Cloudflare 22.214.171.124 iOS app - <AUTHOR> https://itunes.apple.com/us/app/1-1-1-1-faster-internet/id1423538627?mt=8 <comment> EZ-E This app works by connecting to a VPN. From experience, user experience on these kind of apps using a VPN is pretty poor (for example, ad blockers)

I believe keeping VPN connected drains the battery because some of the device's chips cannot "sleep"

A VPN-based app also disconnects when going from Wi-FI to cellular.

Worse, when going from cellular to WiFi (ie: going back home) with a VPN on, the iPhone just keeps using the mobile network until the VPN is disconnected

These apps usually try to auto-connect to VPN but when your connection is spotty, it becomes a very annoying, you have to kill the app, disconnect the vpn manually etc

As user you're left manually putting the VPN on/off constantly if you're on the move

It's definitively not a "set and forget thing". I wish Apple could give a way for ad-blockers and this kind of apps to function normally without using a VPN as a crutch

<comment><USER2> I've been using openvpn on iOS for about a year, and this 220.127.116.11 app for a day now, and I can guarantee that most of the connectivity issues described are not true. [edit: for me, of course. sorry, didn't mean to discredit parent comment like that. just wanted to add my perspective.]

\- it automatically switches networks, both to and from WiFi

\- it does not disconnect when switching

\- the 126.96.36.199 app does not make anything more spotty or unreliable; it's just DNS. Openvpn yes, but this app clearly not.

As for the battery issue: could very well be true, I have no idea how to test it.

The difference between this app and an actual VPN are clear from using it.

<comment><USER3> 'the 188.8.131.52 app does not make anything more spotty or unreliable; it's just DNS. Openvpn yes, but this app clearly not.'

Not entirely true, in my experience it really fucks with your ability to connect to public hotspots (ex. airports, airplanes, trains, coffee shops) which took me a while to realize

<comment><USER4> Well this is normal if those network rely on their special DNS servers to connect you.

It's not cloudflare you should blame here, but those providers

<comment><USER5> Is blame really relevant?

<comment><USER4> I think it is, as they don't follow any standard if they return wrong DNS answers, and they might mess with user's systems

</comment></comment></comment></comment></comment></comment><comment><AUTHOR> Also on the Google Play store: [https://play.google.com/store/apps/details?id=com.cloudflare...](https://play.google.com/store/apps/details?id=com.cloudflare.onedotonedotonedotone)

<comment><USER6> Btw, you don't need the App if you the 1% of Android - Pie introduced a system setting for this under Private DNS.

</comment></comment><comment><USER7> It's cute that the time in the screenshots is 11:11.

<comment><USER8> I get the joke, but I wonder if some folks will believe it's for a different reason: [https://en.wikipedia.org/wiki/11:11_(numerology)](https://en.wikipedia.org/wiki/11:11_\(numerology\))

</comment></comment><comment><USER9> On IOS there's also DNSCloak[0], which goes even further and has the option to choose for ad-filtering (eg, via PiHole) in combination with no-logging and using 188.8.131.52 as DNS.

[0] [https://itunes.apple.com/us/app/dnscloak-dnscrypt-doh- client...](https://itunes.apple.com/us/app/dnscloak-dnscrypt-doh- client/id1330471557)

<comment><AUTHOR> Does it encrypt DNS queries like the 184.108.40.206 app though?

<comment><USER10> The URL includes 'doh', which means 'dns over https'. That is the encryption layer which 126.96.36.199 uses.

<comment><USER11> Cloudflare also has DNS over TLS that you can enable in the Settings, which is probably what everyone should be using anyway.

<comment><USER12> What drives that suggestion?

I prefer DNS over HTTPS as some networks intercept DNS traffic, fail to parse the TLS-wrapped DNS payloads, and fail. DoH exists because DoTLS is prone to more interference.

</comment></comment></comment></comment></comment><comment><USER13> ISP DNS servers will always be closer, eg have less latency then third party DNS servers. And after one query, the result will be stored locally, eg no DNS servers will be used for following lookups. The thing with expensive DNS solutions is they only speed up the very first lookup, which might be cached on your ISP anyway. DNS is already a distributed system, which is much larger then any single private entity. Some third party DNS services might also sacrifice resiliency for performance, they will for example not try secondary DNS if primary is down. The reason why private organizations want you to use their DNS service is because they want to know every site you visit, then sell that information.

<comment><USER14> Cloudflare is on record saying they will not sell the information. You can trust that or not but your ISP is almost certainly selling it if it is one of the major US ISP.

Verizon owns Oath, Att owns App Nexus, Comcast has a whole suite of adtech companies & owns gigantic publishers. Time Warner literally started out in the sell side of advertising.

<comment><USER13> I think ISP selling user data is outrageous and should be illegal. Thankfully where I live (EU) I got 20 ISP's to choose from, allowing me to vote with my wallet.

<comment><USER14> I don't know much about the ISP market in the EU but Telenor (a Norwegian ISP) owns Tapad which is an adtech company most recently named in a big GDPR case. So its not purely a US based problem.

</comment></comment></comment></comment><comment><USER15> If you install this on iOS, you'll see a little 'VPN' icon in the top bar of your phone. Not sure if you can hide that though.

<comment><USER16> Same on Android. It's also implemented as a VPN.

</comment></comment><comment><USER17> For what it's worth I think this is a beautifully designed app. The usability and user experience is great. Yes, it does just one simple thing but it does so in a smooth and elegant way.

</comment><comment><USER18> Been using this since the beta on testflight and it has beeen awesome. The only thing it needs IMO is the ability to whitelist WiFi networks not to run it on. I run a PiHole instance at home that does DoH through CF already so I have to remember to turn it off/on all the time to get the ad blocking.

<comment><USER19> On Android I use DNS66 [0], it creates a VPN server in my phone, redirects DNS traffics through it and filters it. This way I get adblock all the time even if I don't have a PiHole. Edit: I see now this app by CloudFlare does the same. However DNS66 let's you choose your own hosts filters and your own DNS servers.

[0] [https://f-droid.org/en/packages/org.jak_linux.dns66/](https://f-droid.org/en/packages/org.jak_linux.dns66/)

<comment><USER18> Yeah iPhone user here so thats probably a no go.

I've considered just creating a VPN back to my gigabit connection at home (running R715 in a homelab rack) but not super keen about the data making a round trip back home first, especially when travelling.

<comment><USER20> R715 might be a bit overkill. I use a RPI with docker. One container with vpn server and one container with pi hole. The pi hole container is not accessible outside the local LAN. The VPN server is configured to use it as a DNS server. I use iOS devices and just use the on demand function for cellular/WiFi VPN (always on). I have an iPhone X and I don't notice a degraded user experience in regards to the battery.

       13:20:52 up 10:57,  1 user,  load average: 0.00, 0.03, 0.00

I just restarted it 11 hours ago, but the load is never high for the two containers. Currently free -m is reporting 114/927 used

<comment><USER18> It's not bare metal, I have Xen Server running with quite a few VMs so PiHole is just a small chunk.

</comment></comment></comment></comment></comment><comment><USER21> I'm not quite so sure why everyone is happy to just blindly trust Cloudflare. These are the people who play games when Adobe Flash "updater" sites which are clearly, obviously and unambiguously hosting Trojans are hosted via their services.

I don't trust them one tiny bit.

<comment><USER22> What do you mean, you don't trust them? Cloudflare provides services to scummy websites, yes. But Cloudflare isn't doing anything to promote these websites, trick users into visiting them, or otherwise aide them in any way other than providing the exact same services they provide to everybody else.

I fully understand disagreeing with Cloudflare's decision to turn a blind eye towards what their customers are doing. I just don't understand why this behavior means you "don't trust them". What do you think Cloudflare is going to do?

<comment><USER21> Something is clearly and obviously illegal. Nobody can say there's ambiguity about the legitimacy of these sites. Yet Cloudflare not only does nothing even when these sites are reported to them, they help make sure the sites continue to run.

Would the problem here be more clear if Cloudflare did nothing when people use them to provide hosting services for child porn sites? Why do you think it's OK for Cloudflare to decide when to ignore the law and when to do something about obviously illegal content?

<comment><USER22> Providing services to malware sites isn't illegal. Providing services to child porn sites is. That's the distinction that Cloudflare draws.

<comment><USER23> > _That 's the distinction that Cloudflare draws_

And we free persons are at liberty to disagree with their lime. Personally, their delineation seems self-serving and marginally scummy. (The service and this app are appreciated and used.)

<comment><USER24> How about torrent sites? Where would you personally draw the line? It has to be drawn somewhere.

</comment></comment></comment></comment></comment></comment><comment><USER25> I can just add 126.96.36.199 as the DNS server in iOS Settings. What's the difference?

<comment><USER26> Configuring with iOS settings sends unencrypted DNS requests to 126.96.36.199 and, as a result, the sites you access can be seen in your internet traffic by people like your Mobile provider (when using mobile internet) or the local cafe (when using their WiFi) or your home ISP (when using your home WiFi).

This app enables your DNS requests to be encrypted. Your requests are still seen by Cloudflare, of course.

<comment><USER27> We try to hold on to as few logs as possible, the goal of the project is improving privacy. You can read the full policy here: [https://developers.cloudflare.com/126.96.36.199/commitment-to- priv...](https://developers.cloudflare.com/220.127.116.11/commitment-to- privacy/privacy-policy/privacy-policy/)

<comment><USER28> Got a follow up question for you... have you guys integrated the IOS into Apple's "Shortcuts" app? This app was created by a 3rd party used to be called Workflow. Apple bought the app 2 years ago or so.

Reason I ask... I have a one-tap shortcut to turn off WIFI and Bluetooth for leaving home. Would be awesome to turn off WIFI / Bluetooth / turn on Cloudfare with a single tap as I head out the door.

I don't need the battery drain from VPN usage while sitting at home, and already have my DNS routed away from my ISP.

