Docker Hub Maintenance - <AUTHOR> https://success.docker.com/article/docker-hub-maintenance <comment><USER2> "Given the nature of this update and the need to ensure the highest level of security, we have provided limited advanced notice. We understand that the maintenance process impacts our customers, and we apologize in advance for any inconvenience this may cause." \-- This is a ridiculous statement. Security does not come from opaque statements made at the last moment.

I fail to understand how updating a "cloud native" service requires downtime at all, much less this sort of outage.

<comment><USER3> Translation: In the aftermath of the hack last week they found additional major security issues that require downtime to fix. They are limiting the advanced notice to give attackers less time to try to find them before they can be fixed.

<comment><USER4> Quoting from the page:

" _Q: Is Docker experiencing a security incident?

A: No, this is a scheduled update and a proactive step we are taking to provide the best possible customer experience and highest level of security._"

<comment><USER5> scheduled when...

<comment><USER6> We just scheduled it right now.

</comment></comment></comment></comment></comment><comment><USER7> 24 hours notice for up to 8 hours of downtime ("read only") seems quite abrupt.

<comment><USER8> Apparently security-related.

"Given the nature of this update and the need to ensure the highest level of security, we have provided limited advanced notice."

<comment><USER7> I suppose my point was more along the lines of "what else could there possibly be to justify this that you haven't screwed up already?"

I guess come Sunday/Monday we'll see...

</comment></comment></comment><comment> mh- They nearly-erased the page in the last few minutes..

Here's the original from time of submission: [https://web.archive.org/web/20190503141604/https://success.d...](https://web.archive.org/web/20190503141604/https://success.docker.com/article/docker- hub-maintenance)

Now as of my comment the entire body of the page is:

 _Docker Hub Maintenance - May 2019_

 _In early May, 2019, Docker Inc. will perform maintenace on the Docker Hub._

 _This article details actions to be taken, timeline, and any current status /issues/recommendations._

</comment><comment><USER9> I guess this weekend I'll be setting up my own registry. Gives me an opportunity to do something I've been meaning to do for awhile anyway.

<comment><USER10> Setting up a registry is easy and actually pretty fun. You can even run it in a docker container ([https://hub.docker.com/_/registry](https://hub.docker.com/_/registry))! The complicated/non-trivial part is getting a front-end set up if you want more than the command line. I would recommend most people at least keep backups of their important images in a private registry. It really doesn't take much to keep one running, and you're covered if Docker Hub has an outage.

For most people's needs, command line access to the registry is more than enough though. There are a couple of options out there already for a registry web UI, but I've never had the chance to use any.

<comment><USER11> i actually open sourced a tool kbld ([https://get-kbld.io](https://get- kbld.io)) a couple of weeks ago that includes export/import images functionality (keeps same digests across registries): [https://github.com/k14s/kbld/blob/master/docs/packaging.md](https://github.com/k14s/kbld/blob/master/docs/packaging.md). didn't think of it as a image backup tool till i read your comment.

</comment></comment></comment><comment><USER12> If this is related to security, I think users deserve to know what's up.

As someone working in security, I'm fairly distraught that I _still_ don't know exactly what happened last week. The Docker post-mortem[1] states:

 _> On Thursday, April 25th, 2019, we discovered unauthorized access to a single Docker Hub database storing a subset of non-financial user data. Upon discovery, we acted quickly to intervene and secure the site._

 _> During a brief period of unauthorized access to a Docker Hub database, sensitive data from approximately 190,000 accounts may have been exposed (less than 5% of Hub users). Data includes usernames and hashed passwords for a small percentage of these users, as well as GitHub and Bitbucket tokens for Docker autobuilds._

 _> There was a brief period of unauthorized access to a Docker Hub database. During this time some sensitive data from approximately 190,000 accounts may have been exposed (less than 5% of Hub users). Data includes usernames and hashed passwords for a small percentage of users as well as GitHub and Bitbucket tokens for Docker autobuilds. All these tokens have been revoked._

To the best of my knowledge, the above excerpts are the entirety of information about the incident that Docker has officially released. This is not nearly the level of detail that any security-conscious customer cares about, and in my opinion, it's an egregious violation of trust to not give more information.

For those that may not be working in security day-in, day-out, here's what I mean:

If this incident was, at its core, a DockerHub error that exposed a database to the Internet without proper authentication in place -- and then someone stumbled upon it -- that's an embarrassing mistake, but these things happen. I'd feel comfortable that Docker understands the extent of the breach, and that we can continue to use these products with some degree of confidence.

If, however, the breach was -- and we're going to the other end of the spectrum here -- a state-backed APT that blew 0days to breach the DockerHub network, then the threat model is _significantly_ different. Did Docker bring in incident response professionals? What were the attackers targeting? How confident can we be that they didn't pivot to somewhere else on the Docker infrastructure undetected?

I know that Docker is likely trying to save face, and that the former scenario is significantly more likely than the later -- but guessing about whether or not the breach was severe is a ridiculous situation to be in for major organizations that use the DockerHub service.

In case anyone was wondering, I wasn't personally or professionally impacted by the breach, but we performed full credential rotation anyway. If the breach was more severe than described (e.g., persistent access was established), then that probably wouldn't do much good... but it's better than just assuming that "only 5% of users could have been impacted," and doing nothing.

I'm very unhappy with Docker's communication of this breach/misconfiguration/incident/whatever it may have actually been. I really hope they release more information (perhaps in the form of a _real_ post- mortem) so that DockerHub users can better understand the risks of using Docker products. In my opinion, it's incredibly irresponsible of Docker to keep this information to themselves.

1: [https://success.docker.com/article/docker-hub-user- notificat...](https://success.docker.com/article/docker-hub-user-notification)

<comment><USER13> A bit of a tangent: as someone studying cybersecurity at a university in NYC and dealing with a range of topics: virtualization, forensics, incident response, defense, offense, CTFs, bounty programs etc. etc. And at the pace I am going at it (evening classes), it will take a few years to finish, and even then I might not start in the security industry right away.

I would like to ask, in your opinion, what is a good way to stay up to date, simulating as close as possible to real-world experience through hands-on self-teaching methods ? And what areas would you concentrate on personally, considering how vast the field is.

<comment><USER12> I honestly think that following current events -- whether that means technical news via HN, or more mainstream events covered by traditional media -- is the best thing you can do to stay up-to-date on what people are thinking about. Take analysis with a grain of salt. Look at breaches and ask yourself how they could have been prevented (or perpetrated!)

Attend community events and conferences. There are local "Bsides" conferences in most cities, and the big conferences (DEF CON, Black Hat, ShmooCon, etc.) are great too. I haven't been to Summercon or Hushcon East, but I've heard that they're both great NYC conferences. When you're at these things, don't just go to the talks (you can see them on YouTube later), but talk to people in the hallways/bars/parties and find out what kind of challenges they're facing.

Attend local meetups. See what people are talking about. Be involved with the community.

If you do these things, I can guarantee you'll stay current -- and hopefully, it will keep your interest in security going strong :)</comment></comment></comment>


Where/How to get an SBA loan? (I am in NYC) - <AUTHOR> I got a new job with a 3-year old company.
We're expanding operations and we're looking for a $3-4MM SBA loan. Yes I know that the 2 principals will have to sign a personal guarantee.
The problem is that in the past nobody had bothered to establish a relationship with our BIG Bank (checking account only so far), and I am calling left and right but body is actually returning my calls, not at my bank nor at any of the other 4 banks that I contacted.
It's frustrating.
So, what is the formula for "Getting an SBA loan 101"? <comment><USER2> Stop calling and walk in.

<comment><AUTHOR> LOL, I did. they told me to call the toll-free number.</comment></comment>


BayesDB - a Bayesian database table - <AUTHOR> http://probcomp.csail.mit.edu/bayesdb/ <comment><USER2> This looks like the technology behind Prior Knowledge ([http://priorknowledge.com/](http://priorknowledge.com/)), which is not surprising given that a lot of the same people are involved. Awesome that it's going open source.

It will be interesting to see how far the database analogy can be pushed. The key thing to realize is that BayesDB is based on a particular model, CrossCat ([http://probcomp.csail.mit.edu/crosscat/](http://probcomp.csail.mit.edu/crosscat/)). If your database table is an adjacency list that represents a graph, for instance, it's not going to perform very well compared to a more tailored model. On the other hand, a generic approach to high-dimensional imputation is very useful.

<comment><USER3> Eric Jonas here, former CEO of Prior Knowledge, cofounder of Navia, etc. etc. [and obviously not speaking for my employer] Tristan is right, our tech was based on CrossCat, a model originally developed in Josh Tenenbaum's lab at MIT. We fundamentally believe that structured probabilistic models are the future -- this is very much the direction that my latest research has taken, for example.

The reality is that almost any model that lets you build up a good joint density estimate of the data can be useful for this sort of tabular data. CrossCat assumes that your joint factors in to several independent factors -- that is, p(x, y, z, w) = p(x, y) p(z, w), for example. Of course, because it's a dirichlet process of dirichlet processes, all that's learned from the data. But that's not always the best approach, there are others, and it will be fun to see what else comes out of the research community.

And Tristan's also right that this is not always a great fit for your data -- if it's graph based, or if your data are super-high-dimensional, or whatever, it's not a perfect fit. But it is a good start.

For a great review of the Dirichlet Process/CRP, the Indian Buffet Process, and other probability distributions over infinite structures, I highly recommend this great tech report from Zoubin and Tom:

[http://mlg.eng.cam.ac.uk/pub/pdf/GriGha11.pdf](http://mlg.eng.cam.ac.uk/pub/pdf/GriGha11.pdf)

<comment><USER4> Agreed! CrossCat works really well for many datasets, but I am also very excited about implementing BayesDB with other joint density estimators.

</comment></comment></comment><comment><USER5> Interesting project!

I have some questions that I couldn't immediately answer from skimming either the BayesDB documentation or the paper linked from [http://probcomp.csail.mit.edu/crosscat/](http://probcomp.csail.mit.edu/crosscat/)

* The CrossCut paper seems to focus on binary features and categorical learning. How does BayesDB generalize that? Does it quantize continuous features first to make it all categorical, or does it generalize CrossCut somehow?

