Mixing Vue.js templates with server-side templates can lead to XSS - <AUTHOR> https://github.com/dotboris/vuejs-serverside-template-xss <comment><USER2> Makes sense because htmlspecialchars() doesn't protect against malicious Vue template expressions, it only converts characters that are used to represent html tags, entities or attributes (<>"'&) IIRC.

I think another solution (besides v-pre) to "fixing" it (though you might say that relying on htmlspecialchars() to protect against user-supplied {{vue expressions}} was unwise to begin with) is to replace { and } with { and } after using htmlspecialchars/htmlentities.

EDIT: Another solution would be to pass a different set of delimiters to Vue that uses characters that would be escaped by htmlspecialchars, like demonstrated in [1] or like so:

        Vue.options.delimiters = ['<%', '%>'];

[1]: [https://stackoverflow.com/a/40538194/4522571](https://stackoverflow.com/a/40538194/4522571)

<comment><USER3> In truth, you should just avoid metaprogramming for this purpose. All it takes is somebody to come along after you and say "why the hell did they change the delimiters" and switch them all back to the default.

Just store user input somewhere safe and inject it at runtime rather than trying to fiddle with the Vue template. If you strictly isolate the executable code and user input, this is never a problem.

</comment></comment><comment><USER4> Let me get this straight.

The issue here is " Server side code is passing user inputted data --without sanitizing it-- for further use, which in this case is front end".

It looks like standard XSS flaw.

<comment><USER5> No, it's "server-side does proper sanitization for server-side rendering" and "client does proper sanitization for client-side rendering", but when both are combined, they allow XSS, because server-side-rendered page is re-interpreted as a client-side template.

The flaw is not immediately obvious, because each renderer is safe in isolation.

<comment><USER6> I would interpret that as a server-side render being improperly sanitized since obviously data from the server is being wrongfully executed.

So that means either the server has to properly escape data or take additional steps to isolate data and code.

</comment></comment></comment><comment><USER7> I think the fixed code here is vulnerable to a subtle XSS.

        <?php
        $serverVars = [
          'injectMe' => (string)$_GET['injectme']
        ];
        ?>
        <script>
        window.SERVER_VARS = <?= json_encode($serverVars) ?>

The problem here is that the injectme parameter could include a closing </script> tag to escape that script block. Something like this:

        ?injectme=</script><script>alert('xss')</script>

The fix for this exploit is to endure any < or > characters in the JSON are escaped using JSON character encoding. I think this is the correct recipe for that in PHP:

        json_encode($a, JSON_HEX_TAG)

<comment><USER8> json_encode will escape / with \ by default, so this shouldn't be an issue.

</comment></comment><comment><USER9> That's a well researched problem, and is common in most JavaScript frameworks. In practice it makes it harder to protect applications using them against XSS.

Check [https://www.slideshare.net/mobile/x00mario/jsmvcomfg-to- ster...](https://www.slideshare.net/mobile/x00mario/jsmvcomfg-to-sternly-look- at-javascript-mvc-and-templating-frameworks) or script gadgets research [https://github.com/google/security-research- pocs/blob/master...](https://github.com/google/security-research- pocs/blob/master/script-gadgets/README.md) for more complete overview of the issue.

Disclaimer: I'm one of the authors.

<comment><USER10> I made the effort of reading those links to save others the effort. Neither of them are relevant to the vulnerability in the article.

</comment></comment><comment><USER11> Rendering user input via a Vue template is gonna set off some mental alarms with most experienced Vue devs. (Rendering user input directly is something most devs are careful with)

Evan discusses some of these risks in the docs and I'm guessing this particular exploit can be patched.

</comment><comment><USER12> this is a rather misleading title when it's talking about something so general (unsanitized user input) about which the author states:

> this vulnerability is not specific to ... Vue.js

I don't think anyone will read the title and think this isn't referring to a vue-specific problem

<comment><USER10> Vue is where it was discovered, and it affects only a few other templating engines. Specifically, it affects those that will search for template invocations in arbitrary parts of the page and affects any server-side app that insert user-supplied input into templates without escaping such template invocations.

</comment></comment><comment><USER13> I see a lot of comments here like "this is just standard XSS" and I think that misses the bigger point (even if the author failed to properly articulate it). The real problem here is making assumptions that then are broken.

"Reflecting user input back to the user in a basic server side app? Just output encode it, now no XSS/html injection!"

That makes assumptions about how the outputed user input will be used and appear in the markup. As soon as the reality changes (that output is now input into a client-side interpretation environment) the code has a vuln. This is important lesson to learn and it doesn't matter what JavaScript framework or backend framework is being used: when you change assumptions you need to review any security decisions that were made on those assumptions.

(This is also a solid example why output encoding alone isn't sufficient to protect against XSS, Because output encoding makes assumptions about how the output is being used. Input validation is key and should be the primary way to protect against most injection attacks, followed by various types of output encoding or parameterization)

<comment><USER10> There's nothing inherently wrong with a user entering <script src="[http://evil.example.com/">](http://evil.example.com/">) </script> in most any field, so you're not talking input validation but instead input restriction. I'd rather have my outputs properly escaped that have arbitrary restrictions on my inputs.

</comment></comment><comment> vertex-four The solution is essentially an implementation of SQL query parameters in a different context, for anyone who hasn't noticed that.

</comment><comment><USER14> Your html sanitizer should escape ' and "... both characters you're using unescaped.

So does this work with a proper sanitizer? Doesn't look like it.

If you have a broken sanitizer, or worse youre inserting it without sanitizing it, you're already vulnerable to XSS... this is just a lot of writing showing an exploit caused by a broken sanitizer.

<comment><USER15> This is incorrect; the problem is that htmlspecialchars() doesn't know to escape {{ }}, and that that then allows user input to get interpreted as Vue template expressions.

If you have a sanitizer that cleans up ' and ", that'd only serve to limit the vulnerability to executing javascript without quotations in it. That's nowhere near a comfortable place to be - user data should not end up interpreted as Javascript, quotations or not.

<comment><USER2> Yup. Obfusticating using a tool like [http://www.jsfuck.com](http://www.jsfuck.com) would get around the lack of quotations.

If the result was too verbose, you can always handroll your own JS:

        {{constructor.constructor(constructor.name.constructor.fromCharCode(97,108,101,114,116,40,39,120,115,115,39,41))()}}

</comment></comment></comment><comment><USER16> Let's be clear - this affects client-side apps which include the template compiler (ie. the full vue.js bundle). Right? So apps built with Webpack, and using vue.runtime.min.js should be safe?

I'd imagine that represents the majority of Vue apps in production, but I might be wrong.

</comment><comment><USER17> Look, I am gonna be blunt.

 _A great man once said: "Those who sacrifice essential Security to purchase a little temporary Convenience deserve neither" :)_

I have seen Javascript frameworks and fads come and go. I remember 10 years ago "progressive enhancement" was the greatest thing, and onclick inside your HTML was considered hideous. Then came Angular with its ng-click and suddenly placing behavior stuff inside declarative HTML was cool again. Then came React and placing HTML -- er, excuse me, JSX inside your Javascript files was ... shocking but then cool. Then came Vue...

Look, it isn't that difficult:

      HTML is for structure
      CSS is for presentation
      JS is for dynamic behavior

Want animations? Use classes and CSS.

Want complex behavior? Use classes, find your elements with getElementsByClassName and do your thing.

Want extra info? Stuff it into a JSON-encoded data-{something} attribute.

There is no reason to let your declarative HTML contain code-like things. Have it contain markers using HTML-compatible things like CSS classes and data- attributes (we used to call this "microformats").

Then on the server...

When you render your HTML tags you escape your attributes and text content.

When you output Javascript ... you DON'T. Instead you json_encode stuff that a .js file should consume. Oh, and use SRIs when loading the js from CDNs.

Before you execute SQL, you escape the values.

</comment><comment></comment><comment></comment><comment>====

 _In short - you escape for the medium you are interacting with._

</comment><comment></comment><comment></comment><comment>====

Seriously, it's straightforward and you can't mess it up... unless you start using "syntax sugar" that makes you insert things into a language that it wasn't designed for, after reading a framework touting "LOOK THE GREATEST SHINY NEW NONSTANDARD TECHNIQUE".

It's really not adding all that much. I remember when two-way binding was hot and touted by Angular 1. It's not anymore. I remember when CoffeeScript was the next greatest thing. It's not so much anymore.

Meanwhile, if you stick to the ES5/6 standards and let each language of the Web do what it's supposed to, you have a great future ahead of you. And much less injections to worry about.

 _Update - to the downvoters: go ahead, type words! I am interested to have an actual discussion after over 15 years of seeing SO MANY SECURITY HOLES from this one thing: frameworks interpolating stuff into a language that was designed for something else._

<comment><USER18> You're getting downvoted because you're equating Angular 1, React and Vue.

React has one huge difference: its "template language" is (almost) never compiled at run time. Its not HTML at all. This makes it difficult to coerce it to interpret any random string as an expression. That annoying "build step" that everyone hates, that is the convenience for which people are sacrificing security.

When you have no build step, your template compiler must accept expression strings at run-time, and it will inevitably process user input at some point unless you're very careful all the time. "Escaping" things is a stop-gap that doesn't work.

You could just use fully static HTML/JS endpoints (react based) combined with fully JSON based RPC endpoints and it will be safe. Then you can combine that into server-side rendering, and it will stay safe (unless renderToString has a problem). No escaping required if you are not sending code strings to a compiler at runtime.

<comment><USER17> I get your point about precompilers. LESS, SASS, JSX and so on. But that's only _one_ thing, my main point was "don't put executable code into your HTML".

I would say, btw, that a Template Engine is what you need, such as Handlebars. They compile stuff too. What is wrong with escaping? That _is_ what you do when you dynamically interpolate stuff.

