Generics aren't ready for Go - <AUTHOR> https://drewdevault.com/2019/02/18/Generics-arent-ready-for-Go.html <comment><USER2> This reads like sour grapes.

Basically, this is trying to spin "Popular language missing essential feature" into "But what if it's because they're braintstorming something EVEN BETTER???"

Well, if they're brainstorming something better, then I'll wait to use your language until you solve all the basic problems first.

Plus I think the language-obsession is usually cargo-culting and signaling. All good engineers I know use and enjoy several languages. The hipster/all- talk/buzzword engineers are the ones who insist on prototyping garbage in a new language every 6 weeks and dropping it entirely thereafter.

<comment><USER3> >Popular language missing essential feature

But is it an essential feature? I've written a lot of Go code and I'm perfectly fine without generics. It makes my code a lot simpler, no need to abstract everything into Thing<OtherThing implementing Stuff, YetOtherThing<Thingie implementing This or That>>. By the way, C doesn't have generics.

If you really need generics that badly for your use-case, nothing stops you from using another language.

<comment><USER4> Bringing up C invokes my suspicions about this debate: It's really people with totally different use cases talking past each other.

C doesn't have generics. Java has extremely limited generics. In both cases, it means that it's annoying and difficult for me to write a decent math library. I have to choose among making it support only one numeric type, implementing many copies by hand (one for each numeric type), or using some sort of ugly code generation tool - who knows what in Java, the preprocessor in C - to implement all those copies.

Which might not be a problem for everyone, but, for my use case, it's annoying.

(Deliberately avoiding the "generic library of data structures" use case because, while generics are what brought that to most of us ( _edit - in the world of static typing_ ), it would appear that Go's handling that case just fine without them.)

<comment><USER3> I'd say either resort to code generation or pick another language that fits better your use-case.

<comment><USER4> Yeah, sorry if I wasn't being clear. That's pretty much the line I was thinking along.

It's perfectly fine for Go's answer to be, "Go doesn't have generics because generics aren't needed to solve the kinds of problems Go is designed for solving, and we are _not_ trying to be a kitchen sink language here. If generics are something you need, please pick a language that's designed to solve the problems that you're trying to solve."

But that's a far cry from what TFA said. TFA read more to me as, "Go doesn't have generics because generic programming is a half-baked idea that isn't ready for prime time."

<comment><USER4> Or, to throw a third option one out there -- "Go doesn't have generics because they would interact poorly with some other aspect of the language." That works, too.

For example, it's why F# continues not to have ad-hoc polymorphism, despite many users clamoring for it. I'm inclined to agree with the project's maintainers on the subject. As useful a thing as it is, and as glaring as it is for a modern descendant of ML not to have it, it's hard to see how it could be added without creating all sorts of language warts.

<comment><USER5> Both F# and C# can do ad-hoc polymorphism - I use it in my language-ext library [1], the library is C# but the principle is the same for F#. It's not idiomatic (or pretty), but it's possible if needed. Higher-kinds is the killer missing feature.

[1] [https://github.com/louthy/language-ext#ad-hoc- polymorphism](https://github.com/louthy/language-ext#ad-hoc-polymorphism)

</comment></comment></comment></comment></comment></comment></comment><comment><USER6> > Go strikes me as one of the most conservative programming languages > available today. It's small and simple, and every detail is carefully > thought out.

This article is wrong in many ways, but I thought I'd point out this particular one. There are many really weird warts in Go, in fact its about average in "wartiness". Here is one example [https://dave.cheney.net/2017/08/09/typed-nils-in- go-2](https://dave.cheney.net/2017/08/09/typed-nils-in-go-2)

Go biggest advantage isn't the language, its the decent documentation and standard library design. The language is a bit mediocre. I wish the Go community accepted this and moved on - a mediocre language with good documentation and well done standard library is still an acceptable contender since so many other languages get those two wrong.

<comment><USER7> Sucks for you, considered very good by plenty of other people who use it daily.

<comment><USER8> I use Go daily and I agree with the general sentiment that it's a janky language full of warts and could really benefit from features like generics.

<comment><USER7> Maybe go back to java or c++? I'd rather have less people complain about a feature I don't want in the language.

<comment><USER9> Just curious: why don't you want generics in Go?

The language already uses them for Arrays, Maps and Slices, plus a lot of code relies on runtime-typed ad-hoc generics with interface{}.

It's not as if Go is a language without warts... there's a lot of ugly stuff, like Iota, Reflection, the error handling, interface{} itself.

This is a legitimate question, btw. Legitimately looking for other points of view

<comment><USER10> Keep in mind that many golang programmers just parrot what the golang authors say, without fully understanding it or even realizing the golang authors are wrong (not saying that's the case in this specific instance).

They hear the golang authors complain about Java, that it's the only way to do things, so they think that the only other solution is to go the extreme opposite way, not even looking at real modern languages (which golang isn't) like Kotlin or even C# for instance.

It's very evident that the golang authors have no experience designing language, and didn't look in depth at what other languages did.

<comment><USER7> Unfortunately I am not parroting. If you are used to read code, and you read c++, you will see that templates are abused. No generics force devs to make their code clearer and thus more secure.

It is evident that Go is a better language than most thanks to the creators having deep experience in that domain.

<comment><USER9> They aren't abused in C#, Java, Haskell, OCaml and other languages. Honestly, picking C++ as an example of traditional generic usage is a bit disingenuous.

<comment><USER11> I think generics in C# are really well executed and solve a lot of problems in C#'s problem domain.

I do think you're on the right track that go's designers are pushing back hard on what they see as feature abuse in C++ and Java. C++ abuses templates and has dozens of ways to do anything that also don't interact with each other well. Java abuses inheritance, abstractions, and OOP.

go uses generics under the hood, probably the designers fear that generic's will also get abused if released into the wild. On the other hand I've never heard anyone bitch about well designed generics in other languages. Which is a tell since people will bitch about anything and everything.

<comment><USER9> > I do think you're on the right track that go's designers are pushing back > hard on what they see as feature abuse in C++ and Java

Now that you mention it, I can't really blame them!

> On the other hand I've never heard anyone bitch about well designed generics > in other languages. Which is a tell since people will bitch about anything > and everything.

That's my opinion as well. Generics are quite pleasant, simple and a great tool to have when they're well designed.

</comment></comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER12> It's weird seeing all this post-hoc rationalising when there is a perfect explanation for why go doesn't have generics:

Rob Pike didn't bother to look into any of the research into type theory and programming language technology. Hence his understanding of types were restricted to Java and C++ and similar (whose type systems are an abomination), and he could not separate subclass polymorhism with inhertance from parametric polymorhism.

        But more important, what it says is that types are the way to lift that burden. Types. Not polymorphic functions or language primitives or helpers of other kinds, but types.
        That's the detail that sticks with me.

        Programmers who come to Go from C++ and Java miss the idea of programming with types, particularly inheritance and subclassing and all that. Perhaps I'm a philistine about types but I've never found that model particularly expressive.

        My late friend Alain Fournier once told me that he considered the lowest form of academic work to be taxonomy. And you know what? Type hierarchies are just that.

[https://commandcenter.blogspot.com/2012/06/less-is- exponenti...](https://commandcenter.blogspot.com/2012/06/less-is- exponentially-more.html)

I mean he's openly contemptous of the academics who do research in his field, while wildly mistepresenting their work. But people eat that shit up, because "OMG it's Rob Pike" instead of actually discussing the underlying issues.

Yes Rob, you are a philistine when it comes to types.. (or at least were)

<comment><USER13> Or maybe the academics and type theorists are philistines about the software that runs the world and their arguments have mostly been about hand-picked toy examples?

Maybe Mr. Pike actually has some well-deserved reputation when it comes to real-world software and engineering projects that are about handling large scale data in real time?

<comment><USER14> >about the software that runs the world

Software that runs the world utilizes parametric polymorphysm in C++, Java, Ada, D, Swift, OCaml, Haskell etc, hell, even C [1].

I also tend to consider some mission critical Ada/C++ software a real engineering, not some webshit.

