Beating hash tables with trees? The ART-ful radix trie - <AUTHOR> http://the-paper-trail.org/art-index/ <comment><USER2> My experience has been that the vast majority of papers on data-structures are at best misleading, and at worst deliberately biased.

For example:

> The hash table used by the authors of ART in their study was a chained hash > table, but this kind of hash tables can be suboptimal in terms of space and > performance due to their potentially high use of pointers.

> Our experiments strongly indicate that neither ART nor Judy are competitive > to the aforementioned hashing schemes in terms of performance, and, in the > case of ART, sometimes not even in terms of space.

[https://www.victoralvarez.net/papers/A%20Comparison%20of%20A...](https://www.victoralvarez.net/papers/A%20Comparison%20of%20Adaptive%20Radix%20Trees%20and%20Hash%20Tables%20-%20ICDE%202015.pdf)

<comment><USER3> It is unsurprising that a structure designed for range queries loses out against hashes for random point look-ups.

Thanks for posting that addition and very nice link. It is completely unclear why authors in this field even attempt to compete with hash-tables for random point queries: Trees (whether comparison or radix) make only sense when using either range queries or when faced with a query distribution that prefers locality.

Something I'd like to see is benchmarks of batch-query performance: If we can queue a couple of queries, then trees should gain a lot from processing them in-order (then, the last query has already warmed the cache for the next; this probably can pay for approximately sorting the batch).

<comment><USER4> > or when faced with a query distribution that prefers locality

Isn't this a fairly common pattern? How would we go about quantifying the preferring locality-ness of a query distribution?

<comment><USER5> > _How would we go about quantifying the preferring locality-ness of a query > distribution?_

For each level of the tree, treat the incoming stream of queries as a markov process where each state is a query that involves a certain node. So, if I have 7 nodes on level 2, I can build up a table of transition probabilities between vertices like "query involved node 3 on level 2" and "query involved node 7 on level 2." When the transitions between these vertices and themselves have high probability, the queries prefer locality. You can see which scale the locality is preferred on by doing this at each level of the tree.

</comment></comment></comment></comment><comment><USER6> Nice article and analysis! I'm actually considering scrapping the trie used in my project to something based off of this one, with some modifications:

For instance, find_node(c, Node48) could avoid the branch if a non-existing index points to an additional entry in child_ptrs that's always NULL. Lookup would be comparable to the Node256 version.

Another thing that could be done, is to scrap the Node48 entirely, and implement two new structs to replace it: Node32 and Node64, and use respectively AVX2 and AVX512. These can be based off of the Node16 version. It remains to be seen if these will yield better performance than the branchless Node48 above, especially if power management kicks in when mixing AVX512 with older SIMD generations.

The trie in Lwan ([https://lwan.ws](https://lwan.ws)) does an interesting trick to reduce the amount of memory used in the equivalent of a Node256: instead of 256 pointers to a node, it has only 8 pointers. Characters are hashed (MOD 8). The leaf node contains a linked list of key/value pair, and an actual string comparison is performed at the end. (Lwan cheats here by avoiding a string comparison if the linked list contains only 1 element.) Works pretty well, as it's part of the URL routing mechanism.

One other experiment I've been making with tries, is to use the idea of key compression and use it in a different way: slice it every 4 or 8 bytes, consider those bytes as an arbitrary integer, and add every chunk of it to a hashmap<int, some_struct>, building a chain for the next lookup in some_struct. The prototype I wrote works pretty well.

<comment><USER7> Another standard trick to reduce memory is to store a bitfield telling you which pointers are not null, and then store an array of only the pointers that are non null. For example for a Node64 you store a 64 bits bitfield plus only the pointers that are not null, so if that node has only 3 children you store 64 bits plus 3 pointers instead of 64 pointers. You can index that structure by doing a shift + popcount: if you want to find the pointer at index n you first check the n-th bit in the bitfield to see if the pointer is null, and if it isn't you count the number of set bits in bitfield[0..n] to find the index into the pointer array.

</comment></comment><comment><USER8> A good point for both RB trees and linear-addressing hash tables is that they can be implemented with vectors( [1], [2]), allowing the case of initial reservation for N elements, so with a tricky implementation you could even have the data structure with one or zero allocations (e. g. allocate the tree or the hash table in the stack). For tries you could use many memory pools for the different node sizes, apply path compression, and even a LUT accelerator for reaching the Nth level, but hardly could be implemented using a vector.

[1] [https://github.com/faragon/libsrt/blob/master/src/saux/stree...](https://github.com/faragon/libsrt/blob/master/src/saux/stree.c)

[2] I'm implementing a key-value hash table that will be added to the same library as [1] with "srt_hmap" type, in one continuous allocation. Being able to use hash tables allocated both in the heap and in the stack (e.g. you could use a int32-int32 hash table allocated in the stack for computing the color frequency of a bitmap image). Being the HT performance 4 to 5x the performance of the RB-trees, including cost of rehashing - rehash implementation using techniques for avoiding moving all the data- (rehashing only available for the heap case).

<comment><USER9> You can implement most things with dynamically allocated vectors. Just use indices instead of pointers to link the elements. This can also bring advantage in space efficiency if you're able to do with 4 byte indices instead of 8 byte pointers.

<comment><USER10> You can consider the entire virtual memory space to be a big vector, where a pointer is just an index into it!

<comment><USER9> However that's a pretty poor vector. It's not homogeneous (you put things of different shapes inside). That also implies you need sophisticated memory management, leading to further overheads. You cannot meaningfully iterate it.

<comment><USER10> I was mostly joking…

<comment><USER9> Yes and I'm serious :-)

</comment></comment></comment></comment></comment></comment><comment><USER11> Just a friendly reminder that B-trees are often faster on modern microprocessors than RB-trees. See kbtree.h for a simple, yet fast example. I didn't test it, but I'd assume B-tries would be rather efficient.

<comment><USER7> Red-Black trees are isomorphic to B-trees of node size 4. If you take a Red- Black tree and put each black node together with all its red children into a single node then you get a B-tree of node size 4. An insertion/deletion algorithm for Red-Black trees gives a corresponding insertion/deletion algorithm for B-trees of size 4 and vice versa. Putting those nodes together in a single node probably improves performance already because you have fewer pointers, and you can improve performance further by increasing the size of the B-tree nodes to, say, 32 instead of 4.

<comment><USER10> They are isomorphic, but B-Trees are more cache friendly. B-Trees store more in each node, while red-black trees require pointer chasing for each element.

<comment><USER7> That's what I said.

</comment></comment></comment></comment><comment><USER12> Radix trees are one of the most under utilized data structures.

They are great and have fantastic performance!

I implemented a custom on disk storage engine with a Radix format, and am getting on a low end MacBook Air 2015 about 3K/acked writes to disk/second! It is now the default at [https://github.com/amark/gun](https://github.com/amark/gun) the code is pretty short too.