Of course interpolating stuff where it doesn't belong can lead to this:

[https://medium.com/dailyjs/exploiting-script-injection- flaws...](https://medium.com/dailyjs/exploiting-script-injection-flaws-in- reactjs-883fb1fe36c1)

<comment><USER18> You need escaping only when you're sending strings to a compiler (which is what you do when you do server-side rendering), and its a never ending source of bugs. You basically need to re-implement the entire logic of a full blown parser for the target language to guarantee successful escaping.

E.g. see `mysql_real_for_real_this_time_escape_string` versus just supporting parameterized queries. Parameters don't need to be escaped; they will never be interpreted as SQL code.

This list is also fun: [https://gist.github.com/JohannesHoppe/5612274](https://gist.github.com/JohannesHoppe/5612274) \- will your framework escape implementation cover all of them? Are you sure?

If you serve a static html (no templates) + css + JS (pre-compiled JSX templates) client with all dynamic content being served as e.g. JSON, you're getting rid of a large number of attack vectors from the start.

You are down to a handful of attributes, of which only dangerouslySetInnerHTML is a React-originating attack vector because similarly to all other template languages it sends a string to a compiler. It should probably be a symbol, too, especially now that we have spread syntax for props. [https://github.com/facebook/react/issues/10506](https://github.com/facebook/react/issues/10506) \- until then, you can simply forbid spread syntax for props and/or dangerouslySetInnerHTML.

Any other HTML attributes that have a string-to-compiler behaviour remain a problem, regardless of whether you are using jquery or react or whatever. (e.g. href). Its sad but for some of them the only recourse we have is escaping. Still, thats a huge improvement over escaping everything.

<comment><USER17> Exactly. You make a very good point. Passing PARAMETERS to a string based query or command should be done by reference whenever possible. The CALLER shouldn't be responsible for the escaping and interpolation. That is for the DRIVER or API or whatever.

That just further proves my point. When you call SQL commands from PHP you should use PDO and parametrized queries always. Values should always be passed by reference.

Same goes when you are outputting some HTML. You should have a hash of

      {
         attributeName: value
      }

and it should be up to the HTML RENDERER - and not you - to escape the values every time.

You've made another great point, which layers on top of my point, which is:

1) Use each language Y as it was intended

2) Escape everything automatically by passing values by reference to an API layer in language X

So to sum up:

Use HTML for structure, CSS for appearance, and JS for all dynamic behaviors. Keep your files separate! Do not allow embedding arbitrary CSS and JS in your HTML and so on.

For MySQL use a MySQL driver API and pass values to it

For HTML use an HTML renderer API and pass values to it

For Javascript-accessible data embedded in HTML use a JSON function (easy) and pass values to it.

For JSONP (old school) use JSON wrapped with some callback. Better: load actual JSON using XHR and CORS. Best: use iframes and postMessage to execute arbitrary methods in the other domain via an authorized session.

And so on.

</comment></comment></comment></comment></comment><comment><USER19> Ultimately if your input is never expected to pass a semicolon, quotation, bracket, parentheses, or other special char I explicitly remove them from the user input. I also believe that using POST inputs is less of a temptation/invitation for injection. Sure anyone can send a crafted CuRL request but it's a lot less inviting than just plugging your injection into the address bar.

<comment><USER20> This doesn't really help when serving content into different formats, html, json, xml, etc. Because you have different rules for what are special chars depending on the format. Maybe one format doesn't work with single quotes while another does.</comment></comment>


This year, I resolve to ban laptops from my classroom - <AUTHOR> http://www.washingtonpost.com/posteverything/wp/2014/12/30/this-year-im-resolving-to-ban-laptops-from-my-classroom/

<comment><USER2> Is this before or after the students were told they were required to own a laptop to participate in their education? I'm just about finishing my own education, and everyone there owned a laptop at the school's recommendation.

Personally I used mine for a lot of rapid note-taking, which was a lot faster for me than having to write things down. It actually allowed me to take notes in real time which I am not able to do on paper. Then I also encountered a professor like the one in the submitted article who hated the idea of students using the devices the school encouraged them to buy for their education in his classroom. That class was the roughest for me, I found it very hard to work with my written notes (Which I no longer was used to using of course, since I used that laptop for years) and am convinced the class would have gone a lot better for me had the professor not decided to make a decision which set his classroom starkly apart from the rest.

If the school has a policy of allowing laptops then I think it's terrible for a professor to override that.

<comment><USER3> What did you use for note taking? Did you use any system?

I hand write notes in meetings and I use Cornell method. For me personally I don't think a computer would work (partly because I only type at about 65 WPM) so I'm interested when I find people who say it does work for them.

<comment><USER2> I just used Google Docs, but I type very fast. I'm not entirely sure, but I think I have about a WPM of about 130. I managed with just typing things as they happened, and using the shortcuts to enter LateX formulas. I didn't encounter a lot of diagrams or other things that needed drawing during my studies, but usually kept a notebook nearby just in case.

</comment></comment></comment><comment><USER4> I was a student very recently and if I class was boring, or too easy (easy enough I could get by without good notes) I distracted myself, with or without a laptop. Most Mathematics professors don't allow laptops to be brought to class, so I planned out personal projects, made UMLs, and at one point wrote shitty poetry if I got bored.

If he's going to ban laptops, I hope he refrains from reading off powerpoint slides. Any professor or teacher who does has given up their right to be mad if students aren't paying attention.

</comment><comment><USER5> Honestly, I think it is up to the student to decide. If they find they don't pay enough attention with a laptop in front of them, then they should stop pulling it out. If they feel like they barely get anything out of the lectures and decide to stay home, that is also their decision. Its strikes me as odd that it is so common in college now to require attendance or attempt to force student to pay attention. I typically only pay less attention if I don't feel the professor is offering me any new content or insight into the material. If reading the book and doing the assigned homework gets me the same knowledge, then I only feel inclined to half listen to the lecture. I think it is often the pride of the professor which drives them to ban laptops or phones, they want everyone to listen to them, even if it is receptive and boring. Instead of addressing the problems with their delivery, they blame the students. I always listen to entertaining, interesting professors.

<comment><USER3> I tend to agree with you. What about the student who is trying to concentrate but who has a bunch of distracted colleagues playing games or checking social media?

<comment><USER5> I tend to sit closer to the front to help myself concentrate. This helps me not get distracted on my own computer, but also it puts less distractions in front of me. Nothing is really out of your control as a student. Sure maybe the guy playing Flappy Bird in front of you might distract you for a single class, but if you sit behind him every class then its your own fault.

</comment></comment></comment><comment><USER6> We think technology is the solution to education (our math test scores are lower than China's because they have better laptops than us!).

It comes down to motivation. Laptops in the classroom are a nearly irresistible demotivator/distractor for most kids.

</comment><comment><USER7> When you write something down it is not just the information passing through your eyes and brain onto the paper, it's the remnant of that information in your brain that counts. That's why note taking is useful.

</comment><comment><USER8> _I had a choice. I could disrupt the class to single him out. Or I could do what most teachers in higher education do: just ignore it. After all, these students are adults, and they have to take a final exam._

I think there are always people who will do something else, if they were not looking at a laptop they'd be daydreaming or idly doodling. In the end it doesn't matter as long as they can do the work and meet the learning goals of the course. The ones who can't, regardless of whether they're looking at a laptop, will (or should...) fail anyway.

</comment><comment><USER9> How about instead of lecturing (talking _at_ people instead of _to_ them) and banning laptops, we change the way these people are taught so that they are actually engaged and focused. It's been known for a while now that different people learn in different ways. Technology can be a huge help in this and companies are already creating products to help create this personalised learning experience.

Disclosure: I work for Frog, a company that creates learning platforms.

<comment><USER3> > It's been known for a while now that different people learn in different > ways.

Are you talking about "learning styles" such as kinaesthetic or visual or auditory?

[http://en.wikipedia.org/wiki/Learning_styles](http://en.wikipedia.org/wiki/Learning_styles)

> Although there is ample evidence that individuals express preferences for > how they prefer to receive information, few studies have found any validity > in using learning styles in education.[2] Critics say there is no evidence > that identifying an individual student's learning style produces better > outcomes. There is evidence of empirical and pedagogical problems related to > the use of learning tasks to "correspond to differences in a one-to-one > fashion."[3] Well-designed studies contradict the widespread "meshing > hypothesis", that a student will learn best if taught in a method deemed > appropriate for the student's learning style.[2]

</comment></comment><comment><USER10> Hello, this is 2015 and people learn in totally different ways than 20 years ago.

In other words, if your students are staring at Facebook maybe is because your lecture is boring as hell. That's what you should be worried about.

<comment><USER11> _" Hello, this is 2015 and people learn in totally different ways than 20 years ago."_

The _learning_ process will be similar to 20, 200 or 2000 years ago as the brain does not change that quickly. The mode by which we access things to learn may well change from generation to generation.

Challenge: 'boring' may imply resistance to engagement, perhaps because the material is _hard_.

<comment><USER10> By learning different I mean we don't learn in a "broadcast" way anymore. Check out this great article by Don Tapscott:

 _Yet the students, who have grown up in an interactive digital world, learn differently. Schooled on Google and Wikipedia, they want to inquire, not rely on the professor for a detailed roadmap. They want an animated conversation, not a lecture. They want an interactive education, not a broadcast one that might have been perfectly fine for the Industrial Age, or even for boomers. These students are making new demands of universities, and if the universities try to ignore them, they will do so at their peril._

[http://edge.org/conversation/the-impending-demise-of-the- uni...](http://edge.org/conversation/the-impending-demise-of-the-university)

<comment><AUTHOR> > By learning different I mean we don't learn in a "broadcast" way anymore.

Given the excerpt you quoted uses the word "want" I think you mean you don't _want_ to learn in a broadcast way. That's fine, but that's not a sufficient rebuttal to the point you were replying to that " _The learning process will be similar to 20, 200 or 2000 years ago as the brain does not change that quickly_." I'm not sure I entirely agree with that[1], but saying you _want_ to learn in a different way is not evidence that "people learn in totally different ways."

On one hand I feel students preferring more interaction / less broadcast is nothing new, but on the other hand the popularity of Coursera, MIT OpenCourseWare, Udacity, Khan Academy, and countless other very "broadcasty" education sites/resources would seem to indicate many are quite satisfied with little or no interaction.

