Practical Linux Hardening Guide - <AUTHOR> https://github.com/trimstray/the-practical-linux-hardening-guide <comment><USER3> Not a fan of this guide: No explanations, no context and worse: missing critical stuff for your typical hosted $webapp server usecase:

run services as normal user and confine them using apparmor (or selinux if you are masochichst)

the NSA will probably hack you anyway, that drive by script-kiddie that kills your company JIRA instance by DDoSing some gameserver while exploiting some old Wordpress plugin _can_ be stopped by apparmor!

What's missing is some kind of kernel live patching - if someone is not a script-kiddie on your machine that Wordpress shell is a nice tool to elevate to root - your kernel is rotting and exploits are plenty... so consider some kind of live-patching if your are paranoid.

Also no discussion about updates, the need to restart services for reloading updated .so files (like openssl)...

You can obey that guide and be busy with life and some skiddy root exploits your box anyway...

so /rant - there must be some better guides? found those cis benchmarks ([https://www.cisecurity.org](https://www.cisecurity.org)) a mixed bag - <USER2> there anything better out there?

<comment><USER4> Yeah, getting strong 90s vibes from this doc, perhaps because most hardening manuals like this are just collections of advice from other (bad and old) hardening manuals.

<comment><USER5> That's exactly it.

Lists like this exist to give administrators and their managers (1) a false sense of security when implementing it and (2) a subconscious excuse not to actually have to think about what you actually have to defend against. The list of topics is almost entirely useless if you are running any sort of containers on top of your Linux install, just as one example.

I'm sorry to be sounding so harsh, but I sincerely detest the security-by- checklist approach. It barely protects against any real-world threats, needlessly complicates matters, and gives credence to the perception that "security slow things down" through over-engineered solutions to non-existing problems. Moreover, it's a subconscious excuse to actually stop thinking about one's actual risks. Reasoning about actual threat models may not be easy but it is what one should be doing.

There's nothing "practical" about this at all, in my view.

<comment><USER6> > I'm sorry to be sounding so harsh, but I sincerely detest the security-by- > checklist approach.

Checklists are essential (or becoming so) in all professions that require a level of safety or assurance in their operations. They don't _replace_ careful though and action, but they do _supplement_ it be making sure there's a minimum level of items that were checked and not omitted because someone thought they didn't apply when then did, or someone just plain forgot. A checklist is a good way to start some rational thinking about what's required for your specific case (especially if it's so restrictive that you have to (and are expected to) selectively alter portions of the checklist just so your current use case functions.

Checklists are well known and save lives in some professions (such as aviation), and are being applied to others even when there's push-back (Surgeons and emergency room operations[1]) because the benefits are just so large.

I think it's fair to dislike how people and organizations adopt a checklist in lieu of careful thought about security, and to dislike poorly defined and reasoned checklists themselves, but I for one would be much happier, and feel much safer, if security checklists were much more common overall.

1: [https://www.who.int/bulletin/volumes/86/7/08-010708/en/](https://www.who.int/bulletin/volumes/86/7/08-010708/en/)

<comment><USER5> Checklists are fine if you have a fixed problem space. Just to go by your example - aviation safety is a mostly fixed problem space you can make mitigations in. Any item on the checklist would be there to mitigate safety issues almost any aircraft would encounter (and I'd imagine there are specific checklists for e.g. passenger vs. cargo aviation).

"Linux security" is not a fixed problem space. Not at all. And that's precisely my problem with this - this checklist pretends that it's a fixed problem space, and therefore grossly misrepresents the problem.

<comment><USER6> My point is that most problem spaces can be split into fixed and non fixed portions. Aviation safety has plenty of problems that require a real person to make a call and react intelligently, which is why we still have pilots. Checklists are used to cut down on the entirely avoidable problems that might be missed some percentage of the time otherwise.

There are _plenty_ of things in Linux security that are static solutions that can be employed almost all the time, such as not allowing direct access to root accounts, always running a local firewall, making sure remote services aren't run as root without dropping privileges, etc.

</comment></comment></comment></comment></comment></comment><comment><USER7> > Maintaining a stable temperature and humidity within tight tolerances is > critical to IT system reliability.

Data center HVAC engineer here. The part about tight tolerances is not entirely accurate. IT equipment can handle a reasonably wide range of temperatures. The ASHRAE guidelines [1] have a range of 18 to 27 deg C for all classes of equipment.

What is an issue is rapid changes between temperatures. For a data center with any kind of devices (eg tape storage), ASHRAE limits this rate of change to 5degC within a 15 minute period and obviously you also want to avoid any situation where condensation could occur or static build up (high or low relative humidity).

Data centers do try to keep the temp stable towards the top of the thermal envelope for economic reasons but there's always some fluctuation due to server load.

[1] ASHRAE TC9.9 Data Center Power Equipment Thermal Guidelines and Best Practices [http://tc0909.ashraetcs.org/documents/ashrae_tc0909_power_wh...](http://tc0909.ashraetcs.org/documents/ashrae_tc0909_power_white_paper_22_june_2016_revised.pdf)

<comment><USER8> Wow, your gear is treated so nicely. The stuff I work on has to deal with anywhere between 0C and 80C while having the crap shaken out of it and occasionally being hit with a high pressure hose.

Different worlds...

<comment><USER9> OK, high pressure hose in a data centre piques my interest 8)

I stuck a camera on a stick at the southern boundary of my property, about three feet above the stream. The stream rose four feet for a while. I moved the camera.

Now, 0 to 80C. That is just plain odd. Here (southern UK) the temp range is something like -10 to +35C. Nowhere has 0-80C apart from a weird oven.

<comment><USER8> This is minesite automation stuff, so it usually lives in a stainless steel cabinet, ambient air temperature can be over 50C, sometimes sharing the space with high power switchgear. It's not unheard of for the inside of the cabinets to be over 70C if it's mounted in direct sunlight, so most gear is rated to 80C. Then at other times in the year it'll get down to freezing.

</comment></comment></comment></comment><comment><USER10> > For secure rooms make sure that the walls go beyond the false ceiling, and > below the raised floor, large vents should also be covered with bars if > possible.

Ah, the 'Aliens' threat model.

<comment><USER11> Well if feel the need to have a physically secure room, then presumably you want to actually be secure.

<comment><USER12> What, are you trying to say security theatre doesn't make everything safe???

Surely if we grope everybody's balls/boobs on their way in, and have a secret list of "people with names that are vaguely similar to middle eastern sounding names" that we won't let in, that'd make up for the walls that you can just crawl under of climb over? Right?

</comment></comment></comment><comment><USER13> Not Linux specific but:

Don't make your security encourage legitimate users to work around it due to pointless friction

<comment><USER14> I always felt like increasing security has some cost on convenience.

<comment><USER13> It does, but there's also what I call stupid security that doesn't really add any measurable improvement, but does decrease productivity. Users out smart these systems all the time (e.g. forced password changes where you can't use the last 10 passwords, users just change their password 11 times so they can continue to use a password that's been configured on their devices. It's stupid then to force changes like that when there are much better ways like mfa)

Smart security allows users to do what they need to do efficiently and safely.

<comment><USER15> Yeah I can't stand the forced password changes where you can't use the last X passwords, or passwords that expire every 30 days. A lot of times it's security compliance entities that push this down to companies, for instance PCI, etc all require those. I think even the new NIST standards address these practices, but the compliance entities are slow and far from pragmatic.

<comment><USER16> yes but the rule does enhance security.

the password rules force you to choose [heuristically] guessable passwords, therefore they must be changed every 90 days. simple!

<comment><USER17> It doesn't if users are working around it.

<comment><USER18> Right. The first rule of password security: if you have a large enough user base, the odds of a user writing down a password increase, and as passwords become sufficiently difficult to remember, the odds approach 100% at some point that _some_ people are writing down passwords. No amount of defense in depth can protect the "I have a Post-It note under my keyboard" problem, if people can get into your building.

<comment><USER19> We've handled this by mandating password manager use and pushing length requirements to absurd levels to where it truly is easier to just use the manager, which has two factor.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER20> On that note, I would like to recommend the most complete book I've encountered on the topic: "UNIX and Linux System Administration Handbook" by Nemeth et.al. Just because I wish someone had recommended it to me earlier.

<comment><USER21> I can vouch for the book also. It's the best technical book for system operators.

<comment><USER20> It's really amazing the stuff they cover succinctly and yet complete. From the "classic" unix stuff and contemporary ones, like Docker, Ansible etc.

</comment></comment></comment><comment><USER22> Personally, I prefer the Securing Debian Manual [http://www.debian.org/doc/manuals/securing-debian- howto/](http://www.debian.org/doc/manuals/securing-debian-howto/)

Note: This is an official Debian manual, not some random third party.

</comment><comment><USER23> This looks good. I like that they have explanations / reasoning included, rather than just "do this". If all the planned topics get filled, that will be something to recommend.

Also, first time I hear about polyinstantiated directories, so TIL.

<comment><USER24> This was one of the neatest features of the computer formerly known as AS/400: each job (batch or interactive) had its own temporary library (QTEMP). You could create objects there knowing only you could see them, and the library was destroyed the moment the job ended. Definitely will try polyinstantiated directories.