</comment><comment><USER13> > _This is superior to binary-search: no branches (except for the test when > bitfield is 0), and all the comparisons are done in parallel_

Branchless binary search isn't hard to implement if you know (or can bound) the number of elements statically. You just use the comparison result arithmetically instead of branching on it, and you unroll the loop.

Obviously a binary search can't do comparisons in parallel, though.

<comment><USER14> > Obviously a binary search can't do comparisons in parallel, though.

Sure you can, although at reduced efficiency the "deeper" you go.

For example, while searching a range of size N, you know your next probe point will be at N/2\. You also know the probe point _after_ that will be at N/4 or 3N/4, and so on. You know up-front all the possible probe points. Of course, only one out of the two probe points N/4 or 3N/4 or will actually be useful, depending on the N/2 result - but that doesn't stop you from comparing all three in parallel.

You can get a reasonable speedup this way: the extra comparisons happen in parallel and for a moderate depth the unnecessary probes are more than compensated by doing comparisons in parallel.

</comment></comment><comment><USER15> If somebody need a good/fast/well optimized Go implementation of the ART, check this out: [https://github.com/plar/go-adaptive-radix- tree](https://github.com/plar/go-adaptive-radix-tree) (disclosure: I'm the author)

</comment><comment><USER10> I had to implement a trie for an Aho-Corasick implementation a while back, and I just used a std::unordered_set<unichar, std::unique_ptr<trie_node>> to store the children (this was Objective-C++, so I was using UTF-16 characters taken from an NSString). Worked well enough for the effort I put into it.

<comment><USER16> So you ended up using a tree to hold your tree nodes. I guess that was good enough for your purpose, but the article is discussing an optimized implementation.

<comment><USER10> std::unordered_map is general a hash table, is it not?

<comment><USER16> Sorry, I switched set and unordered set in my mind. Still, a generic hash table isn't going to match a tailored data structure.

<comment><USER10> I mean, it might. I only had to construct one trie, and I used it hundreds of millions of times, so O(1) child (hash) lookup ended up being faster than the O(log(n)) binary search lookup, at best, from the data structure described in the article. And since the data structure in the article wastes some space as well, I may have even used a similar amount of storage.</comment></comment></comment></comment></comment>


Ask HN: How much user data can I get from user via web browser - <AUTHOR>

Alright, this is serious. Someone stole the password of our customer and now he logins using this password. We need to know who he is. We currently log IP, session_id, login and logout time but this is not enough to know who he is. IP addresses are mostly dynamic, session_id changes so we need another solution. Can you give an example what other things that we can collect. Is it possible to found his address, name etc somehow? <comment><USER2> Checking visited links and browser config including plugins has a good chance to give you a unique fingerprint. Though depending on how the password was taken, it's possible that you are dealing with multiple people with the same access. Consider having the user contact law enforcement. [https://www.eff.org/deeplinks/2010/05/every-browser- unique-r...](https://www.eff.org/deeplinks/2010/05/every-browser-unique- results-fom-panopticlick)

<comment><AUTHOR> Checking visited links? Can I do that? Most probably the user has facebook account and he always visit there. If this is what you mean, wow this will work. And yes, there may be more than one sessions for each user which makes it difficult.</comment></comment>


Money has been privatised by stealth (2011) - <AUTHOR> http://www.theguardian.com/commentisfree/2011/nov/15/money-privatised-stealth

<comment><USER2> This seems to be much a do about nothing.

Suppose you borrow money from a bank. The bank could:

A. Use mortgages/IOUs instead of cash so the next borrower who wants to borrow is given IOU's (from various people) instead of cash. Assuming the person selling the house agrees, the buyer trades these IOU's to the seller for the house. "I'll give you 2 IOU's that I got from my bank (1 from Bob and 1 from Sally) totaling $200K for your house."

OR B. The bank uses some mechanism to convert those IOU's to cash and assumes the risk that Bob and Sally might not pay their debts.

The bank agrees to guarantee/take responsibility for the IOU's it received i.e covers the risk that the IOU will go bad and gives the next borrower cash instead. The banks is being compensated for assuming that risk by charging interest.

Am I missing something?

</comment><comment><USER3> > When you ask the bank for the money to buy a one-bedroom box in London, the > money that appears in your account isn't borrowed from some prudent > grandmother's life savings. In fact, the bank simply types those numbers > into your account, creating brand new money that you can now spend.

Erm what?

<comment><AUTHOR> Yes. Banks bring money into existence in the form of debt by loaning it to people. It seems massively immoral to me that they charge interest on something that literally costs them nothing to bring into existence.

<comment><USER3> Is there a limit on how much money they can create? Can I start my own bank?

<comment><USER4> 1) Yes there is, that is why it is called fractional reserve, they are allowed to expand the money supply based on a fraction of the reserve deposits they take in. This number is set by the FED in the case of the US.

2) Yes you can with the proper licensing and certifications. It's not as easy as hoping on down to the division of banking and picking up your license, there are some pretty stringent requirements, it's not cheap to start a bank.</comment></comment></comment></comment>


Cdnjs - the missing cdn - <AUTHOR> http://cdnjs.com/ <comment><USER2> What's the policy on previous versions of libraries?

I noticed, for example, that only the latest version (3.1) of the jQuery plugin Nivo Slider is available. The last versions (<= 3.0.1) are returning 404s.

Given that the previous version was released in May 2012 that's an _insanely_ fast deprecation policy for a CDN.

I have to guess that either I've stumbled upon a bug or minor oversight in this case, because I can't see how removing old versions that quickly would be at all a workable solution for 99% of use cases...

<comment><USER3> Maybe they'll only support version that were released from the date that library was added to the CDN. In other words, hopefully once a library+version are added to the CDN, it's supported for a long long time.

<comment><USER2> Yes, I think you are correct.

Digging deeper, I see that libraries are added via pull request and that the Nivo Slider library was added 11 days ago. Other libraries that have been there longer (such as jQuery) continue to have old versions.

<comment><AUTHOR> We'll host any version of any library. It's just that no one typically adds versions of libraries older than we currently host.

</comment></comment></comment></comment><comment><USER4> "This page (<http://cdnjs.com/>) is currently offline. However, because the site uses CloudFlare's Always Online™ technology you can continue to surf a snapshot of the site."

Well, that's hardly comforting.

<comment><USER5> FWIW, the libraries they host still seem to be getting served normally, so that's a good thing.

<comment><USER4> Sort of. I'm still not sure I want to use a CDN that can't keep its main site up.

How do I know their .js files won't expire out of the CloudFlare cache before the site comes up, for example?

<comment><AUTHOR> It doesn't work like that.

The CDN portion is _completely independent_ of the website. The website is really just an index of the files on the CDN.

</comment></comment></comment></comment><comment><USER6> I always prefer compiling and gzipping the whole site's assets to just one .js and one .css file and serve them through CloudFront. It's usually around 100-200 KB and CloudFront's latency is very low at most places.