[1] [https://github.com/jiixyj/libebur128/blob/master/ebur128/ebu...](https://github.com/jiixyj/libebur128/blob/master/ebur128/ebur128.c#L610)

<comment><USER13> And [1] actually makes a point that we don't need language support for every imaginable use case (maybe not even Generics). It's not a problem to work around a "missing" feature, sometimes.

</comment></comment></comment></comment><comment><USER15> As a physicist I find out of context references to physics pretty annoying. No go modules are not like a grand unified theory, nor is any other go package management solution like general relativity.

<comment><USER4> Just enjoy that these kinds of references give you so much latitude for interpretation.

For example, in the absence of any practical exposition demonstrating that the module system solves problems that other systems don't, you can quite comfortably (and cynically, sure, but please let me have my fun) choose to interpret the analogy along these lines: General relativity is well- established, reasonably well-understood, and is essential to making a sizable chunk of the modern world (e.g., GPS) work. Whereas nobody's been able to demonstrate a working GUT yet, so currently its main practical use is as fodder for books and TV specials.

</comment></comment><comment><USER16> Maybe a Go programmer can enlighten me - without generics, how can you have data structures implementations that can contain more than one type? Do you have to have one linked list implementation for every type in your program? Do you have to abandon type checking by using an equivalent of void pointers? Or is the type system smart enough that you'd never need generics in the first place?

<comment><USER17> First go does have generics. It just doesn't have user defined generics.

But to answer your question go has really mediocre support for a wide variety of problems. Some that burn me a lot is support for future/promises and support for modern lock free algorithms.

So you end up either writing non-optimal replacements, losing type safety or in some case code generation is used.

<comment><USER3> >Some that burn me a lot is support for future/promises

This doesn't make sense in Go. Nothing is asynchronous in Go, everything is blocking. You use goroutines to execute multiple tasks at the same time. That's a big part of what makes Go simple: it's a lot easier to understand sequential code than spaghetti callbacks and promises (it's somewhat similar to async/await in the JavaScript world).

<comment><USER18> Yeah, and that's why Go code is a spaghetti of communicating via channels, rather than callbacks.

<comment><USER19> Go channels are very handy and magnitude of less spaghetti than futures. And goroutines have good performance.

I think people are used to futures etc, that's why the new concept feels strange.

I think the goroutines and channels are the biggest features which compensates for generics.

</comment></comment></comment></comment></comment><comment><USER20> > The constraints imposed by the lack of generics (and other things Go lacks) > breed creativity

Uhg such programming language Stockholm syndrome. You could apply this fallacy to any feature. The lack of modules and a performant garbage collector also bred creative solutions in previous Go releases, but that doesn't mean that adding those was a bad idea.

<comment><USER3> As said in the article, solutions to these problems have now been implemented. These solutions _feel_ very Go-ish. Modules are an elegant solution. Adding them was a good idea.

Until we find an elegant solution for the generics issue, it's better not to have them.

</comment></comment><comment><USER21> _> Have you ever seen someone write something to the effect of "I would use Go, but I need generics"? Perhaps we can infer from this that many of the people who are pining after generics in Go are not, in fact, Go users._

This is the sort non-adhominem adhominem attack that makes these debates so tedious.

Obviously, someone deciding not to use Go for lack of generics after giving it a serious try would end up not being a Go user. Does that invalidate their opinion?

The logic of this argument is strikingly cult-like. Any criticism coming from non-adherents is automatically disregarded on the basis of it coming from non- adherents.

<comment><USER22> In addition there are plenty of people who _do_ use Go yet still criticise its lack of generics. But apparently these are not "real" Go users?

</comment></comment><comment><USER23> This article highlights very well why designing a programming language without generics is a mistake. Adding it after the fact is not trivial, especially if you have high standards wrt simplicity and non-redundancy.

<comment><USER13> You're implying that there is a better design that has generics and caters to the same programmer folks. But you don't show what that design is. The OP didn't imply there was one.

<comment><USER10> D, Rust, C#, ML, Delphi, etc.

<comment><USER13> I haven't used all the other ones, but "Delphi" really made me crack up. I used it for 6 months before I quit my job. It's a mess, junk after junk added on a pile of junk, only surpassing the junk-adding badness of C++ by also having this broken standard library that's somehow required to write any type of software (because the simplest thing, C-like pointers, exist but are really not nice to work with).

The task that lead to my decision to quit was to write a data serialization systems for datastructure that I didn't know in which version of junk they were expressed, by interfacing with the broken standard library. The serialization system was to replace another serialization system that somehow didn't quite work. No wonder, it was broken code, and I couldn't see a way to write non-broken code to solve an unsolveable problem.

What's nice about Delphi is that the compiler is quick and it has a beginner- friendly IDE with a visual GUI creator (no selling point for me). That's about it, AFAICT.

<comment><USER10> I was referring to generics systems that don't suck.

</comment></comment></comment></comment></comment><comment><USER4> I realize I'm not the audience here, but still -- As someone who isn't terribly familiar with Go, most of what I'm seeing in this article is the shady corners I can't see into.

The generics one, I've seen plenty of pixels spilled on, and I've come to accept that I won't really grok the debate unless I spend some serious time programming in Go. What about the module system, though? Can anyone explain or share an article on what's so great about its module system?

<comment><USER7> Exactly. If you can't get rid of your favorite paradigm (which seems to be generics for some reason in this thread) then I guess stick with the language you are already using and don't try to wrap your head around other languages?

</comment></comment><comment><USER24> An algorithm or data structure may be applied to various types of data. There's various ways to handle this. Macro expansion, generics (basically equivalent of macro expansion but as a language syntax), or losing types: void pointers, duck typing, interfaces.

Go puts it's head in the sand and and handles the problem like it's 1970 with the "void pointer" way of thinking. That's fine if you're using a dynamic language (ie python, lisp) and firmly decided your trade offs with regards to types and performance. But if you elect to use a statically typed language, it would be nice to reap the benefits.

Modern C++ is still the only way to go for serious software. Rust maybe in the future as the compilers improve. Go is a no no-go.

<comment><USER13> I don't speak from experience with Go, but a simple type assertion at an interface boundary should normally not be noticeable at all. Where performance matters, there you usually do not have parameteric types or similar. Have you measured anything?

</comment></comment><comment><USER2> I don't understand how not having generics is at all acceptable. But maybe that's because I come from a functional programming perspective.

<comment><USER25> It's because Go is a brutalist hipster language - simplicity above utility. Forget a lack of generics, you don't even get proper error messages.

<comment><USER13> Is "hipster" a label you would like to apply to e.g. Russ Cox? Maybe the designers of Go have design goals that are different than what you have in mind. Maybe they don't see it as "simplicity vs utility", but more as "utility through simplicity".

<comment><USER25> "Hipster: A person who follows the latest trends and fashions, especially those regarded as being _outside the cultural mainstream_."

Yep. Go is a hipster language, even if you don't like it.

<comment><USER13> "The latest trends"? To me Go is particularly conservative.

I don't feel like arguing over a word that has become essentially meaningless over time, but I think you have seriously misunderstood what _hipster_ means or was once supposed to mean. Either that, or you don't really know about Go and are just judging it by its marketing's design aesthetics (Gopher, fonts etc. following a trendy googley style).

<comment><USER25> Go is trendy and Go is outside of the mainstream in it's minimalist design choices. Are you trying to say that Go is not in fashion and has made mainstream language choices?

I think you're just upset about the choice of the word hipster but as with all words it's a shortcut to actual meaning. It was intended with a hint of playfulness and not intended to make you feel bad, even if you don't agree with the choice of word.

<comment><USER13> > Are you trying to say that Go is not in fashion and has made mainstream > language choices?

I can't even understand how you can be constructing such a statement. "In fashion" and "mainstream" are pretty synonymous to me. In consequence, the statement is contradictory. Hence, No, I am clearly not trying to say that.

> I think you're just upset about the choice of the word hipster

No I'm saying that the team behind Go is just really considerate and principled. They don't follow all the latest fads, simply because those fads are the reason why so many other languages suck and projects written in them become giant unmaintainable hairballs.

They are _engineers_ (label them conservative if you like). Not hipsters.

