Debian Dropping the Linux Standard Base - vezzy-fnord https://lwn.net/Articles/658809/ <comment><AUTHOR> I've always liked the concept behind GoboLinux[1], it makes so much more sense in comparison to the legacy mainframe style file structure other linux distros use. Debian dropping LSB might pave the way for more distros adopting a more modern and sensible file structure.

1 [http://www.gobolinux.org/?page=at_a_glance](http://www.gobolinux.org/?page=at_a_glance)

<comment><USER2> This is nothing new, of course. NeXTStep introduced things like ~/Apps, /LocalLibrary, and /LocalApps back in the early 1990s.

Daniel J. Bernstein, around the turn of the century, proposed a /package hierarchy (for package management without the need for conflict resolution) and a /command directory. ([http://cr.yp.to/slashpackage.html](http://cr.yp.to/slashpackage.html)) Their major problem was the idea that one had to register things with what was to most of the world just some bloke on another continent. But they had concepts like a hierarchical package naming scheme ("admin/", "mail/", &c.), self- contained build trees with versioned names, and an "index" directory full of symbolic links.

<comment><USER3> I do not seem to understand, so forgive my ignorance if you will but; Why do we need a /Apps directory isn't that what /bin /sbin and /usr/bin are for? And as for /LocalApps is that not what /home/$user/bin is for? this seems fairly redundant, or needless wheel reinventing?

<comment><USER4> On NeXTSTEP and OS X, the /Apps (/Applications) directory is for self- contained application bundles that hold a GUI application and all of its dependencies that aren't part of the base OS, and they can be installed and removed by dragging and dropping that one bundle (which is a directory, but appears in the graphical file manager as a single object). There was also a distinction between locally-installed stuff and network resources which made things a little more complex but more manageable if you were actually working in an office full of NeXT boxes. OS X still has /usr and it still has pretty much the same meaning, but GUI apps live in a separate and more user-friendly domain.

<comment><USER5> Known on Windows world as xcopy install, due to the similar way MS-DOS software used to be bundled and everyone used xcopy instead of the pretty basic copy that didn't do recursive copies.

But sadly it doesn't present the nice object concept NeXTSTEP and OS X have.

</comment></comment></comment></comment></comment><comment><USER6> We package our software for CentOS, Debian, Ubuntu, and have occasionally supported a few others. We never even considered targeting the LSB. It is so much simpler to target the defaults on the system, build for the top three or four or five distros (which actually ends up working on several spin off systems, by virtue of similarity), and when problems arise we know we're not the only ones running into it because we are using the same libs as the rest of the system.

The idea of one package for all distros is cute but not at all realistic. And it isn't pleasant for the end user, who wants everything in their native package manager and things to be configured in the same ways as everything else.

LSB was a well-meaning idea, but it doesn't actually do anything to improve openness or interoperability.

<comment><USER7> Well 1 thing of LSB does help in 1 case: init.d return codes, very important with some HA tools.

<comment><USER6> We support and manage all of the major init systems (initscripts, systemd, Upstart, BSD, etc.) so we don't care about that (or we do, but the software already has configuration and code for all of the possibilities).

</comment></comment></comment><comment><USER8> About a year back I was tasked with porting an installer for a proprietary product to work on Linux. I wanted to show the log files to the user in the graphical installer and I ended up using xdg-open, which as it turns out opens text files in Firefox, even though light weight editors are present on the system.

I also found that some scripts had the hashbang line as /bin/env which works on RHEL, but not on SuSE.

I have also been trying to write some scripts that work across multiple distros. Detecting distros is wierd. "lsb-release" is not present in most distros. "/etc/issue.net" is present in some, but not on ArchLinux.

No wonder ISVs find it hard to support Linux. I suspect the technical side of this problem is probably trivial, the leadership side, not so much.

<comment><USER9> /bin/env was always a bad idea. Way before Linux was even a thing, every Unix used /usr/bin/env - and that was the point of it being used to find an interpreter. Red Hat (where I worked at the time, man years ago) realised the mistake, but alas didn't want to break compatibility.

'lsb-release' was always hilarious: the one thing about Linux that is almost standard is that the LSB tools are never present.

<comment><USER10> Why is this a bad idea?

<comment><USER11> Because the whole point is portability, so hardcoding /bin/env when the rest of the world is using /usr/bin/env makes it nonportable!

<comment><USER10> I'm still confused should I use: #!/usr/bin/env python #!/usr/bin/python

And why?

<comment><USER12> You should use:

        #!/usr/bin/env python

or preferably

        #!/usr/bin/env python2

or

        #!/usr/bin/env python3

env supposed to always be in /usr/bin, while python doesn't. On FreeBSD for example it is in /usr/local/bin because it is not integral part of the OS.

</comment></comment></comment></comment></comment></comment><comment><USER13> The impression I get is that the main point of LSB was to combat FUD from commercial Unix vendors about Linux being fragmented and nonstandardized and lacking binary compatibility. Once Linux supplanted Solaris in the corporate world this all became unnecessary. Is this right?

<comment><USER14> As someone shipping proprietary applications on Linux, the lack of binary compat is still not fun at all. In a previous gig, we ended up with 20 odd build slaves ({x86, x86_64} * Common RHEL, Ubuntu, Debian), and making binaries for each, rather than trying to make LSB based binaries.

<comment><USER15> Maybe this will help you: [http://phusion.github.io/holy-build- box/](http://phusion.github.io/holy-build-box/)

<comment><USER16> I was very excited until I saw: "Supporting graphical applications such as those based on GTK, Qt, SDL, OpenGL etc is outside the scope of this project."

<comment><USER17> xdg-app by GNOME solves this problem

[https://wiki.gnome.org/Projects/SandboxedApps](https://wiki.gnome.org/Projects/SandboxedApps)

It's already in a working state - you can try running GIMP nightlies

</comment></comment></comment></comment></comment><comment><USER18> It's not worth conforming to a standard that no one uses, it's just extra overhead.

One of the many reasons that the best standards are reflective of what most people do than prescriptive of what they should do.

</comment><comment><USER5> Has any distribution ever complied to it?

I remember back in the day, LSB was announced as a means to avoid the return of UNIX wars in GNU/Linux.

Here we are with each distribution having its own way how to do things, so now we do have GNU/Linux wars, with a few selected distributions just like the old commercial UNIXes, because no one can bare to support X thousand variants.

<comment><USER19> Here's a list:

[https://www.linuxbase.org/lsb- cert/productdir.php?by_lsb](https://www.linuxbase.org/lsb- cert/productdir.php?by_lsb)

As you can see it has the big name distributions on it, except for Debian and Gentoo, plus many obscure ones.

However, the list of LSB certified _applications_ is rather remarkably short, which suggests that the real problem is that ISVs are much less interested in LSB than one would expect.

</comment></comment><comment><USER20> _In a follow-up message, he noted that changing the LSB to be, essentially, "whatever Debian as well as all other actors in the FLOSS world are _actually _doing" might make the standard—and the effort to support it in Debian—more valuable._

I think this strategy worked remarkably well for HTML5. Standards is a two-way conversation with the community.

</comment><comment><USER21> The problem with LSB is that no application used it, because not every distro supports it. I hope that xdg-app application containerization[1] will change that and make it finally possible to write an application that targets all distributions. Well, all distributions that implement xdg-app ;).

[1]: [https://wiki.gnome.org/Projects/SandboxedApps](https://wiki.gnome.org/Projects/SandboxedApps)

<comment><USER22> Suggest to just ask various distributions nicely if they could package xdg- app. Especially the ones that you target and/or use frequently. I quite like the idea behind xdg-app and I've packaged xdg-app for Mageia Cauldron (think Fedora rawhide). As I did that only yesterday I don't know if it works. But next stable release of Mageia will have it.

[http://pkgs.org/search/xdg-app](http://pkgs.org/search/xdg-app)

Apparently only available on Fedora, openSUSE and Mageia at the moment.

</comment></comment><comment><USER23> Seems to me that linux is self destructing, causes by people who think new is better than working.

First systemd pretty much ruined linux, I know so many people who lost interest in promoting or using linux what that was forced on us.

Now they seem to want to change this.

Yeah.... I'll just go back to windows.

<comment><USER24> I suspect Windows/Microsoft is capable of self-destruction, too. Remember Windows Mobile? It used to be the dominant OS on smartphones before the iPhone and Android came along.

<comment><USER25> Really?

I don't remember Windows Mobile having any relevance.

Symbian was pretty much alone at the throne for years before iOS and Android.

</comment></comment></comment><comment><USER26> Speaking of standards, has anything happened with POSIX since '08?

