Do you want a good one sentence description for your company? - <AUTHOR> I love to create and serve.
Just tell me......
What you do?
How you do it? and Why?
I will write you a simple one sentence description of your company.
I am A simple man <comment><AUTHOR> Im looking forward to seeing what great companies are doing out there...</comment>


Planning for catastrophe - <AUTHOR> http://webmasters.stackexchange.com/q/16746/1253

<comment><USER2> He/She should be asking: What can I afford, and what kind of RTO/RPO's do I have? Does the entire system need to be back up? Can you survive with a stream-lined version of your infrastructure? Do you think you can restore your systems on the failover site faster than your provider can restore service? This is a big one -- failing over may cause your site to be out longer if the provider restores service mid-way through -- and by then, your DNS changes may have already begun to propagate.

If your business really requires to be up all the time, perhaps you should be looking at multiple online sites (active/active), with failover just at the data layer. That means duplicating your environment (down to hosting your own DNS servers at each site), and fighting all of the typical replication issues.</comment>


Ask HN: What would you do differently if you knew you might live to 1000? - <AUTHOR>

Suppose SENS worked out and essentially cured aging, so you knew there was a good chance you and everyone else would live to at least 1000 (only non-aging related things could kill you).<p>What would you do differently, starting from today? <comment><USER2> Nothing; we'll still manage to kill ourselves/each-other long long before we reach 1000.

</comment><comment><USER3> Floss.</comment>


Jsonstore.io – Store your data for free without signing up - <AUTHOR> https://www.jsonstore.io/ <comment><USER2> So this is the same what Pastebins are for unstructured texts and image hoster for pictures. At one point, at least everybody realizes that JSON can host arbitrary data -- such as unstructured text -- and pictures as containers, can do as well.

I wonder how the operators of these free services act in terms of durability. [https://jsonbin.io/](https://jsonbin.io/) proudly reports: "21838 bins created". That probably does not need much storage. But what if I use it regularly from my systems? I'm not so much convinced of just another service which allows storing data for some time, probably with a nice UI.

(Actually I noticed this with [http://sprunge.us/](http://sprunge.us/) \-- I included uploading a build log into my build systems which my team is using now. At one point, sprunge.us started to give back 500's for us, basically stopping working. Sure, switching the service takes a blink of an eye.)

<comment><USER3> JSONbin.io developer here. Tracked the thread using GA after unusual spike in the traffic.

Good point. We cannot trust any random service. It takes some amount of investment, dev time & server costs to keep the service up and running. The reason I developed this service is to ease the storage process for the developers developing mobile or small scale apps, so that they can focus on the app rather than spending time setting up the database. Just to keep the website up and running, I'm going to introduce nominal amount plans which developers can afford and it pays my server bills. I'll ensure that I've SLA in place when am introducing pricing. The only reason I've not introduced pricing on the website is I don't want to charge for something basic what am providing for now. Will add it when I provide more powerful features which are already under development.

<comment><USER4> What's your take on developers not putting the effort forth to use their own object store (ie S3) for this?

I'm not against developer velocity (disclaimer: not a dev), but this seems to be a cycle where hosted tool comes out, people rely on it, tool becomes too expensive to run, neglected, etc, and then tool goes dark one day. Would time be better spent on client libraries that ease the difficulties of using existing durable storage systems? Or open source javascript frontends you can drop into your S3 bucket to provide a GUI for manipulating JSON in the same object store?

I am seeking enlightenment, not an argument. In tech for almost 20 years now, and have seen my fair share of the cycle.

<comment><USER5> I believe your question is equivalent to the question of solving the tragedy of the commons, which suggests it's indeed a tricky problem.

As a strawman proposal, we could take some of Elinor Ostrom's suggestions for a non-governmental solution ([https://en.wikipedia.org/wiki/Tragedy_of_the_commons#Non- gov...](https://en.wikipedia.org/wiki/Tragedy_of_the_commons#Non- governmental_solution)) and apply them:

1\. Introduce the concept of an API key to allow users to voluntarily segregate the traffic into accounts. API keys are only voluntary because it's easy to extract someone else's key from a client binary and masquerade as that person.

2\. Issue API keys only to users who agree to a set of community standards.

3\. Nontrivial usage that still complies with the community standards requires payment. The payment should be structured so that it's reasonable for medium- traffic users to stay, but more economical for heavy-traffic users to leave the community and start up their own clone of the service. For style points, the community standards should have specified that anyone who starts with the free community service and graduates to hosting a clone must also host low- traffic free users, basically causing the service to become federated. Maybe the original service replies with 301 redirects to the new service so that old clients keep working.

I think all of this can be fully automated, and if you're cool accepting Bitcoin for usage above the free tier, then you don't even have to worry about how to handle payments. There are plenty of VPS providers that accept Bitcoin these days, so the system is even closed-loop from the perspective of the service operator.

<comment><USER6> I built essentially what you describe a while back (jsondata.io if you're interested, though the certificate has expired and I've turned off the actual service for now). The idea was to make an infinitely scalable (within reason) solution that works well as a pastebin-style, no-setup-required data store for hacking on projects, but also as something that can scale with the needs of a business.

The architecture is built on AWS Lambda and DynamoDB, along with a small Ruby Sinatra service to handle payments and access control.

After running it for a while and getting some limited feedback from potential users/customers, I ultimately abandoned the project due to an apparent lack of interest. For hobby projects, it's fairly easy to spin up a self-hosted data store for low volume needs (or use one of the other free services). For anything more than that, a business is probably going to spend the necessary time/money to maintain a full DBMS or use something like Firebase.

I might be missing an opportunity (I've had thoughts about resurrecting the project), but for the time being, I'm just not convinced there is enough demand on the paying side.

<comment><USER5> Part of the fun of prototyping is setting up your own service; at least, I always find that part fun. That likely eliminates some of the target market.

If the service API were fully standardized, and users paid for their own database, and signing up for a new website meant that the user granted controlled DB access to the site, then that might be enough impetus for developers to use a provider of the service. Maybe it could follow a Dropbox model where the first N bytes/month are free per user, and service providers pay affiliate fees to sites that recruit lots of paying users.

See also Attic Labs ([https://techcrunch.com/2018/01/08/salesforce-acquires- attic-...](https://techcrunch.com/2018/01/08/salesforce-acquires-attic-labs- the-startup-behind-decentralized-database-noms/amp/)).

</comment></comment></comment></comment></comment></comment><comment><AUTHOR> To make it clear:

\- jsonstore.io is intended for small projects, mostly for the open-source community. It's not a datastore you can use to store all the logs of your company, and we do have quota limits.

\- We do nothing with your data, it's secured and if you want to store sensitive data you may want to encrypt it.

\- The idea of this project is to provide the open source community a easy solution for storing casual usage data/settings for their projects.

<comment><USER3> Just want to drop a big thumbs up for making the project open source unlike mine. It will really help developers who are looking for an API and want to host it themselves. I'll try to contribute to your project in the best possible way I can. Cheers.

<comment><AUTHOR> Thanks, appreciate it. :)

</comment></comment></comment><comment><USER7> Hashing a value from Math.random() with a cryptographic hash (i.e. SHA256) doesn't make it cryptographically random[1].

If you want a random string get one directly via crypto.randomBytes(...)[2]:

        const id = crypto.randomBytes(32).toString('hex');

[1]: [https://github.com/bluzi/jsonstore/blob/87af0d3ef6bf11222b98...](https://github.com/bluzi/jsonstore/blob/87af0d3ef6bf11222b98c00bbfda3ea48c30be57/api/routes.js#L9-L10)

[2]: [https://nodejs.org/api/crypto.html#crypto_crypto_randombytes...](https://nodejs.org/api/crypto.html#crypto_crypto_randombytes_size_callback)

<comment><USER8> Why not use uuids?

<comment><USER7> UUIDs are fine too. What matters is how they're generated.

If you're generating v4 UUIDs server side using the "uuid" NPM module then you're fine as internally it's using crypto.randomBytes(...)[1] with an _almost_ 16-byte random string (UUIDs are 16-bytes but a proper v4 UUID has to override some of the bits to conform to the spec[2]).

