Minnow Server: Fast and embeddable websocket SSL server for microcontrollers - <AUTHOR> https://github.com/RealTimeLogic/MinnowServer <comment><USER2> From personal experience: using WebSockets for realtime communication with a microcontroller works really well. I've put together a number of products using ESP8266 to do this and serving out the HTML/JS from an embedded web server. Works particularly well for streaming out the state of sensors on the device.

The main issue I had was that only HTTP was well supported on the Arduino/ESP8266 platform and as we all know that's fallen out of favour. Unfortunately, it also limits what you can do on resource constrained microcontrollers. Having HTTPS in this library opens up the ability to build an SPA which was something I'd always wanted to do.

I don't see any mention of ESP8266 on their site but hopefully, as probably the most widely available IP enabled microcontroller, it will be supported too. Time to do some more digging into getting it running.

edit: I obviously didn't look closely enough - there's recently been added support for ESP8266 - happy days!

<comment><AUTHOR> I _highly_ recommend pairing an esp8266 with a ATECC508A crypto chip for serious tls stuff. It all works nicely with MongooseOS.

Edit: Looks like the MongooseOS team has even blogged about it (a few different times). Here is an example: [https://mongoose-os.com/blog/mongoose- esp8266-atecc508-aws/](https://mongoose-os.com/blog/mongoose- esp8266-atecc508-aws/)

</comment></comment><comment><USER3> I've read this README and linked pages, but my lack of experience with these topics still prevents me from having a clear picture:

Would it be possible to port this for the Atmel (now Microchip) AVR32 architecture? I'm writing some code for the UC3C family and next thing to do is write code to present a configuration page over an Ethernet port. I'm not using a RTOS so my plan was to use lwIP directly, altough switching to FreeRTOS would also be an option (as I'm currently writing code for other boards and I've not really started writing any code for this specific, Ethernet-enabled board).

Would appreciate any pointers of how to do this. Never had to implement TCP/IP and HTTP before on a MCU, so it was a relief discovering that there are already made and free to use implementations of these stacks :)

I'm also exploring alternative OSes such as Mongoose mentioned here. It seems there is a lot of options. Having support for OTA updates could save a lot of work too, because that's another planned feature.

<comment><USER4> Minnows README says it supports lwIP-raw. Atmel apparently also has their own reference example of an lwIP HTTP server for AVR32.(Probably FreeRTOS based)

[http://ultimaserial.com/classroom2.html](http://ultimaserial.com/classroom2.html)

<comment><USER3> Thanks. I understand from Minnow docs that first lwIp should be set up in the MCU, and then Minnow can be set up _on top_ of it.

</comment></comment></comment><comment><USER5> Where is the SSL and crypto implementation in this project?

<comment><AUTHOR> [https://github.com/RealTimeLogic/MinnowServer/blob/fa30b0d5b...](https://github.com/RealTimeLogic/MinnowServer/blob/fa30b0d5be3d7ce13c8f8263bdbbfe73f877e01b/example/src/main.c#L5-L9)

        The code can be used with or without a TLS stack. The code is tailored for the SharkSSL API and the code automatically uses the SharkSSL API if compiled together with a SharkSSL delivery. The code uses standard non secure connections if not using TLS.</comment></comment>


Ask HN: Does HN Karma do anything, other than give me dopamine? (in algorithm) - <AUTHOR> <comment><USER2> There are some thresholds to unlock additional abilities. For example, with 200 you can make polls and with 500 you can downvote comments. (The numbers may change.)

<comment><USER3> How does one make polls?

<comment><USER4> I'm not sure whether I've ever seen a poll. Is there a list or something?

</comment></comment></comment><comment><USER5> I sometimes get dopamine from downvotes. Weird. It's like someone cares enough to say "that's shit".

<comment><USER6> I was totally going to give you a dopamine hit but I don't have enough karma to downvote :(

Maybe if people like this comment enough ?

(/s, if you must ask)

</comment></comment><comment><USER7> I think at a certain Karma you can also change your: top bar color. I have mine set to: 9794b6. I think it was at 500 points that I could do this.

<comment><USER8> For real? I'm mostly a lurker, now I wanna hit 500 points.

<comment><USER7> A post above thinks it might be 256!

</comment></comment></comment><comment><USER9> At 1000 karma you unlock the ability to post an occasional /.-worthy +2 Funny comment without worrying about the inevitable downvotes.

But really, I do look at people's karma to see if I should take a comment seriously if I'm feeling uncertain about it. People with 2000+ karma are usually worth listening to, even if you don't agree with them.

<comment><USER10> Yes, karma is a good indicator of standing in the HN community :-) High karma shows somebody has been around for a while and is known for substantive comments.

</comment></comment><comment><USER11> It's great for reinforcing group-think and confirming certain trendy biases.

</comment><comment><USER12> Here are the lesser documented features [1] of HN.

[1] - [https://github.com/minimaxir/hacker-news- undocumented](https://github.com/minimaxir/hacker-news-undocumented)

</comment><comment><USER13> If anything, karma reflects how many users like your post or comment. They can like it for various reasons, not necessarily support it.

<comment><USER14> This is true for individual comments. But do we need the "score box" next to our login name?

I don't see an option in the settings to make that disappear, and adblocking the div removes a useful link.

</comment></comment><comment><USER15> It give feedback as to whether people feel that your comments contribute positively to the discussion. Not algo but useful.

</comment><comment><USER16> Exposes the ability to downvote comments at >500\. Seems to give flags and possibly votes more weight.

</comment><comment><USER17> I'm opening a hn karma for karma trade marketplace to help us unionize commenting.

</comment><comment><USER18> It suppresses opinions that are not widely accepted or favorable and deters irritable tones of voice among other things.

<comment><USER19> This is one reason I'm not a big fan of these sorts of karma systems. It's like when social media sites try to re-order the news instead of just showing it in chronological order. This post was popular, so maybe you'll like it too. Just a bit irritating. I think I prefer more traditional forums where the new posts are at the end.</comment></comment>


Flyweight Pattern - <AUTHOR> https://en.wikipedia.org/wiki/Flyweight_pattern <comment><USER2> Link not opening.

<comment><USER2> Or maybe it's because i am using materialistic, and its browser problem.</comment></comment>


Cosmos Browser – A text-message-based web browser. Now on Android - <AUTHOR> http://cosmosbrowser.org/

<comment><USER2> Congrats on launching this! I've been looking into using SMS as a delivery mechanism for a while now, for different reasons. Access to, for example, medical information through SMS could be immensely helpful in the developing world.

Two questions that made me stumble were:

\- how does the pricing work out? In my research, all SMS services were way too expensive to work at scale, especially with sending to the developing world, Africa etc. You use Twillio, and for developing countries it's mostly 0.01$/message over a local number, but no option to buy a local number.

\- what is the difference between land coverage of cellular networks vs. EDGE/3G networks in the developing world? Does it make sense to focus on SMS to increase reach?

Would appreciate what you guys or anyone else has found out about this.

<comment><USER3> Yeah, it is very expensive :/

Coverage wise, I don't know how much it is in places like Africa. I have personal experience in India with a smartphone, no internet, and cell connection. Stefan also had this issue on the bus from Chicago (?) to MHacks (Ann Arbor), which was a 9 hour trip without 4g. A lot of more rural areas of America have bad data coverage too. I like to go camping, and I see this pattern a lot.

</comment></comment><comment><USER3> We've spent a significant amount of money already in the first couple of hours. We really need your support! If you guys could help us out on Tilt, that would be awesome! We also have a Teespring campaign going!

[https://www.tilt.com/campaigns/cosmos- browser](https://www.tilt.com/campaigns/cosmos-browser)

[http://teespring.com/cosmosbrowser](http://teespring.com/cosmosbrowser)

We <3 you guys!

</comment><comment><USER4> Hey guys, please note that this is still in the early stages of development. Please report any bugs to firstname.lastname@example.com

Much love, Team Cosmos

</comment><comment><USER5> Horrible landing page. No information about what/why/how whatsoever.

<comment><USER3> We're all high school and college students, and we're still working on it.

</comment></comment><comment><USER6> Awesome product, horrriblleeee timing on the launch :)</comment>


Social Vibing - <AUTHOR> http://www.bristollair.com/2008/outer-game/pua-skills/social-vibing/

<comment><USER2> I haven't read, yet, but I see that laughter is mentioned.

I've thought of laughter as a means of turning weakness into social strength. As an exercise/observation, I can divide this into two categories (without claiming any sort of authoritative definition/categorization):

1) Laughing with someone / a "victim": Expressing social support, thereby turning the "weakness", the cause of the humor, into a strength.

2) Laughing at someone: A form of segregation, strengthening the group laughing while ostracizing the weakened victim.

I've observed what seems to me to be a major uptick in 2) in U.S. culture during the past decade plus, which I don't enjoy. For example, I can no longer watch much of "Saturday Night Live", as most of the skits appear to be based in 2). I find it very malicious and not at all funny; rather, it makes me more than a bit queasy, when not angry.</comment>


Seeing How Computers Think Helps Humans Stump Machines and Reveal AI Weaknesses - <AUTHOR> https://cmns.umd.edu/news-events/features/4470 <comment><AUTHOR> I'm a co-author and would be happy to answer questions about our work!</comment>


How do we cut down on emissions from steel, cement, and plastic? - <AUTHOR> https://www.gatesnotes.com/Energy/A-question-to-ask-about-every-climate-plan <comment><USER2> My climate change plan is simple: a ratcheting carbon fee with dividend[1], together with a carbon tariff as part of a climate club[2]

The industries where it's easy will take the easy way to avoid the carbon fee.

The industries where it's hard will pay the fee but will see the ratchet coming and will be furiously researching alternatives. Worse come to worse, at some point the fee will be more than sequestration costs so they'll take that option.

I don't have to talk about any specific industry like steel because there is always sequestration as a backstop.

edit: of course my plan only works because there are lots of people like the companies Bill Gates linked to working on the details.