<comment><USER27> The current edition of POSIX is from 2013: [http://pubs.opengroup.org/onlinepubs/9699919799/](http://pubs.opengroup.org/onlinepubs/9699919799/)

<comment><USER26> I guess what I was really wondering was why so little has changed with respect to multiprocessing, modern filesystems, resource quotas, virtualization, etc... since '08.

<comment><USER27> I think it would be hard to give an answer without a more specific question, this just seems like a kind of nonspecific gripe.

<comment><USER26> I personally have a number of specific _gripes_ , but more importantly it seems odd the committee hasn't added anything to the standard since '08 (especially since good portable software generally needs more functionality now).

As an easy example, multiprocessing has become more important between now and then. Why are things like processor affinities still not defined?

<comment><USER27> There has been recent movement in multiprocessing - for example robust and errorchecking mutexes are now in the base spec.

In the case of processor affinity, it looks to me like no-one has ever suggested it. Participating in the Austin Group is pretty open - why don't you put a proposal forward? (Maybe affinity can be added to struct sched_param somehow?)

<comment><USER28> > Participating in the Austin Group is pretty open

Not really. I know someone who's spent ages trying to get O_CREATE added as an alias for O_CREAT.

[http://spiegelmock.com/2015/01/23/fixing-a-typo-the-hard- way...](http://spiegelmock.com/2015/01/23/fixing-a-typo-the-hard-way-unix- standards-style/)

<comment><USER26> This was a bit disheartening to read. I didn't see a any problem proper versioning couldn't address. Breaking backward compatibility shouldn't be an issue as long as you generally don't break forward compatibility. I was under the impression this was what the _POSIX_C_SOURCE_ macro was meant for.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER29> I worry this will make things more complicated than necessary in the future. The LSB is one of those things that you don't really miss until it's gone.

</comment><comment><USER30> Is this a solvable problem via package tools? Can (and maybe my ignorance isshowing) can say apt-get not interrogate a .deb file and ask "which files re your config?". Ok for this distro, they go under /GOBO/yourapp/config or /usr/etc in that distro.

A final single constants file could be handed back to the app Saying "CONFIGDIR=/foo/bar/bad"

<comment><USER31> Apt considers everything under /etc as a "config file", or any file mentioned in the special CONFFILES package file.

<comment><USER30> So it could write the files to any location. But how to tell the application it should now look in a different place ? That's probably impossible to get every developer to do.

Symlink everything?

</comment></comment></comment><comment><USER32> With systemd too it's clear that Linux sees its future as something distinct from POSIX.

</comment><comment><USER33> Oh, so the replacement for POSIX because POSIX is too established needs a replacement now?

Funny Linux guys.

</comment><comment><USER34> So long as this isn't to make way for Redhat's vision of systemd as the base system, I shrug.

<comment><USER35> I am still to find a sys admin that likes systemd.

On the other hand, developers seem to enjoy it quite a bit.

That's what happens when you have developers developing for themselves, not for sys admins (the end users of their work).

<comment><USER36> As a sysadmin, I find that every time I rail against systemd here, I get constantly challenged by developers who know far more about, well developing, than I do.

Is it so hard to avoid change for change's sake? I'm not opposed to learning new things, but we're all _really busy_ , and when the standard way of accomplishing things changes in every major release (which you're usually trying to deploy to stay on top of the latest developer demand, or audit requirements or whatever) just adds a massive learning curve. Now I've got to learn something new, rewrite a bunch of tools, all because.. why?

<comment><USER37> There will always be busy sysadmins; there will also always be new sysadmins. If we agree that systemd is a good thing, the best thing to do is to switch over quickly and bite the bullet on the re-learning problem. I understand why it happened that way and there were excellent technical reasons for it, but Debian's and Ubuntu's slow transitions (through insserv and Upstart + logind, respectively) were probably a disservice in the end, if you somehow magically knew that systemd would be the end state for both distros.

I don't expect it to change again in the next 10-15 years, except potentially to a competitor that is designed very similarly but just plain better.

I _would_ like to see more empathy for the fact that systemd is a complex, underdocumented system. Lennart's blog series is great for the "why," but very sparse on "how" and especially "how do I fix it".

</comment></comment></comment></comment><comment><USER38> [https://www.debian.org/releases/](https://www.debian.org/releases/)</comment>


Why I don't (yet) recommend In-Memory OLTP to my customers - <AUTHOR> http://www.sqlpassion.at/archive/2015/03/11/dont-yet-recommend-memory-oltp-customers

<comment><USER2> Ouch, looks like SQL Server 2014 is gunning for Neo4J and mongodb for being a quarter-baked database.</comment>


The End of IKVM.NET - <AUTHOR> http://weblog.ikvm.net/2017/04/21/TheEndOfIKVMNET.aspx <comment><USER2> [https://mobile.twitter.com/JeroenFrijters/status/85506465430...](https://mobile.twitter.com/JeroenFrijters/status/855064654309199872)

This conversation between Miguel De Icaza and the author doesn't look too favorable for the author.

<comment><USER3> To be honest, though, I think the author recognises that, which is why he specifically praises MdI in his post. Knowing that he's tired and just plain pissed-off with both platforms explains both. You're right, he doesn't come out of it well, but I've certainly had days and even months when I've felt like that, and he's making the right decision: he's moving away from something that is, for him, toxic.

<comment><USER2> > he's making the right decision: he's moving away from something that is, for > him, toxic.

No argument there. After working 15 years on something non trivial it's totally ok to get fatigued and bail out. I was pointing out that there doesn't seem to be a valid technical argument to it.

</comment></comment></comment><comment><USER4> IKVM has saved my ass a number of times. The ability to, at times, give up on the .NET ecosystem and peek into the Java ecosystem for suitable open source is fantastic.

We once had a project where some genius long ago had mandated that parts communicate _via FTP_. Eg one program uploads a file, another program monitors the directory. Total clusterfuck, so we wanted reliable automated tests. Turns out that doing an FTP server in .NET is pretty difficult. Full-fledged commercial libraries exist, but we just wanted a stub for testing.

IKVM, Apache Mina FtpServer solved it in two hours for us. I suspect many .NET shops use IKVM this way.

Sad to see it go, but it must've been an incomprehensibly huge one man hobby project for 15 years! If I were Jeroen I'd quit a long time ago :-)

Let's hope some shops get sufficient value out of it to maintain a fork. Jeroen if you read HN, thanks!!

<comment><USER5> We have the same setup at our place. FTP communication isn't a "clusterfuck", it is the tried and tested communication method between any two large companies that aren't banks. To us, it is the only highly available and reliable one. Web services have downtimes and re-sends. Our partners practically never turn off their FTP machines.

The only difference at our place is that we assume FTP works and do our tests on the file system. We don't test whether FTP works. We know it does.

<comment><USER4> How did you deal with large files, dropped connections, and so on?

I mean, sure, FTP the protocol works fine, and so does virtually all FTP software, but for communication it lacks an important feature: the ability to tell when a file completed uploading.

When we started to upload reasonably large files on reasonably fast file systems this became problem. Our file watcher noticed that a new file arrived, but it's just _started_ uploading. We tried polling the FTP server for connection status, but it turned out that the client supported and did at time use, resumed uploads on connection drops. We ended up having to parse each file just to tell whether it had finished uploading. The file fortunately was an enormous XML dump, so we could check completeness pretty cheaply.

All of this work would've been avoided with a transactional protocol such as HTTP.

<comment><USER6> I've almost exclusively seen this handled using an upload with a temporary filename (usually convention based) and then renamed on completion. Watch then for the existence of the renamed files. Clean up temp files after a defined amount to time (30 days for example).

<comment><USER4> Ahyes, smart. We didn't control the client, unfortunately, so we couldn't do that.

(we tried to communicate with the people who did but they turned out to be the supplier to the supplier to the customer of our customer, 5 countries away, and fixing anything at all was _not_ high on their priority list :D)

<comment><USER7> Afterwards change the extension to .xmlok or .xmlfail (alt: zip it), no need for vendor adjustments

</comment></comment></comment></comment></comment></comment><comment><USER8> >I've slowly been losing faith in .NET.

That piece is interesting. I don't know many .NET developers that aren't excited with what Microsoft has been doing with .NET over the last couple years. Can anyone shed light on why someone would be losing faith in it?

<comment><USER9> I've been a .NET developer for years but I've also been a big Java guy. The lack of an OSS ecosystem in .NET is a huge glaring problem. This is compounded by the echo chamber that is the MS developer world.

There have been multiple projects where lack of a library or database driver have resulted in hacks or passing something to a little Java app and back because it's unrealistic to do the work in C#. Like I said, the MS world seems to be an echo chamber and the vast majority of C# devs shun any solution outside official MS channels. Why do they do this?

