Changes to the Blog - <AUTHOR> http://www.schneier.com/blog/archives/2013/03/changes_to_the.html

<comment><USER2> Is there anything wrong with linking to the share pages directly to avoid the JavaScript buttons altogether? e.g.

Facebook: [https://www.facebook.com/sharer/sharer.php?u=http%3A%2F%2Fex...](https://www.facebook.com/sharer/sharer.php?u=http%3A%2F%2Fexample.com)

Twitter: [https://twitter.com/intent/tweet?text=My+tweet+http%3A%2F%2F...](https://twitter.com/intent/tweet?text=My+tweet+http%3A%2F%2Fexample.com)

Google+: <https://plus.google.com/share?url=http%3A%2F%2Fexample.com>

LinkedIn: [http://www.linkedin.com/shareArticle?mini=true&url=http:...](http://www.linkedin.com/shareArticle?mini=true&url=http://example.com)

<comment><USER3> I worked at an ad company that was very keen on social sharing. Having played with both the bookmarklet-style links you've cited as well as the official share buttons, I've found the official buttons are better supported. I feel like one day, Facebook is just going to deprecate sharer.php and make everyone use the Like button. Tracking aside, the Like button has a much better UX, whereas sharer.php has been barely maintained in spite of all the changes to Facebook proper in the last few years. I don't think you can even suggest a link title anymore.

Anecdotally, users seem to trust native button more. If it looks like you made your own PNG and linked it to Facebook, they can't trust that you aren't going to try to do something shady to their Facebook account (or open a popup). If you use Facebook's button, it's a familiar experience without providing the publisher's site the opportunity to play man-in-the-middle.

User perception matters. Facebook's button seems to be perceived as more user- friendly than the unknown button on someone else's site, even if the unfamiliar button was designed to be less hostile than Like.

<comment><USER4> > Facebook's button seems to be perceived as more user-friendly than the > unknown button on someone else's site, even if the unfamiliar button was > designed to be less hostile than Like.

I expect that Schneier's blog is one of the best places to start reversing that common (and understandable) perception. Given the pervasive nature of fraudulent sites focusing on Facebook, one can't blame the users--but shifting their frame of mind from "fraud is bad!" to "tracking/other invasions of privacy are bad!" is overdue.

</comment></comment></comment><comment><USER5> I'm glad to see Schneier leading by example in removing/hiding those pervasive share buttons.

(To enable something similar for every site you go to, check out the Ghostery extension for Firefox/Chrome.)

<comment><USER6> > leading by example

He is way behind here, and we could have used his advocacy much earlier.

There have been alternate buttons, browser plugins and a movement to include no third-party scripts on the web for years.

I switched techrunch.com to the two-click solution in 2008. It didn't last long because we weren't successful in arguing why you don't want scripts from third-parties loading automatically. I sure could have used a bit of backup at that time.

<comment><USER7> If you had to compromise, what about enabling the buttons on hover? You'd still have people accidentally enabling them, but fewer than if they were auto-enabled.

</comment></comment></comment><comment><USER8> > Over the next couple of days, I will transition existing subscribers off of > Feedburner, but since some of you are subscribed directly to a Feedburner > URL, [...]

Anybody happen to know how one might "transition existing subscribers off of Feedburner"? I have a decent amount of subscribers via Feedburner but I would also like to cease using it (the writing is on the wall) and transition existing subscribers off but, obviously, RSS readers are tied to my Feedburner URL instead of the "direct" URL on my blog.

<comment><USER2> I believe the only way of doing it is to delete the FeedBurner feed. Google redirects requests for your FB feed to the source for 15 days, then stops redirecting and shows a message with a link to the source feed for 15 days, then returns a 404: <http://support.google.com/feedburner/answer/79597?hl=en>

This should give keen subscribers the chance to switch over, although you will likely lose some in the transition.

If you have FeedBurner's email subscription option turned on, you'll also need to migrate those users to MailChimp or FeedBlitz or similar manually. (You can export the list from the FB control panel.)

</comment></comment><comment><USER9> [Wondering aloud] Would a better approach be to activate the sharing icons on mouseover? Sure, users would do this accidentally, but those concerned about privacy could learn to avoid those areas of blogs. Those who don't care (or pay attention) would get a one-click experience.

Touch users woud presumably still have to tap twice.

<comment><USER10> If I remember correctly they went the way they did to alleviate the threat of trademark litigation.

</comment></comment><comment><USER11> How do you "transition existing subscribers off of FeedBurner"? I'd definitely think about doing this, but I don't know how.

<comment><USER6> I recently read up on this because I want to move my subs off. Feedburner has support for redirects and extracting email subscribers, although I still wish there was a tool that would automate a few of the steps.

See this post, which is the best I have found on the topic:

[http://devilsworkshop.org/tips/how-to-leave-feedburner- witho...](http://devilsworkshop.org/tips/how-to-leave-feedburner-without- loosing-your-subscribers/1402/)

</comment></comment><comment><USER12> Why doesn't he implement his own social sharing buttons if he's worried about having visitors send data to third parties unwillingly?

I've done that on my own blog and it works well (using FontAwesome to identify services). Saves on loading time too.

<comment><USER13> Is it as easy for a non-webdev as this <https://github.com/panzi/SocialSharePrivacy>

If you have a better solution, you should publicize it.

<comment><USER12> Define "easy for a non-webdev," because implementing a jQuery plugin isn't something I could tell my friends to do on their normal Wordpress blog.

My solution isn't "better" (nor easier to implement, due to how implemented social buttons handle social counts) because for this purpose because I primarily implemented my own buttons for performance/aesthetic reasons.

<comment><USER13> By "implementing a jQuery plugin" you mean "copy and pasting a few lines of code, like it says in the instructions"? I'm sure you can appreciate that some people have the skill to do that, but not the skill to come up with a new solution from scratch.

Also, I was genuine above when I said that, if you have a better solution, you should publicize it. Any reason why your method can't be done just as easily, if the code was out there?

</comment></comment></comment></comment><comment><USER14> This reminds me that I need <http://disconnect.me/> to add support for Disqus.

</comment><comment><USER15> I was hoping the changes would include a commitment to him keeping to discussing things he knows about, rather than having the expert's problem of talking about things outside his domain knowledge and being considered an expert for it regardless.

<comment><USER16> Which pieces by Schneier were not well-informed, or in which ones was he talking about something outside of his domain?

<comment><USER15> It's surprisingly common. Here's[1] the most recent example of Schneier talking out of his domain with the potential to cause damage.

The problem is that Schneier is a pundit, not a security expert. He has a good knowledge of cryptography but as a media pundit he's often asked questions outside of his domain and on responding or commenting he's referred to in the media as an expert. This is precisely what happened with his views on Airport Security. He was expressing views as an expert when he was known for cryptography and had no domain experience in airport security. Over time he's clearly researched it and had more interest in it, but his earlier stuff shows his lack of domain knowledge, yet because of his media presence he's automatically deemed an expert, and this is dangerous.

In the most recent example of security awareness training, I would bet £5 (to be donated to the Open Rights Group, the UK equivalent of the EFF) versus the equivalent in dollars to be donated to the EFF that Schneier never once in his lifetime has been involved in implementing a security awareness training programme. Yet his commentary on this marks him as an expert in the field as far as the media is concerned, and such views coming from 'an expert' may impact the security awareness programmes of many people trying to improve security in their own organisations worldwide. There's strong and well put opposition to this from Dave Kennedy[2] and Andy Ellis[3], the latter of which is Akamai's CSO, and someone who actually practices security on a day to day basis.

Just to be clear, I am generally critical of Schneier and I think it would be unfair not to state this. While I'm not a cryptography expert I recognise the work he's done in that field, however where his points have crossed over into my domain knowledge I've found his comments often show a lack of experience for someone deemed an expert by default. I don't blame him for this, but I do believe that he benefits from it and does nothing to counter the impression (that he is an expert in areas he clearly isn't).

[1] - <http://www.schneier.com/essay-419.html>

[2] - [https://www.trustedsec.com/march-2013/the-debate-on- security...](https://www.trustedsec.com/march-2013/the-debate-on-security- education-and-awareness/)

[3] - <http://www.csoandy.com/files/why_bother_with_awareness.html>

<comment><USER16> I don't find it very surprising that providers of security awareness programs don't agree with Schneier's arguments against their offering.

But since they have a strong financial incentive to disagree with him I'm doubtful about their arguments.

Their arguments were also not convincing to me. Let me quote a random and very shallow bit from the first linked post:

"An education and awareness PROGRAM is not a one hour CBT and clicking through something. It's education and awareness just like your HR department helps you navigate to your expenses."

That sounds desperate.

<comment><USER15> > I don't find it very surprising that providers of security awareness > programs don't agree with Schneier's arguments against their offering.

Erm... I wasn't talking about commercial providers of security awareness programmes. I'm talking about people who work in security who actually implement security awareness programmes as part of their security management processes, and the risk of a higher up being convinced that it's not worthwhile because schneier said so.

I've actually had a phone call this morning with one of my clients where this article was raised as justification for cutting the security budget next year by reducing spend on security awareness. This is for a major european defence manufacturer who's under pretty much constant attack by people looking to steal their IP.