</comment></comment></comment></comment></comment></comment></comment><comment><USER26> > they feel that generics are a good fit for this language

Or that it's ludicrous for any statically typed language to not have generics.

> It's small and simple, and every detail is carefully thought out > Nearly > all of Go's features are bulletproof > my opinion are among the best > implementations of their concepts in our entire industry

Uh huh.

> You could write a book called "C++: the good parts", but consider that such > a book about Go would just be a book about Go

Or it could be one-liner: "easy concurrency".

> simplicity and elegance are now the principles I optimize for

Doesn't everyone who cares? The problem is that elegance and simplicity, like beauty, are in the eye of the beholder.

To me, generics increase elegance and simplicity.

> If you're fighting Go's lack of generics trying to do something Your Way, > you might want to step back and consider a solution to the problem which > embraces the limitations of Go instead

So pretend it's the 70s and use void* (interface{})?

</comment><comment><USER27> The way he describes Go's existing feature set as unwavering perfection is disappointing. No language is perfect except in heavily constrained context. They all make trade offs. GC is itself a compromise and so it follows that Go is not _the one true language_.

</comment><comment><USER28> Been using Go for 4 years. I totally agree. It sucks to have to use your brain to think about alternative ideas on how to do something. However, I've come across much much better solutions to my problems than I would have if Go offered a crutch to my flawed thinking.

<comment><USER29> The problem is the solution is often to make the compiler ignore types all together and use interface {} wholesale, then test interfaces with type assertions.

If Go had a least unions, it would be a bit less painful to describe a range of finite types while keeping things strictly typed in functions and methods. Unions are a limited form of type polymorphism in a garbage collected language.

<comment><USER30> I'd be disappointed if Go went for unions instead of full-on Rust-like enums, but I agree with your general point.

</comment></comment></comment><comment><USER25> I keep thinking they could add macros instead but I guess the C++ version is too much history for them to be associated with. It would basically be like code generation at compile time, except much cleaner than the current, version-specific mess of tools.

<comment><USER31> They have macros. Sort of. Search "go generate".

<comment><USER29> This isn't a macro language. It relies on an external program that the developer needs to write himself at first place. "go generate" just facilitates the execution of a third party program. It does nothing more, and doesn't even do it automatically when compiling a program.</comment></comment></comment>


High-skill green cards get lame-duck push in Congress - <AUTHOR> http://www.mercurynews.com/politics-government/ci_22054338/high-skill-green-cards-get-lame-duck-push <comment><USER2> It always annoys me that business groups are constantly lobbying for increased immigration because of a "lack of supply" of skilled labour. When there is an imbalance in supply and demand with labour we should see an increase in the incomes of those people with the skills in shortage. Instead business groups want to cheat the system and increase supply, not by paying workers more, but instead trying to import more labour, screwing the workers out of their good fortune of being on the right side of the supply and demand equation for a change.

<comment><USER3> I don't see how this would be "cheating the system". There are skilled workers out there that can't receive the income they deserve simply because of their location. Locking out foreign workers is basically geographical discrimination -- and discrimination is economically inefficient. We'd all be better off if everyone could just receive a fair market salary: no more, no less.

<comment><USER4> What you propose is feasible when labor flows as freely as capital across borders. It takes less paperwork and time to set up a bank account in a foreign bank and deposit funds into it than it does to start working in the same domicile as the foreign bank (unless one is talking about special cases like intra-EU or intra-NAFTA, and even intra-NAFTA is no picnic). If you have $0.5-1M or more to set up shop, it takes less paperwork and time to start a new business in a foreign domicile than it does to move your labor to the same domicile without the same level of capital (and in many locales, that level of capital garners you a PR card at the same time). At the moment there is asymmetric discrimination against labor mobility, and these calls for increased immigration-with-strings quotas from capital represent an even greater imbalance, hence where I suspect the "cheating the system" sentiment comes from. Cut _all_ the strings, and your fair market value would tend to emerge.

</comment></comment></comment><comment><USER5> Immigration policy in the US is ridiculous.

Why is this particular bill aimed at people with advanced degrees only? The majority of software engineers only have undergrad degrees and don't really need anything more than that. This is my case and I'm up for a wait of probably 3-4 years for an employer sponsored green card.

The green card lottery is an odd beast and frankly I think is my best bet of getting a green card (coming from a relatively low lottery program participant country of Australia).

In these issues someone always raises the "what about domestic workers?" argument, which takes one of two forms:

1\. Immigrant workers are taking jobs that domestic workers could do or could be trained to do; and

2\. The increase in supply is dampening the earning potential of those in the field.

(2) might well be true but this isn't a bad thing. Doctors in some countries are scarce because the de facto doctor's "union" seeks to constrain supply, raising the cost of health care. For example, by restricting the number of university places in medicine.

Or, in Australia, runaway capital projects have raised the cost of construction to absurdly high levels, particularly in Western Australia, such that you really can't build a house for less than $300,000 anymore. Higher construction costs raise the cost of everything. This (IMHO) could ultimately paralyze the economy.

As for (1), speaking just about software engineers, there is a worldwide shortage of competent software engineers. There are (IMHO) at least 10 times as many masquerading as software engineers. I am shocked when I see candidates with 10 years of experience who can't write a for loop in the language of their choice on a whiteboard.

Given a worldwide shortage, it's better to have as many of them as possible.

As for entrepreneurs, frankly I think states should have the right to collect a special tax (in addition to other taxes) for anyone who wants to come to the US and start their business. That tax is to cover infrastructure and government services that person uses. Let them stay on that as long as they're willing to pay and until such time as they can shift to an immigration category based on the size of their business (these categories already exist).

Also, let the spouses of H1B holders have a job. I'm an Australian and on an E3 visa (specifically for Australian professionals). One advantage of this is the E3D (spouse visa for an E3 holder) allows that spouse to work. Just FYI.

<comment><USER6> > Immigration policy in the US is ridiculous. Why is this particular bill > aimed at people with advanced degrees only? The majority of software > engineers only have undergrad degrees and don't really need anything more > than that. This is my case and I'm up for a wait of probably 3-4 years for > an employer sponsored green card.

Do you realize how easy it is to get an undergrad degree in Asia? A vast majority of undergrad degrees there are a joke. What are we going to do? Use Fizz Buzz to evaluate who is qualified to get a green card? I sympathize with you but the problem is that "advanced degrees" is essentially code word for has a degree from a U.S. university which I suspect they want.

> The green card lottery is an odd beast and frankly I think is my best bet of > getting a green card (coming from a relatively low lottery program > participant country of Australia).

Agreed. If the employment based green card was my only option, I am fairly certain I would emigrate to Canada or some other destination rather than spend 10+ years tied to an employer waiting for a Green Card.

> 2) might well be true but this isn't a bad thing. Doctors in some countries > are scarce because the de facto doctor's "union" seeks to constrain supply, > raising the cost of health care. For example, by restricting the number of > university places in medicine.

> As for (1), speaking just about software engineers, there is a worldwide > shortage of competent software engineers. There are (IMHO) at least 10 times > as many masquerading as software engineers. I am shocked when I see > candidates with 10 years of experience who can't write a for loop in the > language of their choice on a whiteboard.

I kind of agree with you but good luck getting a politician who is beholden to U.S. voters to agree to that. There are already rants about "immigrants stealing jobs" and depressing wages. Free market economics is not highly encouraged around these parts.

> Also, let the spouses of H1B holders have a job. I'm an Australian and on an > E3 visa (specifically for Australian professionals). One advantage of this > is the E3D (spouse visa for an E3 holder) allows that spouse to work. Just > FYI.

Again, there is a reason that doesn't exist. It is hackable: One person comes in through an H1B and another person gets through the system and "steals a job from a deserving American". Also, how do you handle the situation where the H1B is technically tied to one employer and another employer is somehow gaining by being able to hire their spouse? I suspect the reason it exists for Australians is the low numbers of Australians coming which means the system has been hacked (yet).

<comment><USER7> Please don't use such words as hackable when discussing immigration policies, and please try to look at the situation from the perspective of an immigrant.