1: [https://en.wikipedia.org/wiki/Carbon_fee_and_dividend](https://en.wikipedia.org/wiki/Carbon_fee_and_dividend) 2: [https://issues.org/climate-clubs-to-overcome-free- riding/](https://issues.org/climate-clubs-to-overcome-free-riding/)

<comment><USER3> "Fee"? "Dividend"? That's not a plan to stop and reverse climate change, that's a plan for financiers and capitalists to trade in the blame for continuing climate change.

No no, emissions need to be cut - for real. There need to be schedules and (tax-based) funding to help make this happen. And - an expropriation of intellectual property so that technologies developed to help this happen aren't controlled by any single company or cartel - or nation.

<comment><USER2> The plan takes from the rich and gives to the poor. It could also be called a "Carbon Tax & Benefit". But instead we use right-friendly words for a very left-friendly plan.

<comment><USER3> You can take from the rich and give to the poor all day long - but that in itself doesn't reduce emissions. The rich will pay some taxes, or more probably, evade them, offshore stuff etc, and emissions will continue.

<comment><USER2> The rich can hide money, but it's a lot harder for them to hide consumption, and the carbon tax is a consumption tax.

<comment><USER3> So what? So they'll pay consumption tax. They're rich, after all, they can afford it.

</comment></comment></comment></comment></comment></comment><comment><USER4> > _Some industrial processes can't easily be electrified because they require > too much heat. One possible alternative is to get the heat from a next- > generation nuclear plant._

Glad to see this. I take any future large-scale green energy initiative as unserious if it doesn't take an honest look and consideration at new nuclear energy power plants.

<comment><USER5> There's three necessities I see in a green scale initiative: carbon tax, nuclear, and sequestration (CC).

I also have a hard time taking anyone serially if they don't talk about how we need a diversified energy portfolio nor understand the difficulties of energy density. I feel like many repeat popular points but do not spend time trying to understand. I think that's how we get politicians that consider climate change as one of their top priorities saying that geoengineering and CC are "false solutions". I also don't know any climatologist who isn't pro nuclear (which means nuclear + renewables, not nuclear vs renewables).

The IPCC endorses the use of nuclear power too[0]. Being anti nuclear seems to me, as a scientist, anti-scientific. Since it is against what the scientists studying this are recommending.

[0] [https://www.world-nuclear.org/press/press-statements/the- ipc...](https://www.world-nuclear.org/press/press-statements/the- ipcc-1-5c-special-report-nuclear-energy%E2%80%99s-impo.aspx)

<comment><USER6> Anti-scientific, or we learned from our mistakes? We can barely build a bridge that lasts for 50 years, but somehow we are going to magically build containment units for waste which last 1,000s?

The science has shown us that Nuclear electricity is incredibly dangerous, and that humans are mostly too incompetent to maintain it safely. I say this as the child of a Nuclear Physicist who spent half of his life working on weapons, and half at a power plant. Dad didn't think we were up to the responsibility either.

I was just in Belarus, a friend of mine told me that since Chernobyl 20 members of her family have died of cancer. Cancer isn't fun, I will tell you from experience.

There's more to consider than "does it work in the lab?" and "will it be cheaper"?.

<comment><USER7> Options for death are basically either heart attack, cancer or other [0]. Cancer is horrible, but that isn't a very telling example without more detail.

> We can barely build a bridge that lasts for 50 years, but somehow we are > going to magically build containment units for waste which last 1,000s?

We've had nuclear power for ~70 years. There is a very high likelihood that if we push on with nuclear power we will either be reprocessing that 'waste' for fuel at some point or it will be inert enough that it doesn't really matter.

The idea that we in 2019 need to take responsibility for the next 15 generations is absurd. Anyone who tried that at any point in the past would have been at best wasting their time; technology has moved too quickly. Our ancestors might as well have worried that by 2019 we'd look back on them with contempt for not leaving us a strategic 10t reserve of bronze for forging our swords and shields.

The biggest risk is that in 60 years they will dig it up and hurl it at their enemies, on purpose, as a dirty bomb.

[0] [https://www.cdc.gov/nchs/fastats/leading-causes-of- death.htm](https://www.cdc.gov/nchs/fastats/leading-causes-of-death.htm)

</comment></comment></comment></comment><comment><USER8> He says that Steel (and some other materials) are the most important issue because we don't yet have any proven good or easy way to reduce the CO2 impact of their production.

That leads me to the opposite of Gates' conclusion.

At this point there are many low hanging fruit, so until we have a good way to address steel production, we should keep the focus on those other measures.

We should certainly be doing research on the issue that he is focused on, but we shouldn't let ourselves get distracted by it.

Getting to zero carbon emissions overall (the goal he brings up to justify his focus) is a great long-term goal but I think our success in this challenge will be determined in the short and medium term.

<comment><USER9> This isn't something more research will solve. Metals exist in ores as oxides. To get pure metal you have to reduce them, and that oxygen had to go somewhere, bound to something. There is no net zero process that will magic away those pesky atoms.

<comment><USER10> Eh, its perfectly doable to make those atoms wind up as O2, it is just expensive. All we need to do to solve climate change, today, is accept a drastically lower standard of living. Hence why it isn't happening, (and won't happen until people start dying).

<comment><USER2> > accept a drastically lower standard of living

With sequestration costs at $100 - $300 per tonne for worst-case industries, climate change will cost trillions world-wide. That's a lot of money, but hardly a "drastically lower standard of living". Compare with Iraq war, or Apollo + Vietnam. Much less sacrifice than WW2.

<comment><USER10> Even at those optimistic costs that is $2-6,000 dollars per person (20 tonnes/American-year), 8 to 24k per family of four. I'd call that a drastically lower quality of living for an average American, to say nothing about a working person in the 3rd world who probably doesn't make 2,000USD in a year.

I'm not suggesting sequestering is going to be the end of society or the economy, just that people won't start sequestering until something is _imminently_ threatening them.

</comment></comment></comment></comment></comment><comment><USER11> > Making steel and other materials—such as cement, plastic, glass, aluminum, > and paper—is the third biggest contributor of greenhouse gases, behind > agriculture and making electricity

While I agree in broad terms that eliminating greenhouse gases in the materials sector is important medium-term, I agree with other posters here that we need to focus hard on implementing solutions we DO have now - specifically, in the electricity and transportation sectors.

> these materials are everywhere in our lives, and we don't yet have any > proven breakthroughs that will give us affordable zero-carbon versions of > them

This is at least partially misleading - for aluminum. There are a number of hydroelectric-powered aluminum smelters in Quebec and British Columbia, that produce very-low-carbon aluminum. And there are technologies approaching market for zero-carbon aluminum[1].

[1] [https://www.elysis.com/en](https://www.elysis.com/en)

<comment><USER9> It's not the source of power. It's the chemical process itself. You get oxygen out of a metal oxide by binding it with carbon and releasing the CO2. Canadian smelting is just as dirty in this respect.

The only other alternative is electrolyzing water to get hydrogen, which binds with the metal oxide's oxygen to make water again.

But not only is this really inefficient by comparison, but now you're adding O2 to the atmosphere at industrial scale.

<comment><USER12> Is using hydrogen for that an actual process or just an idea?

There's the problem that hydrogen can make metals brittle, see [https://en.wikipedia.org/wiki/Hydrogen_embrittlement](https://en.wikipedia.org/wiki/Hydrogen_embrittlement)

<comment><USER13> It's an actual process. The ability of hydrogen to reduce hot iron oxides to metallic iron has been known at least since the early 19th century. But it has not been done on an industrial scale before because using fossil fuels is cheaper, and reducing GHG emissions has not been a significant priority until recently.

EDIT: Joseph Priestley actually discovered that iron oxide ("calx of iron") could be reduced to the metallic state by hot hydrogen ("inflammable air") in the late 18th century.

[https://archive.org/details/b22281824/page/n57](https://archive.org/details/b22281824/page/n57)

<comment><USER12> Thanks!

</comment></comment></comment></comment></comment><comment><USER14> German steel makers aiming to go carbon neutral by 2050. Hydrogen is an important element in this: [https://www.handelsblatt.com/today/companies/green-energy- th...](https://www.handelsblatt.com/today/companies/green-energy-thyssenkrupp- steels-itself-for-a-carbon-free-future/23894808.html)

<comment><USER15> Aiming to is a meaningless word. It requires fundamental discoveries we by definition can't know when or if we are going to find.

Edit: Downvoted for what exactly?

<comment><USER16> We can't even estimate next week's sprint properly.

</comment></comment></comment><comment><USER17> If we have cheap reliable renewable electricity, then we can generate hydrogen from electrolysis, and use the hydrogen as fuel for steel production. Hydrogen burns even hotter than methane and it's clean. So, the key is we need renewable electricity.

<comment><USER18> I'm not super knowledgeable about this, but my understanding is that there are significant losses during electrolysis and probably when burning hydrogen. I expect just using an electric furnace would be more efficient.

</comment></comment><comment><USER19> Steel can be produced using hydrogen. This plays extremely well with renewables and storing energy. Produce hydrogen from electricity when energy is cheap (sun + wind), don't do that when its expensive.

</comment><comment><USER20> I think his first point about carbon capture probably deserves more attention. It's likely the most sellable strategy and it also doesn't depend on the location where it is carried out. It has the benefits of possibly producing some goods that can be used and there is prior history of this working. If we look at the Paleocene–Eocene Thermal Maximum we see a similar increase in global temperatures due to carbon dioxide release, albeit over a much longer timeline. But we also see a drastic reduction of those carbon dioxide levels. One theory as to how the global CO2 levels were reduced is algal biosequestration. Can we duplicate this at an industrial scale? We're already promoting the growth of algae unintentionally with fertilizer runoff, could we do this intentionally in a location that would minimize harm in order to offset carbon emissions?

<comment><USER21> There has been quite a bit of work on ocean fertilization, to increase phytoplankton photosynthesis, but no killer app yet:

[https://en.wikipedia.org/wiki/Ocean_fertilization](https://en.wikipedia.org/wiki/Ocean_fertilization)

</comment></comment><comment><USER15> I am glad to see Bill Gates being more vocal about this. There has been an unrealistic optimism when it comes to how easy it is to find alternatives to what we are currently using.