In reference to your quote, that's not desperate, it's fact. A proper security awareness programme is created and maintained by the organisation itself on the basis of trying to find the best way to counter the threats the organisation faces. Some organisations will find that the need for this is relatively low and that the biggest threats they face are things like password sharing and internal things with disgruntled employees. Others may find that they're under constant attack from external threat actors and need to train people to help support their detection capability. In either situation it's definitely not a one hour CBT, it's more complex, it's more nuanced and it's ongoing.

</comment></comment></comment></comment></comment><comment><USER17> This is a very interesting approach, I really like it. I use Adblock and DuckDuckGo but really like making these changes for my blog visitors as well.</comment>


The 5+5 Commandments of a Ph.D. - <AUTHOR> http://matt.might.net/articles/phd-commandments/ <comment> barry-cotter _not be deluded or blinded by catchphrases like "life of the mind." Indeed, this life does exist, but probably only during the ABD portion of a Ph.D. A professor would be extremely lucky to live the life of the mind 15 hours a week, leaving 60 hours of advising, teaching, reviewing, writing grant proposals, traveling, and sitting in meetings._

This immediately made me think of this

 _The perverse incentives this creates are massive. Universities hire scientists rather than teachers in order to get their hands on half the scientist's grants [1]. Scientists waste their time masquerading as teachers because they can't get grants if they don't work for a university [2]. This is harmful both to science (I'm not doing research in class) and students. Of course, they don't put much effort into teaching because they are judged on their ability to get grants. Actual teachers are squeezed out, since there is no room for them._ <http://news.ycombinator.com/item?id=851218>

which I originally saw here <http://news.ycombinator.com/item?id=2094244>

</comment><comment><USER2> No. 1 Commandment as far as I'm concerned:

\- Research your advisor before you enter a Ph.D program.

Because that's the only control you have as a student over the first 5 commandments.

<comment><USER3> That's excellent advice.

I always tell students that they should do two or even three independent studies in their first semester as a Ph.D. student.

It's critically important to find the right match.

/post co-author

</comment></comment><comment><USER4> Off-topic, but why do so many blogs not have any indication whatsoever of the date posted? It's at least partially understandable for more "essay-like" posts which contain essentially timeless information, but particularly when your post uses the word "lately" in the first sentence, it's annoying to not know if "lately" meant the late 1990s, 2005, or (in 20 years), 2015.

<comment> barry-cotter Because unless your content rots, like breaking news, having a date is a pure loss. Patio11 has made this point many times. It will hurt your SEO if people are less likely to link to you because they think "Oh, that's old news"

</comment></comment><comment><USER5> _Students who periodically disappear for long bouts of skiing, soul searching, or contract work tend to be put on the back burner by their advisor, making it much more difficult to get re-engaged later on. An easy litmus test: if acting a certain way would get you fired from a real job, then it's probably a bad idea to try that in a Ph.D. program too._

I tell students the worst thing they can do is lose contact with their advisor. That makes it extremely difficult to come back later.

<comment><USER6> "An easy litmus test: if acting a certain way would get you fired from a real job, then it's probably a bad idea to try that in a Ph.D. program too."

Well, ok. But try this: "if acting a certain way would lose you an employee at a real job, then it's probably a bad idea to try this with a Ph.D student too."

Like using a student whose programming skills are probably worth over $100K in the real world as an indentured servant, dependent on you for a degree (and perhaps even a visa to remain in the country).

The problem is, of course, that there is a serious power imbalance here. They can definitely say "act like a professional" without feeling obligated to treat you (and certainly not pay you) like a professional.

<comment><USER7> > Like using a student whose programming skills are probably worth over $100K > in the real world as an indentured servant, dependent on you for a degree > (and perhaps even a visa to remain in the country).

Supply and demand. There are way more people who wish to pursue a PhD in CS than there are spots for them. If you really would rather be on the outside making six figures, your adviser would be happy to oblige--(s)he can fill your chair tomorrow with any one of a hundred people who are equally qualified.

It cuts the other way too--advisers who really treat their students like shit (as in, "pick up my dry cleaning") find that the supply of people who want to work with them dwindles. (Unless less they are so brilliant and well-connected that they can get away with it. It all evens out.)

There is a market for talent both inside and outside of the university.

<comment><USER6> I agree with you that there is a market for talent, but I wouldn't call it a free market.

I've seen it first hand. I was (briefly) a PhD student at UC Berkeley, and I left with a MS. Quickly, I was earning low six figures with stock options to write software that did optimization (linear/nonlinear programming) for a startup. A buddy of mine at Berkeley did the same thing for a professor as a research associate for about 15K a year.

The difference? Well, of course he may be passionate about research, I can't rule that out. But you can't discount the visa factor: I have citizenship, and he doesn't (or at least didn't at the time). Maybe he could have left with an MS and still gotten a work visa, but would he have wanted to risk that on a startup? His options are simply more limited.

I also heard (sorry, no cite) that UCSF took a hard look at its own PhD programs in response to very long completion times, and concluded that some of these 7 or 8 year PhD candidates were almost certainly being held an additional year because it's very difficult to find someone of that skill level to staff your lab. I suppose a US citizen could finally get fed up and leave - but keep in mind that US citizens actually have turned away from these programs in droves. While the mainstream explanation for this is poor science education in American secondary schools, a RAND study concluded that americans are avoiding PhD programs in the sciences largely because of excessively long training programs, poor job prospects, and low pay relative to the "professions" (MBA, JD, MD, DDS, etc...)

I think that if PhD programs truly had to compete in a "free market", the current system would collapse. Right now, I think they have managed to avoid change largely because international students are willing to put up with a lot to get a visa, and the professional schools aren't as accessible if you aren't already a US citizen, so they still have takers.</comment></comment></comment></comment>


The Economist Tends Its Sophisticate Garden  - <AUTHOR> http://www.nytimes.com/2010/08/09/business/media/09economist.html?ref=business

<comment><AUTHOR> I think marketing's only part of the Economist's success.

It's certainly true that editorially and, uh, advertisorially a lot of what the Economist does is not done to primarily inform its readers, but rather to play to their aspirations. Just look at the advertisement section that comes after the initial material and before the meatier articles. Or listen to their city guide podcasts. They're interesting, to be sure, but they're also very directed toward people with a certain kind of ambition.

It's easy to spot problems in their reporting and analysis in areas I know something about, and now I think I can see them sometimes in areas I know less about. (Hard to tell what that says about me -- older, uglier, a bit more experienced -- and what it says about them -- maybe their writing isn't as good. Probably mostly the former.) Still, calling the other newsweeklies "lowest common denominator" makes them look far better, more articulate, more insightful, more not-retarded than they are, and at least you can't say that about the Economist.

And lot of places would be well served by a magazine of similar quality and tone but focussed on their specific region.</comment>


Plato, the Proto-Fascist? - <AUTHOR> https://worthypatterns.substack.com/p/plato-the-proto-fascist <comment><USER2> In the article a parallel is drawn between the ostensible fascist promotion of the state over the individual and Plato's implication that the state is a better subject to understand justice than the individual.

Notice that Nazi Germany would be an example of the "fevered state", as opposed to the healthy, moderate state, that necessitates a "guardian class" in the first place.</comment>


1M cases of Covid, 1 pixel = 1 case - <AUTHOR> https://covidgraph.com/1-million-pixels-covid-cases-by-country/ <comment><USER2> In Bosnia&Herzegovina, 200 previously reported COVID-19 cases were yesterday noted as false positives due to no certified labs in the region that reported the cases. The logic for reporting false positives is that a COVID-19 epidemic qualifies B&H for emergency IMF funds, which the local politicians are already smacking their lips for.

I have yet to hear any global news outlets discuss the matter of false positives, let alone launch the investigation into how the numbers are tallied. All it matters is that the numbers go up, no matter how. It's tragic how low the media has sunk.

</comment><comment><USER3> Does anyone actually believe China's reported numbers?

<comment><USER4> Does anyone actually believe the US'? This is not a nationalistic thing, don't make it such.

<comment><USER5> > Does anyone actually believe the US'?

[https://en.wikipedia.org/wiki/Whataboutism](https://en.wikipedia.org/wiki/Whataboutism)

More importantly, the US isn't pretending to be a poster child of successful epidemic containment, nor did it caused the pandemic by systematically lying about how easily the virus spread between humans. The Chinese government is the sole responsible for this whole mess due to the extensive lying and disinformation campaign it mounted around the epidemic, turning it into a historical disaster.

<comment><USER6> I don't have much to say on the topic, but it's wrong to call any questioning back "whataboutism". Whataboutism applies to cases in which criticism is _deflected_ by a replying with criticism in turn. It does _not_ apply when the criticism can be accepted _and_ new criticism is offered. In other words, reading support or acceptance of Chinese statistics into GP's reply effectively fabricates "whataboutism". The point, in a charitable reading, is "Sure, Chinese numbers can't be trusted. But can the U.S.'s numbers be trusted?" \- this interpretation does not lend any support to China, and merely points out that we need to be skeptical of both. The origin of the concept whataboutism lies with the USSR deflecting criticism by saying what the US was doing is worse. It was not an admission and then mutual criticism. That's the key difference.

Case 1 (whataboutism):

A: China can't be trusted to give out accurate numbers.

B: Oh really? What about the US? The US is doing worse!