<comment><USER27> Thanks for the suggestion, we'll look into integrating. There shouldn't be notable battery drain from the app though, it's not a VPN in the traditional sense.

<comment><USER28> Very cool. Thanks. Yeah, in addition to the battery issue (which sounds a nonissue based on your reply) there is the simply issue of me not remembering to turn on / off.

</comment></comment></comment></comment></comment></comment><comment><USER29> So the app shows you your DNS logs, without any sort of protection.

I imagine this is a trivially simple way of snooping on an unsuspecting target. Let's say you don't trust your spouse. You install this app – showing them the security benefits as advertised by the application, letting them do their own research if necessary – then a day later come back and scroll through their DNS logs looking for cheatonmypartner.com.

<comment><USER30> This app changes nothing. If you've got access to install software on someones handset then there isn't much they can do to prevent you from installing tracking tools - aside having to trust that you wouldn't.

<comment><USER29> All good points in response, I hadn't thought this through.

\- You need to be able to unlock their device without their knowledge to view the DNS logs.

\- Therefore you know their PIN or have your fingerprint loaded (as I do on my partner's phone and vice versa).

\- Therefore you can just install [any other tracking malware] and hide the icon in a folder somewhere. And now you don't have a VPN icon in the toolbar.

But does [any other tracking malware] _actually exist_ for iOS?

<comment><USER31> > But does [any other tracking malware] actually exist for iOS?

Much easier would be to install a router with OpenWRT, set a DNS server (that your DHCP points to) and look at the logs. Or even running Wireshark in your own network should do the trick.

As long the DNS requests are not encrypt, you should got the information you want.

</comment></comment></comment></comment><comment><USER32> I want to believe this is a good thing, but I can't get that whole "we block Tor users" campaign out of my mind.

<comment><USER33> I'm quite the opposite as I appreciate the work towards supporting Tor with easy-to-setup onion fronts as alt-svc's and their work towards limiting their DDOS mitigation for Tor users. These are usually thankless efforts that don't affect their bottom line, or maybe even are a net negative depending upon the level of effort they expend.

</comment></comment><comment><USER34> I still need to understand how that is going to be faster and more private

</comment><comment><USER35> For something with way more features, check out DNSCloak, probably the best DNS app for mobile devices: [https://itunes.apple.com/us/app/dnscloak- dnscrypt-doh-client...](https://itunes.apple.com/us/app/dnscloak-dnscrypt-doh- client/id1330471557?mt=8)

DNSCloak supports Cloudflare (among many other options), and has since day one. It will also let you choose how to steer DNS traffic, what domains to block and when, has a built-in cache to reduce latency, and more.

<comment><USER12> Is there a trustworthy third-party review of DNSCloak?

Short of installing & packet sniffing myself, or breaking apart the package; neither of which I have time to do.

(edit: to be clear, I'd love more options, including one that allows me to use Google's DoH DNS, but I won't blindly instal an app that intercepts my traffic, even if 'just' DNS)

</comment></comment><comment><USER36> It's not a real VPN from what I think of a VPN in that my IP is still from my ISP (checked at whatismyip.com) just the DNS requests are encrypted. Still cool though.

</comment><comment><USER37> It is a bad idea for several reasons.

1\. You won't be able to configure real VPN, iOS allows only one VPN profile. Get a real VPN for native IKEv2 client you have.

2\. It gives CF golden mine of your browsing history. It already has your traffic to many sites in _plaintext_ , emails and passwords included

3\. You trust the third-party app without the source code, probaly with access all your traffic

</comment><comment><USER38> Can someone please help me understand something please? I understand that the main feature of 1.1.1. is privacy from the ISP, however, after the DNS resolution when my device will actually go to the destination, lets say to www.example.com domain - my ISP will know about this too, so what exactly am I hiding here?

<comment><USER39> Encrypted sni will add some plausible deniability

<comment><USER40> IIRC, a prerequisite for the confidentiality of eSNI is in fact secure DNS.

<comment><USER41> You need that your adversary can't snoop your DNS queries (which DoH and other DPRIVE offerings provide) and if the adversary is active you also need DNSSEC with validation so that the adversary can't lie to your DNS provider and say eSNI isn't available.

Cloudflare do both

</comment></comment></comment></comment><comment><USER42> Will they rent/lease/lend/share my data out to partners/non partners/anyone? I understand they clearly state they won't sell the data or use it (themselves) for ad targeting, but their wording doesn't cover rental to others.

<comment><USER43> Maybe I'm a little naive, but to me, "renting" data sounds a lot like just selling data.

<comment><USER42> Right... but it's a known dark pattern for companies to make deceptive-but- technically-true assurances, so I'm not so sure. They do it because it works, as evidenced by what you say. I do tend to trust Cloudflare to do what they say, but they should say it with full clarity.

</comment></comment></comment><comment><USER44> It's super slow for me. I'm on AT&T fiber at home. Which I can't even set my DNS to without taking everything down. But when using the Cloudfare app it appears to work, but it's 10+ seconds to load a page.

<comment><AUTHOR> I've actually had a noticeable increase in speed, not sure why that's happening to you.

<comment><USER44> I'm jealous. It's still incredibly slow for me. I assume it's an AT&T thing since I'm on wifi working from home. I am unable to use 220.127.116.11 with AT&T at all still. So I use Google's 126.96.36.199 until they fix the issue. But it's been 6 months and I doubt it will ever be resolved at this point.

</comment></comment></comment><comment><USER45> Related tangent: does this (or any other similar app or service) provide a straightforward way to bind a static IP address to outbound HTTP requests? Use case: persistent IP address that can be whitelisted by a secured endpoint.

</comment><comment><USER46> so, it's a vpn -- the other vpn app i use is local hosts file adblocker that apple removed from the app store last year for the following reason:

>According to Apple, Future Mind's AdBlock app violates section 4.2 of the App Store Review Guidelines, which dictates that apps must be useful, unique, and "app-like."

‾\\_(ツ)_/‾

<comment><USER47> It's not a VPN. Unless you mean "it's a VPN for your DNS traffic only". Which is an odd distinction.

<comment><USER48> It's implemented on iOS as a VPN, of which you can only have one active at a time.

Some Ad Blockers are implemented as VPNs. This is unfortunate, and they should use the Safari Content Blockers interface instead. Content Blockers cannot intercept or sell your content, since the code is sandboxed and doesn't get network access. NeverAds seems to work well for me.

</comment></comment></comment><comment><USER49> I imagine they don't want anyone to find the app with that name, given how notoriously bad AppStore search is.

</comment><comment><USER50> From their play store description:

"Best of all: No upsells, no in-app purchases, and free for life. Website owners pay us to make your Internet faster so you don't have to."

That sounds totally against net neutrality to me. Unless website owners are not getting preferential speed up.

<comment><USER22> The description does not mean website owners are paying so that users of this app can get a faster connection to them. It just means website owners pay Cloudflare already, Cloudflare's business model is selling services to website owners, and so this dinky app for consumers has no need to make money and therefore is free.

<comment><USER51> Wellll.... paying Cf customers will get lower latency service using this, just as Cloudfront gives better service to AWS users.

That's part of why this app is in CF's interests.

<comment><USER22> This app only redirects DNS, it does not tunnel any other networking. The DNS speedup someone will get by using this app applies to all domains, not just those of websites that pay for Cloudflare.

</comment></comment></comment></comment><comment><USER52> How do I test this is working correctly?

<comment><USER53> Connect your phone to desktop via adhoc network and run Wireshark. You'll see the dns lookups and be able to confirm the tcp traffic afterwards.

This SO post seemed to give a lot of details if you need it

[https://stackoverflow.com/questions/9555403/capturing- mobile...](https://stackoverflow.com/questions/9555403/capturing-mobile-phone- traffic-on-wireshark)

Good luck!

</comment></comment><comment><USER54> 33.6 MB? to change the dns ?

<comment><USER55> Sounds like a React Native app (and feels like one, sadly?).

I could be wrong, though, since the NetworkExtension would have to be written in Swift, so I don't see why they wouldn't just write the rest in Swift and/or ObjC... would be happy to be wrong actually.

</comment></comment><comment><USER56> Works like a charm.

<comment><USER57> Yep. Doesn't get more simple than a toggle switch.

</comment></comment><comment><USER58> Yay! Centralisation

<comment><USER59> it's just a service

you can run your own easily

just connect to roots

</comment></comment><comment><USER60> Trust us, not them?

<comment><USER61> I'd trust one organization that I trust a bit (Cloudflare), rather than random wifi hotspots or my cell & ISP providers which have proven themselves untrustworthy.

</comment></comment><comment><USER62> Don't use that. Don't use 18.104.22.168 or 18.104.22.168 or any other DNS service which have clear conflicts of interest on both sides. Don't ever trust DNS servers you don't have any control over.

<comment><USER63> I don't have control over the root domain name servers, so I guess I shouldn't use DNS?

<comment><USER64> Just run your own root name server! I only use my own self-hosted internet, because it is safe and only contains things that I myself have set up.

 _/ s_

<comment><USER63> Smart!</comment></comment></comment></comment>


Oracle is gunning for AWS with new infrastructure offering - <AUTHOR> http://www.computerworld.com/article/3121212/cloud-computing/oracle-is-gunning-for-aws-with-new-infrastructure-offering.html <comment><USER2> > Ellison showed off a new Oracle Dense Cloud IO bare metal cloud server > offering that will provide developers with 36 CPU cores, 512GB of D-RAM, and > 28.8TB of SSD storage.

AWS isn't merely about the compute. EC2 is just part of a larger ecosystem of infrastructure services that has been built out by amazon over the past 10 years. If Oracle thinks they can beat that, then more power to them but I'm not quite convinced.

I'm happy that there's more competition but Oracle's offering seems more like empty words rather than concrete competition.

Maybe they'll now stop pouring resources into the Google lawsuit and actually pursue building new useful products.