I have experienced it on me and know what it's like when your wife cannot work, it's fucked up... If you're an american living in US then you will not understand how difficult it can be for the wife and husband. Look at it from another perspective: if family members are allowed to work then they 1. learn the language 2. better integrate into society 3. grow their career 4. become useful for the economy. You should also consider that wife is not husband's property (also true for the reverse case). If she's not allowed to work than she becomes overly dependent on the husband.

I mean com'on I'm so tired of this high-level discussions on immigration, these are people's lives you're talking about. Would you like to lose 5-10 year of your twenties, thirties only to obtain better visa? Would you like to be in the position when you're in a foreign country for multiple years and you cannot break up with your spouse only because of the visa, unless you're willing to go back to your "home" country that is not home to you anymore?

EDIT: My point is, if you let person into your country don't put additional barriers. If it's a family you're talking about then benchmark all the family members and then decided whether to let them in or not, don't create second class citizens.

<comment><USER6> > Please don't use such words as hackable when discussing immigration > policies, and please try to look at the situation from the perspective of an > immigrant.

I _am_ an immigrant on a visa, so yeah I do know both sides of the coin. The term "hackable" was used from the perspective of how USCIS looks at this.

> I have experienced it on me and know what it's like when your wife cannot > work, it's fucked up... If you're an american living in US then you will not > understand how difficult it can be for the wife and husband. Look at it from > another perspective: if family members are allowed to work then they 1. > learn the language 2. better integrate into society 3. grow their career 4. > become useful for the economy. You should also consider that wife is not > husband's property (also true for the reverse case). If she's not allowed to > work than she becomes overly dependent on the husband.

I am sure you may have had bad experiences and there is no doubt that the situation can be hard. Let me offer a counter perspective: I know several immigrants who come here on H1B visas with their wives on H4 visas. From what I understand, they have two options currently :

1\. Getting an F1 visa, going to school and then getting a job.

2\. Getting a company to sponsor the person for an H1B and then switching from H4 to H1B.

Both of these situations are hard, no doubt but not impossible. I personally know people who have done them. Yes, they are limited to people who have the money to go to school or the skillset to get a job as an H1B.

> I mean com'on I'm so tired of this high-level discussions on immigration, > these are people's lives you're talking about. Would you like to lose 5-10 > year of your twenties, thirties only to obtain better visa? Would you like > to be in the position when you're in a foreign country for multiple years > and you cannot break up with your spouse only because of the visa, unless > you're willing to go back to your "home" country that is not home to you > anymore?

I personally will somewhere else if I had to wait that long. I refuse to believe that my situation (Or that of any high skilled immigrant who gets paid well and lives a regular middle class life) is worse than the countless undocumented immigrants who get exploited for decades and live under the fear of deportation. I am not trying to create a false dichotomy here but consider this from the perspective of the people who make legislation: Why are highly skilled immigrants supposed to be first in line compared to any one else who comes in?

> EDIT: My point is, if you let person into your country don't put additional > barriers. If it's a family you're talking about then benchmark all the > family members and then decided whether to let them in or not, don't create > second class citizens.

I don't disagree with you in general. However, my comments were strictly from a policy perspective: The purpose of the H1B is to let people in so that they can temporarily fill a need for highly skilled labor. The rules associated with that visa are what they are.

<comment><USER7> Sure there are always workarounds and in the end spouse can always look for someone to sponsor application for working visa, but good luck with getting it if you had no or little experience. Going back to school doesn't really solve the problem of spouse being attached to the main visa holder (AFAIK education in US can be quite expensive).

What I dislike the most about H1B visa is that it is almost the only way to start working in the US which as you said aimed to temporarily fill a need for highly skilled labor. So what are the alternatives? I would be totally OK with H1B if it was limited to say 2 years with absolutely no possibility to extend it, people would not be lured to the USA with false promises of future improvement of their conditions. Last time I checked it was possible to lose H1B simply because of quota no matter how many years you've spend in the US, it's wrong.

I would like to compare it to Swiss B permit. It is very hard to get one especially because of quotas on the first time applicants, but once you have it you don't have to worry anymore. To extend it all you need is to be gainfully employed (you're not tied to your original employer). Process is rather streamlined and after 6 years you receive C permit which is similar to the green card. (disclaimer: some cantons are better some are worse, in Geneva and Zurich for example they can issue L permit instead of B which is limited to 2 years without notifying the applicant, basically you learn that you have L when it's too late...)

I understand that you were playing devils advocate in the original comment and I guess we agree on many points but there are many people that have never experienced it and cannot understand all the hardships of living in a foreign country with limited rights.

<comment><USER6> > Sure there are always workarounds and in the end spouse can always look for > someone to sponsor application for working visa, but good luck with getting > it if you had no or little experience. Going back to school doesn't really > solve the problem of spouse being attached to the main visa holder (AFAIK > education in US can be quite expensive).

OK. Let me put it across in a different way then: Why should a person with no or little experience be allowed to take a job which could potentially be used by someone who is a citizen?

> What I dislike the most about H1B visa is that it is almost the only way to > start working in the US which as you said aimed to temporarily fill a need > for highly skilled labor. So what are the alternatives? I would be totally > OK with H1B if it was limited to say 2 years with absolutely no possibility > to extend it, people would not be lured to the USA with false promises of > future improvement of their conditions. Last time I checked it was possible > to lose H1B simply because of quota no matter how many years you've spend in > the US, it's wrong.

So is your issue the time limitation itself or that time for which one can be on an H1B is two years rather than five years.

> I would like to compare it to Swiss B permit. It is very hard to get one > especially because of quotas on the first time applicants, but once you have > it you don't have to worry anymore. To extend it all you need is to be > gainfully employed (you're not tied to your original employer). Process is > rather streamlined and after 6 years you receive C permit which is similar > to the green card. (disclaimer: some cantons are better some are worse, in > Geneva and Zurich for example they can issue L permit instead of B which is > limited to 2 years without notifying the applicant, basically you learn that > you have L when it's too late...)

I agree that a better system must exist: Of late, I have come to the realization that the H1B is an evil system which is basically a form of white- collar slavery. However, it is going to be hard to build a scalable, robust system that benefits current citizens without exploiting future citizens.

<comment><USER7> > OK. Let me put it across in a different way then: Why should a person with > no or little experience be allowed to take a job which could potentially be > used by someone who is a citizen?

How is this different from an American marrying a foreigner who then receives green card and can work wherever? He/she may not have any experience and yet will take over someone else's job. On one hand we have a person with expertise that is in high demand on the other hand we have a citizen who just happened to be born on the USA soil, why should we treat their families differently? Especially that we have confirmed that the former is an asset to the economy.

<comment><USER6> You are comparing apples and oranges: The reason a foreigner who marries an American gets a green card is because it is considered to be a preliminary step for the person who by virtue of marrying a U.S. citizen to acquire citizenship. The second case is of someone who is temporarily in the United States and whose family has an even more tenuous status.

Also, a citizen has additional rights and responsibilities: E.g. voting is a right and a responsibility so is selective service. Economic productivity is only part of the civic responsibility of a citizen.

<comment><USER7> Is there another way for an experienced professional to get into the USA without going through H1B? Again please correct me AFAIK the standard path to citizenship is H1B then green card then citizenship. How many years should you spend in the country before your status changes from temporary to something else?

Anyway I respect your opinion and it certainly has merit, the only thing the I want to say is that, as you say, to prevent white collar slavery immigrants must be allowed higher mobility and their spouses independence.

</comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER8> There is very little chance of this passing the Senate or President, since it takes away the "diversity visa" and because solving the universally acceptable high-skill immigration issue reduces pressure for "comprehensive immigration reform", which is primarily about (by the numbers) Mexicans in the US, and secondarily other central and South Americans, few of whom have STEM degrees or work in tech.

</comment><comment><USER9> I'm admittedly ignorant on the details of why more tech green cards are needed.

Is there a country that does tech immigration "right" like Canadian health- care is compared to US health care?

I don't like the idea of discriminating who can be an immigrant based on what they know - or the model of what their income level is (ie. foreign corporate bigwigs get easy long term visas)

I also don't like the idea that immigration is being sponsored to get lower wage workers for the same position, how can we insure that high-tech immigrants are paid the same as a domestic worker and not being taken advantage of?