<comment><USER9> What do you mean former? There is an AS/400 in our data centre that we look after for a customer for their off site DR box, with constant DB replication. It is about four years old, the platform is rather older. Bloody noisy beast especially on boot up (IPL?) sounds like a helicopter winding up. It was switched on after racking and that was it - I'm told it is simply available.

<comment><USER25> Although the platform still exists, IBM has renamed it:

[https://en.wikipedia.org/wiki/IBM_System_i](https://en.wikipedia.org/wiki/IBM_System_i)

</comment></comment></comment></comment><comment><USER26> A lot of this can be eliminated (Not the physical security or install) by doing the following:

1\. Run centOS or Redhat

2\. install openscap-workbench

3\. Use the centOS stig and choose which profile (I recommend US govt configuration base)

4\. Uncheck the firewall rules (they set it to deny all incoming; change to DMZ with basic rules)

5\. Click remediate and apply.

6\. OpenSCAP does the work for you to harden the system

You'll have to use other security appropriate tools for appropriate servers, but you'll know which service and its ramifications.I know that MySQL has a comprehensive security script to prepare. Other tools have similar built in functions.

Also note you can download Nessus and get a 7 day free trial as well. It's not perfect since the ticket price is $2400/yr . You could also use OpenSCAP for compliance, and metasploit as a substitute for application. There's also websuites like Burp and OWASP.

But regardless you pay or not for automated testing, you need something to automatically find bad things so you can fix them.

<comment><USER27> As with a lot of other enterprisey software made by RH, it should all work in theory, but it rarely works as well. I've never been able to get stuff like openscap to work reliably with satellite (which is one of those things that should probably not exist at all). I don't remember which openscap profile it was (I think C2S), but it would just hang on nfs servers with lots of data. So you can go and hack on these profiles, but it just gives the impression that none of this stuff is that widely used/production ready.

</comment></comment><comment><USER27> So here's something I've always wondered. If you use linux as a desktop/workstation in enterprise, how do you deploy it securely ? Other than chromeos, I don't see any other distro trying to tackle this. With all traditional distros, you'll likely need to give the user sudo on their machine to be productive (for eg., installing packages). However, all bets are off once you do that. You can restrict sudo to certain programs, but that also isn't very practical (for eg., sudo for yum is basically sudo for the whole system since you can install arbitrary packages). You can create a chromeos like system, but is there no interest in it ? There are some developments like fedora silverblue and nixos, but how is it that this has gone unsolved till now ?

<comment><USER9> "you'll likely need to give the user sudo on their machine" \- no we have sysadmins and application management systems to obviate that. If a user needs an app then they ring up the helldesk and get added to a group (after authorisation), which causes the app to appear.

<comment><USER27> >If a user needs an app then they ring up the helldesk

That seems very inefficient and friction prone. We have stuff like the nix package manager that can install stuff locally without sudo. It also has other nice features from what I've read. What I'm saying is that we need general purpose distros where you don't need sudo to use them.

<comment><USER28> Interesting you bring this up. Regardless of the provenance of packages and facility for installation you seem to be hinting that there should be a method to install specific service/feature sets to a system securely and without systems access.

I designed such a system which runs with appropriate permissions to a task, is modular, and accomplishes the provisioning via 'job' files submitted to a service endpoint. A user could describe the software they want installed. The SA performs due diligence on vetting software and designs a standard install module then generates a skeleton jobfile and provides it to the requesting user to fill in necessary details and submit. Wash , rinse, repeat.

</comment></comment></comment></comment><comment><USER29> Also...stick the SSH on a non-default port. Cuts login attempts down to near zero.

<comment><USER30> That's really terrible recommendation. You should add firewall rules and allow SSH access only from trusted hosts, ideally over VPN. It's not about login attempts but about possible bug in SSH (and other network services), because it's all just software, written in C, so believe it or not, but it's there, it's not if but when.

<comment><USER31> The firewall isn't immune to exploitable bugs: [https://nvd.nist.gov/vuln/detail/CVE-2017-18017](https://nvd.nist.gov/vuln/detail/CVE-2017-18017)

Likewise for VPN stacks: [https://nvd.nist.gov/vuln/detail/CVE-2017-7521](https://nvd.nist.gov/vuln/detail/CVE-2017-7521)

If you're not prepared to expose a service to the world, you _probably_ should run it at all. Ad hoc, non-standard configurations add substantial complexity and maintenance burdens. Complexity is the enemy of security, and having less time to manage more complex configurations is not a good recipe.

If you really need a service, then choose the best one and move on. The rule of thumb is that if you can reach a service, you should assume anybody else can, as well. This is especially true regarding SSH. I've seen plenty of servers p0wned via SSH, but never by breaking SSH. Instead the vector was always through an SSH user's computer infected by malware.

You want secure SSH? Disable password authentication and force everybody to use smartcard authentication like a Yubikey. I do rate limit SSH access using OpenBSD PF, but only because the authentication failures fill up and pollute the logs.

<comment><USER32> Have you seen yubikey/smartcard being used for sshin a large team? Would love to hear about your setup and learnings.

</comment></comment></comment></comment><comment><USER33> I'd absolutely love a section that covers UEFI, secure and measured boot, and TPM integrations.

<comment><USER9> You can install Ubuntu with UEFI and secure boot enabled without any problems (personal experience). I believe that several other distros work as well, out of the box. All distros can do UEFI with minimal effort.

To be honest I consider things like BMC and the like and whatever goes on inside the BIOS and the like as far greater opaque problems than some of the more esoteric security "assurances" like measured boot.

</comment></comment><comment><USER32> Even if you have a single server to run a bunch of services (web, mail, ssh, file server etc), best way to raise the security bar quickly is to isolate these services from one another. Use one of the modern virtualmachine/container technologies with minimal footprint to do this. Ideally, you would want physical separation between a node running firewall/loadbalancer and the servers behind them. If you are running a large cluster of many servers, then you definitely want to plan and separate your architecture into different layers of separations.

Don't forget your own laptop from where you login to administer all this is the best chance an attacker has to breaching all this security. So, ensure there is good role separation for administrators and good security hygiene on all the individuals machines (use password managers, do only official work on these laptops, don't visit random websites, run vetted authorised packages only).

For highly sensitive stuff (like CA or any root of your chain of trust), setup a SCIF and use only terminals inside a SCIF to access/administer them.

</comment><comment><USER32> Since this guide started with datacenter and hardware security, it is important to discuss the merits of having a secure enclave (hardware security module) on each server to hold the security keys.

Securing the chain of trust is a critical element of securing any system. If the root of the chain of trust is not securely bootstrapped and continuously verified to be still secure, then all bets are off.

The provenance and integrity of binaries, config and data running on your servers should be fully known – their integrity verified with cryptographic methods tied to your chain of trust. There should be no way for these entities to be mutated without cryptographic hardware tokens also being broken. This raises the security bar significantly. (mostly targeted supply chain attacks mounted by highly motivated likely state actors can overcome this bar).

Without this, you are always standing on shaky suspicious ground no matter how much you harden the layers above.

</comment><comment><USER34> I just keep my prod systems clean, updated and SELinux in enforcing mode. Behind strict firewall of course. This is sufficient for practical reasons.

In proper devops teams, there is no even ssh access. System is deployed from image and configures itself. And is killed in scaling events.

Grsecurity is for hardcore stuff. Or openbsd, ultimate solution :)

<comment><USER35> Yeah, let's not debug anything, ever.

That'll teach'em not to make mistaeks.

</comment></comment><comment><USER36> Oversaw a CTO 'harden' a linux box that was used as a firewall and exploited with;

chmod -R 600 /

I wouldn't recommend doing that.

<comment><USER35> Well, it certainly is secure, there's no denying that.

Especially after the next reboot.

</comment></comment><comment><USER37> Suggested additions: 1. Don't use a CPU equipped with Intel ME or equivalent, or other system-level management engines like HP's iLO. 2. Look out for keylog devices.

Also, from a practical point of view: sshguard is very useful and easy to install.

<comment><USER23> You mean, you want to drive to your data centre every single time something fails to boot, or have the awkward debugging session over the phone with remote hands? Or come in with a physical copy of the firmware update every time? Remote management is necessary in some situations. KVMs, ILO, and others have their issues, but it's a tradeoff. "Don't use" is not a great suggestion.

<comment><USER37> Ok, if you _have_ to use something like iLO, then make sure to connect it _only_ to an internal network. And update the thing frequently.

<comment><USER38> People expose IPMI to the internet?

</comment></comment></comment></comment><comment><USER39> Why put /boot on a separate partition? It becomes a pain on Ubuntu if the size is too small, if you forget to run apt autoremove (or whatever the exact command is) that thing fills up with old kernals. Updates can fall because of this and your system breaks in weird ways.

I know this because the original developer of our system used a /boot partition of 500 MB. That's right, 500 MB. I noped out of that. Don't even get me start on 2 GB total disk space for everything else on our API server. This was built in 2013 mind you, plenty of disk space by then...