[1] [http://www.theatlantic.com/magazine/archive/2008/07/is- googl...](http://www.theatlantic.com/magazine/archive/2008/07/is-google- making-us-stupid/306868/)

</comment></comment></comment></comment><comment><USER12> The problem is not whether you take notes on a laptop or a legal pad. The problem resides in TAKING NOTES! This might be just my opinion, but I hate taking notes, it's completely useful! If I'm going to a class I go to LISTEN to the professor and to ask questions to him/her.

Before every class I used to read the contents we were going to cover (superficial read). That way I wouldn't be caught by weird words, references or concepts. At least I knew something. Then I'd "use" the professor to "explain" and "dig" those concepts for me.

If you seriously need to take notes, the one failing is the professor. She/he should provide the content covered in the class in the form of pages of books to read, slides, etc.

If you're a student. DON'T TAKE NOTES! (again, just my opinion)

<comment><USER13> I wasn't much of a notetaker in college. But there may be something to it.

I was going through old books from university over christmas. I found two notebooks where I took extensive notes during class.

They were all familiar. I remembered the content of the class quite well, whereas I've forgotten most other classes.

(Of course, one possible bias is that I thought these two teachers were better, so I may have paid more attention)</comment></comment>


Nike just unveiled the first real power lacing sneaker the Hyperadapt-1-0 - <AUTHOR> http://techcrunch.com/2016/03/16/nike-just-unveiled-the-first-real-power-lacing-sneaker-the-hyperadapt-1-0/ <comment><USER2> There are probably a lot of good answers to this question, but why not just use velcro? If velcro isn't strong enough then I'm sure that designing better velcro would be easier than designing this.</comment>


Why Apple did this in Swift language? - <AUTHOR> http://stackoverflow.com/questions/24190340/use-of-let-in-optional-value-along-with-if

<comment><AUTHOR> they can optimise at compiler level. why user has to always pass the boolean inside if statement.</comment>


New Deal for Information Technology - <AUTHOR> http://www.salon.com/news/politics/war_room/2011/06/14/lind_information_technology/index.html

<comment><USER2> Comparing Nanotech, Education, and future IT to other revolutionary technologies is interesting but nothing radically new. It can be especially difficult to direct money to these new frontiers when the infrastructure of yesterday is becoming increasingly potholed.

Forward into uncertainty as a means of raising our ceiling? Or stand our ground and try to raise the floor?</comment>


Comcat – Cat, but for Comments - <AUTHOR> https://github.com/pointbazaar/comcat <comment><USER2> What's wrong with the following (for Rust/C++)?

       sed -n 's/.*\/\///p' comcat.rs       # for displaying comments
       sed 's/\/\/.*//' comcat.rs           # for displaying source</comment>


Ask HN: What are your thoughts on the 2016 NBA Finals? - <AUTHOR> There's got to be a ton of basketball fans around here.<p>So what did you think of that crazy ending? <comment><USER2> [https://twitter.com/FiveThirtyEight/status/73994901139466240...](https://twitter.com/FiveThirtyEight/status/739949011394662400)

</comment><comment><USER3> "I watched Beethoven tonight, I watched LeBron James compose a game." -Kyrie Irving</comment>


Mozilla staff insist on removing referer warnings from docs - <AUTHOR> https://developer.mozilla.org/en-US/docs/Web/HTML/Element/a$compare?locale=en-US&to=1419235&from=1419041 <comment><AUTHOR> I'm tired of complaining to companies about microtargeting on their websites or security failings like leaking reset passwords. There's a serious knowledge gap between how businesses think the web works and how it actually does and referer is a serious problem. Mozilla seem to want to teach people how to write bad websites first that adopt anchor or image tags without explaining what the referer does, only to leave it as a note later in the page that they need to read up elsewhere to find out about it. Essentially, Firefox (and other browsers) aren't designed for privacy and I wouldn't mind that so much if they could be open and upfront in teaching developers that problem... The world is full of flaws and sometimes we need "wet floor" signs before we take a step, not afterwards. Can someone else take it from here.

</comment><comment><AUTHOR> Sadly, they removed this too. [https://developer.mozilla.org/en- US/docs/Web/HTML/Element/im...](https://developer.mozilla.org/en- US/docs/Web/HTML/Element/img$compare?locale=en-US&to=1419222&from=1419039)

To whoever restored the anchor element doc, thanks, I hope it stays there or they suggest a better alternative.</comment>


Show HN: Mockit – Open-source app to create and configure HTTP mocked endpoints - <AUTHOR> https://mockit.netlify.com/ <comment><USER2> Another alternative that I have had good experience with is Mountebank - [http://www.mbtest.org/](http://www.mbtest.org/)

It doesn't have a nice GUI like this, but it is extremely flexible in the information you can match on for returning your mocked responses.

</comment><comment><USER3> Any plans to build from an OpenAPI Spec descriptor file? Ideally v3

<comment><AUTHOR> Hey,

No nothing yet, but did you want to create an issue explaining the feature? [https://github.com/boyney123/mockit/issues/new](https://github.com/boyney123/mockit/issues/new)

I can take a look and see what we can do

<comment><USER4> Tools looks great! I've added an issue here for openapi: [https://github.com/boyney123/mockit/issues/5](https://github.com/boyney123/mockit/issues/5) . I have quite a few specifications in openapi v2 (swagger). It'd be helpful to support both v2 and v3 (as op requested) of the OpenAPI format.

Thanks!

</comment></comment></comment><comment><USER5> I guess this would be somewhat comparable to WireMock? [http://wiremock.org/](http://wiremock.org/)

The GUI looks pretty, but I'm not sure how useful that is in practice for automated tests at least.

<comment><USER6> I've met these products mostly in the context of front-end engineers needing endpoints that don't exist yet.

Useful for QA testers too.

</comment></comment><comment><USER7> Seems like a more featureful version of something I wrote a long while ago to ease testing, fakettp: github.com/sethgrid/fakettp. Mine requires a json config and can act as a proxy, intercepting given paths and overriding responses. Not sure if I added dynamic response based on an http header. The post's utility seems really polished with a nice ui.

<comment><AUTHOR> Hey,

Yeah I will check that repo out and see what you've got.

Thanks, hopefully the UI is easy enough for people to do what they need to. :)

</comment></comment><comment><USER8> Really easy to get things up and running. Love the chaos monkey feature!

</comment><comment><USER9> I've been looking for a tool like this most recently. The criteria where

* no java * lightweight docker implementation * self hosted

Funny how a perfect solution randomly pops up on the front page. I will check it out the coming week, thank you very much! :)

<comment><USER10> A similar tool that stumbled upon recently is duckrails: [https://github.com/iridakos/duckrails](https://github.com/iridakos/duckrails)

It's got some nice features like building dynamic mocks with JavaScript or Ruby, cause delays, timeouts etc..

</comment></comment><comment><USER11> The chaos monky is a bit agressive, throwing a stack trace on every request. :) I think it's a bug with it's implementation.

<comment><AUTHOR> Ha yeah, maybe its a bit too much. Maybe some configuration would help what do you think? Some kind of threshold?

<comment><USER6> Perhaps a set of sliders for each type of issue which define how often they might appear. E.G I don't care about 500s right now but would like 50% of the requests to be slow.

<comment><AUTHOR> Yeah, some interesting thoughts. I will have a think and see what can be done to extend the Monkey

</comment></comment></comment></comment><comment><USER12> It touched my heart :( I worked more than one year on a service virtualization project in my previous job with 6-7 people and it has never been used by a real customer because of really bad management. I am still so angry. Our product was able to scale thanks to nomad+docker and had a cool ui to configure services such as rest, swagger, plain http etc.

Alternative \- [https://hoverfly.io/](https://hoverfly.io/)

Enterprise Solutions \- [https://www.ca.com/us/products/ca-service- virtualization.htm...](https://www.ca.com/us/products/ca-service- virtualization.html) \- [https://www.microfocus.com/en-us/products/service- virtualiza...](https://www.microfocus.com/en-us/products/service- virtualization/overview)

</comment><comment><USER13> We currently use a lot of API blueprint and drakov for this. But having options like monkeys in it would be a very nice thing! kinda thinking if there is a middleware for this though.

<comment><AUTHOR> Yeah guess there is no reason why a monkey could not be worked on.

Here is how it works for MockIt, as you said its just some middleware

[https://github.com/boyney123/mockit/blob/master/mockit- route...](https://github.com/boyney123/mockit/blob/master/mockit- routes/src/middlewares/chaos-monkey/index.js)

</comment></comment><comment><USER6> This is great - thanks for building it.

<comment><AUTHOR> No problem, hope you find it useful

</comment></comment><comment><USER14> Something like this would be cool, and probably significantly harder to implement, for GraphQL.

</comment><comment><USER15> Http://beeceptor.com is another hosted one. And it gives named endpoints for drop-in replacement for API base url.</comment>


Show HN: Cx Framework – let's build a gorgeous admin or dashboard application - <AUTHOR> http://cx.codaxy.com <comment><AUTHOR> Cx is a modern UI framework based on ES6, Babel, React and webpack featuring widgets, charts, router, customizable appearance, powerful data-binding options, view controllers, inner and outer layouts, selection models, culture dependent data formatting and much more.

Don't miss out on our documentation, starter kit and fiddle.

We're looking for feedback and early adopters. Please say what you like or what you don't like about Cx.</comment>


Show HN: Prepare for SQL interviews with real questions from companies - <AUTHOR> http://www.stratascratch.com <comment><AUTHOR> Hi HN,

I've spent my career continuously prepping and practicing for technical interviews, specifically SQL and python. I also teach SQL and python as an adjunct professor at a local university.

I built Strata Scratch to help others prepare for their technical interviews and brush up on their skills. I loaded it with over 500+ technical interview questions I've sourced from various sites.