Case 2 ( _not_ whataboutism):

A: China can't be trusted to give out accurate numbers.

B: Maybe that's true - but can the US' numbers be trusted either?

<comment><USER4> Indeed, my comment is to point out that _no_ large country seems to be handling this very well or transparently. There is a lot of face-saving going on by everyone as leaders scramble to preserve reputation in every place on Earth, to varying degrees.

Smaller countries seem to be doing less of it. I'm not sure if that's due to some inherent trait, or simply correlated with size. Large countries are all operating IMO shamefully, lying blatantly in predictable ways through the ascent phases. It seems to me inaccurate to pick out any single one.

</comment></comment></comment></comment></comment><comment><USER7> It would be nice if y axis in the graph of cases starts at 0K instead of 10K. For other graph where the y range is smaller than the offset, it is better to cut the unused part, but in this case sadly the range is much bigger than 10K. (Also, cutting the axes makes the graph difficult to read by non technical people.)

<comment><USER8> Starting at 10K makes the most sense because getting from 0-10K may be short or long, but after it should reflect the rate of infection more relatively

<comment><USER9> The graph can have an y-axis starting at 0, and still have all the data points start at 10k.

<comment><USER8> Oh my bad, I thought you meant the x-axis</comment></comment></comment></comment>


Writing Linux Kernel Module in Rust - <AUTHOR> https://github.com/lizhuohua/linux-kernel-module-rust <comment><AUTHOR> paper link: [https://mssun.me/assets/ares19securing.pdf](https://mssun.me/assets/ares19securing.pdf)</comment>


Glue Languages Make You a Better Coder - <AUTHOR> http://zachholman.com/posts/glue-languages/ <comment><USER2> If shell were a brand new language, made in someone's basement, it would be immediately shat upon. But its ecology and ubiquity make it 'good enough'. But really, shell programming is awesome in its simplicity. Bash syntax is a bit clumsy but every commandline application ever written for unix is a new library, provided it spits out reasonably predictable output. If unix applications are hunks of oddly-shaped and designed metal, shell programming is the arc welder. (Yes, I know I'm blurring the line between bash, sh, zsh, and the like, but they serve the same purpose.)

<comment><USER3> I'm waiting for all the Java-bashing Rubyists out there to discover csh. If you need to do "real programming" csh is pretty great and has a more "programmery" syntax than a lot of the others.

But, YMMV.

<comment><USER4> Way back when I was young and first learning shell scripting, I was taught not to use csh for scripting. Is that no longer true? Have the problems described here <http://www.faqs.org/faqs/unix-faq/shell/csh-whynot/> been fixed in newer versions of csh, or in tcsh?

<comment><USER3> Okay, I'll take the bait.

When I ssh into our Solaris server, it drops me into csh by default. That makes me think someone out there believes it's good enough.

<comment><USER5> That's not the default (/bin/sh is on recent versions of Solaris, which is fairly primitive), so your sysadmin is probably the person who thinks it's "good enough".

Nearly all Solaris systems I've worked on and set up have a sun freeware or CSW system set up on them with all the standard "linuxy" tools installed, so the change isn't that weird.

<comment><USER3> This was on a Sun Fire X4500 box set up by a sysadmin who I know for sure is not a csh guy. Could be that it was different for some reason.

</comment></comment></comment></comment></comment></comment><comment><USER6> I suppose it's also true that your day-to-day development language may be someone else's glue language. There's probably hardware people who consider C their glue language.

I use Python for all of my scripts. The moment that I want to automate some system related task that requires any logic, I reach for Python. (I'd still write a bash "script" if the script was just a succession of commands.) I don't think this is a controversial position since Python is considered a cousin of Perl, and Perl was heavily inspired by shell scripts, awk and sed. I think of Perl and TCL as the original glue languages.

If I'm writing a script from scratch, I just don't see any compelling reason to do it in bash. (Or whatever your shell of choice is.) Yes, I recognize that "Python may not be available" is a potential reason, but it's not compelling to me because it's available in the places I'll need to work.

<comment><USER7> Agreed. I've been up to my armpits in other peoples' SH at times. It has a long list of defects which will come around and bite you.

I have taken the policy of moving any SH script I write to Perl (or Python) after it breaks about 45 lines (a page). I get good error checking, type checking, reliable escaping, and the ability to neatly abstract into modules.

So far, it hasn't hit me in the face yet. :-)

<comment><USER8> Of course everyone does what works for them.

But I have to say that I think the 45 lines rule is not the best criterion. Lots of scripts which are of the form "move these files around, run this command on the files, mangle the output, send it to this command to summarize, send to another command to pretty-print" can be long in line count, but are really well-done in shell. Basically, operation sequencing, and/or line-by- line file processing.

Shell makes it easy to ensure tempfiles are deleted, to catch signals, to automatically check error status of each and every command.

As you note, sometimes shell is "contraindicated" (as they say in medicine). Anything needing data structures, or abstraction beyond simple functions, is not so good for shell.

</comment></comment></comment><comment><USER9> I think the blogs comments regarding javascript are less true then that regarding shell as javascript is becoming a core language no longer only active in the web "glue language" domain.

In the web context within HTML it maybe but in terms of mobile development using tools such as titanium/appcelerator or developing things in node.js, this requires javascript not as just a glue language but as the core.

In terms of shell, yeh, I think it still applies cause to this day i havn't seen anyone write a fully blown program completely in shell (thought that could just be me).

What i noticed in all the places i have worked at, when the shell script/program starts to get to large its usually slowly migrated to perl or <insert persons fav scripting language here>.

</comment><comment><USER10> I've written stuff in shell over many years (I don't claim to be an expert, just average) but its not always smooth esp when I upgrade or change OS's. Most shell programs will make calls to other commands. These commands do not have standard arguments across unixes. Take the OSX (BSD) date and linux's date. On one machine I may have installed coreutils with default_names, on another without.

Sometimes, this forces us to make quick trips into perl or awk (to get yesterday or tomorrow). However, shell scripting has certainly made me more __productive __over the years. For most of my initial programming life (90's), I've generated boilerplate code using shell (often with awk).

</comment><comment><USER11> "Node is just more accessible in JavaScript than if it were written in Ruby."

Why? I don't see anything special in JavaScript's syntax that makes it more accessible. Node's asynchronous callback style would be a perfect fit for Ruby's block syntax.

<comment><USER12> I'm curious about this statement as well. Any leads ?

</comment></comment><comment><USER13> _This is even apparent in shell: rvm, a platform-agnostic Ruby installer, is substantially written in shell rather than Ruby._

I hope so! :-)

<comment><USER14> That comment didn't make sense to me. Why would a script that installs Ruby be written in Ruby? Isn't that the very definition of the chicken-and-egg problem?

<comment><USER15> I think rvm could have a lot more Ruby code in it- Wayne (the author) does a lot of things in shell that could feasibly be abstracted away in Ruby. I happen to really like that, although I think it goes against the grain of what most Rubyists think- others would probably do the bare minimum in shell and quickly jump into Ruby as soon as it was feasible.</comment></comment></comment>


Things I Wish I'd Known Before Using Vagrant - <AUTHOR> https://zwischenzugs.com/2017/10/27/ten-things-i-wish-id-known-before-using-vagrant/ <comment><USER2> Here's what I wish I'd known before using Vagrant:

1\. How to properly do cross-platform, high-performance two-way synced folders between host and guest. Most providers only support one-way syncing. Virtualbox has shared folders, but their performance is pretty lousy and they have issues with relative symlinks. In fact, I still don't fully know what the correct setup is for a dev environment where the files are edited on the host and the guest immediately picks up on them...

2\. This idea that with vagrant you'll never again say "It works on my machine" is a lie. So many inconsistencies between Vagrant on Windows, Linux and macOS. Internet connection sharing, line endings issues, symlinking issues, ...

If anyone wants to see how we're using Vagrant:

[https://github.com/hearthsim/hearthsim- vagrant](https://github.com/hearthsim/hearthsim-vagrant)

I don't want to make it sound like Vagrant isn't solving a real problem though, it is. It's just not the unicorn it claims to be.

<comment><USER3> 2 has been a big issue with a recent client because Virtualbox is a fucking pig in terms of features and performance compared to the commercial alternatives.

My advice is to cough up an hour or two salary and pay for parallels or VMware (if on Mac)

<comment><USER4> I've been using Vagrant + Virtualbox and have been happy with it. Is Vagrant + VMWare really that much of a step up in performance? Could you explain which features have been helpful? Thanks.

<comment><USER5> Not the parent, but anecdotally, Vagrant + Parallels runs MUCH faster on my 15" MacBook Pro than Vagrant + VirtualBox. VM startup time is shorter, and CPU usage seems to be lighter. For instance, I worked on a project where I had a long-running process that would do a lot of file I/O and periodically collect the results and run some calculations. On VirtualBox, this basically pegged a CPU core while it was running, but when I switched to Parallels, CPU usage hovered around 5%. (I'm guessing this particular example is more to do with VirtualBox's dog-slow shared folders, but still relevant, I think.)

