engineering team and that with just 5 years exp. you'd be the strongest engineer with nobody to learn from. That would be a red flag. Otherwise, seems like a clear win.

</comment><comment><USER5> In my opinion it depends partly how your finances look at the moment. If you're scraping by then, assuming all else is equal, I'd go for the money. That said if money isn't an issue for whatever reason then I would go for the job which is most interesting for you. Which job has a role more focused on your interests or plans?

Where ever you work you'll learn new skills even if some environments promote it a little more. You also have free time if there is a specific skill set you want to master.

<comment><AUTHOR> Thanks for this advice. In either case I'd be paid enough to be comfortable, but I wonder if passing up the pay bump will put me further behind in my career. I'd like to get to the pay level in job #2, and I fear working at #1 will slow down my progress toward that salary.

On the other hand, I think job #1 will have more interesting challenges (building out a new product from scratch), but I don't like the space or business as much (social media).

Nothing about this choice seems easy or straightforward to me and I'm so worried about making the wrong decision and regretting this.

<comment><USER5> Personally I'd probably go for job #1 with the more interesting and challenging work. If the work truly is challenging then you should be able to build a strong skill set that will enable you to move onto #2-esque opportunities in the future. You should also take other things into consideration, do you get better benefits (you're in the states so health care should of importance to you), time off, et al...

Which team do you prefer, remember you will spend a lot of time with them, make sure you get along. You mentioned a "strong engineer"; from what you've said I guess you plan to learn from him. If that is the case then make sure you get along well with him in particular. Can you contact people who have worked with them before? Find out what they're truly like...

</comment></comment></comment><comment><USER6> #2 sounds like a safer / better bet to me. They're more established, they'll pay you more, you don't have doubts about their viability, and they're closer to actually turning your equity into something valuable.

#1 sounds like you just want to build some from scratch. While I understand the appeal of that, I wouldn't make a career decision based on it.

</comment><comment><USER7> Yeah, definitely the second offer!</comment>


Quick poll: Favorite VNC Server for Windows? - <AUTHOR>

Hi,
Just wondering if anyone has any recommendations for a Windows VNC Server. We've been using UltraVNC for years and it's still fine, but we've been having issues with the later versions with time outs and crashes. Does anyone have a suggestion on a stable, modern, open source VNC Server package? Preferably one that has seen serious field usage and has proven robust on many different quality network links.
Thanks! <comment><USER2> TightVNC</comment>


Houdini Engine Indie Edition - <AUTHOR> https://www.sidefx.com/industries/virtual-reality/ <comment><AUTHOR> Does anyone know how this compares to blender for beginners?</comment>