<comment><USER40> I think the advantage is to have /boot read only? so you can't abuse fs security bugs to infect boot files

</comment></comment><comment><USER41> No mention of 2 factor authentication. Humm

<comment><USER42> Have fun getting smartcard logon working on a desktop Linux machine (unless you've got a full-blown enterprise PKI in place -- and, even then, it's still gonna be fun).

 _(cue the "but I did it with a Yubikey" responses)_

<comment><USER38> Or you could use a hosted solution like Duo which has a PAM module which is dead simple to use.

Or pam_google_authenticator.

</comment></comment></comment><comment><USER43> Seems to be in progress. In the future it will cover 'automatoc security updates'. Anyone have insight into wether this is a good idea and how it's done on something as rolling as an ubuntu server?

<comment><USER44> On Ubuntu and Debian there is a package for this: unattended-upgrades.

The default configuration should work fine for most.

<comment><USER45> I've had problems on some servers where unattended-upgrades would install new kernel versions without removing the old ones, and ending up filling my /boot partition.

<comment><USER39> Ditto, for this reason I leave it off. Also, I want to be able to verify patches in staging. Kill me if you want, but we only patch once a month for this reason. For critical things like heartbleed, meltdown, spectre we fast track them obviously. I find it helpful to subscribe to all security lists of core services to know if something really nasty is out there.

</comment></comment></comment></comment><comment><USER46> This seems good technically, but the writing needs a good once-over. Some directions are awkwardly written and obtuse:

 _For more security-focused situations is as follows_

</comment><comment><USER47> This is like having a car that you work on more than you drive. Great as a hobby but that's about it.

</comment><comment><USER48> One thing I miss from that guide.

What about compiling everything with GCC security enabled like Google does on Android?

<comment><USER49> The fact is; your distro is likely doing this already.

There is a script which reads elf binaries and outputs security info: [https://unix.stackexchange.com/a/89214](https://unix.stackexchange.com/a/89214)

<comment><USER48> Not all of them enable ALSR for example, right?

Thanks for the script, I wasn't aware of it.

<comment><USER49> ASLR is implemented in the kernel; although some unscrupulous programs are able to bypass it entirely (or force it to be disabled system-wide as is the case for Dropbox on mac)

<comment><USER50> I think what they were getting at is that ASLR doesn't work at all (for the main program) if you're not running a PIE binary. The libraries still get it (they usually have to be PIC by design) but that's not much benefit when the application using those libraries has entirely predictable addresses.

So yeah, your binaries need to be built with CFLAGS="-fPIE" and linked with LDFLAGS="-pie".

</comment></comment></comment></comment></comment><comment> pi-victor incomplete and yet has 1600 stars now. good job. also it's top on HN.

</comment><comment><USER51> this is not practical...at all.

<comment><USER52> I have to agree. Table of contents is a bit too ambitious. Anything that wants to cover "Air conditioning", "Fire protection" and configuring Nginx and Apache is not going to be practical.

</comment></comment><comment><USER53> This would make a great Ansible role too!

<comment><USER23> This is the beginning of a great list, but to apply everything without careful understanding / adapting to your situation would just end up confusing people and causing them problems. Some things are also very distro/environment specific (like the mounts layout).

There are tools which will verify the situation for you, but not force a specific solution.

</comment></comment><comment><USER54> Does anybody knowledgeable know how hard would it be to patch the same linux kernel with per-application permissions? I know there is some 'OS' doing it but I am looking for a WSL like solution- 'patch' the existing kernel so I can run the binaries et al unmodified.

There would be a permissioning matrix where I can list allow-all-permissions and deny-all-permissions by default and then change the granularity

<comment><USER23> That sounds like selinux / apparmor / rbac. (Or alternatively I don't understand what you mean by "patch Linux kernel with per-app permissions")

<comment><USER54> You understood exactly and apparmor clearly fits what I need (and possibly the other two too but I haven't had time to look...). I used to (incorrectly) believe that SELinux only dealt with networking...</comment></comment></comment>


How to demotivate people (Re: Making Debian Responsible For Its Actions) - <AUTHOR> http://www.lucas-nussbaum.net/blog/?p=582

<comment><USER2> Only 3 votes? I guess it's more fun to read Zed's latest hate-filled rant than about the people actually doing the work.</comment>


An Angel Investor Group Move That Makes Me Vomit - <AUTHOR> http://www.feld.com/wp/archives/2009/08/an-angel-investor-group-move-that-make-me-vomit.html?utm_campaign=foundrygroup&utm_medium=fndry.gr-copypaste&utm_source=twitter.com&utm_content=site-basic

<comment> old-gregg I thought it was a well-known fact that "angel" groups who charge for pitching are just scam artists. My mailbox is full of spam from these groups inviting us to pitch to them for a "small fee". These dudes even operate like scam artists: by spamming the hell out of you.

I haven't heard of a single well-known startup like Google, Ebay, Cisco and thousand of others, that has been financed this way.

<comment><USER2> Absolutely right -- when we were fund raising we experienced the exact same thing. I am convinced these angel groups are the biggest scam to first-time entrepreneurs.

When we first moved out to the valley to fund raise, we didn't know the difference between angels vs. angel groups. So we thought, oh, what a great way to pitch to a bunch of angels all at once. When they started asking us to to fill out a 500-page online application (AngelSoft makes me want to puke), and asking for $5,000 per presentation, we immediately wrote them all off.

The idea of me having to pay to pitch disgusts me. I even ask one of the groups outright -- doesn't it make more sense to charge the angels rather than the entrepreneurs? I mean... they are the ones who have money while we are the ones starving right?

For all you first-time entrepreneurs out there, please do not waste your time talking to angel groups like we did. If you network well enough you can pitch to any angel / VC in the Valley without much problem - and most importantly, for free.

<comment><USER3> Serious question: Why would a scam group require a 500-page application? Wouldn't they want to maximize the number of suckers prepared to pay the $5,000?

<comment><USER2> Ok, may be "scam" is too harsh. Keep in mind these angel groups are usually group of rich people who made their fortune from big corporations such as Cisco, IBM, etc. They are not the type of angels you read about on TechCrunch (Ron Conway, Ariel Poler, etc).

And typical corporate mindset is "processes". And an long application that no one ever reads is just part of that process. This is very similar to job applications -- no recruiters care about your cover letter, but you have to write one because it's the "way" it is.

<comment><USER4> I don't know about corporate recruiting but I find the cover letter much more informative then the CV.

<comment><USER5> On the other hand, I find the CV much more informative than the cover letter due to it's fixed format; you have much less liberty when writing your CV so any ever so little deviation from a textbook CV can tell a lot of good or bad things about the candidate. I totally ignore cover letters, I'm not even bothered to read them.

</comment></comment></comment></comment></comment></comment><comment><USER6> No reputable angel investor will _ever_ charge you for a pitch. Same with VCs. If someone wants you to pay even a minimal fee (such as travel expenses or whatever they come up with) walk away.

One of the first rules of dealing with VCs & angel investors is you pay _your_ own way, and so do they, until a deal is reached.

</comment><comment><USER7> The issue is that the "good" angel groups are so concentrated in SV, NYC, Boston, and LA (generally) that groups outside those areas can get away with this. To me, the bigger issue is what Brad points out - how few people/groups actually cut the damn check.

</comment><comment><USER8> I have one word for "angel investor groups" that charge start-ups to present to them:

Scams.

</comment><comment><USER9> It does seem arse-about that an angel would charge a fee to let a startup pitch to them. Surely, the angel is the one with the money, and the startup is the one that needs it, not the other way around.

Charging does solve one problem for the less-than-bright angel - if they receive enough pitches, it means they don't actually need to work out who they should invest in, they can make plenty of money from fees.

</comment><comment><USER10> This reminds me of the kind of people that claim to be movie producers who charge you to read your script. It's a fail/fail scenario from the start.

</comment><comment><USER11> I find it ironic that some of the groups he's criticizing have advertisements showing up in the Google text ads on his post.

</comment><comment><USER12> It would be interesting to know the funding frequency for those Angel Groups that charge for pitching vs those that don't.

I would assume that they (those who charge) fund at the same rate as other Angels, which basically makes the claim of "filtering quality" bogus.

</comment><comment><USER13> How to lose friends & alienate people - charge for pitching without offering anything better than the next angel investor.

</comment><comment><USER14> How do people feel about Angelsoft? Is what Angelsoft offers through Open Deals different from pay-to-pitch?

<comment><USER2> Absolute waste of time. Please don't bother with it.</comment></comment>


Fastpass: A Centralized "Zero-Queue" Datacenter Network - <AUTHOR> http://fastpass.mit.edu/ <comment><USER2> As context, I am a researcher in datacenter networks at a world renowned university. I've read the full research paper in detail, several times (not just the media summary) and have reviewed it carefully with other researchers in this area in our weekly reading group.

This first thing to note is that this is not "done and dusted" "accepted as gospel truth". The work may have been accepted for publication at a top tier conference (and that's fantastic!), but this means that only a small fraction of researchers have actually read that paper. Research publications are part of a conversation in the research community, an argument, and they should be read critically.

