PostgreSQL 9.5 New Features with Examples [pdf] - <AUTHOR> http://h30507.www3.hp.com/hpblogs/attachments/hpblogs/Japan-Enterprise-Topics/124/1/PostgreSQL%209.5%20New%20Features%20English%2020150807-1.pdf <comment><USER2> INSERT ON CONFLICT and Row Level Security are awesome new additions.

If you don't know about RLS I recommend you read up on them[1], as they would allow you to handle select/update/delete rights on rows directly on the data itself.

[1][http://michael.otacoo.com/postgresql-2/postgres-9-5-feature-...](http://michael.otacoo.com/postgresql-2/postgres-9-5-feature- highlight-row-level-security/)

<comment><USER3> > Row Level Security

Awesome! Though having read the explanation I can't think of a secure way to use this in a multi-tenanted app, as once the DB user has permission to execute "SET ROLE", it's got the same security issues with accessing other user data as the current "WHERE company_id=3" style of separation? Would it help this use-case, and does it add security?

<comment><USER4> > as once the DB user has permission to execute "SET ROLE", it's got the same > security issues with accessing other user data as the current "WHERE > company_id=3" style of separation?

DB users can only SET ROLE to roles they belong to. If each tenant has its own role it isn't possible to switch between them.

        # CREATE ROLE bob;
        CREATE ROLE
        # CREATE ROLE alice;
        CREATE ROLE
        # SET SESSION AUTHORIZATION bob;
        SET
        > SET ROLE alice;
        ERROR:  permission denied to set role "alice"

"SET SESSION AUTHORIZATION <role>" changes the possible SET ROLE targets to those allowed for <role> (so only the roles it's a member of), whereas SET ROLE keeps the original possible roleset (which is every role if you SET ROLE from an admin account), so SET SESSION AUTHORIZATION is a better proxy for "logged as <role>".

The biggest annoyance is with connection pooling and the inability (to my knowledge) to prevent RESET SESSION AUTHORIZATION at the DB-level: when pooling connections you'll want to have a "base" role which is a NOINHERIT member of all "effective" (tenant) roles, so it can only SET ROLE/SET SESSION AUTHORIZATION but can't do anything (so it can't be exploited), the first thing you do when you get a connection from the pool is SSA to the effective user you want, and the last thing you do when you put the connection back in the pool is a RSA.

        # CREATE TABLE foo ( id serial, c1 varchar, c2 varchar );
        # GRANT SELECT (id, c1, c2) ON foo TO public;
        # GRANT UPDATE (c1) ON foo TO bob;
        # GRANT UPDATE (c2) ON foo TO alice;
        # INSERT INTO foo (c1, c2) VALUES ('a', 'b');
        # SELECT * FROM foo;
         id | c1 | c2
        ----+----+----
          1 | a  | b
        (3 rows)
        # SET SESSION AUTHORIZATION base;
        > UPDATE foo SET c1 = 'd' WHERE id = 1;
        ERROR:  permission denied for relation foo
        > SET SESSION AUTHORIZATION bob;
        > UPDATE foo SET c1 = 'd' WHERE id = 1;
        UPDATE 1
        > SELECT * FROM foo;
         id | c1 | c2
        ----+----+----
          1 | d  | b
        (3 rows)

That'll prevent honest mistakes, though an attacker could still RESET SESSION AUTHORIZATION then switch the connection to a different role and go to town. It might be possible to mitigate that at the application level, but that's less convenient.

<comment><USER5> MS does this with a magic cookie value. [https://msdn.microsoft.com/en- us/library/ms181362.aspx](https://msdn.microsoft.com/en- us/library/ms181362.aspx)

It's been discussed on the pg mailing lists but nothing has happened so far

<comment><USER4> An output parameter seems somewhat inconvenient to use from an application context, but yes that's a feature which — as the MSDN correctly notes — would be extremely useful for multiuser with connection pooling environment.

</comment></comment></comment></comment></comment><comment><USER6> Can't wait to use the new JSONB operators of 9.5, e.g.:

        SELECT '{"k1":"v1"}'::JSONB || '{"k1":"v2","k2":true}'::JSONB

=> {"k1": "v2", "k2": true}

In 9.4 this is the 'best way' I know:

        SELECT
            ('{' || STRING_AGG(
    	    '"' || COALESCE(j2.key, j1.key) ||
    	    '": ' || TO_JSON(COALESCE(j2.value, j1.value)
            ), ',') || '}')::JSONB
        FROM JSONB_EACH('{"k1":"v1"}') j1
        FULL OUTER JOIN
        (SELECT * FROM JSONB_EACH('{"k1":"v2","k2":true}')) j2 ON j1.key = j2.key

<comment><USER7> The JSONB 9.5 operators have been backported to 9.4 and are available here:

[https://github.com/erthalion/jsonbx](https://github.com/erthalion/jsonbx)

</comment></comment><comment><USER8> The ALTER TABLE UNLOGGED feature is awesome, we've been looking for ways to speed up our Django test runner and this seems like it would help.

I've been thinking that a "test-only" mode of Postgres would be quite useful - i.e no persistence/WAL/crash-safety at all, in return for raw speed. My tests don't need any of this, and the Django test runner is awfully wasteful when it comes to setting up and tearing down tests.

<comment><USER9> Unlogged tables have existed since 9.1. The only thing that was added now was a quick way to toggle between modes. Before, you could achieve the he same by creating a second unlogged table (using 'like x including indexes'), followed by an 'insert into ... select ...' an the subsequent dropping and renaming (remember: DDL is transactional in Postgres, so you can do all of this in a transaction).

Yes, the new toggle is much more convenient, but you do not have to wait for 9.5 if you really want it.

In our case, we converted some tables we use as kind of materialized views the moment 9.1 came out.

edit: fixed autocorrect wittyness (unclogged => unlogged)

<comment><USER8> Thanks for that tip, I will try and integrate it with our tests later and see if there is much of a speedup (before I was trying to alter Django's CREATE TABLE statements which is harder than I thought).

I was also suggesting something further than unlogged tables, maybe something completely in-memory? Good tests are run in isolation and are really just care about the constraints rather than any form of persistence, combined with the fact that all data inserted is erased at the end of the test anyway it just seems a bit wasteful.

<comment><USER10> if it's just for testing, you can use a ram disk to store the data directory. If you don't want the entire db on the ramdisk, you can create a tablespace for the ramdisk, and then create tables on it. [http://www.postgresql.org/docs/9.5/static/manage-ag- tablespa...](http://www.postgresql.org/docs/9.5/static/manage-ag- tablespaces.html)

<comment><USER11> I'm very tempted to try that, but this warning in the docs you linked sounds pretty scary:

> Placing a tablespace on a temporary file system like a ramdisk risks the > reliability of the entire cluster

Are you sure putting your test db on a ramdisk won't destroy the development db too?

<comment><USER10> The idea is, since it's a development db, after you destroy it, you can recreate it easily.

But there is a way to do it without destroying the db. When you're finished, stop postgres, copy the files off of the ramdisk, and then you can destroy the ramdisk. When you want to start it back up, create the ramdisk, copy the files back, and then start postgres.

Obviously something like MySQL's memory tables would be a better solution.. but postgres doesn't have anything similar. So this is as close as you can get.

<comment><USER11> Thanks for writing back! I don't love either of those options. Maybe I should just make a separate _cluster_ for my test database?!: `initdb -D /pgramdisk` I wonder if anyone has tried this, and what the drawbacks are.

</comment></comment></comment></comment></comment></comment></comment><comment><USER12> Genuine question : why is this on HP's website ? Are they a Postgres contributor or use it massively internally ?

<comment><USER13> They have big enterprise software and consulting businesses.

</comment></comment><comment><USER14> Official Wiki: [https://wiki.postgresql.org/wiki/What%27s_new_in_PostgreSQL_...](https://wiki.postgresql.org/wiki/What%27s_new_in_PostgreSQL_9.5)

</comment><comment><USER15> What's the easiest way to try out an alpha version of postgres? I can't find a ubuntu or homebrew pacakged build of it... easiest to build it from source?

 _edit_ : seems like the alpha release is available on the downloads page now: [http://www.postgresql.org/download/](http://www.postgresql.org/download/)

<comment><USER16> Building Postgres from source for testing is relatively simple - at least on Ubuntu / Debian.

        useradd --home-dir /home/postgres \
            --create-home --shell /bin/bash \
            --user-group postgres

        apt-get install -y build-essential libkrb5-dev \
            libxml2 libxml2-dev libxslt1-dev \
            libossp-uuid-dev uuid python-dev \
            libreadline6 libreadline-dev

        ./configure --disable-debug --enable-thread-safety \
            --with-gssapi --with-openssl \
            --with-libxml --with-libxslt \
            --with-ossp-uuid --with-python \
            --without-bonjour

        make world && make install
        sudo su - postgres -c "/usr/local/pgsql/bin/initdb -D /home/postgres/cluster -E UTF8"

<comment><USER17> > "Relatively simple - at least on Ubuntu / Debian"

I realize we're all professionals here and technical know-how is expected, but nothing about this is "simple". Brings me PTSD of working w/ academics' alphabet soup of "open source" simulation code written in C, Perl and Makefiles.