* How are we to think about what BayesDB doing? Is the underlying model most similar to a graphical model? A Bayesian network? A Markov field?

* On an informal level, how is the factorization structure learned?

* What's the time and memory complexity in terms of number of features and examples for different operations? Is insertion constant time? Is it storing sparse contingency tables of some kind?

<comment><USER4> Thanks!

While the original CrossCat paper focused on binary features, it is in fact much more general. For example, CrossCat uses a beta-bernoulli model for binary features, normal-gamma for continuous, and dirichlet-multinomial for categorical data.

CrossCat is a generative bayesian nonparametric probabilistic model. Informally, the generative process assumed by CrossCat is that the columns are clustered (into "views") according to a Dirichlet Process, then the rows within each view are clustered by another Dirichlet Process. Then, the data is generated by the datatype-appropriate component model for each cluster.

INFER, SIMULATE, and INSERT are all constant time, and most other operations scale linearly with the number of rows or columns, including inference. It doesn't store any sparse contingency tables or anything like that -- all it stores are CrossCat posterior samples.

<comment><USER6> What about the individual cluster models -- can they represent dependencies of variables within a cluster? For instance, I'm thinking about the "salary prediction" example. Is the salary variable considered to be conditionally independent of all the other variables, given the cluster assignment? Or can it learn something like an additive model, where categorical variables are associated with higher or lower salaries within a cluster?

Or to use another example, can it learn correlations between two continuous variables, to solve things like linear regression?

<comment><USER4> You are correct that each variable is considered conditionally independent of the other variables given the cluster assignment. CrossCat learns additive models and correlations between continuous variables by using many clusters (the clusters don't necessarily have meaningful real-world interpretations).

</comment></comment></comment></comment><comment><USER7> The crosscat paper ([http://web.mit.edu/vkm/www/crosscat.pdf](http://web.mit.edu/vkm/www/crosscat.pdf)) is super-terse. Is there a more gentle description somewhere?

I'm quite familiar with generative models and MCMC sampling and reasonably familiar with the Dirichlet process though I've never implemented it.

<comment><USER4> This computational cognitive science paper about CrossCat ([http://shaftolab.com/lab_papers/repository/shaftoetal06_cros...](http://shaftolab.com/lab_papers/repository/shaftoetal06_crosscat.pdf)) provides a different perspective that may be more approachable.

</comment></comment><comment><USER8> This looks great. It has similarities to PreQL, the query language from Prior Knowledge (acq. Saleforce).

I would love to see a full set of QL primitives for common data science operations.

</comment><comment><USER9> Scaling? Can I get images in it? Can I reslice my data? Is it all in memory?

<comment><USER4> Hi, I'm one of the lead developers on the project. It's a relatively young project, so keep an eye out for lots of substantial releases over the next few months.

So far, we have been focusing on smaller dataset sizes, such as 10,000 rows by 100 columns, but everything scales linearly (both query processing and offline inference) so you could use it for larger datasets too. The current version is all in memory, though, so you're limited there.

Right now you must import data from csv, so no images, and you must do all preprocessing of your data before loading it in. We hope to add more and more of this kind of functionality in later releases. I'd love to hear suggestions! I recommend trying out the VM installation if you want to quickly play around with it.

<comment><USER10> Here's a suggestion for importing data: support HDF5. It's like CSV, but a lot faster and better. And the set of people who use HDF5 probably overlaps a fair bit with your target audience.

</comment></comment></comment><comment><USER11> This looks awesome! If it works the way suggested, it is going to save me a lot of time modeling the Bayesian Analysis in coming projects.

</comment><comment><USER12> I'm having trouble getting the examples to work on the VirtualBox VM. run_dha_example gives me "None" every time. I've ran the client.execute with --timing=True and --pretty=False with the same results. Am I doing something stupid? :)

<comment><USER13> I got the VM up but can't get it to do anything useful.. No next steps after getting the VM up..?? Also, I would be very nice to have a more granular install.. I just spent the day fixing my system after attempting a native install on Ubuntu 13.10 (still have more to repair) A list of prerequisites would be better that the current unified install...

<comment><USER4> Once you have the VM up, you can try running demo scripts, located at ~/bayesdb/examples/ _/_.py after you've checked out and pulled master from ~/bayesdb and ~/crosscat.

Yes, the install process is a pain in the current release (sorry!), but the next release (almost ready) will be much more friendly and granular to install.

</comment></comment></comment><comment><USER14> Hi Jay, I was talking with Anne just now and we need explanation on another level, I am afraid. I would like to understand BayesDB, and I wonder if there is a layman's summary available? It was great seeing you at Thanksgiving at Beachcliff! Mimi

</comment><comment><USER15> A question for the developers: Does this support time series data?

<comment><USER4> The answer is both yes and no. In principle, longitudinal/panel data can be run through BayesDB, though BayesDB would have to infer the temporal structure. Also, we've toyed a little with forecasting by making a table where each row is a sliding window.

That said, BayesDB is really about the classic multivariate statistics setting: each row is a sample from some population. We think that a streaming Bayesian database, that models sequences of timestamped UPDATEs to a DB (and with FORECAST in addition to INFER) is an interesting, distinct project that we've done a little work on.

Contact us if you're interested in this kind of data and we'd be happy to talk more.

</comment></comment><comment><USER16> can we get that in postgresql 9.3.3 ok tks bye

<comment><USER17> You can get predicted columns via [https://github.com/no0p/alps](https://github.com/no0p/alps) ... Turns out that adding words like infer to the lex is kind of a big project in pgsql. Excellent work with the language aspect of it in BayesDB -- well thought out.

<comment><USER16> thanks for the tip! it was worth the karma i lost for my attempt at humor...

</comment></comment></comment><comment><USER18> This must be a joke, a cruel, cruel attempt to troll poor data programmers who have waited forever for something like this to be made.</comment>


Launch HN: Cosmic JS (YC W19) - API-first drop-in replacement for WordPress - <AUTHOR> Hey HN,
I'm Tony, one of the cofounders of Cosmic JS (YC W19) (https://cosmicjs.com). Cosmic JS is a drop-in replacement for WordPress that can power content for any website or app. We provide a web dashboard to create content and API tools and resources (REST and GraphQL) to integrate content into any new or existing project. Commonly referred to as a "Headless CMS", this eliminates the need to build and maintain your own CMS infrastructure. For a monthly fee, you use our CMS infrastructure and can focus on what really matters: building great products and user experiences.
My cofounder Carson and I met at a digital agency where we built and managed WordPress websites. We noticed that lots of development time was spent building and maintaining the CMS itself, sucking time away from core application development. Plus we encountered the same CMS problems over and over: automatic updates caused sites to crash, a client would decide to install a bunch of plugins that caused the site to crash, comment spam was a never-ending battle. We began looking for a better way to manage content.
This was 2014 and API services were becoming more popular (Stripe, Twilio, SendGrid etc were gaining traction in offloading non-core dev tasks), and it made sense that using an API could be a viable way to deal with content as well. So Cosmic JS was created to be the solution that we wanted to use: one click to add a new project, unlimited projects with a single login, a simple web dashboard to create content, and API tools and resources to integrate content into any new or existing website or app. No CMS infrastructure needed.
After much beta testing, we eventually released to the public in 2016. We're now powering production websites and apps for hundreds of teams around the world across various use-cases.
We know the market for a solution to this problem is big because WordPress, as of this posting, powers 30% of the web. That's 75,000,000 websites (source: https://www.whoishostingthis.com/compare/wordpress/stats/). Plus the need for dynamic content extends beyond websites. Mobile, IOT and other emerging tech are increasingly requiring dynamic, easily integrated content.
This is a hard problem to solve because a CMS has to satisfy the needs of both developers and content creators. We're different than other headless CMS providers because lots of effort has been made to make the CMS admin dashboard and content integration process as easy as possible for both the developer and content creator. We've been told "it doesn't get much simpler". We're also very committed to education and community. We're the only headless CMS that comes with a community of developers built-in providing hundreds of apps, extensions, and integrations to learn best practices and teach others. You can get up and running with a variety of use-cases in just a few clicks. And we have a free plan that rewards contributors with a free personal Bucket forever.
Check out some of the apps built with Cosmic JS: https://cosmicjs.com/apps.
We're excited to be participating in Y Combinator for the W19 batch to help more teams avoid the pain of CMS infrastructure management so they can focus on building great products.
We'd love to hear your feedback and learn more about your personal experiences building content-powered websites and apps! <comment><USER2> Going to be a hard lift to compete with the likes of [http://strapi.io](http://strapi.io) when you aren't open source.

I'm all for the headless CMS space, but I'll never recommend a solution to my clients that causes vendor lock-in and that I don't have the ability to operationalize myself.

Most folks in this space, wordpress included, follow a model of "open source, but pay us to scale and operationalize it for you".

They follow this model because it works.

As a CTO making decisions for my company, I'm not going to take the risk on a startup in this space without an open source fallback plan.

<comment><USER3> Exactly, after 15 years of web development, I never lock any customers into any proprietary anything. The cost, time, suffering, that come with the failure of a company we rely on is no longer worth it.

We have dealt with this a couple times with shopping cart providers, mls idx search systems, do-it-yourself website systems, captcha systems, cms systems (paid-for, now with no upgrade path for things like PHP5 to 7), payment processing systems, and more I probably can't think of at the moment.

If it's not open source, and self-hosted, then we walk away.

The only things we kind-of lock into now are hosting providers, email providers, and domain registrars. But we use pretty big and established operations for these just so we hopefully don't have to move things.

<comment><USER4> Not just the failure of a vendor, but the "success" too. They build the product out with a low-cost self-serve model and an army of loyal and enthusiastic customers, but then they get greedy / raise money / realize that they could be going after much bigger fish and they jack prices to the moon to shed all their current customers who are "holding them back". See Segment, Drip, and an endless list of others.

<comment><AUTHOR> FYI we have and will always grandfather in early customers.

<comment><USER5> This is the same sort of promise app.net made

</comment></comment></comment></comment></comment><comment><USER6> Up front: congratulations on shipping. _Shipping is hard._ My impressions from looking at CosmicJS are not super positive, though, and maybe this will be of some use to you.