If you're rolling your own UUID function or generating them client side then they may not be as random as you think. For example the same uuid NPM module silently uses Math.random()[3] on the client side if it can't find a better alternative. It's fine for something purely local to the one browser but I wouldn't rely on it being unique globally.

[1]: [https://github.com/kelektiv/node- uuid/blob/17d443f7d8cfb65a7...](https://github.com/kelektiv/node- uuid/blob/17d443f7d8cfb65a7d85803218df27a6b4ae8397/lib/rng.js#L7)

[2]: [https://github.com/kelektiv/node- uuid/blob/17d443f7d8cfb65a7...](https://github.com/kelektiv/node- uuid/blob/17d443f7d8cfb65a7d85803218df27a6b4ae8397/v4.js#L15-L17)

[3]: [https://github.com/kelektiv/node- uuid/blob/17d443f7d8cfb65a7...](https://github.com/kelektiv/node- uuid/blob/17d443f7d8cfb65a7d85803218df27a6b4ae8397/lib/rng-browser.js#L20-L28)

</comment></comment></comment><comment><USER9> Sounds like a vaguely similar project to RequestBin[0].

Just a word of warning: "We have discontinued the publicly hosted version of RequestBin due to ongoing abuse that made it very difficult to keep the site up reliably."

[0]: [https://github.com/Runscope/requestbin](https://github.com/Runscope/requestbin)

</comment><comment><USER10> So there's no actual security on this? That is, given the knowledge of an endpoint, anyone can issue requests against it?

How do you plan on responding to requests regarding GDPR requirements from EU residents? What happens when someone starts uploading content that could be covered under the DMCA? Following the links, should we assume that [https://www.forter.com](https://www.forter.com) is the responsible company?

<comment><AUTHOR> Not at all, it has nothing to do with Forter. It's my own personal project.

<comment><USER11> I hope you've learned a lesson about creating things that may help people on the modern, legislated internet. Next time, be prepared to handle all complaints first or stop providing services to people and let the bigger companies do it that can absorb the administrative costs that come with worldwide legal conformance.

<comment><USER9> It's quite sad that this is the current state of the internet.

</comment></comment></comment></comment><comment><USER12> Looking at your source code, it appears you're wrapping firebase. I'm very curious to hear how much this will cost you after the HN traffic hit.

</comment><comment><USER13> Be sure to check out webdis ( [https://github.com/nicolasff/webdis](https://github.com/nicolasff/webdis) ) for a similar service you can run on your servers. It's all in C so it's superlighweight.

<comment><AUTHOR> Thanks for sharing! fyi: You can also run jsonstore on your own servers.

</comment></comment><comment><AUTHOR> Just enter the website, copy your link, and start sending HTTP requests to store data.

GitHub: [https://github.com/bluzi/jsonstore](https://github.com/bluzi/jsonstore)

</comment><comment><USER14> The curl DELETE example is wrong (it's identical to the GET example).

</comment><comment><USER15> JavaScript developers interested in this should also take a look at [https://encapsule.io/docs/ARCcore/filter](https://encapsule.io/docs/ARCcore/filter) that makes it simple to implement bulletproof JSON validation and normalization. Advanced application of this library additionally allows for runtime type-based metaprogramming in JavaScript (i.e. build generic algorithms that are specialized to handle specific app-defined data types at runtime).

</comment><comment><USER16> It even has an automated assistant...who looks like he's about to beat you up and take your lunch money.

</comment><comment><USER17> How do you deal with abuse? E.g. people posting (links to) copyrighted stuff, or large amounts of data?

</comment><comment><USER18> Since we are talking about the value of an online JSON storage system, would any of you be interested in a collaborative system for common JSON data sources? Something like Wikipedia but for structured data that currently lives as files or github repos?

</comment><comment><USER19> "Create a microservice that stores JSONs." Says the senior SE to the intern.

</comment><comment><USER20> Another similar tool (FOSS, source is on GitHub somewhere): [https://jsonblob.com/](https://jsonblob.com/)

It also has the added advantage of a JSON editor with tree view.

</comment><comment><USER21> "This site is blocked due to a security threat."

First time I'm seeing this message so I doubt it's a case of over-sensitive Cisco firewall. Chrome also blocked it as a threat.

<comment><USER22> Cisco firewalls block GitHub occasionally...

</comment></comment><comment><USER23> If i were to host this locally, what are jsonstore benefits compared to let's say couchdb (opensource, stores and serves json documents over http)?

</comment><comment><USER24> Basically a [https://jsonbin.io](https://jsonbin.io) clone?

<comment><USER25> Sounds like it, though as the author of jsonbin is in this thread points out, this one is open source: [https://news.ycombinator.com/item?id=16765885](https://news.ycombinator.com/item?id=16765885)

<comment><USER24> gotcha

</comment></comment></comment><comment><USER15> How does this differ from Firebase?

<comment><USER26> It is essentially a think wrapper on Firebase:

[https://github.com/bluzi/jsonstore/blob/master/api/database....](https://github.com/bluzi/jsonstore/blob/master/api/database.js)

</comment></comment><comment><USER27> Cool idea! I'm kinda jealous I didn't think of it myself. Very simply but useful.

Nice work!

</comment><comment><USER28> what is the backend / infrastructure like ? is it just Mongodb?

<comment><AUTHOR> Feel free to look at the sources: [https://github.com/bluzi/jsonstore](https://github.com/bluzi/jsonstore)

</comment></comment><comment><USER29> This looks handy! Thanks!

</comment><comment><USER28> this just opens up a whole new world to static websites!

</comment><comment><USER30> Love the implementation! Would be great to eventually see pagination and parameter/ID filtering (/users?age=32, etc)</comment>


Ask HN: What is the best city for a Technical Support operation in the US? - <AUTHOR>

Based on the following parameters:<p>1. Low cost of living 2. Lots of experienced staff technical support agents <comment><USER2> In cringely.com a couple of years ago he posted about this company: Maverick Software [1]

That is providing technical support services from Minnesota Mankato.

This provides nice alternative to outsourcing. By setting up technical support centers in inexpensive regions of the us.

[1] [http://www.cringely.com/2010/08/24/little-geeks-on-the- prair...](http://www.cringely.com/2010/08/24/little-geeks-on-the-prairie/)

</comment><comment><USER3> Have you thought about having a remote staff? Then you aren't limited by geography.

That's what Support.com and Sutherland do.

Or maybe you work for one of these companies and are looking for where to best target your ads for Craigslist? :)</comment>


NYU: Obesity the biggest 'chronic' factor in New York's Covid hospitalizations - <AUTHOR> https://www.zdnet.com/article/nyu-scientists-largest-u-s-study-of-covid-19-finds-obesity-the-single-biggest-factor-in-new-york-critical-cases/ <comment><USER3> Here's the actual study: [https://www.medrxiv.org/content/10.1101/2020.04.08.20057794v...](https://www.medrxiv.org/content/10.1101/2020.04.08.20057794v1)

ZDnet title seems a bit off, as first factor in their decision tree is _age_ , not _obesity_. Also, this doesn't appear to attempt to unwind causation vs correlation. As I read it, it's just, _if you could only ask a few questions to make your decision, what should you ask first?_ Useful for admitting, but probably less so for understanding what's actually going on.

Looking at the numbers in the paper, high blood pressure, for example, seems like a powerful predictor of problems. Presumably that's captured by the obesity question, even though those two conditions are only partially correlated.

Also interesting is that they don't see race as a factor. Other reports seem to indicate that African Americans are doing significantly worse.

<comment><USER4> It's worth noting their definition for obesity is BMI>40 as opposed to the normal definition of BMI>30\. BMI>40 is considered "class 3" or "extreme" obesity.

<comment><USER5> In Table 1, BMI between 30 and 40 was also strongly correlated with hospital admission: 659 people in that group were admitted, 256 were not.