Build tools have come along away, maybe not with vanilla Postgres installs, but I guess that's what DBAs are paid to know these days.

<comment><USER18> I honestly don't see what's so hard about the gp's set of instructions. Your grandma doesn't need to install alpha builds of PostgreSQL (though I shouldn't assume, there are some technical grandmas out there ;) ), for 99% of people out there they can use "apt-get" or "yum" or whatever and can wait until the release.

So let's turn this around, how would you _like_ to see builds become easier?

<comment><USER17> I was cranky earlier, I just want better documentation. Postgres has slowly gotten better about this over the years.

</comment></comment></comment></comment></comment><comment><USER19> honestly who still produces PDF in A4 for content which 99% of a time will be read on a screen ...</comment>


Ottawa man sending free sanitizer - <AUTHOR> https://handsan.ca/ <comment><USER2> I'd be happy to contribute but he offers nothing but a Canada-only method (Interac e-Transfer). Shame.

<comment><USER3> I'd be happy to act as a middleman and Interac it to him. Email firstname.lastname@example.com if you want to figure that out. You'll have to trust me though.

</comment></comment><comment><USER4> So inspired by the philanthropy I've been seeing lately as we navigate this pandemic.</comment>


Ballmer: Apple has not produced a product that customers use - <AUTHOR> http://www.tuaw.com/2012/10/29/ballmer-apple-has-not-produced-a-product-that-customers-use/ <comment><USER2> I'm getting tired of Mr. Ballmer opening his mouth and being so laughably wrong. He's a smart guy, I can only assume that he's preaching to the choir, namely Microsoft employees that must be exhausted and demoralized by the success of the tablets that are threatening to disrupt another huge chunk of the Microsoft Windows Tax.

I remember him laughing at the MacBook Air: "Where's the DVD dive?" he asked. As if anyone except MPAA executives want to carry DVDs anywhere.

<comment><USER3> It's also entirely possible that he's like the Detroit Auto manufacturer higher-ups in the 1970s - 1980s. They got no input from outsiders (a.k.a. their community was in-bred), and mechanics fixed the exec's cars every day while the execs worked. Apparently the auto executives thought that everything was OK, and that the stuff they read in newspapers was just whining.

Maybe Ballmer only uses Windows. He's got a tech support guy that just fixes things, and the support guy is really good. Ballmer lives and works with people who only use Windows, with maybe the token Apple Fanboi in the social circle existing just to provide comic relief.

Communication is only possible between equals, and only MPAA/RIAA C-levels, and Senators are Ballmer's equals. Ballmer exists in a bubble.</comment></comment>


Should tech recruiters learn to code? - <AUTHOR> http://rosario.io/2014/01/07/should-tech-recruiters-learn-to-code.html

<comment><USER2> Honestly, no they shouldn't. It's not their job to know how to write code, or how to design websites. It's their job to hook people who are looking for employees up with people looking for jobs. Do they get it right every time? No they don't. But neither do developers or CEOs. Do tech recruiters need to know the difference between a set of technologies so that they can serve their clients better? Absolutely. Should their contacts be based on more than keyword searches? Yes. Do they need to know how to write code? No

<comment><USER3> > Honestly, no they shouldn't.

If the only thing they know about the difference between HTML and CSS is that one is spelt H-T-M-L and the other C-S-S, then what skills do they bring to the process?

</comment></comment><comment><USER4> I think it would be nice if tech recruiters knew how to work computers. You may think I'm exaggerating, but I'm really not.</comment>


Lexus just unveiled what it calls a real, working hoverboard - <AUTHOR> http://mashable.com/2015/06/23/lexus-hoverboard/?utm_cid=mash-com-li-pete-link <comment><USER2> Judging from the steam pouring out of the contraption, it would seem they're using superconducting electromagnetics. I don't imagine you'd get more than 15 minutes before it needed to be 'recharged'.

Also, depending on it's operation, it may require an agreeable surface beneath the board (some form of metal or metal composite).

Edit: visited the Lexus site. Yes, it's superconductivity. So, you need to keep your magnets in a very, very cold state for it to achieve its quantum levitation. Unfortunately, you're not likely to be able to do stunts on this board.

</comment><comment><USER3> As much as hope its not just a PR stunt.. it probably is.</comment>


How long is your mobile app hot fix process? - <AUTHOR> At my employer even the most horrible disaster of an app/playstore store release can take a minimum of 1-2 weeks before being approved to replace a nightmare release. If you work at a company that releases native mobile apps (either platform) how long does it take for you to push a hot fix? <comment><USER2> Playstore process was fast, almost immediately. App store at best take 1-2 days even on expedition, and number of expedition is limited per year.

source: am iOS developer, screwed up few times.</comment>


An experiment in iAd - <AUTHOR> http://blog.metarain.com/post/83086723160/an-experiment-in-iad <comment><USER2> 25 downloads on 1 million impressions. Damn, that's sad.

<comment><AUTHOR> It used to be much worse. Read this [http://rayvinly.com/iad-workbench- campaign-performance-analy...](http://rayvinly.com/iad-workbench-campaign- performance-analysis/)

Compared to other mobile Ad networks is this bad?

Remember this is not taps, this is actual downloads...

<comment><USER3> Yes, compared to other mobile ad networks this is bad. People aren't rocketing up the install lists by having their $10 a day budgets not being filled.

> We chose to run the ads on apps from the following categories: Photo & > Video, Social Networking, Entertainment, Games, Food & Drink and Utilities.

Those are some of the very largest targets you can have. Apple was unable to provide enough impressions to meet $10 a day.

<comment><AUTHOR> Agreed. The thing is that after they have put the price to 50 USD it incentivises indie developers to test it out, which intern results in a higher fill rate for the apps. I think this is just a start, maybe there is a lot more.

Just a question is the CPA also really bad compared to the other ad networks?

<comment><USER3> It doesn't seem bad, but the CPA doesn't really matter if they can't fill. If Apple is leaving money on the table that means they just don't have the impressions (which is believable, you don't see iAds in a lot of apps).

It could also be a targeting problem (they don't know who is most likely to download), but iOS users are pretty app happy so I would imagine this is the easiest type of ad to convert with. Apple has a huge advantage here as the control the whole ecosystem and are the only ones in the world who can optimize the App Store. Just 25 installs after 1,702 taps for a free app with good reviews seems depressingly low.

</comment></comment></comment></comment></comment><comment><USER4> I feel like there's so much negative I've heard about iAd, but this is the first real feedback I've ever seen on the tool. Now that they've reduced the minimum spending cost it seems like we should start seeing more soon.

I'm interested to know if anyone has any experience from the developer side, how iAd compares to non-native Ad services within iOS apps. What is that experience like?

</comment><comment><USER5> They used to ask a million dollar minimum spending? That's insane, right?

<comment><USER6> No, it's perfectly reasonable.

They wanted to jump start the service with few select big clients, like Nike, Coca Cola, Disney etc.

For those kind of companies, 1 million for an ad campaign in a major mobile platform is small change.

<comment><USER3> Except that didn't happen and they had no ads to run on their highly touted network. If you want to jump start the service with a few big fish you sign deals with a few big fish. You need to have ads to fill inventory or there will be no inventory to sell.

<comment><USER6> > _Except that didn 't happen and they had no ads to run on their highly > touted network._

Nope, it did happen. When they started it they had quite nice rooster of collaborating companies, and quite good conversion rates. At some point, they had 15% of the mobile ad market.

Plus, they didn't just go from 1M to $50 because nobody came to them at $1M. That was the inital price back in 2010, and just for the launch. Afterwars it was a gradual progress of opening the service and letting more advertisers in (went to $500,000, then to $100,000 etc)

<comment><USER3> > Plus, they didn't just go from 1M to $50 because nobody came to them at $1M. > That was the inital price back in 2010, and just for the launch. Afterwars > it was a gradual progress of opening the service and letting more > advertisers in (went to $500,000, then to $100,000 etc)

Sounds like a roaring success!

<comment><USER6> > _Sounds like a roaring success!_

Or a gradual rollout.

Why assume their intention was to only catter to $1M customers and leave all the long tail untapped?

</comment></comment></comment></comment></comment></comment><comment><USER7> Thanks for sharing. I hope you follow up later when you scale your campaigns.

<comment><AUTHOR> Definitely plan to</comment></comment>


Ecuador Grants Assange Citizenship - <AUTHOR> https://www.nytimes.com/2018/01/11/world/europe/julian-assange-ecuador-embassy.html <comment><USER2> I had a hard time understanding from the article how this solves anything.