What people forget is that things like plastic ever-present not because of some evil conspiracy by oil companies to push an inferior material on the market but because it's superior to all other materials we know of.

The problem isn't product innovation but fundamental science and we have had no new discoveries since oil to fundamentally change how we approach progress.

Having listened to a lot of pitches by claimed alternative to plastic it's been very obvious to me that we simply need improvements in fundamental science not just in technology. I.e we lack fundamentally new discoveries to truly change our ways.

Nanotech might help us some of the way but we are nowhere near the utopia a lot of people seem to be thinking.

<comment><USER22> Superior except that it would _not_ be superior in all these cases if the unaccounted for externalities were considered.

<comment><USER15> The externalities include positive ones so yes it would be superior by far.

There literally is no realistic alternative to plastic right now.

<comment><USER22> Excuse me what are those? I can list just a few negatives just off the top off my head, hormonal dysfunction in humans and animals, microplastics in the sea, no way to know if plastic contains carcinogens, are safe for food or not, contain heavy metals, litter, and new problems we don't even know about yet, because there is a never ending stream of new products and materials getting shoved out in our lives.

And what a defeatist attitude - what about enumerating the plastics we, standardising and regulating additives etc? Today it's total chaos with a _very_ thin veneer of recycling.

<comment><USER15> How do you think we do most modern operations and healthcare, how do you think we manage to have cars be extremely lightweight and i could go on.

<comment><USER22> Fine, but are these _unaccounted_ positive externalities? Don't you choose plastic exactly because you want its nice properties? But looking back the next day I think I may have over-reacted a bit to your comment. Of course plastic is in many ways very nice. Let's keep a fair subset. But we could benefit from paring down the variations, and the volume, a lot, IMHO.

<comment><USER15> It's not just nice it's crucial for our survival. Keep in mind plastic can be as soft as velvet and as durable and hard as diamonds. No other material does that and that allow us to make things that would be impossible otherwise. We simply have no alternatives to them yet.

The unaccounted externalities are that fossil fuel and thus ex. plastic makes modern life possible with everything from increased age, to the ability to cure the sick, to lowered childbirth, to increased living standards, food production, cleaner environments and so on.

Of course there are negative externalities too and we need to deal with them but all in all plastics and thus fossil fuels improve our lives tremendously IMO.

Ironically the problem the modern society is facing is how to deal with abundance rather than scarcity.

<comment><USER22> Now I really feel like a strawman argument is going on.

Do you believe I advocate remove _all plastic_?

Do you advocate keeping _all plastic_? _None_ of the plastic can be replaced with other materials or designed away altogether?!

I hope you are not, because that is ludicrous.

<comment><USER15> I don't believe anything about you. I am simply telling you what I consider to be the reality.

Some parts of the plastic industry can and will be replaced but far less both short term and long term than people want to think, unless; some new fundamental scientific discoveries are done.

</comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER23> Bill Gates has become-- against all odds-- one of my most respected sources of information when he blogs. I don't always agree with him, but I like his thought processes and writing style.

<comment><USER24> Agreed. I often disagree with him but at least he makes an effort to present ideas based on facts and well thought out ideas. This makes finding solutions much easier.

I am always horrified by the debate about US healthcare we're almost nobody makes an effort to think it through and also listen to other opinions and experiences.

</comment></comment><comment><USER25> I think a lot of this comes down to resources and innovation.

As more money is invested and spent on research and development of new ideas, I think some things will eventually start to work providing a solution to these issues.

For more money to flow into the ecosystem, we need people to see value from being carbon neutral personally.

If you'd like to become carbon neutral, I'd suggest you check out [https://projectwren.com/](https://projectwren.com/)

</comment><comment><USER26> Unpopular opinion: adaptation is best (only?) solution.

<comment><USER27> Unpopular opinion: adaptation at +4C is genocide

<comment><USER28> That seems likely. But (yet another unpopular opinion): "Zero emissions now" is also genocide, or at least large-scale death.

<comment><USER29> I don't know why this is being downvoted. If we went zero carbon tomorrow we'd have no replacement for the Haber process which produces the massive amounts of fertilizer needed to feed the human population.

<comment><USER28> Or for most of the tractors and combines that work the farm fields, or the trucks, trains, and ships that transport the food. Or for the power plants that run the air conditioning that keeps some people from literally dying in the summer, or for the natural gas that keeps some people from dying in the winter.

</comment></comment></comment></comment></comment><comment><USER30> > bridges are so sturdy and last so long

What a joke, when you see how all the bridges built in the 60s and 70s are crumbling apart.

<comment><USER20> That's actually solvable by using another product of high-heat processes, basaltic rebar. The main problem with concrete infrastructure is that water eventually infiltrates down to the rebar and wire mesh used to add tensile strength causing it to rust and expand which breaks apart the concrete. If you use something with equivalent tensile strength that doesn't rust then you get construction that lasts many, many decades longer.

</comment></comment><comment><USER31> > Some industrial processes can't easily be electrified because they require > too much heat [...] We also might be able to get the heat using hydrogen > fuels, which can be made using clean electricity

I don't quite get it, as this ends up electrifying the production process. Unless he talks about directly heating with electricity (induction?). I was under the impression that there was no real limit to electric heating (induction, microwave, etc.). Of course, a complex hydrogen production plant shipping hydrogen to the factories could end up being much cheaper than installing microwave heaters, I guess.

> Carbon capture

At the very least, I'd like to see those processed if they can't be eliminated or sequestrated. Run the exhaust trough some algae containers, and transform the resulting biomass into biofuels. At least, that would lessen the carbon impact due to burning those fuels.

Taking the idea to its limits to judge the impact: If every factory was to do this, if we take current emissions as (24% agriculture, 25% electricity, 21% manufacturing, 14% transportation) [1] we would in theory be able to fully supply transportation with biofuels, cutting it entirely. Do the same with electricity, and you can remove as much emissions as the entire "manufacturing" budget, so 21%. Not that bad. In parallel, you can continue cleaning up electricity generation, and replacing carbon-intensive manufacturing processes with electricity-based ones.

Actually, there is no reason why this couldn't be almost a closed-loop system: Hydrocarbons burned in Manufacturing -> CO2 -> Capture + Algae + processing -> Biofuels (Hydrocarbons)

The energy input ends up being solar energy (or equivalent) necessary for photosynthesis. Algae could also be replaced by chemical processes that take electricity as an input.

This could be expensive to install, but the fuel could be an extra source of revenue as well (or savings, if closed-loop). That's also why we need the right incentives (carbon tax?) There are multiple research projects being conducted in this area [2]

[1]: [https://www.gatesnotes.com/Energy/We-should-discuss-soil- as-...](https://www.gatesnotes.com/Energy/We-should-discuss-soil-as-much-as- coal)

[2]: [https://en.wikipedia.org/wiki/Algae_fuel#Carbon_dioxide](https://en.wikipedia.org/wiki/Algae_fuel#Carbon_dioxide)

</comment><comment><USER32> Couldn't we just put a dome around manufacturing plants that is air tight and collects the carbon? For breathable air we can use hospital grade air systems.

</comment><comment><USER33> > "Whenever I hear an idea for what we can do to keep global warming in > check—whether it's over a conference table or a cheeseburger"

You're discussing global warming prevention and eating meat??

<comment><USER34> You're discussing global warming prevention and using a computer??</comment></comment>


Self-Proclaimed Bitcoin Inventor Says Fortune Inaccessible - <AUTHOR> https://www.bloomberg.com/news/articles/2019-06-28/self-proclaimed-bitcoin-inventor-says-fortune-inaccessible <comment><USER2> Wright has produced faked signatures in the past in an attempt to trick people into thinking he was Satoshi:

[https://crypto.stackexchange.com/questions/35060/how-is- the-...](https://crypto.stackexchange.com/questions/35060/how-is-the- base64-encoded-signature-in-craig-wrights-proof-constructed)

<comment><USER3> "Your keys, your bitcoin". "Not your keys, not your bitcoin".

<comment><USER4> > Emotional courtroom speeches

Yea this guy is a fraudster and not a good one at that, show keys or gtfo, that's all that should count.

</comment></comment></comment><comment><USER5> This guy is is a conman and trying to win both ways - "Yes, I invented Bitcoin even though I can't provide any proof, and also I cannot access my $10 billion dollar fortune because I lost the key which subsequently would also prove I invented Bitcoin."

I know some very serious blockchain people who actually believe this guy is Satoshi and it boggles my mind.

<comment><USER6> Can you name anyone who believe's he's Satoshi? The only informed people I've come across to proclaim that are shilling BSV, presumably for their own financial benefit.

<comment><USER5> If you look at my profile you can see who I am, people can publish their own beliefs but I don't speak for anyone else. It seems that "The Secret Life" is a big reason why people believe it.[0] Industry people have their own opinions and some people honestly believe CSW is crazy like a fox, and is doing all of this hoaxing on purpose to keep the mystery alive or for other purposes.

[0] [https://www.lrb.co.uk/v38/n13/andrew-ohagan/the-satoshi- affa...](https://www.lrb.co.uk/v38/n13/andrew-ohagan/the-satoshi-affair)

</comment></comment></comment><comment><USER7> I can't take anyone seriously who would believe this guy is actually satoshi. Even ignoring the iron clad evidence of private keys and public signatures, Satoshi wrote a lot of C++. I don't think this guy has ever demonstrated that he can program on that level.

Beyond that, he has copied large parts of research papers, tried to fake old websites to make it seem like he was working on crypto currency many years ago, and has released even more nonsense in research papers.

His end goal seems to be to get seed money and use it to patent as many crypto currency ideas as possible.

<comment><USER6> The bitcoin C++ seems mostly written by Satoshi and Hal Finney. I imagine Finney did most of the coding. Not that I think Wright had anything to do with it.

<comment><USER7> I don't know much about how it was split up originally, what are you basing that on?