</comment></comment></comment><comment><USER6> [https://www.medrxiv.org/content/10.1101/2020.04.08.20057794v...](https://www.medrxiv.org/content/10.1101/2020.04.08.20057794v1.full.pdf)

Surprising outcome: inconsistent data on smoking, they found no correlation.

</comment><comment> radford-neal I looked at this question using the UK critical care data in a blog post at [https://radfordneal.wordpress.com/2020/04/06/body-mass- and-r...](https://radfordneal.wordpress.com/2020/04/06/body-mass-and-risk- from-covid-19-and-influenza/)

From that data, it does indeed seem that having BMI>40 is a large risk factor for COVID-19 being serious. BMI between 30 and 40 is also a risk factor, but much less than for BMI>40.

In drawing these conclusions, I was assuming that being put in critical care was a good proxy for serious disease, but it's obviously not perfect - <USER2> who die quickly before reaching critical care obviously aren't counted, for instance. I think this is probably not a big issue for the UK, but reports are that quite substantial numbers of people in New York City died of COVID-19 without this being recognized by the health care system. Since we don't know (from this study) what the BMI was for these people it's hard to draw justified conclusions.

It's frustrating that they don't break down the BMI<30 category further, since there's also reason to believe that low BMI could be a risk factor.</comment>


The Peter Principle - <AUTHOR> https://en.wikipedia.org/wiki/Peter_principle <comment><USER2> Traditionally, the way to avoid Peter's Corollary has been to operate a society with one or multiple glass ceilings, ensuring that in principle[1] the middle ranks of an organisation wind up filled by experienced competent people who pose no threat of advancement.

"every Bertie his Jeeves"

[1] others have other theories: [https://www.youtube.com/watch?v=5mVF6GZ8v1A](https://www.youtube.com/watch?v=5mVF6GZ8v1A) (not to mention the alimentary habits of the Morlocks)</comment>


Google grants patent priveleges to the Go language - <AUTHOR> http://groups.google.com/group/golang-nuts/browse_thread/thread/8f881ceab22cd1b7

<comment><USER2> Not to be too nit-picky, but "priveleges" should be spelled "privileges."</comment>


Ask HN: Is Googlebot signing up for accounts on stackoverflow? - <AUTHOR> Today I googled a random programming question, and this was the result in google:
http://i.imgur.com/5iRwd1q.png
Note the line "Please click the link in the confirmation email to activate your subscription."
Why would googlebot ever scrape this text, unless it signed up for an account on stackoverflow?
The page in question:
http://askubuntu.com/questions/562417/how-do-you-update-npm-to-the-latest-version <comment><USER2> Strangely enough, if I Google "install latest version of npm", I get the same link as your screenshot, but the text is as follows:

"8 Answers 8. You can update nodejs by using npm itself, a PPA, or manually. Or just tell it to install the latest stable version. Both may take a while.17 Dec 2014 14.04 - How do you update npm to the latest version? - Ask Ubuntu askubuntu.com/questions/562417/how-do-you-update-npm-to-the-latest-version"

Does that mean that Google have activated the subscription?

</comment><comment><USER3> It could be possible that they do that, or that SO has granted more permission to the google bot and that string is there by mistake. Good find!

</comment><comment><USER4> I changed my useragent to Googlebot and Googlebot smartphone and none of them display the link for activating the subscription. Which means that SO had not granted more permissions to Google Bot and possibly Google is registering? Is this even possible?

</comment><comment><USER5> Maybe this is an error on Stackoverflow's end, (i.e. serving "Please click the link in the confirmation email to activate your subscription." text to googlebot) and then it went into google index.

</comment><comment><USER6> I'm not sure what you are trying to explain here.

<comment><AUTHOR> This is new behavior from google. Nobody is aware of googlebot _creating accounts_ and/or logging into websites in order to scrape them.

If this is a new policy, then google set a precedent. Now anybody scraping a website post-login can claim "google does it too," which is already an accepted excuse in defense of scraping in general.</comment></comment>


Ask HN: What do hackers do with stolen passwords? - <AUTHOR>

So you get your passwords stollen with a keylogger or some other malware.  What does a hacker do with stolen passwords?  Whats the end game?  Where is the financial motive for the hacker? <comment><USER2> There is a good chance that the person whose password is stolen uses that password on other sites. I guarantee you that if you steal enough usernames and passwords, you'll find a lot of people who use the same credentials for their email, bank, PayPal, etc. Actually, they just need your email, and from there they can reset your other passwords and click the confirm link once it goes to your email.

The financial incentives can vary...they can make fraudulent purchases, transfer money, steal domain names, hack sites, you name it.

EDIT: For a real-life example, when I worked at Internet Brands (makers of vBulletin), a hacker managed to obtain administrator passwords on sites we owned running vBulletin. He then used that administrator's account to install a plugin that gave him access to the whole user database. He then used that database to log into other sites we owned (it is possible to google a vBulletin username to see what other sites they are members of). Once he had admin access on a dozen or so sites, he added dupedb.com links to all of them.

<comment><AUTHOR> So the end game would be to transfer money out of bank accounts and paypal? Is it really that easy to do. Seems like it would leave one hell of a trail.

Whats the end game in stealing domain names and hacking sites. There has got to be a financial motivator somewhere in the chain.

Thanks for the info.

<comment><USER2> _Whats the end game in stealing domain names and hacking sites. There has got to be a financial motivator somewhere in the chain._

In the case of the vBulletin hacks, the dozen or so sites hacked were all PR4 and above. The guess the idea there is that Google crawls these sites regularly, and it would find hundreds of inlinks to the hacker's site, giving him a boost in the rankings.

As far as PayPal and banks go, you're right, it would leave quite a trail if the hacker started sending money to his accounts from yours. Instead, the hacker might log into your PayPal account to get additional info, such as the billing address for each of your credit cards (easy to find under Profile>Credit Cards). He can log into your bank website to find the full credit card number or account numbers and routing numbers along with the billing address, and a nice history of purchases. It would be easy to disguise a fraudulent purchase by making it the same amount as a purchase you regularly make.

</comment></comment></comment><comment><USER3> Keyloggers (often malware, so not intentionally put there by some hacker) download the passwords for your FTP sites, and alter some of the pages on the websites you have FTP data from. They will use your websites to send spam.

<comment><AUTHOR> Why do they send spam from other websites? What is the benefit to sending spam from a hacked site as opposed to one you just register yourself?

<comment><USER2> Every time someone clicks "report spam" in their email program, it gets logged, and with enough flags, and IP gets banned. Sometimes the lifetime of a spam server is just an hour or two (not worth registering). This is why so many Amazon EC2 IPs are banned. They are so easy to spin up and spam, then terminate.

The spammers can use "clean" websites as relays to send spam, and move on to a new one, leaving the site owner to deal with the consequences. Likewise, they can send out spam using hacked individual accounts. The advantage here is that people are more likely to open an email from someone on their contact list, and these emails are often whitelisted.

</comment></comment></comment><comment><USER4> Real hackers don't steal passwords to begin with. There is no end game.</comment>


An update about Redis developments in 2019 - <AUTHOR> http://antirez.com/news/126 <comment><USER4> @antirez: You continue to be an inspiration. Your words are thoughtful, your thinking clear and well-documented, and despite rare lapses your English skills are exceptional.

I use redis. I don't need ACLs, but I certainly don't disagree with your assessment, nor begrudge the time, care and attention to detail which is obvious in your design-work.

<comment><USER5> Thanks so much for the kind words! I'll try hard to find the balance in the future before new, old and stable... Nobody wants a bloated Redis I bet! Since I believe that many members of the Redis community have a similar aesthetic mindset about software.

<comment><USER4> If you had the patience and available location you could publish an address sometime in one of your blog-posts.

I bet you'd receive a hell of a lot of postcards of thanks from around the world. Things like that feel more "real" than emails and words on forums.

<comment><USER6> I'd probably sent him some of our company swag. It's not expensive stuff but I love getting swag from my customers.

@antirez do you have dogs? I've got some branded leashes with your name on em!

<comment><USER5> No dogs just children :-D Thanks for your kind offer!