This saves a lot of requests and waiting time between page loads (i.e. the first page is always slower, but subsequent page loads take almost no time because there're very few (or even just 1) requests needed to make.)

</comment><comment><USER7> Who pays for this ? How do I know you're not going to replace some of that javascript with malicious content ?

<comment><AUTHOR> Cloudflare pays for this. They've been sponsoring cdnjs for around a year now.

As for the security of our system, all javascript files are verified against official sources before going on the cdn. Additionally, we have many library maintainers submitting updates to their own libraries.

Beyond that the only question remaining is our personal integrity. Like any relationship with a third party, you're going to have to decide whether trusting us is an acceptable level of risk. If past performance is any indication of integrity, we have had no security incidents since we began in January 2011.

<comment><USER8> I assume you are the creator of cdnjs - what are your relation with cloudflare beyond just the sponsorship? Are you working for them? Do you advise them?

I'm wondering what is the performance increase delivered by cloudflare. I've heard many mixed opinions and I'm at the interesection where I have to decide whether I'm using them or others.

btw - kudos to Cloudflare for sponsoring this - seems like a great way to put yourself in front of developers.

<comment><AUTHOR> We have a very good relationship with Cloudflare. See these releases by Cloudflare:

[http://blog.cloudflare.com/cdnjs-community-moderated- javascr...](http://blog.cloudflare.com/cdnjs-community-moderated-javascript- librarie) <https://www.cloudflare.com/apps/cdnjs>

As for Cloudflare's speed, you can see cdnjs's average ping time as measured by pingdom here: <http://stats.pingdom.com/4jg86a2wqei0/362854>

<comment><USER9> > As for Cloudflare's speed, you can see cdnjs's average ping time as measured > by pingdom here: <http://stats.pingdom.com/4jg86a2wqei0/362854>

If I'm guessing what the names of your Pingdom checks mean correctly, they seem to show CloudFlare making your response time 10ms slower. I'm assuming that cdnjs.cloudflare.com is the site with CF in front, and cdnjs.com is without, not sure if that's correct.

<comment><AUTHOR> <http://stats.pingdom.com/4jg86a2wqei0/362854/history>

</comment></comment></comment></comment></comment></comment><comment><USER10> What do providers get for access to these type of files? Can they capitalize on the information gathered from file requests? Adding to their knowledge of traffic patterns etc...

<comment><USER11> As it's sponsored by CloudFlare, I suspect it makes for a good Case Study for them.

</comment></comment><comment><USER12> and here is the other 'missing' cdn that does the same thing and has been around longer:

<http://cachedcommons.org/>

:)

<comment><USER13> cdnjs has been around for a while already.

<comment><USER12> cachedcommons claims to have been around since 2009. cdnjs claims to have been around since 2011. Im not saying one is better than the other, but i am implying that cdnjs is not 'the missing cdn'.

</comment></comment></comment><comment><USER14> That's pretty awesome! I've always wondered why popular css grids weren't also CDN'd. Bootstrap, 960, etc, etc - it makes great sense to have many of these things cached across 100s of sites 1 time - instead of 100 times. Modify the cdn version in a seperate style sheet afterwards.

<comment><USER15> The same people who are doing the cdnjs have been planning do a CSS one as well, <https://github.com/cdnjs/cdncss>

<comment><AUTHOR> Yep. We plan on launching the css component our our offering in the near future.

<comment><USER16> I've just submitted a pull request with both versions of normalize.css. <https://github.com/cdnjs/cdncss/pull/15>

</comment></comment></comment></comment><comment><USER17> I suppose if you have a big trust issue letting Cdnjs host your libraries or if you have a customized build of one, you could just do what they did and sign up for CloudFlare and control the files yourself. [edit: CloudFlare, not Cloudfront]

</comment><comment><USER18> Ok, I'm not a developer and I'm probably missing the big picture or smth; my question: \- All this fuss is about hosting a few text files none bigger than several KB??

Who in this world does NOT afford to host a few small files nowadays?

<comment><USER19> The idea is that users wouldn't have to download the same jquery or whatever script over and over for every site they visit. It makes less sense when it comes to not-so-popular script files, but I guess there's a convenience factor too.

<comment><USER20> We need to extend the baseline notion of what the web is. If some nontrivial number of sites are using (say) jQuery, then it would be a good idea to have a way to declare "SCRIPT SRC jQuery version x.y.z" and let the browser figure out where it lives. Then you fetch it once, parse it once, and run it many times, no matter what site you may be visiting.

Or at the very least, we need some way to say "get this script from this URL, but only if it hashes to <this value>, since otherwise it's been compromised". Why worry about CDNs when you can design the script-switcheroo attack right out the system in the first place?

I wrote about this in June: <http://rachelbythebay.com/w/2012/06/27/src/>

<comment><USER21> It seems to me that the best way to handle this would be a content-addressable system with a more traditional fallback. You'd declare that you want file with SHA-256 (or whatever) hash of XYZ. If the browser has it, then you're done. If the browser knows where to find XYZ, then it can go off and grab it however it feels like. For compatibility, you'd also specify one or more traditional URLs where you think that content XYZ can be found, and the browser could use the hash to verify integrity.

The trouble with the current CDN setup is that you only get the maximum benefit if everybody uses the same CDN, but people don't necessarily want to trust Google or whoever to host code that their site relies on. With a content-addressable system with fallbacks, you'd get all the benefits of the CDNs with none of the drawbacks.

<comment><USER22> I think we already have this system - it's the browser's cache. Consider the following sequence of steps:

1) add the "SIG" values to the tags in the HTML page that have SRC attribute. Be it scripts, or images, or iframes, or what not. So far, we've just bloated the page a bit with no good effect for the user.

2) update the code in the browser to calculate for each resource in the browser's cache the values of a few "frequently used" signatures, and allow the signature-based access to the content [compressed trie?], in addition to indexing the cache by the URL. Now, the "bloat markup" from step 1 starts to kick in - and you can reuse web-wide all sorts of resources - scripts, downloadable fonts, artwork, whatever. At this point the user spends the time only on the first download of the file, even if that file comes from a very slow VPS.

This approach could dramatically decrease the load on the CDNs for the frequently-repeated content, and get the latency down to near zero, so it would be much better than even the ISP-hosted CDNs.

Maybe anyone is reading this who is familiar with the FF/Chromium codebase to comment on the feasibility of such an approach ?

<comment><USER21> I'm a bit confused, how does this qualify as "we already have this system" when your step #2 is "update the code in the browser"?

Aside from that, yes, this sounds pretty much like what I'm thinking of.

<comment><USER22> I thought you had in mind a totally new content delivery mechanism to fetch the data by hash from the network, relative to that adding the content addressability to browser cache is near trivial. Apologies if I misunderstood.

<comment><USER21> I was thinking that this could be added as well, but that it would be purely optional, if anyone got around to adding it.