The platform is about 2 years old and is growing. It's only a side hustle of mine but it's continuously improving. It's free to try out but has a monthly subscription if you want to see the solutions, otherwise, you can access all the 500 questions.

Any feedback or feature requests would be greatly appreciated!</comment>


Show HN: Badger – an embeddable, persistent key-value store written in Go - <AUTHOR> https://github.com/dgraph-io/badger <comment><USER2> Nice project! What's new since the last time we saw this? [1]

[1] [https://news.ycombinator.com/item?id=14335931](https://news.ycombinator.com/item?id=14335931)

<comment><USER3> New funding round

</comment></comment><comment><USER4> >Keep it simple, stupid. No support for transactions, versioning or snapshots -- anything that can be done outside of the store should be done outside.

Not sure how I feel about that philosophy. Transaction support is extremely complex and should be left to a storage engine if ever possible.

What is the benefit of this over something like Berkeley DB?

<comment><AUTHOR> The reason we want to KISS is to ensure a solid, robust, and performant layer of storage, that other projects can use to build their transactional versions, etc.

One can take Badger and build a transactional layer above it, and it would still be below the application layer.

<comment><USER5> > The reason we want to KISS is to ensure a solid, robust, and performant > layer of storage, that other projects can use to build their transactional > versions, etc.

Then comparing it to Rocks DB is unfair (infact title of this post is misleading). Stuff like transactions and MVCC is way complicated than it sounds.

<comment><AUTHOR> It's not. The comparison is using the same APIs as provided by LevelDB/RocksDB. Not the transactional ones mentioned below.

TransactionDB* txn_db; Status s = TransactionDB::Open(options, path, &txn_db);

Transaction* txn = txn_db->BeginTransaction(write_options, txn_options); s = txn->Put("key", "value"); s = txn->Delete("key2"); s = txn->Merge("key3", "value"); s = txn->Commit(); delete txn;

</comment></comment></comment></comment><comment><USER6> Very interesting, though a shame (to me) that it's Go, as I'm actually after a C++ KV store that ideally isn't RocksDB (I want something that's much easier to embed and RocksDB has a bunch of dependencies).

Have you tried benchmarking on baremetal though? I've been shopping around for a KV store and came across this benchmark: [http://www.lmdb.tech/bench/ondisk/#sec7](http://www.lmdb.tech/bench/ondisk/#sec7)

Interestingly, for 768-byte values, LevelDB is the clear winner when it comes to read scaling on a VM yet on bare metal it's drastically outperformed by LMDB.

<comment><USER7> On bare metal you'll be hard pressed to beat LMDB.

It's really about as simple, and as bare bones as you can make a traditional KV storage while still preserving MVCC, transactions, and maintaining ACID.

Furthermore it's design is prefectly suited to exploit Optane/FRAM non- volatile RAM devices that appear to becoming.

<comment><USER8> Apparently the way LMDB does I/O is exercising slower (more complex?) code paths in the virtualization implementation code compared to LevelDB, and virtualization overhead is significant in these benchmarks (actually slows down execution several times).

LMDB does mmap while LevelDB does plain file I/O.

<comment><USER7> It depends on the hypervisor. XEN/AWS uses and older slower path for memory allocation then the modern KVM/Intel-EPT allows.

Every `malloc` under XEN (that can't be satisfied with unused memory already mapped into that processes userspace) requires a hyper call.

This VMM approach was _largely_ depreciated about 6 years ago when Intel created page table bits that let the bare metal OS give the VM a _range_ of memory it can virtually re-map, but AWS hasn't adopted this.

</comment></comment></comment></comment><comment><USER9> What do people typically store in KV stores that do not have a database built on top of them? Terabytes of what? Accessed by what kind of application logic?

<comment><USER10> I currently use leveldb in my project as a way to handle an intermediate data processing step that chews on much-larger-than-RAM datasets. And I didn't feel like this processing step warranted the overhead of a full-blown database sitting on another box, or even the same box. Works quite nicely thus far.

<comment><USER9> Would you have used SQlite if it had an LSM backend so the write performance would be as good as leveldb?

<comment><USER10> I considered it, but for what I was doing, a K/V store that also has fast key prefix lookup was perfect. Plus, yeah, what I'm doing is currently super write-heavy.

</comment></comment></comment></comment><comment><USER11> Link to WiscKey paper, discussion of tradeoffs made - awesome. DB vendors, take a page out of their book please.

RocksDB does go to some lengths to reduce amplification on SSDs, though it seems this design is taking that into consideration from the very beginning.

</comment><comment><USER12> I remember last time you mentioned range query was very slow and you didn't quite understand what was causing it. Any news on that end?

<comment><AUTHOR> Go is slow when doing a lot of random lookups. Each lookup into disk is a blocking one, which causes a Goroutine to block the OS thread. A new OS thread then has gets created after a time delay to schedule goroutines. This happens over and over again.

You can follow the discussion here: [http://bit.ly/2tb19eX](http://bit.ly/2tb19eX)

<comment><USER12> > Each lookup into disk is a blocking one, which causes a Goroutine to block > the OS thread.

Can you have multiple OS threads created at the beginning so whenever an OS thread is blocked the OS scheduler simply schedules another OS thread? That's how most databases handle blocking disk IO, right?

Doing blocking disk IO has to be a common task. How do other golang applications/databases handle this issue?

<comment><AUTHOR> > so whenever an OS thread is blocked the OS scheduler simply schedules > another OS thread

Go does that even now. If a thread is blocked, it would create another thread, but it does it with a small delay. I saw a visible increase in IOPS when starting Go with more OS threads (using GoMAXPROCS), because Go doesn't need to wait before having access to these threads, but on a longer running job with enough initiation for OS threads, that benefit would be nullified.

Most LSM based KV stores are designed to avoid random lookups -- and Go DBs tend to use RocksDB -- so it probably hasn't been such a big issue for them.

</comment></comment></comment></comment><comment><AUTHOR> Why is this marked as dup? This is the first time the Github link is on HN.

<comment><USER13> Because duplicate counting is not per URL, and and the announcement blog post (which has a link to the github, and the same kind of information as is on there) already was on HN.

</comment></comment><comment><USER14> How does it compare with wiredtiger which IIRC use also LSM trees?

<comment><USER7> As it doesn't offer transactions, or MVCC you really shouldn't compare the two.

<comment><USER15> Thanks for the comparison!

</comment></comment></comment><comment><USER16> Who drew the logo?</comment>


England and Wales dropping rape inquiries when victims won't hand in phones - <AUTHOR> https://www.theguardian.com/society/2020/jun/17/police-in-england-and-wales-dropping-inquiries-when-victims-refuse-to-hand-in-phones <comment><USER2> This is the right call, once you realize that the article buries the lede - this only happens when the phone contents are deemed relevant to the investigation.

If a complaining witness refuses to cooperate in an investigation by handing over relevant information, it would be inappropriate for the government to proceed toward a prosecution.

In the United States, there is case law requiring the prosecution to turn over exculpatory material known to the government. In my jurisdiction, that specifically includes the existence of relevant exculpatory material held by a complaining witness.

The fact that the only person capable of providing that evidence refuses to do so allows the drawing of an adverse inference, which means it's presumptively exculpatory. Refusal to turn over exculpatory evidence is per se a violation of the defendant's rights.

Sexual assaults of all kinds are horrific, and we should generally do a better job investigating and prosecuting them, but not at the expense of basic due process rights. Everyone deserves a fair trial.

<comment><USER3> >this only happens when the phone contents are deemed relevant to the investigation

Perhaps you stopped reading the article part way through?

> Olivia (not her real name) reported being drugged and attacked by strangers. > Police asked for seven years of phone data, and her case was dropped after > she refused. "My phone documents many of the most personal moments in my > life and the thought of strangers combing through it, to try to use it > against me, makes me feel like I'm being violated once again," she said.

"This isn't about trying to stop the police from putting together the facts of the case. This isn't about objecting to the police downloading information from the time that it happened. This is about objecting to the police downloading seven years of information that pre-dates the event and therefore has zero relevance.

"I kept trying to ask them if the data that they took could be restricted just to the period of time of relevance to what actually happened, and they said no.

"They told me that if I didn't consent, they may just drop the case and may not proceed with it. They have now dropped the case citing one of the reasons being that I have not handed over seven years of my personal life which is of complete and utter irrelevance to that one night.

"I am willing to hand over the information that is relevant to what happened – I'm not willing to hand over seven years' worth of information that is totally and utterly irrelevant."

<comment><USER4> But how would you enforce only downloading the relevant data? How do you get only the data you think is relevant before looking at the data? It could be the police couldn't agree that they wouldn't download more than they need because they simply do not have the expertise to be able to not download it all, and then process it afterwards. At the very least, someone would probably have to look at huge chunks of the data. And depending on how UK courts work, they may be required to get everything.

In the US, you would probably still have to get it all, but the prosecutor would likely be able to limit what was turned over to the defense. And if the defense wanted more, they might be able to get a neutral third-party to look at the data and decide whether it should be turned over (or the judge might do this). I don't know if the UK has something similar where the prosecutor can avoid turning all data over to the defense.

It might be that there is no good way to handle this type of case.

<comment><USER5> When I'm victimized and want to press charges against my assailant, I should only have to provide any and all evidence that I have against the assailant. The police can then decide whether or not to pursue the case, based on the strength of the evidence I've provided.

In no sane world should the victim be expected to expose ALL of her private information. It's the digital equivalent of getting robbed in a dark alley, and the cops telling you they will drop the case unless you allow them to search your home.

<comment><USER2> So if I go to the police and give a statement to the effect of "whack assaulted me in an alley!" you're okay with a system where _I_ don't have to substantiate that complaint any further or hand over my phone (to determine whether we were on a date, flirting, sexting, or I had sole motive to fabricate an allegation), but _you_ can be interrogated, your electronic devices confiscated and searched, your friends and relatives called and interviewed, all based on an allegation I refused to provide information for?

As a general rule, the proponent of a claim bears the burden of proving it. This general rule is even more important in the context of criminal allegations. I don't think there should be an exception just because of the sexes of the complaining witness and the subject of the complaint.