</comment></comment></comment></comment></comment><comment><USER7> >"I really want Redis to be a set of orthogonal data structures that the user can put together, and not a set of _tools_ that are ready to use."

This is why I fell in love with Redis right from the beginning. Having a data store that gets out of the way and just gives you the structures (a lot like programming data structures) to do what you need feels _awesome_. Picking up the commands and putting them to use feels as natural as reaching for any vector/list/whatever structures I use anyway in my programs.

Thanks so much for everything you're doing antirez.

</comment><comment><USER8> I've said it before and I'll say it again, thanks for Redis antirez. It is an amazing piece of software in the utility it provides and I have used it in my work for so long and just never ever had it fail on me. It does what is written on the box every single time.

Thank you for the thoughtful design, for saying no to so many things and keeping Redis pure and useful and for your awesome stewardship. You are an inspiration in all those things!

</comment><comment><USER9> The ACL implementation: [https://github.com/antirez/redis/blob/unstable/src/acl.c](https://github.com/antirez/redis/blob/unstable/src/acl.c)

<comment><USER10> Love the code and how it is explained! Beautiful.

Not a security expert, but in time_independent_strcmp(), first comment about strlen()s: couldn't the attacker use his own accounts with known passwords to determine the length of some other user's password? Also, given the name of this function I would expect the comparison to be time independent, even if attacker can change both strings' lengths... Or am I missing something? Haven't touched C in a loooong time... :)

<comment><USER5> Hello, the attacker here can control only one string: we want the time taken by the function to be independent from the POV of the string provided by the user. That is, we don't want that the user-controlled string can affect the time the function takes. The other string is the string set inside the database. About information leaks about the length, that would be completely acceptable: anyway the user is very likely to just it the user password length by extracting a random number, there is no real protection there. The problem of this kind of timing attacks is that it can leak the actual user string _content_. Such function should hopefully prevent this problem.

<comment><USER11> The comments in the code make it seem like absolutely no information about the secret is leaked:

> /* Again the time of the following two copies is proportional to > * len(a) > + len(b) so no info is leaked. */ > memcpy(bufa,a,alen); > > memcpy(bufb,b,blen);

If the attacker controls one of the inputs, the execution time reveals something about the length of the other input, right?

Or maybe you just meant that the length is leaked by the contents are not leaked? (I agree that it's generally considered ok for "timing-safe equals" functions to leak the length of the secret. But if you ARE allowed to leak the length, you can simplify the code by just checking the length in the beginning and exiting if they're not equal.)

And if you don't want to leak the length, it's easy: pre-SHA-512 the secret and then only compare hashes instead of comparing the full strings.

</comment></comment></comment></comment><comment><USER12> There seems to be a chronic need in the Redis community to avoid confrontation (or even be bucketed) in the same space as Kafka.

Redis Streams is probably one of the most path-breaking things that Redis is doing - and can completely change what it stands for. That's not a bad thing..but it doesn't even get a title by itself but is rather called "data structures".

Here's a question - do you anticipate competing with Kafka? There are a lot of us that are cheering Redis on for this...but it seems there is internal reluctance.

It's like the long standing "Redis is not memcached" statement - <USER3> WordPress has a "choose Redis or memcached for object caching" option.

<comment><USER13> > It's like the long standing "Redis is not memcached" statement - <USER3> > WordPress has a "choose Redis or memcached for object caching" option.

As was said in the post, _Redis_ isn't memcached, but "a bunch of Redis nodes on the same machine together with a Redis Cluster proxy" _is_ kind of equivalent to memcached.

Redis and memcached are on different _architectural levels_ —one Redis instance represents one shard of a sharded data-store with an IO-concurrency of r=1 w=1, while one memcached instance represents a complete data-store with an IO-concurrency of r=N w=1. To build a caching "virtual appliance" for deploying on some big hardware, a memcached appliance would just be a memcached instance; while a Redis appliance would contain N Redis nodes + 1 Redis Cluster proxy.

It's a bit like comparing, say, UDP with TCP. There are features you can layer on top of UDP to make it act equivalently to TCP (as e.g. QUIC does), but you can also just use UDP by itself. UDP is not designed to be TCP or "compete" with TCP; but UDP happens to be able to be used—when you add extra stuff on top—for the same things TCP can be used for.

Redis, like UDP, is a flexible, low-level "infrastructure component" that can be _customized into_ tools to solve any number of use-cases—but, like UDP, Redis sets out to address only a _very limited_ set of use-cases when used as a standalone "tool" without such customization. I personally think of Redis a lot like an OS distribution—you could make any number of virtual appliances by customizing e.g. Debian with your own extra packages and building the resulting appliance-nodes into your desired architecture; and you can make any number of data-store servers (solving any number of problems) by customizing Redis with your own commands, and then connecting the resulting nodes into your desired architecture.

Redis itself isn't going to compete directly with Kafka. Kafka, like memcached, is on a higher architectural layer than Redis. But there's nothing stopping some downstream developer from building something on that layer, e.g. a "RedisMQ" server customized into a Kafka-killer.

<comment><USER12> > _Redis itself isn 't going to compete directly with Kafka. But there's > nothing stopping some downstream developer from building something_

So this is a philosophical rather than a technical thing. For a hobbyist open source project, I would agree with you there - there's only so much resources that someone can carve out of his day job.

For a company that raised a 60mil venture funding and specifically created a license to prevent IP leakage, this is disappointing.

I want to pay Redis and I don't mind their licensing. But I'm then questioning the philosophy if everything meaningful has to be done by unpaid open-source developers/startups, who might be on tenuous footing to do anything meaningful with it because of the licensing.

<comment><USER13> I think you're confusing Redis with Redis Labs.

Redis is built by antirez as a "hobbyist open source project." It is a small core, and will stay that way. It is an infrastructure component. It is fully open-source.

 _Redis Labs_ is the company that raised 60mil venture funding, and Redis Labs' business model is exactly to create such "distributions" of Redis for their customers. These distributions are not open-source; they are the thing that has the weird license.

Redis Labs does not own or control Redis. antirez owns and controls Redis.

You could create a similar company of your own which is _also_ selling Redis distributions (as a product, as a service, etc.) and make money off of doing so. Since Redis itself—the thing antirez develops—is open-source, nothing stops you from doing this, just like nothing stops Redis Labs from doing this. No "unpaid open-source developers" are needed.

antirez just happens to _work for_ Redis Labs—but not in the sense that they can really tell him what to do. They just want to pay him to ensure he keeps making it, because their business depends on the continued health of the open- source project at its core. (It's about the same situation as Guido van Rossum working for Dropbox, or Yukihiro Matsumoto working for Heroku.)

If you want to talk about the well-being of some project, downstream of Redis, to build a full-featured multipurpose DBMS "tool" with Redis at its core, that is fully open-source... well, that project doesn't exist. Redis Labs is not(!) that project; Redis Labs is a services company. But there's nothing stopping such a project from existing, and there's nothing stopping a foundation springing up around it to take care of it and its developers (like e.g. the Linux Software Foundation, or the PostgreSQL EU+US foundations.)

But that software project, if it existed, would no more be "the Redis project" than [https://openresty.org/en/](https://openresty.org/en/) is "the Nginx project." It'd just be a customized distribution, by separate people.

</comment></comment></comment></comment><comment><USER14> What is the current stance between Redis Streams vs Kafka? Serious question.

Because I prefer not to have both in production.

<comment><USER15> A key difference I observed was that if a Kafka consumer crashes, a rebalance is triggered by kafka after which the remaining consumers seamlessly start consuming the messages from the last committed offset of the failed consumer.

Whereas with Redis streams I had to write code in my application to periodically poll and claim unacked messages pending for more then some threshold time.

</comment></comment><comment><USER16> > I really believe that in the future of Redis "client side caching" will be a > big thing. It's the logical step in every scalable system.

As soon as this happens I will have no use for Redis. I already have better scalable datastores. I often use Redis as a cache for those. If Redis isn't a low-latency, consistent key-value/key-structure store anymore then in my mind it isn't Redis anymore.