The worst problem I see with all of this is the idea that American colleges are not producing people who would be compatible for these jobs despite the millions of people who go into debt to get higher education. Maybe congress should be addressing that first and the timebomb of student loans and why college costs go up exactly based on what loans are available.

<comment><USER6> > Is there a country that does tech immigration "right" like Canadian health- > care is compared to US health care?

Erm..maybe the Canadian immigration system? They have a points based system where expertise in rare specialized skills gets you further up the value chain as far as getting a PR card. However, I am not particularly sure how robust their system is when compared to the American system and whether that setup would scale when ported here.

> I don't like the idea of discriminating who can be an immigrant based on > what they know - or the model of what their income level is (ie. foreign > corporate bigwigs get easy long term visas)

I like the diversity visa personally and don't agree with the idea that the 50K visas that make America a truly diverse nation should be poured into the pool of visas for tech ( A majority of which are really people of Indian and Chinese origin). Also, yes, I have heard of people "hacking" the visa system by coming in as corporate managers from foreign nations and easily getting green cards as "Aliens of extraordinary ability". However, you will have to understand that the U.S. is extraordinarily paranoid of the idea of people turning out to be public charges which I figure is why this discrimination exists.

> I also don't like the idea that immigration is being sponsored to get lower > wage workers for the same position, how can we insure that high-tech > immigrants are paid the same as a domestic worker and not being taken > advantage of?

Well that is interesting, because I suspect that does happen pretty significantly in the industry especially when people born in India and China are involved. The process takes multiple years and if I understand it correctly, there are points where you can't leave your job for fear of starting over and losing years in the line. This to me is a situation that is ripe for exploitation.

> The worst problem I see with all of this is the idea that American colleges > are not producing people who would be compatible for these jobs despite the > millions of people who go into debt to get higher education.

This is a societal issue. I am not sure legislation can address this. In third world countries, there is extraordinary pressure to succeed and getting an advanced degree is one of the easier ways to get into the middle class or maintain your position in it. This is important especially considering that there is literally no safety net. On the other hand, one can exist just fine either as part of the middle class or the lower middle class with a minimal skill set in the U.S.

</comment></comment><comment><USER10> Just curious, how many of the HN faithful have Master's or higher level education? I would suspect that STEM grads who'd benefit most from this would predominately 'only' have Bachelor's degrees, if that even.

<comment><USER11> The funny thing about this is it wouldn't even benefit most people who hold a non-U.S. Master's degree.

U.S. Bachelor's degrees usually take 4 years to complete, after which a U.S. Master's degree takes 2 years.

Many non-U.S. bachelor's degrees take only 3 years and as a result, the USCIS deems having a 3 year Bachelor's + 2 year Master's as being unworthy of a U.S. Master's degree, instead equating it to a U.S. Bachelor's degree.

<comment><USER12> Yep. This happened to me. And having 15 years of 100% relevant industrial experience including being a company director made no difference to visa pool I was placed in...

</comment></comment></comment><comment><USER13> "One problem, said Lofgren, is that the Republicans' swap would actually cut immigration, since there are not enough foreigners with advanced degrees who want to emigrate"

This is plain wrong, last year the H1B visa cap was reached in June. The year before in November. I applied for the H1B visa for a job in SF, two years ago, but I missed the cap by one day. Hopefully the limit will be increased this year.

</comment><comment><USER14> Wonder why they wouldnt just add 50k STEM Green Cards instead of swapping them out? Seems like posturing.

<comment><USER15> Key quote from the article:

> Republicans are "trying to pretend they're pro-immigrant by this bill, > knowing that it goes nowhere," said U.S. Rep. Zoe Lofgren, D-San Jose, the > top Democrat on the House immigration subcommittee.

I run a visa-related site so I try to follow these things closely. There actually were 3 different candidates for such a STEM visa bill. Basically the republicans are trying to pass one that the senate is unlikely to accept at this point, hoping that efforts to muster up another bill following this will be exhausted. Failing that, they'll have passed a bill that satisfies their lobbyists.

Previously, Lamar smith tried to pass a different STEM visa bill that was failed under suspension, but was backed by Apple, HP, Intel, IBM, Oracle, etc.

We'll see how this goes.

I plan to do a writeup on this soon.

</comment></comment><comment><USER16> As an outsider .. I thought the US had loads of out of work high skill programmers etc. The problem is just that companies don't want to pay them a reasonable rate, and use green carders instead?

</comment><comment><USER17> I would be curious to see what effect this has on PHD programs

<comment><USER6> On the larger scale of things it is going to be minimal. The proportion of Indians and Chinese in the PhD programs is so high and 50,000 visas is so much of a small drop in the vast ocean, that it may have a tiny effect blimp in the curve or not, considering that there are so many other latent variables that come into play.</comment></comment>


AWS IPv6 Support Update – CloudFront, WAF, S3 Transfer Acceleration - <AUTHOR> https://aws.amazon.com/blogs/aws/ipv6-support-update-cloudfront-waf-and-s3-transfer-acceleration/ <comment><USER2> Patiently waiting for any news on IPv6 for VPC-based ELBs.

I guess one could put a CloudFront distribution in front of an ELB with TTL=0 and that would sort of work for HTTP and HTTPS.

<comment><USER3> It's in beta now so hopefully soon.</comment></comment>


The Worst Act of Terrorism in San Francisco History - <AUTHOR> http://priceonomics.com/the-worst-act-of-terrorism-in-san-francisco/ <comment><USER2> Huh. It seems like the justice system has been as corrupt as it is currently for a long time.</comment>


NowServed | A resource for convenience tech services - <AUTHOR> http://www.nowserved.com

<comment><AUTHOR> Here is something that I've been putting together that I thought would be useful both for a community of practitioners but also for consumers looking to find new services to make their lives simpler.

The site and service has a lot of scope for improvement, but I just wanted to get it out there and continue to make improvements as I move forward.

Your feedback would be valuable.</comment>


Cloud Firewalls - <AUTHOR> https://www.digitalocean.com/products/cloud-firewalls/ <comment><USER3> Features like this feel like table stakes for cloud hosting in 2017, so it's nice to see DigitalOcean on board.

It'll be interesting to see what the tooling support looks like for this, it looks like it's launching with API support day one: [https://developers.digitalocean.com/documentation/v2/](https://developers.digitalocean.com/documentation/v2/) which is great. It looks like they're already working to get it into Terraform: [https://github.com/hashicorp/terraform/pull/15121](https://github.com/hashicorp/terraform/pull/15121) which is fantastic!

I look forward to the day that I can automatically spin up a DigitalOcean set of Droplets running Kubernetes using this.

<comment><USER4> >I look forward to the day that I can automatically spin up a DigitalOcean set of Droplets running Kubernetes using this

Stackpoint.io can do this, you paste your DO API key and get a k8s cluster in a few minutes. Would be nice if DO built something like that in-house.

<comment><USER5> > Would be nice if DO built something like that in-house.

Curious, why? Isn't it much nicer to keep that separate from DO so that you can move away from DO easily should there be a reason to?

I'm not sure if I'm weird this way, but one main reason we use DO and not, say, AWS is because we're afraid of vendor lock-in. The more we depend on specialized services, the harder it gets to move somewhere. I wonder whether this is a common sentiment in 2017 or whether I'm just old-fashioned.

<comment><USER4> Hosted K8s isn't much lock-in...you could move to GKE or Azure.

</comment></comment></comment></comment><comment><USER6> Isn't this just doing the same exact thing as iptables only worse since it's not transparent to the operating system?

I've created bad firewall rules by mistake many times and enforcing them transparently so the machines can't see them makes the issue almost impossible to debug and fix.

Of course I have the same gripe with AWS VPC setups I guess... I just think it's funny how the cloud keeps reinventing cloud versions of things that perform objectively worse than the original, but then everyone still uses them out of pure convenience or stupidity.

<comment><USER7> Most people don't need anything more complex than this for their firewall needs, so iptables is overkill.

Not only that, but iptables is just terrible to use and it just makes you want to kill yourself.