<comment><USER3> > AWS isn't merely about the compute.

Sure, but having a compelling story about compute _and_ having a massive advantage in knowledge of how to sell to the exact kinds of enterprises that haven't already made their big transition to the cloud yet isn't a bad combination to have if you want to establish a nice firm place in cloud. from which you can expand and develop what you need to bite off other parts of the market.

They aren't going to follow the same path as AWS, both because they aren't, as a corporation, oriented toward that path and because the low-hanging fruit you can pick up along that path has already been picked up by AWS.

<comment><USER4> No, I think Oracle is targeting a different market because to them it is a low hanging fruit.

AWS got a lot of startups and tech savvy companies (like Netflix). If I were Oracle I would target existing customers, who generally are not the tech savvy darlings (think Procter & Gamble, health companies, food companies, banks...) who can now tell their board their on-site Oracle licences have been moved to the cloud.

It's a market Oracle is uniquely qualified to pursue because they already have the sales operation and contacts in place. Now whether they are able to execute is why we are eating the popcorn and watching. The inside sales model is the 20th century sales model after all.

<comment><USER5> ...and here is how that is going to play out. We're a large public sector customer. As part of our last ELA renewal (which was an effing effing nightmare over vmware licensing) we got this crapload of Oracle cloud products that we didn't really want or need, database cloud, process cloud, integration cloud, on and on. I think there must have been a mandate from Mark Hurd to the effect that "There will be cloud products on EVERY deal." So now our rep is trying to get us to do POC's to move apps onto the cloud stuff. I bet other customers can tell similar stories. And so Oracle can show growth in their cloud business...

<comment><USER6> In regards to VMware licensing, allow me to expound upon a situation faced by a recent customer.

Oracle allows licensing on VMware on a hypervisor level. When VMware allowed you to vMotion between hosts in a vSphere HA cluster, Oracle would require that you license all the hosts in the cluster because the Oracle VMs might land on any of those hosts in a failover situation. When cross-cluster vMotion came with 5.1, the customer was told that they must license every host attached to that vCenter instance, forcing the customer to purchase and implement another vCenter strictly for Oracle.

And now, with vSphere 6, comes cross-vCenter vMotion. You can guess where that conversation with Oracle went. Customer bought an Oracle Enterprise license, which is presumably what the sales rep had in mind the whole time.

<comment><USER7> You should have had them mention Mars v. Oracle to the salespeople!

[http://houseofbrick.com/mars-vs-oracle/](http://houseofbrick.com/mars-vs- oracle/)

</comment></comment></comment></comment></comment></comment><comment><USER8> A lot of people have made comments on the tech. But there's another issue here: trust. How many people are going to be willing to trust Oracle with their data? They don't exactly have the best reputation, and they don't have the best track record either. And what they did to Solaris just makes it worse.

Also, Larry Ellison has a history of overselling whatever Oracle's doing, so I doubt the product will be as good as he says in any case.

<comment><USER9> That is exactly what I was thinking. Oracle can do pretty decent stuff with tech as far as I have seen, but their actual direction and choices seems to embody the crassly-disgusting money squeeze corporation so much that I really don't want to do business with them. I mean, they put crapware in the consumer JRE installer. How many dollars did they get for that, versus how much negative feeling from that alone? This seems like a corporation who owns their terrible reputation, and says, "who cares? we're still rich."

<comment> saiya-jin there is no attempt to disguise anything - Oracle is your typical stock evil corp, full package. they are pretty damn consistent about it too. they have couple of decent products that they evolve as little as necessary to maintain position, but everything else about them is a big no-no.

<comment><USER8> If it could get into all the industries, Oracle would literally be Mr. Robot's ECorp.

<comment><USER10> Or, you know, Cyberdyne Systems - the creators of SkyNet:

[http://www.businessinsider.com/terminator-genisys- cyberdyne-...](http://www.businessinsider.com/terminator-genisys-cyberdyne- based-on-oracle-2015-7)

<comment><USER11> If Oracle builds Skynet, taking it down will require nothing more than a poorly coded subquery and a wrong join.

<comment><USER12> Please.

The subquery is optional.

<comment><USER11> But it'll make it spectacular.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER13> Oracle is not going to win, not matter what they do. Oracle is built on selling costly products and services versus operating in a low margin environment.

1.) Amazon has a much higher bar for hiring talent, than Oracle does.

2.) Amazon is internally use to being frugal, and so pricing wars are not going to hurt them. Oracle is use to charging a arm and a leg for their products.

3.) Amazon shareholders are already use to the company not being profitable, where as Oracle shareholders are not.

<comment><USER14> > 2.) Amazon is internally use to being frugal, and so pricing wars are not > going to hurt them. Oracle is use to charging a arm and a leg for their > products.

They may be used to being frugal, but that is not at all reflected in AWS pricing, which is ridiculously high across the board.

<comment><USER15> Did you consider AWS have to keep prices high to constrain demand?

<comment><USER16> Interesting observation, though it raises the obvious responses:

1\. What's constraining AWS's growth capacity? Isn't it simply a matter of stamping out AZs and DCs?

2\. Why would Amazone create a pricing structure which encourages new entrants into the field? Contrast local retail in which _defunct firms_ continue to sit on, and extend, real-estate leases, strictly to prevent other companies from growing into the market they've abandoned. See Dominicks / Anderson grocery stores in the Chicago area, in which _seventy-two_ stores are being leased, at a cost of ~$1m/year, each, to prevent competitors from occupying the space:

[http://www.chicagotribune.com/business/ct-vacant- dominicks-s...](http://www.chicagotribune.com/business/ct-vacant-dominicks- stores-0918-biz-20160916-story.html)

(This works in part because rent is only a small part of the operational cost of a grocery store: electric power, labour, maintenance, and of course, groceries, are required if you're actually _utilising_ the space.)

<comment><USER17> > Why would Amazone create a pricing structure which encourages new entrants > into the field?

Because the primary entrant threats were not going to be dissuaded by low price competition. Specifically Microsoft and Google. Both are hyper cash and income rich and under no circumstances did they want to cede the cloud computing universe to Amazon. Fundamentally it's the exact same reason AWS stopped trying to compete so intensely on price cuts quite a while back now.

Put another way, if you're going up against Google, Microsoft, IBM, Oracle - speaking hypothetically it's better to own 1/3 of the market and print significant operating income, than to own 1/2 of the market and barely make money. That operating income is responsible for roughly doubling the value of Amazon's share price (the stock took off like a rocket after it became clear AWS was going to be a cash-cow).

<comment><USER16> Good answer. That's pretty sound strategy, and clarifies the market for me.

</comment></comment></comment></comment></comment></comment><comment><USER18> To be honest, working with Oracle tech would be reason enough for me to quit my job and work elsewhere. We've now witnessed decades of Oracle's business practices and I really wouldn't bother with any of it at this point. Just using their junkware helps them thrive by turning employers into enablers.

<comment><USER11> Solaris is not that bad.

But then, it's Sun's technology, not Oracle's...

</comment></comment><comment><USER19> Knowing what we do about Oracle's licensing practices and how their sales people are basically just loan sharks that will take your kneecaps out if you don't pay their extortion fees, why would you ever want to put your entire operation in their hands? I would assume they'd have no issue cutting you off from your entire infrastructure at the drop of a hat if there was a billing dispute.

<comment><USER20> Lets not act like the other vendors in the database arena are cherubim. MS, IBM, Oracle, NetApp, EMC, all perform audits, and try to squeeze the most out of large enterprises. They see large companies just like casinos; as whales. And part of that is because it's a lot easier to just buy the big packages than try to roll postgres or mysql into a stack built up on other OTS software.

For example, I'd prefer to run Debian instead of RHEL, but since the stack I have to support uses Oracle and Websphere, my hands are tied.

<comment><USER21> _I 'd prefer to run Debian instead of RHEL, but since the stack I have to support uses Oracle_

Here you go: [https://gaiustech.wordpress.com/2013/06/26/howto-install- ora...](https://gaiustech.wordpress.com/2013/06/26/howto-install-oracle-on- debian-wheezy/)

<comment><USER20> And when you call up Oracle for support, they laugh and tell you to GTFO...

<comment><USER21> Have you ever called Oracle support? That would only be saving you time...

</comment></comment></comment></comment></comment><comment><USER22> If you want to beat AWS fight them on data transfer pricing. $90 per TB is the reason many people choose budget clouds or dedicated hardware. Amazon's own pricing reveals how much markup they have when they drop to $50 per TB publicly for high volume and probably $20 per TB for "Contact Us"-level volume.

</comment><comment><USER23> They may be gunning for AWS, azure, etc publicly but I'd bet the main consumers of this service will be existing Oracle ERP (and other business apps) customers. They're already just fine with paying a fortune and having an iaas backing gives Oracle another way to squeeze a bit more out. We already run your erp in Oracle's iaas, you should bring your other applications up as well, and so on.

Evil empire comments aside more cloud infrastructure competition is good for us all.

</comment><comment><USER24> I would not be surprised if the Oracle offerings turn out to be better than EC2

Oracle has been poaching the core EC2 team from Amazon for years now, in Seattle there are farewell parties every week for another person leaving EC2 to work at Oracle

<comment><USER25> Does this include network-layer personnel? Oracle is talking big about their compute, but it's useless without a robust and dynamic network infrastructure. Since storage fabrics are also networks today, a solid infrastructure is doubly-important, yet some data centers and MSPs seem to struggle with this core competency.

* Since they seem to be targeting a hybrid approach, how flexible will they be at building and customizing network tunnels to multiple data centers and branch offices?

* Will they allow you to host webservers there, or will you have to figure out how to network to another data center - and will it run Java, or can you get Apache or Docker? IIS with License Mobility?

* What will they do about human error creating routing loops or erroneous BGP broadcasts, when they expand or perform maintenance?

* How will they mitigate both external DDoS and compromised machine attacks from inside?