</comment><comment><USER17> Interesting that coleifer wrote the comment. I really respect their open source code. It's no BS in their task cue program [https://github.com/coleifer/huey](https://github.com/coleifer/huey)

</comment><comment><USER15> > "I really believe that in the future of Redis "client side caching" will be > a big thing. It's the logical step in every scalable system."

How is this a logical step in the context of micro services ? I feel there is a trade off. If I have to scale a service to N instances where each of them cache the same type of data. Potentially, I'm duplicating that data N times. Which means I need to reserve that much additional RAM per instance. I can avoid this by storing the data centrally in a very fast cache aka Redis. On the other hand even the fastest standalone cache will be much slower then accessing data in process memory.

<comment><USER18> depends on what your application demands. I've worked on applications where response times more than 3ms could cost the company thousands of dollars. And I've worked on applications where 30ms and nobody would even notice...

<comment><USER5> I may add that, 99% of the very big Redis users out there do some form of client side caching... at scale is basically something common for many years now.

</comment></comment></comment><comment><USER19> I have no valuable addition to the discussion, hope its okay but just want to say thank you antirez for your impressive work. You're leading the way for us others to follow

</comment><comment><USER20> Is there any more info on the redis cluster proxy?

<comment><USER5> Yet a lot to define, but it will be multi-threaded, written in C, in a separated repository, but part of the Redis project conceptually. Please ask any info you want (but not everything is defined yet...). In theory such project is not needed because we at this point should have all the clients with a great cluster implementation. Reality is a bit different :-) We need to do something about that and allow developers to talk with the proxy like if it was a single instance (but with the same multi-key operations limitations of Redis Cluster itself, and the lack of SELECT to have multiple DBs), without implementing any cluster protocol.

<comment><USER21> First of all, these two statements seem to be at odds:

> I/O threading is not going to happen in Redis AFAIK, because after much > consideration I think it's a lot of complexity without a good reason

vs.

> the way I want to scale Redis is by improving the support for multiple Redis > instances to be executed in the same host, especially via Redis Cluster

Having to run multiple Redis instances, with a separate "Redis Cluster [proxy]", sounds like "I didn't originally use threads, and while threads are technically the correct solution (because it's the standard way to do things and not all that complicated), I don't feel like rewriting Redis to use threads the way it should have been done from the start; thus I've come up with an alternative hack that is not ideal but makes my life easier". While I have always argued that memcached is not _automatically_ better _solely_ because it is multi-threaded, the idea that an additional point of failure – a technically unnecessary proxy/broker – is somehow a better solution than threads seems like an attempt to save face for mistakes made during early development.

As for the ACL:

> You get a library from the internet, and it looks to work well. Now why on > the earth such library, that you don't know line by line, should be able to > call "FLUSHALL" and flush away your database instantly

What can I say other than "give me a break". Every large codebase has hundreds/thousands of dependencies, and any one of them could slip in a malicious block of code. My analysis: anyone who would be concerned about some library calling FLUSHALL would never even install Redis - a C program that, for all we know, is spamming emails or running a Bitcoin miner while it runs. The fact is, all 3rd party software/dependencies come with risk; if I'm trusting your software not to screw me while I sleep, I think I can trust a basic library not to hijack my Redis server with a FLUSHALL command. Really, this is not even remotely a valid argument. Whatsoever.

Then there's this:

> maybe you just hired a junior developer that is keeping calling "KEYS" on > the Redis instance, while your company Redis policy is "No KEYS command".

Ok, now you're just making shit up. Here's an idea: you don't need ACL to restrict access to KEYS, as that command should have been deprecated and entirely removed in favour of SCAN long ago. You mentioned "I think it's a lot of complexity without a good reason" regarding multi-threaded Redis; yet here you are advocating an entire, complex ACL layer... for what purpose? For some imaginary malicious scenario where my Redis library is going to call FLUSHALL, or a "junior developer" is allowed to call "KEYS __* " – a command that should not even be available in 2019?

I started this comment intending to provide unfiltered – but polite/constructive – feedback. The more I reread your original post, the more frustrated I got at the fact you seem to have lost all common sense. You're trying to justify adding a massive amount of complexity, including a clustering/proxy strategy instead of simple threading, and ACL to save us from imaginary threats. I've previously been in the stage of development that I believe you might be in now – you've run out of truly "good ideas" that would actually benefit your user base, and are now attempting to justify new features as necessary, when the truth is you're just looking to write new code that you personally find to be "new and exciting", rather than iterating on the existing, boring codebase.

I've spent the past 4-5 years advocating that memcached is effectively dead because of Redis. The more you try to make Redis some kind of ACL-secured, clustered database – rather than the lightweight cache store we learned to love – the more likely another project will step in and replace Redis the same way Redis replaced memcached.

</comment></comment></comment><comment><USER22> TL;DR

* Clients will stay simple, RESP3 is backward compatible with RESP2

* ACLs are mostly an anti-fool protection.

* True multi-threading is impossibly hard to implement, but there will be some ad-hoc workarounds.

* Better persistence will be getting better.

* Existing data structures solve everything, so their number won't be extended.

* Read @antirez twitter to stay tuned.

</comment><comment><USER23> What is an ACL?

<comment><USER24> Access Control List

[https://en.wikipedia.org/wiki/Access_control_list](https://en.wikipedia.org/wiki/Access_control_list)

</comment></comment><comment><USER25> This is completely tangential but it might help some people, especially those where English isn't their first language:

 _> she/he (not sure)_

English is really strange around gender, and idiomatic styles have changed over time. It has always been a valid style in English to use "they" to refer to a single person of unknown gender [1]. This feels natural to English speakers when the subject is unknown and could be one of many potential people, as in:

 _When the first guest arrives at the party, give them a balloon._

Here, "them" only refers to a single person, but it's correct.

For the past hundred years or so, it was also common to use "he" to refer to an unknown hypothetical person. You see a lot of textbooks that do this. In theory, this wasn't supposed to come across as being exclusionary, but obviously it is. It's an explicitly gendered pronoun.

The feminist movement rightly drew attention to this problem, and writers experimented with a variety of approaches. Sometimes, at the beginning of a book you'll see an explicit "apology" saying something like "we use 'he' but don't mean it to only apply to males". Some simply switched to using "she" for everything. Others switch between "he" and "she" throughout, randomly or use the longer "he or she".

But, lately, it seems like the style is settling down towards simply using the already established singular they for all of these cases. To a native speaker, it feels a little weird at first, but you quickly get used to it. It's less jarring than "he" or "she" for most readers now.

It has a lot going for it:

* It has more established history than any other form.

* It doesn't force the author to pick an arbitrary meaningless gender.

* It's shorter than the awkward "he or she" (which also still forces you to decide which gender to put _first_ ).

* It doesn't exclude people who prefer _neither_ "he" _nor_ "she" as their pronoun.

So, if you're trying to figure out what pronoun to use when you don't know a specific one that is correct, default to "they".

[1]: [https://en.wikipedia.org/wiki/Singular_they](https://en.wikipedia.org/wiki/Singular_they)

<comment><USER26> Thought I just had: using just "he" is obviously exclusionary because it makes males the default. Likewise, people don't just use "she" either. But given that there are people whose preferred pronouns are "they/them", wouldn't that make "they" equally exclusionary?

<comment><USER25> No, because singular they is a well-established idiom that conveys "unknown gender", it subsumes people who actually prefer "they" as well as people who prefer "he" and "she".

<comment><USER26> "He" used to serve that purpose and subsumed people with all pronoun preferences.

</comment></comment></comment></comment><comment><USER27> Off-topic: this post, like other posts on the author's blog, is written in Markdown. But rendered inside <pre> tags. Seems a little odd considering the site also uses regular Serif fonts for the title / meta.

<comment><USER5> This is done explicitly, for the reader to have the same feeling as opening a Markdown file with vim or Emacs.

<comment><USER28> why not just deliver it as text/plain then? would save a little bit of overhead.

<comment><USER5> The blog has the ability to embed images (ASCII graphs have their limits), moreover I want to provide a readable font, spacing, ...