Basically, you need the hash and a fallback regular URL. The browser is free to grab the content using the hash however it likes, whether it's grabbing it from its cache, using the fallback URL, using another known URL for that content, or using some new delivery mechanism.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER23> What about old versions? Taking the jQuery url, and changing it to the version previous to the newest release (1.7.2), 404s on me. This is a showstopper.

[http://cdnjs.cloudflare.com/ajax/libs/jquery/1.8.0/jquery-1....](http://cdnjs.cloudflare.com/ajax/libs/jquery/1.8.0/jquery-1.8.0.min.js) \- ok

[http://cdnjs.cloudflare.com/ajax/libs/jquery/1.7.2/jquery-1....](http://cdnjs.cloudflare.com/ajax/libs/jquery/1.7.2/jquery-1.7.2.min.js) \- 404

<comment><USER2> Ha, you and I noticed the same thing just moments apart. Hopefully someone will reply on this thread to our question, because I can't imagine having to upgrade all of my projects immediately whenever a new version of any library was released.

EDIT: Looks like the URL pattern just changed slightly for jQuery. 2.72 is still around:

[http://cdnjs.cloudflare.com/ajax/libs/jquery/1.7.2/jquery.mi...](http://cdnjs.cloudflare.com/ajax/libs/jquery/1.7.2/jquery.min.js)

Looks like they host back to 1.6.1, probably when the library was added to the project:

<https://github.com/cdnjs/cdnjs/tree/master/ajax/libs/jquery>

</comment></comment><comment><USER24> Looks really useful at serving the stuff that you can't find anywhere else (and for whatever reason don't want to host yourself), but IMO it really needs a TOS / license - I'm guessing that I can use it on personal sites, but can I use it on commercial sites, can I use it on SaaS sites, or sell sites that use it, etc etc?

</comment><comment><USER25> Front-end guy here, curious about CDN access on mobile - is it faster to serve one CSS and one JS minified file through a private CDN (like CloudFront), or use something like CDNJS to make concurrent CDN calls with many smaller files spread across a connection?

</comment><comment><USER26> Hint: If you want to brag about your uptime ("100%") then you should monitor that with a HTTP-request and not an ICMP Ping.

The latter is rather deceptive because it's not actually testing service availability.

</comment><comment><USER27> "This website is offline No cached version is available"

definitely missing ;)

</comment><comment><USER28> MochiKit isn't listed: <http://mochi.github.com/mochikit/download.html>

</comment><comment><USER29> I really thought this was going to be related to cjdns.

<https://github.com/cjdelisle/cjdns>

</comment><comment><USER30> I like the simple new design. Everything that I need is there and nothing more. Huge improvement over the last design.

</comment><comment><USER31> <http://news.ycombinator.com/item?id=2828516>

</comment><comment><USER32> Needs more wu.js

<http://fitzgen.github.com/wu.js/>

<comment><USER33> From what I've gathered, you can fork cdnjs, add it, and do a pull request.

</comment></comment><comment><USER34> great CDN for all the stuff that you want that isn't on google or other CDN's.

</comment><comment><USER35> For every one of these CDNs you use, chances that people with scriptblockers will use your site goes down.

When I see that a site tries to resolve scripts from 50 domains, for what should really just be static HTML, I generally leave.

So please. Don't use CDNs. If you want people to trust you, host your own damn stuff on your own domain.

<comment><USER36> How does using CDNs make you distrust a website? If someone is loading jquery.min.js from Google shouldn't you trust it _more_?

<comment><USER35> When I have see that a webpage has 20 or more scripts attached to it from domains differing from the one website I am visiting, I do by default assume they are tracking scripts from advertisers or facebook or similar ilk.

If a website _needs_ scripts, I expect the website to serve it from a domain which belongs to it. For most sites I visit there are at least 30, sometimes 50 scripts from various sites and domains trying to track me, slowing down my browsing experience, and sucking up my systems ram.

Disabling those causes massive speed-ups. Plus it protects my privacy.

Install ScriptNo in Chrome (or similar for Firefox). You will be shocked by the difference. And you will be shocked by the massive script-abuse currently on the net.

And no, I will not wade through that long list for each and every page I visit, to whitelist whatever CDN you have decided to put in the same trustworthyness-group as doubleclick.net.

If your site breaks with those scripts blocked, I leave.

<comment><USER37> _Install ScriptNo in Chrome (or similar for Firefox). You will be shocked by the difference._

Yes, I would be shocked to be browsing the web circa 1995. Which is why I use a modern browser that supports modern technologies. I also use Ghostery with a whitelist to block tracking. That way, sites work like they should and I can browse this decade's Internet without having to go on forums and let everyone know I'm important and I'm special and every web app should work on Lynx because I said so.

<comment><USER35> My point was not that all scripts are evil, but if you want me to trust your site, then dont require me to trust 50 domains I do not know for a minescule 10ms potential performance improvement.

I find that a perfectly reasonable attitude.</comment></comment></comment></comment></comment>


Save some money on those long night outs with this app, would love feedback - <AUTHOR> http://drinklistapp.com/ We're a consulting startup who recently released our first iOS app to help you manage shared tabs and save some cash on those long nights out, check it out here http://drinklistapp.com/<p>I would love to hear everyone's feedback, also if anyone is interested I have a few promo codes around so you can download it for free. <comment><USER2> As nice as it's presented, I can't imagine going on a night out with my mates and spending more time keeping an app on my phone up to date. I'd be too busy getting drunk and enjoying myself to be arsed about what drinks I had and how much they cost.

I'd say it was a solution in search of a problem. And the better alternative, I would say, is to not share your tab if you're a bit of a penny pincher.

</comment><comment><USER3> Seems like something my mom or the local news would mention when talking about how phones can "do just about everything these days" but wouldn't actually get used.

"Well Cathy, theres even an app to keep track of your tab when your out on the town! Isn't that something John, now off to Simon for the weather"

That said, you are obviously talented designers - the site & the app look really nice & will definitely make a great portfolio piece.

</comment><comment><USER4> a great way to make your friends regret asking you to come hang out with them at a bar.

<comment><USER5> Actually, I think it would be a good idea to go drinking with someone who uses this app. Since they'll invariably forget X number of drinks throughout the night, you can offer to settle up the next day. "See? I only had two beers."

<comment><USER6> Sorry but this app has no audit system.

If you and your friend don't have the kind of relationship in which either of you can trust each other or forgive a beer or two, then you don't have the kind of relationship in which you'll automatically trust each other to have pushed the buttons on an app correctly.

</comment></comment></comment><comment><USER7> The landing page design is gorgeous.

But really - would YOU ever use this app in the intended social setting?

The horse is getting beaten to death already, but the last thing people out drinking want to do is log their drinks in their phone.

If you're out drinking so much that you have to keep track of how many drinks you've had, I doubt you're going to care about being charged for an extra drink or two when you and your buddies split the bill at the end of the night.

<comment><USER8> Horse getting beaten to death? Where did we come up with such awful sayings? And why do so many I hear have to do with the cruel treatment of animals?