<comment><USER3> It doesn't, it just highlights how politics makes a mockery out of "justice" \- if you are still naive enough to believe such a thing exists.

Although it is interesting to see that Ecuador doesn't seem to be bowing to pressure from certain other large countries - we don't know how much pressure there is, but good for them in any case!</comment></comment>


How to get as much energy out of caffeine as possible - <AUTHOR> http://alifeofproductivity.com/get-more-energy-out-of-caffeine/ <comment><USER2> I get very severe caffeine crashes and I'm glad to see someone acknowledge them.

In my personal experience, after abstaining for a while, I only get a few days where the high outweighs the crash. I believe I'm best overall off caffeine.</comment>


Extreme Bitcoin Mining Aids an Unexpected Revolution in Iceland - <AUTHOR> https://www.bloomberg.com/news/articles/2018-07-03/extreme-bitcoin-mining-aids-an-unexpected-revolution-in-iceland <comment><USER2> >Island became a magnet for the practice once miners figured out that the place is very _cold_ and that electricity there -- geothermal and hydropower -- costs a lot less ...

This is the next big frontier in data center advancement, imo -- submerged/frigid data center installations. Microsoft's already been playing around with a submersible data center under a project codenamed 'Natick,' while piggybacking off of its extreme portability and flexibility in terms of resources toward R&D, and it's just getting started. Google has already announced plans to do the same. [1]

It also makes sense from a scale/growth standpoint as 50% of earth's population lives within 2 hour drive from their respective coastlines. [2]

[0] [https://natick.research.microsoft.com/](https://natick.research.microsoft.com/) [1] [https://www.citylab.com/life/2016/02/microsoft-cloud- ocean-p...](https://www.citylab.com/life/2016/02/microsoft-cloud-ocean- project-natick/459318/) [2] [http://scienceblogs.com/gregladen/2011/10/18/how- many-people...](http://scienceblogs.com/gregladen/2011/10/18/how-many-people- live-near-the/)

<comment><USER3> > Google has announced plans to do the same.

Citation needed? IMHO putting a datacentre under water is a horrible idea, why not pump the water 10 meters higher and cool a DC near the shoreline?

<comment> Const-me Continuously pumping sea water is expensive to maintain, the primary reason being marine biology. I once saw mussels grew inside a boat engine.

Second reason, land on shorelines is expensive. Many people dream about living on a seaside (except for people who did, practically speaking the idea is not that great, humidity, noise). Also many other businesses require shorelines, beaches, marinas, ports.

<comment><USER4> Pumping water from a lake seems more reasonable..

</comment></comment></comment></comment><comment><USER5> Stuff like this worries me. We should be doing everything we can to curb the energy and heat we produce and instead we're using vast amounts of energy to basically waste trillions of CPU cycles so that we can produce digital money that might never actually be worth anything. It's just about the most pointless use of planetary resources I can think of

<comment><USER6> Why? Doing anything of value requires expending of energy and producing heat, this is unavoidable. Saying that this activity is pointless just because you are not seeing any value does not mean that it is actually pointless. In general anything that people are willing to pay money for is not pointless for someone, otherwise that money would be spent on something else. It is like saying why a farmer needs to drive that big tractor down the field using precious (for whom?) oil and polluting the air whereas I can do things manually on my pea patch just fine. If anything we should welcome higher and higher energy use because it means higher standard of living for the humankind. And just to address 'waste' here, energy is not free so 'waste' that actually wastes resources cannot go on for long lest the waster goes bankrupt.

<comment><USER7> >anything of value

Bitcoin's value (not price, mind you) is still very questionable.

<comment><USER8> There are 21,000,000 bitcoin ever ever ever.

If you can see that, you can begin to exclude yourself from fiat money which requires centralized control of currency.

I trust rare numbers more than I trust the United States government.

<comment><USER5> > I trust rare numbers more than I trust the United States government

That's such a silly statement. Rare numbers do not control the value of bitcoin, the market does. Your rare number might be worth half what it was in December 2017, and twice what it was a year before that. Tomorrow it might be worth nothing. Or $1000. Or $1. The rareness of the number is about as relevant as the colour of the dollar

</comment></comment></comment></comment></comment><comment><USER9> What we have with deep learning is the first data center application for lots of compute with high latency. This will enable data centers in locations previously infeasible.

<comment><USER10> Iceland isn't really high latency. In many ways it is perfect for serving Europe and east coast US from one place (if required).

<comment><USER11> Iceland also has sovereignty and very favorable geography. (Being surrounded by oceans makes it easy to remain fairly neutral.) If I were the government of Iceland, I would issue a cryptocurrency.

<comment><USER12> If you are a government, why would you issue a cryptocurrency? Why not issue a more more traditional digital currency with a central ledger?

<comment><USER13> A government would be responding to customer demand.

Sure, they could create a centralized digital currency. But the market might not want to use that, so what's even the point of spending all this effort making it in the first place.

Whereas a decentralized currency has features that sounds me customers want.

<comment><USER14> Currently, demand for cryptocurrencies seems indistinguishable from zero. At the same time, demand for government issued centralized money is quite large.

<comment><USER11> History has seen rapid changes in the demand for government issued money.

<comment><USER14> The word "rapid" on that phrase was an entirely different meaning from when it's used to describe the rate of change of cryptocoins demand.

A large market is a more stable market. Crypto may get large at some point (I don't see why they would, but I don't see everything), but today they are nothing. Thus, preaching that people massively want them is nonsense.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER15> One hope I have for the Bitcoin mining bubble is that it will indirectly subsidize improved information systems infrastructure in many remote places as well as improved on-demand chip fabrication services. Once the bubble is gone those things will go to more productive use.

<comment><USER16> I've spoken to people who've been in the community for a long time and they seem to view the blockchain hype as something generated to get banks to underwrite the updating of systems that have barely been maintained since the 80s.

(Despite it not being really necessary for like 95% of problems, of course.)

<comment><USER15> I doubt it was deliberately engineered as such but it does seem to be having that effect.

It's also disrupting international wire transfers and venture capital, two antiquated industries ripe for it.

<comment><USER17> You must be delusional to think Bitcoin disrupts SWIFT. [https://economics.stackexchange.com/a/9184/18775](https://economics.stackexchange.com/a/9184/18775)

> SWIFT handles about $5 trillion per day,

> SWIFT payment message volumes are usually around 11.5 million per day

Now, daily Bitcoin-USD traffic is below a billion [https://www.blockchain.com/en/charts/trade- volume](https://www.blockchain.com/en/charts/trade-volume) and even at its heyday it was five billion give or take. That's 0.1% of SWIFT. And Bitcoin couldn't handle more than 600k transactions a day even if it tried and these days it's 150-200K [https://www.blockchain.com/en/charts/n-transactions](https://www.blockchain.com/en/charts/n-transactions) which almost reaches 2% of SWIFT...

Also, it's unusable for legit business transfers since you absolutely have no idea how much money the other ennd receives.

SEPA has higher volumes but lower values [https://www.ebaclearing.eu/services/step2-sct/statistics/](https://www.ebaclearing.eu/services/step2-sct/statistics/) but even that lower value is a magnitude above Bitcoin -- worldwide. With SCT Inst it even beats the transfer speed of Bitcoin.

<comment><USER18> Agree -- the major players already know their customers, so they are more interested in distributed ledger than blockchain. A distributed database with ACID transactions is a more flexible way to implement this stuff: [https://blog.fauna.com/distributed-ledger-without-the- blockc...](https://blog.fauna.com/distributed-ledger-without-the-blockchain)

<comment><USER19> Blockchain is a form of distributed ledgers.

</comment></comment></comment></comment></comment></comment><comment><USER20> I liked this analysis of the situation from when the Bitcoin Miners came to Washington State for the same reason:

[https://twitter.com/patio11/status/1000966967056941056](https://twitter.com/patio11/status/1000966967056941056)

 _" We are going to place a point-of-presence for an intrinsically global network, hardware and a skeleton crew, in your geographic territory for as long as you're the dumbest power provider in the world."_

 _"..."_

 _" If you're not that dumb say so, I have a list."_

</comment><comment><USER21> > Iceland estimates the industry will consume more than 100 megawatts by the > end of the year.

All this energy wasted mining a virtual currency that no one uses.

We have to ask ourselves: is Bitcoin mining really the best use of our resources? Is it worth adding to our already engorged carbon footprints?

<comment><USER22> Isn't that the benefit of Iceland - That there is no (or significantly) carbon footprint?

</comment></comment><comment><USER23> Well if they hope to succeed, they better start the long process of laying down some more fiber connections to the rest of the world. They have to go through Greenland or Europe to get the US.

[https://www.submarinecablemap.com/](https://www.submarinecablemap.com/)

</comment><comment><USER24> I have been wondering, why hasn't Apple, Google, Microsoft, Facebook, Amazon built DC in Iceland?

To avoid the risk of volcanic eruption?