WordPress has problems. Big parts of WordPress sucks. But WordPress-the-thing is hard to argue with. It doesn't demonstrate a need to conflate _sites_ with _apps_ (maybe that impresses low-information folks but as a developer and a content creator I am left asking "so what?") and it doesn't need to hide its brain as a revenue model--they make a lot of money despite WP/WPMU both being open source. And somebody who has spent a decent chunk of time and money wrangling CMSes--I don't see a ton of value to a CMS I can't audit and can't just _run myself_. The `and` is important there. I'm happy to pay for support --and sometimes for operationalization, I've paid WPEngine a decent amount of money over the last few years--but I pay for support once I've validated the use case.

Perhaps I'm not the target audience. But I'm asking "why would I use this?" and coming up kind of empty. Beyond that, what _does_ trouble me is the way in which you're intensely attempting to slag WordPress (which, tbh, rings hollow; "flies don't bite a man who's sure of himself" and all that). You can use WP as an API these days, and it's not bad. Not perfect, but not bad. But you can also do that with other headless CMSes, and I'm not really catching much differentiation between CosmicJS and those, either? The whole thing is coming off like low-information-targeting to me and that immediately makes me ask "OK, where's the grift?". I assume that isn't your intent, and I'm trying to give you the benefit of the doubt. But that's kind of the message I'm picking up here, and that might be something to work on.

<comment><AUTHOR> Thanks for the feedback. Our target customer is a team of developers and content creators that have experienced the pain of building and maintaining an installed CMS (could be any number of installed CMS systems WP being the most popular). If you haven't experienced that pain / are ok with it as a trade- off, that's fine. You're probably not a customer.

And I spent years building WP websites, made a career out of it for a while, so it's not anything against WP and certainly don't intend to come across the way you described. So really Cosmic JS was built to satisfy my own needs that I didn't get from an installed CMS.

<comment><USER7> This clears it up. Still, how do you plan to find and reach your target audience? Most of the people who I know use WordPress aren't too technical and like the premade plugins and themes. Conceptually, I think it alleviates many WordPress issues, but I'm having trouble thinking of someone I know personally who has the issues you describe.

<comment><AUTHOR> Our target customer is not a consumer, there are plenty of consumer CMS choices in the market. We're trying to solve the problem for teams of developers and content creators who don't want to waste time diverting developer time to CMS management.

<comment><USER7> When you say "developers", you mean developers of another product, who want to add a blog or something? If that's the case, I can better see the audience.

<comment><USER8> I think these dudes have it in their head that they just wrote the next React/Vue-tier JS framework, but in the CMS space.

</comment></comment></comment></comment></comment></comment><comment><USER9> What does "drop-in replacement for WordPress" mean exactly?

At first I thought it meant I could maybe go to cosmicjs.com, enter a url and the username and password for my WordPress site, hit a button and have my site magically migrated to something that was 10x better.

But I guess what you actually mean is "WordPress clone" which doesn't seem as exciting.

<comment><AUTHOR> We offer a web dashboard to create content and API tools and resources to integrate content into any new or existing website or app. We actually do offer a way to import your WP posts [https://cosmicjs.com/extensions/wordpress- importer](https://cosmicjs.com/extensions/wordpress-importer)

<comment><USER6> It sounds like you're describing something that one could port to, not a "drop-in" replacement. Wouldn't a drop-in replacement not provide the WordPress REST API?

</comment></comment></comment><comment><USER10> I have a hard time justifying the pricing here.

Wordpress is "free" vs CosmicJS is 49$/mo minimum without backup and only 3GB space.

For 49$/mo you could get a cloud VPS for Wordpress, including backups and even high-availability with no request limits (API limits in CosmicJS).

I know it's not straight comparable, but..

<comment><AUTHOR> Developer time is expensive. Allowing devs to focus on the core-product instead of CMS infrastructure is a big time/money saver. This is the value prop for most all API-first services: Stripe, Twilio, Algolia. Why would you build your own "free" payments processing / telephony / search service when these focused services have done a really good job solving the problem for you?

<comment><USER11> Because all of those are hard, and CRUD is easy?

I mean, I see your point. I'm just not convinced it's enough given the availability of a thousand other (free-ish) solutions.

</comment></comment></comment><comment><USER12> Now would be a good time to come for Wordpress and their huge failure in their new editor called Gutenberg.

Gutenberg promises to have WYSIWYG editable React components, which is a big deal, but they made insane decisions like storing the attributes in HTML, rendering HTML in the database, and requiring component developers to keep an array of deprecated changes when they want to modify anything on the component. In other words: you want to add a new CSS class to your component? Need an entirely new component for that in addition to maintaining the last one. Failure to deprecate will result in something like a fatal error in the editor that the user can't recover from. It's like PHP-era decisions with modern promises.

People are thrashing around in Github Issues, but the team seems unbothered. I would pay $$$$ for someone to unseat them.

<comment><AUTHOR> Great! A vote for Cosmic is a vote for change [https://cosmicjs.com/pricing](https://cosmicjs.com/pricing)

<comment><USER12> It doesn't look like you support visually editing custom React components (?)

<comment><AUTHOR> Currently, we don't offer a visual editor for React components. However, this can be done using an Extension. [https://cosmicjs.com/extensions/](https://cosmicjs.com/extensions/)

This may be something we or our community may make available soon with enough interest.

</comment></comment></comment></comment><comment><USER13> What is your plan to beat WordPress or get people to switch to your CMS away from WordPress ? There are plenty of other CMS providers out there who are doing a decent job but no one is able to take out the giant that is WordPress due to its market share and the community of support and plugin eco-system.

Also, terms such as "headless CMS" does not mean much to a regular user who is looking for a "site in WordPress". So is your intended audience primarily developers and freelancers/agencies ?

<comment><AUTHOR> If you look at trends in the CMS space, WordPress is losing favor: [https://trends.google.com/trends/explore?date=today%205-y&ge...](https://trends.google.com/trends/explore?date=today%205-y&geo=US&q=wordpress)

63.2% of developers voted it most dreaded in the 2018 Stack Overflow survey (narrowly beat by Windows Phone) [https://insights.stackoverflow.com/survey/2018/#most- loved-d...](https://insights.stackoverflow.com/survey/2018/#most-loved- dreaded-and-wanted)

Our customers benefit by avoiding the pain of building and maintaining their own CMS infrastructure so they can focus on their core product. And we have a growing community that is adding more value through education and resources for every new user.

You're right, our target user is not a consumer who has many options for a consumer CMS. Our target customer is a team of developers and content creators.

<comment><USER14> > If you look at trends in the CMS space, WordPress is losing favor: > [https://trends.google.com/trends/explore?date=today%205-y&ge...](https://trends.google.com/trends/explore?date=today%205-y&ge..).

In the last year, WordPress grew from 29.9% of websites to 33.3%. Is that really losing favor? [https://w3techs.com/technologies/history_overview/content_ma...](https://w3techs.com/technologies/history_overview/content_management/all)

<comment><USER7> You have to remind yourself to take this kind of figure with a grain of salt, since every measurement technique has some kind of bias. The StackOverflow survey specifically targets SO users, Google Trends might overestimate languages that receive lots of queries due to less experienced programmers or poor documentation, and it is truly impossible to scan the entire web to find which CMS powers each site (especially since customized CMS installations might not have telltale signs that others do).

</comment></comment></comment></comment><comment><USER15> Because you're closed source and charge outrageous amounts for a service that's been done a billion times.... I actually hope Wordpress puts your company out of business.

I would hate for naive people to get trapped in your ecosystem and continue to get overcharged for no reason.

</comment><comment><USER16> I'm currently using Cosmic JS for a personal project, and so far I've been really impressed -- I was able to launch my site in under an hour, and that was starting completely from scratch with no prior knowledge of Cosmic and having never used a headless CMS before.

One thing that helped a ton was the availability of pre-built templates; there happened to be a node app template that fit my frontend use case perfectly, so I was able make the tweaks I wanted and launch.

</comment><comment><USER17> Congrats on the progress so far. I can attest from spinning Corilla out of Red Hat and the journey we had with it, that there's always a niche for CMS or knowledge management tools.

Especially in the Series A to Series B segment, where ability to change, and necessity to remove complexity, meet the sudden availability of funds to assist. That's where your example of "you can pay X and hour for your engineer or Y a month for us to handle it" works well. How will you pitch this moving further up-market? Especially where the opex exists that dev costs are less important. And vendor lock-in (or likelihood of existing in five years) becomes an issue?

And further up the enterprise scale, the greater the demand for a robust open source community. Is this on your roadmap? If not, why not? Especially given you use Wordpress as an example, and most of the industry itself using open source as a basis for content engineering tools. It's now the default expectation. Even moreso with the likes of near competitors like Strapi being open source. Thoughts?

Your app library is nice, but much like Gatsby or Hugo... it's not "wow". Any plans to ramp up the devrel? How will you stand out from all the other headless CMS products? Especially with the likes of Contentful so well funded. Are you worried that the lack of open source cuts off the lower end of the market and community growth, and the war chest of competitors at the higher level of the market constrains your customer base somewhat?

And.. wat will CosmisJS look like in two and five years? What I love about CMS teams is the creativity and intent of the awesome people who run them, so I'd love to hear more about the big vision too! :)

<comment><AUTHOR> Thank you. These are all great questions and things we consider a lot.

> How will you pitch this moving further up-market? Especially where the opex > exists that dev costs are less important. And vendor lock-in (or likelihood > of existing in five years) becomes an issue?

We believe that developer experience is table stakes now. It's becoming less the case that the CIO buys the tech and hands it to the development team. Developers are more and more making these technology decisions for their organizations. So it's our goal to empower the developers to help champion Cosmic for their team.

> And further up the enterprise scale, the greater the demand for a robust > open source community. Is this on your roadmap?

Absolutely, that's why we're continuing to offer open source example apps, extensions, and integrations that can power complex business logic and to satisfy these types of customers.

> Any plans to ramp up the devrel?

Definitely, it's a big priority of ours to stay active in the developer community to listen and respond to use cases, technologies, extensions, and integrations that our customers will find valuable. This is our David / Goliath strategy. When you don't have a war chest to spend on marketing and sales people, you have to be resourceful :)

> And.. wat will CosmisJS look like in two and five years?