<comment><USER27> I think you have to decide between providing a good web experience (readable font/spacing/images) and making readers feel like they are in Vim/emacs.

That said, it was still a good read. Thank you for the time and effort you put into Redis.

<comment><USER5> I agree, the current text is not very readable, but imagine it served raw as txt... Btw soon or later I'll change it with something else indeed. Need to find the time, also to convert the old posts.

</comment></comment></comment></comment></comment></comment><comment><USER29> This >> "An important thing to realize is that Redis has not a solid roadmap, over the years I found that opportunistic development is a huge win over having a roadmap. Something is demanded? I see the need? I'm in the mood to code it? It's the right moment because there are no other huge priorities? There are a set of users that are helping the design process, giving hints, ideas, testing stuff? It's the right moment, let's do it."

<comment><USER6> I've handled this "chaos" successfully for years. It starts to break down as the company grows and matures. I used to be able to code something up and explain it to 3 people so they could document it, support it, use it etc. Now with ~30 it's a lot more difficult and I upset folks when I deviate from the roadmap.

</comment></comment><comment><USER30> I used to like Redis, because of its simplicity. But these days it is growing so complex, with so many distributed algorithms being implemented, that I'd much rather use FoundationDB, which at least has the benefit of being extensively tested (in fact it was written test-first) and provides a full distributed database with transactions.

I think there would be value in a "simple Redis": a well-maintained tool for a certain class of problems which do not require a distributed database.

<comment><USER5> Redis is still very simple and most features are orthogonal and completely isolated. Don't trust my words, check yourself, if you count the lines of code with "cloc" in Redis unstable, it is composed of 64890 lines of code. In any other system this amount of code is used, maybe, for the query parser. A single developer can still read the Redis source code in a few days and understand how it works and modify any part alone.

EDIT: I also want to stress on a fact, that at the same time in the newer releases there was a simplification attempt. For instance the Lua scripting side effects problem are going to be removed completely by simplifying how the replication of Lua scripts is performed. Redis 5 is already like that, but the dead code was not yet removed for safety. Redis 6 will completely remove many parts of code. So there is not just the stress on adding, but also on refactoring. ACLs themselves allowed to refactor authentication in separated functions inside acl.c to lower the overall complexity.

<comment><USER31> I'm surely not speaking for a minority when I say I couldn't disagree more with the parent comment.

Redis is the most simple, rock-solid piece of software I have ever had the pleasure of using. I find the comparison with FoundationDB jarring.

Don't let the negative comments like that sway your mindset; I think your choices are spot on and the proof is in the pudding.

<comment><USER32> To be honest, the top level comment in this chain reads a bit like an attempt at a plug for FoundationDB than a legitimate criticism of Redis. You could s/Redis/<literally any other DB>/g</comment></comment></comment></comment>


Cheat Sheets for Developers - <AUTHOR> https://digitalilusion.com/news/8-cheat-sheets-for-developers/ <comment><USER2> I know there's not a lot on there (only 8) but can I say thank you for actually having real cheat sheets? I like cheat sheets, I print them and laminate them and keep them around my desk. There are waaaaay too many sites trying to pawn off full references as a cheat sheet. A good cheat sheet should be 1 (maybe 2) pages long and in a print friendly format.

<comment><AUTHOR> I think the same. It is important that you can consult quickly, both for juniors and seniors. More than a sheet or two, it looks like a small reference manual.

</comment></comment><comment><USER3> The GitHub git cheatsheet link does not work for me, Firefox, Chrome or Chromium. This link would seem to get you to the best version for you [https://github.github.com/training-kit/](https://github.github.com/training- kit/)</comment>


Rails versus Django - <AUTHOR> http://superjared.com/entry/rails-versus-django/ <comment><USER3> Oh christ on a bike, not another one of these. It's not even well-written - <USER2> wish I could downvote this thing just for the giant chunk of writing _completely in italics_.

Here's my problem with all of these articles with the rails _versus_ django battle-to-find-the-one-right-answer approach rather than rails _and_ django different-arrows-in-the-quiver: they always seem to focus way down at too small a level of detail in their comparisons. I understand that being a programmer means being down in the trenches with the framework every day, so the temptation is to assume the important differences are down at that altitude as well and that's where the focus of any comparison should be. But it's totally wrong - they're just _different_ at that level (not necessarily better or worse) and the important difference is at the higher level of what these tools are good at. And for that, you can look to where they came from to see their overall focus:

Rails -> came from building a web _app_ (Basecamp) -> great for building apps, has to be rejiggered a bit for web _sites_

Django -> came from building a web _site_ (several newspaper sites in Lawrence, Kansas) -> great for building sites, has to be rejiggered a bit for web _apps_

The idea for this has been building in my head for a while now and was solidified when I saw the creators of each framework say basically the same thing in a video showdown a few years back:

<http://www.djangoproject.com/snakesandrubies/>

<comment><USER4> The best summary I've heard is:

Rails -> If you know Ruby

Django -> If you know Python

I've been using Django for a while now, but the more we evolve our site, the less of Django we are using. Luckily, the separation of concerns thing really does work and we are able to replace components as we need to.

<comment><USER3> Just in my own experiences at work and with friends, I've found the opposite to be true - people pick up the language to use the framework and haven't met anyone that knew either language before choosing which one to use. Plus both frameworks (especially Rails) have a history of encouraging people to take that route as well.

That also partly explains why I started a Ruby tutorial ages ago and never got around to finishing the series, even though I still get pretty good googlejuice from it:

[http://alabut.com/nonsense/2005/03/ruby-self-tutorial- day-1-...](http://alabut.com/nonsense/2005/03/ruby-self-tutorial- day-1-of-21-getting.html)

<comment><USER5> So true.

</comment></comment></comment></comment><comment><USER6> > Python doesn't allow monkey-patching;

Do I misundetstand what monkey-patching means? Because other than a few types such as int & str and cmodules(I believe) I can patch my monkey with python all I want.

<comment><USER7> Maybe he meant the community frowns on monkey-patching.

</comment></comment><comment><USER8> Oh, OK, I'll bite.

When choosing a framework, I want it to be community supported. This means it's under active development and open to change.

When programming an app against a framework, I want it to simply not break when updating to a point release.

I'm not really interested in a comparison of app implementation details of Rails versus Django. What I'd like to know is the crap I'm going to have to deal with moving from x.2 to x.3. Or y2.3 to y3.0. And how does the plugin/addin/module structure enforce limits and consistency?

And while we're at it, someone come up with more interesting posts than Rails versus Django. Can we get some well written comparisons of, say, a Clojure- framework for apps versus a C# one or a server-side JavaScript one?

</comment><comment><USER9> They are both good. What matters is your background, requirements, and timelines. Checkout my post for a detailed article on what to look for in a framework.

<http://blog.shopfiber.com/?p=90>

</comment><comment><USER10> I am in the Django camp, but I am still interested in using ActiveMerchant. Anyone have ideas what the best way to use both would be?

Perhaps one approach would be running a Ruby instance internally, dedicated to exposing ActiveMerchant functionality.

<comment><USER11> What about compiling ActiveMerchant to Python?

<http://github.com/why/unholy/tree/master>

<comment><USER12> Oh God yes. Please, please, please.

</comment></comment></comment><comment><USER13> Python has a numpy and matplotlib, as well as really easy binding with boost (which gives you ublas etc.) This allows you to write really nice optimized numerical algorithms that plug right in. That's what sold me for Django over Rails.

<comment><USER14> That's neat, but really, do you do heavy matrix and vector computations from your web application?

<comment><USER13> Oh I didn't mean to imply it's a common need. But yes I do - in my case it really makes the difference between it being feasible and not-feasible.

<comment><USER14> Then I'm very curious what your web application is.

</comment></comment></comment></comment><comment><USER15> The world of Web development is oh so much larger if you just look around a bit.

</comment><comment><USER16> I haven't used Django. Rails is both great and seriously flawed. Comparisons are generally fatally biased but they still get people thinking.