In that light, reading the work carefully, several things should be noted:

First the good stuff:

1) This work is incredibly well written. It's easy to read, it's sexy and it sells. This makes it easy for reviewers who often get a lot of poorly written work. A job well done by the writers.

2) In my (qualified) opinion, the reason that this work has been accepted for publication is that many in the community, including myself, would not have believed that a centralized arbiter could be be built, AT ALL. This is quite a novel thing. The idea is mad, and it seems to have worked.

Now the not so good stuff:

1) This paper is carefully craft to be slippery. You should be very careful about the claims that the authors make, in contrast to what you assume from the language used.

2) Fastpass is not "zero queue". They simply move queuing into other places. First, in the end host. When a host wants to transmit data, it must queue those packets and send a message to the arbiter to get a slot, it must then wait for a response, and then wait for a slot. Second in the arbiter itself, the arbiter must be able to keep up. This is easy at low load, but these times get much longer at high load and larger systems.

3) The authors never measure or demonstrate the impact of this extra queuing at high load (or at any load) on the end-to-end latency. Using "zero queue" in the title, implies that latency in the system is better, and indeed the MIT sound byte assumes this, but it's not measured or demonstrated anywhere. My guess is that the results just aren't better. So they have focused on the things that look good, and not the dirty details. This seems disingenuous to me.

4) The Facebook implementation uses only 1 rack (at most about 100 machines, probably more like 40), which means that there is only ever 1 path that packets can take. This means that a significant part of their algorithm (calculating the right path) is never run, reducing the cost.

5) Despite this, the Facebook implementation shows almost no benefit. They manage to reduce the number of TCP retransmits from 4 per second down to 2 per second. They never discuss or demonstrate that this has any useful benefit, and, frankly, I'd be surprised if it did.

6) The headline number of reducing latency by 1000's of percent is only in a contrived experiment with ping and iperrf, extreme ends of the latency throughput spectrum with little relation to the real world. This same result could have easily been achieved by simply setting ping to a high network priority.

7) There is no mention of tail latencies for realistic workloads, which is the real problem that is suggested in the solution but never demonstrated.

8) Scalability is a serious issue for this work, which the authors acknowledge, but will limit deployability.

9) Ultimately, this work is sexy and interesting, but never in the paper demonstrates any tangible benefit.

<comment><USER3> Great response but you didn't need to start with the chest thumping ("world renowned university", "(qualified) opinion"). I almost completely skipped reading it because it makes you sound like a blowhard.

<comment><USER2> Thanks. I guess I'm trying to give some sort of indication that I know what I'm talking about. Too many people have opinions without any factual basis to make them on. I'll try to be more toned down in the future.

</comment></comment></comment><comment><USER4> A little bit of relevant discussion:

[https://lists.bufferbloat.net/pipermail/cerowrt- devel/2014-J...](https://lists.bufferbloat.net/pipermail/cerowrt- devel/2014-July/003247.html)

</comment><comment><USER5> The failure modes of the master to secondary arbiter failover process need to be analyzed a bit more. Especially if you have a packet of doom that takes out both the master and the secondary; what happens to all the network traffic when both are gone? Does it degrade to normal TCP (it didn't look like it).

</comment><comment><USER6> Cool, but if you really want to do this sort of stuff (and don't mind being tied to the concept of some sort of arbitrator or route server) then you should be looking at circuit switched networks like Infiniband, Myrinet, DolphinLink, NUMALink etc.

HPC has been doing this stuff for decades, it's a fairly well understood problem how to achieve "zero queuing".

It's worth mentioning that Infiniband is incredibly affordable for datacenter networking and has excellent tooling on both Linux and Windows these days.

<comment><USER7> None of the networks you mention are circuit switched. They are all packet switched.

Fibre Channel is about the last example of a circuit-switched network, and it's pretty much dying.

<comment><USER6> Technically correct, Infiniband is actually a variant of virtual cut through switching. If one want's be be even more pedantic you can also point out there are implementations of Ethernet that employ the same technology at a switching level.

What really makes the big difference though is the presence of the subnet manager. Which pre-programs the routing information into each switch at fabric bring-up time. This is what causes Infiniband to act like a circuit switched network despite ofcourse being VCT at the PHY layer.

<comment><USER7> Uh, no. You aren't using those words the way other people do.

</comment></comment></comment></comment><comment><USER8> When I saw "Zero-Queue" it scared me. It's really zero? What kind of transport layer protocol does this network framework taken(D2TCP or ...)?

<comment><USER9> The queues are still there, but scheduling ensures that they don't fill up.

<comment><USER2> Incorrect. The scheduling only ensures that the queues in the network (from the NIC onwards) don't fill up. However, there queues are still there in the host and in the arbiter. The authors never measure or demonstrate that these queues are any shorter, that the tail latencies are improved for any real workload, or that there is any actual benefit in the approach for a real world scenario.

</comment></comment></comment><comment><USER10> This may be a dumb question - but the experiments show latencies of the order of milliseconds. How would it work when your median latencies are of the order of 100 - 200 microseconds? At that scale, the effect of the arbiter would be more pronounced right?

Am I missing something here, or is this not meant for that use case?

<comment><USER9> It should still reduce your tail latency.

<comment><USER2> Dubious. The question is what the tail response time of the arbiter is at full load. The key measurement (which is conspicuously absent from the paper) is the impact on the end-to-end delay at varying load. A distribution graph of this would answer this question immediately. My suspicion is that it is no better because essentially that same about of "scheduling work" is being done regardless of where it is done.

</comment></comment></comment><comment><USER11> I don't normally vote articles up but this looks really cool.

It would be good if they had more info about their testing methodology and also something like a haproxy implementation.

Also I don't see any mention of failure if the arbiter falls over.

<comment><USER5> Yes, the paper talks about having secondary arbiter that does watchdog pings, and if the primary dies, the secondary waits for the queues to flush then takes over, statelessly. It's a huge hole in the paper.

</comment></comment><comment><USER12> Is it just me, or don't the graphs at the bottom left appear to indicate that Fastpass achieves "improved fairness" through considerably diminished performance, especially under low contention?

<comment><USER13> It took me a while, but I believe this might be one of the few times that a stacked line chart would better serve the purpose. Total throughput is the addition of the 5 "per-connection throughputs." Thus, during the peak, we see ~2 Gb/s for all 5 servers, totaling ~10 Gbps. In the top graph, we see 1-3 Gbps for the 5 servers, totally ~10 Gbps. It would be more clear if a "total throughput" line were added or the author used a stacked line chart, since we're looking at both total throughput and fairness.

<comment><USER12> Right, but I mean the start and end of those graphs. That shows 6+ Gbit for one flow without Fastpass, and around 4 Gbit with it.

<comment><USER9> Yeah, that's fairly poor. It should be 10 Gbps for the first 30 seconds.

</comment></comment></comment></comment><comment><USER14> Just curious: Is Amy Ousterhout anyway related to John Ousterhout of Stanford?

</comment><comment><USER15> Is there no queue for the arbiter?

<comment><USER2> Fastpass is not "zero queue". They simply move queuing into other places. First, in the end host. When a host wants to transmit data, it must queue those packets and send a message to the arbiter to get a slot, it must then wait for a response, and then wait for a slot. Second in the arbiter itself, the arbiter must be able to keep up. This is easy at low load, but will get much longer at high load and larger systems.</comment></comment>


Huffington Post Lawsuit related to NYT Pay Wall - Same bad misconception - <AUTHOR> http://blog.areyoupayingattention.com/2011/04/nyt-paywall-huffpo-lawsuit-symptoms-of-the-same-misconception/

<comment><USER2> Very good points in here.</comment>


'Honeypot' pages to try to convert people searching for cracked software - <AUTHOR> https://successfulsoftware.net/2017/03/10/honeypot-page/ <comment><USER2> When searching for the crack, it means someone thinks that the software isn't worth the value being asked (or they might not have any way to pay). The honeypot page doesn't provide anything useful to the question. I think scaring customers who are looking for cracks with "you're sooooo gonna get malware, stop doing that" sounds a bit cheap and might turn some away. Having that page sounds like a smug idea to 'outsmart' the customers (which I think is dangerous). It gives the impression 'ahaha I knew you will do this, caught ya' \-- you're trying _too_ hard like a car salesman. Best case, they grudgingly pay for your shit. What probably will happen is that they click back and move to the next result.

There might be some actual, helpful solutions to the customer given you are facing a customer trying to save a buck:

1\. Actually giving them a discount: Providing a discounted license. Giving them a student discount. Providing a reduced/lite mode/ad-enabled license (for example, powered by... on the printed cards). Providing WinRAR-style functionality. Extending their trial period. Actually offering them a way to email you to ask for a free license and explain why they can't afford or pay for it.

2\. Showing a cheaper (but inferior, possibly) software/solution that does the same thing as the thing you're trying to sell.

3\. Showing the customer a way to DYI.

After trying 2 or 3 and the customer concluded to themselves "fuck it, it sucks even more for me to try saving a couple of bucks than to buy this outright," then there is a chance they might actually be happy to buy it.