</comment></comment></comment></comment><comment><USER6> A couple more for the list:

11\. Shared folders get setup before provision scripts are run

12\. You can detect provision has already run ([https://github.com/hashicorp/vagrant/issues/936#issuecomment...](https://github.com/hashicorp/vagrant/issues/936#issuecomment-288063253)) using:

      if File.exist?(".vagrant/machines/YOUR_BOX_ID/virtualbox/action_provision")

13\. Vagrantfile configs are actually Ruby scripts, so you could do things like storing your box configs in JSON (like I did in [https://github.com/wildpeaks/boilerplate-vagrant- xenial64](https://github.com/wildpeaks/boilerplate-vagrant-xenial64) ) instead of hardcoding them in the Vagrantfile.

14\. Virtualbox needs Hyper-V disabled whereas Docker for Windows requires Hyper-V enabled.

<comment><USER7> > Vagrantfile configs are actually Ruby scripts

I took advantage of this by storing all my settings in YAML and then using the same YAML for both Vagrant and my Ansible provisioner:

Here's the Ruby Script that loads the YAML:

[https://github.com/BigSense/vSense/blob/master/core/vagrante...](https://github.com/BigSense/vSense/blob/master/core/vagrantenv.rb)

That I call from my Vagrant file:

[https://github.com/BigSense/vSense/blob/master/core/infrastr...](https://github.com/BigSense/vSense/blob/master/core/infrastructure/Vagrantfile)

That is also loaded in all my Ansible roles:

[https://github.com/BigSense/vSense/blob/master/ansible/bigse...](https://github.com/BigSense/vSense/blob/master/ansible/bigsense.yml)

</comment></comment><comment><USER8> One thing thing I can add to this that was driving me nuts (though not strictly Vagrant's fault):

The DHCP client on Ubuntu 16.04LTS doesn't always play nice with multi NIC vagrant machines. All my vagrant boxes are dual NIC (eth0 is the standard 10.0.2.x NAT interface and eth1 is a private interface in the 192.168.56.x range with a static IP - which makes it easier for various vagrant machines to talk directly to each other).

I had an infuriating issue where my boxes would startup and then randomly (it seemed at the time) stop responding to network requests. Initially I thought they were hanging for some reason and would tear them down and re-init them.

Finally thought to enable GUI mode and I noticed that even though a box had stopped responding, I could login fine via the virtual box GUI.

It turned out that Ubuntu's DHCP client was ignoring /etc/network/interfaces (auto generated by vagrant) and wrongly refreshing IP leases on both interfaces (eth0 and eth1).

The trick is to kill the running dhclient during provisioning and restart it with switches that force it to only maintain leases for eth0:

      machine.vm.provision "shell", inline: "kill $(pidof dhclient) && /sbin/dhclient -1 -v -pf /run/dhclient.eth0.pid -lf /var/lib/dhcp/dhclient.eth0.leases -I -df /var/lib/dhcp/dhclient6.eth0.leases eth0"

<comment><USER9> That's not even a little bit Vagrant's fault - that's 100% Ubuntu nonsense, the sort of thing that convinced me about a decade ago never to install Ubuntu again. Sure, running Debian means if you want the latest and greatest you might have to build it yourself. But it's also much less likely to hose you for stupid reasons. I'm glad to see that the state of play has improved so much in the intervening years!

<comment><USER8> I'm also a Debian fanboy (been my preferred distro since "potatoe" days) but I had to switch to Ubuntu for the first time for this current project. It's not all bad but I'll return to the warm embrace of Debian for my next project.

</comment></comment></comment><comment><USER10> I wished I'd known that Vagrant + Windows is always full of surprises. So many problems with Windows developers because Vagrant will not work as expected there :(

Anybody know any best practices what to do with Windows developers? I'm thinking of going to docker... but I'm not sure if this really helps.

<comment><USER9> > Anybody know any best practices what to do with Windows developers?

I always just run a Linux VM and do most things there, with host directories cross-mounted via Cygwin sshd and sshfs (faster, more reliable, and better permissions mapping in my experience than Virtualbox shared folders) and anything that needs to take advantage of filesystem capabilities not supported in NTFS, such as the symlinks mentioned in a sibling comment, done outside a mounted directory.

This lets me get work done, but it's a suboptimal experience to say the least, and relies heavily on my prior systems administration experience to _stay_ working when it goes weird. Absent such experience among your developers or at least someone you can put in support of them, about the best I can recommend is to struggle through with Vagrant and your local handful of best practices - at least with Vagrant your dev environments are reproducible, so that when things go too cattywampus you can just burn down the VM and pop a fresh one out of the oven and get back to work. (If your Vagrant boxes _aren 't_ reproducible, that's the first thing you want to fix.)

Docker for Windows is not going to be an improvement here; on the one hand, it's newer and less battle-hardened, and on the other, it has to run in a VM anyway. (Either Hyper-V or VirtualBox, each of which has its own idiosyncrasies, and only one of which can be used at a time - enable Hyper-V, VirtualBox doesn't work any more.) Docker for Windows, like Docker for Mac, comes with some plumbing that tries to smooth over the impedance mismatch between platforms, but it's lossy and brings its own headaches, so you're just adding more complexity to the dev env for no real gain - you can just run Docker in your Vagrant boxes, if you actually need Docker, and have one fewer headache that way.

<comment><USER8> Similar approach here.

I usually have a "management" vagrant box that exposes my gitrepo back to the Windows host with samba. I then have two or three other vagrant machines that can access the same gitrepo via an NFS mount to the "management" machine.

This way I can still code in VSCode on my windows host but I do all my git commits via the CLI on the "management" vagrant box. The advantage with this approach is file permissions don't get messed up and symlinks work (i.e. you can follow and edit them on the windows host).

The only major disadvantage is if your repo has symlinks you can't create new symlinks on the windows host and you can't use Git for Windows (and, by extension, the git addon for VSCode). This is because Samba "fakes" symlinks on windows and doesn't truly support them (although it might be able to do so in the future). More info here: [https://github.com/git-for- windows/git/issues/1195](https://github.com/git-for-windows/git/issues/1195)

</comment></comment></comment><comment><USER11> If you work with other developers and store your Vagrantfile in source control, then you can allow per-developer settings using the method shown here: [https://www.glenscott.co.uk/blog/allow-per-developer- vagrant...](https://www.glenscott.co.uk/blog/allow-per-developer-vagrantfile- customisations/)

<comment><USER3> I prefer this method: [https://gist.github.com/stephenreay/2afd4205e76836f20e176722...](https://gist.github.com/stephenreay/2afd4205e76836f20e17672238a10957)

Same basic idea but plain ruby constants no need for yaml parsing.

</comment></comment><comment><USER12> I was a long-time Vagrant user but recently switched almost completely to Docker (Compose). What features does Docker miss that make people keep using Vagrant?

<comment><USER5> To give a counter-point to all the praise here, Docker for Mac has been one of the most frustrating pieces of software I've had to use for work. It has improved significantly over the first time I used it (almost immediately after public beta), but I still occasionally run into various bugs, such as inotify events ceasing to work arbitrarily. Any kind of networking that makes your containers visible to the host/on the local network is also a PITA to set up through the VM that Docker for Mac uses. It's also supposed to abstract away the fact that it's actually running in a VM, but I have had to tweak the VM's CPU/memory settings multiple times, and it's not obvious when you have to do this. On top of that, last I checked, Docker for Windows is still missing some features like inotify events, and requires you to enable Hyper-V, which of course removes your ability to have other VMs running simultaneously.

The other side of it is that Vagrant is just easier. Docker requires everything to fit into a "one container per service, one process per container" model, which is a really good idea in production, but makes setting up background services (such as the Flow server) in development way harder than it needs to be. I'm not a devops person, so the extra overhead of trying to figure this all out is significant. Vagrant isn't without its own technical problems, but it mostly Just Works™, and I can do anything to the VM that I'd do on a regular Linux machine. As someone who really doesn't care how these things work under the hood, Vagrant has been a significantly smaller source of friction for me.

<comment><USER13> > Docker requires everything to fit into a "one container per service, one > process per container" model, which is a really good idea in production, but > makes setting up background services (such as the Flow server) in > development way harder than it needs to be.

No, it does not. I use Docker as vagrant replacement too, and use a self- written bash script as "init script" that:

1) launches all services required (e.g. apache, mysql, sshd, elasticsearch) by running "service XYZ start"

2) records the pidfiles of each service (/var/run/xyz.pid)

3) sleeps 10 seconds, waits for all the pids having exited - if yes, exit the initscripts, if not, go back to #3

4) on SIGTERM/SIGINT, gracefully shut down the services _in the correct order_ (e.g. apache/php first, then elasticsearch, then mysql); the watcher loop of #3 will detect all services having shut down and exit cleanly

This way I have _exact_ reproduction of a real target server and don't have to deal with the myriad of issues that arise with docker-compose and "custom networks". Also, the documentation on how to set up a production server, especially the required OS packages, is embedded right in the Dockerfile (or, as I put the setup script in its own file, in this one). Build time for an image with identical functionality is approximately equal to what it was with Vagrant.

In contrast to vagrant, once you build that image initially it starts up way faster (10s for a LAMP+es stack), and provisioning it is a breeze compared to puphpet or whatever is the trend now. And you don't have to update your setup script unless the base OS changes, as compared to puphpet+vagrant - in fact I can use nearly the same setup and init script across stuff as old as Debian 6 (some ancient proprietary software I had to dockerize) over Ubuntu 16.04 and as brand new as Debian nightly.