The transition of Rails to Merb shows that things are still in play. The reason that even the short-sighted, flawed comparisons are worthwhile is because we have so far to go towards creating a web framework that really helps or, for that matter, a language that really helps.

However difficult the discussion here is, it is necessary.</comment>


Yahoo sends CEO packing without severance package - <AUTHOR> http://news.yahoo.com/yahoo-sends-ceo-packing-without-severance-package-220346310--finance.html

<comment><USER2> This whole thing is turning into a mess. I had some dim hope for Yahoo to reemerge from its recent decade of failure, but I don't think it's possible now.

<comment><AUTHOR> Don't say that. I have some stock!</comment></comment>


Microsoft Names Scott Guthrie as Permanent Enterprise Chief - <AUTHOR> http://recode.net/2014/03/31/microsoft-names-scott-guthrie-as-permanent-enterprise-chief-spencer-to-head-xbox/ <comment><USER2> For those of you who don't know, Scott is really the driving force behind Microsoft's embrace of open source. The opening of ASP.NET, the .NET Framework and countless other techs would not have happened without his push.

On top of all that, he is a coder at heart and still deeply in touch with the community. You can email him directly and usually get a response within hours which is astonishing given his role and responsibilities.

This is a win for coders everywhere, regardless of your position on Microsoft and how you feel about them in general - ScottGu is one of the great guys pushing technology forward and has a serious increase in firepower every time he moves up the ladder at Microsoft. This position is tantamount to 'head of all things developer' at Microsoft.

<comment><USER3> what? is .NET open source ? if it's open source is it a free software ?

<comment><USER4> .net is "Source Available" perhaps, Microsoft makes the source available so that you can step into their code when debugging. They make it extremely easy to point VS at their symbol servers(and cache locally for performance) so you always get the exact right source you need while debugging.

If you prefer to browse the source [http://referencesource.microsoft.com/](http://referencesource.microsoft.com/) has it all including the license. It appears to be a non free license as it is for reference use only.

<comment><USER5> >They make it extremely easy to point VS at their symbol servers(and cache locally for performance) so you always get the exact right source you need while debugging.

Is this something that happens automatically? Do you have any more information how to set this up?

<comment><USER6> On [http://referencesource.microsoft.com](http://referencesource.microsoft.com) in bold "How to configure Visual Studio for debugging .NET framework" which links to [http://referencesource.microsoft.com/setup.html](http://referencesource.microsoft.com/setup.html)

</comment></comment></comment></comment></comment><comment><USER7> +1. he's been extremely supportive of our Python & node.js efforts in visual studio. a while back i gave him a demo of PTVS and he strongly encouraged & supported us in putting Python on Azure. it was the renaissance of Python at microsoft in a way.

[http://pytools.codeplex.com](http://pytools.codeplex.com)

[http://nodejstools.codeplex.com](http://nodejstools.codeplex.com)

[https://github.com/WindowsAzure/azure-sdk-for- python](https://github.com/WindowsAzure/azure-sdk-for-python)

</comment><comment><USER8> That is great new. Good for him. I don't do much work with MS anymore but in the past I always followed Scott's blog. I am excited to see Microsoft moving in the right direction. Hell, I'm glad to see Microsoft moving in any direction. They have been stale and dormant for too long.

<comment><USER9> I own one PC for media (win7). Wife, kids and I use mac laptops. Wife has iPhone and I use a Galaxy Note 3.

I say that to say this; I am no luddite. I've been shopping for a Win8.1 tablet to replace the Google I/O Samsung tablet and perhaps maybe my mbp. Win8.1 tablets are compelling due to the full blown desktop environment. However, the MS dev ecosystem is a bit daunting as the lifecycle or shelf life of their tech is never really known (Silverlight comes to mind here).

I work as a Firefighter (day job) and our municipality are solidly MS integrated. This doesn't look it will change in the short to near term as city IT is steadfast MS. You can byod to work at the station...however, we have two laptops on every engine and ladder apparatus. The tools we use for EMS calls are, quite frankly, complete shit. Web apps seem like a logical solution until you see how they are used in the field... latency, network i/o and the choice for browsers are limited among many/varied issues (hipaa, etc).

All that to say, I believe in Scott Guthrie. I follow him on Twitter and he seems like a logical and candid MS employee from what I've read on his blog over the years. The changes that I've seen in MS recently give me a bit of confidence to test the native development side and perhaps fix our shit software.

<comment><USER10> >However, the MS dev ecosystem is a bit daunting as the lifecycle or shelf life of their tech is never really known (Silverlight comes to mind here)

Although silverlight is not actively being developed anymore it will be supported for a considerable period of time [1]. If you have invested time to develop/learn Silverlight applications, your time was not wasted. The underlying technology (XAML) is also used for desktop (WPF), metro (windows store app) and windows phone 8 applications.

Disclaimer: My first language is not english.

1\. [http://support.microsoft.com/lifecycle/default.aspx?LN=en- us...](http://support.microsoft.com/lifecycle/default.aspx?LN=en- us&x=8&y=11&c2=12905)

<comment><USER11> You'll have to rip WPF from my cold dead hands. Silver light and WinRT are just poor imitations that look similar but are missing way too many features that I use dally.

<comment><USER12> Totally agree WPF is awesome. And WinRT/Silverlight don't hold a candle to it. Only thing is WPF performance and verboseness could be better.

<comment><USER11> I use WPF at a low level (no framework components beyond Canvas) in pure C# (no icky XAML); which is probably why WinRT/Silverlight are so unappealing. WPF works well for me but eventually I'll have move onto Direct2D and DirectWrite I guess, but I'll have to use a C# wrapper.

</comment></comment></comment></comment></comment></comment><comment><USER13> "ScottGu" is always on the forefront of keeping MS relevant and making sure they push forward. We need more like him.

</comment><comment><USER14> This seems like a continuation of promoting people who are very in touch with programming, and what needs to be done internally to make things happen at Microsoft. Good first promotion by the new CEO!

</comment><comment><USER15> "Permanent Enterprise Chief" what does it mean? tenure?

<comment><USER16> From the article:

> Microsoft on Monday named Scott Guthrie as the permanent head for > Microsoft's enterprise group, a position he has held in an acting capacity.

> The position became vacant after its previous occupant — Satya Nadella — was > tapped as CEO.

I.e. he held that position temporarily after Nadella moved on and now has it permanently.

<comment><USER15> My question was about the position "what does it mean if someone is ..." not who has it.

<comment><USER16> It means that until now he was just _temporary_ head of that group because there wasn't yet a successor. Now he was named that successor. The »permanent« is not part of the title; it's just an attribute.

</comment></comment></comment></comment><comment><USER17> Scott Guthrie...hmmm. This seems significant.</comment>


Ask HN: How do you use Twitter? - <AUTHOR>

Do you
a) read all of your timeline tweets (i.e. scroll back for tweets you missed overnight)
b) don't care what you missed and start reading from present time on? <comment><USER2> I typically scroll back to catch up with overnight tweets unless I have missed a few days worth either due to travel or busy work schedule. I don't follow just to reciprocate and am very ruthless unfollow people who are noisemakers.

<comment><USER3> Pretty much sums up what I do.

</comment></comment><comment><USER4> c) I don't.

The service had a value to me when there was a focus on interaction, but as it transitioned to a news feed/advertisement service it lost any and all use to me.

For news, there are enough sites that all spout off the same reviews and "exclusives". If there is truly breaking news that I need to be made aware of, there are a multitude of channels I can get the information from and all of them will convey the information better than a 140 character tweet could.

<comment><USER5> d) Never used Twitter

As soon as I realized that _sometimes_ there is news worthy stuff posted there, there will _always_ be reporters crawling through the noise to find those and put the content on their respective outlets. What's the point of me subscribing to boat loads of literal shit ("at toilet, pls rt") to find a pearl now and then, when I can use traditional media to get to the pearls immediately? Sure, I might not get the pearls instantly, but I think that sacrifice is totally worth it when I occasionally read through some public Twitter feed.