<comment><USER5> > _your electronic devices confiscated and searched_

I don't know where on earth you got that from. The police can and do need to get a warrant in order to confiscate or search the accused person's devices or belongings. The warrant needs to explain with probable cause, why those specific devices/belongings are relevant to the case and need to be searched. If the cops can't provide probable cause for searching a device, they aren't allowed to do so.

> _the proponent of a claim bears the burden of proving it_

Hence why I said that it is the accuser's responsibility to provide any and all relevant evidence. You are going one step further and saying that the accuser should give up all claims to privacy, in the entirety of their life. Ie, if I want to press charges against someone for robbing me in a dark alley, I need to allow the police to search my house. This is a ridiculous way to structure any criminal justice system.

<comment><USER2> > _I don 't know where on earth you got that from... The warrant needs to > explain with probable cause_

Thank you for the explanation. In my 11 years as an attorney, my experience has been that warrants are issued freely based on a complaining witness's statements. Has your experience been different?

> _You are going one step further and saying that the accuser should give up > all claims to privacy_

I don't believe I claimed that at all. Productive conversation is easier if both parties fairly characterize one another's positions.

Enjoy the rest of your day.</comment></comment></comment></comment></comment></comment></comment>


Docker - Way better than a VM - <AUTHOR> https://github.com/dotcloud/docker/ <comment><USER2> For those that have thought about running something similar in production, I have a few questions:

1\. Shared kernel - in this model all of the containers have a shared kernel, so any activity or even tuning (ie io scheduler) would impact all of the containers right?

2\. Patching - when you need to apply a kernel security patch, all containers would need to agree on a change window unless you were using something like KSplice?

3\. User space / kernel space dependencies - if we imagine even 5 years down the road, will containers using for example Red Hat Enterprise Linux 5 apps be containerized but broken? Ie the hosting provider will likely want to stay ahead of the curve and upgrade their kernel, but the app teams may not be as progressive, so when these upgrades occur the apps would break

<comment><USER3> Those are problems, but they're problems with all container/jail based virtualization platforms like OpenVZ, FreeBSD jails, Solaris containers.

The first question is a valid point. But you also get benefits from not having the overhead of N different kernels running. This is easiest to see when looking at VPS providers - a 512MB OpenVZ vps means you have 512MB of memory for your application to use. Yeah, kernel overhead isn't that much, especially if you're running a few high-resource instances, but it can help if you have lots of low memory instances. There's lots of discussion online about OpenVZ vs. xen/kvm vps hosts if you're curious.

As for patching - OpenVZ at least makes it very easy to do live migration of instances between servers (barring some weirdness if you have NFS mounts in the guest), although it appears that lxc (and therefore docker) can't do that [1]. In any event, it shouldn't hard to shutdown the guest, migrate, and restart the guest - especially if you're using shared storage of some sort.

As for your third point - backward compatibility with RHEL/Centos is generally quite good (since that's kind of the point of RHEL). At work we're currently on Centos 5, and our migration strategy to Centos 6 is probably going to be to install Centos 6 OpenVZ hosts, then move the guests and worry about upgrading the guests later. Forward-compatibility is an issue, but I don't think there's an easy solution to that.

[1] [http://en.wikipedia.org/wiki/Operating_system- level_virtuali...](http://en.wikipedia.org/wiki/Operating_system- level_virtualization)

<comment><USER4> KSM makes the overhead pretty low memory wise

</comment></comment></comment><comment><USER5> Duplicate of <https://news.ycombinator.com/item?id=5408002> and <https://news.ycombinator.com/item?id=5445387>

<comment><USER6> Not a dup of those - their URL and text content is different.

However those links are useful as the coversation is on topic, even if the source material is different.

</comment></comment><comment><USER7> Right now, finding VPS providers which work well with Docker is a bit like walking through a mine field.

Currently it recommends kernel version 3.8 or greater. This means that if you prefer Ubuntu then you need 13.04 or the ability to upgrade the kernel.

It also currently requires usage of AUFS which means that you need the AUFS kernel module installed. So, if you have a supported kernel then you still might need the ability to modify the kernel. They are working on supporting alternate implementations such as BTRFS though.

EC2 is a great option right now and it's what I'm using.

I agree with another comment mentioning this is the future. However, I wonder how long it will be before something like "Erlang On Xen" becomes more widespread, cutting out the OS completely.

ETA: I love watching this project, it has really taken off and the maintainers have been making fast progress. It seems that as soon as I run into a show stopping problem, it's fixed the next day. It's a bit inspiring and makes me look at the progress I have made on my own projects. ;)

<comment><USER8> What show-stopping problems have you been encountering? Also, which VPS providers have you had luck with so far?

<comment><USER7> The only provider I have been using so far is EC2. I tried Joyent (you can recompile your own kernel but but it's more of a PITA than I'm willing to deal with) and DigitalOcean (no 3.8 kernel for Ubuntu.)

The show stopping problems were early in development. The major one is that I ran into the kernel issues early on and then they added the recommendation to use only 3.8 or higher. So, that's not a fix but it addressed my problems. I was also having problems running Docker in stand-alone mode per their own docs, they have since removed this and daemon mode works great. I don't remember what the others were.

</comment></comment></comment><comment><USER9> This is fantastic, I've been wondering how DotCloud made everything work so well. Can't wait to try this for deploying a Django application I work on — hopefully it will solve my dependency headaches.

One nitpick — not a big fan of the recommended installation method (curl get.docker.io | sh -x). Is it really that hard to ask people to download and run the script themselves?

<comment><USER10> Drop the sh, and inspect the script before you run it. It just checks a few dependencies and system items, and then retrieves the docker binary, and puts it in /usr/local/bin. All of this can be done by hand by any Linux sysadmin .. And of course, it wouldn't take much to make a .deb for it either.

However, I would like to discuss the docker design a little more in detail, on the basis of its ease of use. First of all, I too do not like to have random stuff piped into my shell, so I went looking for the Docker sources. It was darned easy to build from sources, and quick too. At the end, I had a single binary.

And the cool thing about this binary is that its both the server and the client in the same package! So - the sysadmin of your Linux machine can (and should, manually, for now) build from sources, install in a local/ or ~/bin, and add the daemon to start up as needed.

Then, anyone else on the machine - not needing su rights - can run docker images, and so on.

This isolation, simplicity of install, and .. frankly .. rocking feature set .. is a beautiful thing. Can it be that golang is the secret sauce here? I say: yes.

<comment><USER11> Docker author here. Yes, the ability to produce a single binary that "just works" is one of the reasons we chose Golang. The operational simplicity is hard to beat, and you don't have to convince python hackers to install gems, java hackers to mess with virtualenv, and so on.

For the record, another reason we chose Golang is because it was _not python_. Docker is a rewrite of a 2 year old python codebase which has seen a lot of action in production. We wanted the operational learnings but not the spaghetthi code. So we made it impossible to cut corners by changing languages. No copy-pasting!

<comment><USER10> Well I for one was quite surprised that a) docker compiled so rapidly on my system, and b) its a very sublime binary. I guess I'm learning another reason why golang ought to get more of my free-time attention, so thats enough HN for me, I'm off to spend the afternoon reading your code.. Cheers to you and what I'm about to learn from docker! :)

</comment></comment></comment></comment><comment><USER12> Any recommended guides to getting a Django/RoR development environment set up with Docker? How does networking work with Docker? Currently I'm using Vagrant, the guest VM is sharing /Vagrant to the host (how does this work with Docker?), and the host has made Vagrant projects available over my LAN for my Macbook/Windows machines with IDEs. I also get the feeling Docker is meant to be complementary with VMs and not exclusive.

Also does it make sense using Chef/Puppet with Docker?

</comment><comment><USER13> Docker is awesome.

It lets you use a Linode or AWS instance as a bunch of NATed containers. This makes it way easier to install just one thing in one container and not mess up the other ones. This is where configuration management is going.

Plug: CloudVolumes is awesome for Win apps.

</comment><comment><USER14> My main ask is whether this provides the "hard" isolation types (io, mostly, and gpu). It sounds really cool.

Now that I'm looking at it, I don't think this provides any kind of isolation. That's not what it's for. It's for distributing packaged programs.

<comment><USER15> > Docker relies on a different sandboxing method known as containerization. > ... Most modern operating system kernels now support the primitives > necessary for containerization, including Linux with openvz, vserver and > more recently lxc, Solaris with zones and FreeBSD with Jails.

I'd guess it's (at most) as secure as the underlying OS containerization support.

<comment><USER14> I was asking about how the os controls access and allocation of shared resources.

<comment><USER16> Since docker uses cgroups and cgroups can limit CPU, Memory, I/O, i guess this blog post by the docker guys gives a good overview: [http://blog.dotcloud.com/kernel-secrets-from-the-paas- garage...](http://blog.dotcloud.com/kernel-secrets-from-the-paas-garage- part-24-c)

</comment></comment></comment></comment><comment><USER17> Way better than a VM, but only covers a subset of VM use cases.

<comment><USER18> It also covers some of the use cases for packages. So, it's half way between a package and a vm.

<comment><USER17> Exactly. That is actually a bigger problem to solve, IMO, so suggesting that it's mostly a VM alternative is doing it a disservice.

<comment><USER11> One of my biggest challenges has been finding the right way to describe Docker, because it borrows properties from multiple categories: virtualization tools, package managers, build tools, process managers, and even operating systems :)

People have told me they use Docker as a "vmware alternative", a "make alternative", a "rpm alternative", a "vagrant alternative" and even a "tomcat alternative". But people also use Docker _together_ with all of these tools!

In that way Docker reminds me of Redis: depending on what you want to do, you could use it as a replacement for memcache, rabbitmq, couchdb, mysql or even zeromq. But you could also use it _together_ with all of these tools. Over time we're getting more comfortable with the fact that Redis might just be a tool of its own - useful in its own unique way, in combination with whatever other tool is best for the job at hand.