We've got an ambitious roadmap, so stay tuned! Simply put, our north star is to provide the most value for our customers by being the best solution in the era of API-first services.

</comment></comment><comment><USER18> Is it me, or the latest YC batch is rolling out negative surprises?

First, a magazine startup with sloppy design when design should be their foremost asset (after content): [https://news.ycombinator.com/item?id=19320608](https://news.ycombinator.com/item?id=19320608)

Now a WP replacement which showcases and labels a sloppy editor as Delightful Experience ... [https://cosmicjs.com/headless-cms#features--content- creators](https://cosmicjs.com/headless-cms#features--content-creators)

Have you checked Gutenberg, the lates WP editor? It does blocks, like Contentful, Strapi and the other few dozens competing on the headless CMS scene.

Headless CMS is in equal part about content creation and content delivery ... a REST API and Graphql is not enough.

Sorry for the harsh words again but ... I do Wordpress since the beginning and I'm actively searching for a replacement. Yet dissatisfied again with a YC startup, the second disappointment in two days.

Tell me it's coincidence.

<comment><AUTHOR> I'm interested to hear more about what you're looking for in a dashboard experience. If you are looking to find a replacement (and not just blast another YC company) what features would you like to see?

</comment></comment><comment><USER19> If anyone is interested in a much-much more basic version of headless-CMS (micro-CMS): check out [https://www.dropconfig.com/](https://www.dropconfig.com/) \- we built it as a collaborative repository+hosting for JSON files.

You can use it to manage all variable things in your app, including content itself, of course.

It literally takes less than a minute to get started, because you can create an "anonymous" dropconfig without signing-up.

</comment><comment><USER20> Shameless plug

If you are looking for a self-hosted opensource MIT licensed option, checkout Daptin

[https://github.com/daptin/daptin](https://github.com/daptin/daptin)

I have been working on this since about a year and half, use it across a bunch of my own personal sites and desktop apps.

Would love to elaborate if there is interest :)

</comment><comment><USER10> In Wordpress we can combine plugins to create a "whole" system, but your app directory looks like a ton of separate applications - which means, you can't pull together a bunch of plugins to create a complete system like with wordpress.

Or am i missing something?

<comment><AUTHOR> That's right, Cosmic JS apps are fully-built websites and apps.

Extensions are more like WP plugins: [https://cosmicjs.com/extensions/](https://cosmicjs.com/extensions/)

<comment><USER10> Ah, so i was missing something ;-)

Thanks!

</comment></comment></comment><comment><USER21> How do you position yourselves against someone like [https://www.contentful.com](https://www.contentful.com) ? Seems like a similar product, though less targeted directly at Wordpress Devs.

<comment><AUTHOR> There are a few headless CMS players in the space, but we're different in our approach. Compare other headless CMS dashboards and APIs and you'll notice a lot of work has been done to make our solution as simple as possible. Content creators get the easiest dashboard to create content and developers get the most intuitive API tools and resources to quickly integrate content. We've been told "it doesn't get much easier".

Plus we're set apart in our commitment to our community and education. Our community contributes apps / extensions / open source code / learning center articles to help others with their specific use case. Our goal is for each new user to benefit from previous work in our community by offering pre-built apps, extensions and tutorials they can use to build a great product faster and easier.

</comment></comment><comment> laurynas-s I was looking something like this when I wanted to add a blog for my React SPA apps. I didn't want WordPress, but I wanted a simple backend just for editing the blog posts.

However, I realised that it is going to be bad for SEO as I cannot do serverside rendering this way.

I cosidered adding a WordPress blog, but eventually just ended up with a simple markdown rendering from the files - 1 file - 1 post.

If you manage to find a easy way to support serverside rendering, the product is going to be good.

<comment><USER22> My server-side React blog ([https://philandrews.io](https://philandrews.io)) runs on Cosmic. And it's easy. Given that your blog posts reside at the end of a url, one GET request brings gets all the content you need to populate your index or post page. Pair your React with NextJS, fetch your post(s) in getInitialProps and you're good to go.

Here's an article I wrote about opening up a blog with Cosmic back in 2017. It still holds... [https://hackernoon.com/language-agnostic-content- management-...](https://hackernoon.com/language-agnostic-content-management- with-cosmic-js-42b5dbe1880f)

</comment></comment><comment><USER23> Just my $0.02, as someone who's been building things on WordPress more or less full-time for something like a decade now, and working with various other CMSes for another decade before that.

 _> Cosmic JS is a drop-in replacement for WordPress_

I don't know what "drop-in replacement" means in this context. To me, a drop- in replacement for WordPress would offer one or more of the following features:

1\. Connect to my existing WordPress content database and use it as its content store

2\. Use my existing WordPress theme to define its presentation

3\. Provide APIs that are 100% identical to the existing WordPress APIs (the Plugin API, the REST API, etc.)

4\. Allow loading and running existing WordPress plugins without modification

I don't see how Cosmic JS does any of these things. Some of them it addresses partially, an example being that there is a content importer available to pull content in from a WP site. But that still doesn't feel like a "drop-in" solution to me. A drop-in solution means I can pull out WordPress and replace it with the new thing without having to think much or rebuild anything, which does not seem to be the case here.

 _> We noticed that lots of development time was spent building and maintaining the CMS itself, sucking time away from core application development._

I don't understand this. WordPress famously installs in five minutes, and once that's done you only have to deal with it by installing updates, which is increasingly something it can do on its own without your intervention.

It may just be a matter of semantics - to me, "core application development" on WP is everything you do beyond installing WP itself: designing content architecture, selecting or building plugins and themes, etc. The "application" in the WP context is the complete bundle of database content, first-party code and third-party code you assemble to create a given site.

 _> automatic updates caused sites to crash_

I have literally never seen this. Never. If anything, my complaint on automatic updates is that the WP core team has been so cautious to avoid breaking sites that it's made getting automatic updates into the hands of WP users a glacially slow process.

 _> a client would decide to install a bunch of plugins that caused the site to crash_

Any sufficiently popular CMS that allows third-party extensions is going to have this problem. There are going to be third parties out there writing crappy code, and users out there who get dazzled by the marketing of that crappy code and install it. If your solution to this problem is to tell users they can't install third-party extensions, or to drastically limit what those extensions can do, you're going to be at a severe marketing disadvantage to systems that don't have those limitations. There are lots of dumb people out there who desperately want to do these dumb things, and don't like being told the reason they can't is because it's for their own good.

 _> comment spam was a never-ending battle_

Turn comments off (which you'd do on any non-blog site you're building with WordPress), problem solved. If for some brain-damaged reason you _want_ comments, install Akismet ([https://akismet.com/](https://akismet.com/)), problem solved.

 _> We're the only headless CMS that comes with a community of developers built-in_

WordPress itself is _becoming_ a headless CMS. WordPress.com already provides a REST API (see [https://developer.wordpress.com/docs/api/](https://developer.wordpress.com/docs/api/)), so if you just want to host your frontend and let a remote service host the software and database, you can do that with WordPress. (You can also do it with self-hosted WP, but the value proposition is less obvious there since you still have to run and maintain all the complicated backend stuff.)

If what I really want is a headless CMS, and WordPress has already started providing me with a way to satisfy that desire and is clearly going to be doing even more along those lines in the future, why should I switch? What do I get by switching that compensates for losing all the other stuff that comes along with using WP?

 _> providing hundreds of apps, extensions, and integrations_

I guarantee you do not have as many of any of these things as WordPress does.

Please note that none of these things are issues with the Cosmic JS product itself. (For all I know, it may be very good!) _They are 100% about the way you are pitching and positioning it._ If you came to me, a guy who's responsible for dozens of WP sites, and used this positioning to pitch Cosmic to me as a replacement engine for all those sites, I would not find it to be a very compelling pitch. A cursory examination of the product leads me to be skeptical that it would really be an actual drop-in replacement -- and if I'm going to have to rebuild those sites to use the product, then suddenly it's not just competing with WordPress, it's competing with WordPress and every other potential CMS I could rebuild them on. Now I'm doing what (IIRC) Joel Spolsky called "the dreaded market survey," which means now there's a million paths I could end up going down other than the one that leads me to buying your product. You _do not want that._ You want to keep me focused tightly on your product, not start me out window shopping.

So my suggestion would be to retune the way you pitch this product. If it really _is_ a drop-in replacement for WP, make it clearer exactly how and why. If it really _isn 't_, then don't pitch it that way. Find some angle that Cosmic JS has that both makes it superior to WordPress and is clearly taking it in a direction that WP can't or won't go, and lean on that.

I hope this advice is helpful, and that it is received in the spirit of cheerful willingness to help with which it is sent!

<comment><AUTHOR> Thank you for the feedback. I built a career building WordPress websites as well so I do have gratitude for the product and the ecosystem that it has built. But for years I did encounter these problems myself, maybe you or others have not, but this was my experience.

As for the semantics, you are correct, we are not proposing that you can use Cosmic to connect to your WP backend. We provide a light-weight solution to add dynamic content to any website or app. We offer a web dashboard to create content and API tools and resources to integrate content into any website or app. No infrastructure management needed. Our customers benefit from using Cosmic because they can avoid the pain of building and managing their own CMS infrastructure. But if you need that level of control and you like managing infrastructure, that's fine, then you may not be a customer.

We are seeing more and more services that offload these non-core infrastructure services: Stripe, Twilio, Algolia. They add value to development teams that do not want to manage infrastructure. That's our opinion on how content should be managed.

Hope this helps see things from our perspective. And I have taken your feedback in a cheerful spirit, as I hope you have taken my reply :)

</comment></comment><comment><USER24> The page insight report is really really bad: [https://developers.google.com/speed/pagespeed/insights/?url=...](https://developers.google.com/speed/pagespeed/insights/?url=https%3A%2F%2Fcosmicjs.com%2F)

I mean, you are providing a CMS and your own page is this slow?

Shouldn't speed be the main focus?

<comment><USER7> The site isn't actually that slow as a user, though. In the fourth frame of the little "film-roll" view below the times the content has already loaded. Most of that number comes from waiting for that little JavaScript-controlled chat button in the bottom-right corner.