<comment><USER25> The main reason is latency - makes more sense to build a datacenter in the UK or Northeast North America as that would reduce the average latency for more people. The domestic need for a massive datacenter is also rather small.

<comment><USER24> Apple, Facebook , and Microsoft are all building or had Massive Datacenter, at least one or two somewhere in EU and US. Likly for Storage and other non latency sensitive application. But none of them choose Iceland, where Electricity is clean and cheap.

<comment><USER26> Iceland has no direct optic cable connection with the US[1].

[1] [https://www.reddit.com/r/MapPorn/comments/73ekox/map_of_unde...](https://www.reddit.com/r/MapPorn/comments/73ekox/map_of_underwater_cables_that_supply_the_worlds/)

<comment><USER24> arh. thx

</comment></comment></comment></comment></comment><comment><USER27> "looking past the faddishness of cryptocurrencies". Bitcoin is an excellent proof of concept for blockchains but I sold mine some time ago because of the ethical issue I have with Bitcoin mining consuming so much power. Some of the newer coins are much more efficient in terms of consuming power. To refer to cryptocurrencies in general as a fad though is very naive and sounds more like central bank desperation.

</comment><comment><USER28> So.. the article concludes that they're "Building Knowledge" on how to maintain data centers housing racks of servers and ASICs doing mining/blockchain work? I wonder if the same argument could be made for the adult content industry, that, for better or worse, has been pushing the barriers of compute and bandwidth since the dawn of the dotcom era.

</comment><comment><USER29> So... bitcoin miners in Iceland _aren 't_ using ASICs?

<comment><USER30> Remember the Gell-Mann amnesia effect. All Bitcoin mining is done with ASICs but some other cryptos use GPUs. Many industrial-scale miners use both, I guess for diversification.

</comment></comment><comment><USER31> "After devouring nearly as much energy as all of Iceland's households combined, Bitcoin miners may be about to return something to the community that's housed them." Implication is that the miners do nothing for Iceland? Seems unlikely. They're probably incorporated businesses paying taxes and injecting wealth into local economy through payroll and other expenses. Why is Bloomberg anti-bitcoin?

<comment><USER32> "They're probably incorporated businesses paying taxes and injecting wealth into local economy through payroll and other expenses."

What evidence do you have of this? In other areas where this happens, like up by the hydroelectric dam in Washington State, this very much does not happen, and in fact, many mining operations are illegally attaching to the grid.

[https://www.politico.com/magazine/story/2018/03/09/bitcoin-m...](https://www.politico.com/magazine/story/2018/03/09/bitcoin- mining-energy-prices-smalltown-feature-217230)

</comment></comment><comment><USER33> post-bitcoin? fadishness? Bitcoin "probably won't be here far into the future"

When I am interested in the predictions about the future of bitcoin... my first thought is not to ask a "business development manager at the HS Orka power plant in Iceland"

Lol... sales people, in particular, have no credibility about predicting the future... It's always what they are selling.

</comment><comment><USER34> >Bitcoin "probably won't be here far into the future" said Johann Snorri Sigurbergsson

Seeing as this guy -- who could make reams of money[1] if he's an accurate price predictor by shorting bitcoin by buying deep, out-of-the-money puts -- isn't rich by doing so, indicates he's inept at making price predictions.

[https://99bitcoins.com/bitcoinobituaries/](https://99bitcoins.com/bitcoinobituaries/)

[1] If bitcoin's price catastrophically collapses, a put option would yield ~1,000 _X_ / 100000% returns.

<comment><USER35> "The market can remain irrational longer than you can remain solvent."

<comment><USER34> That's not how options work and it's precisely _why_ options exist: to purchase value in domains which are extraordinarily rare without the delta exposure of leveraged spot-shorting.

The premium:payout ratio of such a trade requires him to be right only _once_ in 5-10 years for him to walk away profitable.

<comment><USER36> > That's not how options work and it's precisely why options exist: to > purchase value in domains which are extraordinarily rare without the delta > exposure of leveraged spot-shorting.

Yo, Options have Theta-decay. Push options too long, and all your money decays away.

[https://www.dough.com/blog/speaking-greek-theta-decay- time-d...](https://www.dough.com/blog/speaking-greek-theta-decay-time-decay)

Seriously, don't just... buy options without understanding the risks. You can MITIGATE Theta-decay by rolling over your options to longer-and-longer terms, but it requires maintenance, and you still lose out on money each time you roll options over.

<comment><USER34> >Push options too long, and all your money decays away.

Assume you let all options expire OTM the following still holds:

>The premium:payout ratio of such a trade requires him to be right only once in 5-10 years for him to walk away profitable.

Minimizing theta exposure extends that duration.

<comment><USER36> If you buy a put option, someone sold that put option to you. Only one of you will be correct, and one of you has theta-decay (while the other person benefits from theta-decay).

That's how the options market works. Someone pays theta-decay for the long- tail chance of hopefully being right sometime in the next year or two... while someone else collects that theta-decay over time.

Its insurance, plain and simple. Sometimes, the insurance company wins, and sometimes the buyer wins.

\</comment></comment></comment></comment></comment></comment><comment>-----

But with any trade, there's the other side. If you go long-put, someone else has decided to go short-put against you. Your final bet is that the short-put giver will actually give you the money when you win your bet.

And that's a bet within the BTC market I don't believe in. Too many BTC markets have gone kaput, I'm not trusting anyone in this market.

<comment><USER34> Bringing up theta seems to be tangential to your concern: Solvency. Delta & Gamma have more applicability to solvency issues than theta

<comment><USER36> I'm avoiding Delta and Gamma mostly because its clear that you understand those issues. Or at very least, I haven't seen you write anything that warrants me correcting you with regards to Delta / Gamma.

Also, Delta and Gamma are the causes of big-swings. So I think most people fear those and give them appropriate amount of respect.

Theta on the other hand is the difficult one. Option sellers collect the pennies in front of the steamroller, while option buyers are hoping that they're right eventually. Typical human psychology doesn't really handle this case very well, on either side.</comment></comment></comment>


How to Measure Planck's Constant Using Lego - <AUTHOR> http://www.technologyreview.com/view/533401/how-to-measure-plancks-constant-using-lego/

<comment><USER2> Nice trick, to cancel the e^2 from (h/e)^2 and h/e^2 to give h, and do it a way accessible to a basic laboratory.

The interesting thing about h/e^2 as Hall resistance is that it's an off- diagonal term in the Onsager matrix, while here it is used to balance a diagonal term i.e; work.

Equally nice is to consume Newton's gravitational constant in g, the acceleration due to gravity, because somewhere the mass needs to come out, and there is no mass in the Maxwell equations. The Planck voltage sqrt(G _e^2 /(h_c^5)) is very small (compared with electrochemical potentials): 3.3e-29 Volts.</comment>


Why I'm Betting on You to Help Shape the New American Economy - <AUTHOR> https://medium.com/@PresidentObama/why-im-betting-on-you-to-help-shape-the-new-american-economy-e80a775b44ee

<comment><USER2> An obvious election pitch, but interesting nonetheless.

For context, the Wall Street Journal's (unpaywalled) 'day in history' has 3 front pages from 6 years ago right now, which was when the stock market fell off a cliff: [http://blogs.wsj.com/wsj125/2014/10/08/oct-9-11-2008-crisis-...](http://blogs.wsj.com/wsj125/2014/10/08/oct-9-11-2008-crisis- on-wall-street/)</comment>


Boys Will Be Boys: Gender, Overconfidence and Common Stock Investment [pdf] - <AUTHOR> http://faculty.haas.berkeley.edu/odean/papers/gender/BoysWillBeBoys.pdf Modern financial economics assumes that we behave with extreme rationality; but, we do not. Furthermore, our deviations from rationality are often systematic. Behavioral finance relaxes the traditional assumptions of financial economics by incorporating these observable, systematic, and very human departures from rationality into standard models of financial markets. Overconfidence is one such departure.
Models that assume market participants are overconfident yield one central prediction: overconfident investors will trade too much. ...
Men trade more than women and thereby reduce their returns more so than do women. Furthermore, these differences are most pronounced between single men and single women. <comment><AUTHOR> _Modern financial economics assumes that we behave with extreme rationality; but, we do not. Furthermore, our deviations from rationality are often systematic. Behavioral finance relaxes the traditional assumptions of financial economics by incorporating these observable, systematic, and very human departures from rationality into standard models of financial markets. Overconfidence is one such departure. Models that assume market participants are overconfident yield one central prediction: overconfident investors will trade too much.

...

Men trade more than women and thereby reduce their returns more so than do women. Furthermore, these differences are most pronounced between single men and single women._

<comment><USER2> So: how might we generalize/extend this research to the benefit of HN readers?

Are startup/financing decisions also made more (too?) often by males than females?

Or: might men be more likely to err on redirecting/retooling efforts and women to err on the side of hanging in there when the going looks tough?