Because open source devs generally still dislike MS and until .NET core (which is not ready for prime time) using C# saddled you to Visual Studio, Windows, SQL Server, and IIS. Because of this, the open source community on other languages like Python or Java is maybe 20x bigger.

The other reason open source avoids the MS platform is because they like to take your stuff and replace it with the "MS official" version. Entity framework was originally a poor emulation of NHibernate. WebApi a copy of Spring Boot. Instead of helping your project, or making it official like Java tends to do, MS likes to replace your OSS with something proprietary.

The other big .NET problem is speed. I like C# syntax better, but when I wanna get something done on my own I reach for Java first. It's faster and more flexible. In some areas the execution speed difference is 100x. The CLR might be quick but MS never considered performance a priority until .NET core, because before core they were only competing with themselves.

The echo chamberyness is leaving the MS stack in the dust. Everyone else runs on Linux now. Everyone else is using containers and SPA frameworks and Postgres. In the MS world, the unofficial rule is that if it's not a visual studio project template don't use it. It encourages reaching out of the Microsoft ecosystem as little as possible.

Big sites like stackoverflow that have chosen to go with C# have blogged about their adventures. Most of these adventures involve building things that are already available from the community in most languages. Core may save .NET but it might be too little too late. Windows has already lost the war for server operating system and that leaves little reason to use C# over the primary competitors Java and Go. Both of those have ecosystems far larger and far better support for things like databases, mapreduce, Linux, containers, etc...

<comment><USER10> I'm curious, in what areas is Java 100x faster than C#?

<comment><USER11> Aggressive inlining and devirtualization is one thing. Escape analysis that allows objects that one would expect by all rational and technological reason to be required to be allocated on the heap being allowed to be allocated on the stack.

<comment><USER12> It's not just a handful of optimisations. The entire JVM is performance focused in a way the CLR just isn't. Microsoft historically put their resources into the C# language and the IDE. Sun/Oracle put their efforts into the runtime.

For instance, the CLR doesn't do any profile guided or speculative optimisations at all. That's a 20% win for most Java apps and even more still for languages with higher levels of abstraction like Scala. So right there from the start .NET is 20% behind. The CLR doesn't have an interpreter, so, it spends a lot of time JIT compiling code that isn't particularly important. That takes CPU time away from your app, not sure how much of an effect that is but I can imagine it's at least another 10% down. C# asks devs to control de- virtualisation by hand to try and compensate, but the JVM can do a better job automatically. CLR is only now starting to look at tiered compilation and even then only a very basic form compared to Java which has had it since Java 8.

But not only is the base infrastructure and approach far more advanced, the JVM's JIT compilers are way ahead of even the new RyuJIT. Not just fancy optimisations like devirt and escape analysis/scalar replacement, but even basic things like profile-guided basic block ordering. JVM can do auto- vectorisation of loops, lock optimisations, it can even replace speculatively profile and replace synchronised blocks with hardware (TSX) transactional memory. The CLR is multiple generations behind where HotSpot is. And the JVM team is extending its lead even further with projects like Graal.

</comment></comment></comment></comment></comment><comment><USER13> I had always wondered how he funded his work on IKVM.NET anyway. He worked on it so tirelessly, it felt like he was a full-time employee of it.

</comment><comment><USER14> Told you so. Give a couple more years to .NET Core et al guys in reign, and they will totally destroy .NET. J Duffy I'm looking at you.

<comment><USER15> What in particular is worrying you about NET Core?

<comment><USER16> I guess that the platform and tooling is pretty much in motion yet. I think this is totally OK, it is in its early stage of life, and agile projects are like this in that stage. This is a cost for us, as we use them, yet we accept this, as the benefits will be larger for us, especially in the long run.

We can see how the development works, and maybe people with more enterprisey (it here a word for this?) background find this problematic, as they are more accustomed to the slow pace of innovation/changes in that area.

For me, with pretty much FLOSS experience (mostly as user) this is nothing new or worrying. This is how business is done in the open, where you see experimentation. This is the way if you want to listen to your users: show them what you do, and listen to them. Do this often, not once every 3-5 years, as in the enterprise.

</comment></comment></comment><comment><USER17> IKVM was always the king of the edge cases.

I will follow anything Jeroen publishes in the future with interest!

</comment><comment><USER18> This is sad. IKVM should have been supported by MS a lot. Being able to use Java libraries would be a huge help for .NET.

<comment><USER19> As a .NET developer, I only use wrappers for unmanaged code as a last resort. Having to introduce a dependency on something as slow and security-bug-rich as Java would be a hard sell in most .NET shops.

<comment><USER20> Can you name a few specific examples of where you are using .NET/CLR that Java would have introduced security holes? Basically all the high profile ones that people think of are code-loading issues, similar to XBAP and other .NET tech's bugs. In other words, the "Java insecure" meme applies to very little actual Java dev.

<comment><USER19> You have to install a whole extra runtime on all of your servers, including production internet-facing servers to use Java. If you can't see that would add to your potential attack surface, I can't help you.

<comment><USER20> Please list a few remote access vulnerabilities caused by the JVM and not app.

</comment></comment></comment></comment></comment><comment><USER21> This is disappointing. I've used IKVM to convert a few Java libraries written by academics where no .NET equivalent existed at the time (NLP and some other math libraries).

<comment><USER22> OTOH, without IKVM, there will be a lot of people who will be forced to come out of the .NET ecosystem when using these libraries, which will end up improving both the libraries and the surrounding ecosystem (e.g. many people dislike Java the language, but maybe people will migrate towards Kotlin for maintaining/improving these libraries). Also, any improvements they make can be more easily integrated back into the source.

<comment><USER9> IKVM exists because library offerings kinda suck in C#, not the other way around. I find it more likely that people will just write these applications in Java.

MS has a long, dark history with open source including attempting to kill both Linux and Java. Many of us have forgiven but will never forget.

<comment><USER23> They are doing something very bad with Win10 - the private data is at risk. I know about their history, and they haven't changed. They still have a monopoly on desktop/notebook. They just lost the mobile sector to Apple and Google - the end consumer decided.

</comment></comment></comment></comment><comment><USER11> It's a marvelous piece of technology. You would think when importing a Java dependency with moderately complex dependencies, there'd be some catch; there isn't. You would expect that JNI does not work (how should it?); but it does. You'd expect reflection support to be broken; but it works.

If the folks at Microsoft had any sense, they would have hired this guy, but they're probably busy rewriting Office in TypeScript based on Electron.

</comment><comment><USER24> For me, the one thing that .NET has going for it is Visual Studio. Every time I've tried returning to Java, it is not the language but the dev environment that has me running away in horror.

<comment><USER23> JetBrains IDEA, Eclipse and NetBeans are all pretty good and comparable IDEs. Visual Studio has no unique selling point per se, if you are into C# its a very good choice eecially with the Resharper plugin (some of its features got cloned).

</comment></comment><comment><USER25> I remember it was the only way to get Java running on the first surface RT with ARM Windows [http://domenukk.blogspot.de/2013/05/microsoft-surface- runnin...](http://domenukk.blogspot.de/2013/05/microsoft-surface-running- jdownloader.html?m=1) Good times

</comment><comment><USER26> Huh, I had assumed this was dead for quite some time based on the lack of updates. Here's hoping someone will take this as an opportunity to revive the project.

<comment><USER27> The lack of updates may have coincided with lack of updates to Java.</comment></comment>


Practical Advice for Changing Jobs - <AUTHOR> https://sundayscaries.substack.com/p/practical-advice-for-changing-jobs <comment><AUTHOR> I recently went through the process of transitioning out of my role as a Product Manager at a Fortune 30 company. It struck me just how large of a variance exists in success of the transition process across employees.

I wrote this post to help others who are considering how to spend their last few weeks at a company. There will be many demands for your attention -- this attempts to help you prioritize what is important to spend time doing.</comment>


Facebook Mission Updated - <AUTHOR> https://m.facebook.com/pg/facebook/about/ <comment><USER2> "Give people the power to build community and bring the world closer together."</comment>


Show HN: My new startup forum - <AUTHOR>

Hello HN!
I decided to finally do something with one of my domains, Startup2.com & ended up turning it into a forum. Just launched it a few minutes ago! I'd love to receive some feedback/criticism. It's not really alive yet due to just launching - hopefully this is something that will change soon but I have to be patient.
http://www.startup2.com
Thanks in advance for any tips/feedback!
Sam <comment><USER2> Main tip number 1 (and nobody ever listens to me on this but I'll say it anyway): the forum has to look active to attract people. Remove ALL categories, only keep 1 forum. And then seed it so it has at least a few pages full of interesting discussion. And THEN launch it with an invite-only.

You do not have to be "patient": it will not populate by itself. You need to seed it.