<comment><USER6> Guess work but basically this ([https://medium.com/@cypherpunk./so-you-are- saying-satoshi-is...](https://medium.com/@cypherpunk./so-you-are-saying- satoshi-is-nick-szabo-then-arent-you-86fb3ec2ad5f)) plus the fact that Finney was the professional C++ coder. I'm told the code is very professional. I don't know C++ myself.

</comment></comment></comment></comment><comment><USER8> I'm still wondering how BSV hasn't tanked both on the news that 98% of BSV's transactions come from a shitty weather app associated with it and Wright's constant antics.

[https://cointelegraph.com/news/98-of-bsv-transactions- used-f...](https://cointelegraph.com/news/98-of-bsv-transactions-used-for- writing-weather-data-on-blockchain-report)

</comment><comment><USER9> > "My wife and I consider it's too much money," Wright said. "I've got enough > now… and we worry what that amount of money would do to the kids."

Haha, so, this is a comedy.

</comment><comment><USER10> I don't understand why no one that Satoshi collaborated with can ask him about stuff that only Satoshi would know. Isn't that the simplest way for both sides to prove it?

<comment><USER11> The simplest way is for Satoshi to re-use a key known to be his.

Wright cannot do so, because he is not Satoshi.

</comment></comment><comment><USER12> Non-paywalled alternative:

[https://www.coindesk.com/craig-wright-spars-with-kleiman- law...](https://www.coindesk.com/craig-wright-spars-with-kleiman-lawyers-in- combative-courtroom-appearance)</comment>


Containers and Docker: how secure are they? - <AUTHOR> http://blog.docker.io/2013/08/containers-docker-how-secure-are-they/ <comment><USER2> I support docker in its efforts. However, docker is too cute, too hyped, and too rapidly developed to trust with your security as yet. Quite frankly, you have to understand a bit more than how to call an API to have faith in your infrastructure's inherent security.

For example, in this article the author links to the 'list of dropped capabilities in the Docker code'. As it happens, I wrote that list quite some time ago, and wrote it for _lxc-gentoo_ , a guest-generation script for raw LXC against an earlier kernel version with an earlier LXC userspace. Not only is the list now out of date, it's no longer using the preferred approach. Why is this? Instead of explicit drop ("allow all, deny some") after some months of raising the issue one of the LXC devs finally added the 'lxc.keep' (ie. "deny all, allow some") which is architecturally more secure against things like kernel upgrades which add or modify kernel capabilities.

Furthermore, the docker people only included this when I added [https://github.com/dotcloud/docker/commits/v0.5.0/lxc_templa...](https://github.com/dotcloud/docker/commits/v0.5.0/lxc_template.go?author=globalcitizen) ... things as important as _WARNING: procfs is a known attack vector and should probably be disabled if your userspace allows it. eg. see_ [http://blog.zx2c4.com/749](http://blog.zx2c4.com/749) and _WARNING: sysfs is a known attack vector and should probably be disabled if your userspace allows it. eg. see_ [http://bit.ly/T9CkqJ](http://bit.ly/T9CkqJ)

Again, I fully support docker's efforts but the article is ... misleading at best.

<comment><USER3> Hi, docker maintainer here.

There's a reason we keep saying docker is not yet production-ready.

Right now our focus is on usability and stabilizing the management API to make deployment-centric deployment awesome. You can be sure that before we tell anyone that they can use docker to sandbox untrusted code in a shared environment (which by the way is not the only use case of docker) we will be locking down our default lxc configuration and doing a sweep of all pending security issues.

For the record, we (dotCloud) have tens of thousands of lxc containers currently running untrusted code _in production_ on shared infrastructure, and have had to monitor and maintain them 24/7 for several years. Before that we ran openvz. And before that, we ran vserver. So while docker itself may not yet be ready for production (and indeed we don't use it in production at dotcloud either), you don't need to worry about our stance on security. We care about it just as much as you do.

<comment><USER4> Do you allow any of that untrusted code to run AS ROOT within a container, though? (If so: what capabilities do you allow it to have?)

<comment><USER3> Good question - no, we don't. Developers can request for certain whitelisted commands to be executed within an environment that we know to be safe. For example, you can specify a list of system packages, and dotcloud will install them from the official LTS Ubuntu repository.

There's an ongoing discussion in the Docker community on the best way to make this possible in a shared environment. One possibility is to add support for OpenVZ, which has a better track record on that front (although it's not clear how much of the perceived difference is just fud). Another is to combine namespaces with SELinux, so that even if you break out of the namespace, you're stuck in a "limbo" context with no ability to do harm. Lastly, there's the possibility of extra instrumentation around the container, to limit the risk - for example you could allow root privileges only for a whitelist of commands on a whitelist of base images. Or you could only authorize network connectivity with a whitelist of remote hosts (keeping in mind most use cases which require root access involve short-lived image building). Or you could map containers with root privileges to dedicated virtual machines, separately from the unprivileged containers. Etc.

<comment><USER3> To clarify, I'm talking about our use of containers _at dotCloud_ , which is a multi-tenant environment.

 _Docker_ _does_ allow running processes as root inside a container, and it also allows dropping privileges to the uid of your choice. It all depends on your particular use case.

</comment></comment></comment></comment></comment><comment><USER5> Good post, except that it's extremely misleading to use Solaris as the canonical example of non-Linux containers and then say that non-Linux containers "haven't had as much exposure" and "the source code isn't always available for peer review and auditing". Solaris containers (in Solaris first, and then illumos when Solaris became closed-source again) have been open source since 2005 and running in hostile production environments that whole time.

<comment><AUTHOR> True, I will update the blog post so that it feels less misleading. Source code for Solaris zones is indeed available; but I wouldn't consider it widely deployed. Of course, some people are using it in public hosting environments (the most notable example is probably Joyent); but I don't think that it's significant compared to the installed base of VServer, OpenVZ, or LXC out there.

I mean — it's trivially easy to get access to a Linux VPS, for a ridiculously low price (sometimes for free). Now compare with something equivalent based on Solaris zones.

But yeah, I'll definitely update the blog post, thanks!

<comment><USER6> _Source code for Solaris zones is indeed available; but I wouldn 't consider it widely deployed._

Why would you not consider it widely deployed? If it needs to be said: just because you don't use something doesn't mean that others aren't. Speaking only for us (I work for Joyent), we have deployed hundreds of thousands of zones into production over the years -- and Joyent was running with FreeBSD jails before that. And that's just us; there are many others in the illumos/SmartOS/OmniOS, Solaris and FreeBSD communities who have been running this technology in production -- broadly -- for years. Perhaps OS virtualization is a new technology for you, but understand that it's not new for everyone; some of us have been doing this for a while -- widely deployed and in production.

<comment><AUTHOR> I wouldn't consider it "widely deployed" compared to the Linux installed base.

Sure, Joyent (and others) has "deployed hundreds of thousands of zones into production over the years", but you guys are the only well-known, large-scale, public hosting service using zones (and you're damn good at that, no doubt about it!)

Now compare with dotCloud, Heroku, Dreamhost, 1&1, Mediatemple, OVH, Amen (just to name those I can remember without doing an extensive research): those guys have also "deployed hundreds of thousands of Linux-based VPS into production", using VServer, OpenVZ, and more recently, LXC.

Don't get me wrong: I'm a big fan of Solaris (and its heritage); I have lots of my marbles on ZFS; I hacked basic ZFS support in Docker just for fun a while ago; and if I knew better, I would love to find a way to run sub-zones and a ZFS pool in a Joyent SmartOS instance and port Docker to your platform. But there is a helluva lot of Linux hosters out there.

I'll close with a lovely paraphrase: « Perhaps LXC containers are a new technology for you, but understand that it's not new for everyone; some of us have been doing this for a while — widely deployed and in production. » ☺

<comment><USER7> Just because popular hosting companies are not using Solaris zones, that does not mean there are not large Zones-based deployments elsewhere in the industry. Particularly, some major corporations (including banks and telcos) are using Zones in their production Solaris environments. These turn out to be particularly large deployments, with hundreds of machines in data centers across the US.

These users do not broadcast their use of Zones, but having worked with them, they certainly do exist.

*Used to work at Sun on a project related to Zones and ZFS.

</comment></comment></comment></comment></comment><comment><AUTHOR> By the way, if anyone knows of a documented exploit for LXC, I would love to hear about it. People (generally advocating VMs, zones, jails, OpenVZ...) will often say that "containers are not secure", but once you've taken some basic steps (like locking down kernel caps and device access) it becomes difficult to find an actual threat.

<comment><USER2> _I would love to hear about it_

See [http://blog.zx2c4.com/749](http://blog.zx2c4.com/749) and [http://bit.ly/T9CkqJ](http://bit.ly/T9CkqJ)

<comment><USER8> Neither of these exploits works on stock Ubuntu 12.04 LTS, with LXC or otherwise (AppArmor kicks in).

Like jpetazzo, I would love to see a working LXC exploit. In my case, "working" == "can get host root when given container root on Ubuntu 12.04 or later".

<comment><USER9> The fact is that by the time you know about the "working" exploit it's already been fixed. Unless you're security-related researchers / engineers you're not very likely to get hold of a 0-day exploit.

</comment></comment></comment></comment><comment><USER10> _> Finally, if you run Docker on a server, it is recommended to run exclusively Docker in the server, and move all other services within containers controlled by Docker._

This looks like what CoreOS is providing, a stripped down barebones host, with all other services not strictly necessary in the host moved to the containers.

 _> Capabilities turn the binary "root/non-root" dichotomy into a fine-grained access control system. Processes (like web servers) that just need to bind on a port below 1024 do not have to run as root: they can just be granted the net_bind_service capability instead. And there are many other capabilities, for almost all the specific areas where root privileges are usually needed._

This is awesome, has been a personal pain point in the past, trying to get JVM running as non-root in ubuntu server. Theoretically it's easy with IPTABLEs, but in practice it can be tricky to get working exactly right.

<comment><USER11> To your first point, CoreOS is SmartOS for linux :)

</comment></comment><comment><USER12> Any 0-day Linux root vulnerability qualifies. Linux is a _large_ system, do your own risk analysis.