<comment><USER3> I'm not 100% sure what is your experience with others but these kind of people are pathological customers. At least in my business.

You can test this by adding something like this to your honeypot page or home page:

      if you have do not financial needs or you are student
      please email us and we can discuss how to you can get
      software at discounted rate or free.

And you will get just bunch of hate emails. And we even decided: "who ever writes us an email that email contains "thank you" to "please" phrase (or nice in any other way) they will get our service for free". Just that: just be nice and you will get it free. And you know what: you will get maybe two or three emails in a year which have "thank you" or "please" in the email. All other emails will be rude emails demanding something. Like "I'm retired I do not have money to pay for your shit. Give me free or fuck yourself" (actual email).

<comment><USER4> What would you say if someone offered to mail cash to you? Or asked if you accept Bitcoin?

<comment><USER3> If the email was nice (no profanities, thank you or something) we will just give it free - just keep it simple.

The point I'm trying to make here is that offering something cheaper via webpage will attract wrong type of people (patio11 calls them pathological customers).

I think there was also 37signals post about why they do not offer discounts for students or similar.

In short, just keep it simple as Veen said: If I offer a service or product to what I assume are reasonable, rational, intelligent human beings, the deal is this: you pay me what I ask and you get the service I'm offering at that price.

<comment><USER4> Yes, that's fair enough.

But the point is that there are people who would pay you, but can't do so using credit cards. That's pretty common in parts of Africa, Middle East, etc.

<comment><USER3> Sure - as you probably know if run a SaaS business you will be receiving requests for users wanting to pay using alternate methods (Orange payment, invoices, bitcoin, onecoin, etc.). But not via this email: these were normal support requests.

</comment></comment></comment></comment></comment></comment><comment><USER5> Not everyone that is looking for cracked software does it because they wouldn't pay. Some do it because the vendor is useless at actually selling them the software.

On 3-4 occasions over the last 7-8 years I have been trying to buy a legal copy of Windows, download it to my Mac and then install it in VMWare. Every time this has been a situation where I just needed to OS to run some piece of software to fix a problem there and then and I didn't have time to wait for physical medium or there were no shops carrying Windows near by.

For instance when I need to adjust the idle-parameters on the engine of one of my cars that has a specialty ECU.

I have _never_ succeeding in buying a downloadable Windows in any of these situations. Not a single time. Microsoft has made such a big mess out of it each and every time I gave up and then found some pirated Windows that I could boot for one time use and then throw away.

A couple of days ago I was trying to buy Microsoft Office. The reason was that I needed to fix a problem in a document and none of the other software I had would deal with that feature. So I go to the Microsoft website. After noodling around for 3-4 minutes I'm still confused what product I really want to buy. I want the cheapest possible alternative that doesn't require me to register for this and that and which will defecate unwanted stuff all over my laptop.

In the middle of the checkout process a popup asks me if I want alerts when there are new products or some similar bullshit.

In the checkout process! If there is one place you should take care not to upset the user it is while the user is handing over his or her money to you.

I am continually amazed at how bad Microsoft are at this. I understand that Satya Nadella is a busy man, but I would take time out of my day, walk over to whomever is responsible for Microsoft's online retail and fire the moron responsible for it.

All the software I use I have licensed. Some of it even though I'm not even required to license it, just because I want to support those who make it. But perhaps once per year I use unlicensed copies of software perhaps once. And it is almost always due to incompetence on part of the vendor.

<comment><USER6> Can you not just download and use one of these vms?

[https://developer.microsoft.com/en-us/microsoft- edge/tools/v...](https://developer.microsoft.com/en-us/microsoft- edge/tools/vms/)

<comment><USER4> Are these full-featured Windows VMs, or specifically browser testbeds?

</comment></comment></comment><comment><USER7> I think the _idea_ of a honeypot page is great because it gives you a chance to re-engage with a potential user (not necessarily customer).

There's obviously more than one way to style it, but just like every good marketing how you present it should fit your product/brand.

Personally, I think the page should talk more about the "why" you should pay this guy (who works hard on it, bla bla bla) and less about scaring you into paying, because most people who know what a crack is aren't really scared away by the mention of malware.

<comment><USER8> I think the software creator is also going to be facing another issue: this _seems_ only one step away from creating an actual malware version and releasing it on the internet. That is not an impression you want to leave on your potential customers.

The second problem is that you might now open yourself up to differentiation from competitors who can now claim they don't create 'manipulative' honeypot pages and thus gain attention to themselves in the worst way possible for this author - by taking a seemingly high moral ground.

</comment></comment><comment><USER9> I would add a picture of the team behind the software to this page. Makes it a bit more personal. Also I would place the second paragraph at the beginning for the same reason.

</comment><comment><USER10> >Feel free to make a version of the page for your own product, but please don't copy the exact wording. That would be copyright infringement. ;0)

To be honest this sort of attitude is why many people have little or no respect for copyright. They see people being sticklers for copyright about things that are completely unreasonable to be copyrighted and extrapolate that essentially copyright is stupid and should be ignored. Same thing for patents.

Yeah in reality patents and copyright have their place, but every time someone uses a ridiculous patent or an overly aggressive interpretation of copyright, it turns people off from the entire concept.

<comment><USER11> Ironically, he seems to have pirated it himself, which makes the copyright claim even more insulting.

PerfectTablePlan: "If you like PerfectTablePlan enough to go searching for a crack for it then why not just buy it? It's a lot less hassle and you won't risk infecting your computer with viruses, spyware and other malware commonly disguised as software cracks."

Dplot: "If you like DPlot enough to go searching for a crack for it then why not just buy it? It is a lot less hassle and you won't risk infecting your computer with viruses, spyware and other malware commonly disguised as software cracks."

There's a bit of rewording in the middle but it's mostly copy and pasted from the other guy's or the common source.

<comment><USER8> The person who created Dplot seems to have left a comment on that page clearing the air a bit:

"Mine is a mostly word-for-word copy and dates Aug 2015. But as I recall the original was Dexter Bell, who offered this up on the ASP newsgroups and encouraged copying. But as with many other things I may be wrong!"

</comment></comment></comment><comment><USER12> I think the threat mentioned in the comments of Google algorithmically flagging your site as a warez/malware distribution site and downgrading the main page in search results could be a real one.

Of course the obvious solution to this is to go stick your "cracks are often malware or don't work, why not buy the real thing for only $xx" honeypot on a different domain, probably social media.

<comment><USER13> Putting it on a different domain would likely make the SEO much more difficult. It's unlikely you could keep it as the first result as no authoritative sites for those keywords would link to it.

<comment><USER14> Rather than making a honeypot _page_ , you can actually make a honeypot _crack_ (or pre-cracked app) and upload it to torrent sites. I've seen a few apps do this.

<comment><USER15> This is one of the best suggestions I've seen in this thread.

Not only does it let you get the message out, but it also lets you track the proportion of licensed/cracked software in circulation. If your cracked versions overwhelm licensed versions, you know that your price is too high.

</comment></comment></comment></comment><comment><USER16> >Some stuff to keep the search engines happy: crack, cracks, hack, serial numbers, keygen, torrent, warez, licence, license, registration codes, full version download.

Just a note, this might work when you have a very small audience and not a lot of strong online competition for this topic. PerfectTablePlan isn't exactly Microsoft Word. The fact that you ARE PerfectTablePlan is also a huge contributing factor to this page being #1.

But if you try this in a competitive space, the swift hand of Google will come to crush you.

Basically right now, Google is saying "Okay this page does mention these words, and their site has a ton of brand authority for PerfectTablePlan, but Goddamnit they are spamming and if I can put a non-spammer up front, I will."

I really like this as a general anti-warez tactic though.

</comment><comment><USER17> Alternatively, why not have a "honeypot" site that asks for _feedback_ on why the person is pirating it?

<comment><USER18> Because the feedback would be "I want to use your software, but I don't want to pay for it"?

</comment></comment><comment><USER19> Its not about honeypot its about price. Few days ago I saw a page here linking to a software for simple image editing, I think it was PhotoBulk. I downloaded the trial, it does what i need, sells for $9. I googled for a serial and it doesnt exist, except malware websites. I searched for freeware alternatives and there are so many, Ill have to find some time to inspect which does the job. Didnt include shell batch scripts, there are dozen of those.

The lesson is: if that software advertised here sold for 1 or 2 dolars I'd buy it. I could buy it for $9 as well, but I could do that only once. Tomorrow I cant pay again $9 for other software because this cycle of instaling software never ends and I dont produce money. I have not been employed for a long time.

So that honeypot page would be useless.

<comment><USER20> I had the exact opposite reaction. $9? That's a steal. Many pieces of software are needlessly bloated in price. If I'm going to use it once for a few hours, $40 doesn't seem worth it. On the other hand, if it saves me an hour, $9 is totally worth it - it's less than I'd have had to pay a minimum wage person to do it for me.

On the other hand, I'd love to see more people respect the shareware model. Give most or all features for free, encourage people to drop $5-10 in a hat to pay you back. I'm a firm believer in patreon and PayPal tip jars, though I know that they don't work at present for what I believe are cultural reasons. People (rightly) don't trust free, assume that there's some ulterior motive.