<comment><USER4> The larger issue is that Twitter has pushed news services to focus on being first over being correct. It seems like reporters are falling over themselves to be the first to break a story, journalistic integrity be damned.

</comment></comment></comment><comment><USER6> I follow 30,000 accounts on Twitter. There is no way that anything relevant/interesting shows up on my "feed". I always use the "@Connect" filter so I do not miss any Tweets directed at me. I search on key words or hashtags to follow interesting discussions and get news. I keep a separate tab open to @glenngreenwald since everything he Tweets is interesting.

<comment><USER7> >I follow 30,000 accounts on Twitter

oh God why?

<comment><USER6> I use Twitter as a broadcast medium. People follow me for news and very short form analysis. 80% of the hits to my blog and column come from Twitter. Of course I have a lot of followers and it is rude not to follow back.

<comment><USER8> Rude not to follow back ? Is it rude to be honest ?

<comment><USER6> OK, set aside the judgement on rudeness for now. Twitter limits the number of people you can follow with daily limits and rate limits and a hard stop at 2,000. In order to follow more than 2,000 you need first to be followed by around 1,900 people. There are many people who would like to generate a large following. After all, the most influential/interesting people (and celebrities) are followed by millions. Therefore many people unfollow non- followers so they can move on to follow someone who does follow back. Think of it as a karma system that has real world relevance because the number of followers you have is public and often your Twitter handle is associated with your real identity. So, if you do not follow everyone who follows you will lose folowers. Unless you are Justin Bieber of course.

The rude part is that someone took the microsecond required to follow you and now they have to use a tool to find their unfollowers (you), unfollow you, and follow someone else.

<comment><USER8> Who you follow is a reading list for people who share your interests. Polluting it with people whom you follow just as a hat tip is rude. Also, following uninteresting people makes your stream unusable. In my book, keeping a high signal to noise ratio is the epitome of politeness. I guess that we don't use Twitter for the same reasons...

</comment></comment></comment></comment></comment></comment><comment><USER9> I'm surprised this isn't a poll.

Anyway, my answer is "a", I use a client, Tweetbot, that syncs my read position across all my devices. When I wake up in the morning it shows me the last tweets I read the previous night. I then read them chronologically until I'm caught up.

I detailed that process because I feel that there's an important distinction between what I do and scrolling back for tweets I missed. For me, the process to catch up is the same process I use to read Twitter throughout the day, meaning that I don't have to do anything special when I wake up.

Of course, if I'm away or otherwise have been unable to check Twitter for two or three days, catching up can be a bit difficult and I might just give up and scroll to the top, then scroll down a bit just to see the most recent tweets, but I try to avoid doing that most of the time.

</comment><comment><USER10> I'm trying to use twitter more, but I find keeping up to date with it very difficult! This isn't helped by following several distinct groups of people, and only having mobile client access most of the time. What do people recommend using to keep on top of twitter?

</comment><comment><USER11> Don't care catching up. Rapidly reply to tweets if it makes sense while reading the timeline at that time. Usually tweet via buffer and OS X's Notification. Checks twitter mostly while traveling, waiting before a meeting, etc.

</comment><comment><USER12> Twitter is for me pretty much unusable without active list management.

I only check my followers tweets in moments of complete boredom. But there are lists with people whom I want to keep up with (personal friends, key targets who's attention I would like to get).

Of those lists I ready every tweet and by checking it at least twice a day and try actively to engage with the people (responding, re-tweeting, asking, answering, etc). Otherwise the noise ratio is just to large and it feels pretty much just as social as shouting "hello" at random strangers.

</comment><comment><USER13> I use desktop Twitter and follow a handful each of professional designers, UX/UI devs, artists, DJs/producers, Android blogs, tech blogs, kaomoji artists, and @HNTweets.

Most don't flood, spam or waste my time. Too much signal to noise, no matter how popular you are, I have to unfollow.

I keep the feed open and look over every few minutes. I catch up on mornings if I'm bored.

</comment><comment><USER14> I barely use Twitter, but have a similar dilemma with RSS.

I use Feedly, which allows me to mark some sources as "must read," so I can read every single item. I then also add a few hundred sites where I just glance at the most recent.

It balances my "keep up on everything from x source" and the "have a steady stream of interesting to fill time" needs pretty well.

</comment><comment><USER15> Typically I'll scroll back to read all tweets since the last time I checked, but I will rarely go back more than 8 or 10 hours.

</comment><comment><USER16> I only read Twitter in real time. It's like a pseudo-IRC chatroom for me. When I'm watching sports, I can fire it up and see real-time reactions (from the various sports people and writers that I follow) and have everyone go "WOW LOOK AT THAT SHOT" at the same time. Makes it almost as nice as having a living room full of friends.

</comment><comment><USER17> I don't think I browse twitter well. I alternate between your two choices, depending on how long since I last checked twitter.

I would like something like 'circles for twitter' so that I could check close friends and family tweets quickly, then kill time with lower priority/higher volume users if I want to.

<comment><USER18> Isn't that what lists are for? That's certainly my primary usecase for them.

</comment></comment><comment><USER19> Whenever I start a new project I snag the Twitter name for it and link it up to automatically tweet when stuff is posted to the website so I can at least show up. Same with Facebook. I don't think I'd ever use is it as a communication tool, though I might consider it for news if RSS completely died or something.

</comment><comment><USER20> Huh! Cool question. I do both. If I have time to kill (say, a train ride), I go back and read from where I left off. If I know I just need to pass a few minutes (say, waiting in line at the store), I'll just pop in and see the latest. Sometimes I go back and read what specific friends wrote throughout the day.

</comment><comment><USER18> I originally did a), but it became impractical one I was following around 300 people. Now I just read the last 10 or 15 minute's worth. I also, however, have a list of people I am reasonably close to whose tweets I try to read to a reasonable level of completeness.

</comment><comment><USER21> I use a ton of twitter lists! I'm probably the only one that does this. If I get REALLY bored, I go through the actual feed. When I check the list, I check the entire timeline. If I check the feed itself, i don't care.

</comment><comment><USER3> I have also been trying to curate lists and I use tweetbot to easily switch between them. I find it is a great way to catch up on one community segment or another.

I wish twitter made list building easier.

</comment><comment><USER22> b) I will check it twice or so per day. This is on my personal account. I will retweet or post to it a few times per day.

I like twitter, but I don't love it. I would use twitter often when third party clients were popping up.

I was using app.net for a while, but my friends never took to it. (this is within the first months of its launch) I paid for it, and liked it, but it lacked the network effect.

</comment><comment><USER23> B, I'll take one hour a day to go through the timeline on my phone and then the discovery tab.

</comment><comment><USER24> b)

\+ c) I search for specific keywords when investigating product ideas and pain points

</comment><comment><USER25> b - information saturation is huge when you follow 100+ people in the same topic

</comment><comment><USER26> b.

But about six months ago, I stopped posting and now I rarely visit. It wasn't a conscious decision. I just got bored with it and started tapering off usage.

</comment><comment><USER27> I used to do A before I lost interest in twitter.

</comment><comment><USER28> What are you building?

</comment><comment><USER29> connect it to my wordpress blog and it auto updates.

</comment><comment><USER30> I use it purely to Tweet and to network...either to respond to people or to just tweet what I've read. I almost never read my timeline as I follow just about anyone who follows me, and anyone who is either in New York, a journalist, or a programmer, though I don't follow too many celebrities.

I don't understand people who are put off by the noise. Just don't read your timeline. Also, it's not much work to manage...whenever I read an interesting article, I just tweet the headline and link...Literally a 10 second action that sometimes can catch a lot of attention and help you find other like- minded people,

<comment><USER31> If nobody reads it, what's the point?

<comment><USER30> People may not read the Tweet _then_ , but people who look you up later have a good sense of the kind of things you like to read and think about. In a way, it's an even better reflection than if you had kept a blog, because with a blog, your main intent is letting your thoughts be known and read. For me, a Tweet is an effortless snapshot to what I just read.

</comment></comment></comment><comment><USER32> Newsfeed.</comment>