<comment><AUTHOR> Are you implying that gaining root access inside a LXC container means that you can escalate to the host system, or to sibling containers?

If yes, I would like to see an example of that (that works on systems with very minimal lockdown, i.e. using the device control group and kernel capabilities).

Otherwise, if you just mean that "0-day Linux root vulnerabilities can be used to escalate from non-root to root in a Linux Containers", that's a truism, and it also stands true for VMs or OpenVZ systems.

Just like 0-day vulnerabilities will help people to escalate from non-root to root in a FreeBSD jail or Solaris zone.

<comment><USER13> Many (though not all) local kernel exploits that allow you to escalate to root will also allow you to run arbitrary code in kernel-space, and there's only one kernel, not one kernel per container.

VMs will always be more secure than containers, simply through defense in depth; the only question is whether you want to trade away some performance and flexibility to increase security.

<comment><AUTHOR> I disagree with this assertion that "VMs will always be more secure". Of course, they bring an extra layer (or rather, a layer of different nature).

But check the number of Xen vulnerabilities (I kept up with those for a while because I still run a Xen cluster): they are very real. And keep in mind that Xen (at least in my case!) doesn't bring an extra layer of security: if you are (e.g.) an IAAS provider using Xen to sell VMs, your customers can run anything they like in their VMs, and Xen will be the only layer. Your hypervisor will be "on the front line" if you see what I mean.

I would actually argue quite the contrary. I.E.: exploits affecting containers are likely to be exploits affecting _all_ Linux systems, meaning that they will draw much more attention and scrutiny than exploits affecting hypervisors, and they are likely to be fixed faster.

<comment><USER13> To clarify: VMs will always be more secure for sandboxing a non-root service. In that case, untrusted code would have to get root first, then use that to either replace or exploit the kernel, and _then_ exploit the VM.

In the case where you run untrusted root or kernel code, that code only needs to exploit the VM, true. (On the other hand, many VMs have smaller attack surfaces than the Linux kernel.)

</comment></comment></comment></comment></comment><comment><USER14> I'm very interested in all those things, but I clearly lack a trajectory for learning them. Is there a reference I could read or a 'name' for that domain? How does one become educated on these things?

So far I've grabbed knowledge by reading paper on operating systems (and misunderstanding 80% of their content), reading man pages, reading Tanenbaum's textbooks, etc. But still I don't feel like I know or understand.

They say a lack of words for things render one blinds of their ignorance. Sometimes it's also that you just don't know what needs to be learnt.

</comment><comment><USER15> "No exploit has been crafted yet to demonstrate this, but it will certainly happen in the feature". But will it be considered a future? ;)</comment>


Doctors Still Aren't Sure Why Covid-19 Is Causing Hearing Loss - <AUTHOR> https://www.verywellhealth.com/hearing-loss-tinnitus-symptoms-covid-19-5076221 <comment> just-juan-post The conclusion of the study that the article is based from:

> Reports of audio-vestibular symptoms in confirmed COVID-19 cases are few, > with mostly minor symptoms, and the studies are of poor quality</comment>


Calculize: A Mathematical Scripting Language - <AUTHOR> http://calculize.com/

<comment><USER6> Coffeescript-inspired syntax is nice, but unfortunately Matlab is clearly superior for anything mathematical than most other languages, so drawing some inspiration from it wouldn't hurt...

For example:

        m1 = matrix([1,  2,  5],
                [2, -1,  6],
                [5, 10, -1])

why not adapt a simpler syntax for constructing multi-dimensional arrays:

        m1 = [1   2   5;      # commas are optional
              2, -1,  6;
              5, 10, -1]

Also, a special constructor for matrices and vectors is redundant - in a mathematical language, a list/array is the special case, not a matrix/vector. Besides, vectors are just a special case of matrices, no need to treat them differently, especially since the dot product is not overloaded in Calculize.

Matlab also wins by having a special syntax for matrix transpose. Now, this depends on the implementation ( AFAIK, Matlab doesn't actually transpose the matrix, it simply uses a different algorithm for further calculations), but would still be nice, since it's often useful (necessary) when trying to multiply matrices.

<comment><USER7> I don't think you should consider vectors a special case of matrices - <USER3> makes tensors difficult to handle. The other way around generalizes better.

<comment><USER8> > I don't think you should consider vectors a special case of matrices - <USER3> > makes tensors difficult to handle. The other way around generalizes better.

I guess (from the first sentence) that you mean to regard matrices as a special case of _tensors_ (which certainly generalises well), rather than of _vectors_ (which is possible but ugly)?

<comment><USER7> No, I certainly do mean to regard matrices as a special case of vectors. While it's true that one rarely needs more than 3 dimensions to their array, I see no point in setting an upper limit.

<comment><USER6> Probably this is just a lapsus lingue, but what you are saying makes no sense.

Vectors are a special case of matrices, which are a special case of tensors (finally, scalars, which is just a fancy name for plain numbers, are a special case of vectors). Although there are many mathematical representation of all these objects (geometrical, functional, etc.), they can be written as multidimensional arrays (after selecting for a base).

Thus, scalars are 1x1 matrices, and a vector of size n is actually a nx1 matrix. Although a common high-school notation of a vector is x = (1, 2, 3), a vector is actually

      x = [ 1
            2
            3 ]

Tensors are the extension of matrices to further dimensions.

<comment><USER7> Right. And how would you characterize the 4-dimensional extension, in terms of the first three?

Or do you simply draw the line at two dimensions, figuring that's as much as anyone will ever need?

<comment><USER8> What are the two dimensions of which you speak here? The 'row' and 'column' dimensions of a matrix? If so, that's exactly what tensors do: A matrix is a 2-tensor (better, a (1, 1)-tensor, but let's not get into that). If you want an m-dimensional generalisation, just use an m-tensor.

</comment></comment></comment></comment></comment></comment></comment><comment><USER9> Others might find the Sage Notebook interesting:

<http://nb.sagemath.org/> <http://sagenb.com/>

Features

•Use Sage, Python, R, Octave, and most other mathematical software with any web browser

•Notebook interface that allows you to write and run code, display 2d and 3d plots, and organize and share your work.

</comment><comment><USER10> I like the concept - really nice. It would be cool to see an update of Calculize use a math library instead of JavaScript numbers.

        In Calculize:
        a = 1/3
        show a+a+a+a+a+a == 6*a
        # => false
        show pow 9,18
        #         => 150094635296999140
        # should be: 150094635296999121
        show 150094635296999122 - <USER5>
        # => 0

        In Python 2.6.1:
        >>> p = 1.0/3.0
        >>> p+p+p+p+p+p == 6*p
        False
        >>> pow(9,18)
        150094635296999121
        >>> 150094635296999122 - <USER5>
        1

These minuscule rounding errors are inconsequential for most apps, but for math...

Maybe the results will also vary between browsers, because EcmaScript talks of implementation-dependent approximation's.

[Edit: Oops, python got me with it's own quirk - division needs to be from the __future__ or it's integer]

</comment><comment><USER11> This is pretty awesome!

Their contact page 404s unfortunately. There're some visual glitches in their guided tour that i wanted to point out.

Seems like an admirable repurposing of what Coffeescript is doing to create a mathematics toolkit.

(Last note: too bad they didn't name it Calculon!)

</comment><comment><USER12> Impressive. They seem to have added operator overloading to CoffeeScript, among other things:

        # 1. Matrix multiplication

        m1 = matrix([1,  2,  5],
                    [2, -1,  6],
                    [5, 10, -1])

        m2 = matrix([2,   3,  1],
                    [-3, -1, -3],
                    [4,   9, -2])

        show m1 * m2

Not sure how this could be used for "serious" number crunching (as it runs in- browser) but I imagine it would be a _fantastic_ teaching tool.

<comment><AUTHOR> One major problem with any JS-based language for number crunching is JS' lack of any numeric types other than a double.

I don't know how well the string-based workarounds really work, for arbitrary precision math ... but I'd imagine that they wouldn't be terribly fast or convenient. It's a real shame.

<comment><USER13> Current versions of Firefox and Chrome have typed arrays, which add more numeric types for performance optimization. Hopefully we will see them in other browsers soon: <https://developer.mozilla.org/en/javascript_typed_arrays>

</comment></comment></comment><comment><AUTHOR> Direct link to the live demo: <http://calculize.com/pickhardt/standard_example>

</comment><comment><USER14> I really like the look of this. I developed <http://kayali.sf.net> (Maxima/Qt based) and achieving such a clean look is very difficult. Having a web based app makes a lot of sense these days especially for students.

</comment><comment><USER15> Nice. A good next step would be to add an interactive window, like the main window in Matlab.

</comment><comment><USER16> Nice.</comment>


The Research Pirates of the Dark Web - <AUTHOR> http://www.theatlantic.com/technology/archive/2016/02/the-research-pirates-of-the-dark-web/461829/?single_page=true <comment><USER2> The Sci-Hub Tor URL is [https://scihub22266oqcxt.onion](https://scihub22266oqcxt.onion) (source: [https://vk.com/sci_hub?w=wall-36928352_5896](https://vk.com/sci_hub?w=wall-36928352_5896))

Image: [http://i.imgur.com/xZmDmPY.jpg](http://i.imgur.com/xZmDmPY.jpg)

<comment><USER3> You pasted a HTTPS address, but the server doesn't answer to HTTPS (it is somewhat redundant when you use onion services anyway). The correct one is [http://scihub22266oqcxt.onion/](http://scihub22266oqcxt.onion/)

<comment><USER4> It's not redundant; if someone sets up a malicious exit node they can view all your traffic, unless it is encrypted e.g. by SSL.

Of course for this kind of site that is not so important, but you shouldn't use any kind of site where you log in or enter sensitive information over Tor without HTTPS.

<comment><USER5> Traffic to .onion URLs is terminated within the Tor network. It doesn't pass through exit nodes.

HTTPS is actually a bit redundant for .onion URLs, as the hostname is a representation of the host's public key.

</comment></comment></comment></comment><comment><USER6> > the dark web, a part of the Internet often associated with drugs, weapons, > and child porn.