<comment><USER5> I used the wrong wording: I should have said that Docker _encourages_ one process per container, not that it _requires_ it. It's possible to do most of the same things with Docker as you can do with a VM, including implementing a full-blown init system, it's just a matter of effort.

Having said that, what you did is definitely non-trivial (at least it would be for me), and you've basically re-implemented all of the stuff Vagrant gives you for free, for a pretty marginal benefit (IMO). Maybe that setup works better for you, but I don't understand why I should go through all that effort when Vagrant Just Works™ most of the time, and Docker for Mac runs everything through a VM anyway.

<comment><USER13> > but I don't understand why I should go through all that effort when Vagrant > Just Works™ most of the time

Problem with Vagrant is you can't take the VM you created and deploy it on any random Linux server (or random Docker-hosting cloud provider) - while a pure Docker solution can be deployed literally anywhere with Docker support, as long as you give it a way to persist the data directories of the services. docker-compose is a hit-and-miss across hosters, and you can't use it on DC/OS or Kubernetes environments.

I use my script collection mainly for dev environments, but it's useful when you want to spin up QA/dev instances without having to provision real servers.

</comment></comment></comment></comment></comment><comment><USER14> If you're a PHP dev (or even not) check [https://puphpet.com/](https://puphpet.com/)

I generate my Vagrant files for all my side projects with it and it's a real time saver, especially if you're not savvy in those fancy provisioners or sysadmin in general.

</comment><comment><USER15> Vagrant's private network is really cool as well. I use it to test ansible provisioning scripts for server infrastructure.

        config.vm.define "ums-01" do |machine|
              machine.vm.network "private_network", ip: "192.168.1.10"
              machine.vm.network :forwarded_port, guest: 22, host: 2210, id: "ssh"
        end

        config.vm.define "ums-02" do |machine|
              machine.vm.network "private_network", ip: "192.168.1.20"
              machine.vm.network :forwarded_port, guest: 22, host: 2220, id: "ssh"
        end

\-- [https://www.vagrantup.com/docs/networking/private_network.ht...](https://www.vagrantup.com/docs/networking/private_network.html)

</comment><comment><USER16> I'd advise caution with the use of landrush, at my company it was very quick to get up and running using it, but we encountered several problems with it over time. We have several vagrant boxes coming up and down at various times on each developer's machine and it would tend to get out of sync in various cases, hold on to records for machines that no longer existed and macOS DNS cache also played a role.

Eventually we replaced it with Dnsmasq and a static IP setup with each development box getting an immutable static IP. Dnsmasq runs on a guest VM that needs to always be up for other purposes as well.

As always the effort from the landrush developers is much appreciated and it may be suitable for a limited number of boxes but it didn't scale with our usecase.

</comment><comment><USER17> Here's my advice go to GitHub and type:

filename:Vagrantfile thing you're looking for

You'd be suprised how many hidden gems are on GitHub that you can use to figure out how to use vagrant. This tip applies more generally.

<comment><USER18> I often find Google searches for GitHub gists to be super useful.

<stuff you care about> Vagrantfile site:gist.github.com

</comment></comment><comment><USER19> \- Vagrant Triggers plugin is super useful [https://github.com/emyl/vagrant- triggers](https://github.com/emyl/vagrant-triggers)

\- I've found VMware Fusion as a provider worth the extra cost/disk space

<comment><USER3> Do you find vmware base box availability an issue? Is it just you or a team using VMware?

<comment><USER20> Creating your own base boxes is actually pretty straight forward since Packer.

Maintaining them is admittedly a bit of a time sink though.

<comment><USER3> Haha I'm aware. I'm the maintainer for [https://app.vagrantup.com/koalephant](https://app.vagrantup.com/koalephant) \- I was curious about vmware+Vagrant usage, we don't support it right now but I'm considering adding it.

</comment></comment></comment></comment><comment><USER21> Also big fan of vagrant global-status. I have it aliased to vgs in my terminal.

Also very helpful for those using Vagrant on OSX is Vagrant Manager [0] which gives you menu-bar integration and a quick interface to turn VMs on and off. It's useful even to remind myself when I've left some VMs on, especially if I'm running on battery.

[0] [http://vagrantmanager.com/](http://vagrantmanager.com/)

</comment><comment><USER22> We've avoided many of the problems (and solutions) in the link by standardizing on Ubuntu laptops for the host OS, and using vagrant-lxc to run our vagrant guests.

[https://github.com/fgrehm/vagrant-lxc](https://github.com/fgrehm/vagrant-lxc)

At least one or two of our new hires started with OSX hosts, but switched to Ubuntu after a while, to avoid virtualbox pain.

[edit: added vagrant-lxc link]

</comment><comment><USER23> For me vagrant works best with declarative configuration and a runner. something like this, with sane defaults and many options available by changing fields in a dictionary.

[https://github.com/Attumm/vagrantfile_example/blob/master/Va...](https://github.com/Attumm/vagrantfile_example/blob/master/Vagrantfile)

</comment><comment><USER24> Fore me something that inclined me to use vagrant, was the share feature, so I can let anyone in the world check my development environment. Now they deprecated that feature and [https://ngrok.com](https://ngrok.com) does the job very well.

</comment><comment><USER25> Ofcourse this depends on the kind of project, but my last experience with a big Laravel project was that I was running the project working under Apache on my local machine and the rest of the team was loosing a lot of time because Vagrant was not working as expected.

I can understand the need for reproducible environments. But when so much time is lost I doubt the first thing you need is something like Vagrant. To me Vagrant is a tool that you use when the team starts to struggle with "works on my machine". But not before that. Because most of the time (well for PHP at least) it's very easy to make it work on all machines.

<comment><USER26> I've had quite the opposite experience. Vagrant has saved my team lots of time fighting environmental issues. The approach of running apache locally falls apart pretty quickly as you add more components to your application. Elastic search, mongo, one person happens to have php 7 instead of 5.2 and wrote everything with short array syntax, etc.

We also work on many different projects, often getting dropped into something new without much of a primer. Being able to "vagrant up" and not having to know all the dependencies to get up and running is very handy.

Do we spend time troubleshooting vagrant weirdness? For sure, but compared to the time saved it's a no-brainer.

<comment><USER27> I tend to agree with the parent comment, a small team can get away without it if the software stack is stable. PHP 5.2 to 7 is quite a change and should have been documented upfront. I assume that the project must conform to certain software requirements. On the other hand, npm is full of surprises.

<comment><USER26> I don't disagree that if you can get away with just a local development environment that it is likely easier to get up and running. However, it requires good documentation of project dependencies and discipline by the team to not accidentally upgrade their version of PHP without telling anyone, both things that are easier said than done. Vagrant lets you codify that through "code". In the case of my employer, it's a necessity, but obviously everyone is different.

<comment><USER27> Agreed, but the "Vagrant doesn't start" saying is a real thing imo. Maybe it's my experience but it doesn't feel very robust.

</comment></comment></comment></comment></comment><comment><USER28> I've used Vagrant extensively in the past but since I found docker-compose, I haven't reached for it over the past year.

<comment><USER20> Docker and Vagrant are two very different tools.

<comment><USER29> Are they? Very different? Not really.

<comment><USER30> I'm pretty fustrated reading comments like these because there are use-cases where these tools are pretty much the same and use-cases where these tools are wildly different and you guys are going back and forth arguing semantics that are totally meaningless without the context or use case.

<comment><USER31> I think the parent's point is that for the majority of web development use cases (which I'd wager was a large percentage of the Vagrant user base) Docker has eliminated the need for Vagrant. Agreed, though that there are times when you need to simulate software running on a particular machine and for that Vagrant is still useful.

</comment></comment></comment></comment></comment><comment><USER32> Another thing to add to the list is you can set Paravirtualization Interface if you're using VirtualBox.

If your defaults are currently on "Legacy", empirically we saw 10-30% speedup by switching to "KVM".

</comment><comment><USER33> There used to be a problem with running Vagrant on VirtualBox with more than 1 CPU: [https://github.com/rdsubhas/vagrant- faster/issues/5](https://github.com/rdsubhas/vagrant-faster/issues/5)

Explanation and workarounds: [http://www.mihaimatei.com/virtualbox- performance-issues-mult...](http://www.mihaimatei.com/virtualbox-performance- issues-multiple-cpu-cores/)

Did they fix this?

</comment><comment><USER34> My top tip: install your dotfiles into any Vagrant VM without modifying anything in the VMs Vagrantfile/provisioning scripts: [https://gist.github.com/tadas-s/0cd468a4cc9fa4cafce6fe57a5dc...](https://gist.github.com/tadas-s/0cd468a4cc9fa4cafce6fe57a5dce123)

<comment><USER3> Because you said "without modifying anything in the vms Vagrantfile" I assume you put this in $VAGRANT_HOME/Vagrantfile?

Also, nice username. You'll need a tray.

<comment><USER34> No, you put that Vagrantfile with provisioner installing your dotfiles into $HOME/.vagrant.d/ folder. Every time vagrant creates or starts any vm it will sort of "extend" its configuration by reading $HOME/.vagrant.d/Vagrantfile (if it exists).

<comment><USER3> Um yeah. That's the default location for $VAGRANT_HOME if you don't set the env var.