Running a multi-data center MSP is no easy feat. It will be interesting to see what solutions are developed by Oracle's offering to the above problems.

<comment><USER26> > Does this include network-layer personnel?

Yes. I used to work at a major networking company in Seattle, and Oracle has recruited many good people from there, and is paying them nose-ruining salaries. I think their cloud may have many problems, but I doubt networking infrastructure will be one of them.

</comment></comment></comment><comment><USER27> Oracle is smoking some dang strong weed if they honestly think they can compete with AWS. AWS does so well because they have a history of opening their platforms up, Oracle does the exact opposite

<comment><USER21> Yes and no. AWS has bet on cloud-means-public-cloud. Azure and Oracle are betting on hybrid: they'll sell you a private cloud that sits in your own DC that can interoperate seamlessly with their public cloud. AWS is a no-brainer if you're a greenfield, but the jury's still out on brownfield.

<comment><USER28> Which also makes it more viable for _government_ contracts.

This is like looking at any other marketshare debate. Amazon/Google may win the majority of users, but MS and Oracle are going to get the ones with deep pockets. They don't need me and my piddly weekend project, or most startups. They'll make a mint off a handful of lucrative government contracts, and contracts with the defense contractors that go Oracle because the gov't has pushed it.

<comment><USER29> Deep pockets like the CIA?

[http://www.theatlantic.com/technology/archive/2014/07/the- de...](http://www.theatlantic.com/technology/archive/2014/07/the-details- about-the-cias-deal-with-amazon/374632/)

The moral of the story is: AWS is all public cloud, but if you're the CIA and give them $600MM... you can have a private cloud too!

</comment></comment></comment></comment><comment><USER30> Has Oracle given any details about their underlying technology, other than what we assume was acquired from Nimbula and others? Do they know how to build a datacenter for IAAS/PASS at the same level as Amazon, Google, MS?

Amazon and other large players have made fundamental innovations in how they construct custom X86 servers, Virtual servers & custom layer 2/3 networks at large scale. They don't just rack together Dell/HP servers & connect them with Cisco switches/routers, then slap a webui on top of it. That would just be putting lipstick on a pig. It doesn't matter if its a large pig with 64 Cpu cores.

</comment><comment><USER31> On one level this is just typical bluster. "Oracle is going to launch a phone, so you might as well get used to it, 2015 was Apple's last profitable year." On another, why is such bluster typical? These people aren't stupid, I assume, so why even try such implausibly optimistic announcements?

Does hubris lead to sales if you have Oracle-like customers?

<comment><USER32> Oracle has one the most aggressive salesforces, they could sell combs to bald men. As long as they convince the non technical CXO teams thats all they need.

<comment><USER21> I attended an Oracle sales conference once (for the canapes, very good) and happened to be in the auditorium for one of the speakers.

There were lasers.

There was dry ice.

Vanessa Mae was playing the electric violin.

A director on stage bellowed we will bring $competitor TO THEIR KNEES!

Everyone was on their feet cheering, I've been to metal gigs that were less intense. Oracle takes sales very, very seriously.

<comment><USER31> Granted. It's just that to my ears, Larry Ellison's announcement scores the wrong check marks:

bluster: check hubris: check realism: nope

I would have expected that someone who takes marketing very, very seriously tries to sound realistic, not overoptimistic or full of that which makes plants grow.

Saying "oracle's database rocks" and asking for a stiff price has a certain touch of realism. I can see how a good salesforce can do that with success. My question is along the lines of: Can a good salesforce use bluster as a main tool to sell something shitty, such as oracle's IaaS offering? How does that sales process work?

<comment><USER33> >Can a good salesforce use bluster as a main tool to sell something shitty, such as oracle's IaaS offering? How does that sales process work?

Well, yes, obviously and consistently. The sales process starts on the golf course/opera/football private box

</comment></comment></comment></comment></comment><comment><AUTHOR> Based on this article alone, it sounds like Oracle is gunning for lift-and- shift of existing solutions into this bare-metal "cloud", positioning themselves more as an MSP than a true cloud provider. Is my read wrong here?

<comment><USER34> thats what I'm thinking, at least for now.

from elsewhere:

> Bare IaaS still has its place for now, and at that point the major factors > are hardware, uptime/reliability, and cost. Lots of companies either can't > utilize SaaS/PaaS offerings from most cloud providers (regulatory > requirements those providers don't comply with, etc...), or just have legacy > products that aren't near EOL yet.

</comment></comment><comment><USER35> So how easy is it to leave when Oracle stop running it as a loss leader?

<comment><USER11> If your tech staff is worth anything, cheap.

</comment></comment><comment><USER36> > IDC program director Al Hilwa wrote in an email that he had little doubt > Oracle would be a major force in the cloud, and is building momentum.

The quote they use doesn't sound like he has "little doubt"

> "In terms of market leadership, I think Oracle will have to produce much > faster growth rates to really get ahead of Amazon or even Microsoft in IaaS, > and analysts will be watching its spend on data-centers to track this," he > said.

</comment><comment><USER37> AWS has many advantages over competitors and one prominent one that stands out the most is Lambda platform. Once customers are tied in to it (very symbiotic code) they would prefer not to move to similar offerings by Oracle or another company unless the cost savings are astronomical enough to motivate otherwise.

(I heavily use Lambda)

</comment><comment><USER38> AWS isn't just about EC2 though.

They offer quite an extraordinary breadth of managed services, whether it be queuing/messaging/Notifications (Kinesis, SQS, SNS), to databases (RDS, Aurora, Redshift), cluster based computing (EMR), object storage (S3), quite fine grained access control (IAM), monitoring (cloudwatch), infrastructure as code (cloudformation)....

The list goes on, I don't see this Oracle offering much more than just being a bit of a cheaper version of EC2

</comment><comment><USER39> How I read this: "we will double down on license audits, if we found you breaching our contract we will pardon you if you move to our jail or face the fines"

</comment><comment><USER40> Oracle has substantially more support staff and support infrastructure in place with existing (mid to large) firms than Amazon, Google, Apple (Microsoft is the exception). In a sense, their "market" and competitor is more like IBM (and Microsoft) and not Amazon, but notably, they offer prices to small firms that are lower than Amazon's at least for services that they, Oracle, do provide.

</comment><comment><USER41> I coincidentally have a meeting with some sales reps and an engineer about their cloud infrastructure this afternoon. Anyone have questions they'd like asked?

I'm trying to figure out if we can get our enterprise customers to trust their private cloud tech and then deploy our products within it.

It's a long shot, but I have trouble saying no to sales people before there's money involved.

</comment><comment><USER42> A vertically integrated public cloud platform where the provider controls both the hardware/firmware/hypervisors/OS/applications/middleware. As far as I know this is first of a kind platform.

What will ultimately determine it's success is adoption and not the technology potential itself. Let's see what happens it'll be interesting to observe the impact of this.

</comment><comment><USER16> Oracle _had_ a cloud compute capacity, as Sun Microsystems, billed as "Sun Cloud" or "Sun Grid". Launched in 2006, it failed to attract interest. The product was discontinued in 2010.

[https://en.m.wikipedia.org/wiki/Sun_Cloud](https://en.m.wikipedia.org/wiki/Sun_Cloud)

</comment><comment><USER43> At least Oracle has the Fortune 500 FUD going for them. But, to think that they can easily beat an entrenched incumbent like AWS is a little much. I mean even Google, with their positive brand, hordes of cash, and guerrilla ad campaign (on this site and others) can barely make a dent.

</comment><comment><USER44> Is Oracle paying more for talent than its competitors, namely Google or AWS? Until the answer is "yes" I'm not going to believe their statements about a better cloud.

Otherwise they're competing on niche or price, and that's not going to stop the gorilla.

<comment><USER45> At least compared to AWS, rumors are that the answer has been "hell yes" for a couple of years now.

</comment></comment><comment><USER46> In addition to the cheap 2 Xeon socket configuration, I would love to see Oracle offering fault-tolerant, mainframe reliability level, infrastructure. Also, "SPARC big iron as a service"...

</comment><comment><USER47> [https://www.oracle.com/openworld/on- demand/index.html](https://www.oracle.com/openworld/on-demand/index.html)

</comment><comment><USER48> The advertising from this company is so false and pricing so outrageous it is essentially fraud. If you want to embarrass your tech people then make them use this 'cloud'.

</comment><comment><USER49> Competition is always good.

PS: It just passed through my mind: some corp. should be able to compete with Google (mainly on search engine and ads), before they become "too powerful".

</comment><comment><USER50> If anyone still needs proof that having a competitive IaaS offering is not just about capex just watch Oracle burn piles of money and totally fuck this up.

</comment><comment><USER51> Why is he not running in this election against Trump? We would have some "make x great again" debates.

</comment><comment><USER52> ...Because I totally want to use cloud infrastructure by the company that supports Java.

</comment><comment><USER27> Oracle is smoking some dang strong weed if they think they can compete with AWS

</comment><comment><USER53> Nice. Your move Amazon. Time to drop your prices :D

</comment><comment><USER54> This must be what the nebula team was a used for.

<comment><USER55> Nimbula, yes. It's so very bad. Oracle's IaaS cloud is a Potemkin village.

<comment><USER54> No, not Nimbula. Nebula:

[http://www.businessinsider.com/oracle-hires-nebula- employees...](http://www.businessinsider.com/oracle-hires-nebula- employees-2015-5)

<comment><USER56> They bought Nimbula back in 2013 as well: [https://en.wikipedia.org/wiki/Nimbula](https://en.wikipedia.org/wiki/Nimbula)

The naming was always confusing because both companies were based within a mile of each other, never mind the product overlap.

</comment></comment></comment></comment><comment><USER57> Oracle built hardware == so Solaris on SPARC?