</comment></comment><comment><USER21> This works great for coupon seekers for SaaS and eCommerce businesses too.

</comment><comment><USER22> Seems that the sentence "For a one-off fee of $29.95/£19.95/€26.95 is it worth the risk?" should be re-written...

[http://www.perfecttableplan.com/html/crack.html](http://www.perfecttableplan.com/html/crack.html)

</comment><comment><USER23> This is titled 'Why you should ...' but the content is just 'You should ...'

<comment><USER24> That first phrase has three pieces of linkbait and the second only two.

We changed the title above to representative language from the article.

<comment><USER23> Thanks - the title here now is much better, to be clear though I wasn't criticising mods or OP here, since it was verbatim the linked article. :)

</comment></comment></comment><comment><USER25> > Some stuff to keep the search engines happy: crack, cracks, hack, serial > numbers, keygen, torrent, warez, licence, license, registration codes, full > version download.

I think it's against Google TOS to be that explicit. A better alternative will be "Related Keywords:" without metioning search engines.

</comment><comment><USER26> I don't think anybody is going to pirate your wedding planner software. you being smug about something you have no control over (re: piracy) is also not going to do anything either.

</comment><comment><USER27> Oh, no.. this surely will not be another bad site, where company's upload virus infected ripped software and torrents to movies in continuously worsening quality. And surely the reeducation camp will succeed this time.

Is it really so tough to accept the simple fact that entertainment (games) is like a lot of other industrys (nuclear power, bread) a half socialized industry - meaning the state will intervene on shortage and pricespikes. Absolutely noone of those politicians you get to meet as lobbyist at fency dinner partys has a real interest on reducing tv-show and games piracy.

The day they would close the Consolecolosseum, because those plebeians did not pay the entrance ticket - there would be a riot to end all riots. Sure you can turn your back to the bloody show, and preach to the good in man sitting on the ranks for entertainment.

The industries assembled here have taken alot of those "none"-customers there jobs. Now want to take there free entertainment and there food, while they wait for the lifes to drop to zero?

I want it written down into the Pre-Revolution-Chronicles that i did not support this madness.</comment>


MNIST training: Showdown between JavaScript and WebAssembly - <AUTHOR> https://ai.danruta.co.uk/webassembly <comment><USER2> I compiled hello world in Rust into wasm the other day for the first time and it was incredibly satisfying for whatever reason. New technology is fun I guess.

Note: This page isn't rendering properly on iPhone

<comment><USER3> We're working on making it even easier! Expect news soonish.

</comment></comment><comment><USER4> It would be a more fair comparison to [https://deeplearnjs.org/](https://deeplearnjs.org/), since CPU training is not standard practice for neural nets these days.

<comment><USER5> We've done some initial tests ourselves. WASM doesn't yet support SIMD so WebGL tends to be 5-10x faster. SIMD is actively being worked on by many smart people in Chromium / other browsers, so I would expect to see huge wins in the near term future. When that happens, deeplearn.js will have a WASM backend. WASM has a much better memory management story (destructors on the C++ side) so I'm super excited about its future.

<comment><USER6> Is SIMD going to close that performance gap for a problem that otherwise fits well on a GPU? Wouldn't the ideal by WASM support for GPU access?

<comment><USER7> Indeed WASM supports GPU access through the normal JS WebGL API. Many asm.js/WebAssembly apps use the GPU in this way.

Though compiling WebAssembly to GPU code would be a very interesting thing to explore, too.

<comment><USER5> This probably won't buy you anything. The API you still have is WebGL, and JS is not the bottleneck.

</comment></comment></comment></comment></comment><comment><USER8> This seems like a race between crawling and hopping on one foot.

<comment><USER9> Where the feet and knees belong to your users...(?)

</comment></comment><comment><USER7> So what's the explanation for the 20x difference? Is the JS implementation untuned?

edit: seems the JS is written in the straightforward, idiomatic JS way without employing speed hacks or typed arrays. So that I guess explains some of it.

<comment><USER10> You tell me, [https://github.com/DanRuta/jsNet/tree/master/dev/js](https://github.com/DanRuta/jsNet/tree/master/dev/js)

Ran in Chrome profiler, spent most time in these forward/backward functions [https://github.com/DanRuta/jsNet/blob/master/dev/js/ConvLaye...](https://github.com/DanRuta/jsNet/blob/master/dev/js/ConvLayer.js#L95)

</comment></comment><comment><USER11> If you care about performance use GPU shaders.

<comment><USER12> If you care about performance, don't use JS for training neural networks.

<comment><USER13> Not everything requires a multiple layer NN to be trained. It is not optimal, sure, but it might open up different possibilities

</comment></comment></comment><comment><USER14> PLEASE NOTE

This is NOT a fair and honest comparison.

The WebAssembly implementation pegs 100% of one CPU core (as monitored in htop) on my system until it is completed.

The JS button sits between 66.2%-66.8% and 19-26% of one core depending on whether the tab is focused or not.

The JS version does not use Web Workers. I can, however, see two references to setTimeout(). This leads me to assume that the JS version is being slowed down so that the UI does not lock up.

Completely understandable, but patently dishonest, as there is no mention of this fact on the webpage.

The JS version should be reimplemented so it can run at 100% speed.

<comment><USER15> It's still an order of magnitude slower though at least on my machine

<comment><USER14> Same here too. I just think it's dishonest that there's no mention that the JS version is being throttled while the wasm version is not.

</comment></comment></comment><comment><USER16> woah, I never expected this much traffic! Thank you for all the suggestions, don't worry, I am still hard at work on this.

I'm currently most focused on designing and implementing a WebGL version (partially working FC forward shader, so far), between uni assignments, trying to see if I can get it working nicely together with WebAssembly (need to figure out the best way to create the contexts with an off-screen canvas).

The JS version uses setTimeout to stop locking up the browser, and is something old, which I'm about to change, in favour of using WebWorkers, and (optionally) collecting error data in an array, for displaying charts at the end of training, instead of during. That should come out in version 3.3, unless the GPU stuff comes out first, in v4.0.

I didn't expect the link would get posted somewhere, so the library versions used were pretty old, haha, but I'll update them now. I've also added a note about the setTimeout thing, which, again, will be removed soon.

The repo is here, if anyone was interested: [https://github.com/DanRuta/jsNet](https://github.com/DanRuta/jsNet)

</comment><comment><USER17> My browser at least seems to struggle to download the file at [https://ai.danruta.co.uk/webassembly/mnist.js](https://ai.danruta.co.uk/webassembly/mnist.js) \- how big is this file in total?

<comment><USER18> It is 20 Megabytes, transmitted gzipped at 2.4 Megabytes. It is super slow to grab though, due to the other end.

<comment><USER16> Yep, running this on a 2 year old raspberry pi, on my desk, haha

</comment></comment></comment><comment><USER19> Do webGL now, with this library from Google: [https://deeplearnjs.org/#getting-started](https://deeplearnjs.org/#getting- started)

</comment><comment><USER20> I showed me 1 min as 31 mins

</comment><comment><USER5> Come build a WASM backend for deeplearn.js :)

<comment><USER16> That sounds like it could be a lot of fun :)</comment></comment>


Is the Relational Database Doomed? - <AUTHOR> http://www.readwriteweb.com/archives/is_the_relational_database_doomed.php <comment><USER2> This article is fairly well-balanced, but the hype around these "hashes in the sky" is completely out of control. This article tries to be objective, but it's not doing enough to counter the rabid zeal that is gripping silver- bullet-seeking, Twitter-wannabe young web developers. My observations are that too many people are making the following mistakes:

* Overestimating their need to scale - a powerful box with a cache-backed site can serve a LOT of hits. The vast majority of apps will never need to scale beyond this, don't kid yourself.

* Underestimating the amount of work and the cost of failure in maintaining data integrity at the application level - for all but the most simplistic applications you will end up writing a ton of code that replicates what a RDBMS does, except slower, with more bugs, and less generality.

* Underestimating the importance of data integrity - When your massive database with billions of records has subtle data integrity issues, how hard will it be to fix? My guess is that some truly nasty situations will arise and over time the hype will be tempered by the horror stories.

* Underestimating the constraints this puts on future development - Sure greenfield apps may seem like a great candidate for a document-oriented DB, but how often do apps look like the original version 1 year later, 2 years later, 5 years later. With a relational database your bets are hedged automatically. You can go in a million different directions with your data. The relational model gives you orders of magnitude more flexibility than complex algorithms designed for map-reduce-style scalability. If you don't need the scalability you are throwing an awful lot of flexibility out the window for nothing.

* Underestimating how relational their data really is - It's not just that developers understand the relational model, it's the fact that it's a rigorous theoretical model that actually models relationships in an academically complete way. Sure, real life RDBMSs don't live up to the theory, and sometimes things are too slow to be practical, in which case you fudge things as necessary or add layers of caching. But at the end of the day, the relational model can cover pretty much anything, where these hash-databases give you a small set of scalable functionality and some clever algorithms to accomplish a bunch of different things. The things you can accomplish are not comprehensive in a theoretical sense, they are just techniques that have proven useful for a number of applications recently. However the limitations are not as well defined as a RDBMS.