Even without any research, the one generalization that _might be worth_ considering for startups: some gender balance might provide useful perspective on company directions.</comment></comment>


How do I humanize my startup? - <AUTHOR> http://pastebin.com/HzQneevm

<comment><USER2> I do not know what are you writing about, but in the first place, you need challenging subjects that worth to be debated. Then, check the profile of your user that's coming in. Is the user only look for information, and than leave? Is he landing there but the content he is looking for is not what he needs? Checked the analytics? Installed a heat map - recording user interaction script to see how they behave on the page?

And since you already have some early adopters, have you also asked them why they do not interact with what you write? :)</comment>


Ask HN: What self-hosted shopping cart should I buy to do easy A/B testing? - <AUTHOR>

My store uses Prestashop which has worked well for an open source shopping cart but we've always had wonky Google Analytics conversion tracking issues.
We need a shopping cart that allows for quick and painless A/B testing. It seems like Shopify has this feature ( http://blog.shopify.com/2010/3/22/test-test-test-more ) but I'd much prefer to host the website myself without paying a % of revenue.
What's the best shopping cart I can buy and host myself? Or, are the 3rd party hosted solutions vastly (or somewhat) superior? <comment><USER2> I'd highly recommend Spree (<http://spreecommerce.com/tour>). It's based around the payment processor that Shopify uses, and it supports a lot of the more advanced Google Analytics features.

</comment><comment><USER3> This is a good quality PHP, self-hosted A/B testing system. It's free and it works well.

<http://robisit.com/8n>

This is a very flexible way to accomplish A/B testing and since everything is hosted on your own site, you don't need to worry about any other variables finding their way into your tests such as additional load time. It integrates seamlessly with Google Analytics and can perform true multi-variative testing.

<comment><USER4> is there any specific reason that you dont link to the site [1] directly but instead use some sort of redirect using (possibly) your own domain (8n=hn i guess)?

<http://phpabtest.com/>

<comment><USER3> I use Yourls on my domain to shorten and track links. I was curious to see how many folks would click through. It's my first comment here on HN (long time lurker). No real motive behind it other than just for fun to see if anyone cared what I said. I find myself hitting the "shorten" button the majority of links that I post online not only to see if folks are interested in what I've said, but so that if I make a mistake, I can correct it. 8n is just the next random sequence that was generated.

Of note, the Firefox addon LongURL (<http://longurl.org/>) is a great thing to have if you're at all nervous about shortened URL's.

</comment></comment></comment><comment><USER5> Magento integrates with google analytics A/B testing.

<comment><USER6> the only problem with Magento is the fact it is overengeneered! And once you decide to work on it yourself, you will find out no documentation, no community support, etc.

But if you like to model everything - you will like digging in it's code. Just do not forget primary reason you installed magento - sell something to client ))))

<comment><USER7> I'm with you on the community thing... I mentioned how slow and bloated Magento is on their forums and was told to go and buy a faster server.

<comment><USER8> Yea.. That is the solution sometimes.. but on a fresh install it's total garbage. I understand what they are trying to do, and it's great, but the learning curve is stupid retarded in my opinion. And without a coupon system in the free version it's worthless. But that's besides the point.</comment></comment></comment></comment>


Twitter Fact Checks Trump - <AUTHOR> https://mobile.twitter.com/realDonaldTrump/status/1265255835124539392 <comment><AUTHOR> I for one applaud twitter for doing this! Bravo!! It's an extraordinary move By twitter and I hope the don't back down. The tool that made him president (by his own acknowledgment in a FT interview from 2016) is now no longer susceptible to sprerad his bullying and lying tactics.

I think What will follow will be equally extraordinary - an attack by trump That will shock the American public and in turn will establish new lows For a presidents behavior for American politics

</comment><comment><USER2> Previous discussion: [https://news.ycombinator.com/item?id=23317286](https://news.ycombinator.com/item?id=23317286)</comment>


Shoco – a fast compressor for short strings - <AUTHOR> https://ed-von-schleck.github.io/shoco/ <comment><USER2> Also posted a few hours ago at [https://news.ycombinator.com/item?id=10060018](https://news.ycombinator.com/item?id=10060018) .</comment>


Question About Intellectual Property - <AUTHOR> I am a college student and just started my first venture project. What are some ways that I can get patent and trade mark my intellectual properties?
Also, when would it not be necessary to have my app or service trademarked? - Because things like  facebook or youtube can be easily duplicated <comment><USER2> You should contact a lawyer to answer these kinds of questions.</comment>


Can one stumble over a bot? - <AUTHOR> http://meta.stackoverflow.com/q/114271/155556

<comment><USER2> I was just recently wondering what will happen to all Internet discussion when bots reach the level of intelligence that it becomes difficult to separate them from humans. Just the thought that other participants might be bots will pretty much diminish most of the community value that any website like HN could have.

Or does it matter? Is it satisfying to converse with bots if they (seem to) have human level intelligence?

<comment><AUTHOR> It seems like it is ^_^.

Sometimes I get quite funny responses :-D</comment></comment>


11% case fatality rate observed in 2019 novel coronavirus cases [pdf] - <AUTHOR> https://marlin-prod.literatumonline.com/pb-assets/Lancet/pdfs/S0140673620302117.pdf <comment><AUTHOR> Officially published in The Lancet today: [https://www.thelancet.com/pb- assets/Lancet/pdfs/S01406736203...](https://www.thelancet.com/pb- assets/Lancet/pdfs/S0140673620302117.pdf)

Moderator: feel free to update the link to point to thelancet.com</comment>


Redesigning Shakespeare - <AUTHOR> https://blog.crew.co/manuja-waldia-interview/ <comment><USER2> Love this. It's awesome to see something that's been around for hundreds of years and been so many people's gateway drug into the arts get a much needed facelift.</comment>


Why Code - <AUTHOR> http://andrewbadr.com/log/4/why-code/

<comment><USER2> Nice. I tell this to my 14 year old brother all day. He seems interested but is easily distracted too (you know the stuff that you do at this age!) :)</comment>


After $620,000 theft, another Bitcoin service shuts down - <AUTHOR> http://www.theverge.com/2014/3/4/5469924/after-620000-theft-another-bitcoin-service-shuts-down

<comment><AUTHOR> I don't like to repeat a previous comment but it is relevant to this discussion - just a few days ago, I wrote:

The number #1 requirement for a currency is trust and confidence in it. Why would anyone trust a currency which has no consumer protection whatsoever and provides zero recourse for when things inevitably go wrong?

What I mean is, everyone is hating on Mt. Gox but conceivably what happened to them can happen to any of the exchanges out there now. There is no mechanism to prevent it and there is no recourse for users when it does.

This is why bitcoin is interesting as a protocol but a non-starter when it comes to being a true currency. A currency requires backing by a central authority. No amount of code can make up for that.</comment>


Growth Ranker – Top-growing products on Indie Hackers - <AUTHOR> https://www.growthranker.com <comment><USER2> Do people really care about indiehackers? Only emails I receive from them are very rock-bottom bad websites created with codecanyon scripts. They are possibly paying indiehackers to expose those sites via email blast and their blogs. Not even one project from there looked good so far.

<comment><USER3> Indiehackers sounded like a group of people I could relate, but after I looked at that site I had the impression it's full of "I can't code but wanna make big moniez with tech"-hustlers....

<comment><USER4> To be fair, your customers rarely care what the code your product is written in is like.

They just care it provides the value they're looking for.

<comment><USER3> Sure thing.

But I wanted a community for devs that want to become entrepreneurs and not for random dudes that want to make money at all costs.

Some people like me, that have the same problems, some people I coule relate to.

</comment></comment></comment></comment><comment><USER5> Last 30 days is kind of a bad metric for growth, especially for B2B apps where Q4 can be kind of brutal. Would be cool if they did "all time" or something more encompassing (and had other sources aside from IH).

FWIW I run browserless, which is on IH, and has been growing pretty steadily: [https://www.indiehackers.com/product/browserless/revenue](https://www.indiehackers.com/product/browserless/revenue)

EDIT: Might also be cool to see growth in terms of customer growth vs MRR

<comment><USER6> You run browserless?

Gotta say, your customer support is top notch. I asked a question on a Saturday evening and got a response 15 mins later. I was stunned!

<comment><USER5> Thanks! I try and be responsive as possible -- I know how painful it is to sit and wait for a response. Appreciate your comment!

</comment></comment></comment><comment><USER7> I think Indie Hackers is great but the best content you can get is the content you never got because you were too busy shipping.

Therefore I think that ranking and tracking what other people are shipping does nothing remotely useful. Maybe good for an entertainment, though.

</comment><comment><USER8> What are they using to determine revenue of the companies?