<comment><USER58> Afaik they are a linux cloud, like all the others.</comment></comment>


Ask HN: Should I learn (E)Lisp before switching to Emacs? - rooam-dev Hello,
I mean switch for good, to get most out of it down the road. I know there are tutorials and guides out there, but after trying a few more advanced I see some "weird syntax" which my understanding is the Lisp part of it. So, perhaps "getting" Lisp 1st would make the transition worth it more.
Thank you in advance. <comment><AUTHOR> I've been using Emacs since 2013. The only critical use I have had for eLisp is in my .emacs (configuration) file. That has always been for 'one liners' based on something I've looked up on the web. Often it's copy and paste with a little tweaking.

My only extensive use of eLisp was a three/four week project I did in eLisp in order to learn it. Sometimes I will use ielm (interactive eLisp mode) REPL but usually I am running an another language's interpreter under Emacs and that's the language at the front of my brain.

While eLisp is a great tool, most of the existing tooling is much more mature and stable than anything I might write. And there are good tutorials on the things I am most likely to write such as a mode for some obscure language (but a language has to be pretty obscure not to already have a mode in Emacs). Good luck.

<comment> rooam-dev Yes, that is what i wanted to be able to make sense of those one liners to avoid frustration of not having any idea why it's not working. Thanks.

<comment><AUTHOR> About all the Lisp you need to know for that is Python/Javascript/C code that looks like:

      myFunc(3, "odd", myOtherFunc(7, 4, 8));

In a Lisp might look like:

      (myFunc 3 'odd (myOtherFunc 7 4 8))

Essentially the parentheses move, the commas go away, and strings that are used for dispatch are passed as symbols ('odd in Lisp instead of "odd"). On the one hand, that's really about it.

On the other hand...there's a lot more to learning Lisp than that. It's just like any other programming language...it takes a non-trivial number of months.

But you can use Emacs without knowing any Lisp at all. And the basic syntax of (func arg1 arg2 ... argN) gets you a long way. If you get the basic idea of quoting, you can probably parse all the code in just about any .emacs file.

The hard part of Lisp is understanding all the implications and possibilities of quoting and applying them to abstract away complexity in a problem domain...your .emacs file won't need to do that because the relevant complexities are already abstracted away by the Emacs system as shipped.

</comment></comment></comment><comment><USER2> Giving the manual a skim and following the built-in Emacs tutorial (C-h t) are probably good ideas, but not much beyond that - you don't _need_ to learn elisp before starting to use Emacs.

You'll probably learn it well enough after you'll start tweaking your configuration file, and the best environment to do that is actually Emacs itself: the scratch buffer will start out in lisp-interaction mode, which means that you can execute elisp snippets with C-j, and being into Emacs also means that the documentation of the various functions and variables is just a C-h f/C-h v away.

<comment> rooam-dev Thanks

</comment></comment><comment><USER3> I don't think you need a whole lot of elisp knowledge to get started. You'll probably pick up a fair bit from writing your own config file, which isn't too hard. Then you can learn as needed from there. I use emacs for org-mode and still barely know elisp although I'm an experienced lisp programmer.

</comment><comment> rooam-dev Thanks for your feedback. I found this short intro that helps to get an idea at least.

[https://learnxinyminutes.com/docs/elisp/](https://learnxinyminutes.com/docs/elisp/)

<comment><AUTHOR> If you're going to learn a Lisp, eLisp is a very good entry point. In part because it's just another Lisp and learning one gets you pretty far with other. More importantly, Emacs provides a context for building tools by applying the language. There's less need to search for meaningful projects and no need to search for libraries that do what you want. Everything for working with Emacs is baked into the environment.

</comment></comment><comment><USER4> I'd encourage you to try the built-in tutorials on the subject, starting with "An Introduction to Programming in Emacs Lisp" (unless you still have to complete the general emacs tutorial, in which case, press C-h t). Imho, being able to effectively navigate the builtin documentation tools (C-h i, C-h k, C-h m, C-h f, ...) is what allows you to ramp up your emacs knowledge the fastest.

<comment> rooam-dev Thank you!

</comment></comment><comment><USER5> Just learn a little bit is enough for you to start using and configuring Emacs.

However, when you want to do more advance configuration (e.g. write your own feature), you will need to learn more about Emacs lisp and Emacs's API.</comment>


Ask HN: A lot of trouble trying to do customer development - <AUTHOR> Hn, I've been having a lot of trouble trying to get individuals in my target market to want to do customer development interviews.<p>Are they imperative in an existing market ? What do you do to get companies to want to give you 15min of their time ? <comment><USER2> What are you trying to learn?

If the market is well defined you can start with a discovery driven sales approach where you sell against the existing solution your prospect is using and keep your eyes and ears open as to why the choose to stick with it or switch to your offer.

<comment><AUTHOR> Well ultimately if they'd want to buy my product but well before that does it make sense to develop something before talking to them?

<comment><USER2> If you are having trouble getting prospects to talk to you how will having a product change that? Unless you are attacking an existing well defined market it makes sense to talk to prospects about what you are developing to make sure you don't leave something important out (or spend too much time adding features no one cares about).

</comment></comment></comment><comment><USER3> Customer and user research is critical. Can you provide more info on your initiative, market, incentives you're offering, and what you've already tried?</comment>


Show HN: ColorMe - <AUTHOR> https://tylergaw.com/articles/introducing-colorme <comment><USER2> a bunch of useful color links I've accumulated over the years:

tools

* [https://dtrejo.com/colorslice/](https://dtrejo.com/colorslice/) \- I made this b/c i wanted multi-color picking and good schemes from images and husl and multiple editable color formats

* [http://speculo.co/](http://speculo.co/) \- preview colors on layouts

* [http://tools.medialab.sciences-po.fr/iwanthue/](http://tools.medialab.sciences-po.fr/iwanthue/) \- colors for data scientists

* [https://color.hailpixel.com/](https://color.hailpixel.com/) \- fun color picker

* [http://tristen.ca/hcl-picker/#/hlc/6/1/20313E/EFEE68](http://tristen.ca/hcl-picker/#/hlc/6/1/20313E/EFEE68) \- hcl picker

formats

* [http://www.hsluv.org/](http://www.hsluv.org/) \- human friendly hsl

a11y

* [https://www.randoma11y.com/#/?_k=nm2tko](https://www.randoma11y.com/#/?_k=nm2tko) \- check color a11y

* [https://snook.ca/technical/colour_contrast/colour.html#fg=33...](https://snook.ca/technical/colour_contrast/colour.html#fg=33FF33,bg=333333) \- contrast checker

<comment><USER3> I would add Color Safe[0] to the list -- for creating accessible palettes. I think it's a project of LinkedIn.

0\. [http://colorsafe.co/](http://colorsafe.co/)

</comment></comment><comment><USER4> It looks neat, but I have a subtle suggestion; why not output CSS HSL colour codes instead of RGB? It's supported in all relevant browsers (IE9+).

HSL has the benefit of explicitly showing the colour's hue, saturation, and lightness — meaningful values compared with RGB's three colour channels, which is something you might want to stimulate with a tool like this.

With HSL a minor change in saturation or lightness can also be done directly from the CSS (or SASS) code by whoever is maintaining the stylesheet.

        # Green.
        hsl(130, 41%, 33%)
        rgb(50, 119, 62)

        # Slightly more vibrant green — note that only the saturation value changes.
        hsl(130, 53%, 33%)
        rgb(39, 130, 55)

<comment><USER5> I did a big survey of site stylesheets a while back and HSL use in practice is super, super low. I'll see if I can dig up that old spreadsheet.

And that's the reason I love your suggestion. With some browser support reassurances to the user (HSL is safe to use!), a neat tool like this outputting HSL could help the HSL adoption rate. HSL is pretty nice to work with, so I'd love to see more of it.

</comment></comment><comment><USER6> Very cool. One minor usability suggestion - it would be fantastic if the adjusters didn't reset when the base color changes.

<comment><USER7> Ah, yes! I had it set up like that in the beginning, but turned it off because I wasn't sure what the expected outcome was. Can flip it back and add a "reset" button for the Adjusters. Thanks for the feedback.

</comment></comment><comment><USER8> A color picker for the base color would be handy

</comment><comment><USER9> I love the design and layout of this app. Very nice!

A killer feature would be add options to calculate complementary, monochromatic, analogous, etc. color harmonies, similar to a color calculator:

[https://www.sessions.edu/color-calculator/](https://www.sessions.edu/color- calculator/)

</comment><comment><USER10> Nice. A color app is a way I like to get used to controllers in MVCs, this takes that in a new direction.

<comment><USER11> You have any examples? I've always thought a todo app was too lacking, but haven't thought of a good slightly tougher example

</comment></comment><comment><USER12> This is awesome. I was looking for something like this not too long ago and surprised I wasn't able to find anything to do this easily. Thanks!

</comment><comment><USER13> Nice job. Adobe Color ([https://color.adobe.com](https://color.adobe.com)) is also a similar tool.

</comment><comment><USER14> Curious if there's a reason Disqus is the main comment app. What about Facebook/other social media? I was thinking of bundling them together perhaps mix results.

Also I like the design/style of the site though I think white text on black isn't a good practice eg. Harder to read due to contrast. That's just my opinion though and not backed by anything, I'm not an expert designer just my opinion.

</comment><comment><USER15> This is great. My only thought is that it is nearly impossible to adjust the sliders on a mobile device.

<comment><USER7> Hey, thanks for the feedback. Thought the same thing. I released an update for them a few minutes ago [https://github.com/tylergaw/colorme/pull/4](https://github.com/tylergaw/colorme/pull/4)

I've been using it on an iPhone 6 and it's better. I still miss and get the horizontal slider from time to time, but feeling better now. What do you think?

</comment></comment><comment><USER16> Well done!</comment>


A Full Break of the Bitstream Encryption of Xilinx 7-Series FPGAs - <AUTHOR> https://www.usenix.org/conference/usenixsecurity20/presentation/ender <comment><USER2> Once I worked at a place which was very interested in protecting the IP inherent in their firmware. They gave me a research assignment to get an idea of how difficult it would be for an attacker to extract it as a binary given unlimited physical access to a sample device.