Good luck :)

<comment><AUTHOR> I actually like the invite/private idea - creates a certain hype! Also, good point regarding making the forum look active by having 1 category, just not sure what I'd call that category!</comment></comment>


Better Revenue Through UX - <AUTHOR> http://adaptivepath.com/ideas/better-revenue-through-ux

<comment><USER2> Video is unnecessarily obscured. Watch it at <http://bcove.me/wf01kza1>

</comment><comment><USER3> I like hearing stories about UX benefit companies' bottom line in the wild.

As designer, all too many times do I give advice and get strongly told - "that's nice, just design it this way.." It's sad because if I don't want to design it, there'll surely be a fresh upstart that'll do it to take my place.

</comment><comment><USER4> Anybody want to summarize what she says in the video?

<comment><USER5> She wanted to remove a display banner ad that was harming the UX, her boss told her that she needs to find alternative revenue if she wants to remove the ad. Therefore she make a comparison toolbox that opened in a new window Expedia & other competing websites upon a user selection, which brought revenue to Hotwire and at the same time proved to their customers that they do indeed have the lowest prices.

At the end of the talk she mentions how important it is to find good metrics to watch during any change, and how analytic insights guaranteed her a spot at the table and the respect she was looking for.

</comment></comment><comment><USER6> Nice article, but the crappy spam comment entries are quite a shame.</comment>


Show HN: BlurPage – A browser extension to hide sensitive information on webpage - <AUTHOR> https://blur.page <comment><USER2> I don't mean to be overly critical of your product, as I hate when people do that on HN

However, you should know blurring is not a secure way of censoring information, as each character is still sort of recognisable, and programmatically reversing the blurring of known alphabets and typefaces is not that difficult (for numbers, you could blur each number from 0-9 and look at the resulting images)

This is even more obvious in the text that includes caps and descender characters (q/g)

Maybe you should consider a black rectangle instead?

<comment><USER3> I agree, the blurring is not "strong" enough, too much information is retained. It's highly likely that it can be undone (I mean if blurred stuff gets passed around as a screenshot - it would be trivial to undo it right on the webpage ;-) )

</comment></comment><comment><USER4> $20 for a browser extension that blurs text on a page! Yikes!

This strikes me as the sort of generic productivity tool that might be worth a buck or two, but for $20, it had better blur text AND file my taxes for me.

I would be really surprised if there were not free extensions that did effectively the same thing. And if there are not, someone could probably whip it up in a day or two, and there goes your business.

<comment><USER5> Pricing is incredibly hard to get right. It's very, _very_ likely that the market for a tool like this is small, so charging $2 would actually net the author far less than charging fewer people $20. In that regard it's correctly priced at $20.

The apparent simplicity of some code has _absolutely no impact whatsoever_ on the amount you should charge for it. What you charge for your product should be based on the value that the customer gets from it and _not_ the amount work that you've put in to it. If you decide a price based on the level of effort it takes you then you are almost certainly not charging enough.

 _I would be really surprised if there were not free extensions that did effectively the same thing. And if there are not, someone could probably whip it up in a day or two, and there goes your business._

The danger that someone could release a free version of your app exists regardless of what you've made. That's not a very good reason not to make an app and try to sell it.

<comment><USER4> > What you charge for your product should be based on the value that the > customer gets from it and not the amount work that you've put in to it.

Go one level deeper. How much effort would a competitor have to put into building a competing product and undercutting you?

If the answer is "one afternoon," then you either need to figure out a way to make competition less likely or set a more realistic price.

<comment><USER6> If it really takes the competition a whole afternoon to implement this, $20 is an incredible price. Even just an hour for any in-house SWE in America is going to cost the company at least $20.

<comment><USER4> Replace "competition" with "user" and you have a point.

But what I mean is that if it takes only an afternoon to replicate 95% of what this tool offers, then a competitor could knock it out and start charging $10, or $5, or $1, or heaven forbid, release it as a free tool.

If that happens, the only people who are going to pay $20 are those who have no idea that the other tools exist.

There are certainly companies who operate solely on marketing power and get people to pay for things they could otherwise get for free -- see ProPublica's TurboTax investigation -- but for a tool like this, I can't see how it could work out in the long term.

</comment></comment></comment></comment></comment><comment><USER7> I personally don't think this utility is worth the asking price _for my use case_ but as a developer struggling to monetize my own projects, I respect that this developer is bold enough to ask for money at all.

What I don't like...actually what drives me totally crazy, is this:

> Buy once, upgrade for free forever!

This is not sustainable. In some ways it's even worse than free. I really wish people would stop proposing this pricing model for software. Software is never done, and a pay-once model is totally inappropriate.

Most insidiously, it gives consumers the wrong impression of software maintenance and makes it exponentially harder for other developers to implement more appropriate pricing models.

</comment><comment><USER8> You can do something like this in a few lines of JS.

[https://kopy.io/sAgzt](https://kopy.io/sAgzt)

Yes I know it's jQuery - hate all ya want. Vanilla JS would be just as trivial. Drop it into a console and ctrl click to hide stuff. VERY easy to pull this off!

</comment><comment><USER9> When the text is blurred you can sometimes still find out what letters were blurred. I think it would be smart to replace any any blurred text with random characters with the same length. Only then can you be sure the sensitive information is actually hidden.

</comment><comment><USER10> Is the use case something like taking screenshots?

I don't think $20 is bad here, I don't need it so $20 seems like a lot to me, for someone taking a lot of screen shots maybe $20 is no different than $2?

If I'm expensing something for say work, nobody cares if it is $2 or $20. In fact someone might look at me weird for expesning $2 rather than $20. The breakpoints are far higher than that as far as approvals.

</comment><comment><USER11> John Costella shared code to unblur images : [http://johncostella.com/unblur/](http://johncostella.com/unblur/)

</comment><comment><USER12> Not to mention, an expensive tool that blurs all of my confidential info by identifying where all my confidential info is first...

no thanks

</comment><comment><USER13> It appears to simply apply this CSS to the selected elements:

.___blur-blur { filter: blur(5px); }

</comment><comment><USER14> so 20$ for basically

document.addEventListener('click',function(event){event.target.style.filter = 'blur(5px)';},false);

</comment><comment><USER8> You're not handling input elements correctly. Using CSS to hide things like CC number fields etc via blurring is a fool's errand. You're going to have split- second rendering issues that still display info in cleartext on the screen (I get this is for an "already loaded page" but still - I would hope blurring persists from page to page). Sometimes Chromium gets buggy and can display stuff for seconds at a time before a CSS3 blur is drawn (trust me - I've tested this at scale).

As someone who's had to do this for automation purposes (can't get a CC/SSN in a screenshot due to compliance) you first set sensitive fields to "password" on the input element, query the DOM to ensure a "safe state", and THEN you fill then input.

Also - other comments on blurring being reversible are correct as well.

TLDR: Replace attributes/characters to do properly censor text on a webpage. Source - 10+ years of automation (same logic still applies to vanilla front- end dev). Not a very useful tool.

</comment><comment><USER15> What would be a use case? Blurring stuff in screenshots?

</comment><comment><USER16> For what it's worth, a lot of free tools already offer this type of thing in them, for free. Droplr [1], for example, has blurring ability built into their screenshot grabber. Not to mention, they use a more advanced technique of blurring by obfuscating what you select.

[1] [https://droplr.com](https://droplr.com)

</comment><comment><USER17> 20$ for filter: blur(5px); seems really odd.

If the tool did something more - maybe, but right now definitely not worth the money.</comment>


Toyota Supra gets new life: sports car debuts at 2019 Detroit auto show - <AUTHOR> https://www.emttime.com/2019/01/toyota-supra-gets-new-life-totally-lit.html <comment><USER2> It's not a Supra. It's not even a Toyota. It's an ok BMW. Nothing that makes the Supra appealing or especially elevated it to legendary car culture status is true of this new "Supra". It's extremely disappointing and a slap in the face to any fan of true Toyota sports cars.

Akio Toyoda claims to be a "car guy" but after the massive disappointment of the FR-S and Scion in general it is clear he's entirely clueless.

Toyota is a disappointing shell of itself, this car is another example in a long line of soulless non-Toyota letdowns.

<comment><USER3> I've been a huge Toyota fan since the late 80s. I've owned multiple 1970s Corollas, 80s and 90s Celicas, Hiluxes, the list goes on. All the way up to mid 2000s.

This Supra is an abomination. They go on about how it's "for the fans", which just rubs it in even worse. If they'd just made a bigger 86 with a turbo V6 I would've put money down the minute they took preorders. Instead I'm just upset that they absolutely destroyed the name of one of the most iconic cars of my generation by outsourcing it to BMW and whitelabeling a boring overpriced midlife crisis car.