Indeed, due to journalists perpetuating that meme on and on again. Thanks for strengthening the bad image, Atlantic.

<comment><USER7> "The researchers, who have been studying and writing about encryption policy, sniffed around with a Tor browser and found 1,547 out of 5,205 total websites live on the dark web engaging in illegal activity."

It is one of the most common ways for distributing those three things, so yes, that "meme" is correct.

[http://www.networkworld.com/article/3031661/internet/drugs-g...](http://www.networkworld.com/article/3031661/internet/drugs- guns-and-hitmen-more-common-on-dark-web-than-religious-extremism.html)

<comment><USER8> You think the most common way to distribute drugs, weapons, and child porn is over Tor hidden services? I'm incredibly skeptical.

Doubtless a significant percentage of child porn is distributed that way, but I'm under the impression they prefer to use Tor to access encrypted blobs others host for them, like on Usenet. I've met many drug users, but only two of them were even aware of hidden services. And however many guns are sold on hidden services will never compare to the number purchased by the US military, or sold at gun conventions, etc.

</comment></comment></comment><comment><USER9> Really surprised this article makes no mention of Aaron Swartz and his battle with JSTOR.

<comment><USER10> This is the logical continuation of Aaron Swartz work. He should be mentioned.

<comment><USER6> Not to belittle Aaron but the Library Genesis is much older than his JSTOR actions.

</comment></comment></comment><comment><USER11> Why are the academics forced to publish their papers through these paywalls? Hosting a PDF on the university website seems cheeper than going through these publishers.

Are these university imposed rules? Are they forced to go through these publishers if they want their paper peer reviewed and published in journals?

<comment><USER12> To put it short: Academic "weight" works much like google - the more citations paper has, the higher it is ranked. Of course a citation from local university journal (probably every university has at least one) is worth much, _much_ less than a citation from Nature. It is calculated from Impact Factor, that is in turn calculated from number of citations. Sort of a closed loop.

This would not be too much of a problem if not for funding. You see, funding, that is necessary for anything non-trivial, is usually awarded according to researcher's reputation - something again based on impact, citations, etc.

<comment><USER13> It might even be more accurate to say that google works like academic "weight" \-- it's my understanding that PageRank was originally intended to rank research papers.

</comment></comment></comment><comment><USER14> I use it almost everyday, it's even more convenient to search an article in Google Scholar and then download a paper thorough Sci-Hub, than to use Scopus.com or Web of Knowledge's search engine.

<comment><USER15> Do you get good results? I just tried it out and it most of the articles didn't work. I'm hoping it's just because of a traffic spike.

<comment><USER14> Do you search by article name or DOI or link? I prefer DOI, because, I guess, it easier for the engine to find a paper. In 95% cases I find a needed paper by DOI.

<comment><USER16> What DOI means?

<comment><USER17> [https://en.wikipedia.org/wiki/Digital_object_identifier](https://en.wikipedia.org/wiki/Digital_object_identifier)

 _A digital object identifier (DOI) is a serial code used to uniquely identify objects. The DOI system is particularly used for electronic documents such as journal articles._

</comment></comment></comment></comment></comment><comment><USER18> Has anyone successfully found something useful which they couldn't find elsewhere using this tool? I tried it on a few things yesterday and was disappointed.

<comment><USER19> I would say easily a third the time I need a paper, I'll have to get it through Libgen, and especially if a paper is new or published through Elsevier or Nature. (If you've read through my comments and noticed me posting Dropbox links to fulltext PDFs - Libgen in action.) It's also good for older papers pre-2000 where it's unlikely the author has put up a copy or someone else has hosted it, and finally, it's good for getting finalized copies of papers as published since preprints often change quite a bit (economics papers in particular seem to spend years hanging around going through many versions which can change conclusions dramatically).

</comment></comment><comment><USER20> I find the way TOR is used lacking. I really would like to have .Onion resolution across my whole system (in my case, I extensively use Linux). So, Here's a way to do just that:

I use a significant amount of HiddenServices to communicate back and forth with my machines. My eventual goal was to be able to process data from different geographical areas and have them inserted into MQTT via Node-Red. Until now, it was all or nothing with regards to proxy settings.

I have figured that out. For those that want to integrate seamless .onion usage across the whole of Node-Red (and every other Linux program), follow this.

get the following packages (Ubuntu, Debian)

        sudo apt-get install tor iptables dnsmasq dnsutils

Add the following to the /etc/tor/torrc file

        VirtualAddrNetworkIPv4 10.192.0.0/10
        AutomapHostsOnResolve 1
        TransPort 9040
        DNSPort 53
        DNSListenAddress 127.0.0.2

Restart TOR

        sudo service tor restart

Edit /etc/dnsmasq.conf and add the following:

        listen-address=127.0.0.1
        resolv-file=/etc/realresolv.conf
        server=/onion/127.0.0.2

Make a new file, called /etc/realresolv.conf . Add this in the file:

        nameserver 126.96.36.199
        nameserver 220.127.116.11

Restart DNSmasq:

        sudo service dnsmasq restart

Run the IPtables firewall update for redirection

        sudo iptables -t nat -A OUTPUT -p tcp -d 10.192.0.0/10 -j REDIRECT --to-ports 9040

Also, this script must be run at every boot, so add this in /etc/rc.local, ABOVE the "exit 0"

        /sbin/iptables -t nat -A OUTPUT -p tcp -d 10.192.0.0/10 -j REDIRECT --to-ports 9040

Once you do those things, your whole Linux sustem will be able to resolve .onion addresses seamlessly, yet leaving alone canonical address schemes. this means that you can talk with a MQTT-out on an .onion, or control remote servers via exec node and SSH. And since you don't have to poke holes through firewalls, networking between Hidden Nodes with Node-Red sitting on top makes IoT sensor capture from remote areas (Work, home, car, hackerspace) very easy.

Of course, this does not discuss how to actually add a new hidden service You should think very hard before enabling a service: Make sure there is good authentication on them along with the newest updates. There is no determining origination on these kinds of attacks.

cite: [http://www.linuxquestions.org/questions/linux- networking-3/h...](http://www.linuxquestions.org/questions/linux- networking-3/how-to-access-the-darknet-tor-network-4175553338/) , Have confirmed directions work flawlessly on Ubuntu 14.04, 15.04, and 15.10 (various flavors of Ubuntu, XUbuntu, KUbuntu)

<comment><USER21> Thank you, an interesting approach.

</comment></comment><comment><USER22> Somehow I believe that thing could have an awesome forum. (But alas, it does not have one.)</comment>


Video doorbell firm Ring says its devices slash crime, but evidence looks flimsy - <AUTHOR> https://www.technologyreview.com/s/612307/video-doorbell-firm-ring-says-its-devices-slash-crimebut-the-evidence-looks-flimsy/ <comment><USER2> I wouldn't be surprised if Ring overstated their impact.

That being said systems like Ring are pretty amazing. I can log on and people around the neighborhood (big city) are posting videos/images of people who broke into their house or were acting suspiciously late at night. I imagine even if just a slice of these lead to arrests in the short term it could lead to a very good impact in the future (both because the people who were stealing would have likely repeated if they weren't caught + if it becomes perceived as harder to rob a house less people will attempt it).</comment>


Sending Cold Emails - <AUTHOR> http://codecondo.com/tips-for-sending-cold-emails/

<comment><USER2> Nice article, I think Being honest and to the point in the cold email works the best.</comment>


Diagnostic Port (2004) - <AUTHOR> http://www.folklore.org/StoryView.py?story=Diagnostic_Port.txt <comment><USER2> Certainly seems somewhat prophetic of the situation I've always thought was the case at Apple - the "you don't need to see this" mentality, that users should just accept that it works and that's that. I appreciate that suits some people (and indeed most of the kids I teach at one of the schools have Macs and love them), but I'm not sure it's good, long term; the level of knowledge of how computers work at even the most simplistic level seems to be disappearing amongst the majority of those I teach, and I don't think that's an empowering situation.

I wonder how this was all squared with the introduction of USB on the iMac? It appeared to me that the wider adoption of USB happened in part because of it being included on the original iMac series (it may just have taken that long to get traction as most technologies seem to need a while, particularly if there is an alternative as there was on PCs with parallel and PS/2 ports), and USB has been a huge boon in terms of connectivity for most people. I wonder if there was any similar push for no USB, or a proprietary Apple connection (a la ADB) - anyone know?

</comment><comment><USER3> The comment section is probably even more interesting. Specifically, that Jef Raskin was talking about there being a complete product, where for instance you plug in a printer rather than buying a printer _and_ an interface for the printer, rather than opposing expandability.

Other words that might get at the same point: the "Design Considerations for an Anthropophilic Computer" document [1] describes a structuring of components that does not favor people who enjoy tinkering over those who don't.

[1] [http://web.stanford.edu/dept/SUL/sites/mac/primary/docs/bom/...](http://web.stanford.edu/dept/SUL/sites/mac/primary/docs/bom/anthrophilic.html)

<comment><AUTHOR> The problem is that "tinkering" is what computers are _for_. They are only peripherally useful for entertainment or drone work, the latter of which they wind up being used to automate away anyway.

</comment></comment><comment><USER4> Ah, the era where 64K and 256K DRAM prices fell ten fold in a year (from 1984 to 1985). Micron suffered years of losses until just before the DRAM shortage in 1988.

</comment><comment><USER5> My first thought was that this was about swigging fortified wine to possibly aid (and therefore diagnose) ailing health...</comment>


A Trail of Evidence Leading to AT&T's Partnership with the NSA - <AUTHOR> https://www.propublica.org/article/a-trail-of-evidence-leading-to-atts-partnership-with-the-nsa

<comment><USER2> Extensive discussion a week ago of the AT&T/NSA partnership: [https://news.ycombinator.com/item?id=10066014](https://news.ycombinator.com/item?id=10066014)</comment>


Twitter Polls Are an Awful Idea - <AUTHOR> http://techcrunch.com/2015/09/25/twitter-polls-are-an-awful-idea/ <comment><USER2> Could not disagree more, they're brilliant</comment>


Kubernetes Failure Stories - <AUTHOR> https://github.com/hjacobs/kubernetes-failure-stories <comment><USER2> Nice, exactly what I needed today, after firefighting a latency spike because of a compute node after a separate ingress node was restarted.