Since I read and write Chinese, I did some searching on Chinese-language sites and found a company advertising their ability to do just that... for about $10,000 per job. They listed the chips they knew how to crack, but the one my employer was using was not on the list...

I feel that trying to prevent reverse-engineering by adversaries with unlimited physical access is a fool's errand. So this break of Xilinx FPGAs is interesting... But kind of a shoulder shrug.

<comment><USER3> There are quite a few Chinese (and Russian, not surprisingly...) companies who will do "MCU breaks". $10k (USD) is near the high end of the price range; price depends on complexity and newness --- less than $1k for some of the common and older parts. Mikatech is one of the better-known and older ones.

They are great for maintaining legacy equipment where the original company has either discontinued support or disappeared completely.

<comment><USER4> I've often wondered -- and perhaps you don't know the answer, or there is no one typical answer -- but, do these companies in Russia, China, etc., that one pays to break the chip, promise to not re-sell the extracted chip contents? (Or maybe we should just remember the saying "no honor amongst thieves")

I think the last time I looked into a service like this, they required that you send them multiple targets to attack because normally the attack is invasive / destructive, and they might need to "burn through a few" before they succeed. If you have any experience in this area, do you know if that still holds true?

Thanks. Sorry to punish your useful answer with more questions.

<comment><USER3> _but, do these companies in Russia, China, etc., that one pays to break the chip, promise to not re-sell the extracted chip contents?_

I don't know --- I imagine a lot of the time they wouldn't even know what equipment the chip came out of, and/or it's something extremely obscure, so it would be very hard to sell the contents.

 _I think the last time I looked into a service like this, they required that you send them multiple targets to attack because normally the attack is invasive / destructive, and they might need to "burn through a few" before they succeed. If you have any experience in this area, do you know if that still holds true?_

If it's a new MCU they've not done before, they might ask for that --- to find where the protection fuses are. It doesn't have to be the actual one you want, just an example of a protected one along with the code it contains in order to "check their answers". That will cost quite a lot more than known-extractions, however.

</comment></comment></comment></comment><comment><USER5> While this does open up the code (sans descriptive text) to external attacks, I rather feel that once you have a logic analyzer or compromised microcontroller on the logic bus of your secure device you've got the attacker on the wrong side of the airtight hatchway.

I'm personally much more interested in what it means for 'attackers' who wish to use it to open up their own hardware. Perhaps that might not align with the goals of Xilinx or the OEM, but it's great for their customers!

<comment><AUTHOR> Attacker needs physical access to just one device in the whole product line that uses the same encryption key.

After that, all you need is to get the device to update using the bitstream you made. In some cases this could be remote attack.

<comment><USER6> I'm not sure this is true. This attack allows reading the encrypted bitstream, but it doesn't say anything about allowing you to sign modified bitstreams.

<comment><USER7> As the paper explains, there is no "signing" involved (in the sense of a public-key cryptosystem).

Each encrypted bitstream includes an HMAC, but because the HMAC key is part of the encrypted bitstream itself, it basically only acts like a non- cryptographic checksum. An attacker who knows the encryption key can simply choose an arbitrary HMAC key and generate a valid HMAC for arbitrary data.

EDIT: I should clarify that this attack doesn't appear to actually let someone _extract_ the AES encryption key. But they can use an FPGA that has the key programmed as a decryption oracle. And a weakness of CBC mode is that a decryption oracle can be used for encryption as well.

<comment><USER6> Ah interesting, thanks!

</comment></comment></comment></comment></comment><comment><USER8> This isn't bad for "security" or "secure microcontrollers." It is in fact good for security. Designs running on these FPGAs can now be analyzed and inspected for accidental or intentional security issues. Mind you: the security issues are there whether you know about them or not. The function that the FPGA implements can (and should) still be secure - since the security of its algorithms should never rely on the secrecy thereof. (And to protect secrecy of private key material, it comes down to physical security either way.)

What it's bad for is vendors relying on DRM to protect their assets. Which is normally diametrically opposed to user freedom.

<comment><USER9> This encryption is the only way that you can ensure the integrity of the firmware at the chip level so anything relying on that as part of their chain of trust is going to have to redesign their device now. Firmware is loaded from an external eeprom on these devices DRM wasn't the sole use of this feature.

<comment><USER8> The chain of trust could already be attacked by replacing the entire FPGA chip with an unkeyed/open one, and then loading you own malicious bitstream.

Also, encryption never ensures integrity; it ensures confidentiality. Integrity would've come from the accompanying signature scheme, which apparently was badly implemented and broken at the same time.

If anything, the encryption makes it impossible to conduct spot checks on a batch of devices you receive, since it prevents the end user from verifying bitstream integrity. (The keys are device specific AFAIK, so the bitstream is device specific too, and signature public keys aren't known.) To establish trust, you ideally need an unencrypted, verifiable, signed bitstream.

(An encrypted, signed bitstream with the keys available does not protect against manufacturer collusion; they can cooperate in sending you a tampered device. An unencrypted bitstream allows comparing a device you received against other devices around the planet.)

<comment><USER9> On these chips the encryption and integrity checking feature is one and the same you can't turn on one without the other.

Whether or not you use the same key over every device in a product line or a per device key is up to the oem. So you can still verify firmware in the former instance.

Replacing the FPGA chip is a lot harder than re-flashing an eeprom and they would also have to put a lot of effort in to replicating your firmware just to insert their change.

</comment></comment></comment></comment><comment><USER3> I wonder if everyone who works on stuff like this is pro-DRM/anti-freedom, because while I've seen plenty of DRM-breaking papers which paint a very negative view of their findings (this one included), I can't recall seeing a single one which takes the opposite view that this is another step forward for freedom and right-to-repair. Are the researchers really believing that this is a bad thing, or is it because they're afraid of taking that position since others could disapprove and reject their paper?

<comment><USER10> So this will help:

1\. Security researchers, so they can see what malware may be lurking in FPGA bitstreams.

2\. Open source developers working on FPGA bitstream compilers.

3\. People who want to steal proprietary IP cores.

It hurts:

1\. People who chose the part because of the closed bitstream particularly. In part because they made security decisions that the bitstream wasn't open.

2\. Anyone who bought the products based upon the marketed security claims of the product (Hopitals/DoD/etc)

<comment><USER11> Woah, from what I undeddtand, the bitstream is the fpga equivalent of the compiler output? Then selling something as "secure" because nobody can know what code it is running would be security through obscurity no? How would vendors get away with _that_ sort of BS?

To be clear: just talking about the confidentiality requirement here. Authenticity (ie code signing, right?) is obviously something very useful _especially_ in these cases.

<comment><USER12> This is about bitstream _encryption_ , so there is an expectation of confidentiality. The keys needed to decrypt the bitstream are stored in nonvolatile memory on the FPGA itself. Assuming that it is implemented correctly (evidently not in this case), it is impossible to decrypt the bitstream without analyzing the FPGA die itself, using tools that are usually beyond what a casual attacker might have. It probably won't stop a nation- state from figuring out how to read out your FPGA design, but it will probably slow down your competitors.

<comment><USER11> Yes, for IP protection I get why that's interesting. But crucially, it's the vendor's interest. For a hospital or such, the interest is actually opposed to this. They should be looking for secure software that is as open as possible to allow for audit and servicing if needed. So selling DRM as something that somehow makes the _customer_ more secure is BS.

</comment></comment></comment></comment></comment><comment><USER13> Is there any way that the breaking of the Xlinix bitstream encryption opens the door to documenting and reverse engineering that bitstream in the same way that was done with Project IceStorm[0] for the Lattice iCE40 FPGAs?

[0] Project IceStorm - [http://www.clifford.at/icestorm/](http://www.clifford.at/icestorm/)

<comment><USER14> It's such a sad situation. Why can't companies just provide all the necessary hardware info in the datasheet?

<comment><USER15> Vendor lock-in is the primary way in which these companies make money

<comment><USER14> But wouldn't an open specification be a much better value proposition for engineers?

<comment><USER16> Not directly. Much of the value in a modern FPGA lies in the specialized proprietary hardware provided by the manufacturer -- transceivers, memory controllers, clock management, dozens of other things -- and in the IP cores that can either be inferred or generated through wizards.

So knowing the bitstream format by itself is only a small step forward, if your goal is to take full advantage of the hardware and IP available. You'd need to reverse-engineer all of the specialized hardware and IP support as well. Opening the bitstream format would still be very worthwhile, but it's not the game-changer that many believe it would be.

</comment></comment></comment></comment></comment><comment><AUTHOR> >3.5 Wrap-Up: What Went Wrong?

>These two attacks show again that nowadays, cryptographic primitives hold their security assumptions, but their embedding in a real-world protocol is often a pitfall. Two issues lead to the success of our attacks: First, the decrypted data are interpreted by the configuration logic before the HMAC validates them. Generally, a malicious bitstream crafted by the attacker is checked at the end of the bitstream, which would prevent an altered bitstream content from running on the fabric. Nevertheless, the attack runs only inside the configuration logic, where the command execution is not secured by the HMAC. Second, the HMAC key K_HMAC is stored inside the encrypted bitstream. Hence, an attacker who can circumvent the encryption mechanism can read K_HMAC and thus calculate the HMAC tag for a modified bitstream. Further, they can change K_HMAC, as the security of the key depends solely on the confidentiality of the bitstream. The HMAC key is not secured by other means. Therefore, an attacker who can circumvent the encryption mechanism can also bypass the HMAC validation

<comment><USER15> This is another example of what Moxie Marlinspike calls the "cryptographic doom principle". If you do anything, _anything_ with a ciphertext before checking authenticity, doom is inevitable.

<comment><USER17> For others following along: [https://moxie.org/blog/the-cryptographic-doom- principle/](https://moxie.org/blog/the-cryptographic-doom-principle/) (2011)

<comment><USER18> That was really interesting, thanks for that.