</comment></comment></comment></comment><comment><USER35> 11\. Virtual Box sucks. Try out alternatives, I like vagrant-lxc.

<comment><USER36> Could you elaborate on why you think VirtualBox sucks? Or why you think vagrant-lxc is better?

<comment><USER35> VirtualBox is slow (especially sharing files), we've had lots of problems with it becoming corrupted, and requiring a fixed partition of RAM makes it very hard to run more than one VM without starving your VM's or host of memory.

vagrant-lxc has none of the above problems, it is just containerization with no virtualization penalties.

I've had lots of people tell me that Vagrant sucks. When digging into their problems it's almost always been VirtualBox causing their problems.

</comment></comment></comment><comment><USER37> Thank you for "vagrant global-status". There's still a lot of boxes I don't even remember.

<comment><AUTHOR> You're welcome!

</comment></comment><comment><USER38> I've done development with all the databases, languages and packages installed on the host machine, as well as with vagrant. With the VM, I have to ssh in, or switch windows to run tests, whereas before I could just run the tests in vim. How do people achieve fluency with these?

I suppose I could install some more of my tools on the VM, but if you take that to its absurd conclusion, I'm just running a clone of my host on the VM.

It seems more useful, maybe, to just run databases and other services in the VM. Those are the more difficult bits to manage usually. A good programming language already has version and package management facilities.

Or perhaps am I missing something? Anyone have another workflow?

<comment><USER14> Jetbrains IDE has a good SSH & Vagrant support so mostly I create tools/tasks that launch through ssh (or use the built-in ssh client but that's like any console except you can stay in the IDE), same for the database tool.

</comment></comment><comment><USER39> Another thing that's good to know: vboxfs (the default VirtualBox file-sharing filesystem) doesn't support mmap().

The are quite a few software that use mmap to access files, especially databases. When that happens, either avoid using the shared folder or switch to using the nfs mount.

Here is the ticket about it that's been opened 10 years ago: [https://www.virtualbox.org/ticket/819](https://www.virtualbox.org/ticket/819)

</comment><comment><USER40> Adding swap really is critical. Machines running out of swap was causing my MBP to crash ~once a day, enough that I ran linux on it for a while (it was more stable for whatever reason) until we figured out what the issue was.

</comment><comment><USER41> I highly recommend lando. Basically an easy to use CLI wrapper for docker apps.

[https://docs.devwithlando.io/](https://docs.devwithlando.io/)

<comment><USER31> From a development perspective, what's the advantage here over just using Docker Compose? Is it the baked in recipes that it provides?

</comment></comment><comment><USER42> Is anyone really using Vagrant for anything more than quick tasks on your local dev machines? I always perceived Vagrant as a hack.

<comment><USER43> What would you do instead if you want to test things that need to run on actual VMs? Configuration management or whatever. Is booting a VM at a public cloud provider any less of a hack?

<comment><USER44> Last time I did this I just created a base VM that had Ansible set up and anytime you wanted to get the latest environment you just ran a script. Although I admit that I'm sort of an infrastructure fanatic and love Ansible, so that might be why I steer away from things like Vagrant.

</comment></comment></comment><comment><USER45> Yup yup this is a good list. Thanks for mentioning landrush, it is something I could have used.

</comment><comment><USER46> Vagrant's documentation leaves something to be desired. It's perfectly possible to control many VMs from one Vagrantfile, but good luck figuring out how from the docs.

I mean with a bit of ruby knowhow and some digging you can figure most stuff out, but Vagrant's documentation still lags behind Hashicorp's other stuff which is usually very well documented.

<comment><AUTHOR> Yeah, that's been my experience too.

Which is a shame, as it's an incredibly powerful tool, it just lacks the 'last mile' stuff that Docker did so well.</comment></comment>


(2009) Carl Linnaeus Invented the Index Card - <AUTHOR> https://www.sciencedaily.com/releases/2009/06/090616080137.htm <comment><USER2> A longer more scholarly treatment of the subject: [http://www.lse.ac.uk/economicHistory/pdf/FACTSPDF/3909Muelle...](http://www.lse.ac.uk/economicHistory/pdf/FACTSPDF/3909MuellerWilleScharf.pdf)</comment>


The dirty secret of browser security #1 - <AUTHOR> http://scarybeastsecurity.blogspot.com/2012/01/dirty-secret-of-browser-security-1.html

<comment><USER2> Perhaps someone should maintain a list of vulnerable versions of software (similar to bugtraq) and then whenever a browser executes an external program it could be checked against this and display a warning.

As a side note I don't think we've successfully educated users on how important updated software is to security.

I know a number of people who have disabled automatic updates for anything on their computer (often on the advice of more IT savvy friends).

I think this is often because of a fear that automatic updates for software may apply unwanted changes to the software functionality or occasionally break things.

Security updates and general updates need to be cleanly seperated.

<comment><USER3> I agree with the separation. Two separate checkboxes for disabling regular updates and security updates, would probably stop most users from disabling security updates.

</comment></comment><comment><USER4> This page lists installed plugins, finds those that are updated and tells you where to get updates:

<https://www.mozilla.org/plugincheck/>

Though that isn't as newbie-proof as what Chromium does (blocks outdated plugins, though they an infobar allows running them from the current page).

</comment><comment><USER5> One reason why I keep plugins disabled in Safari.

<comment><USER2> The problem is that we are probably not the target users here.

We can disable plugins and then selectively re-enable them (we probably keep them upto date anyway) but many people are going to get annoyed if they try and access something that uses (say) flash and it doesn't work immediately.</comment></comment>


Reverse Engineering Cognition - <AUTHOR> https://www.mitre.org/publications/technical-papers/reverse-engineering-cognition <comment><AUTHOR> As mentioned in this paper, the present resources for learning RE binaries is not good enough.

"opensecuritytraining.info is somewhat smattering of topics rather than a logical sequence of exercises that vuilds upon each other [sic]".

(thenewboston is quite infamous for its teaching methodology. w3schools.com was also infamous for its errors. This link [https://news.ycombinator.com/item?id=17397823](https://news.ycombinator.com/item?id=17397823) shared on here itself explains why some books on programming languages with catchy titles are teaching concepts in the worst manner possible ("the worst book on C programming" as mentioned by Brian Kernighan himself in one of his talk).

So what are your best experiences/opinions/resources on learning binary RE and exploitation to minimize time wasting on pseudo-intellectual books/courses/youtube-tutorials by self acclaimed l33t h4x0rs and spend that time on learning the ACTUALLY required concepts clearly in logical manner to maximize the learning part and minimize the time wastage on some completely unrelated topics.

One previous discussion where some people are discouraging a beginner asking questions about RE by telling him that asking for right book and tutorials is like asking for short tricks (which the OP is clearly not doing).

[https://news.ycombinator.com/item?id=14481686](https://news.ycombinator.com/item?id=14481686)</comment>


Tips to succeed as a programmer (Facebook engineering Notes) - <AUTHOR> https://www.facebook.com/notes/facebook-engineering/three-tips-to-succeed-as-a-programmer/10150639100788920 <comment><USER2> Timeless advice for any software engineer!

The one thing to add (related to 1 and 3) is:

         *do not focus completely on the technology. learn what's around it also*.

I once worked for a company where 1 week/month the managers would work in 1 department (as regular team members). With the hands-on feedback, they would improve the process/team/business. Needless to say, that company was making profits in the 2008-2009 "dark-age period".

The main lesson for me is that software is the business where you learn about & improve other businesses. The value is that you get to understand better the world (business) around you. That way you can avoid building "innovative products" that no one needs.

<comment><USER3> This sounds similar to the edw519 approach of "talk to people, see how you can improve things."

I think there's a lot to be said for it. I suspect we (as a species) waste a lot of time because we're ignorant of the big picture.

<comment><USER2> Not only that, but you also strengthen the relationship and stay up-to-date (micro & macro).

In some cultures (eg. ex-communist countries) there is a natural "distance" (approachability) between employees and management. I did not see this in Western Europe (at least at such level)

EDIT: thanks for the tip about edw519 ( <https://twitter.com/#!/edw519> ). New feed to read!

</comment></comment></comment><comment><USER4> Counterpoint: patio11's [http://www.kalzumeus.com/2011/10/28/dont-call- yourself-a-pro...](http://www.kalzumeus.com/2011/10/28/dont-call-yourself-a- programmer/).

<comment><USER5> Patio is a successful "small tech consultant", and enjoys blogging and sales and marketing. Some people prefer to lean more heavily/exclusively to technology and math, and they are needed and well rewarded to work on large technical systems. (My team is hiring. )

<comment><USER6> As far as I can tell, you have provided no contact information at this stage, so the information that you're hiring may not do anyone any good. :-)

<comment><USER5> I am confident that you've heard of us and others like us, and know how to apply.

</comment></comment></comment></comment><comment><USER7> _1\. Look for jobs that will let you program. ... You want your job title to be 'software developer,' 'software engineer,' 'programmer,' 'coder_

Followed by

 _Goranka Bjedov is a capacity engineer_

Hmm.

</comment><comment><USER8> I love how I can just read the bullet points and glean 90%-95% of what the post is about. So many blogs waste words.

</comment><comment><USER9> Reading code always worried me. That was always my biggest deficit in school - I couldn't just pick up someone else's code and dive in, it took a lot of effort to understand anything more than the most basic code.