I would make the taxionomy a bit more precise: failures at running software on the platform and failures at running the platform itself (which of course affect the software running over it: high latency, network packets dropped, DNS not reolved, ...)

In general I find that when the platform works as expected, it is not that easy to make software run on it fail. That is, it is harder than without what Kubernetes provides (granted: you can have it without Kubernetes, but many of us didn't bother to have capable admins setting things up the right way).

What I find extremely fragile is the platform itself. It works, but you have to start and stop things in the right order, navigate a sea of self-signed TLS certificates that can expire, iptable rules and services and logs.

All have failure modes you need to learn: it takes a dedicated team. And once you have that, you'll need another team and cluster to perform an upgrade.

But hey, when it works, it is really cool to deploy software on it.

<comment><USER3> > a sea of self-signed TLS certificates that can expire

I would like to know more about what's going on here. Is this just a sloppy description and in fact Kubernetes uses a private PKI, so that the certs you're using aren't in fact self-signed but signed by a private CA?

<comment><USER4> There's (IMO) a mix.

Kubernetes and cloud native software make a _lot_ of use of TLS for mutual auth.

A standard Kubeadm cluster (very vanilla k8s) has 3 distinct Certificate authorities, all with the CA root keys online.

On top of that things like Helm, FluentD and Istio will make use of their own distinct TLS certs.

One of the most "fun" pieces is that k8s __does not __support certificate revocation, so if you use client certs for AuthN, then a user leaving /changing job/losing their laptop can lead to a full re-roll of that certificate authority :)

<comment><USER5> If you issue user certs, it is best to do it from software and have them live for 8h max.

Also recommended: keep api behind a jumpbox.

<comment><USER4> I've seen short-lived certs as a suggested workaround for the lack of revocation and as a user that might be the best option.

That said the distributions I've seen that make use of client certs, don't do that (typical lifetime for a client cert is 1 year), so I'm guessing a load of people using k8s will have these certs floating about...

<comment><USER5> As an aside, if you want revocable, non expiring user creds you would be better served by bearer tokens.

<comment><USER4> True, the only real in-built option in k8s land for that is Service accounts, which aren't designed for user auth. but can be used for that purpose.

</comment></comment></comment></comment></comment></comment></comment><comment><USER6> You know what's worse than Kubernetes complexity? A shallow abstraction of it by some mediocre team to get promotion and leave everyone else struggle with something that you can't get help from anywhere else. This happened in past two unicorns that I worked for. They template the templates and wrapped the `kubectl` with some leaky abstraction.

At least raw Kubernetes is Google-able!

<comment><USER7> We try to keep it simple at Zalando, i.e. just using Mustache templating and wrapping kubectl to add extra commands. See [https://www.slideshare.net/try_except_/developer- experience-...](https://www.slideshare.net/try_except_/developer-experience- at-zalando-cncf-end-user-sigdx)

</comment></comment><comment><USER8> A long time back , I had gone down a rabbit hole to get Kubernetes manage my Mongodb. Thankfully , I got bitch slapped into reality within a few days and gave up because that rabbit hole goes deep. Now my mongodb stands outside of the K8 and I have no issues with it that cant be solved with a rebuild of a replica node.

<comment><USER9> Glad I'm not the only one who almost got white-whaled into running stateful services on K8s.

The API is so slick that it makes you feel you can do anything. But there's can, and there's should.

<comment><USER10> The API is there, but is there a stable MongoDB Operator? ( [https://github.com/Ultimaker/k8s-mongo- operator](https://github.com/Ultimaker/k8s-mongo-operator) ? [https://github.com/mongodb/mongodb-enterprise- kubernetes](https://github.com/mongodb/mongodb-enterprise-kubernetes) ? )

<comment><USER9> Honestly I'd only think of running Mongo on Kubernetes if my organization is thoroughly bored with how well they've managed Mongo upgrades, scaling, outages, migrations, and tuning over the last year on a traditional VM setup.

Even so, if everyone's bored with the stability, why change it?

I'm an advocate for databases in dev/test environments on K8s due to ease of deployment, but there's too many moving pieces around storage for it to be a great idea for production out the gate.

<comment><USER10> Well. The benefits (monitoring, telemetry/observability) are nice enough that I might think about running it on k8s in prod. But only after sufficient number of dev/staging clusters have been sacrificed.

</comment></comment></comment></comment></comment><comment><USER11> In one of my ex-companies I worked with, we had a newbie coder who was just getting fascinated by Kubernetes. Unfortunately, every project this person touched would be left half-way by him and he'd move on to another project.

This company invested around $1 million into a very new Saas product that had a lot of potential. Now, I'm an old school guy. I like systems where I don't touch devops. The cost for such Paas is usually high, but it saves a lot of my time, which I value more than money (and it is valuable, in many cases). I advised the management to use something like AppEngine which is freakin' awesome for such kind of large scale projects.

Unfortunately, this newbie coder was management's pet. They bit the bullet and went on with his advice to use Kubernetes instead. The system randomly failed, they spent tons of time doing devops and microservices on what should have been a simplified monolith. The development time elongated to almost 2 years. By this time, there were competing offerings in the market for much cheaper.

This costed an entire team's morale, which lead to missed deadlines and product launches. This lead to many missed opportunities. For instance, there was a HUGE client we were demo'ing this Saas product. It failed spectacularly on a relatively light load (I've hosted Rails apps on AppEngine that can handle FAR better) and we lost that product and the client.

It was still not too late and I insisted on management identifying the root cause to switch to a managed Paas stack given how resource constrained we were. But this newbie coder turned it into a political situation ('mine vs yours'). I tried various ways to resolve this, but it didn't work out.

As a result, I said 'fuck this, I'm out of here' and I quit. In less than 3 months of my departure, about 10 people quit including one of the senior managers. In about 6 months, the company shrunk from a double digit to single digit company. The company almost went into bankruptcy.

The company lost its $1 million investment. Everyone left. The product development was put on indefinite hold. Finally, this newbie coder left as well. The founders had to rebuild their companies from scratch.

Co-incidentally, I went on to become an AppEngine consultant. I'm able to run unbelievably large monoliths in production, with almost zero downtime for 3 years in a row simply because I chose to avoid devops, and most importantly infrastructure complexity. I pay more, but it easily is worth my ROI. Most of the time, microservices aren't required and we can get away with a simplified monolith. And if you can get away with monoliths, you probably don't need Kubernetes.

<comment><USER12> > if you can get away with monoliths, you probably don't need Kubernetes

Right, especially if you're doing microservices the "right way" which means, each service has not only its own app setup but its own data store. I am responsible for (among other things) maintaining and scaling my company's infrastructure, and while we do have some vague concept of microservices (app, api (monolith), queuing system, various ML apis, headless browser, etc) it is always _always ALWAYS_ "what's the _simplest_ way to do this?" Microservices are a ton of moving parts, and adding in their own data stores is another can of worms.

We have a need for a scheduler. We are using Nomad internally. I chose this over Kubernetes. Why? I know that Kubernetes has more muscle behind it, can do more "things" we might need in the future, etc. I chose it because of its operational simplicity. It strikes a perfect balance of "scale these three things up" without needing a dedicated ops team to run it.

So far it has performed great, and I really think it comes down to limiting the number of moving pieces. Don't get me wrong, microservices are great if you have an ops team and a 50+ dev team all working on different things. But I often see microservices being pushed _without warning people of the inherent costs involved_.

I'm sure kubernetes is great, and I'm continuously re-evaluating where we are and what we need, but for now simpler is always better. If we do go with Kube, it will likely be a managed version so I don't have to touch the internals...not because I don't want to learn them (I definitely would want to know all the grimy details) but because I just don't have the fucking time to deal with it.

<comment><USER13> How do you use Nomad? Do you run Docker containers with it? I don't need the scaling, I need the part where new versions of code are autodeployed automatically, services are connected together, and basically things update without having to run ops checklists every time.

Kubernetes feels too heavyweight and deploying machines feels too snowflakey...

<comment><USER12> We use nomad a few different ways. One is system jobs which run DNS and Fabio (the networking fabric layer) on the host machines. Then, yeah, for all the apps and services we use Docker containers which I've found runs pretty well...with one caveat: make sure if you're spinning jobs up/down a _lot_ you get a fast disk. For instance, we were running on 64gb ebs gpio volumes and Docker was starting to grind to a halt on them (we spin workers for our queue up/down quite a lot). We started using instances with ephemeral SSDs instead which has a bit more operational complexity on init, but overall works really nicely.

We also use Nomad for deployments as well. I wrote some deploy scripts by hand that create the Docker containers and load the templated Nomad jobs ie

        image = "container-hub.myapp.com/api:{{ BUILD_TAG }}"

becomes

        image = "container-hub.myapp.com/api:master.20190613-153222.f996f1bd"

I'd say as far as "take this container and run N instances of it and load balance requests at this hostname to them" Nomad has been pretty great. There is definitely some work involved getting the comm fabric all set up exactly how you want (Fabio does make this easier but it's still work). Consul now has Connect ([https://www.consul.io/docs/connect/index.html](https://www.consul.io/docs/connect/index.html)) which I haven't looked at yet which might alleviate a lot of this. I think some of our complexity also came fromt he fact that we do have TCP services we needed to load balance and most fo the service fabric stuff forces HTTP onto everything.

Overall my experience with Nomad has been great. It's capable and really not too difficult to operate for one person who also has tons of other stuff going as well =].

<comment><USER13> This is super useful, thank you! Do you think all of this is worth doing, now that you can basically get managed Kubernetes for free from providers as long as you use their machines?

It feels like this is much easier than rolling your own Kube, but not easier than using the managed version...

<comment><USER12> Not sure, honestly. I've never used Kube, just taken a preliminary look at the docs and been scared away by how much abtraction there is. While providers may manage it for us, I'm not sure to what extent they manage it. We're on AWS and I haven't been super happy with the responses/response times of their support, so when dealing with unknowns I'd rather not rely on someone else.