<comment><USER9> The source is IndieHackers which is owned by Stripe. I'm assuming the startups must register and opt-in to have their revenue numbers published?

e.g. [https://www.indiehackers.com/product/tettra/revenue](https://www.indiehackers.com/product/tettra/revenue)

<comment><AUTHOR> Yeah, you need to connect to your Stripe account when you create your product page on IndieHackers for it to track revenue.

<comment><USER10> Why would you want IndieHacker to track your revenue? I would thought that Stripe would provide the necessary information already.

</comment></comment></comment></comment><comment><USER11> This is cool but quite easy to game - all I need is a spare couple of thousand and I can jump to the top of the leaderboard by buying my own products. Of course I'll have to pay stripe's fees but it's probably quite a good ROI if my product's target market are people that read indiehackers.

</comment><comment><USER12> Fun fact: In a round-about way you can estimate how much revenue these products are generating for Stripe if you measure the transaction fees against the reported numbers.</comment>


11% of people under 25 use Instagram for news - <AUTHOR> https://www.bbc.com/news/technology-53050959 <comment><USER2> News about... what? The Kardashians?

It's 25% of 18-24 year olds, according to the story. So, basically people who would never read the WSJ or NYT or New Yorker or The Guardian, or probably even the BBC. Or read anything more than 1-2 paragraphs. That group of 18-24 year olds... you know who they are.

I actually think we should make them stay on IG for 3 years as punishment until they swear they will never go back there. Or maybe just put all the Twitter and IG users into local churches (one on each side of the aisle) and lock them inside until they agree to stop yelling at each other.

#booksrule</comment>


How long do your mistakes bother you? - <AUTHOR> http://www.sebastianmarshall.com/how-long-do-your-mistakes-bother-you

<comment><USER2> I can think of mistakes that I've made that I still get a bit of an internal "sting" from. I think for me, the mistakes last for just about as long as it takes for a success to come replace it. And it's rather topic specific. If it's a business mistake, it's not until that mistake is followed by a business success at which point I've completely forgiven myself for the mistake. So for me, the time cycle is never more than a few months or so. However, in my view, that's too long. I think, reviewing it, learning from it, grieving for about 24 to 48 hours if necessary and then getting back in the game with the same or heightened enthusiasm, but yet poised is what I'm gunning for as my habit for dealing with mistakes, failures and losses.

</comment><comment><AUTHOR> While it is an obvious question, it kind of resonated with me because of a couple of car crashes Ive had recently. Nothing major, just really really stupid ones and both my fault. Both as a result of not checking my surroundings clearly and carefully. I mean they were both different situations but still!</comment>


"No handshakes, please": The tech industry is terrified of the coronavirus [Feb] - <AUTHOR> https://www.vox.com/recode/2020/2/13/21128209/coronavirus-fears-contagion-how-infection-spreads <comment><USER2> I knew a (very, very) prominent VC who hasn't been shaking hands for years (he did fist bumps, kind of funny to fist bump a billionaire).</comment>


AWS EC2 Virtualization 2017: Including Nitro - <AUTHOR> http://www.brendangregg.com/blog/2017-11-29/aws-ec2-virtualization-2017.html <comment><USER2> Turns out Nitro is not only an improved KVM but also work exclusively with their Nitro Custom Silicon. [1]

And we are finally here, the true cloud, elastic computing with little to no performance overhead.

[1]: [https://www.theregister.co.uk/2017/11/29/aws_reveals_nitro_a...](https://www.theregister.co.uk/2017/11/29/aws_reveals_nitro_architecture_bare_metal_ec2_guard_duty_security_tool/)

<comment><USER3> We were here back in 2005 with the introduction of Solaris zones, which now live on in SmartOS. Took GNU/Linux "only" 12 years to begin to catch up. This might be new to you, but it's nothing new to those of us who built private clouds back in 2005/2006\. Just don't think it's new because it isn't.

<comment><USER4> You know the author of this piece is Brendan Gregg, right? DTrace author, performance guru, ex-Sun engineer and lead performance engineer at Joyent. And now a full time Linux guy. He doesn't think it's so bad apparently!

<comment><USER3> Yes, I know that; we even corresponded privately. However, call to authority does not magically validate Amazon, nor does it magically invalidate my points. Nothing Brendan wrote contradicts the points either of us made.

<comment><USER5> What is your point, exactly? That we shouldn't care about hardware-backed virtualization because we have zones? That AWS should go home and re-write EC2 to just be zones instead of VMs?

<comment><USER3> _What is your point, exactly? That we shouldn 't care about hardware-backed virtualization because we have zones?_

Yes!

 _That AWS should go home and re-write EC2 to just be zones instead of VMs?_

There is no reason for AWS to exist.

<comment><USER5> Zones aren't a replacement for VMs. With VMs you can have different OSes, for example, which is not generally possible with a zone (you can do some stuff with syscall routing to do this in certain ways, but requires support from the root container). In a zone you can't do a variety of things that require higher level kernel access, like installing custom kernel modules. Zones also have a higher attack surface, which matters quite a lot when you are dealing with a multi-tenancy situation. But I'm pretty sure you knew that already.

<comment><USER3> If you need another OS besides SmartOS for serving data, you have far bigger problems.

Kernel modules are only meant to be installed in the global zone, on the hardware. This is by design. If you need access to that particular device, it can be delegated to that zone with the add subcommand to zonecfg(1M).

Zones do not increase attack surface, I don't know what would make you think that. They reduce the attack surface because one can set up read-only zones, good luck changing anything in there. In a zone, attacker lands in a jail, assuming they actually manage to break in!

What strange times we live in when there is so much misconception. So much knowledge lost! No wonder AWS and Linux rule the day!

Zones are a revolutionary technology in terms of network security. What makes you think zones increase attack surface?

<comment><USER5> Zones increase attack surface compared to a hypervisor because you have a shared kernel, and every syscall is a potential attack surface. Compare that to a hypervisor, which a much simpler API exposed with far less functionality. Hypervisor vulnerabilities are far less common than kernel vulnerabilities for that reason. This is fairly well known in the security space.

In fact, if you look into Joyent, you'll see they don't use regular zones for multi-tenancy, but rather a KVM-inspired hypervisor implementation of zones.

<comment><USER6> SmartOS provides Zones, and if you need it a KVM instance within a Zone.

Hypervisors have their own security issues. They're just programs. That's why there've been all the patching over the years for Xen and for KVM.

Last year, an independent researcher did find an issue related to Dtrace that Joyent patched. However, the security and engineering that backs Zones is way more than with other kernels.

[https://www.joyent.com/blog/dtrace-conf-16-wrap- up](https://www.joyent.com/blog/dtrace-conf-16-wrap-up)

DTrace exploitation: [http://slides.com/benmurphy/deck#/](http://slides.com/benmurphy/deck#/)

[http://benmmurphy.github.io/blog/2017/01/06/arbitrary- kernel...](http://benmmurphy.github.io/blog/2017/01/06/arbitrary-kernel- memory-reads-on-illumos/)

[https://vimeo.com/173300650](https://vimeo.com/173300650)

</comment></comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER7> I wonder what measures are in place in the bare-metal edition to protect themselves from firmware attacks. What protects them from possible attacks against BIOS flash or potentially infect the CPU and HDD chips?

<comment><USER8> There is a Nitro security chip that is integrated into the motherboard. SPI and I2C buses are routed through the security chip. During system reset, the security chip holds motherboard components in reset while firmware is inspected out of band. So all contents of flash are verified.

Local NVMe storage is also handled through our Nitro hardware, and the underlying physical flash devices are protected from firmware modifications.

[https://www.youtube.com/watch?v=o9_4uGvbvnk](https://www.youtube.com/watch?v=o9_4uGvbvnk) provides an overview.

</comment></comment><comment><USER9> Am super curious to see some benches on AWS Nitro compared with GCP's Skylake VMs.

</comment><comment><USER10> This article talks about the underlying technical differences between various classes of EC2 computer... is this documented by Amazon anywhere? I would totally care more about replacing stuff if I knew "ok, there is some new virtualization difference in this new set of machines" that I could analyze against my use cases instead of "I have no clue what if anything is different, other than the pricing is a little different".

<comment><USER11> Some of this is fairly well known if you happen to be quite familiar with Xen.

If your use case is "I don't want to understand Xen", then fine, just use AWS and pick the newest instances, they're usually the best.

AWS does have some words about PV vs HVM here: [http://docs.aws.amazon.com/AWSEC2/latest/UserGuide/virtualiz...](http://docs.aws.amazon.com/AWSEC2/latest/UserGuide/virtualization_types.html)

But really, they don't say much and that's fine. If you just want to run stuff, you probably don't need to understand the deep details of Xen or PV drivers or whatever; the cpu speed, memory, and "disk io"/"cpu credits" they document quite well will be what matters significantly more.

If you are at the scale of netflix, then it does make sense to figure out an extra several percent disk performance.