</comment></comment><comment><USER9> Looks great, but agree with most points made around how folks might be perceived using this (unless in a group of finance/accountant types).

Maybe a slight repositioning as something 'practical' that considers responsible folks consume at different rates - have it know who is in the group, who is 'in' for each round (as folks consume at different rates), then when final bill comes in, it will do a proportional split of final tab based on who is in each round, (also potentially relative drink pricing if different costs beer/mixed/wine), and tipping suggestion for each based on a value you set (18% / 20% / ??). Then app is more friendly to the group, and benefit is you don't overpay/overtip individually or as a group when maybe not thinking clearly when you settle.

You could even add a game element on who's paying the round, or based on random, ongoing bets, ??

</comment><comment><USER6> The presentation here is nice but it doesn't fit the reality of social drinking, as other commenters have noted. Long nights out involve free-flowing liquor and some give-and-take in buying rounds, sometimes eating a loss, sometimes getting many free drinks.

Drinking is about loosening up. The use of this app would seemingly inhibit that.

<comment><AUTHOR> Definitely see your points (and everyone else's) the app started out as a proof of concept and wanted to get some more feedback if there was a valid market.

</comment></comment><comment><USER10> How are drunk people gonna use it?

<comment><AUTHOR> We made a fair bit of "on-site user testing", it works :)

</comment></comment><comment><USER11> I think it's curious that at the top of the page it says "requires iOS 5" and at the bottom it says "iOS 5 ready."

It's a beautiful landing page, but I'm not quite sure I understand the problem.. Is this to split tabs? Or to show the bartender, "Hey, I only ordered these drinks, don't charge me for more!" The latter doesn't sound like it'd go over well. Confused.

<comment><AUTHOR> The use case is more for splitting tabs between large groups of people.

Also cross reference what the establishment is charging you vs what you actually had, you'd be surprised how many bars and places are willing to overcharge you once you've had a bit too many.

<comment><USER5> So when I'm at a bar and I order "2 Whiskey Sours, a Budweiser, an Amstel Light, a Heineken, a Sapphire Gimlet and a Knob Creek neat," and the bartender charges $50 (or whatever), do I stand there asking how much each one was?

<comment><USER12> Even if you ask, I've had cases where they just don't know (Everything gets entered into a computer, computer does some magic math to come out with your total)

</comment></comment></comment></comment><comment><USER13> It would probably be better served to just keep track of how many drinks you have. I would be more likely to use it if I wanted to quickly calculate calories, drinks, estimated BAC, etc. The estimated BAC could be pretty cool - it could do calculations based on weight and alcohol processing based on when you click a +1 or something.

</comment><comment><USER14> Funny app idea. I'd say that if you need this app, you've got a serious drinking problem.

<comment><AUTHOR> Well this is intended for sharing tabs between large groups, rather than you counting your long night of an alcoholic spree.

<comment><USER14> The only thing on your website that suggests that is this brief sentence "just pay for what you had".

If I saw my friend taking out this app and being a miser about something like this, I'd probably not drink with them again. Hell, I wouldn't drink with myself again if I pulled out this app. I seriously can't imagine someone using this in a social setting and not being ridiculed for it.

Could you imagine at the end of the night, pulling out your phone and saying... "hey everyone, look, I only drank this much and I'm not going to put any more money towards the whole tab."

Most of the time, the people who would even care about the tab are the people who aren't drinking! Why would they even need this app?

Really, I hope my friends are honest enough to put their share of the tab up or suck it up and just pay a bit more knowing that the next night of drinking maybe they save a bit. It all evens out in the end between friends.

Spending time and money implementing ideas like this are exactly why we are in a bubble right now. If someone is going to pay $0.99 for this app, but be worried about paying too much for drinks in a group setting, something is really wrong with that person.

<comment><USER6> It seems like you got downvoted but you're pretty much on the dot. The people I go out drinking on long nights with are friends and we're all fairly honest. A lot of nights that I go out with non-friends, those people are either taking care of the tab or I've decided to take care of it. The first impression created by pulling out an drink-accounting app will probably not be a good one.

</comment></comment></comment></comment><comment><USER15> I had to read this three times before I understood what it meant. It's "nights out" not "night outs"

</comment><comment><USER16> Do you go out and drink much? Seems nice but in the night life the last thing people are going to be doing is using an app to find out the cost of the drinks, then adding them in. Understand its hard enough to get a drink in crowded bars, it may help with costs, but that person may look like a cheapass with his little app. _Hey everyone my app says I didnt drink those beers and its off 50 cents, can I have the costs again to every drink i bought to I can add them into my app..... If I didnt buy a certain drink I just tell the waiter, I didnt drink that and they take it off.</comment>


The chronic suffering of the VB.NET community - <AUTHOR> https://anthonydgreen.net/2020/03/15/a-primer-on-why-the-chronic-suffering-of-the-vb-net-community-is-neither-necessary-nor-a-matter-of-expense-or-practicality/ <comment><USER2> As someone who was a VB developer back when VB.NET first shipped twenty years ago, I'm kind of surprised by this. VB.NET was very clearly a second-class citizen in the .NET ecosystem even back then. While Microsoft paid lip service to supporting it equally with C#, it was very clear from the huge volume of documentation, tutorials, books, etc. they put out for C# compared to the tiny volume for VB.NET that C# was where they really wanted developers to be. And syntactically VB.NET felt more like C#-with-training-wheels than "classic" VB anyway, which reinforced the impression.

Given how big C# ended up becoming, I'm wondering why anyone committed to staying in the .NET ecosystem would have stuck with VB.NET all this time. What's the attraction? I could see it as a transitional stage to get classic VB developers started on the road to C#, but as a long-term solution it seemed doomed to chronic suffering from birth.

<comment><USER3> I think I must be the only person alive who actually prefers Pascal-style syntax (VB, VB.NET, Delphi, PL/SQL) to C-style syntax. There are lots of small nice things, such as distinct keywords for end blocks ("End Try", "End Loop", "End If"), and syntactic sugar like the "With" keyword. Intellisense in Visual Studio still seems to work better in VB.NET than C#. It does look comparatively simple; but I'd prefer the complexity of my code to be mitigated by the syntax, not exacerbated by it.

<comment><USER4> What makes distinct keywords for end blocks nice in your opinion? I feel they are maybe overly verbose.

<comment><USER5> Harder to mismatch.

In C# the end to an if and a try both look the same. In VB they don't.

<comment><USER6> This. I flip between both languages all the time and without issue but I have to say in VB.Net I never have to go looking for that random missing brace that is throwing the entire structure off. I spent enough time doing that in my LISP days. :)

As for the complaints of something being verbose, I see people constantly adding comments to close braces to indicate what it was they closed.

<comment><USER7> The Verboseness starts to get very real when you are dealing with inlined Expressions/Functions. But maybe that's not what a normal VB.NET project has a lot of.

And, for whatever it's worth, it can encourage people to not inline which probably would be more maintainable anyway.