<comment><USER24> I wish them all the luck in the world, I just shared something that I thought they might consider looking into as many CTO's would do the same thing I did.

But c'mon... It's giving me 14 secs to interactive. How isn't that slow?

<comment><USER7> Hmmm. I'm over a fairly high-latency, low-bandwidth mobile connection and it loads pretty quick (more like 3 seconds than 14). You make a valid point if it does in fact take 14 seconds to load, because that's ridiculously slow.

</comment></comment></comment></comment><comment><USER24> Question: How was your traction before you guys joined YC?

>We're now powering production websites and apps for hundreds of teams around the world across various use-cases.

I guess I don't understand why would anyone join an accelerator with this level of traction. Seems that fundraising should be pretty straightforward.

<comment><AUTHOR> We had good traction before YC. But YC comes with many benefits, not just fundraising.

<comment><USER24> I fully agree. What was the #1 factor for you to join the program?

<comment><AUTHOR> Hard to boil it down to just one. The dedicated help in improving the company, the network, and others are the biggest.

</comment></comment></comment></comment><comment><USER25> Does this work with static site generators?

For the API requests per month pricing tiers, roughly how many API calls get made each time a site build is triggered for a site with say 100 blog posts?

<comment><AUTHOR> Yes, you can get all of your content from Cosmic at build time for your static site. Here are some resources that may help:

Gatsby source plugin: [https://www.npmjs.com/package/gatsby-source- cosmicjs](https://www.npmjs.com/package/gatsby-source-cosmicjs)

Gatsby Starter: [https://github.com/cosmicjs/gatsby- starter](https://github.com/cosmicjs/gatsby-starter)

Gatsby App: [https://cosmicjs.com/apps/gatsby- blog](https://cosmicjs.com/apps/gatsby-blog)

Gridsome App: [https://cosmicjs.com/apps/gridsome- blog](https://cosmicjs.com/apps/gridsome-blog)

For API requests: To get all of your posts, you can use just one API request to the Objects endpoint.

Does this help?

<comment><USER25> Thanks! So you mean if I wanted to trigger a fresh build of a Gatsby site, it would only take a single API request to pull in all the content needed for the build? Even if you had thousands of posts and pages?

<comment><AUTHOR> That's right. You get up to 1,000 results (Objects) before you have to do multiple requests on the API.

</comment></comment></comment></comment><comment><USER26> Which database backend are you using? Apologies if it's been mentioned. Also, does Cosmic support graphql subscriptions or streaming/live data?

<comment><AUTHOR> We use MongoDB. We have a GraphQL API [https://cosmicjs.com/docs/graphql](https://cosmicjs.com/docs/graphql), but do not currently offer streaming live data.

</comment></comment><comment><USER27> This sounds amazing. Good luck Tony. Cosmic is very useful and I wish you luck.

<comment><AUTHOR> Thanks Emil!

</comment></comment><comment><USER28> you guys know you've got something important because there's an amazing amount of pushback from hnow it alls here. a bit of a lightning rod for criticism. well done!

</comment><comment><USER29> What is your current MRR?

</comment><comment><USER30> Check out sanity.io. They have a somewhat similar product.

</comment><comment><USER31> Sounds very good by the description! I'll give it a try.

<comment><AUTHOR> Great! Let me know if you have any questions :)

</comment></comment><comment><USER32> A lot of skepticism and resistance here. @tonyspiro, all the best at this. I do follow what you're doing and see the benefit of this in comparison to and also regardless of WordPress. At some point most things will be operating via APIs, and via hassle free SaaS services anyway. I, for one would not want to deal with installs, updates of any kind. It sounds like you've got some good traction that can hopefully continue. I will though acknowledge a few concerns:

1\. A proper import / export tool for risk management

2\. A slightly more refined message / call to action

3\. Why the JS centric name/brand? Can it be used outside of NodeJS based tech stacks?

4\. The price poice does seem high for small teams. You mentioned that this is normal for SaaS for some companies you listed. However, until you're established, it sounds a bit high. Can you perhaps go for a discount for the first X amount to time to entice potential customers?

Best! \- K

<comment><AUTHOR> Some answers to your points:

1\. We do offer a full data export. After you login, go to Bucket Settings > Import / Export to get a full JSON file export of your Bucket.

2\. Thanks for the feedback. Anything specific?

3\. Early on we wanted to be able to add dynamic content to any website server-side or client-side using NPM / React / Angular. And the domain name was available :)

4\. Our target customer is teams, not individuals. And the value resonates even more with larger teams because they experience more of the pain. We've actually been told they would pay more :)</comment></comment>


Ask HN: Why Google Drop Linux Support? - <AUTHOR>

Google Photos just released today, and it's Desktop Uploader only support Mac OS X and Windows. Where is Linux?<p>https://photos.google.com/apps <comment><USER2> Have they 'dropped' support or did they just never support it? I don't see any consumer software made by Google that runs on Linux.

<comment><USER3> Google Earth is on Linux Picasa was on Linux

A lot of the decisions are based on returns on investment. Even though internally they may use a lot of Linux, I guess they don't see as much as a return on outside use of Linux. There has been a lot of success of running Windows based google apps with WINE.

</comment></comment><comment><USER4> For that matter, why is there no Minix support? Why no Haiku support?</comment>


Intel predicts a $7 trillion self-driving future - <AUTHOR> https://www.theverge.com/2017/6/1/15725516/intel-7-trillion-dollar-self-driving-autonomous-cars <comment><USER2> The 'half-million lives saved' will shoot themselves driving behind cars programmed to travel at the speed limit.</comment>


A Tour of a Real Geeks Room - <AUTHOR> http://todaystopthing.com/?p=304

<comment><USER2> Just looks like someone with a load of expensive gadgets neatly arranged in a room, i.e. a moron with a load of money rather than a geek with a genuine interest.</comment>


Hannah Arendt: Remembering W.H. Auden (1975) - <AUTHOR> https://www.newyorker.com/magazine/1975/01/20/remembering-wystan-h-auden-who-died-in-the-night-of-the-twenty-eighth-of-september-1973 <comment><USER2> _" Auden, instead, became a Christian; that is, he left the train of History altogether."_

That is particularly insightful. All the hoopla about historical progress is a rather recent addition (and addiction ...) to our worldview, and not really part of perspectives with more than a handful of centuries tradition.

<comment><USER3> I guess she means he left communism. A belief in history, almost as a god, is inherent in communism as I understand it. The changes they believe in are pre- ordained, they need only to join the stream.

<comment><USER4> Communism does not have the pretensions to divinity and supernatural aspects that we see manifested during elections in the USA.

It has a recognition that the forces of production change. That relations of production change, and this base changes superstructure in the society. Hunter gatherer tribes make way for Sumerian and Greek slave empires, make way for feudal Europe, which make way for capitalism and bourgeois republics.

The Paris commune, the Russian revolution, the 1936 Spanish republic etc. are seen in this light as nascent proto-steps toward the next superstructure coming out of changed forces of production and relations of production.

History has already seen four major changes from one system to another, but not by means of divinity. Marx's pointed to contradictions inherent to capitalism. I think the 2008 bailout and crisis would be a sign of the eventual end in Marx's view - US Treasury secretary Hank Paulson said GE CEO Jeff Immelt visited him on September 15, 2008 and said GE was having trouble financing day-to-day operations. Events like that are harbingers of the eventual collapse of the capitalist economic system, in Marx's view. For now, the government and taxpayer bailing out the capitalists and corporations work, in Marx's view, one day it will not work. But the collapses are only part of the collapse, advances had to have happened to shift the system as well. It is not divinity, it is history continuing to be dialectic.

<comment><USER5> How does communism change the knee jerk negative response it receives in the West?

</comment></comment></comment></comment><comment><USER6> That should surely be "Remembering", not "Rembering".

<comment><AUTHOR> mm, macbook keyboards. My mistake.</comment></comment>


Ask HN: Advice on cofounders wanting to kick you out - <AUTHOR>

Hello everyone,
I usually have an account with a decent 4-figure karma, but felt safer asking for advice on this topic through a throwaway account.
Here's the situation: we're a young startup doing some pretty cool things, but after we released our product to the general public things started going a bit apeshit. Many mistakes were made and we basically failed to iterate quickly enough, all the while bleeding money like a slaughtered pig. Or at least bleeding much more money than we can afford without managing to get much return on this, shall we call it, investment.
My official role in the startup is that of ceo and cto, if such titles even apply in a small team.
Now the situation has deteriorated so far that the other cofounder has decided he wants to kick me out of the startup because everything that's gone wrong is my fault and I am being very incompetent.
What I'd like to know is if anyone has any advice on what to do in this situation?
I was the original founder who started solving a problem and I seriously don't want to leave what I've poured my life into. While I understand that staying in the role of ceo is a bit unrealistic right now given my track record, I know I can still bring value to the startup and I honestly don't think the startup will, in the long term, be as awesome without me as it can with me on board.
So yeah, if anyone can offer some advice or share some experience on handling this sort of situation I would be much obliged.
edit: to clarify, I am willing to step down as CEO and take on a CTO job at least for a while, so that I could focus more on the things I'm good at. <comment><USER2> Who has final say in the matter? If both of you have even voting power than you need to figure out what each of you want.

You seem to want to stay in the startup.

Your cofounder wants you out.

This is where you start. Maybe you leave taking a percentage of equity with you. Or investigate vesting options where you immediately vest and step down to another role.

</comment><comment><USER3> Please quantify monetarily what you mean by "I honestly don't think the startup will be as awesome without me."

I applaud your humility in admitting the mistakes were in fact yours. But you offer nothing here that suggests things will be different in the future. Reconfigure your role so you can still contribute but allow someone else to make the major decisions.

<comment><AUTHOR> Not sure on how to monetarily quantify it to be honest, I guess the difference between being a 10's of millions a year and being 100's of millions a year.

As I said, I am willing to step down as CEO and just remain a CTO at least for the time being, however the other cofounder's stance is that I don't deserve even that much. They even went so far as to suggest I don't deserve even a code monkey job in the future.