That said, Nomad hasn't been without problems. It's just that the problems seem to be easier for one person to solve. I set all this up almost a year and a half ago and haven't touched it much since, so it's possible both Nomad, Kube, and and managed services have come a long way and now is a good time to re-evaluate.

</comment></comment></comment></comment></comment></comment><comment><USER14> I got enough of random 503's, network errors, slowdowns on mid-to-high traffic and dropped TCP connections yesterday. I setup dedicated VPS's for our main app servers using Ansible and good ol' fashion Capistrano. It feels almost old-school, but so much more stable.

</comment><comment><USER15> I'm torn on this list. It is important to learn from the mistakes from others, so I like it (postmortems are great for this reason), BUT it feels like folks are using these examples as reasons to stay away from Kubernetes. There could be a significantly larger list of system failures where K8s is not involved. Similarly there could probably be a list of "Encryption Failure Stories" but that doesn't mean we shouldn't encrypt things.

As an industry, one of the things we do pretty well is identify the most viable patterns to solve a problem and then develop and adopt the best primitives of those patterns. This is what Kubernetes is for creating reliable, scalable, distributed systems.

<comment><USER16> k8s does not solve any problem around making your system distributed, scalable and reliable.

You still have to implement your own architecture to implement quorum, leader election, failover etc where needed.

k8s will only redeploy containers when a node fail.

<comment><USER17> > k8s will only redeploy containers when a node fail.

That's not true at all. Kubernetes monitors containers' health and automatically scales deployments according to the demand. Thus quite obviously kubernetes does help make your system distributable, scalable and reliable. In fact, that was the design goal of kubernetes.

</comment></comment></comment><comment><USER18> In my opinion many of these issues with Kubernetes arise because it is not the right abstraction for application developers. You are forced to think about too many low level details to get a stable application running.

Many companies forget that they are incharge of getting way more intricate details of the application runtime right when they shift their application to Kubernetes.

In some of my recent experience I have seen a company shift an application from app engine to Kubernetes. However they forgot that appengine is using an optimized jvm to run your application. When they deployed to Kubernetes their app grinded to a halt. They forgot about all the observability that comes out of the box in app engine, thus resulting in an unobservable badly performing application.

Hopefully more domain specific runtimes build on top of Kubernetes can help application developers deploy to a kubernetes cluster in a sane way. I am putting some of my money on knative, however it is still quite hard to convince clients to invest in this area.

<comment><USER19> Not sure what any of this means.

Kubernetes does not prevent you from using an optimized JVM to run your application. In fact it doesn't even involve itself at that level rather it focuses just on managing containers which can have anything inside them.

And Kubernetes actually has far more observability than most distributed applications since you can get plugins which trace/monitor every connection between containers as well as monitor the health of each container.

I think what you're after is a PaaS on top of Kubernetes ? Well there are many of those around as well.

<comment><USER20> Yes, you can get a bunch of pieces that need a team to evaluate and operate. You are saying the same thing and somehow making it a disagreement?

</comment></comment></comment><comment><USER21> These are all very informative and even amusing. But this is to be expected. Kubernetes is an enormous system (or ecosystem of systems actually). It's really hard to understand all the pieces and components, even the built-ins.

I still struggle (after having set up 2 clusters from scratch) with understanding networking, especially Ingresses and exposing things to the public internet.

</comment><comment><USER22> After a couple of years of massive frustration with the entire direction of the "devops" segment, I think I'm resolved to get out of it and either move further up back to ordinary application development or further down into the actual kernel, preferably working on FreeBSD or some other OS that's more sane and focused than Linux.

Kubernetes represents the complete "operationalization" of the devops space. As companies have built out "devops" teams, they've mostly re-used their existing ops people, plus some stragglers from the dev side. These are the people you hear talking about how great Kubernetes is, because for them, they see it as "run a Helm chart and all done!". Which makes sense, since they were, not too long ago, the same guys fired up about all the super-neato buttons to click in the Control Panel. 90% of "devops" people at non-FAANG companies are operations people who just think of it as a new name for their old job.

Among this set, there's no recognition of the massive needless complexity that permeates all the way through Kubernetes, no recognition of the tried-and- tested toolkit thrown away and left behind, no recognition of the fact that we're working _so hard_ to get things that we've had as built-in pieces of any decent server OS for decades. No recognition that Kubernetes _exists_ so it can serve as Google's wedge in the Rent-Your-Server-From-Me Wars, and no awareness that just in general, _there 's no reason it should be this hard_.

Of course, to them, it's not hard. They have an interface with buttons, they can run `helm install`, they get pretty graphs via their "service mesh". That's what I mean by "operationalized"; Kuberenetes is meant to be _consumed_ , not configured. You don't ask how or why. You run the Minikube VM image locally and you rent GKE or EKS and go on your merry way. The intricacies are for the geniuses who've blursed us with this death trap to worry about! Worst- case, you use something like kops. Start asking questions or putting pieces together beyond this, and you're starting to sound like you don't have very much of that much-coveted "devops mindset" anymore.

"What happens if there's a security issue?" Oh, silly, security issues are a thing of the past in the day and age where we blindly `FROM crazy-joes-used- mongodb-emporium:latest-built-2-years-ago`. Containers don't _need_ updates, you goose. They're beautiful, blubber-powered magic, and the Great Googly Kubernetes in the sky is managing "all that" for us. Right on.

I'm picking on Kubernetes specifically here because it's the epitome of all this, but really everything in "devops" world has become this way, and combined with the head-over-heels "omg get us into the cloud right now" mentality that's overtaking virtually every company, it's a bad scene.

Systems have gotten so much more convoluted and so much dumber over the last 5 years. The industry has a lot to be embarrassed about right now.

<comment><USER23> IMO .... AWS has been eating everyones lunch. K8s was a play by Google to sell GKE / GCP and it worked.

Problem being not everyone has a team of Google SREs to manage it so when k8s blows up the skillset to figure out the issues simply doesnt exist in the team managing it.

<comment><USER24> They are still the 3rd cloud provider.

It is hard to state that it worked, specially when AWS and Azure also offer Docker and Kubernetes deployments.

On Microsoft's case it is even supported directly from Visual Studio.

<comment><USER23> Windows is a 2nd class citizen when automation is concerned IMO.

I believe Azure is feeding off of enterprises who are 15 years behind everyone else.

Windows as a platform cannot possibly keep up with the fast moving changes required by containers and that ecosystem. The only way Azure is competing is offering Linux based systems.

</2 cents>

<comment><USER24> Only for those that don't bother to learn how to do it the Windows way.

My Windows 2000 deployments already had plenty of automation scripts.

</comment></comment></comment></comment></comment><comment><USER7> As the owner of the linked GitHub repo (also rendered on [https://k8s.af](https://k8s.af) \--- thanks to Joe Beda), I highly encourage everyone to contribute their failure stories (I'm still looking for the first production service mesh failure story..).

Also be aware of availability bias: Kubernetes enables us to collect failure stories in a (more or less) consistent way, this was previously not easily possible (think about on-premise failures, other fragmented orchestration frameworks, etc) --- I'm pretty sure there are much more failure stories in total about other things (like enterprise software), but we will never hear about them as they are buried inside orgs..

BTW, I also have a small post on why I think Kubernetes is more than just a "complex scheduler": [https://srcco.de/posts/why- kubernetes.html](https://srcco.de/posts/why-kubernetes.html)

</comment><comment><USER25> Some really interesting issues that hopefully, as a new Kubernetes Cluster maintainer, I'll now be able to avoid!

<comment><USER7> Thanks, feel free to reach out on Twitter ([https://twitter.com/try_except_/](https://twitter.com/try_except_/)) --- we are always happy to share experiences on running K8s.

</comment></comment><comment><USER26> Awesome. I'd like to see a list for other related products.

Such as Openstack. I bet there's a few stories there.

</comment><comment><USER27> So the most used tags are: OOMKill, CoreDNS, ndots:5, NotReady nodes.

I'd seriously consider disabling the OOMKiller. Not sure about the DNS issues.

</comment><comment><USER28> This is just propaganda to drive companies away from Kubernetes so that they use expensive hosted 'lock-in' PaaS solutions instead of free, open source, no lock-in solutions.

<comment><USER9> The tone of the repo doesn't really scream propaganda to me. It just looks like a solid list of failures and what people can learn from them.</comment></comment>


Show HN: Handpicked, Curated, Randomized Idea Generator for 3D Printing - <AUTHOR> http://whatshouldi3dprint.com/ <comment><USER2> A well-selected list of interesting 3D print files/projects is a nice thing, but IMHO hiding it behind a "random" button removes 95% of the value it might have.</comment>


FMRI bugs: estimating the impact (Bibliometrics of Cluster Inference) - <AUTHOR> http://blogs.warwick.ac.uk/nichols/entry/bibliometrics_of_cluster/ <comment><AUTHOR> Title annotated for general clarity as Dr. Nichols's original (in parentheses) is a bit opaque. Also, that should be a lower-case "f" on "fMRI"; I believe that the title was the victim of autocapitalization.</comment>


Cash for Clunkers Fails to Help Economy or Environment - <AUTHOR> http://online.wsj.com/article/SB10001424052748703628304574453280766443704.html?mod=wsj_share_digg <comment><USER2> This article is not just totally off-topic. It's a poorly written article consisting of little more than one ad hominem argument after another. Not even clever ad hom attacks, either.

<comment><USER3> Er, not going to disagree that it's off-topic, but do you know what an ad hominem attack is? <http://en.wikipedia.org/wiki/Ad_hominem></comment></comment>


Big government the real threat to Internet - <AUTHOR> http://www.cnn.com/2010/OPINION/08/06/thierer.net.neutrality/index.html

<comment><USER2> Sure, if you include all the big government subsidized, supported, and protected telcos like Verizon, Comcast, etc.

IMHO any state-protected monopoly or oligopoly or any large recipient of state subsidies is not a "private" company.</comment>