<comment><USER3> >> Underestimating the amount of work and the cost of failure in maintaining data integrity at the application level - for all but the most simplistic applications you will end up writing a ton of code that replicates what a RDBMS does, except slower, with more bugs, and less generality.

If I'm the first to explicate the underlying rule, can I name it after myself? Please? Pretty please with Lisp on it?

Doffing's Tenth Rule of Database Systems (with apologies to Phillip Greenspun):

"Any sufficiently complicated database management system contains an ad hoc, informally-specified, bug-ridden, slow implementation of half of a good RDBMS."

</comment></comment><comment><USER4> The answer is "no". The question is "will key/value cloud computing data bases replace relational"? RDBs are very good at modeling your data, but have scaling problems. The cloud computing solutions scale well but are really poor at modeling data; you have to do it yourself. Example problem: you commit an update to a record. Subsequent reads may not see the change until the DB gets around to committing it some time later. Can't run your airlines or banks that way. The eventual solution will have RDB-like modeling with cloud-like scaling, replication, robustness, and all that good stuff. The real solution will allow you to request high data integrity along with I-dont-care-what- happens for storing your RSS feeds or slashdot comments.

<comment><USER5> Whoever solves the "scalability or consistency: choose one" problem will make a boatload of money. From what I can tell this is a very hard problem, so software that makes it seamless to operate at multiple levels of this tradeoff curve -- perhaps at the same time, for different parts of your data -- would also be a big win.

<comment><USER6> I see this as an area where Microsoft could pull out a big win. Imagine if, instead of their half-baked BigTable clone that they just released, they had instead put 1000 or so brains on the problem of distributing a single SQL Server database across N machines.

Scaling out to a dozen DB servers that master/slave their way to scalability is no fun, but it's solved. The problem is that you're currently required to do it yourself. It would rock to be able to outsource that to the cloud.

I want to toss my ASP.NET application up into the Microsoft Cloud, where it will figure out how many webservers it needs to spread itself across and how many database servers it needs to fire up to handle the load it's seeing. And I want it to pretend like it's a single webserver talking to a single DB instance on a single box.

Say what you will about Microsoft, but they have the skills to pull that off. I sure hope they're working on it.

<comment><USER7> _Imagine if, instead of their half-baked BigTable clone that they just released, they had instead put 1000 or so brains on the problem of distributing a single SQL Server database across N machines._

Unfortunately brains don't scale, so you're better off using one huge brain, like Michael Stonebraker.

<http://db.cs.yale.edu/hstore/>

<comment><USER8> Right and his commercial startup is Vertica <http://www.vertica.com>

</comment></comment></comment></comment></comment><comment><USER9> Context: So, why are relational databases going to die? Because only key-value hash lookups are fast enough. Wait, can't RDBMs do hash-based lookups too? Yes they can. So what's the problem? Well, if you want to take advantage of the relations, you have to use joins and such. Why is that bad? The query plans the RDBMs uses end up being slow. Putative solution? Throw out RDBMs, replace them with key/value DBs (which are strict and severely impoverished subsets of RDBMs), and implement your own relations.

My comment: This makes me wonder if the solution shouldn't be looked for in a different direction. Instead of throwing out the RDBMs, why not give me one that gives me complete control of the query plan? That's the real stickler here, not the relations themselves, which are there whether you maintain them or not. If the DB can't guess up a good query plan, why not let me simply feed one to it?

Is there any DB that lets me have complete control over the query plan? (And even if there is, it's probably a half-hearted, unoptimized feature with little design effort poured behind it.)

Yes, even so you may have to give up 40-table joins, but it seems to me RDBMs, with more control given to the user, could still provide a lot of value without throwing out the baby too.

<comment><USER10> _Why is that bad? The query plans the RDBMs uses end up being slow._

I think it's simply not the case that people are using key-value stores because the query plans that a typical DBMS optimizer chooses are suboptimal for the kinds of queries most web apps use.

</comment></comment><comment><USER3> The rise of functional programming might not be accelerated by the pain of impedance matching to RDBMSs. Converting between the relational and OO models of data is a time-consuming pain. If this is widely realized, it could give FP a boost.

>> Is the Relational Database Doomed?

Ah, linkbait! Sorry, no sale. Using a (pre-compiled) stored procedure to do a key value lookup will likely be about as fast as a lookup in a key/value DB. In any case, it's easier to add a key/value lookup capability to an RDBMS than it is to add efficient query capabilities to a KVDB.

The article focuses on scaling, which is rarely an issue. KVDBs win on simplicity and flexibility (no need to pre-define a data model) and a better impedance match with OOPLs. RDBMSs crush on querying, which most (though not all) applications need.

<comment><USER3> >> The rise of functional programming might not be accelerated by the pain of impedance matching to RDBMSs.

Arrrgh! I meant that it _might be_ accelerated by the pain of impedance matching to RDBMSs. Sorry, it was late at night.

</comment></comment><comment><USER11> The future is here already, and has been for decades.

These non-relational database structures are not a new or revolutionary idea. The same concepts have long been implemented in systems like LDAP, X.500, and document-oriented databases like Lotus Domino.

The real mystery is the recent trend towards completely reinventing the wheel. For instance, LDAP (the protocol) is incredibly efficient, standardized, and well supported on most development platforms. It provides a standard query / filter language, facilities for scoping, and data updates. There are standardized exchange formats, wide availability of OSS and commercial management tools, and multiple server implementations.

Yet, there seems to be a great interest in developing from scratch highly proprietary and non-portable alternatives that do exactly the same thing (or less). These systems ignore decades of research and lessons learned through practical implementation.

The real issue though is that direct comparison of the two models is inherently flawed. They each have their own strengths and weaknesses, each excelling in situations that the other falls short. Looking at them as complementary models is perhaps a better approach.

<comment><USER12> As I started reading the article my very first thought went to Lotus Notes (never developed in it, but had friends that did). I agree with you, that they are complementary models is probably a better approach to the comparison.

</comment></comment><comment><USER13> The future is probably going to be a mix. RDBMS are good for data integrity. The non-relational databases are great for distributing queries. I've seen some apps which use a slow, asynchronous RDBMS to supply denormalized 'documents' for the non-relational stores.

Mind you, the RDBMS could still make a comeback. The world is looking to non- relational because since 1998 or so, throwing multiple pieces of hardware and network capacity at the problem is cheaper than solving it all in one giant node or cluster. But maybe one day an off-the-shelf computer (perhaps with better concurrent programming techniques for multicore) will be able to handle all the queries you would ever want and have the bandwidth to match.

Also, just wondering; exactly how many organizations really need a distributed database? There are some top websites, like LinkedIn, that do it all in one giant node, and my guess is that even sites like Facebook have only a few hundred database shards, maybe a few thousand at most.

<comment><USER14> I do wonder how many people on EC2 use SimpleDB because they need (or think they will need) the scalability, as opposed to thinking it's easier to code for, or simply just so they can avoid the drudgery of running their own RDBMS.

</comment></comment><comment><USER15> Are Non-Baiting Titles Doomed?

<comment><USER16> yes

(i meant to say that i hope one word answers are doomed as well)

</comment></comment><comment><USER7> There may be a good point in here somewhere, but it's not clear what it is. Relational databases don't scale, so... try CouchDB! or Drizzle! ...which also don't scale. What?

For a more complete list of RDBMS-killing science projects, try [http://www.metabrew.com/article/anti-rdbms-a-list-of- distrib...](http://www.metabrew.com/article/anti-rdbms-a-list-of-distributed- key-value-stores/) (discussion: <http://news.ycombinator.com/item?id=440687> )

</comment><comment><USER17> Mr. Bain's article would be more worthwhile if he were to elaborate on what it means for a knowledge representation system to be "doomed".

The relational model proposed by Codd[1] was formulated so that applications which adhere to it would continue to work and be free of inconsistencies when the underlying data is updated or reorganized. That may not sound like much but it's surprisingly useful when the data is important or valuable and needs to always be correct. This is also the whole point of all those irritating normal forms.

The relational model has a lot of shortcomings but it's not likely to be replaced by anything that doesn't address these issues.

That said, for some kinds of data it is definitely overkill. Religiously following the relational model for short lived stuff with little significance makes about as much sense as filling out your shopping lists in triplicate, storing permanent copies in a safe deposit box and requiring two signatures for every alteration the same way you might if you changing your will or a deed to your property.

[1] - "Relational Model of Data for Large Shared Data Banks" , <http://www.cis.upenn.edu/~zives/03f/cis550/codd.pdf>

<comment><USER18> Codd's paper is instructive from a historical perspective as well. When you read it, you realize that people were grappling with all these same issues before the relational database came on the scene. His description of hierarchical data storage systems describes some of the issues with things like XML databases and XQuery pretty well.

</comment></comment><comment><USER19> From the submitted article: "But in making your decision, remember the database's limitations and the risks you face by branching off the relational path.