<comment><USER4> Unless that was a heated comment that was later apologised for, it sounds like your differences might be irreconcilable, no matter how much you can potentially contribute...

</comment></comment></comment><comment><USER5> Couple follow-up questions:

1.) Have you admitted to your cofounder you screwed up? You're owning up to it here (+1) but to him?

2.) Did you just screw up your CEO part of the job or both CEO & CTO?

3.) Could you live with just being a code monkey (role player) for a while?

4.) How many people are in the company?

<comment><AUTHOR> 1) Yes.

2) That one's a bit difficult to judge, I certainly screwed up the management parts of my job, whether I'm any good as an architecture designer and someone who makes technical decisions ... can't really tell; I think I managed quite alright.

3) I guess potentially I could, but not very happily. I'd rather remain a CTO and have some very hands-on/tough coaching regime to get me into shape within a few months.

4) Right now there's just the two of us, but some other people are involved on a looser basis.

</comment></comment><comment><USER6> Just curious - how are you the original founder, CEO, & CTO, yet someone else has the ability to kick you out of the company?

<comment><AUTHOR> Well there are two ways this someone else can kick me out.

1\. We have some advisors/extremely-early-investors so any two parties that band up together, have the majority share and can throw the third party out.

2\. This someone else has been footing a lot of the bills for the startup because they could take on other projects while I worked on the product. Because the we agreed to mostly split the bills halfsies and I didn't have the money, the other cofounder payed for me and now I owe him the money. He is now requesting I vouch for it with a big enough share of the company so he'd hold the majority share.

Also, as mentioned, we're both in the company on a reverse vesting thing - this is so when problems occur, people can be thrown out without taking half the company with them (ie. better for the company, not for the persons)

And that's basically how someone else has the ability to kick me out.

<comment><USER6> Then you need to settle with the other guy and one of you needs to leave with a small share of equity for time served.

</comment></comment></comment><comment><USER7> What's the nature of the agreement between you. Can you just dissolve the start-up and go your separate ways?

<comment><AUTHOR> The cofounder and I came together because of the startup. And we have the good ol' reverse vesting thing, neither of us is over the 0% boundary yet.

As for the startup itself, it's almost certain to get a follow-on of a certain government grant, so it wouldn't be the wisest decision to just dissolve it completely.</comment></comment>


What happens when you type Google.com into the address box and press enter - <AUTHOR> https://github.com/alex/what-happens-when/blob/master/README.rst <comment><USER2> A spot of satire to go along with this: [https://alwaystrend.in/articles/interview-question-what- happ...](https://alwaystrend.in/articles/interview-question-what-happens-when- you-visit-a-url-phased-out)

</comment><comment><USER3> Previous discussions: [https://news.ycombinator.com/item?id=8902105](https://news.ycombinator.com/item?id=8902105), [https://news.ycombinator.com/item?id=9189096](https://news.ycombinator.com/item?id=9189096)

</comment><comment><USER4> It's lacking the biology part and physics part, and chemistry, and ....

Some of the sections are just out of context and become showing offs(like the keyboard part. For a hardware position that is not enough, for a software position that's non-relevant), which doesn't mean more sophisticated, just different interest domains.

<comment><USER5> Your comment sums it up well but I don't see what the problem with that is. Expanding arbitrarily into different interest domains without any limits (upper or lower) to detail seems exactly the point of this repo. Which seems great.

<comment><USER4> That point (arbitrary domains) become less impressive for me when I knew everybody can have some less known knowledge to others.

I found I often can learn from slickdeals discussion in various topics, which is actually a good way to hear seasoned opinions.

</comment></comment></comment><comment><USER6> This is like that old comedic trope where someone says start at the beginning and the respondent says 'Well, a long time ago the universe existed as a single point that was infinitely small, infinitely hot, and infinitely dense..' and the questioner has to spend a lot of time saying ok skip that, okay skip that part...

on edit: typo fixed

</comment><comment><USER7> I love this how oversimplified this is.

</comment><comment><USER8> What is the actual utility of this question?

<comment><USER9> Before it was such a cliche, it was actually a great question. Open ended, allowing you to gauge how a candidate deals with unknown problems; answers can focus on any part of what happens, giving you an idea of where the candidate has most experience; lots of opportunities to ask questions to go deeper; but also lots op opportunities to say 'yeah let's just skip this part'.

As a candidate, I loved the creativity in it, and the chances it gives you to show off knowing things that you don't necessarily _need_ to know to do a certain job but will still make you better at it than others. Say, when you're an (average) web dev, you don't need to know much about DNS. But pointing out the difference between an A and an MX record shows you have deeper knowledge than many, or at least that you've managed some systems before.

Look, I'll admit that I too have at some point asked people 'what's the difference between an object and a class'. But that's such a shit question, today I'd only do it after having asked some other questions they completely bombed to check if they know anything at all, or after apologizing profusely for the question and blaming it on 'standardized interviewing procedure' or whatever.

I deal a lot with spatial information systems; here's my favorite question I used to ask back when I interviewed people: consider a matrix A of dimensions M x N. Assume that that matrix represents a height map, i.e. each value represents the elevation at that location of a (discrete representation of) a terrain. How would you go about filling this matrix to make it represent a pyramid, i.e. the center cell having the highest value, linearly going down to 0 (or 1) at the border cells? Start by enumerating the assumptions you make, pick the ones that make your solution simplest, then go from there describing how you'd go about relaxing the constraints of your assumptions.

Then I'd draw a sample on a small 5x5 matrix.

I've had people who couldn't understand the problem no matter how hard I tried; and then I had people who would insist on showing 5 different ways of doing it complete with big O notation (in both cycles and memory) to illustrate the trade offs.

Anyone else have any favorite interview questions they came up with themselves that you think are a good representation of your field?

<comment><USER10> I assume my code knows (or can readily find) the value of M and N. The max_height of the pyramid is ceil(M/2) + ceil(N/2). The height of every point in the matrix can be readily calculated by taking its Manhattan Metric distance from the center. The equation is max_height - (floor(abs(i-M/2)) + floor(abs(j-N/2))). O(MN) operations are needed. The ceils and floors are there to deal with the case that M or N is even. I did this in my head so there may be off an off by one error which is easily remedied.

I forget terminology. Object is an instance of a class right?

Did I get the job?

<comment><USER11> Actually, if your M/2 isn't integer division (which I assume is the case from your use of ceil around it first), your 5x5 pyramid would look like this:

        23443
        34554
        45665
        45665
        34554

Using max_height - (abs(i - floor(M/2)) + abs(j - floor(N/2))) would give the properly-centered pyramid:

        23432
        34543
        45654
        34543
        23432

Your max height should really be just max(ceil(M/2), ceil(N/2)) for a height of 3 going to 1 at the edges or floor(M/2) for 2 to 0. Using both Manhattan distances gives you an octagon-base pyramid (approximated to the square shape) when really you just want the max of both distances:

        max_height - max(abs(i - floor(M/2)), abs(j - floor(N/2)))

gives:

        11111
        12221
        12321
        12221
        11111

But this only works for square pyramids, using 3x5 you get:

        12221
        12321
        12221

If you want a rectangle pyramid, use min manhattan distance from edge (don't need a max height then):

        1 + min(i, N-i-1, j, M-j-1)

gives:

        11111
        12221
        11111

or for a 7x10 grid:

        1111111111
        1222222221
        1233333321
        1234444321
        1233333321
        1222222221
        1111111111

Python 3 code for those who want to test themselves:

        N = 7
        M = 10
        for i in range(N):
            print("".join(str(1 + min(i,j,N-i-1,M-j-1)) for j in range(M)))

<comment><USER10> This is what I get for trying to work it out in my head and be the first clever person to respond to OP.

I like your code. very elegant solution with mins and such.</comment></comment></comment></comment></comment>


JSON: The Fat-Free Alternative to XML - <AUTHOR> http://www.json.org/fatfree.html

<comment><USER2> Is the existence of JSON news?

<comment><AUTHOR> _"'Is the existence of JSON news?': JSON's simple values are the same as used in programming languages. JSON's structures look like conventional programming language structures. No restructuring is necessary. JSON's object is record, struct, object, dictionary, hash, or associate array. JSON's array is array, vector, sequence, or list ..."_

It's not the existence that makes it worth posting. It's the why it's used.

One of the questions I was wrestling with yesterday was, _"Why am I thinking of using XML as a data format when all I want to do is give users access to their data?"._ "Do I really need to spend excessive time developing a data standard with XML schema's . Then burden my code with machinery to manipulate it?"* _"Do users really want this now?"_. Asking these questions I realised the approach I was taking was code-calorie rich. Too rich and the better alternative is "Fat-free" JSON. Hence the inclusion.

        ".. The cost of adding a feature
        isn't just the time it takes
        to code it. The cost also
        includes the addition of an
        obstacle to future expansion.
        ... The trick is to pick the
        features that don't fight
        each other."

I used to hang out on Slashdot a lot and I remember reading an interview with John Carmack back in the 90's. I can't find the references now. But the gist of it summarised in the above Carmack quote. HackerNews is what hackers find interesting. Data formats are interesting. Choose the wrong one and you may hamper yourself later on. Case in point is a new xml format that is in development. It work well. But does it need the extra 30Mb in software libs to run it? ~ [http://knitml.svn.sourceforge.net/viewvc/knitml/knitml_core/...](http://knitml.svn.sourceforge.net/viewvc/knitml/knitml_core/tags/release-0.1/trunk/src/main/resources/com/knitml/core/xml/pattern-0.1.xsd?view=markup)

When making things a lot of the time there is no one "right" choice. Just lots of little ones ~ <http://en.wikiquote.org/wiki/John_Carmack>

<comment><USER2> Data formats are interesting, but I think everyone that reads this site has been using JSON for centuries now.

<comment><AUTHOR> _"... Data formats are interesting, but I think everyone that reads this site has been using JSON for centuries now. ..."_

Are you sure?

The disqus guys I imagine they read this site or at least represent the readership. Well go check a disqus account and go to <http://disqus.com/configure/username> then <http://disqus.com/migrate/username> and what do you get? Xml and Rss. So there goes that idea.