> I would totally care more about replacing stuff if I knew ... instead of "I > have no clue what if anything is different

They almost always have blog posts accompanying each new instance launch which roughly outline the performance improvements and reasons that instance type is cool vs previous ones, even if they don't go into the depth of virtualization differences so often (which again, usually doesn't matter! for nitro, the C5 blog _did_ talk about the visualization stuff in depth [https://aws.amazon.com/blogs/aws/now-available-compute- inten...](https://aws.amazon.com/blogs/aws/now-available-compute- intensive-c5-instances-for-amazon-ec2/))

<comment><USER10> I knew about PV vs. HVM, as that is documented. However, there is a ton of nuance in this article about every instance type and specific changes to what parts of the system are virtualized (and in particular stuff with EBS, which I stress heavily). I guess you are saying that people need to essentially find all of the old blog posts from AWS to figure out any of this, but why isn't it just documented? I clearly _am_ someone who cares a lot about these things, or I wouldn't have posted the question I did: but Amazon's instances are essentially just black boxes. I am hoping that there is somewhere in the documentation that I don't know about that just shows the differences between all of these instance types in a few centralized pages.

</comment></comment></comment><comment><USER12> Does this allow nested virtualization?

ie the ability to run VMs within an EC2 instance?

<comment><USER13> C5 does not support nested virtualization but i3.metal allows using virtualization technology without nested virtualization.

Both i3.metal and c5 use the same underlying Nitro technology.

<comment><USER14> Wait, so even the "bare metal" i3.metal sits under a hypervisor? It would seem inaccurate to call it "bare metal" in that case.

<comment><USER15> No, Nitro refers to the whole technology stack as well as the hypervisor. *.metal instances utilize most of the Nitro technology stack, but not the Nitro hypervisor.

<comment><USER14> Ah, ok. That makes sense. Thank you for the clarification.

<comment><USER15> You're welcome!

[https://www.youtube.com/watch?v=o9_4uGvbvnk](https://www.youtube.com/watch?v=o9_4uGvbvnk) might be of interest - Matt Wilson talks a lot about the underlying magic of the bare metal instances.

</comment></comment></comment></comment></comment></comment><comment><USER16> How much of this went back upstream to improve KVM itself? Or is all of the nitro work just special sauce on top that they're not required to share?

<comment><USER8> [https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/lin...](https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/log/?qt=author&q=amazon)

</comment></comment><comment><USER17> Can you use a regular AMI on the bare metal instances?

<comment><USER15> AMIs that work on c5 instances should work fine on bare metal instances. NVMe and ENA support will be the big two things you need.</comment></comment>


Show HN: A tool to handle API downtime with 2 LOC - <AUTHOR> https://dev.to/bearer/how-to-handle-api-downtime-with-2-lines-of-code-3nmn <comment><AUTHOR> Author here. Curious about you handle APIs downtime on your side. By APIs, I'm talking about third-parties APIs, like Stripe API, Twilio, Google APIs, etc.</comment>


How the World's Most Difficult Bouldering Problems Get Made (2015) - <AUTHOR> https://www.outsideonline.com/2017711/path-beta-flash-resistance-route-setters <comment><USER2> I think this article doesn't really explain what the setters are focusing on here, and it's actually quite interesting. When setting for a bouldering competition, the problems you create must satisfy very precise constraints: namely, create good separation between competitors, but still be entertaining for spectators. Separation is the hard part. In finals you have a handful of competitors doing a handful of problems, and the perfect separation you're going for is something like this:

        1st place: 4 tops
        2st place: 3 tops
        3rd place: 2 tops
        ...

Of course this rarely ever happens, but it's approximately what you're aiming for. It's hard. You have to know the exact level of the competitors that are participating, and fine-tune the difficulty of the problems so that they will be nicely separated, preferably without depending on height/reach or overly specific strengths. Even world-class setters sometimes fail at this, for example creating a world cup where almost every finalist gets 1 top, leaving only the number of attempts (or zones) to separate them. There's still technically separation, but it's catastrophically frustrating for spectators and competitors, and the results will be less likely to reflect each competitor's actual climbing skill. With all that, you also want the problems to have creative and interesting moves that get the crowd going wild (but that's really the fun part of setting). Source: I'm a routesetter, both regular gym climbs and competitions.

<comment><USER3> > preferably without depending on height/reach or overly specific strengths.

How do you attain this? From an amateur hobbyist eye it seems that bouldering as a sport favours lean + tall builds -> Reach + light-weight advantage. How do you set routes that disadvantage this type?

<comment><USER4> Surprisingly, there's a bit of a bell curve, maxing out at 5'9" being the ideal height. But it only makes about a single grade of difference.

Short folk have incredible strength to weight ratios and fine motor control from short levers. Tall people can reach farther, but can't apply the necessary force or use tiny holds as well. It all evens out in the long run, though you'll see big differences for individual lines that target a single style.

My wife and I climb at the same level despite a foot of height difference. She stays away from my long throws and compression problems. I try not to feel the tiny crimps on her projects, and it all works out in the end.

<comment><USER3> Agreed with tiny holds causing problems. But I presumed it was a grip strength problem, which still doesn't take away from my advantage as a tall-leaner. Though it could also be because I must've not done challenging routes.

<comment><USER4> It is. But again, with longer fingers you need more strength to produce the same force at the fingertip (because you're applying muscle force to the short end of the lever). Combined with the extra weight from the rest of a longer body, it makes pulling on small holds a lot harder for tall folk.

But then we can often simply reach past those small holds to the big jug beyond, so it tends to work itself out.

<comment> saiya-jin I can confirm this - as 188cm tall guy, even if I can reach further, the strain i get on my fingers from my relatively heavy body is taking its toll on the fingers. I can't climb few days in a row, would end up with tendinitis.

It doesn't help that I have a 'flexible type' of the body (can bend like crazy, but tendons/ligament injuries across whole body are much more common). And I started with climbing when I was 30, unlike many in their teens who seem to climb much harder without big effort.

If I would be a competitive person, I would be very frustrated with my little climbing progress. But instead I enjoy the constant challenge, the uneasiness of hard routes, the mental push through in cruxes. As they say, life begins where comfort zone ends. Overall, best sport for me for the warm days (rock experience is vastly superior to gym one), and ski touring/alpinism for the cold ones.

</comment></comment></comment></comment></comment></comment><comment><USER5> If one likes the "bouldering is problem solving like programming is problem solving" paradigm, you may enjoy training tools like the Moon Board, which is an array of holds spaced out uniformly with problems programmed in using LEDs (use only the holds where the LEDs are on). You can share the same problem around the world- anywhere there's another moonboard, and collaborate that way.

[https://www.moonboard.com](https://www.moonboard.com)

</comment><comment><USER6> In case anyone isn't already familiar with indoor bouldering, here's a great competition video: [https://youtu.be/uHlV_nLLXLc?t=49](https://youtu.be/uHlV_nLLXLc?t=49)

Cannot recommend bouldering enough. Problem-solving minds tend to _love_ it.

<comment><USER5> I'd recommend anyone curious about bouldering get into simply top rope climbing first. Bouldering is HARD which isn't so much the real problem, but it can also be frustrating. Some problem solving strategies like throwing yourself into the problem (metaphorically)can result in nasty injuries and a short bouldering career.

Get some easy climbing mileage!

<comment><USER4> _Bouldering is HARD_

It's as hard as you want it to be.

Here in Fontainebleau, there are bouldering circuits in the forest set for the level of our three year old. (Seriously. Painted with little pink hearts next to the arrows).

They get used, too. Even for me, climbing pretty hard these days, I'll often run off and do an easy Blue or even easier Orange circuit just for the joy of movement over 40-80 nice problems, few of which would even get a V0 if you translated the grade across.

The difficulty scale goes as far as you want in either direction.

<comment><USER3> Can we compare difficulty levels with children? They seem to be naturally better at climbing at that age. Faster recovery period and their tendons and ligaments seem to be able to handle their small weights well.

<comment><USER5> I bet there's a lot of things going on:

* children are smaller, so holds in general are proportionally larger

* children may have a different lower and upper body ratio (they've got shorter legs than adults), making them better suited for climbing.

* Better flexibility/mobility

* don't have to be (re)taught how to play

* perchance better strength/weight ratio

* relatively fearless

* usually can find a enthusiastic peer group that isn't so centered around competition/jealousy (similar to, "knows how to play")

* A lot of kids I see at the gym have parents that have been climbing half their own lives, so they've got incredible coaching from a trusted source, and an amazing cheerleading section. They'll be climbing _most_ of their lives, if they decided to keep it up.

The only real detriment may be that problems in a gym setting aren't always made for their sized bodies, so some of the moves may be a bit reachy. A children's general creativity could allow them to solve such issues though.

</comment></comment></comment></comment></comment><comment><USER7> I'm a fat-old-man in climbing terms. I still prefer the mental challenge of trad leading (although I haven't done much recently) to bouldering. The zen like state of staying calm while placing gear that your life depends on is quite something to me. Whereas bouldering is an art form of movement... and one I suck at...but it never appealed to me in the same way

<comment><USER8> Same here. Plus, when I was more in to that scene, it seemed like a disproportionate number of folks got injuries from bouldering vs free climbing.