"For all other requirements, you are probably best off with the good old RDBMS. So, is the relational database doomed? Clearly not. Well, not yet at least."

So the answer is no. The article doesn't do justice to the theoretical rigor of the relational database model. An online posting with some interesting discussion of technical trade-offs in popular terms and links to other posts can be found at

[http://highscalability.com/paper-dynamo-amazon-s-highly- avai...](http://highscalability.com/paper-dynamo-amazon-s-highly-available- key-value-store)

</comment><comment><USER20> RDBMSs are not doomed, but people are beginning to realize that they are not the Solution To Every Problem. I don't know why people ever started treating them like that; they really only handle one (small) problem space well -- modeling relational data. If that's the problem space you're working in, there's no better tool. If that's _not_ the problem space you're working in, then now we have some better options.

The reality is that 99% of web apps don't really want a RDBMS. There are no arbitrary queries to run, they just need to extract some objects from the database, interact with them, and render a web page. As of late, people have been using ORMs to make their relational database look like an object database. The problem is that the objects you get from an ORM don't work like real objects (try making a cyclical structure, or try `change-class`-ing the objects; doesn't work). This usually means you need to map the objects from your ORM into a better model of your app, adding complexity. (Some ORMs also screw up the relational part, making the data in the database nearly useless to any other apps. Oops.)

People are starting to realize that this model is a waste of their time, and they are using object databases instead. Now there is no ORM, they write their objects that the app interacts with, and those are persisted as needed. Suddenly half your app's code is gone, and it runs faster. That is why people are excited. Less code is always exciting.

This article is really heavy on key/value databases, probably because they are easy to understand. But really, key/value databases are like the assembly language of databases. You will have to do a lot of work to run your app on a key/value database. It is better to use something higher-level, like CouchDB or an object database. (For an OODB, I recommend KiokuDB. It has indexing (stolen from Postgres), and can store your data to BDB, a directory on disk, a RDBMS, Amazon SimpleDB, or CouchDB. This gives you a lot of flexibility.)

<comment><USER21> "The reality is that 99% of web apps don't really want a RDBMS. There are no arbitrary queries to run, they just need to extract some objects from the database"

Well, I'll tell you what my reality has been. It's been that every time I started a project, it appeared like I just needed to extract some objects from the database. But very soon it turned out that there wasn't just one way to view that information. There were two or three important use cases that destroyed my preferred, supposedly "natural" view.

Now, I'm fully aware that sometimes one preferred view of the information you have is so dominant that you have to optimize for that case. The question, is how do you optimize? Do you hard code that particular view from the beginning, or do you normalize first and then layer an optimized view on top of it, e.g. in the form of caching or materialized views? RDBMS make it easy to do the latter.

You say "they really only handle one (small) problem space well -- modeling relational data."

I think being relational is not an a priori property of data and relational modelling is not a problem space. It's the other way around. First you have a problem space, then you decide how to model it, and then you get the data according to that model. Assuming that information already has a kind of "natural" model attached to it is a fallacy in my view.

</comment></comment><comment><USER22> Where comes the notion that it were to be either this or that?

Why not use a relational database for data that actually suits the relational model, and an object/hierarchical/keyvalue database for complete entities that are often mapped to objects in code? Just put each kind of data to a storage that makes sense.

If you start with a RDBMS, there are plenty of options of how to store the objects. You can just use plain files in the simplest case. Or a good dbm style database. Or if your objects are mostly read-only you can keep the data in the RDB and cache the big joins. Or if you're really stuck with the RDB only you can even store the key-value pairs in the RDB: just make a two-column table for run-time data and keep it separate from the actual relational data. Or keep everything in the RDB but make a live copy off the RDB when the user logs in to keep the runtime data accessible and then unpack it back to the RDB lazily or when the user logs out. There are pretty much endless possibilities depending on your business and search needs.

Ain't easy but non-trivial databases never are.

</comment><comment><USER23> Aside from RDB and key-value, one other model I haven't heard mentioned much is Terracotta (currently the only example of its kind, AFAIK). That gives you basically all the advantages of a database, including replicated ACID transactions, but with data that behaves like live objects. Better than live objects, in fact, because of lazy loading and unloading, which let objects grow beyond the limits of RAM. Better than a database, too, in that it only moves diffs, and it knows exactly where they're needed. If you are the only one currently touching a data structure, the only traffic is "may I?" "carry on until I say otherwise".

</comment><comment><USER24> I've been fascinated with Key-value databases for almost as long as my career. Interestingly enough, I first came across the concept when I did a little work with Lotus Notes, way back in 2001. My memory is a little rusty on the full capabilities of Lotus databases, so I don't know if it applies to their format, but what I miss most from other HashMaps in the cloud are aggregate functions.

As a developer, I'd prefer one of two innovations: relational databases that scale better across machines or k/v databases that provide a familiar mechanism for ad-hoc querying and aggregation across keys.

</comment><comment><USER25> why can't they both just get along

</comment><comment><USER26> A colleague once pointed out to me that my preference for flat file systems over relational databases was likely why I tended to have trouble forming and maintaining relationships. This I could not dispute, but nor has the knowledge altered my preference for flat files.

</comment><comment><USER27> memcached + MySQL solution was invented by livejournal.com and is using by facebook.com. So-called in-memory databases also in the market. And second important moment is the prices of RAM modules, SSDs and commodity hardware. In some cases it is better to create in-house solution that reflects your data structures and data flows.

<comment><USER27> Thanks for downgrading me! I didn't knew about CouchDB! I'm stupid!

</comment></comment><comment><USER28> no.

<comment><USER29> Insightful!

</comment></comment><comment><USER29> I'm sure the day will come when RMDBs will be a distant memory, but sometimes it so comforting to open a database and see all the data in pretty columns and rows.</comment>


OpenSSH and the dangers of unused code - <AUTHOR> https://lwn.net/Articles/672465/ <comment><USER2> This article should be resubmitting when it becomes freely available on 1/28.

I'm surprised LWN had that many subscribers, or are people just upvoting based on a headline?</comment>


Two-phase commit and beyond - <AUTHOR> https://muratbuffalo.blogspot.com/2018/12/2-phase-commit-and-beyond.html <comment><USER2> If you're into this kind of stuff, I highly recommend the somewhat amusing videos of Leslie Lamport himself, the creator and godfather of TLA+.

[https://lamport.azurewebsites.net/video/videos.html](https://lamport.azurewebsites.net/video/videos.html)

<comment><USER3> LearnTLA is also great: [https://learntla.com/introduction/](https://learntla.com/introduction/)

</comment></comment><comment><USER4> This was excellent! Although it took me rather long to get all the way through. The authors blog looks to be very consistently insightful as well.</comment>


Deep3D: Automatic 2D-to-3D Video Conversion with CNNs - <AUTHOR> http://dmlc.ml/mxnet/2016/04/04/deep3d-automatic-2d-to-3d-conversion-with-CNN.html <comment><USER2> AI-based de-lamination algorithms, which this seems to be, are useful. You'd like to be able to take video frames and break them down into layers which reflect what occludes what. This is not necessarily depth; a single object that recedes into the distance, such as a railroad rail, belongs in one layer. It's relative depth; what's in front of what.

Systems for this should be trained on data with lots of things moving in different directions, occluding each other. Football games, for example. Pedestrians in busy intersections.

This sort of things is a good front end for many image understanding applications. You can also do frameless video compression. Framefree did this a few years ago, but the de-lamination front end of the compressor needed more work. We have more CPU power now; it's time to revisit that.

</comment><comment><USER3> This is a negative result :) (the method doesn't work)

</comment><comment><USER4> more like automatic blurry copy of original image :( All the examples are single frames from movies, so why bother when you can extract perfect 3d using multitude of SFM methods (PTAM/SVO/etc) using whole scenes?

<comment><USER5> I think the authors chose the wrong narrative to discuss in their motivation for the paper. Anyway, it's easier to just shoot a movie / VR content with multiple cameras than go through frame-by-frame to make sure the AI isn't introducing blurry regions etc.

However, being able to extract 3D scene features from a still 2D image is a super useful feature to have. Perhaps in the near future, inference models for image-based tasks (i.e. ImageNet, robotics) will make use of 3D features learned during end-to-end training.

The disparity predictions generated here remind me of spatial transformer layers [http://arxiv.org/abs/1506.02025](http://arxiv.org/abs/1506.02025) which Deepmind is using pretty heavily in their sequential attention models. I wonder if they would offer an improvement over the deconv layers.

</comment></comment><comment><USER6> you can test the model here: [http://www.somatic.io/models/oEG0wMkR](http://www.somatic.io/models/oEG0wMkR) the results seem kind of blurry, I hope there is more room to improve this model

</comment><comment><USER7> Our brains do this very well so there must be some algorithm out there for this.

<comment><USER8> Well we have two eyes, and each eye provides some depth information (in addition to depth derived from the two perspectives). It's really a completely different problem (Simplified 3d representation of the 3d world).

<comment><USER7> So you can't tell someone how to navigate a room from a photograph?</comment></comment></comment>