> As for the complaints of something being verbose, I see people constantly > adding comments to close braces to indicate what it was they closed.

Lazy commenting. If you are for some reason dealing with code complex enough to need to keep track of it like that, instead take the time to comment what's happening next as a way to help the reader infer.

Because, let's face it, if it's complex enough to need to track those things, there's a decent chance it's worth leaving some explanations of what it's meant to do.

</comment></comment></comment></comment></comment></comment><comment><USER8> It likely takes 3-5 developers just to maintain what they already have until end of life.

Whenever people come up with these tiny estimates for how much "effort" things take they ignore the organizational overhead and maintenance costs. For example, when changes are made to the CTS/CLS[0] a lot of time is spent considering how those changes will impact other .Net languages, that's a cost/overhead even without actual work on those languages.

So it might take "3-5 people to keep VB.Net alive" but only if you ignore the man-hours lost in other teams (.Net Framework, Tooling, Libraries, etc) and the people already required to maintain existing VB.Net Support (3-5~). 15-20 people is a more realistic conservative estimate.

Plus the language's popularity is almost gone:

[https://trends.google.com/trends/explore?date=all&q=%2Fm%2F0...](https://trends.google.com/trends/explore?date=all&q=%2Fm%2F01dpgv,VB.net,C%23)

[0] [https://docs.microsoft.com/en-us/dotnet/standard/common- type...](https://docs.microsoft.com/en-us/dotnet/standard/common-type-system)

<comment><USER9> The author worked on the team for 8 years, including the transition to Roslyn which unified much of the expensive concerns around VB.NET and C#. It's the author's extremely strong familiarity with that engineering system that led to their claim. In the post he walks through how team sizes grew significantly smaller across the board. 15-20 people would be far larger than the current C# language/compiler team.

</comment></comment><comment> nv-vn One thing the author failed to consider when discussing F# was that F#'s community leans heavily towards compiler/programming language people. Historically, MLs have been extremely popular for writing compilers and a lot of the folks using F# today either come from that background or have been exposed to people from that background and learned about some aspects of compilers. I would wager that maybe 25% of F# users are _capable_ of somehow contributing to the F# compiler compared to maybe 5-10% for C# and VB.NET. I also imagine the F# compiler's source code to be drastically smaller and simpler given both its history and the ease of writing compilers in F#.

<comment><USER10> Edit: disregard

<comment><USER11> The VB compiler is written in VB: [https://github.com/dotnet/roslyn/tree/master/src/Compilers/V...](https://github.com/dotnet/roslyn/tree/master/src/Compilers/VisualBasic/Portable)

</comment></comment></comment><comment><USER12> I'd advocate for the opposite: VB is never going to get first class support. It was clear that I should jump ship when first learning it back in 2010.

Microsoft should just kill it (aka put it into mature support) and give clear guidance that developers should move on.

If you can learn and understand VB.NET you can learn and understand C#. It's time to rip the band aid off.

</comment><comment><USER13> I worked for a shop that was heavily invested in Visual FoxPro, after that time had come and gone. I spent a few years switching most stuff to Python and PostgreSQL, then moved to another city. When I checked in with some friends from there to say hi, I found out that they'd replaced all my "weird Python stuff" with good, standard VB.Net (starting in 2013). I didn't know whether to laugh or cry (with strong leanings toward the latter). It's too bad. I love that company and the people there, but I'd like to smack the person who convinced them to go for that particular rewrite, or at least make fun of them in public.

<comment><USER14> The obvious choice for anyone who has tried a few languages should probably have been C#, but personally, if it was my choice to make and the team was experienced in Visual Foxpro I'd probably choose VB.Net if they wanted it.

The alternative would be C#.

Full disclosure:

Languages sorted by when I learned them:

\- Basic

\- Visual Basic

\- C

\- Assembly

\- Java (well, I "learned" that I was hopelessly ineffective with it. Still got a B.)

\- Javascript

\- Python

\- PHP

\- AutoHotKey

\- Java (actually learned it)

\- Perl

\- Delphi

\- C#

\- VB.Net

Reasons:

Once I actually understood the value of a real typed language there's no way I'll go back except for scripting and small one-offs.

<comment><USER13> Thing is, there was only one person there who was really maintaining the VFP stuff. We'd already done the switch for everything else.

I agree about strongly typed languages. I'd never give Python and its strong typing to switch to a scripting language.

</comment></comment></comment><comment><USER15> A decade too late. This is like complaining that Flash and ActiveX are gone. The world has moved on. C# is easy enough to learn and unless there's maintenance required on legacy code, it's irresponsible to continue using VB on any new projects.

<comment> at-fates-hands Just started working on RPA (Robotic Process Automation) and the tool we primarily use is UIPath. Ironically it's built on VB.Net and requires VB syntax if you want to do anything mildly complex.

Not sure why they went that route, but I've ran into several issues when using REST services and other functionality that would be easy to get done in C#, but are time consuming and painful with VB.NET.

<comment><USER16> If you were going to train and support users that may not already be programmers, it makes a lot of sense to use a language that is similar to English.

</comment></comment></comment><comment><USER17> "Chronic suffering" seems a wee bit hyperbolic, especially in the current apocalyptic climate. Perspective, please.

OT I remember when VB.Net first came out and some VB6 devs were rather sniffily referring to it as "Visual Fred" due to the lack of resemblance wth VB beyond keywords.

It was obvious from the get go VB was now a second class citizen, and c# was the future...

<comment><USER18> VB.NET's only purpose _should_ have been 99% compatibility with VB6. Instead, it was too much like C# to be compatible and too much like VB6 to be consistent.

I had lot of experience with VB6 back in the day but I moved straight to C#.

</comment></comment><comment><USER19> > I am a PURE VB.NET developer. I have never used any other language full-time > for any significant portion of my education or career—a client project here > or there but nothing that somehow made me NOT a VB developer. How am I > supposed to engage?"

Every developer should be polyglot. Adapt or die.

<comment><USER2> I dunno, there are plenty of slices of the programming world where you can quite profitably work in a single language for most or even all of your career. If you specialized in Java twenty years ago, you'd have skills that are still in demand today and will likely still be in demand twenty years from now (as long as you keep current with changes to the platform).

But betting your career on a single language is definitely a big bet. And any bettor will tell you one of the key skills is knowing when to cut your losses.

<comment><USER20> It's fine to happen to develop (or only have developed) in a single language - you might have found your niche and all that.

But the way the author of the article put it is just so weird - choosing the word "pure" in all caps - like it's a point of pride, or big part of their identity.

</comment></comment></comment><comment><USER21> VB is dead. Get over it. It was a concession to an army of classic VB devs to not risk losing them to other technology when .NET and C# were born.

Since then, every VB develooper has had _two decades_ to realize that VB.NET never was a "new VB", but just a C# dialect. It offers zero value over C#, and it's so closely related that anyone who knows VB.NET can pick up C# instead in literally no time at all.