I wonder if the readers on this site and/or those who use JSON use it because it's just there in their toolkits. Or do they purposefully choose it after asking why?</comment></comment></comment></comment>


C and Go without CGO - <AUTHOR> http://skullcountry.com/c-and-go-without-cgo

<comment><USER2> The article doesn't mention any of the downsides to this approach, the biggest being style of C code. From Dave Cheney[0]

\- Using C code is inherently unsafe, not just because it unholsters all the C footguns, but because you can address any symbol in the runtime. With great power comes great responsibility.

\- The Go 1 compatibility guarantee does not extend to C code.

\- C functions cannot be inlined.

\- Escape analysis cannot follow values passed into C functions.

\- Code coverage does not extend to C functions.

\- The C compilers (5c, 6c, 8c) are not as optimised as their companion Go compilers, you may find that the code generated is not as efficient as the same code in Go.

\- You are writing plan 9 style C code, which is a rough analogue of C89.

[0]: [http://dave.cheney.net/2013/09/07/how-to-include-c-code- in-y...](http://dave.cheney.net/2013/09/07/how-to-include-c-code-in-your-go- package)

<comment><USER3> Also some highly non-obvious gotchas and notes, straight from the trenches:

\- VERY IMPORTANT: you'll be actually writing for a _pre-ANSI C compiler!_ Anything you think you know about C may prove false! Example real-world discrepancy found when porting Lua (an extremely high-quality ANSI C codebase) to Go's cc: [http://golang.org/issue/7027](http://golang.org/issue/7027)

\- The ternary operator (?:) is not supported on ARM (see: [https://github.com/akavel/goluago/issues/8#issuecomment-4144...](https://github.com/akavel/goluago/issues/8#issuecomment-41448868))

\- You don't have #if, #elif

\- You must be super careful, and really know what you're doing, when trying to pass pointers through the C<->Go boundary, as you're entering GC (garbage collector)'s carefully tended house of cards

\- You don't have access to the C standard library (although, see [https://github.com/akavel/gostdc](https://github.com/akavel/gostdc))

\- Using varargs functions is non-trivial

\- You must ensure you include one special header in _each and every_ C file (#include "runtime.h") because of special "extern register" variables; although, I'm not sure if this requirement was not removed in Go 1.3.

Hm, that's all I could remember from the top of my head. If you have any questions, feel free to ask me by email (email@example.com) or, obviously, anyone on the golang-nuts mailing list.

That said, it's sure fun! :D actually, maybe in part _because_ of all that :)

<comment><USER4> > you'll be actually writing for a pre-ANSI C compiler!

I would not say the compiler is pre-ANSI. For example it even has _some_ C99 features. Rather, it chose to ignore ANSI, so yes, you need to really careful with what your doing. The integer promotion rules are different, for example

        -1 < u16int(42)

is false, unlike in ANSI C.

> You must be super careful, and really know what you're doing, when trying to > pass pointers through the C<->Go boundary

Yes, however that is true with cgo as well. Especially now with the new precise garbage collector.

> because of special "extern register" variables; although, I'm not sure if > this requirement was not removed in Go 1.3.

Nothing changed in 1.3, however big changes are coming into Go 1.4 and Go 1.5. Eventually all the C code in the runtime will go away. Until then, the plan is to move all remaining C code onto the scheduler stack instead of having common Go and C stacks, as that interferes with the copying stacks and the new precise garbage collector.

In other words, using the Plan 9 C compiler in your project uses to work by accident. Not it appears as it would still work, but it actually has a subtle net negative effect that's not obvious to see at first glance. You should avoid it.

</comment></comment></comment><comment><USER5> I'd love to know how this works behind the scenes.

In the article, a file called chello.c and a file called gohello.go are created - do the filenames have any significance? How does the go compiler and linker know what to do here?

<comment><AUTHOR> Run strace -f -eexecve go build to see whats going on under the covers. The filenames are because 6c and 6g both produced an object file named hello.6.

6g,6c, and 6a produce object files on amd64. 6l is the linker which combines them. Honestly I had a little trouble running the commands individually so I just used go build.

<comment><USER4> Run

        go build -x

There's no need for strace.

</comment></comment></comment><comment><USER5> Excellent article, but this post needs a better title. C and Go without CGO might be okay for here.

</comment><comment><USER6> Can anyone explain the use of the "·" character?

<comment><USER7> So Russ Cox goes into more detail in this post [https://groups.google.com/d/msg/golang- nuts/MdYlJbW4SAo/TrAE...](https://groups.google.com/d/msg/golang- nuts/MdYlJbW4SAo/TrAEoCjAkMwJ)

      Although Go does not compile via C, occasionally C code does need to
      refer to Go identifiers. Since we chose not to restrict the mangled Go
      names to the space of valid C names, we must add some mechanism to
      refer to Go names from C. That mechanism is:

      1. In the assemblers and C compilers, which already accepted all
      non-ASCII Unicode code points in identifiers, the Unicode characters ·
      and / rewrite to ordinary . and / in the object files.

      2. A symbol with a leading . has its import path inserted before the .
      when being linked: inside encoding/json.a, a reference to ".Marshal"
      is equivalent to "encoding/json.Marshal".

      Because of 2, we went a long time without needing a special character
      for slash. Recently the introduction of race detection has made it
      convenient for package runtime to be able to refer to a few symbols in
      runtime/race, hence the new slash lookalike."

<comment><USER3> For some supplementary information, see also this answer on stackoverflow: [http://stackoverflow.com/a/13490787/98528](http://stackoverflow.com/a/13490787/98528)

</comment></comment></comment><comment><USER8> "as fast as physically possible on your CPU architecture" is a ludicrous phrase full of misunderstanding.

<comment><USER5> Can you suggest a better one?

<comment><USER9> I think what pekk is complaining about is the "as fast as physically possible" - unless your CPU is on a rocket heading to the moon it is not physically moving as fast as physically possible.

As for a suggestion how about just "as fast as possible".

<comment><USER10> As fast as physically possible means "as fast as allowed by physics".

It's all physics!</comment></comment></comment></comment>


Show HN: Windows 95 in the browser - <AUTHOR> http://win95.ajf.me/ <comment><USER2> This is pretty nifty. I rediscovered how much I hate Windows solitaire: [http://i.imgur.com/a8jbpok.png](http://i.imgur.com/a8jbpok.png)

<comment><AUTHOR> The three-at-a-time version is frequently unbeatable. However, there's an option in the settings to let you flip through the deck one-at-a-time, which makes it always beatable.

Klondike Solitaire, or at least Microsoft's implementation of it, is fatally flawed. A shame, it can be fun sometimes.

</comment></comment><comment><USER3> It isn't starting here. Maybe the download hasn't complete, but it says it has.

<comment><AUTHOR> There's a 47MB disk image it has to download. That's after the "All downloads are complete" message, unfortunately.

</comment></comment><comment><USER4> awesome...except it froze my entire PC (i74640k, 16GB, SSD) Firefox, Windows 10

<comment><AUTHOR> If a web browser is able to freeze your system, that's rather damning for Windows 10's stability.

<comment><USER4> I can't argue with that, was just giving some feedback in case you wanted to look into it. Oddly enough, it froze around the time I tried launching IE 3.0 :)

Either way, really impressive software, very well executed.

Edit: happened on Chrome too, froze the tab but not the app. JS Console:

[http://i.imgur.com/jlvX9Gp.jpg](http://i.imgur.com/jlvX9Gp.jpg)

<comment><AUTHOR> Weird. The emulation has some issues and the emulator will abort in some cases (like opening IE3.0). But it shouldn't crash the tab.

</comment></comment></comment></comment><comment><USER5> epic!</comment>


Magnetic RAM could soon absorb and use waste heat - <AUTHOR> http://www.extremetech.com/extreme/101497-magnetic-ram-could-soon-absorb-and-use-waste-heat

<comment><USER2> Thermal differential can produce electrical power.

It isn't clear to me how modulating the thermal resistance across the magnetic cell improves the situation, nor how changing the 1nm thick layer's thermal resistance by a factor of two is significant in the larger scheme of substrates, magnetic layers, and adjacent bypass materials.

The headline smells like a good candidate for an XKCD $200 neutrino bet.

<comment><USER3> Indeed, whoever wrote that article either doesn't understand the issues involved or just plain isn't thinking coherently.

Now, this technology _could_ be useful in some places where you want to control the flow of heat -- in a climate with hot days and cold nights, you might want the walls of a building to be good at conducting heat during the night and good at insulating during the day (or possibly vice versa, if your primary challenge is keeping the building warm enough) -- and the thermoelectric effect could _maybe_ be useful to the extent that having self- powered elements would avoid the cost of running (very small amounts of) power everywhere.

But I'm with you on the neutrino bet as far as the application suggested in the article goes.</comment></comment>


GitHub under DDoS attack right now (again...) - <AUTHOR> https://status.github.com <comment><USER2> There are groups of people blackmailing companies for money, threatening with DDoS attacks if they do not comply. A client of mine, a European company gets these occasionally. The bigger the company/service, the bolder are the requirements. Crime, unfortunately, doesn't have feelings for such a great services as GitHub is. I hope GH will be able to mitigate the attack fast.

<comment><USER3> To be fair to crime (... Heh), we're not doing ourselves any favors by putting all our eggs in one basket.

How long until they graduate to exploiting GitHub and securing proprietary code from private source repositories, or forging commits to critical repositories (how often do _you_ verify that every commit in the repo with your name on it is definitively yours?)

<comment><USER2> True, but these people usually want money - fast. The process you describe takes time and with time the risk of being caught expands. So I guess "real criminals" would opt for fast money rather than long term possibilities. The option you're describing seems more likely for various "agencies" and the likes...

</comment></comment></comment><comment><USER4> Honestly if I had the eleventy squillion bytes/s bandwidth of a large DDoS behind me and I wanted to DDoS GitHub ... I'd DDoS the status page too (just for shits and giggs).

But on a serious note, is DDoS'ing a server that serves mostly static content way too hard? I imagine taking out one of GitHub's ways of communicating what's going on is appealing.

<comment><USER5> There are two types of DDoS attacks, which Github actually wrote about last week (thereabouts[1]), although you'll be unable to read the blog post until the site is back (unfortunately).