Every single Toyota car nut I know is insulted, and you just have to look at ANY car forum to see how badly this entire thing is being received.

For most people, a car is the second biggest possession in their life after a house. For many it's THE biggest possession. It's not unfair for people to be attached to brands they've grown up with, and cars they've worked their asses off and poured literally blood sweat and tears into.

Look how upset people are over a missing headphone jack. Now imagine if the iPhone 11 was a rebadged Android phone made entirely by Samsung with an Apple sticker on the back, not even running iOS.

Toyota really screwed this one.

<comment><USER4> >Every single Toyota car nut I know is insulted, and you just have to look at ANY car forum to see how badly this entire thing is being received.

I don't know, it's fairly well received on Reddit, and I personally like it even though I'm a big fan of the A80 Supra. Let's be honest, enthusiasts are _never_ happy about anything, they all want something that's 500hp that also weights 2000lbs and comes straight from the factory with the price of a 3 years old used Miata.

Is this the same type of car as the A80 Supra? Of course not, but all signs pointing toward it being a quite promising _sports car_ , and all the early reviews are quite positives as well.

The kind of people who make the loudest noise on the forums aren't the type who would be putting money down buying a new $80k GT-R caliber Supra anyway.

For $50k starting price, you get a good looking 2 seater that's relatively light, agile, 4.1s 0-60 and very nicely equipped with the latest BMW cabin tech and Toyota styling, I think this thing will sell like hotcakes.

<comment><USER5> And BMW Z4 is a car for those people. Looking at the sale numbers says it all, people you cite as enthusiastic about it dont buy cars.

<comment><USER4> What sales number? This car isn't even on sale yet.

The Z4 is a convertible that costs $15k more. The people who complain the loudest about this car are the ones who don't buy new sports cars.

</comment></comment></comment></comment></comment><comment><USER6> From what I understand, the 3rd/4th gen Supras were such a draw because of the engine. It was an I6 which meant that it could withstand higher RPMs more easily than a V6 (all cylinders moving along the same axis) and it was a cast iron block (no aluminum). This made it exceedingly more capable of withstanding high loads than other engines. Apparently, just by installing a larger turbo and a better camshaft, along with tuning some of the valve timings, it was possible to get 700+hp out of the engine. 1000+ was common and I've heard of people going over 1500HP.

I don't know much about the new engine but I'm assuming this won't be possible here?

<comment><USER2> The original Supra was a Celica trim level. The car that pushed the Supra to legendary status in car cicrles was the 4th generation and to a lesser extent the 3rd.

<comment><USER6> Sorry, that's the one I meant, edited for clarity

</comment></comment></comment><comment><USER7> Not a fan of all the fake vents and curves being added to cars nowadays. Seems like car designs used to be a lot cleaner, now they have so much going on it looks too busy.

<comment><USER8> This is still why the VW golf is my favorite car. Understated is underappreciated.

</comment></comment><comment><USER9> This is how I know I need to get out more: one of the available colors is Absolute Zero White, and my brain went "but #000000 is black!" and not "snow is white".

<comment><USER10> Just think in the subtractive color model, rather than computer-screen- additive...

</comment></comment><comment><USER10> Very puzzling styling--like a more swoopy 370Z with some Z4/M-coupe haunches and ugly modern BMW interior. Which is a strange way to go, after the iconic smooth lines, workmanlike cockpit, and basket handle spoiler of the Mk4.

I think Toyota and BMW are nuts to think this model will draw any 718 Cayman buyers. Who is seriously going to pass on the Porsche PDK (or manual transmission) and mid-rear engine for a front engine and torque converter?

It's nice that Toyota is trying, yet baffling that they came up with some sort of "German fixed-roof autobox Miata" to do it.

<comment><USER11> It's a Z4. Chassis and engine.

<comment><USER2> And interior. And factory.

</comment></comment></comment><comment><USER12> Not EV, not Hybrid, not even really made by Toyota (Z4 rebadge). I struggle to understand why this vehicle is relevant other than perhaps as a symbol of the ICE sportscar nadir.

<comment><USER4> >Not EV, not Hybrid,

Jesus the EV crusaders are annoying. Thank god this car isn't an EV or hybrid, and I say that as a Model 3 owner.

>I struggle to understand why this vehicle is relevant other than perhaps as a symbol of the ICE sportscar nadir.

Obviously you struggle to understand a market that you have neither appreciation nor understanding of. Hint hint: people buy sports cars to have fun in their own ways, and currently there are no hybrid/EVs that's light and agile enough to be called a true sports car.

</comment></comment><comment><USER13> I'm a car nut and love cars. I like the idea of a new Supra, but I don't think it'll last long. The days of the sports coupe are gone. (i.e. the Accord Coupe was a great car, but nobody wanted one.) 'Muscle cars' are an exception, but these differ from sporty coupes.

I predict a short run.

Edit: Others are correctly pointing out that the BRZ/86 twins sell well, but these are small cars, not bigger semi-luxury couples ala the BMW 8.

</comment><comment><USER14> Interior, infotainment and powertrain all look very BMW. Reliability will be interesting to see in a few years.

<comment><USER15> Well, it is co-designed with BMW after all. The new Supra shares a lot with the BMW Z4

<comment><USER2> It's not co-designed. It's a BMW. Designed by BMW, built by BMW. Toyota provides some badges and money. Nothing about this car is a "Toyota".

<comment><USER4> Toyota did their own exterior styling and did all their own steering, chassis and suspension tuning.

It's at heart a BMW, but saying there is nothing Toyota is quite an exaggeration.

<comment><USER2> It's a modified BMW. It's not an actual Toyota like previous Supras.

It has no soul of a Toyota. It's just a base trim level of a BMW with different financing options and a different support network.

By the way, if I'm buying a BMW why would I want Toyota of all companies to modify the steering and suspension? I'd rather have a Toyota with BMW steering and suspension, not this abomination.

"I like my 3 series but I wish it handled more like a Camry" - nobody, ever.

<comment><USER4> Wait.. in one sentence you claim Toyota's "soul" is something good to desire for, and in another sentence you claim it just means the car will handle like Camry.

I drive a F80 M3 right now, and I very much would love to see how this car drives since I love, love the GT86 suspension/steering tuning. In fact the GT86 has better steering than my M3, so if this Supra is like that it would be very attractive to me.

If anything, a car with BMW drivetrain and Toyota motorsport's chassis/suspension/steering is exactly what a lot of people would want these days, since BMW has a big lead in engine tech (especially turbo 6) and Toyota did such a spectacular job with GT-86's chassis/suspension/steering. Hell, if BMW supplied their turbo 4 cylinder to the GT86 imagine the success it would have had.

<comment> m-ee Did Toyota actually do the 86's chassis and suspension or was that Subaru?

<comment><USER4> The 86's chassis and suspension tuning? Absolutely Toyota.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER16> From the side, it looks like it has been in an accident already. I think the side indents are too prominent.

</comment><comment><USER17> Eh looks like a Viper.

Nothing beats MKIV in looks.

<comment><USER18> I think the MK3 has aged better than the MK4 tbh... but agreed that this thing just looks like a MK4 had a baby with a Mustang or something.

</comment></comment><comment><USER19> speedhunters' take: [http://www.speedhunters.com/2019/01/wheres-my-3jz- bro-a90-su...](http://www.speedhunters.com/2019/01/wheres-my-3jz- bro-a90-supra/)

</comment><comment><USER20> It's interesting how many people fetishize the supra as a huge tuner car... and most car pundits I've seen have been saying this will be too. The thing costs just about as much as a BMW 340i - even in the "wink wink probably swap this" 4 cylinder configuration coming later it just seems too expensive for "regular" people to mess with like the mk4s, which only got popular after fast & furious came out.

<comment><USER10> The Mk3/Mk4 Supra was the beneficiary of Japan's golden age--and solid overengineering--in the 1990s. Stout iron block, strong transmission, not too many electrical doodads. Sort of like 1980s German cars, before the Germans got carried away with fussy sensors and featureitis. It seems a little unlikely that either nation is poised to have a good run like that anytime soon.

<comment><USER9> I mean for these prices you are within reach of a Tesla. A Tesla with better 0-60 times.

<comment><USER10> Likely that a lot of folks (y.t. included) won't want to own a Tesla until it's really clear that the company is set up to service broken stuff over the long run. It'll be interesting to see how the Taycan does, and go from there.

<comment><USER2> Ok so why buy a BMW that has to be fixed by Toyota mechanics? What worse scenario can you even imagine for car maintenance?

</comment></comment></comment></comment></comment><comment><USER21> No such a grand idea in my opinion: Toyota style with BMW reliability.