I don't see why the author brings up F#. F# is just as much a second class citizen in the .NET world, but it is a project of a great community and of ms research.

<comment><USER22> > It offers zero value over C#

I loved VB .NET XML literals. Less relevant today with JSON all the things, but I did choose VB .NET a few times over C# just because of these guys. Made for amazingly readable (to me) XML wrangling code.

<comment><USER23> Used to occasionally import VB libraries into C# for that sort of thing. :-)

<comment><USER24> A little known secret is that in the VB namespace in .NET full fat, there is a really nice CSV file reader/writer.

[https://coding.abel.nu/2012/06/built-in-net-csv- parser/](https://coding.abel.nu/2012/06/built-in-net-csv-parser/)

<comment><USER7> My colleague showed me this a couple weeks ago, which makes me laugh even more when I think back to all the CSV parsers I saw in VB.NET in past gigs.

I'll admit, I'd written more than one in C# myself before I discovered FileHelpers.

<comment><USER24> I think I've written some CSV parsers until I thought to myself "I can't believe they don't have this in .NET".

</comment></comment></comment></comment></comment></comment><comment><USER25> Why uhhh... why wouldn't people just start writing new components in C#. Surely learning C# is not beyond them?

It's not like there's a compatibility issue. Just stop writing it.

<comment><USER11> what if they don't want to?

<comment><USER26> Are they going to pay Microsoft enough to maintain VB.NET just for them?

Or they could re-implement and maintain VB.NET themselves?

Those are their options. You can't just demand that someone provide you a product if they don't want to.

</comment></comment></comment><comment><USER24> VB gets a lot of hate. But the language is perfectly fine for the most part. One of the most annoying things about VB.NET is that projects need to be configured with certain options out of the box otherwise it allows you to write some very sloppy code.

I still use VB.NET for creating quick tooling for either myself or non- technical users. There doesn't appear to be anything else really these days for doing that. The newer options from Microsoft tend to enforce a lot of patterns, which just slow you down, when for small tools you don't really require all that guff.

I hope with an open source .NET compiler it will be possible VB.NET to carry on well beyond Microsoft's culling.

</comment><comment><USER27> As a VBClasic user that never made the transition to VB#.NET, a wish you the best but I loose my hopes a long time ago.

<comment><USER28> Out of curiosity, do you develop professionally in VB classic?

<comment><USER29> I know somebody that does. It's working surprisingly well considering that it has been deprecated since 2001.

Interop with C# is working fine and as long as don't have to do too much in the VB part of your program, you can just use it as a "library" (which is technically isn't because you should only call C# from VB, not the other way around). The only two disadvantages I know of are restriction to 32-bit and no easy CI/CD support. Maybe also that it doesn't support HiDPI forms and Windows just scales it up but who is really expecting that from a 90s technology?

<comment><USER28> Yes, and I guess it could also be ran into a VM with Windows 95-98 or that other open source clone, can't remember the name now and still be useful.

<comment><USER30> Wine + Linux and ReactOS would work equally well.

Wine would probably be easier to setup.

</comment></comment></comment></comment></comment><comment><USER31> We're a .NET dev company (all C# coders, but most of us have a background in VB as well), I asked my team if they had to choose would they rather have to develop with:

A: C#, but with WebForms (including using code behind and the built in web controls where possible).

or

B: VB, but with MVC and WebApi.

They all chose C# WebForms even though they all hate WebForms, just not as much as they hate VB.

Personally I love VB and WebForms, I never get to do work with it nowadays (I'm not even sure we have any legacy systems that still run it), but I built my company from scratch off that stack and coming from a classic ASP background I was blown away with controls like GridView and Repeaters etc. I remember our first designer being so confused with the mess of html outputted by these controls and the hatred our purists had for viewstate that polluted their lightweight designs.

I still remember how excited I was when I first used the AjaxControlToolkit and the UpdatePanel control, it was like magic!

Now everything's pretty much all C#, RazorPages, WebApi, Angular or Vue and I'd never go back, but I do miss the old days. It's not often I see tech that seems magical any more, SignalR was probably the last big thing that blew me away in terms of just doing something that felt so different, but it's really rare now.

I would add that we just finished a prototype app for a client using Blazor WASM and coding that did seem like witchcraft and certainly brought back some of the old feelings of being amazed, maybe we'll all look back on javascript frameworks in the same way we look back on VB in a couple of years if Blazor play outs.

</comment><comment><USER32> They make the argument that it would take very little effort for MS to maintain VB.NET.

If that's true, I wonder if part of the reason MS is killing VB is that it doesn't serve any necessary purpose, and it is simply uncool. I wonder if "uncoolness" is a primary factor.

It sounds silly to write, but think about it -- technologies live and die by coolness. MS is doing everything they can right now to shake off their uncool past, and VB is certainly a relic of the uncool past.

Developer share is crucial. You get a lot of developer share by being cool. Thus, being cool is very important. Damn, _I_ want to drop a Medium article on hackernews now with my hot new take.

</comment><comment><USER33> My take away from this is either:

1\. Start a go-fund-me to get a VB.net team started.

2\. Start work on an open source VB.net to F# transpiler.

</comment><comment><USER34> I don't even like VB, but this is a great read. Very informative. The author clearly points out that the deficiencies of the organization that sign the death warrant of VB.NET, regardless of the intrinsic value of that language/compiler/environment.

</comment><comment><USER35> As someone who started programming in VB.NET, this is so true.

It was a great language for beginners that also had enough oomph to build commercial applications, everyone who I spoke to who actually used it loved it.

Why a 1 trillion dollar company like microsoft can't hire 5 dedicated devs is beyond me.

<comment><USER36> That goes back to if the decision to assign them is strategic, or not. If they wish to deprecate the language, it will not be done. Also one could argue that that small code change which took 5 minutes could have cost the company hundreds of hours supporting their clients if something happened. So that would make that very small change a very big change, not based on effort but on impact.

</comment></comment><comment><USER37> Imagine how the poor Fortan and Cobol devs feel.

<comment><USER16> I imagine they feel pretty good considering the type of money they make

<comment><USER26> Is there a lot of money in Fortran? Anyone could learn Fortran in a week if they wanted, and there's tons of research assistants who know it already. How's it lucrative?</comment></comment></comment>


Elon Musk launches into expletive-laden rant calling quarantine measures fascist - <AUTHOR> https://www.washingtonpost.com/technology/2020/04/29/tesla-earnings-2020 <comment><USER2> Poor impulse control. Over and over again. Wish he'd focus on business and spend less time trumpeting on twitter.

<comment><USER3> Maybe we should tattoo "poor impulse control" on his forehead?

<comment><USER4> Elon "Post Malone" Musk

</comment></comment></comment><comment><AUTHOR> Note that this is separate from his tweet that was discussed earlier (and arguably more noteworthy given that it happened during Tesla's earnings call today)

</comment><comment><USER5> How the fuck with anyone more than 3 brain cells continue to worship this guy as some hero?