Of course, now I'm not in a programming job, so I can only imagine I've gotten worse.

<comment><USER10> Well, OPC (Other People's Code) is generally unpleasant to read. ;) Rarely do people try to write programs _"for people to read, and only incidentally for machines to execute"_ , as SICP puts it.

So, I think it helps to do more than just passively "read" it. I might create a private branch, run the sucker with lots of print statements, comment the hell out of it, take copious notes in org-mode, draw diagrams to leverage my visual systems, etc. (It might feel silly, but no one's watching.)

Running it repeatedly (with print statements) allows me to form little hypotheses and test them. The idea is to approximate having a REPL. Something like emacs helps to automate this as much as feasible.

<comment><USER5> Don't add printf, add unit tests!

<comment><USER7> Printf tells you "this function entered, then that function" while the program is running. Unit tests are trendy, but how do you know what to unit test before you even know the code paths? Do you even care about individual functions at that level? Printf may be dirty, but in the initial stages it's better even than a debugger with breakpoints.

<comment><USER10> Interesting, I too kind of believe that print statements are better than debuggers, but I always thought that was an irrational belief on my part. (Like, I often don't have a decent debugger available, so never got much experience using them.) What are your reasons?

<comment><USER7> It's just easy, intuitive, doesn't require any scaffolding, and gives you just the information you want, exactly as your program sees it, yet with the full power of the language to format it exactly as you want to see it, in the most useful way. A breakpoint will do the same thing sure, but only by stopping your program in its tracks! Dtrace is the only thing I've seen that is as useful as liberally sprinkled printf's.

A unit test will tell you if you know what output a function should give for a given input, that it does. Ermm, brilliant, but what if that function isn't on your code path anyway? And assuming that you _already_ understand the program well enough to create any state the function expects if it's impure. Above poster has drunk too much Kool-aid and is suffering from Golden Hammer Syndrome ;-)

</comment></comment></comment></comment></comment></comment><comment><USER11> in fact, these are valuable lessons for any position. Specially, the last one.

1\. Look for jobs that will let you <do whatever you want to do>. 2\. Don't give up on becoming <whatever you want to become>. 3\. Learn how to take charge of your career.

</comment><comment><USER12> Crisp and to the point. Likes it.

</comment><comment><USER13> 404

<comment><USER14> I had to hit refresh a few times to get a page that loaded</comment></comment>


This famous roboticist doesn't think Elon Musk understands AI - <AUTHOR> https://techcrunch.com/2017/07/19/this-famous-roboticist-doesnt-think-elon-musk-understands-ai/ <comment><USER2> Through his lens (i.e., robotics) he's probably correct. On the other hand AI in the broader sense, isn't limited to robotics. For example, the financial industry comes to mind; as does the DoD.

When you think outside the robot, the lens changes, as does the scope. In that context, I would bet on Musk's interpretation.</comment>


Why aren't rings 1 and 2 used? - <AUTHOR> http://yarchive.net/comp/linux/x86_rings.html <comment><USER2> It should be noted that this is a discussion from 2003. I doubt things have changed much, but it is something of which to be aware.</comment>


Three ways to fight climate change that Brett Victor missed - <AUTHOR> http://colinschimmelfing.com/blog/three-things-to-fight-climate-change-you-can-do-that-brett-victor-missed/ <comment><AUTHOR> It's interesting there's so much activity on HN this week related to climate change - maybe because COP21 is coming up?

In any case, check out the marches happening around the world today: [https://twitter.com/search?q=%23ClimateMarch](https://twitter.com/search?q=%23ClimateMarch)</comment>


Stay Classy, Richard Stallman - <AUTHOR> http://opensourcetogo.blogspot.com/2009/07/emailing-richard-stallman.html

<comment><USER2> I don't understand why folks make such a big deal out of RMS. He's nutty, has views widely considered odd, and very rarely compromises or backs down from a confrontation on any intellectual subject (wrong or right). We _know_ all that. RMS has never been anything but, to the best of my knowledge.

Why anyone, particularly someone who claims to be "an active and vocal member of the burgeoning mobile open source community", would ever be surprised by that is baffling to me. And, yet, about once a month I come upon someone absolutely flabbergasted that RMS has been "caught" doing exactly what it is that RMS does.

So, umm, next time anyone feels like getting all aflutter about something RMS says or does, check the google. You'll find he's said or done it, or something very much like it, before. He's practically a parody of himself at this point.

Note: It probably sounds like I'm being critical of RMS, along with all of the people who criticize him. But, I'm actually quite fond of RMS. I think his existence is a net positive for the world, despite his many (amusing) flaws. And, I would encourage those who rail against him at least make an attempt to do as much good for the world during their stay on the planet.

<comment><USER3> I'm also monumentally tired of _"Wow. Just wow."_ There are about 5 truly astonishing things in this world that merit this response. Emailing RMS and getting a prickly response isn't even worth a Spock eyebrow.

Please file it with "anomalous" and "irregardless" and _let it go already._ Sorry. Pet peeve.

</comment></comment><comment><USER4> After reading this person's initial post ([http://opensourcetogo.blogspot.com/2009/07/good-gcds- beginni...](http://opensourcetogo.blogspot.com/2009/07/good-gcds-beginning- with-significant.html)) and tweets about the keynote, I had a really poor impression of RMS.

Now, I now have a poor impression of the article's author and a higher impression of RMS.

I've seen videos and read interviews illustrating the crazy eccentricities of RMS. He certainly takes the nutty extreme on a variety of issues. However, this email exchange makes him sound like a person using his crazy persona to make a few points.

All this said, I'd really hope a video of the keynote gets posted.</comment>


Ask HN: How is your code/build/test/deploy flow organized? - <AUTHOR> We use git for source code management, but thinking about which method of versioning is easier and more scalable in long-run. we can put tag for each release, but when we need to fix older version say v0.1, we cannot easily checkout, fix then commit. Instead we are going to use branch for major versions, v0.1, v1.0, v1.1, v2.0 and etc, tags for minor versions inside each branch, v0.1.1, v0.1.2,..
We use jenkins for builds, but how can we easily organize "build and deploy version X into production" things (assuming that we do not have db migration overhead)
Would be awesome if you can give some details about pros and cons of your current flow, or maybe best practice for creating such flow. <comment><USER3> We currently use a custom CI system. We produce dozens of builds per day in various forms. A "build" to us has different definitions depending on who it is targeted to. They include things like:

* Just building binaries/code

* A data build

* A build that content creators work with (built binaries synced to PC, matching data synced via P4 which they then build locally)

* A full files/package/disc build with included data and binaries

Coders and content creators have different branches to keep some isolation between the two and avoid them impacting each other too much. New binaries are built with every submission to source control as a verification step on the coder branch, but most are only deployed once an hour. Some sets of binaries are deployed at all times, those that are required to run our automated tests on each CL.

The content creator branch always work with a pre-approved set of binaries. When they submit new data it goes through a verification step where all data is built and autotests run, then that data CL shows up as "good" for them - <USER2> they know that data is safe for everyone to sync and work with.

We create full packages for QA to test a few times throughout the day.

The general build steps in a CL on the code branch goes through are:

* Build code

* Build data

* Run autotests

* Once an hour deploy new binaries to sync

The general build steps a CL on the content branch goes through are:

* Build data (no need to build code here as we just sync the pre-approved binaries)

* Run autotests

* Deploy approved build (or mark a CL as "good")

That's the general gist of it, anyway.

</comment><comment><USER4> To me, one workflow - either branches or tags - would seem simpler and make describing and tooling the process simpler. Again, to me, since git is primarily about branching, I'd probably go with branching. Then again, branches with little or no reason to exist beyond semantics wouldn't bother me as much as it might bother someone else.

Good luck.

</comment><comment><USER5> We use IncrediBuild - it speeds up our development and CI. C++ dev on Visual Studio with some teams running C# and CI into Jenkins. The C# team has more automated unit tests with MSTest, which is where they shine</comment>


Ask HN: What do you do with stock options underperforming the underlying stock? - <AUTHOR> The company I work for went public and my strike price is higher than the current price in the market. The real stock probably won't reach that strike price in a long time--if ever, so they're essentially worthless, and will be for a long time. So my question is: what do you do here? At least before we were public, they would use stock options as an incentive because they MIGHT be worth something. But now they're actually worth jack. New employees probably get RSUs that actually amount to a real value, while the older employees are stuck with worthless options.<p>Have you ever been in this position? How do you negotiate/reason about it? <comment><USER2> toilet paper?</comment>


Ask HN: Which Serverless Database do you use? Why - <AUTHOR> Ask HN: Which Serverless Database do you use? Why I am building a serverless application and confused over a couple of options. <comment><USER2> We started off with DynamoDB, but recently moved to Postgres on RDS.

We were having to jump through too many hoops to get DynamoDB to work well with our structure.

We looked at Aurora, but it is behind a few versions on support and we couldn't use json as a datatype.

</comment><comment><USER3> DynamoDB and Google Datastore.

Give a look in the Google datastore</comment>


The telegraph was the Victorian internet - <AUTHOR> https://tomstandage.wordpress.com/books/the-victorian-internet/ <comment><USER2> I read this book when I was back in university, and thoroughly enjoyed it! The social change at that time was enormous.