I've deployed a pretty standard policy now in DO with a couple of clicks, works as expected.

(And before anyone jumps, you should be using a host firewall too; defence in depth)

<comment><USER8> > Not only that, but iptables is just terrible to use and it just makes you > want to kill yourself.

I can't agree more. Luckily though, if you have some setup scripts that you reuse, you don't have to think about iptables... Until the moment that you need to make this harmless quick change that shouldn't cause any problems and you end up locking yourself out of the server somehow.

</comment></comment></comment><comment><USER9> Finally I can block all SSH access by default and only open up to 1 IP address on demand then remove when finished. No jump hosts required.

</comment><comment><USER10> DigitalOcean is killing it against Linode - I just migrated my last services off Linode because you still cannot attach arbitrary sized disks to your instances, something they've been promising as arriving "soon" for months. Go DO!

<comment><USER11> Am I the only one who has constant issues with VMs in Linode? I feel like that platform is the worst out of all the ones I've tried so far. Unfortunately, our company is stuck with it for now. :(

<comment><USER12> Disclaimer: I work there.

What kind of issues are you running into? There's a lot of issues that can happen on a server, but a lot of them are due to not enough resources or a misconfiguration.

Now, if your server is seeing constant issues on the host your server is on...

<comment><USER11> The emails we get are generally ones saying it was an issue affecting the physical hardware that the VM is hosted on, yeah. :( I tend to just ignore them now though, lol. There are only a few VMs there that are absolutely critical. Everything else is configured for HA.

<comment><USER12> That's no good, I'd like to take a look and see what's happened - <USER2> multiple hardware issues isn't necessarily normal. If you have time, please shoot a ticket our way. Mention that you spoke to Soh on Ycombinator and that I requested this ticket to be opened so we can seek out any solutions.

</comment></comment></comment></comment></comment><comment><USER13> Once they double the RAM on all plans like Linode and Vultr did, I will move all of my servers back to DigitalOcean.

I love these features but double the RAM for the same price still outweighs them.

<comment><USER14> Vultr has the cheaper side down I will admit, but their network hasn't been to great for me. It's great for development work but for production-level stuff I wouldn't put anything on it.

Linode is like that old king on the block. They've had security issues in the past (multiple) and since they do store your credit card information those did get released (If I recall). They're decent and they work. They're a bit slower than the other two in my opinion, but they work and that's something I need.

DigitalOcean has been fairly solid and reliable. Yeah you can say you get more resources for how much you spend elsewhere, but DigitalOcean has been more reliable and solid than Vultr. I mean I remember opening support tickets with them and their response being "We took care of someone else on that node. Go ahead." Took me a solid 2 hours just to install a Ubuntu image on one of their (Vultr's) storage nodes. DigitalOcean has never had to give those kinds of responses to me and overall performance and the composition of their nodes has been fairly solid and reliable.

Yeah Vultr and Linode are cheaper and you get more, but I really feel DigitalOcean is solid and more reliable than Vultr. I mean Vultr's SLA is 100% uptime, but their credit return policy is to the effects of "we'll just give you your cheap money back". I don't care about credits and I just want my service online and not having to worry about anything, and most of Vultr's answers has usually been "wait" or "we did it" (but no real long-term solution to the problem). DO has been focusing on providing long-term solutions to problems I've had and no "bs" excuses. Linode has been solid as well, but don't have many of the features DO is starting to roll out with (which fair enough, it's their decision). DO has nothing but praise from me.

<comment><USER15> Vultr has been rock solid for me for years in the Sydney region.

</comment></comment></comment><comment><USER16> Really all we (the company I work for) need now is Block Storage in LON1!

<comment><USER17> We need it for ams3

<comment><USER18> We published the roll-out schedule for Block Storage a little while back. Both LON1 and AMS3 are planned for this year: [https://blog.digitalocean.com/block- storage-comes-to-singapo...](https://blog.digitalocean.com/block-storage- comes-to-singapore/)

<comment><USER17> sweet. Is it possible to enable backups on block storage?

<comment><USER19> You can backup the volume via snapshots.

</comment></comment></comment></comment></comment><comment><USER20> Can someone clarify if the traffic between two droplets is "secure" i.e other droplets cannot see them? On AWS, I can create a VPC and put two ec2 instances on that.

<comment><USER21> I'm not expert on hypervisors but is what you're saying even possible? One would think that dispatching the correct packets to the correct VM would be an integral part of the virtualization environment.

<comment><USER22> Not an expert either, but afaik customer isolation is quite easy when you put each customer on their own VLAN (or similar) and remove the VLAN tag only after the packet has reached the virtual NIC of the customer's VM.

</comment></comment></comment><comment><USER4> They seem to be headed towards being an "AWS light". Would be nice to be have an alternative with reasonable egress costs. Still a long way to go though. At a minimum, they would need a more configurable load balancer and some S3 type function.

<comment><USER23> I would be extremely happy with DO if they put out an S3 competitor. Right now, most of my servers are on DO, the only things I need AWS for is a single windows server to run some windows only software, and S3 to store my database backups.

<comment><USER24> it's always smart to store your backups on another service anyway for any doomsday scenarios

<comment><USER25> And to double the single-points of failure? Now your "stuff" is only alive if both the virtual machine(s) are up, and the object-store is accessible!

<comment><USER23> What do you mean? It's not like if your object store becomes unavailable your database sending it's backups there will suddenly stop working.

<comment><USER25> Indeed, but if you're hosting user-images on S3 and they go away your site is broken.

That might not be a big deal, or it might mean your site is 100% broken. I can't guess, but I'd assume since you went to the effort to setup a store you need it in some way.

(No backups? Of a database? That's one power-cut, or hardware failure away from complete data loss too!)

</comment></comment></comment></comment></comment></comment><comment><USER26> So awesome. It made me giggy today to remove all droplet level iptables rules and convert them to network level Cloud Firewall rules.

Love how DigitalOcean allows you to specify droplets as sources, groups of droplets (tags) as sources, or CIDR ranges.

<comment><USER27> How do you prevent one compromised host spreading to the rest of your hosts? Shouldn't this be an added level of security rather than a replacement?

</comment></comment><comment><USER28> Is there a way to upload a list of ip addresses instead of having to paste, remove focus, re-focus over and over? I use cloud9 IDE and just for 1 region there are 90 possible IPs that they could be using to ssh into my DO box.

</comment><comment><USER29> I know this is not strictly related but how well does Digital Ocean hold under a DDoS nowadays? Are they closer to Hetzner who just blackholes your IP or OVH who can withstand virtually anything?

<comment><USER30> In my experience last year, Digital Ocean blackholes you for 24 hours, during which they don't answer support tickets.

In other words, you can take down any Digital Ocean site for 24 hours after paying $1 to a booter unless they are behind CloudFlare or some other mitigation.

<comment><USER31> DigitalOcean automatically blackholed one of my droplets due to a DDoS attack last year. They notified me immediately via email and a human responded to my support ticket within 30 minutes with technical details.

I was able to provision a new droplet right away, so the downtime was minimal. I think the way DigitalOcean handled the incident was perfectly reasonable, and was a much better experience than I've had with other cloud providers in the past.

</comment></comment></comment><comment><USER32> It's not clear what this offers over the usual iptables/firewalld + ansible solution. What am I missing?

<comment><USER33> Disclaimer: DO Support here

The traffic is blocked/allowed at our network layer before being routed to the droplet. The rules are easily configurable through the control panel and API. You can also specify Droplets (individual or tagged) and our recently new Load Balancers as the targets.

You can also layer multiple firewalls on top of one another if you want to apply specific firewall rules to only a specific set of Droplets/LBs

The Intro tutorial we have is great for details: [https://www.digitalocean.com/community/tutorials/an- introduc...](https://www.digitalocean.com/community/tutorials/an-introduction- to-digitalocean-cloud-firewalls)

Feel free to reach out to us if you have any more specific questions. :)

<comment><USER34> How many firewalls can a single user create, and how many rules can be in each firewall? How is the order of multiple firewalls applied to the same droplet determined? Where is there logging to show when a rule matched? Is there any future plan to support REJECTing packets rather than only DROPing? Will the user interface warn the user when they are about to block all traffic (including ssh) to a droplet?