... but none of that matters if nobody uses it, and to get people to use software you need catchy titles like "better than VMs" :)

</comment></comment></comment></comment><comment><USER19> Isn't this .. old news?

Why keep posting this every two month or so? Would be better if there are improvements, major site using it to roll out etc.

<comment><USER11> We (the docker authors) had nothing to do with this particular posting :)

That said there have been a lot of improvements - see the changelog here <https://github.com/dotcloud/docker/blob/master/CHANGELOG.md>

</comment></comment><comment><USER20> It looks really nice. It would be great if you write more in specific on <https://github.com/dotcloud/docker>. So, what "size" can we expect, what kind of elements are part of the container. What "interpreters" currently exist for the portable format you describe. But also meta-level information such as the size of the team, why has been chosen for Go, and in what situations NOT to use docker. I've been following docker.io for a while for the purpose of cloud services for robotics, so I think I'm a nice example of a person who would liked to be convinced to use your solution. :-)

</comment><comment><USER21> Depending on containers for security is absolute insanity. Kernel vulnerabilities are common. Own the kernel, break out of the docker containers, and the whole concept is rendered useless.

VMs are a much safer bet (though not perfect either).

<comment><USER22> Containers are nice for putting some distance between the compromised app and the OS. Especially useful when combined with a system for mandatory access controls (SELinux, Smack, etc). If you can attempt to limit the exposure of a compromise... you should!

Having said that... If someone has enough determination, they will manage to compromise your system regardless of how 'secure' it's has been made. :)

I generally like to use containers in _addition_ to a virtual machine. I do find it a bit shocking when I see a company offering up containers as an alternative to a VM though. I suppose it's a compromise some companies are willing to make for the additional performance.

<comment><USER21> > Containers are nice for putting some distance between the compromised app > and the OS.

Some distance. But now a days when you can own the kernel, that distance shrinks to zero.

I just saw these a few seconds ago: <http://grsecurity.net/~spender/logs2.txt> <https://twitter.com/grsecurity/status/335963659337601024>

<comment><USER11> The real value of containers is not security (although lxc does include robust security mechanisms), it's the streamlining of application deployment.

If you don't trust lxc to sandbox untrusted code, don't! Just deploy 1 production container per VM, or even per physical machine. But maybe you don't mind running multiple containers on your local dev vm or on your staging machine - I know I don't.

What containers give you is a constant payload which can be moved across very different hardware setups, from the most shared to the most isolated.

<comment><USER21> > it's the streamlining of application deployment.

I always liked the idea of nicely integrating with the environment and utilizing the features of package managers, the file system, users, and all the rest of the niceties we have at our disposal. "I don't know how to organize a bunch of things together!" seems like a silly reason to containerize every component into a separate root fs.

But on the other hand, I can imagine this work flow does have some merit, and some folks save a lot of time and energy and potential headaches just popping things in containers.

<comment><USER11> > "I don't know how to organize a bunch of things together!" seems like a > silly reason to containerize every component into a separate root fs.

One good reason to separate every component is that it facilitates moving them to separate machines down the road, or scaling them separately.

Another good reason is that it reduces the out-of-band requirements of the components. "all the niceties" you have at your disposal may very well be specific to your distro, or your site setup. By contrast, docker containers only require docker, which is a single binary file. A developer needs to know his component will run anywhere, not just on your particular setup.

</comment></comment></comment></comment></comment></comment><comment><USER23> A more relevant comparison is with Juju and Heroku buildbacks support by Stackato.

<comment><USER24> Juju person here. Docker would be a nice enhancement for Juju. Currently we use LXC in our older version (.7 in python) for a local provider to deploy containers on your local laptop. The idea is being thrown around to instead use Docker containers in _every_ provider like EC2 and OpenStack. This would enable you to just move stuff around transparently, which is awesome.

The Juju team is keeping a close eye on Docker and it'll likely (but I can't promise) be in 13.10.

</comment></comment><comment><USER25> This looks very interesting.

I would love to be able to setup a workflow on my Windows machine that allows me to be able to do Rails dev on the Windows machine, in as close to a native way as possible - but with using much of the same workflow I use on my MBP.

If I setup a container on my Windows machine, I would have still have to SSH into some virtual environment to be able to run my rails app, right?

Ideally, I would love to be able to just go to my localhost in my browser and see my app - will this help me be able to do that, rather than going to a browser within a VM or some 'contained environment'?

<comment><USER26> Docker looks like it is *nix only. It CAN be run on windows and Mac...inside a VM, which kind of eliminates all the advantages they talk about.

An option is Vagrant (Which Docker uses on the above OSes) + chef / puppet.

It uses VMs but works well enough for me and both configuration engines have widespread support. <http://docs-v1.vagrantup.com/v1/docs/getting-started/>

<comment><USER11> Running docker inside doesn't eliminate all the advantages. For example, you can test a full stack of components (frontend, database, memcache, background workers...) on a single VM, instead of deploying 1 vm per component, which gets really heavy really fast.

Another advantage is that docker on a vm is still docker: the container running on your local VM is 100% identical, bute-for-byte, to the container you will run on an octo-core box with half a tera of ram.

</comment></comment></comment><comment><USER27> I'm about to install and answer my own question, but what is the difference between this and, say, supermin + lxc? Or just supermin.

</comment><comment><USER28> Is there any way to migrate running containers to another physical machine if you need to do maintenance on the underlining system?

</comment><comment><USER29> Is this similar to RedHat's mock environment?

The advantage is that you're not limiting yourself to a RedHat distro. But conceptually is it similar?

</comment><comment><USER30> If only something like this existed for Windows.

<comment><USER31> VMWare ThinApp

Enigma VirtualBox

Molebox

Thinstall Virtualization Suite

There are more...

<comment><USER32> anything opensource?

</comment></comment></comment><comment><USER27> I really like the way the dependency format is basically a monad, but they don't call it a monad so devs won't get scared :)

</comment><comment><USER33> How is possibile to limit the resources (ram, storage, cpu) and get the resources usage stats?

Tnx

<comment><USER11> You can limit memory and cpu usage with "docker run -m" and "docker run -c", respectively.

Docker relies on cgroups for resource limuts and accounting. So anything you can do with cgroups, you can do with docker.

</comment></comment><comment><USER34> Will this replace vagrant someday?

</comment><comment><USER35> "Way better than a VM"

Why?

<comment><USER36> Crazily enough if you read the linked page you'll find out!

<comment><USER37> Probably a very snarky reference to, if you're uninterested in the four big features of docker, which are implied to be the only reasons for virtualization, and aren't even accurate anyway, then its not better than VMs, it might even be worse.</comment></comment></comment>


Fathers Seek Advertising That Does Not Ridicule - <AUTHOR> http://www.nytimes.com/2013/02/24/business/fathers-seek-advertising-that-does-not-ridicule.html?ref=technology&_r=0 <comment><USER2> I know a great way to avoid all those TV shows depicting sad-sack dads: get rid of your TV.</comment>


Apple Maps Flyover Reverse Engineering - <AUTHOR> https://github.com/retroplasma/flyover-reverse-engineering <comment> w-ll I don't think this is satellite data, most likely photos captured from planes.

And I'd kinda be curious to what Microsoft has been working on, I remember their birds eye was pretty good a few years ago.

Apple I'd believe the are selectively trying to improve their data in areas that are heavily visited by their users.

Also, I did for the first time see an Apple branded car with a photo sphere on the roof recently and kinda got excited that they are gonna try and bring competition into maps / street view that Google has dominated for the last decade.

<comment><USER2> The Apple street view cars also have LIDAR, so I'm curious to see what their plan is for that.

<comment><USER3> Considering the expense, and especially _time_ , involved in gathering street- level data, if I was Apple, I'd put every sensor I could think of on those cars and then let the data scientists figure out a use for it later.

<comment><USER4> Didn't Google get burned by doing that and "accidentally" collecting Wi-Fi network data?

[https://www.theguardian.com/technology/2010/may/15/google- ad...](https://www.theguardian.com/technology/2010/may/15/google-admits- storing-private-data)

</comment></comment></comment></comment><comment><USER5> I recently asked the founder of a pretty big GIS company how they handle plagiarism. The answer: "we don't bother. [we just monetize services on top of open data.]"

So it looks like the intentional errors method didn't work out in the end. [1]

Wonder if Apple will be as accommodating though :p

[https://www.gislounge.com/map-traps-intentional-mapping- erro...](https://www.gislounge.com/map-traps-intentional-mapping-errors- combat-plagiarism/)

</comment><comment><USER6> this is the same person who RE'd Google Earth a couple months ago: [https://news.ycombinator.com/item?id=18900080](https://news.ycombinator.com/item?id=18900080)

</comment><comment><USER3> Coincidence: Half an hour after reading this thread, a white Subaru with California tags stopped at the red light outside my office window. Big disco ball on a platform attached to the roof and "Apple Maps maps.apple.com" stenciled on the window.

I took a picture.

[https://imgur.com/UwK2wYy](https://imgur.com/UwK2wYy)

</comment><comment><USER7> As someone who works with GIS data and map meshes this is really awesome. Hats off to the author.

</comment><comment><USER8> I'd be interested in hearing how they reverse engineered the data!

<comment><USER9> Mostly used popular tools like Hopper, LLDB, Hex Fiend. Xcode's debugger UI was surprisingly helpful too because it lists current memory allocations of obj-c instances nicely. Also learned about Frida along the way and would have used it more in retrospect.

</comment></comment><comment><USER10> I just like how the example is the end of the Santa Monica pier!

</comment><comment><USER11> This is awesome. What are people using it for?</comment>


FrOSCon 2020 – Cloud Edition - <AUTHOR> https://live.froscon.de <comment><AUTHOR> FrOSCon (free and open source software conference) decided to go fully online this year. A lot of talks are in german, but many are in english. See the schedule here: [https://programm.froscon.de/2020/](https://programm.froscon.de/2020/)</comment>


400k trips on scooters in 11 days - <AUTHOR> https://translate.google.com/translate?sl=no&tl=en&u=https%3A%2F%2Fnrkbeta.no%2F2019%2F03%2F28%2F400-000-turer-pa-sparkesykkel-pa-11-dager-i-usa-fikk-vi-kjenne-transport-revolusjonen-pa-kroppen%2F <comment><USER2> Thank god I still haven't seen any in Berlin, but a few days ago I went to Paris for the dotgo and now I understand all the article about how bad they are.