</comment></comment></comment></comment><comment><USER19> If I would really care about security, I would not pick SRAM FPGA in the first place. The are nice Flash based FPGAs out there for projects with high security requirements. They don't need configuration devices leaking bitstream all over the place.

On the other hand is somehow sad, that popular 7 series is compromised. Though I never saw a company, that cared about bitstream security. It was best case "nice to have" feature, usually being completely ignored.

<comment><USER20> A lot of flash-based FPGAs are actually an SRAM FPGA with an internal flash die bonded to the configuration pins. The bitstream is harder to get to, but it's still available to a determined attacker.

<comment><USER19> Actel/Microsemi are very real Flash FPGAs while Altera/Intel MAX10 is SRAM FPGA with configuration Flash inside. Very nice and highly integrated chip, comfy development with it.

<comment><USER21> I'd rather start from sand than use Microsemi again...

</comment></comment></comment></comment><comment><USER22> It's not just an issue for big corporations and their proprietary software and DRM, but also has serious implications for the free and open source hardware community, especially the infosec hackers. To begin with: While it's not realistic to make secure hardware (let's say, a OpenPGP/X.509/Bitcoin Wallet security token) that can be 100% independently verified and free from all backdoors, but still, relatively speaking, FPGAs are generally a better and more secure option as a hardware platform than microcontrollers (for example, see the talk [0] by Peter Todd on Bitcoin hardware wallet and pitfalls of general-purpose microcontrolles), because of three advantages:

* It's possible to implement custom security protections at a lower level than accepting whatever is provided by a microcontroller or implementing it in more vulnerable software.

* Many microcontrollers can be copied easily, but FPGAs are often used to run sensitive bitstream that contains proprietary hardware/software, manufacturers generally provide better security protections, such as verification and encryption, against data extraction (read: OpenPGP private key) and manipulation attacks.

* Most "secure" microcontrollers are guarded under heavy NDAs, while they are commercially available (and widely used in DRM systems), but it's essentially useless for the FOSS community. On the other hand, because the extensive use of FPGA in commercial systems, security is NDA-free for many FPGAs. It's often the best (or the only option) that provides the maximum transparency - not everything can be audited, sure, but the other option is using a "secure" blackbox ASIC, which is a total blackbox.

Unfortunately, nothing is foolproof, manufacturers leave secret debug interfaces, cryptographic implementations have vulnerabilities, etc. Hardware security is a hard problem - 100% security and independent verification is impossible, making it harder to attack is the objective, but it's worse than software - once a bug is discovered and published, the cost of an attack immediately becomes 0, and it cannot be patched. We can only hope that the increased independent verification, like the researchers behind this paper, can somewhat reduce these problems systematically.

[0] [https://www.youtube.com/watch?v=r1qBuj_sco4](https://www.youtube.com/watch?v=r1qBuj_sco4)

<comment><USER8> The way to protect secure hardware tokens is not bitstream encryption, it's tamper protection. You store the key material in SRAM that is erased when the device detects any attempt at manipulating.

If your Bitcoin Wallet or whatever token is affected by this, it was IMHO badly designed to begin with, since apparently it was relying on an AES-CBC bitstream encryption scheme. That should've been a red flag even if it wasn't broken.

<comment><USER22> > _The way to protect secure hardware tokens is not bitstream encryption, it > 's tamper protection. You store the key material in SRAM that is erased when > the device detects any attempt at manipulating._

You need both. First, make all external storage (that hold keys, firmware, configurations) unreadable to everything else besides the main processor itself. Also, in the ideal world, implement tamper detection, in most HSMs there are tamper detections, but unfortunately, the world is not ideal, in the FOSS world, I don't see anything that uses tamper detection, developing an open source tamper detection is something has great value to the community, yet, I don't see it happening at anytime soon. Also, the majority of security token/hardware have no tamper detection - SIM cards, bank cards, OpenPGP cards (Yubikeys, Nitrokeys), smartphones, they only depend on encrypting external storage and/or restrict the access of the secret inside a chip to maintain security. In practice, they still have an above-average security level, it clears shows tamper protection is not the only way to protection the hardware, although it's less effective and occasionally something is going to be broken, to be sure.

This specific FPGA bitstream encryption vulnerability may be a non-issue, as pointed out by the critics, relying on external storage is not a good idea to begin with, better to burn everything inside the FPGA. My point is that FPGAs are the only platform to implement FOSS security hardware in the most (relatively) transparent and secure manner, yet, the recent discoveries of FPGAs vulnerabilities indicates they are much less secure than expected, and it's only the tip of an iceberg. If external bitstream encryption has cryptographic vulnerabilities, what comes next? More broken cryptos that allow you to read an internal key?

<comment><USER8> Moving your data inside a device not easily accessible is tamper protection too.

</comment></comment></comment></comment><comment><USER23> I don't know what the best prctices are now, but it used to be best practice to blow the CFG_AES_Only eFUSE when using bitstream protection, which prevents the loading of a bitstream which isn't authenticated, and thus foils this attack. If a manufacturer went to the trouble of encrypting the FPGA but then allowed loading of plaintext bitstreams they probably didn't really understand what they were doing.

<comment><AUTHOR> This attack breaks the encrypted and authenticated bitstream.

I thought that the title "A Full Break of the Bitstream Encryption of Xilinx 7-Series FPGAs" would give some information even for those who don't want to read the article before commenting. :)

<comment><USER23> While I understand that without the proper context (knowing a bit about bitstream protection in the Xilinx 7-Series FPGAs) my comment may seem a bit obscure, I did read the paper.

As the sibling comment mentions, the attack requires programming a plaintext bitstream in order to perform the readout of the WBSTAR register after the automatic reset caused by the HMAC authentication failure. Blowing the CFG_AES_Only eFUSE prevents the loading of that plaintext readout bitstream and the first stage of the attack is thus foiled (preventing the second stage of the attack from taking place as well).

<comment><AUTHOR> That was the first attack. How about the second attack where they show how to encrypt a bitstream?

<comment><USER23> See my reply in the sibling comment thread. Basically, the second attack is not possible without the first succeeding.

</comment></comment></comment></comment></comment><comment><USER24> From the paper:

> On these devices, the bitstream encryption provides authenticity by using an > SHA-256 based HMAC and also provides confidentiality by using CBC-AES-256 > for encryption

> We identified two roots leading to the attacks. First, the decrypted > bitstream data are interpreted by the configuration logic before the HMAC > validates them. Second, the HMAC key is stored inside the encrypted > bitstream

</comment><comment><AUTHOR> This is not small issue. Up to 10% of FPGA's in the market can be affected.

RAID-, SATA-, NIC- controllers, Industrial control systems, mobile base stations, data centers, devices like encrypted USB sticks and HDD's. In some cases it's possible to carry the attack remotely.

<comment><USER25> Only ones who need to keep firmwares secret will be affected.

There are few companies I knew who transitioned from MCUs to FPGAs solely for their obsession of keeping their "IP" from leaking, hoping that FPGA will provide more obscuration than simple encrypted MCU firmware.

<comment><AUTHOR> If the FPGA can be updated, attacker can take over the hardware and reprogram it.

If attacker gets access to the bitstream, the has complete control over the FPGA.

<comment><USER2> But if an attacker is already "inside" your system and is able to access the interface for configuring the FPGA, I think you have already lost...

<comment><USER22> > _But if an attacker is already "inside" your system [...] I think you have > already lost..._

It's not necessarily true. Protecting the system from physical attackers is a legitimate requirement in cryptography.

1\. While all hardware secrets can be broken with physical access, but there's a different in cost, cost and cost. A commercial HSM - used by CAs, businesses, banks to hold private keys - contains RF shields, temper-detection switches, sensors for X-ray, light, temperature, battery-backed SRAM for self- destruction, and so on, it's extremely unlikely that anyone has ever succeeded to break into a HSM, possibly only a handful people in the three-letter agencies were able to do that, and even for them it's a great expense, launching a supply-chain attack, bribing the sysadmin or stealing the key are more reasonable options. It's certainly possible to break into it, but the cost is prohibitively expensive for most.

2\. You can make the hardware 100% secure against physical attackers if the actual secret is not even on the hardware. If I steal your full-disk-encrypted laptop while it's off, I cannot obtain any meaningful data because the encryption key is in your brain, not in this laptop. This is a practical threat model and often desirable. However, there's nothing to stop me from bruteforcing the key because the hardware itself doesn't have protections.

3\. If we make some compromises to trust the hardware, we have another security model used by a modern smartphone - an encryption key is buried inside the chip, I can boot the phone but it's impossible to physically bypass any software-based access control like passwords, since all Flash data is encrypted. All hardware can be broken with physical access, but opening the chip and extract the key may be cheaper than breaking into a HSM, but it's still expensive in terms of cost and expertise. It's difficult to bypass without an additional software vulnerability, this is a good enough threat model and often desirable.

We can combine (2) and (3): Save the actual secret outside the hardware so it cannot be stole, at the same time, implement some hardware-based protection that requires the attacker to launch an expensive physical attack before one is able to bruteforce the secret. It will be a defense-in-depth and the best of all worlds. What we have here is actually a OpenPGP Card (Yubikey, Nitrokey), or a Bitcoin wallet, which uses both mechanism to protect the user from thieves. For example, Nitrokey's implementation first encrypts the on- chip OpenPGP private key with an user-supplied passphrase, and it also set the on-chip flash to be externally unreadable (only readable by firmware itself), so that the private key cannot be extracted, finally it has the standard OpenPGP card access control: If multiple wrong passphrases are attempted, it locks itself, of course, this feature requires an inaccessible on-chip flash - either the flash itself is on-chip, or an encryption key to the flash is on- chip.