<comment><USER5> Lets hope its not going to be E60 M5 reliable.

</comment></comment><comment><USER22> It looks like a Miata with one of those awful s2000 fastback hard tops!

</comment><comment><USER5> First Subaru, now BMW, cant wait for new Land Cruiser being rebadged TATA Discovery.

</comment><comment><USER23> 2020 Toyota Supra vs. 2019 BMW Z4: One big difference is horsepower [https://www.autoblog.com/2019/01/14/2020-toyota-supra- vs-201...](https://www.autoblog.com/2019/01/14/2020-toyota-supra- vs-2019-bmw-z4-comparison/)

> the BMW version of this BMW engine makes 382 horsepower, while the Toyota- > tuned version produces only 335 horses.

> Toyota is slapping a $50,920 starting price on the Supra, while the Z4 with > the equivalent I6 starts at $64,695.

> BMW always lets folks option its cars up to the gills, and Toyota is > offering a Premium grade and Launch Edition at the start itself. Even with > the special Launch Edition, the Supra is still less, though, at $56,180. The > four-cylinder Z4 is the Supra's price equivalent right now, each starting at > just over $50,000.

</comment><comment><USER24> beautiful car.

<comment><USER25> I wouldn't quite say that. Sort of like an Alfa Romeo if it were Japanese.

<comment><USER2> Japanese styling is always best when they steal it from the British. See the 240z (Jaguar E-Type) or any 1970s Honda UJM (Triumph).

All modern Toyotas are revolting. The new Prius is offensive to look at.

<comment><USER13> Ah, the 240z. Great looking car!</comment></comment></comment></comment>


Microsoft exec Judson Althoff: Amazon expansion is our opportunity - <AUTHOR> https://www.cnbc.com/2018/09/09/microsoft-exec-judson-althoff-amazon-expansion-our-opportunity.html <comment><USER2> Never understood why companies give millions to their competition who are putting them out of business. Walmart got smart and went to Azure and GCP. Netflix still gives like $300m to AWS annually.

</comment><comment><USER3> Great FUD piece on behalf of M$.</comment>


A Prometheus fork for cloud scale anomaly detection across metrics and logs - <AUTHOR> https://www.zebrium.com/blog/a-prometheus-fork-for-efficient-cloud-scale-autonomous-monitoring <comment><USER2> Did you raise the challenges you had with Prometheus to the dev team and community? They are usually quite responsive and open for contributions. I'd be interested in the discussion around the reasons you brought up for forking.

<comment><USER3> Not OP, but one of the biggest issues that I've had with prometheus is that doesn't support the backfilling of timeseries data. Bringing it up to the prometheus devs led to oddly indignant responses that they had no intention of supporting backfilling, because that's not what prometheus was designed for. In large production systems, like prometheus is meant for, it was a very disappointing missing feature, and I could absolutely see why someone would want to fork if nothing else, just to get away from that level of indignancy.

<comment><USER4> I don't know if the Prometheus devs care about it being an enterprise level monitoring software, but not having any type of backfilling on the road map pretty much disqualifies it. Accurate reporting is not a nice-to-have for enterprise grade monitoring.

<comment><USER5> Backfilling data is on the roadmap. It's already possible, the tools are being worked on.

Also, accurate reporting and backfill are not related.

<comment><USER3> It's been on the road map for _at least two and a half years_ , so that's not very convincing: [https://web.archive.org/web/20170708101602/https://prometheu...](https://web.archive.org/web/20170708101602/https://prometheus.io/docs/introduction/roadmap/)

Curious to know why you don't think accurate reporting and backfilling aren't related. In my experience, they absolutely are -- mostly during disaster scenarios, where that information is more critical than _any_ other time.

</comment></comment></comment></comment></comment><comment><USER6> Yet another Prometheus/time-series backend project.

And yet again, it would be far better to just export the data from Prometheus into a distributed columnstore data warehouse like Clickhouse, MemSQL, Vertica (or other alternatives). This gives you fast SQL analysis across massive datasets, real-time updates regardless of ordering, and unlimited metadata, cardinality and overall flexibility.

Prometheus is good at scraping and metrics collection, but it's a terrible storage system.

<comment><USER5> Yup, and that's kinda intentional. The design is to be a monitoring system, not a generic TSDB. What it does needs to be simple, fast, and reliable so that your alerts get sent out.

The original design inspiration, borgmon, also was a terrible storage system and had an external long-term store layered on top of it.

This isn't a design flaw, it's an intentional trade off to make the core use case as bulletproof as it can be. Having seen "monitoring systems" based on something like Cassandra, aka distributed storage, is cringe inducing. The first thing to crash a the first sign of network trouble is distributed storage.

<comment><USER6> My point is that monitoring != storage and there are plenty of great storage systems to use so there's not much reason to create another one. For some reason developers love to create home-made (time-series) databases.

</comment></comment></comment><comment><USER7> Alternative title: "We layered compression on top of the Prometheus remote storage adapter"

<comment><USER8> Zebrium employee here: We could not use prometheus remote storage adapter because of the following issues: 1\. by the time you get there, it looses lot of information (like metric type, help, out of ordered drops etc..) 2\. you do not have control over when it gets sent out, as it has to come through tsdb after chunking, this adds lot of latency. 3\. It is per time series based protocol, not good for sending all the samples of a scraped target as a single chunk. Sending as a single chunk, helps you to group similar metrics at the remote side and simplifies the protocol for reducing the network bandwidth.

hence we did not use remote storage adapter. We introduced a new interface that plugs into the scraper directly.

</comment></comment><comment><USER9> Anyone know what statistical models Prometheus uses?

Having scanned this article, read the wikipedia entry and hit the landing page, I am none the wiser.

<comment><USER7> There isn't much in terms of modelling built into the tool itself because that kind of functionality is secondary (the tool is primarily focused on quick and efficient gathering of metrics). You can do some basic forecasting at query time (holt-winters and linear regression), but beyond that you're using one of the remote storage adapter plugins to send the metrics to a remote time series database and the apply your ML on that (like OPs service does)

[https://prometheus.io/docs/prometheus/latest/querying/functi...](https://prometheus.io/docs/prometheus/latest/querying/functions/#predict_linear)

<comment><USER9> Figures, a fine objective, but not what I'd imagined.

</comment></comment></comment><comment><USER10> Anomaly detection is snake oil.

<comment><USER11> Datadog figured it out. It's pretty great. Obviously it doesn't see everything, but it's a very useful signal. Their anomaly correlation is even cooler.</comment></comment>


The Fallacy of Multitasking and the Lost Art of 'Singletasking' - <AUTHOR> https://blog.nuclino.com/the-fallacy-of-multitasking-and-the-lost-art-of-singletasking <comment> sigh-kick There was recently an interesting discussion on this on HN: [https://news.ycombinator.com/item?id=20580017](https://news.ycombinator.com/item?id=20580017)

Honestly, while it's all true, with the tools we are using and the endless onslaught of instant notifications, I don't see any meaningful cultural changes possible.

</comment><comment><USER2> Multitasking doesn't exist. Distractions do. Deciding which is a task and which is a distraction is the only way to get anything done.</comment>


San Diego: join us for SD Hacker News meetup #33 (Fri 9/28) - <AUTHOR> http://anyvite.com/tzf1fvgrfz

<comment><USER2> Note to the SD hacker news group: I live in San Diego, but I have not yet attended a meeting. However, I just recently purchased a piece of equipment that I think would benefit the group: a Makerbot 2 3D printer ([http://www.youtube.com/watch?feature=player_embedded&v=p...](http://www.youtube.com/watch?feature=player_embedded&v=pFvozQCGvfo)). If anyone needs anything printed, let me know! I will only charge a minimal amount to pay for the PLA plastic ($30-40 per kilogram roughly) and time used.

</comment><comment><USER3> One of these days I'll be in town that day. For ~12 months now since moving to San Diego I've been consistently out of town the last Friday of every month.

Next time!

<comment><AUTHOR> Please do join us next meetup that you happen to be in town. We are very welcoming of newcomers.</comment></comment>


DRAM chip failures reveal surprising hardware vulnerabilities - <AUTHOR> http://spectrum.ieee.org/computing/hardware/drams-damning-defects-and-how-they-cripple-computers <comment><USER2> Thank you Intel for disabling ECC capabilities on consumer grade CPUs.

With smaller and more dense DRAM chips every year, it takes an even smaller amount of disturbance to flip a bit. ECC needs to go mainsteam yesterday.

<comment><USER3> At least AMD is doing the right thing.

Obviously the problem is that Intel has twice the single thread performance, but all modern CPUs are so fast that it's almost irrelevant. And on top of that most of the "actually needs performance" applications are being updated to use the GPU instead of the CPU anyway.