These scooter are hell on earth. They are everywhere, zipping through traffic more dangerously than bikes, often with 2 people on them. Parked in front of historical monuments, in public parks, sideways on the already small sidewalks. It's ridiculous.</comment>


Leah Goodman defends possible Bitcoin author identification - <AUTHOR> http://hereandnow.wbur.org/2014/03/07/nakamoto-bitcoin-newsweek

<comment><USER2> She still doesn't acknowledge what she did was wrong ... pathetic.</comment>


WWDC 2013 Keynote - <AUTHOR> http://www.apple.com/apple-events/june-2013/ <comment><AUTHOR>
      07:00 — Honolulu, Hawaii
      10:00 — San Francisco, California
      13:00 — New York, New York
      14:00 — São Paulo, Brazil
      18:00 — London, England
      19:00 — Rome, Italy
      20:00 — Riyadh, Saudi Arabia
      21:00 — Moscow, Russia
      22:30 — New Delhi, India
      01:00 — Shanghai, China (June 11)
      02:00 — Tokyo, Japan (June 11)
      03:00 — Sydney, Australia (June 11)

<comment><USER2> PSA: The Microsoft E3 press conference will be live streamed at exactly the same time (though MS will start 30 min before Apple) as Apple's WWDC press conference.

A few hours afterwards the EA, Ubisoft and the Sony press conferences will commence.

Here's a great site with times (in your local time zone) and live stream links to all the E3 speeches upcoming tonight:

[http://www.e3countdown.com/](http://www.e3countdown.com/)

This is going to be one of the most exciting nights for tech/gaming junkies like me in a long time!

<comment><USER3> Not for me. The recent revelations about the NSA have made me realize that these events are largely a distraction from greater issues.

<comment><USER4> Of all the shit that has gone in in the world in recent history, the NSA potentially reading your email is what makes you care less about WWDC?

<comment><USER5> Yes.

<comment><USER4> Fair enough.

</comment></comment></comment></comment></comment></comment><comment><USER6> [http://p.events- delivery.apple.com.edgesuite.net/13oygadvoyi...](http://p.events- delivery.apple.com.edgesuite.net/13oygadvoyibawefpiuawefpiuawdf6/sl_mvp.m3u8) for VLC

<comment><USER7> This manages to keep crashing VLC for me. Heh.

<comment><USER8> Same here - anybody have a fix?

<comment><USER6> Same here (and on mobile too). Seems like mirrors on Ustream are the best option e.g. [http://www.ustream.tv/ltktv](http://www.ustream.tv/ltktv)

<comment><USER9> Yeah, I think so. I've had a look through the other feeds on ustream, and haven't found one good quality as that one but that doesn't have annoying commentators talking over the presenter. Ah well...

<comment><USER10> Can you give a link to a low quality one? My problem is I have low speed connection.

<comment><USER9> [http://www.ustream.tv/channel/wwdc-2013-live](http://www.ustream.tv/channel/wwdc-2013-live) was one, but I've no idea if it'll be better for slow connections than [http://www.ustream.tv/ltktv](http://www.ustream.tv/ltktv)

<comment><USER10> That link is choppy and looks crap but it is a lot better than crashing VLC every 5 fucking minutes. Thanks A TON! I expect better from apple.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER11> "Live Streaming video requires Safari 4 or later on Mac OS X v10.6 or later; Safari on iOS 4.2 or later. Streaming via Apple TV requires second- or third- generation Apple TV with software 5.0.2 or later."

<comment><USER12> mplayer [http://qthttp.apple.com.edgesuite.net/129opiygabsdvibsdfobsd...](http://qthttp.apple.com.edgesuite.net/129opiygabsdvibsdfobsd/sl_vod_mvp.m3u8)

seems to work for now. Though streaming the previous event for the time being.

<comment><USER13> VLC also can play it. File->Open Network Stream, paste link. Don't know the CLI command to open it in VLC.

<comment><USER14> vlc [http://qthttp.apple.com.edgesuite.net/129opiygabsdvibsdfobsd...](http://qthttp.apple.com.edgesuite.net/129opiygabsdvibsdfobsd/sl_vod_mvp.m3u)

;)

<comment><USER15> On a mac it would be:

open -a /Applications/VLC.app/ [http://qthttp.apple.com.edgesuite.net/129opiygabsdvibsdfobsd...](http://qthttp.apple.com.edgesuite.net/129opiygabsdvibsdfobsd/sl_vod_mvp.m3u)

:)

</comment></comment></comment></comment></comment><comment><USER16> For everyone asking for a Windows or Linux live stream, last time I watched it on UStream on Win XP - it worked flawlessly, and was about ~30 seconds behind the live blogs.

www.ustream.tv/ltktv looks good for today

<comment><USER10> If this is the guys who stream from a phone then last time they got caught about 5 times and the video/audio was pretty terrible in the auditorium wifi which is flaky. But that was a Steve Jobs keynote. Maybe Cook's will be different/more lenient.

<comment><USER17> No need to stream from a phone this year, or even be in the room. Joe Random with a Ustream account just needs to open the official stream on a Mac, then rebroadcast that to UStream. Easy.

<comment><USER10> Oh I see, that makes sense. Thanks!

</comment></comment></comment></comment><comment><USER18> Really happy to see a tagging file system. Messing around with a hierarchical taxonomy has always been a waste of my time.

EDIT: oh crap flat UI

<comment><USER19> I agree somewhat, but I think I've become somewhat institutionalised by the hierarchical approach! However, here you can blend the two and get the best of both worlds. :)

</comment></comment><comment><USER2> So they're streaming this one live for the first time in ages?

<comment><USER20> Since last year, you mean?

Edit: Thanks smackfu - apparently last year's WWDC event was not streamed, but their October special event was, which got me confused.

<comment><USER17> I don't think the WWDC 2012 keynote was live streamed. The October 2012 special event for the iPad mini was though.

<comment><USER20> Ah I was probably confused with that, then. I guess my statement is still technically correct, but I did mean last year's WWDC event.

</comment></comment></comment></comment><comment><USER10> I am on windows 8, Chrome/Firefox/IE10 and even installed quicktime. I also have VLC. Does anyone know a way to stream the video? Safari is not available for windows anymore. Seems pointless to restrict a huge demographic out.

<comment><USER21> As far as I know, it will not work on Windows. From the page:

Live Streaming video requires Safari 4 or later on Mac OS X v10.6 or later; Safari on iOS 4.2 or later. Streaming via Apple TV requires second- or third- generation Apple TV with software 5.0.2 or later.

<comment><USER10> Yes, as you say, that's... written on the linked page.

</comment></comment></comment><comment><USER22> New mac pro or gtfo.

<comment><USER23> I'm hoping for Xeon Phi coprocessors as standard a option too.

<comment><USER24> With an extra 10+ hours battery life. With every core (CPU+GPU) at 100%.

Heh, sorry couldn't resist. We all know that's totally unrealistic. What I really want is a changeable battery, whoops there I go again!

<comment><USER25> Battery on a mac pro? What for?

</comment></comment></comment></comment><comment><USER26> What are the chances the streaming servers will be able to hold up with the demand? Anybody got a favorite mirror for this?

<comment><USER2> Pretty big, they're using the massive Akamai network handling 15-20% of all internet traffic.

[https://en.wikipedia.org/wiki/Akamai_Technologies#Customers](https://en.wikipedia.org/wiki/Akamai_Technologies#Customers)

<comment><USER27> 30-40% if you include PRISM.

Edit: Ok, fair enough with the down mod, I made a witty remark, but seriously, how do you measure internet traffic? In photons going to designated recipients, as if they were sealed love letters?

<comment><USER28> If the NSA required a copy of every bit flying around the Internet, wouldn't the amount of traffic caused by Akamai remain the same, percentage wise?

(15 out of 100 is 15%. 30 out of 200 is also 15%.)

<comment><USER29> Yeah, but they only need one copy of what's on akamai, plus the metadata.

</comment></comment></comment></comment></comment><comment><USER19> Finally -- tabbed windows in the Finder. I am so so happy about this! It is a simple feature, so I'm happy to see it finally arrive.

The other window and dock management changes also look like big wins for me. :)

<comment><USER30> I wonder if the Finder will finally be able to auto-adjust its font for best- fit-for-content style views. Its the 21st Century, it should be doing this by now, grr ..

</comment></comment><comment><USER31> Is there a way to watch this from a Linux or windows OS?

I bet I'm like a lot of other people here where I have a macbook air at home but work on Linux and windows machines.

<comment><USER32> I don't own or use anything that is allowed to view this, but I would still like to. I really wish Apple would change their attitude toward non-Apple users.

<comment><USER33> It's not about allowed device. It's about supported technology. Apple went all-in on HTTP live streaming, everything they make supports it, and everything they stream uses it. VLC supports it. I think silverlight does too, if you want to whip up your own player in a dead technology.

<comment><USER32> Yes, well it turns out that Apple lied, and you can in fact watch the stream on non-Apple hardware.

<comment><USER34> seriously??? get over yourself.

<comment><USER32> Yes, 100% seriously. They said that you can't watch the stream on non-Apple hardware, and it turns out that is completely untrue. Why is it in any way controversial for me to point this out?

</comment></comment></comment></comment></comment></comment><comment><USER35> Why can't I use Firefox or Chrome to view this?

<comment><USER36> If you are interested in this event running Safari is no great hardship.

<comment><USER35> Hardship? Of course not - it's right there in my dock. My point is more about open web standards and Apple not caring about them here.