<comment><USER35> (DO employee here)

The intro article answers many of these questions (and more): [https://www.digitalocean.com/community/tutorials/an- introduc...](https://www.digitalocean.com/community/tutorials/an-introduction- to-digitalocean-cloud-firewalls)

> How many firewalls can a single user create, and how many rules can be in > each firewall?

100 firewalls, 50 rules per firewall

> How is the order of multiple firewalls applied to the same droplet > determined?

The rules are all added together and applied at the same priority. Order doesn't matter.

> Where is there logging to show when a rule matched?

No logging is available.

> Is there any future plan to support REJECTing packets rather than only > DROPing?

No plans for this.

> Will the user interface warn the user when they are about to block all > traffic (including ssh) to a droplet?

There are no footgun warnings, no.

Let me know if you have more questions... thanks!

<comment><USER34> Just checking if I have this right...

> The rules are all added together and applied at the same priority. Order > doesn't matter.

If I make several firewalls, and the order of the rules when mixed results in unexpected traffic flows compared to the firewalls being applied individually, I have a bug that is hard to see, only experience during traffic as "timeout" or "not a timeout", and because of a lack of logging, no way to troubleshoot other than rewriting all the firewalls to try to remove any possibility of conflict, or writing whole new firewalls.

If I understood correctly, it's basically unsafe to mix more than one firewall per droplet, and in general a pain to troubleshoot. This is in contrast to iptables, where you can have multiple tables and chains, they follow a prescribed order, and you can mix and match them with expected results. Not to mention you can add logging whenever you need it.

<comment><USER35> It's possible you're assuming the firewalls have more rule types than they actually do. Basically these firewalls default to dropping all packets, and any rules you add are to accept a port or port range. Adding such rules together is simple and doesn't depend on order.

<comment><USER34> Oh... I hadn't quite grasped the limitations. So these "firewalls" are basically two chains with a drop policy and rules with ACCEPT jump targets, and either a source or destination. This seems to be a port whitelist rather than a firewall.

It does seem that if you create one single firewall per role, this is a simple and effective means of applying really basic port access rules to a large number of droplets at once. But by calling it a "firewall", people actually believe it replaces a real modern firewall and have actually dropped real firewalls from their droplets, making overall security worse. Not to mention the many ways you could accidentally open up or restrict more than you wanted to.

Maybe I missed something again. It says your firewalls are stateful. Are the input rule targets really "NEW,ESTABLISHED" and the output rule targets really "ESTABLISHED,RELATED" ? If they are doing connection tracking and verifying the 3way handshake before passing on the connection, I suppose this is useful to prevent syn floods that don't complete a handshake. I'd be interested to know what actual protection these firewalls give other than port whitelisting. (And yes, I see a generic icmp type is included as well as tcp & udp)

<comment><USER35> The firewalls are stateful, with connection tracking.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER36> This just made my day. Running apps on FreeBSD is awesome, but dealing with IPFW config is a nightmare.

</comment><comment><USER37> I'm trying to explain what these are to my grandmother. Any car analogies? ;)

<comment><USER38> A firewall is named for the structure in an automobile which keeps engine compartment fires out of the passenger cabin.

[https://en.wikipedia.org/wiki/Firewall_(engine)](https://en.wikipedia.org/wiki/Firewall_\(engine\))

<comment><USER39> On top of it, there are holes (ports) in the firewall to let various wires through. It would also keep road grime, rocks, etc that might be kicked up from entering the passenger compartment.</comment></comment></comment>


Working remotely... from China. Advice? - <AUTHOR>

I'm going to be working (web development) from China for the next few months. I've done this before so let me explain how I did it and then ask if anyone has any advice on how you would do it.
I frequently need access to SSH, FTP, our version control stuff (Vault... yuck), and then basic chat, email and web access. Working from China means dealing with pretty bad lag at times though that isn't a major issue as I am not dealing with video or gaming or remote desktops or anything heavy like that. I will sometimes run into the Great Firewall but have no trouble doing what the Chinese do (using anonymous proxy servers or setting up Tor) to get around such things. Tor and proxies slow things down pretty bad but they are better than nothing and are only needed occasionally as the sites I am accessing are rarely blocked. In addition to Tor and random anonymous proxies I have also tried using Hamachi. It worked to a certain extent but was eventually blocked (I suspect) by the Great Firewall and frankly, it just gives me visual access to my home desktop... something I would really rather access via SSH anyway as SSH is fast and my Unix-foo is adequate. So, that is what I have done in the past, now...
What sorts of advice do you folks have for how to work as effectively as possible from within China? I will not have access to a private company's network so that is out of the question. My access comes from the wireless I have set up in my apartment in China (Hangzhou... sweet city) or from access at Starbucks (yeah, I know... perhaps I will carry a small bottle of Massengill in my bag). So, have any of you worked from inside China? If so, where? Any practical tips you have are most appreciated as I will have a reasonably heavy workload (mostly PHP, MySQL) this summer and will want to be as efficient as possible. Thanks! <comment><USER2> huh. at my VPS hosting business, I have a lot of customers from China, several of whom run VPN tunnels out through me.

Now, I'm in the US, so I imagine you'd get better results with a server in Europe or Japan or somewhere else nearby, but I guess many of these people think saving a few bucks is worth the latency.

Now, if you have a good connection, you are probably only talking 400ms latency, which is bad but not unusable for ssh work.

If the connection is lossy or gets disconnected, you will find the 'screen' utility to be useful.

All I'm saying is tunneling through a well-connected server or vps that you control may be better than tunneling through free services.

<comment><AUTHOR> screen is one of those things I've been meaning to look at forever now. How will it help me? As opposed to, say a vanilla SSH session?

<comment><USER2> so normally, when you are connected to your remote host, and you are in vi or something, if you get disconnected it kills your vi, right? pain in the ass. If you connect to your remote server, then run screen, then run vi from within screen, if you get disconnected, vi is still running. re-connect to your server, type screen -x and you are back exactly where you were.

<comment><AUTHOR> Interesting. I'm going to give it a try, thx.

</comment></comment></comment></comment><comment><USER3> No China experience, but I rely on VPN to access remote servers. AFAIK that will allow you to access the web without problems.</comment>


Unfortunately, StackOverflow is difficult-to-avoid nowadays… - <AUTHOR> https://marc.info/?l=openbsd-misc&m=151960881910649&w=2 <comment><USER2> Looks like the case of snobbery outbreak right there. I mean, you can have issues with depth and precision and other stuff on SO answers - in any huge project, there are good things and there are bad things, and in fact there are tons of bad things you can pick out if the project is large enough. But ignoring the fact that lots of developers successfully use it to exchange information and enrich their knowledge and claiming it's just "some random site" is just ignoring the reality. And claiming "no one should be promoting SO in open source community at all" because it's imperfect just begs the question - ok, what should one be promoting instead? What is the perfect site which is as good an information source as SO and yet has none of its downsides? If this is not specified - in the same place - it just sounds as empty snobbery. SO is a practical tool, it's imperfect, it has obvious and known flaws - but dismissing it wholesale out of hand is only appropriate if one has better tool that solves the same problem, and better. So far I haven't seen any suggestions for that.

<comment><USER3> When a site is as big as SO you can never fit all the people all of the time.

1\. It's community run

2\. they make their money through legitimate means of job ads which fits perfectly

3\. the ads they do have are to community voted places eg Sheldon Brown from cycling SE

4\. It's about as transparent as you can get

5\. The people with the most points almost always really know their shit

6\. It's one of the few places on the Internet you can make yourself marketable by being helpful. I can prove my knowledge to potential companies through my answers

Or let's just all go back to Experts Exchange.

</comment></comment><comment><USER4> It all depends on how you use it. If something I make produces an error, or unexpected output, the first thing I do after the usual "stop and think" phase is google it. More often than not, that search will give me at least half a page of Stackoverflow pages - many of them completely irrelevant to my specific problem of course - but looking at the code can jog something in my mind that I wouldn't have thought of myself. It helps to look at somewhat related code. At least in my opinion.