<comment><USER9> Yup. It is vastly more dangerous than trad or even sport climbing. No rope+fall=bad, even if only a few feet off the deck. Bouldering also leads to pushing a vertical boundry, exactly where does bouldering become free soloing? I also worry for the boulderer/gym rat who's physical abilities are not matched with the technical knowhow that comes from trad.

</comment></comment></comment><comment><USER10> I recently got into climbing (+ bouldering). Although I get super bored at regular gyms, I never bore of climbing, I think, because it's like programming -- for the body. Problem solving applied to an element that is both sociable and physical.

<comment><USER11> I also got bored at regular gyms, and realized that combat-oriented martial arts may be the ultimate problem-solving challenges. You have to muster all your intellectual and physical capabilities "against" an intelligent opponent who acts/reacts "in realtime", but also is prepared to it (the boulders layout is carefully crafted beforehand, but it doesn't react!). Jiu-jitsu may be one of the most adequate because it seems not as dangerous as striking arts (albeit by becoming competitive one may gain serious back-related aches or even injuries).

<comment><USER3> Agreed with the combat-oriented sports being the ultimate problem-solving challenge. Used to box (still occasional do), have never obtained the same technical satisfaction anywhere else. There are so many different facets to it. Ring generalship, creating angles, stances that gain or lose out on defensive or offensive capabilities, psychological game by use of feints and disruptive rhythms. It's not called the sweet science for nothing. Should hold true for other combat sports as well.

</comment></comment></comment><comment><USER12> Climbing is a lot of fun. It is talked about on HN occasionally but IMO not often enough. Hope to see more submissions about climbing on HN!

Oh and if anyone ITT is in the proximity of Gjøvik, Norway (slim chance) and would like to climb, message me on Mastodon. @firstname.lastname@example.com

I am a bit out of shape but I belay safely and communicate well and that's what matters the most when we climb single pitch, isn't it ;)

Though of course it is preferable to climb with someone on about the same level to minimize the amount of switching back and forth between routes.

</comment><comment><USER13> Bouldered a bit in college, feel like code challenge sites like Project Euler are like a programmer form of bouldering. you fail a few times, gain an insight, make some progress, finally get it, then feel a big rush of accomplishment.

<comment><USER14> 42+ years old, climber since 2 years here, _progammer_ since +30y.

Interesting comparaison, but bouldering problems relies on physical-traits that are harder to move up than the _psychological_ -traits needed in Project Euler. ( think of size, balance, synchronicity ... ).

... but OK some PE are now too hard for me. Training during college would change the game.

<comment><USER13> Yeah I struggled with grip after a point, would use the hangboard all the time. My frame is thin. Also just a lot of understanding how to move is hard to get.

</comment></comment></comment><comment><USER15> As much as I like the article, the title is flat-out incorrect. The most difficult bouldering problems aren't found inside a gym, they are out in nature. World Cup problems average V10ish, whereas the top climbers project V16 outside.

<comment><USER16> It literally says those things. It says boulder problems go up to v16, and that they aim for v10 at the comp.

<comment><USER7> To save other Europeans a Google. V10 = 7c+ font. V16 = 8c+ font.

Both grades I don't even aspire to!

[https://en.wikipedia.org/wiki/Grade_(bouldering)#Comparisons...](https://en.wikipedia.org/wiki/Grade_\(bouldering\)#Comparisons_of_bouldering_grades)

<comment><USER17> To save those who don't climb...

I've climbed most of my life...

I boulder three times a week and run 30 miles worth of trails a week . I can do pullups from my finger tips on a 'hangboard' (it's a training tool).

I climbed a V5 last week and was so happy I nearly cried.

These people are _freaks_ in the most awe inspiring and amazing way I can possibly imagine.

Climbing competitions are worth watching just for the sheer amazement at what the human body can be trained to do. I use them at the beginning of classes because students usually just stop talking and watch in stunned silence.

<comment><USER18> > These people are freaks in the most awe inspiring and amazing way I can > possibly imagine.

I went to youtube to find out what you mean. Didn't need to search for long. Here's one example. I don't know what grade this is but the climb is definitely freaky.

[https://youtu.be/4QrvLoxFAM4?t=180](https://youtu.be/4QrvLoxFAM4?t=180)

<comment><USER19> I'm not sure there's a sport that puts so much emphasis on pushing the upper limits of human strength within a single muscle group (the fingers). Check out this video of Jan Hojer training, it really makes it clear just how ridiculously, absurdly, otherworldly strong elite boulderers can be:

[https://youtu.be/DFojqoAfJ7g](https://youtu.be/DFojqoAfJ7g)

And in top competition bouldering the problems aren't just physically hard, they are also fiendishly difficult puzzles to solve.

<comment><USER20> Those pinky levers are just amazing!

</comment></comment></comment></comment></comment></comment></comment><comment><USER21> I was lucky enough to have and Outdoor Education class & a great teacher in High School that got me into climbing, which turned into a love for Bouldering.

Its one of the things I try to get all of my friends into who want to do something more active in their life or just something fun. Too me its the perfect balance of physical exertion and problem solving. The community is also (for the most part) great to be apart.

If anyone has any questions about the sport I would love to answer them.

</comment><comment><USER22> I'm the founder and organizer of the Bouldering in Austin meetup. We are a little over a year old and recently surpassed 500 members.

If any Austinites want to try it out, either as beginners or experienced climbers, give me a holler. :)

[https://www.meetup.com/Bouldering-in- Austin/](https://www.meetup.com/Bouldering-in-Austin/)

<comment><USER23> I climb at Crux... if you see an awkward bald-ish dude with a horseshoe mustache in the rope canyon feel free to say howdy.</comment></comment>


When you HTTParty, you must party hard - <AUTHOR> http://joshmlewis.com/screenshots/partyhard_364b.png

<comment><AUTHOR> I came across this while deploying to Heroku. It's the little things like this that make your day a little better, right? It's like coders give little bits of humors in unexpected ways. I bet when whomever wrote that they weren't thinking it would give someone else something to smile about months later.</comment>


Ask HN: Strong magnet in Logitech mouse box - <AUTHOR> I recently bought a Logitech MX Anywhere 2S mouse and when I was flattening the box I noticed it had a small battery like disk inside. I assumed it was an RFID tag. When I was tossing it in the trash it flew out of my hand and stuck the metal trash can.
On first glance it looks like a "357" battery [that is the small battery a little less that 1/2 across that is very common in laser pointers, small flashlights, etc].
Does anyone know why an RFID tag (if that's what it is) would have such a strong magnet in it? <comment><USER2> Some packaging now comes with a magnetic clasp to hold the lid of the box shut. I've seen it on several electronic product boxes. If you look kart the packaging, there may be a small metal strip embedded under a strip of paper that the magnet would have been in line with.

</comment><comment><USER3> My rolling papers also have a magnet on the box, it helps keep the lid closed.

</comment><comment><AUTHOR> Thanks guys. I have a 2nd unopened box I can look at.</comment>


"Islam is" auto-fill is back on Google search - <AUTHOR> http://www.networkworld.com/community/node/56540

<comment><USER2> "islam is " a keyword that returns almost exactly the same expansions as "christianity is " on Google. Some fine Network World reporting there.

</comment><comment><USER3> Older discussion thread <http://news.ycombinator.com/item?id=1033444>

</comment><comment><USER4> It's probably at least one person's full time job at Google to worry about these things.

<comment><USER5> explains why he probably has tons of free time to always post it here.

</comment></comment><comment><USER6> "catholicism is " and "christianity is " both produce the same results... "buddhism is " is actually slightly more positive. anyone for an infographic? [edit] just saw that tptacek beat me to the punch. cheers.</comment>


Gentouch Tablet PCs Powered by Android 2.1 - <AUTHOR> http://augenus.com/indexhome.html/GENTOUCH.html

<comment><AUTHOR> Why I submitted this: 1) I've seen others here jonesing for a cheap Android tablet. 2) This is supposed to be at Kmart this week for $150.00. So, no more dealing with sketchy people in Asia. That said, I'm not sure this is going to be a good buy. Edit to add: None of the photos show buttons.

<comment><USER2> $150 is a good price. I see Android tablets from China for $100, but slower and less ram and not as good looking.

Since I already have a new smartphone, the tablet seems a bit lacking. Not Android 2.2, only 800mhz compared to 1ghz, only 256MB RAM compared to 512MB, only 800x480 res for 7" display. For the price, it's hard to complain if you are looking for one though.</comment></comment>


Language popularity in Code Jam 2012 - <AUTHOR> http://www.go-hero.net/jam/12/languages/0

<comment><USER2> I'm surprised by the high number for Pascal, and low number for Javascript.</comment>