<comment><USER36> Definition:

> "An open standard [1] is a standard that is publicly available and has > various rights to use associated with it,"

Published standard: HTTP Live Streaming at IETF [2]

See also: HTTP Live Streaming at apple.com [3]

The real question is why have none of the other browsers gone on to implement what is a very efficient streaming technology. And HTTP live streaming is very web-like, there's not really any new technology there. Instead Firefox and Chrome put effort into WebRTC, which seems like a lot more work. Although I do accept that WebRTC is orthogonal to HTTP Live streaming.

[1] [https://en.wikipedia.org/wiki/Open_standard](https://en.wikipedia.org/wiki/Open_standard)

[2] [https://tools.ietf.org/html/draft-pantos-http-live- streaming...](https://tools.ietf.org/html/draft-pantos-http-live-streaming-11)

[3] [https://developer.apple.com/streaming/](https://developer.apple.com/streaming/)

<comment><USER35> Didn't realize there was an actual standard being used here that simply wasn't supported by the other browsers.

</comment></comment></comment></comment></comment><comment><USER37> This is available on Apple TV as well.

</comment><comment><USER38> Shame they won't just stream on Youtube like everyone else.

<comment><USER39> I find the once-per-year installation and subsequent purging of QuickTime quite therapeutic. Is there anyone else than Apple that still serves up QuickTime video?

<comment><USER40> Did you really install it? Why? Just to take a jab at it? You should have used VLC if you are not on a Mac. The video stream is H264, not QuickTime video.

</comment></comment></comment><comment><USER41> Is it just me or have i been spoiled by the awesome conference setups from the past (e.g. Google), that I am already a bit disappointed with the beginning of this one?

</comment><comment><USER42> Does anyone have a download link of the keynote video ?

I live in India & the bandwidth is really low to watch the streaming video(even post the event) :(

</comment><comment><USER43> The fact that the stream is live for apple users suggests that they are the targeted audience.

<comment><USER44> The fact that this is the World Wide Developer's Conference makes me think that developers are the targeted audience.

</comment></comment><comment><USER45> It hasn't started yet has it?

</comment><comment><USER41> really? you cannot watch if you are not on iOS? Messed up.

</comment><comment><USER46> iOS 7 looks like Windows Phone and Android had a baby.

<comment><USER47> A fugly one.

</comment></comment><comment><USER48> I can barely watch this. Cook imitating Jobs doesn't work.

<comment><USER49> It hasn't even started yet…why would you make that comment?

<comment><USER48> The direct HTTP link posted here was still playing the keynote of last year, which I didn't notice immediately. I have no doubt my comment will still apply when it actually starts.

<comment><USER50> Well?

</comment></comment></comment></comment><comment><USER51> Techcrunch: Live From Apple's WWDC 2013 Keynote

[http://techcrunch.com/2013/06/10/live-blog- wwdc-2013-keynote...](http://techcrunch.com/2013/06/10/live-blog- wwdc-2013-keynote/)

</comment><comment><USER52> Use raveler to discuss WWDC. It's better than using twitter. [https://itunes.apple.com/us/app/raveler/id641285606](https://itunes.apple.com/us/app/raveler/id641285606)

<comment><USER53> I don't think you should lie when advertising your product.

<comment><USER54> Especially when it looks like Raveler co-opted Path.app's logo.

<comment><USER52> We actually took a lot of logo inspiration from the CNN app, instead of Path. If you had a chance to take a look at the app. I'd love to hear your thoughts.</comment></comment></comment></comment>


Show HN: Full Calendar and Todo List with Portable Data, Supports Dropbox - <AUTHOR> https://textcal.com/?v=3 <comment><USER2> This looks neat...but there's no self-hosted option (or doesn't seem to be?). I'm going to suspect that many users who are interested in using a plain-text calendar/todo system like this would prefer hosting the result themselves rather than piping it through a cloud service.

That said, I _really_ like this model for constructing calendars from easy text files. It would make it a lot easier to create shared calendars from a bunch of engineers that all use different calendaring clients, especially if this could make a read-only ICS available for import into a client. I could imagine creating a text calendar file in a git repository and managing additions using pull requests, for instance...

<comment><AUTHOR> Thank you for your feedbacks. For the local hosting, it currently stores calendar data in the browser (localStorage), and sync back (for private calendars) when you're online & logged in. Right now, users can save data to Dropbox (app folder). I plan to create a cross-platform desktop app (using Electron) so user can save to files also.

That's a great idea about git! I also thought about it. Importing feature is being developed. In the next few days, users will be able to import from a public webpage (Github, Google Sites, etc.) & publish the read-only calendar to other users. If you could become a beta user for this feature, I'd really appreciate that. Please file a ticket at - [https://github.com/TextCalHQ/Support](https://github.com/TextCalHQ/Support)

</comment></comment><comment><USER3> When I add a new task, it is always added on the next day.

Chrome latest, OSX, Timezone +8 if that's the issue.

<comment><AUTHOR> I'm also in PST timezone but it works. I logged the bug here - [https://github.com/TextCalHQ/Support](https://github.com/TextCalHQ/Support) \- will try to reproduce the bug. Thanks.

</comment></comment><comment><USER4> Just what I need. It'd be great if I can save to other storage services also.

<comment><AUTHOR> Other storage (Evernote, etc.) services will be supported in the next version. Also, users will be able to import calendar tasks/events data from any webpage.</comment></comment>


Google Cloud credits gave us Covid relief - <AUTHOR> https://startup.google.com/tools/coronavirus-resources-for-startups/ <comment><AUTHOR> This was amazing on Google's part. We are a small company with a teeny-weeny seed round, struggling to take off and Google's credits literally extended our runway and saved the team a lot of anxiety in the next 12 months. Just wanted to share with HN, not least because this is what I had criticized Google for in the past right here.</comment>


Excercises in Generated Prose - <AUTHOR> http://emshort.wordpress.com/2009/06/24/exercises-in-generated-prose/

<comment><AUTHOR> There was an article here earlier about Inform 7 tools, this one shows how to construct interesting interactive prose using the I7 language.</comment>


What would Milton Friedman do now? - <AUTHOR> http://online.wsj.com/article/SB10001424052702303443904575578202202857136.html

<comment><USER2> Friedman would definitely support the Fed's actions. Bernanke is a loyal Friedman acolyte.

The "Helicopter Ben" reference comes from him quoting Friedman's term for creating money to prevent deflation: [http://www.federalreserve.gov/BOARDDOCS/SPEECHES/2002/200211...](http://www.federalreserve.gov/BOARDDOCS/SPEECHES/2002/20021121/default.htm)

He credits the Fed's failure to do what it is doing now with causing the Great Depression in this speech: [http://www.federalreserve.gov/BOARDDOCS/SPEECHES/2002/200211...](http://www.federalreserve.gov/BOARDDOCS/SPEECHES/2002/20021108/default.htm)

Friedman explains this himself in the following clip from his television series: <http://www.youtube.com/watch?v=9V5OP-VmXgE>

<comment><USER3> Friedman also conceived of income tax withholding and what he called the "negative income tax," now known as EITC. It does not surprise me that he would advocate Monetary Mischief as well.

The QE arguments are an example of magical thinking. Incomes are falling, so increment some numbers in the memory of a computer and that will fix it. Never mind the realities of Human Action.

Real incomes rise when people become more productive, and that happens when they have more and better tools (capital) at their disposal and more incentive to produce. No one achieves that by printing Monopoly money.

"Each dollar the Fed prints has less oomph." Yes, they are pushing on a string, and those dollars do not impress me. To those who feast at the government trough, may you eat dollars!

<comment><USER2> EITC isn't really the same thing as the basic income/negative income tax. The basic income has no means test whatsoever, whereas the EITC does. Check out the wiki on it. Also, most economists support the basic income as the ideal system of welfare (as confirmed in the article this thread is about), and it is intended to replace all other forms of welfare, including Social Security and Medicare.

Tax withholding was done during WW2 and before Friedman had changed his views considerably. But monetarism is his crowning achievement, it is what he is best known for, and where he was most influential. Friedman beat inflation and solved the mystery of the Great Depression.

</comment></comment></comment><comment><USER4> If you watch his "Free to choose" series (<http://www.ideachannel.tv/>), Friedman blamed the Fed for the depression because they didn't keep the money supply stable. Because of bank failures the money supply decreased by a 3rd. He never advocated massively increasing the money supply. In fact, he has been consistently against printing money because of it's leading to inflation.

You can interpret his comments on the BOJ in the article that he would support buying government bonds only as a way to provide liquidity to banks. In the current US scenario, the banks and corporations have enough capital, so I cannot see that Friedman would support QE2.

P.S. "Friedman believed in the power of money". Nonsense. He believed in the power of individual freedom.

<comment><USER5> I don't understand the downvote for this (so I voted it back to 1).

Generally speaking, the idea expressed here matches my own understanding (though I'm more specifically familiar with Hayek and Mises). Can anyone explain why bj_nortier_hn is wrong?

<comment><USER4> Downvoting it without posing a counter-argument doesn't help me in examining my own subjective beliefs. If I'm wrong, I want to know why.

</comment></comment></comment><comment><USER6> _"The Friedman logic, though, makes the case for QE2."_ but only just after going through uncertainty and points against. The way the article is written sounds like the author wanted the conclusion regardless.

<comment><USER7> Well, I'd hope it was after going through uncertainty and points against. Otherwise, how do you know if the idea's any good?

</comment></comment><comment><USER8> Short reply by Krugman: [http://krugman.blogs.nytimes.com/2010/10/28/friedman- on-japa...](http://krugman.blogs.nytimes.com/2010/10/28/friedman-on-japan/)

<comment><USER9> I found this helpful, as I am not familiar with the term: <http://en.wikipedia.org/wiki/Liquidity_trap>

</comment></comment><comment><USER10> _Enough about John Maynard Keynes. We can be sure the 20th century British economic giant would advise more government spending to spur U.S. economic growth with consumers and businesses so hesitant and short-term interest rates at zero._

Indeed, enough... we don't want to be remembered anymore that he would advise us to save money in good times so we can spend it when the times get bad. And we're spending it in both good and bad times.</comment>