But I can outline the two they discussed. The first is a "complex attack", which basically consists of doing things that make the server overload itself (repeatedly handshaking SSL, etc.), and that would be mitigated to some extent by reducing the complexity of the site (i.e. you can't SSL handshake with a server that only knows HTTP). Similarly, dynamic content could be an attack surface, so static content would make it more difficult to use such a complexity attack.

The other type of attack, a simple bandwidth attack, doesn't care if your server is a top-of-the-line quad-chip Xeon server or an RPi in your basement, because all it does is exploit the bottleneck that is bandwidth. This attack just pumps packets like mad in your direction, and your network will likely become congested (and eventually fail) at some level other than your server (i.e. router level, firewall can't handle 100 Gb/s so the packets never even make it to your server).

So, in light of the second there, DDoS'ing static content is just as easy as DDoS'ing dynamic content sites, as long as you're using a bandwidth type attack.

I encourage you to read the blog post when the site is back up, it's definitely worth a read!

[1] [https://github.com/blog/1796-denial-of-service- attacks](https://github.com/blog/1796-denial-of-service-attacks)

<comment><USER6> It seems back now, but in case anyone finds this comment the _next_ time GitHub is under DDoS:

[http://webcache.googleusercontent.com/search?q=cache:KNnwGeD...](http://webcache.googleusercontent.com/search?q=cache:KNnwGeDlspwJ:https://github.com/blog/1796-denial- of-service-attacks+&cd=1&hl=en&ct=clnk&gl=ca)

</comment></comment></comment><comment><USER7> In my teenage years I don't think anyone with access to a few servers hooked to T1 lines had to have any excuse to use that to DoS anyone. I always assumed they had some sense of fun (whatever that is) or were compensating for something else in their life.

Anyway, I don't think we ugly bags of water have changed much in the last 20 or so years. I wouldn't read too much into this GitHub DDoS event.

</comment><comment><USER8> Of all the sites I frequently visit/use, GitHub is by far the one to get DDoS the most often. Anyone has any insights on why?

<comment><USER9> I'm not prone to violence but if I met someone who I was certain DDOS'd Github I'd certainly immediately punch them hard in the face.

Github is a noble company with noble end-goals, and collaborative open-source is a revolutionary "work" idea. To see someone smash a bottle on the counter and threaten the nicest guy in the room gives me rage.

<comment><USER10> > I'd certainly immediately punch them hard in the face

Looks to me you are prone to violence.

</comment></comment></comment><comment><USER11> What happened to the Hubot command to redirect the attack to the contracted provider? Surely they can handle it.

<comment><USER12> This isn't as simple as it sounds; they'd need to identify DDoS traffic and reroute, while still allowing "legitimate" users through.

But this may not be the sort of brute-force bandwidth DDoS that this was designed to handle either -- it could be a more targeted attack to existing bottlenecks in GitHub's architecture.

<comment><USER11> They made praising comments about the service last time.

</comment></comment></comment><comment><USER13> Since most are on the github.io domain, maybe someone is fighting back against the propagation of 2048 clones?

<comment><USER14> .io domains are hosted separately for this reason (and others, probably).

</comment></comment><comment><USER15> This is getting ridiculous. There are so many sites to attack, why Github?

<comment><USER16> Could this be in any way related to Julie Ann Horvath's treatment at the company?

<comment><USER9> I didn't know the story. From [http://thinkprogress.org/economy/2014/03/19/3416013/github-j...](http://thinkprogress.org/economy/2014/03/19/3416013/github- julie-ann-horvath-sexism/) :

"The sight of her male coworkers leering at a group of women in the office was the last straw for Github's first female hire."

Take a workplace with all-men, and due to _sheer probability_ you're going to get a lot of leerers when any number of women walk in. That's really a bit unfair of an assessment. I'd like to see what happens when an attractive man walks into a workplace that is all-women.

<comment><USER17> _I 'd like to see what happens when an attractive man walks into a workplace that is all-women_

I've been in this situation a few times and it makes me feel incredibly terrified.

</comment></comment></comment></comment><comment><USER18> These days when I see a GitHub post that they are experiencing a DDoS attack I have a slightly cynical reaction to it. I was at a software conference where we had thousands of people hitting GitHub to clone projects for workshops all that same time. They shut us down and said they were experiencing a DDoS... We were lucky that a couple of GitHub employees were at the conference and were able to contact the main office to get things straightened out.

</comment><comment><USER19> Message about DDoS attack could cause another wave of DDoS performed by thousands of users continuously refreshing a website to see if it's up.

</comment><comment><USER20> My company is in the process of moving from our own SVN server to using GitHub. Is this a bad idea in light of all these DDoS attacks recently?

<comment><USER21> Github still holds quite a lot of nines in terms of uptime. It's just that it's extra visible when something big like Github goes down.

The important part you should consider is to switch go git. I'd recommend starting to use Github, and if you find that it's down too much, look at alternatives or at hosting a solution yourself.

<comment> vertex-four No they don't now. Because of the recent DDoSes, they're at 99.93%.

<comment><USER22> Correct me if I'm wrong, but that still seems like a lot of nines.

<comment><USER23> Not if you need less than 30m of downtime a month to run your business.

</comment></comment></comment></comment></comment><comment><USER24> If anything this is just a minor annoyance to users. If whoever is responsible gets a kick out of DDoS'ing a site like GitHub for no rhyme or reason they really should find better things to do with their time, i.e. they are losers.

</comment><comment><USER25> This is Chris Dodd and his new friends.

[http://www.webupd8.org/2014/03/how-to-install-popcorn- time-f...](http://www.webupd8.org/2014/03/how-to-install-popcorn-time-from- source.html)

</comment><comment><USER26> Let's look on the bright side... At least 2048 is up! ;-) [http://gabrielecirulli.github.io/2048/](http://gabrielecirulli.github.io/2048/)

<comment><USER27> No. No! Nononononononooooooooo

</comment></comment><comment><USER28> ...and let me help by trying to load the site. /dumbmonkey

</comment><comment><USER19> GitHub's website loads pretty fine for now. The team is working on the traffic filtering now, the status page said.

</comment><comment><USER29> The pinnacle of asshattery... This is why we can't have nice things...

</comment><comment><USER30> Can this be a part of the story?

[http://thinkprogress.org/economy/2014/03/19/3416013/github-j...](http://thinkprogress.org/economy/2014/03/19/3416013/github- julie-ann-horvath-sexism/)

</comment><comment><USER19> Wondering who is continuously DDoSign GitHub last time...

</comment><comment><USER31> Seems like a waste of time for however is DDoSign.

<comment><USER13> Waste of time? Not really. Think of all the projects that rely on it for package management, plugins, etc. Think of all the companies using private Github. Lots of lost productivity.

<comment><USER32> Not really, you won't deploy live code from github and if you are it's decentralised anyway so you just use your latest private clones and it's exactly the same.

Everyone can keep working happily even using other syncing methods to collaborate.

At worst it messes with the issue queues and integration services.

<comment><USER31> +1, As stated, this isn't affecting the git repos themselves. :)

</comment></comment></comment></comment><comment><USER33> Its back for me in Baltimore, MD</comment>


GraphQL Code generators – Dreaming up the next generation of tools - <AUTHOR> https://swatinem.de/blog/graphql-codegen/ <comment><USER2> The author has completely missed the point of Apollo and GraphQL query collocation. Having the query definition in the same place as the rendering avoids over or under fetching.

With a single `getMe` function how will they differentiate between use cases with different requirements? You either end up with REST style massive payloads, or have some kind of configuration that mimics GraphQL queries.

Their "DRY" example also omits any integration with React. Add in error handling, loading states and persistence of data and all of a sudden the code is very un-DRY.

<comment><USER3> Should every API be modeled after how react works?</comment></comment>


We Were Trapped by Radioactive Fallout (1957) - <AUTHOR> http://web.archive.org/web/20080212220701/http://www.aracnet.com/~pdxavets/wetokian/trap1.htm

<comment><USER2> This Atomic Veterans History Project, now apparently disappeared from the web, seems to have a lot of interesting stuff in it: [http://web.archive.org/web/20080211170204/www.aracnet.com/~p...](http://web.archive.org/web/20080211170204/www.aracnet.com/~pdxavets/)

Wonder what caused it to go offline? There's just an empty directory there now (<http://www.aracnet.com/~pdxavets/>), but it was being actively maintained up through mid-2008.

<comment><AUTHOR> I have no idea, but there are still some pages available at original server: <http://www.aracnet.com/~histgaz/atomi/>

</comment></comment><comment><USER3> "Oops! Lithium-7 is _not_ inert inside a thermonuclear device."

([http://en.wikipedia.org/wiki/Castle_Bravo#Cause_of_high_yiel...](http://en.wikipedia.org/wiki/Castle_Bravo#Cause_of_high_yield))</comment>


Atoms can be in two places at the same time - <AUTHOR> http://phys.org/news/2015-01-atoms.html <comment><USER2> This has to be one of the worst dumbed-down explanations of quantum mechanics I've ever seen and I barely grasp the basics of quantum mechanics.

I think they are saying the experiment can test whether a whole atom can be in a super-positional quantum state (until observed) which would be the equivalent of the double-slit experiment but with a much larger entity composed of multiple particles.

I'm not sure if thinking of particles as discrete packets of excitations of fields in space-time is a valid way to conceptualize QM but I know particles aren't the little round balls we tend to think of. I wish we had a model that more accurately described QM but in simple terms like the traditional view of the atom composed of little balls orbiting.

<comment><USER3> As to simple terms, I assume you are talking about a conceptual model.

The problem with a conceptual model really is that we have only a few conceptual native schema to work with. I.E. As we grow up and observe the world, we don't seem to need more than about twenty five. (See George Lakoff's work) We deal with the world of macro-effects, so none of them have the desired qualities of having a super-positional state that resolves when we observe it.

If you are talking about a mathematical model, I think they tend to be even more abstract, and definitely not intuitive until you spend a lot of time with them.</comment></comment>


My friend made an awesome little site to track storage for sale - <AUTHOR> http://drivefeed.appspot.com/

<comment><USER2> It's great, though I wish it could do other countries too!</comment>