</comment><comment><USER5> I've lost count of how many times I've googled a question, had the first hit be SO, and the top answer to the question be "Have you ever heard of Google, n00b"? (Thread locked).

<comment><USER6> I've lost track of the number of times that I've gone to a question that actually deals with what I'm looking for just to find that it's locked and marked duplicate of a completely different question. Complete pain in the ass.

<comment><USER7> Although I've encountered this as well, in most cases I got a useful answer for my problem.

I often ddg problems related to Ubuntu. I had many encounters where someone had the same problem than me on askubuntu, but the answers where unhelpful, sometimes only the question was posted with no answer at all. Or the original poster stated he solved his problem, without posting the solution. In most cases, on SO I found relief.

</comment></comment></comment><comment><USER8> I was curious, and I did a search for "deleted:1 user:me" to see if any of my posts had been deleted, and six had, almost all of them I had deleted myself. For context I have posted around 200 posts on Stack Overflow.

Being able to see deleted posts is indeed an eye-opener, and I also wish more people had this ability, but for a different reason. It makes you aware of the amount of very low quality posts that get posted to Stack Overflow, not to mention spam.

<comment><USER2> Yes, I see candidates for deletion in review queue, and most of it is either garbage or "I have this complex problem, please solve it for me after I give you the most vague description of it". Like the one I just saw recently where somebody has a huge pile of legacy Perl code and has trouble figuring it out (and that's all, no specific Perl question). I can feel their pain, but what can be done here except giving the poor soul a hug? So this kind of questions gets closed. And probably the person asking it is very frustrated, but really, what can one do here?

<comment><USER9> What about hiring an actual Perl programmer?

<comment><USER2> I've been a Perl programmer once, and I assure you given a pile of legacy Perl code, written in a good old style with good old "everything accesses everything", no comments and clever use of tricky Perl constructs, most people would be inclined to yell for help. It's not specifically Perl's fault, but a constellation of Perl being at the top of its popularity when thinking about who will support it 20 years later didn't exactly enter the mindset of most programmers.

</comment></comment></comment></comment><comment><USER10> Main issues for me: 1)too eager closing of questions for whatever reason 2)number of answers for given question growing over time and best answers not getting the best position.

<comment><USER11> I concur. Main issue I have faced is people down voting questions even when the question is perfectly valid and reasonably well explained(imo). It sometimes looks to me that when a question is about 'under the cover' stuff and not superficial 'how do i get this done/i did this but got this output', it would be down voted.

<comment><USER12> I had this happen when I was obtaining my degree a couple of years ago. I forget the issue exactly, but I had this homework problem that I was able to solve using Python docs but what was happening underneath wasn't really "clicking" in my brain. So I posted the problem I solved, my solution, along with my actual question about the underlying issue. I got a lot of "did you check the documentation?" and "is this for HW?"...sadly my question was closed and I never got an answer.

</comment></comment></comment><comment><USER13> What I find hilarious is when I post a very detailed technical android answer and then someone comes along and edits it to be incorrect. I wish there was a way to make your posts only viewable or deletable. The people who go around editing do a terrible job...

<comment><USER14> That's a sweeping geneealization. More often than noy, those nifty, pristine posts with corrext syntax and grammar are the work of editors who clean them up.</comment></comment>


Porting Half Life with Xash3D: Not Strictly Straightforward - <AUTHOR> http://pandoralive.info/?p=5043.

<comment><USER2> I remember a while back Xash3D was a very illegal project gathering code from many other projects (sometimes without any form of credit). I'm unsure if the situation has dramatically changed, but I still wouldn't trust the project.

<comment><AUTHOR> On Github:

> Xash3D Engine is a custom Gold Source Engine rewritten from scratch.

If that is really true, how can it be illegal ?

</comment></comment><comment><USER3> I see Half Life 3 in the title.</comment>


What's the difference between containers and virtual machines? - <AUTHOR> https://blogs.dxc.technology/2019/03/11/whats-the-difference-between-containers-and-virtual-machines/ <comment><USER2> _So, if containers are so wonderful why aren't we all using them in place of VMs? There are several reasons. First, containers are theoretically more insecure than VMs._

Container breakout can be mitigated with SELinux. It can take a little more initial setup to get that working, but we have mitigated 0-day vulns by having SELinux enabled on docker hosts.

 _In practice, containers can also hold bad, out-of-date software that comes with security issues. Containers can also be harder to manage–albeit Kubernetes is taking care of the management issue._

This same issue applies equally to bare metal, VM's and containers. It comes down to your build pipelines and the discipline of your org. If anything, containers are easier to rebuild and deploy. VM images are usually a bit bigger. Bare metal images even more so.</comment>


YC Startup School: Lessons for a First-Time Founder - <AUTHOR> http://refer.ly/blog/five-lessons-from-yc-startup-school/

<comment><USER2> You're using my WordPress mobile plugin for your blog and have it slightly misconfigured with your cache plugin.

Send me an email and I will help you fix it.

email@example.com

</comment><comment><USER3> There's something interesting in #2: if you look at the examples, AOL was the expensive choice, which won. Today, I see the same thing playing out with github(expensive) over bitbucket(cheap).

Selling expensive stuff makes you able to throw crazy money into marketing (so you can send cds to everybody and their cat). That marketing money will buy you the mindshare you need to win. Most of my friends use github. But nobody knows what/who bitbucket is.

In other words, even when network effects abound, cheap/free products may not beat expensive products with the right marketing.</comment>


XSS hole in Paypal.com (fixed now) - <AUTHOR> http://www.h-online.com/security/news/item/Embarrassing-security-failure-at-PayPal-1477905.html

<comment><USER2> I think I was affected by this. There was a lot of fishiness going on the last few days, I tried to buy the Aziz comedy show and that USB TV stick that the Ham Radio people are talking about, both PayPal, and on these sites there seemed to be some really weird domains popping up, and then someone in HK logged into my Facebook account. So, I guess I'm going around and changing passwords and such this evening.</comment>


Show HN: I'm building a service to help people schedule tasks - s-stude http://scheduleworkers.com <comment><AUTHOR> Another gorgeous looking website that is clearly intended to explain what the service is, and I still haven't got a clue exactly what it does, how it works, how I'd use it, or what value I'd get from it.

Does anyone else understand what it _really_ does?

<comment> s-stude I can explain what the service does: basically you submit a URL which returns any kind of data. Then you set up a schedule for a worker to go to that URL and to load a data on a scheduled basis. Every time a data is loaded it is send to you via email.

So it's sort of alerting / scheduling mechanism.

</comment></comment><comment><USER2> Shoot me an email, its in My bio. I'm a UX & UI designer working on something in the same space would love to connect.

<comment> s-stude Done!</comment></comment>


Ask HN: Has anyone built a categorization tool for articles posted on HN? - <AUTHOR> <comment><USER2> Well, my RSS reader automatically tags incoming articles

[https://handlr.sapico.me](https://handlr.sapico.me)

If hn would add a rss feed, I could create a new subdomain for hn and it would have the result you requested.

Some manual administration for tags and their alternatives + subsets and parents would be required though.

</comment><comment><USER3> What kind of categorization do you have in mind ?

<comment><AUTHOR> I've saved (up voted) a lot of articles on HN. It'd be nice to sort them by category. That way you could get a better idea of what all the articles are about at a quicker glance.

<comment><USER2> On handlr, you can use the bookmarklet to add articles.

When using personal mode, you can see all your upvoted/submitted articles at once.

If you use the tag "CommentsByHackernews" while submitting the article. You can add the hn Id.

Then opening the article on handlr will also load all HN comments</comment></comment></comment>


New git command? git xxx? - <AUTHOR> http://i.imgur.com/iqKuXIB.png Just found this today.  Is this some sort of Easter Egg? <comment><USER2> Please tell me this is just a bad joke.</comment>


Mathias Rust: German teenager who flew to Red Square - <AUTHOR> http://www.bbc.co.uk/news/magazine-20609795

<comment><USER2> That's probably the longest lucky streak, if not more luck, than most ever have in a lifetime!</comment>