If the firmware executed by the chip can be replaced, the attacker can disable all the access restrictions (disable the wrong-passphare lockout, and readback the key), totally eliminating the hardware layer of defense, which is not what we want here. Unfortunately, Nitrokey is based on a standard STM32 microcontroller, and its flash protection has already been broken. Nitrokey Pro remains "secure" \- the real crypto is performed on an externally inserted OpenPGP smartcard, which is powered by a "secure" microcontroller, but the card is a partial blackbox and cannot be audited - When Yubikey said it was unable to release the source, many recommended Nitrokey since it's "open source", unfortunately, it is, but it depends on a Yubikey-like blackbox. If you want to implement something better, more trustworthy than a Nitrokey or Yubikey, the option for you here is to write a FOSS implementation of the blackbox, make it becoming a whitebox. Not that the underlying FPGA can be audited, it cannot be, but it's still much better than a complete blackbox.

And now back to the original topic: If your FPGA's bitstream encryption has a vulnerability, it's game over. This is a serious problem. A response may be: relying on bitstream encryption is not the correct approach, one should use external Flash at all, well, yes, but this is not my argument here, my argument is simply that securing your hardware against physical access by an attacker is a legitimate requirement, and that even if everything can be broken with physical access, doing so still has a point.

<comment><USER25> > A commercial HSM - used by CAs, businesses, banks to hold private keys - > contains RF shields, temper-detection switches, sensors for X-ray, light, > temperature, battery-backed SRAM for self-destruction, and so on, it's > extremely unlikely that anyone has ever succeeded to break into a HSM

A service to lift firmware from Gemalto chips used in SIM, and credit cards costs $25k here at most

<comment><USER22> I think there's some confusion. Are you sure that you are talking about the same thing? What I meant here is a real HSM, something similar to a IBM 4758 [0] (which was once vulnerable, but only because it had buggy software), not a SIM card or a credit card chip. Do you imply that many HSMs are based on the same Gemalto chip?

[0] [https://www.cl.cam.ac.uk/~rnc1/descrack/ibm4758.html](https://www.cl.cam.ac.uk/~rnc1/descrack/ibm4758.html)

</comment></comment></comment></comment></comment></comment></comment><comment><USER26> I don't know much about FPGA's but I tried to read the paper. Maybe someone can tell me if this is correct:

Getting your hands to raw gate configuration helps with cloning. It's pita to reverse engineer.

Any device that uses Xilinx 7 or Virtex 6 SPI or BPI Flash remote update is potentially fucked. There is HMAC in bitstream and no other authentication.

</comment><comment><USER27> The number of people glossing over his to take a bitstream which is the gate configuration of the fabric and read it back to human logic like Verilog is extremely few people and always a lot of time.

This is a big issue for cloning though.

Oh AES CBC, when will you stop disappointing!?

</comment><comment><USER28> So can I use this hack to use open source tools on these FPGAs?

<comment><USER29> No. It means people will be able to copy FPGA's like was possible in the 2000's. It also means that the design in an FPGA could be altered by an unauthorized 3rd party without having to physically replace the device.

<comment><USER30> Some FPGA's _require_ bitstream encryption. On those devices, breaking this encryption is the first of many steps to making an opensource toolchain

<comment><USER8> This is not the case for the FPGAs targeted here. Encryption is optional on Xilinx 7-Series. Also there already is an open source toolchain coming up for them.

[http://www.clifford.at/yosys/](http://www.clifford.at/yosys/)</comment></comment></comment></comment>


Ask HN: I have an idea for a startup... now what? - <AUTHOR>

I've got an idea for a startup which I think many people would find useful.
I've gone through the following steps:
1) Other people (from different demographics) agree that this idea would be useful - some of them would even use it. 2) I have places to look for funding (tentatively interested parties). 3) I have a sketchy business plan (sketchy is in currently vague).
4) I have a basic process that the user would go through to use my product, and ballpark figures for costs and required elements for the idea.
I want to get this up and going soon, and I'd probably like a partner who could help with this (especially seeing as I'm in college, currently).
What's next? <comment><USER2> This is what I do at the moment(for a personal project, but it could easily adapt to an early-stage startup): Maintain a task list for the product/business - "action items" that can be taken care of each day. Pull a grab bag out each day and resolve to complete them. So when you want to work on the product itself, you come up with technical tasks, research tasks, maintenance tasks, etc. Or when you want to seek funding, advice, or partners, you create tasks for those. Create scheduling milestones as well. You want to keep moving forward, making decisions, while retaining a balance. Having the schedule helps you to say with confidence, "this is good enough for now," "I can wait on this until later," or "this is critical and has to be done to hit my goals."

It's the decision-making that moves the business forward - as you get used to that, the process of doing the work itself, meeting people, research, etc. will quickly become background elements of what actually happened that day. If you can't make a decision yet, then you need to gather more information. You're either doing one or the other.

An example list of tasks from your starting position would be:

-Research implementation strategies(self-built, outsourced, with co-founder)

-Evaluate early customer needs(example: are you selling a bells-and-whistles "experience," or will no-frills functionality be sufficient to solve customer problems?) and pick a core focus for product development.

-Plan style of external communications - which audiences will be addressed, how to maintain the best relationships over time

-Plan internal organizational structure over some time frame(how big, how quickly, what kind of culture, when do you exit)

-Establish motivations of all potential co-founders vs. self, and identify possible conflict points so they can be addressed early.

<comment><AUTHOR> I'll do that – write out a list based on the business plan and try to navigate the fastest way through it to launch.

Thanks for that – it gets overwhelming to consider all the project at once.

</comment></comment><comment><USER3> If you can build a 1st version prototype do so now. If not figure out what you need to be able to complete a 1st version prototype and take steps towards achieving that.

</comment><comment><USER4> I would sort out the business plan. Will the startup be profitable? What are the risks? Surely this is the first thing that any potential partners are going to ask.

</comment><comment><USER5> Where do you go to school? I'm a college student who's looking for a co- founder as well. Shoot me an email at dzlobinsky [at] gmail.

</comment><comment><USER6> 1\. Get in line.

2\. Start testing.

i.e. Minimum viable product. Customer feedback. Iterate.

Are you a programmer?

<comment><AUTHOR> I'll parse last first.

I probably should have mentioned that I am a programmer, mostly Python, but have work experience in Java and am capable with JS/HTML/CSS (and have knowledge of or am somewhat capable in Scheme and C).

Problematic is the fact that I don't have a grasp on database software or security and I dislike the idea of using Django, partially because I don't want to think in Django. I'd almost like to write in Scheme, if Python didn't (a) come more naturally, having written much more code in it (b) seem to have more libraries etc... (c) I have formal education in Python, and I still don't have a solid grasp on where call/cc would be used in a program, which signals to me that I'm not ready to use Scheme.

I'm also decent with sysadmin tools, by no means an expert, but I can use bash and I can script a bit.

So yes and no?

I'm all for the agile approach. I'd like to open with a bang, though. I'm thinking a designer?

2\. I suppose I do just need to step into the game. Now. The advice I hear but selectively ignore is "just do it."

1\. ?

Thanks!

<comment><USER7> Here's the thing with call/cc: it's a powerful but low-level operator. It can be used for example to implement throwing and catching exceptions, or generators like Python's yield. However, once you've implemented generators or exception handling, then you'd use "throw" and "catch" and "yield" directly instead of calling call/cc to do those things. So when you say "when would I use call/cc in a program", it would be for some situation that doesn't already have an implementation for it, which is probably pretty rare when most of the things that you'd use call/cc for are already implemented.

If you're interested in web programming with Scheme, I suggest taking a look at Arc (<http://arclanguage.org/>) which is (I find) a very pleasant language to program in and useful for basic web apps.

For the first iteration of your application, keep it as simple as you can. Don't use a complicated framework if you don't need to. Don't store your data in a database if you can simply store it in files. There's plenty of time later to say "ah, this piece needs to be faster" and move that bit into a database or whatever. By then you'll know what you actually need, instead of vaguely guessing and spending a lot of time to store _all_ your data in a database in the hope that it will turn out to what you need.

While I suggest taking a look at Arc since it sounds like you'd be interested, I'm also guessing that Python is _most likely_ going to be your best choice because it _is_ a lot more mature, it _does_ have a lot more libraries, and you already know it. But look for a way to do your project simply. Don't go off and use a complicated framework that has object-relational mapping and templates and junk if you don't need that stuff now.

I hope this helps... :-)

<comment><AUTHOR> I've checked out Arc before, and it looks pretty neat. Perhaps it could handle some of the "simpler" part of the application, and I let Python handle some of the more intense server-side implementation. Would that be unwise – combining two (similar) languages in one app?

Thanks for the advice! It sounds as though I need to just get a version 1 out there, ASAP.

A problem with my idea is that it requires some pretty intense sysadmin knowledge, and my big stumbling block is either learning more about all that, or bringing in a partner.

Another issue, perhaps you've got suggestions regarding it, is security. How do I go about handling that? Passwords, information, etc?

Thanks again!

<comment><USER7> Find some simple Python libraries to use, and going all Python is probably best. Combining Arc and Python would be a fun project but would distract you from getting version 1 done :-)

System administration is tedious but not very hard to learn. An advantage of doing it yourself is that when you need to do some minor tweak you can just do it and not interrupt your flow, instead of emailing some guy who does it the next day but it isn't quite right so now you've been stuck for two days and then he's had some important emergency so he can't get back to you right now... For help with system administrations issues you can ask questions over at <http://serverfault.com/> if you get stuck on something.

Security is figuring out that you don't want people to be able to do X, Y, and Z and then making sure that they can't do X, Y, and Z. The simpler your system is, the easier it is for you to check. Which is another reason to avoid complicated software that you don't need.

For passwords specifically, for version 1 just do something very simple. Use OpenID if it won't confuse your users and you won't have to store passwords at all, or just collect the usual username/password and stick it in a simple file on your server. Then as you get going you can come back and take another look, but don't get hung up on it for now.

I'm "aw" on arglanguage.org, by the way.</comment></comment></comment></comment></comment>