<comment><USER4> I have an AMD Bulldozer CPU that was release in 2011 and it supports ECC RAM. I admit that I haven't used it.

I assume Intel disables ECC in consumer CPUs to help prop up the prices of the Xeon models which are essentially the same CPUs but at a higher price point.

<comment><USER5> What about xeon e3? They have similar prices to i7s.

<comment><USER6> Except a Xeon motherboard often costs significantly more.

<comment><USER7> Indeed.

It's a little-known fact that Celeron, Pentium and i3 processors also support ECC, when used in a motherboard with a server/workstation chipset.

It's just i5s and i7s that are crippled. Cunning.

</comment></comment></comment></comment></comment></comment><comment><USER8> They make an interesting claim:

       Between 12 percent and 45 percent of machines
       at Google experience at least one DRAM error
       per year. This is orders of magnitude more
       frequent than earlier estimates had suggested.

We just had a big discussion on this topic a few days ago. [https://news.ycombinator.com/item?id=10598629](https://news.ycombinator.com/item?id=10598629)

<comment><AUTHOR> I'm not sure if this is the cited source, but the following Google paper is one of my bookmarks:

[http://static.googleusercontent.com/media/research.google.co...](http://static.googleusercontent.com/media/research.google.com/en//pubs/archive/35162.pdf)

</comment></comment><comment><USER9> Judging from Jeff Atwood's post only three days ago, a lot of people converted or seem to believe now that bit flips in RAMs are a thing of the past and ECC is just an "enterprisey" thing.

[https://news.ycombinator.com/item?id=10598629](https://news.ycombinator.com/item?id=10598629)

He didn't dare himself to not use ECC for the database... :)

<comment><AUTHOR> Seeing that DRAM pricing is so dirt cheap, it's difficult to persuade any chip manufacturer to devote another 10-15% (my estimate based on previous memory design projects) of die area to ECC bits & decode circuitry when they won't get another dime for the capability.

<comment><USER10> Why can't they charge 15% more for ECC to recoup the costs?

<comment><AUTHOR> It depends on the end customer.

PC manufacturers have zero incentive to add ECC when 99.99% of consumers don't care or even know.

Networking: a mixed big. Some designs manage ECC inside the processor, others use memories with ECC for specialized functions like packet QoS. Commmodity DRAM errors are a known irritant and planned for.

Servers: I'm not quite sure of my facts here, but a DRAM manufacturer would have to persuade a commmodity manager at Dell, etc, that ECC is worth it. A commodity manager won't give a d __* unless his systems guys say that it 's needed.

<comment><USER10> I don't think you get the point. Just stop making non-ECC RAM for all future DDR releases. Let's just say, for example, "DDR6 has ECC baked into the standard" and have everyone on board with this. The memory manufacturers bump prices a bit to cover the costs and the entire world moves on unabashed.

<comment><USER8> _Just stop making non-ECC RAM_

That's what's currently done with flash, but for DRAM that's not smart from a _system_ point of view.

A long time ago ECC was done with Hamming Codes[1]; now there are similar but more sophisticated versions. These codes share a property such that the wider the word, the fewer the additional bits required. So, e.g.

        8 bits + 5 bits
       16 bits + 6 bits
       32 bits + 7 bits
       64 bits + 8 bits

That is enough for a minimum "hamming distance" of 4 between valid words. That gets you SEC (single error correction) plus DED (double error detection). You can save 1 bit if you're willing to forego the latter.

Many decades ago (but I couldn't find a reference with a quick google) Micron made a chip that had on-board ECC. IIRC it was 8+4, which meant that it would internally correct a 1 bit error, but there was a possibility it would mis- correct some 2+ bit errors (which were rare).

But that meant that Micron was putting 50% more bits onto a die over a non-ECC device. They probably did this not for system reliability but to cover up the failings of their chips at the time. Yes you could make each bit smaller, but no way would it pay off if you needed to put 50% more bits onto a die.

ECC is best done with wide words. For example, a SIMM that presents a 72-bit interface can easily be built with 9 chips, each 8-bits wide.

The system (CPU, memory controller, whatever) takes in 72 bits (or some multiple thereof) from DRAM and does ECC internally. Note that as words get wider the time to compute ECC goes up. So a system could even speculatively execute using the uncorrected data, while in parallel checking to make sure that it was OK. This requires recovery in case of error, but since errors are infrequent it could be a big win overall.

It doesn't make sense for a DDRx spec to require ECC. It's cheaper and smarter to do ECC at a system level.

[1] [https://en.wikipedia.org/wiki/Hamming_code](https://en.wikipedia.org/wiki/Hamming_code)

</comment></comment></comment></comment></comment></comment><comment><USER11> The article seems to be based on the following paper, published in 2012: "Cosmic Rays Don't Strike Twice: Understanding the Nature of DRAM Errors and the Implications for System Design". Newer research on the topic has since been published, for example this year: "Revisiting Memory Errors in Large- Scale Production Data Centers: Analysis and Modeling of New Trends from the Field" (from Facebook) and "Memory Errors in Modern Systems: The Good, The Bad, and The Ugly".

</comment><comment><USER12> The idea that cosmic rays are responsible for DRAM failures seems laughable. I'm surprised anybody ever thought that.

I worked in a DRAM fab; I saw how it was made and tested. It's a month-long process involving dozens of machines. Particulate contamination, watermarks, process variation -- there are tons of things that can go wrong. And then testing. There's just no way to test thoroughly enough to catch all of the possible issues with timing and crosstalk. Not to mention electromigration and dielectric breakdown. You can do burn-in, but it's not going to catch everything. We even know which die are most failure-prone (usually edge die, due to process uniformity issues.) If they pass test, they get shipped!

 _Of course_ these issues are manufacturing related.

<comment><USER13> If so, why dont they increase refresh rates given that most of the memory (>95%) can do refreshes at numbers of over 3x existing refresh rates. This could potentially increase the energy savings and also potentially make the system faster because of lesser waiting time during Refresh and Row Activation.

<comment><USER12> Faster refresh will mitigate leakage, so you can run your DRAM hotter, but I don't see how that helps energy savings. Refresh means current flows out of the cell, through the sense amplifier, and then current flows back in, through the word driver. More refresh means more current. More current flow, more power consumption. This does not seem to argue for energy savings.

<comment><USER13> I meant reduce the refresh rate. My bad. Should have proof read what I typed. Essentially, what I meant was that many dram chips needn't be refreshed as often as they are now.

</comment></comment></comment></comment><comment><USER14> "DRAM chips are a little like people: Their faults are not so much in their stars as in themselves. And like so many people, they can function perfectly well once they compensate for a few small flaws."

A beautifully whimsical way to end a fascinating technical article!

</comment><comment><USER15> Does anyone know of a consumer-grade laptop with ECC RAM?

<comment><USER16> Skylake in Xeon version. So far there is Dell XPS 15 and something from Lenovo.

<comment><USER15> Thanks. Though, the downside: both companies got caught red-handed with filling their computers pre-loaded with spyware, malware and other bullshit :'(

<comment><USER17> If you care enough to put ECC in your machine you probably should start with a clean install as well.

<comment><USER15> Doesn't help a single bit (pun intended) against the bullshit in the BIOS data tables which installs the malware no matter what :(

</comment></comment></comment></comment></comment><comment><USER18> Source paper appears to be: [http://www.cs.toronto.edu/~bianca/papers/ASPLOS2012.pdf](http://www.cs.toronto.edu/~bianca/papers/ASPLOS2012.pdf)

Based on the list of authors at the beginning of the article and the credited source given in the figures ("Ioan Stefanovici, Andy Hwang & Bianca Schroeder" and "Source: Hwang, Stefanovici, and Schroeder, Proceedings of ASPLOS XVII, 2012")

</comment><comment><USER19> So how do we enable page retirement in popular operating systems on machines with ECC?

</comment><comment><USER20> Can I pay the publisher to omit those blinking distractions? If I want to watch a movie while reading an article, I bring one myself.

<comment><USER21> On the devices with iOS I can click on the book icon by the URL and read just the text there.

<comment><USER22> Or in firefox, anywhere.</comment></comment></comment>


China is supplying military drones circumventing restrictions on US exports - <AUTHOR> https://www.wsj.com/articles/unable-to-buy-u-s-military-drones-allies-place-orders-with-china-1500301716 <comment><USER2> how do we know dji doesn't have secret firmware that will turn them into suicide bombers?</comment>


Ask HN: What are some low / no cost businesses one could start part time? - <AUTHOR> To spare you the details, I've found myself in a bit of financial trouble and while I have plans to fix it, I could speed up the process by utilizing the boatloads of free time I have particularly on weekends to make some spare cash.<p>Are there any sort of no cost businesses or services I could provide that I could perform on these weekends? I used to do web development for small businesses, but that's a pretty non-existent market these days. Also I don't / can't drive so that eliminates a number of options.  I don't need to make much, even just $50-$100 a week would be helpful <comment><USER2> I convinced the teenager who mows my lawn to start spraying for bugs as a side gig to his lawn mowing gig. He now makes more money doing that than mowing lawns. Cost to start: $15. Makes $25 per visit. Takes about 30 minutes or less to spray the exterior of a house with off the shelf stuff. He is fully booked for the summer and does 4 clients a day (because he does not drive and uses a bicycle).