Boats were once the fastest way to send a message (faster than horses). The railway suddenly made it much quicker to communicate, and within a generation was quickly followed by the telegraph.

The effects of the telegraph on language, as people found cheaper ways to send messages when they had to pay by the character, are having modern parallels with SMS and emojis.

</comment><comment><USER3> If you're interested in telegraph's and early communications technology, I HIGHLY recommend getting a copy of "The Story of Telecommunication" by George P. Oslin [1]. It's very thoroughly researched and clearly a labor of love. tchingazing video on YouTube.

Also, I can't help but share this awesome video I recently found - "How the Teleprinter Works" [2]. It's fascinating and very well done.

[1]: [https://www.amazon.com/STORY-TELECOMMUNICATIONS-George-P- Osl...](https://www.amazon.com/STORY-TELECOMMUNICATIONS-George-P- Oslin/dp/0865546592)

[2]: [https://youtu.be/HcMHam54EOI](https://youtu.be/HcMHam54EOI)

</comment><comment><USER4> It really was, complete with a 1880s-vintage Tinder: [http://archive.org/stream/wiredlovearomanc24353gut/24353.txt](http://archive.org/stream/wiredlovearomanc24353gut/24353.txt)

I read that a while ago and though the plot itself is kinda facile (it is supposed to be just a simple romance novel after all), it's really fascinating to see the parallels of the telegraph with the internet from a cultural aspect. It's easy enough to draw comparisons between the two as being different stages in the evolution of networks etc but the human side of things is always a bit harder to sum up.

</comment><comment><USER5> I also present you with this:

[https://en.wikipedia.org/wiki/Semaphore_line](https://en.wikipedia.org/wiki/Semaphore_line)

</comment><comment><USER6> I'm sure I'm preaching to the choir here on HN but if you haven't read Terry Pratchett's "Going Postal", I highly recommend it.

<comment><USER7> There is a follow up board game too called Clacks, that's a lot of fun [1].

It's the detail that makes it even going down to the terminology of using jacquard cards [2].

1\. [https://boardgamegeek.com/boardgame/140279/clacks- discworld-...](https://boardgamegeek.com/boardgame/140279/clacks-discworld- board-game)

2\. [http://www.computerhistory.org/storageengine/punched- cards-c...](http://www.computerhistory.org/storageengine/punched-cards- control-jacquard-loom/)

</comment></comment><comment><USER8> I hardly ever read non-fiction but I read this book a few years ago and absolutely loved it. Was sorry when I was finished. Well worth anyone's time.</comment>


Ask HN: Micro-consulting - is there a market? - <AUTHOR>

TL;DR - Is there are market for sharing skills e.g on a 1 day or half day basis. Shorter than an ODesk or Elance project, somewhere between a paid tutor, mentor or pair programming platform? Like a mini startup weekend for your own idea?
<comment></comment><comment></comment><comment></comment><comment></comment><comment></comment><comment></comment><comment>---
This follows on from this post..
http://news.ycombinator.com/item?id=4499615
which is discussing keeping seeds of ideas in a spark file, to be revisited at a later date.
I've been keeping an ideas list of my own for a while now. Every time I revisit it, I re-order it, starting from the ideas I'm most excited about.
Having looked at it today, I've not completed any of my top 5 ideas. The 5 ideas I have executed on were further down the list but were only started because I had the skills needed to see them through to completion.
For example, for some projects I'd need to work with an iOS developer and UI/UX designers initially to share wireframes, learn limitations and get feedback & improve in an area outside of my current skills.
Ideally it would be a collaborative effort with a target or deliverable produced at the end of each paired-building day.
I've used Elance and ODesk quite a bit and they seem to fall short. They work well when you can deliver very specific instructions and have relevant area knowledge, but what about creative discussion? Improving upon an idea needs to come before the execution! It seems counter intuitive to direct a project in an area you have little knowledge of. I know from both sides how frustrating it can be.
As developers or designers, would you offer your services (on a daily rate) to work with people that wanted more than just a freelancer to do it for them? So advice and execution combined?
I have a feeling that if this kind of platform was available - a lot of projects would get built! </comment><comment><USER3> I think if you could build a platform where specialist and short term capacity could dovetail into the process you may have a great idea. If somehow companies that used your service where required to use some standards like say gitflow, and an automated dev environment set up then you may be onto something. My though is if one could rapidly get someone up and running with a code base you could provide a system where specific defects can be dealt with by specialist, the problem is the labor involved in just getting said person up and running to look at the defect/feature. Having them pair is of less value because you are hiring another resource and loosing the capacity of a trained resource. But if that micro-contracted resource can rapidly bear tangible fruit, then you have a product that can provide personnel capacity on demand. I can think of three cases where this would be of value:

1) Company looks at it's backlog of lower priority tickets and says wow we need someone to just come in and clear tickets.

2) Company has a small feature that needs to be developed not really worth anyone's effort of going through a bidding process.

3) Company has a specific specialization needed and no one on the dev team posses said expertise. Such as we need a dev with a security background to implement authentication.

Again the trick to this would be to require a standard for participating companies. In the end it may have to be several standards for the different platforms, but the setting up of the code base and the workflow of tasks would have to be pretty standardized for the participating developers to be able to rapidly on-board for the economics to be there.

<comment><AUTHOR> Yes! Spot on, exactly - "specialist could dovetail into the process"

I was thinking more for individuals working with individuals, mainly because companies have drawn out processes. I think the key would be speed and efficiency.

For your scenarios 1 & 2, that would be farming out lower priority tasks to someone who could hit the ground running. That's an interesting angle, especially considering the volume potential. It's perhaps a little too close to recruitment/emergency staffing for me.

My thoughts were more aligned with number 3, where you don't have specific skills, you have the benefit of working with an area expert for x number of days to complete a specific phase of an idea.

<comment><USER3> As I see it though, they are all the same problem, fix one and you fix all three. Granted with #3 a company or individual may be more willing to invest some time, but many times specialist jobs can be small and therefore the purchasing party may, in the end, decide that it is not worth the effort. Reducing that entrance barrier not only lessens the decision making for #3, but the others as well.

</comment></comment></comment><comment><USER4> I like this idea and came at it from a different approach. I've hired odeskers before with mixes successes.

We were hiring some day laborers locally to help us load and unload a truck, went to a place, hired two guys for a daily rate, and at the end of the day that was it.

As a dev, I'd love to hire someone to consult with me for a day to walk through my app with me and help improve it.

I wonder if ramp up time takes too much, or if it needs to be limited to consulting only, rather than actual writing the code / designing psds work.

<comment><USER5> Is it possible for me to take a look at your app?

<comment><USER4> We've never finished getting the multi-user one production-ready. We've been using a really simple version to hire out our consulting services to clients for a year or so. It's just a simple checkout with different day rates for different services (consulting, designing, code)

</comment></comment></comment><comment><USER6> Your idea is not perfectly clear to me.

My first impression was that you want to promote 1-day consultancy transactions focused on specialist advisory and/or mentoring.

My second impression was that it would be a idea grooming platform where people get together.

Which are you leaning towards? #1 may sound boring (actually, I find it cool) but I think it has a market, whilst #2 may have a greater appeal but you'd have to build some monetization strategy upon it (and it sounds awfully like co-working spaces for trendy startups)

<comment><AUTHOR> My original thinking was close to your first impression.

Simplified down to it's easiest terms "1 day consultancy transactions" it does sound boring but I think it would be win-win for both sides. Quite exciting if it means you get started on an idea with the right people!

There's no reason why it couldn't also support people that just wanted to find others to work with (no fee) and share the project.

I wasn't proposing any kind of co-working space, just a platform of hirable experts!

</comment></comment><comment><USER7> I don't know about the creative side of things, but this would certainly be interesting for the "getting started" part of a project.

Client: Creates a spec for a website.

Consultant: An expert django dev sets up the website + deploy scripts and implements one or two models for you.

Client: Continues the project and can immitate the step and do the "grunt work".

Incidentally, I would also see this working with "employment periods" even shorter than half a day.

<comment><AUTHOR> That's true! Even just spending a few hours with a particular subject expert could enable you to ask questions, check possibilities or even find there's a much simpler way to implement an idea.

Yet, having an idea doesn't necessarily mean you know what components, technology or skillset is applicable, sometimes it's tough to write the spec!

The way a spec is written can make or break a project - I've actually tested this theory on Elance, 2 specs, same requirements but different words resulted in project bids that range from low hundreds on one to several thousands on the other.

Sometimes just engaging in a short conversation (skype, email etc) can clarify a lot of things and help people to learn too! (That's why I'm interested - <USER2> don't want people to do stuff for me, I want to know about what goes into it)

</comment></comment><comment><USER8> Yes, I think so. It'd be a good startup. Think of it as connecting people by getting them to commit to working together on something briefly. Make it high quality participants with set rates, some tools/rules around pair producing, etc.

<comment><AUTHOR> Thanks, I appreciate the feedback.

If it simplified exchanging skills & helped freelancers to jump into projects where needed, it could be great!

</comment></comment><comment><USER9> something like <http://anyfu.com/> ?

<comment><AUTHOR> Yes!! Thank you, I might give that a try!

<comment><USER10> <http://Clarity.fm> ...might fill a void as well</comment></comment></comment>