</comment><comment><USER3> If you've done web development for small businesses I would give that a go. Start with family and friends who might need a website or know someone who needs one. Focus on basic websites till you get your feet wet again.

Then start doing more and more advanced sites.

Try offering a website as a service package where a small business pays you $99/mo (Up to X pages) for design, development, hosting and maintenance and small updates. You can give a quote for large edits/updates. Ass you add more pages to their site increase their monthly subscription (you can set this up through paypal at first or ask for an annual check, or set it up through stripe, stripe has invoices now which is a nice way to do it.)

Or offer them a traditional quote($500-$750 for a really basic site in my area if you're working with individuals or freelancers), plus a monthly or annual hosting and maintenance fee ($20+/mo).

There are still plenty of small businesses that need websites or need new websites. Start with family and friends, then start inquiring about talking to other businesses who you can see need a website or a refresh.

SSL certs are a bigger deal now, since the browsers will list sites as not secure. If you sign up for forge.laravel.com you can spin up servers on Digital Ocean and setup SSL certs from LetsEncrypt. Forge is $20/mo, Digital Ocean droplets start at $5/mo, but the certs you can setup for free and forge will automatically renew them. So you can provide SSL certs as part of your hosting, maintenance packages.

Good luck.

</comment><comment><USER4> I signed up for a market research company's mailing list, and I get about 2 offers a week, $100 AUD cash usually. I've said no so far because I'm fussy, but if I needed the cash these would be excellent. They are often out of work hours too.

Other than that, sell your stuff on Gumtree/eBay/Craigslist. Do some good sales pitch to maximize what you get.

Can you do handy work? Always demand for that. Depends on licenses, insurance etc. I guess though.

Can you take a lodger?

</comment><comment><USER5> You could easily do this buying things locally and selling them on eBay. I do this some and find it quite fun. I do not like listing the items on eBay, that is the necessary evil of it all.

It took me about 3 weeks and a very minimal investment ($40?) before I turned a profit.

I primarily buy things at goodwill outlet, other thrift shops, and yard sales.

</comment><comment><USER6> Going to a local bar and cooking burgers or steaks on the weekend.

</comment><comment><USER7> Some coding camps offer online tutoring. The tutors can work from anywhere and get paid well.

</comment><comment><USER8> Walk door to door and sell life insurance?</comment>


So you submit resume for jobs? This guy created a site for a Google job - <AUTHOR> http://googlepleasehire.me/

<comment><USER2> [http://validator.w3.org/check?uri=http%3A%2F%2Fgooglepleaseh...](http://validator.w3.org/check?uri=http%3A%2F%2Fgooglepleasehire.me%2F&charset=%28detect+automatically%29&doctype=Inline&group=0)

</comment><comment><USER3> This guy deserves to skip the first round.</comment>


Google previews Friend Connect. Run Open Social apps on your web site. - <AUTHOR> http://www.techcrunch.com/2008/05/12/live-from-google-campfire-one-friend-connect/

<comment><AUTHOR> Being able to run your social apps outside of Facebook or Hi5 and on your web site seems incredibly powerful.

The example they give is guacamole lover who wants to build a community around her guac recipe site. She adds a OpenSocial a widget that lets her friends rate the recipie postings, if you opt-in those reviews get pushing pack into your news feed.

Their demo site:

<http://loveguac.com/guac1.htm>

Seems like Orkut is doing all the widget parsing/generation. Curious how that works with FB/Hi5 and how they deal with security since the widgets are js.

Here is the video introducing Friend Connect:

<http://www.youtube.com/watch?v=BIEwUxMrJ4Y>

And finally here are some examples Google gives, can't wait to start playing with this:

* A cooking site - Review a recipe and provide comments which clarify or improve it. Add a recipe to a social recipe box that appears across multiple cooking sites.

* A musician's site - Post pictures from your latest concert on the band's site, and communicate directly with your fans.

* An extreme sports site - Play a motor cross game, then compare your score to friends and other site members.

* An academic site - Discuss and review articles in context with colleagues and the broader community. Filter the discussion to colleagues only, or widen your view. Forge connections with new participants whose comments seem particularly insightful.

* A shopping site - Read expert reviews and tips right next to the camera you're thinking of buying, and find a friend who has already purchased the same item.

* A philanthropic site - Cultivate a community around your cause, post pictures at fund raisers, let donors connect, and involve their friends.</comment>


Cell Phones Might Be Causing Horns to Grow on Young People's Skulls - <AUTHOR> http://fortune.com/2019/06/20/horns-growing-human-skulls-cell-phones/ <comment><USER2> It's not cellphone or the radiation, it's the posture. People are bending their neck forwards for prolonged times resulting in growth spurs at the back of the skull</comment>


Faulty masks. Flawed tests. China's quality control problem - <AUTHOR> https://www.latimes.com/world-nation/story/2020-04-10/china-beijing-supply-world-coronavirus-fight-quality-control <comment><USER2> It's not really Chinese problem, it's procurement management problem. You can't just put an order in Alibaba if you need to ensure the quality.

Chinese generally have the ability to produce electronics, metals, medical devices and materials with the quality you want. At least the last 10 years.

The problem comes when procurement assumes that purchasing works in China as it does in the West. It does not. If you don't have business relationship or are one-time customer, Chinese manufacturers don't like to decline orders. They just outsource it without the required quality control.</comment>


VC for Hackers - <AUTHOR> http://chimeracoder.github.io/vc-for-hackers/#1

<comment><USER2> This is pretty awesome. Wish this had been around a few years ago. I've pretty much "reverse engineered" these concepts by following HN discussions...

</comment><comment><USER3> Could someone explain the "Your main differentiator is the market -> raise venture" vs "Your main differentiator is your advantage -> not raise venture" thing better?

<comment><USER4> Sure, this would be more clear if I had the audio to go along with it (which I should probably post too).

Basically, many (not all) successful venture-backed startups are creating new markets for themselves. Google wasn't successful because it was the best web portal - Google was successful because it rendered hierarchical web portals _irrelevant_. They created a new market that obsoleted an existing one.

In other words, if you're _creating_ a market, you have a huge potential for upside. If you're entering an existing market with a superior product, that's possible, but more difficult.

These are all rough rules of thumb, of course, not hard-and-fast criteria.

<comment><USER3> so from a VC's pov, a company that _could create a new market_ has more potential upside than one that could _take over an existing market?_ ...seems a bit counter-intuitive because for an existing big market you know exactly how big it is, so there's no "market size related risk", whereas for a new market, there's a big risk that it will turn out to be a very small niche market. Isn't the optimization being made for something like [upside]/[risk], even if it's an intuitive estimate of course, with an important component of the [risk] being market related?

</comment></comment></comment><comment><USER5> Your link does not seem to work

<comment><USER4> Author here. You can scroll through the slides with the keyboard (press 'page down', the right arrow, or the down arrow).

(The slides were generated with go.talk/present: [http://godoc.org/code.google.com/p/go.talks/pkg/present](http://godoc.org/code.google.com/p/go.talks/pkg/present))

<comment><USER6> Thanks! I've seen quite a few of these presentations and have never been able to get them to work. Naturally, I want to scroll with my trackpad and this works up through Slide 3. I didn't know you could use the keyboard to actually load more slides. I wish they'd fix this in the presenter software.

</comment></comment></comment><comment><USER4> Author here. I prepared these slides with go.talk/present[0]

If you see any issues (mistakes, things that need to be added), feel free to submit a pull request! [https://github.com/ChimeraCoder/vc-for- hackers](https://github.com/ChimeraCoder/vc-for-hackers)

[0] [http://godoc.org/code.google.com/p/go.talks/pkg/present](http://godoc.org/code.google.com/p/go.talks/pkg/present)

<comment><USER7> I found it very unsettling that there is no way to know how many slides were left -- I know that's probably github limitation, but maybe worth inserting summary/progress slides?

</comment></comment><comment><USER8> Slide 8 uses the acronym "ROI" but doesn't define it.

<comment><USER9> Return On Investment (ROI) is very widely used, including in the general press. He probably thought it unnecessary to define.</comment></comment>