</comment><comment><USER6> that was not expletive-laden it was not a rant he sounded pretty calm, but annoyed to me.

</comment><comment><USER7> OK, he _has_ to be doing this on purpose to troll us all. You just can't make this stuff up. He even managed to outdo Trump's "jokes" about disinfectant, that's simply awesome.

<comment><USER8> When people talked about Trump's actions being part of a grand 4D chess scheme, it's hard to believe, but EM may be a different story...we'll have to see

<comment><USER9> Or perhaps instead of being some sort of elaborate troll chess game he just has a valid point. This is not going to be a popular opinion here on HN, but I think it's absurd people who are championing for opening and business to get back to work are shamed and dismissed as ignorant. It wreaks of soap box moral superiority. As Elon said "Silicon valley has become sanctimonious valley."

There are lots of positives, including perhaps the biggest news from Gilead today. That in tandem with the fact that I believe a vast majority of the population already has the anti-body (were sick or no symptoms). Test ability is ramping up significantly, and lastly I happen to live in an area that was not a major "hotspot" yet the local city officials are at odds with the state officials about opening.

<comment><USER10> The thing that worries me is the way exponential growth rates work.

In the places that everyone has been paying attention to, New York, Italy, Spain, etc., the growth rate indeed seems to be coming under control. And for the sake of argument, let's say that they/we succeed in reopening businesses while continuing to limit the spread.

But, what about the places that had fewer cases early on, and are now growing at a much higher percentage rate? If you rank countries by the number of new cases, you are starting to see some with relatively few cases but many new ones, and if it is as exponential as it appears, it's going to be a matter of days before the previous leaders are replaced. This is happening country by country, and similarly within the US by state.

The US still had the most new cases of any country yesterday, but who was #2 and #3? Not the countries that you've been hearing about, but Brazil and Russia. Turkey, India, and Mexico also seem to be trending to soon have more new cases than the European countries people have been paying attention to.

And within the US? NY and NJ are still the top two states, but number 3 is now California, number 6 is Texas, and number 8 is Georgia - all states with relatively few cases so far, but the number of new cases is surging relative to the previously hard hit states.

It's like the stock market - people attach too much importance to the numbers describing the current situation and not enough to differences in growth rate.</comment></comment></comment></comment>


Further fate of PlatformIO Project - <AUTHOR> https://github.com/platformio/platformio/issues/490 <comment><AUTHOR> This project is just brilliant and it would be a waste to see it disappear. It makes life for embedded software developers so much easier, by providing a single environment that supports a wide array of target boards and IDEs.

Their quest for funding may still need a slightly different approach though. I really hope an investor can see the value of this project without the business case or profit model being spelled out exactly.

<comment><USER2> PlatformIO is exactly the kind of 'infrastructure project' that everyone is always suggesting YC should fund. I think they should consider a Kickstarter as well - this seems to have worked for a few similar projects.

Developing for embedded devices (in fact, developing C/C++ in general) is currently a complete mess. Fixing it properly will have significant knock-on value.</comment></comment>


Microsoft courting Facebook? - <AUTHOR> http://online.wsj.com/article/SB121017846020274243.html

<comment><USER2> I bet they offer less than $15 Billion.

Now, granted this purchase would align with their current business goals to cater to younger, hipper customers (hence their recent advertising shift) supporting their Zune and XBox businesses.

But why aren't they courting LinkedIn. LinkedIn has a more professional (read: worthwhile) business model, one that would actually gel with Microsoft. Additionally, the purchase of LinkedIn would complement their business service offering and allow them to expand their B2B business to compete with IBM, especially in the small business area. I'm baffled by this one...

<comment><USER3> Agreed about the linked in point. FB brand would suffer from day one under MS. Linked in brand would not. Simple as that.

</comment></comment><comment><USER3> Why does MS seem so desperate to make a move for the sake of making a move right now? It feels as if the failure of Vista has shaken their confidence in their ability to deliver software anymore so now they are trying to become a player in a different field to compensate. It feels weird to me, I wonder what's been going on behind closed doors over there.

<comment><USER4> Could be a gambit to play at Yahoo!'s insecurity. You know, how you start acting like you're going out with another girl to make your ex jealous.

<comment><USER3> Hmm, that is true but to be honest, it reeks of desperation.

</comment></comment></comment><comment><USER5> Would Microsoft really offer something substantially more than $15 Billion? Their last investment never really was a $15 Billion valuation because MS received an advertising deal as well as stock in exchange for their money, but I would think Facebook would demand a substantial premium over that $15B anyway.

I think an acquisition of Facebook won't happen, partly because I don't think Zuckerberg is interested in selling, and that's why the sale didn't go through before when MS and Yahoo offered over a billion. But the other reason I think it won't happen is because Facebook's valuation is really hard to peg right now, before we see what kind of stuff is really built with their platform. If multiple hundered-million-dollar companies and maybe a billion-dollar company or two are built from Facebook Apps, than FB is probably significantly undervalued at $15B. However, if the Facebook platform continues to primarily be a way to throw sheep at people and provide an outlet for widgets from companies that were already valuable before Facebook (Slide, RockYou), $15B is probably too much. It therefore might make sense for all parties to wait and see what happens.

<comment><USER6> >>> I think an acquisition of Facebook won't happen, partly because I don't think Zuckerberg is interested in selling, and that's why the sale didn't go through before when MS and Yahoo offered over a billion.

The sale didn't go through BECAUSE they offered him one billion. I'm sure if they came along with more a couple of years ago, he would have sold.

Personally, I hope they IPO. That stock will be amazing to short after the IPO pushes the stock price at least 50% higher than it should be.

</comment></comment><comment><USER7> Buying facebook would be a nice play, but it would be more like putting all your eggs into one basket as yahoo has more unique properties, including gems like flickr.

However, many people feel the future of search is through social networks, that is, seeing what my friends think/have bought before I go off on my own to try and figure things out is a pretty compelling reason to invest in a high growth social network.

Although I'm sure most MS engineers are sweating given facebook's platofrm.

It comes down to facebooks long term viability as a property on the net.

</comment><comment><USER8> they've been courting, in fact the 240mm investment made by them already was a gesture of good will towards FB from MSFT

</comment><comment><USER9> what sources of revenue does facebook have at the moment?

has it actually made ANY money yet?

<comment><USER10> CPM ads and a custom PPC ad platform.</comment></comment>


Hackers Are Using Gmail Drafts to Update Their Malware and Steal Data - <AUTHOR> http://www.wired.com/2014/10/hackers-using-gmail-drafts-update-malware-steal-data/

<comment><USER2> so if you're not logged into Gmail on IE you should be good?

<comment><USER3> > _The hacker first set up an anonymous Gmail account, then infected a > computer on the target's network with malware. (Shape declined to name the > victim of the attack.) After gaining control of the target machine, the > hacker opened their anonymous Gmail account on the victim's computer in an > invisible instance of Internet Explorer_

It seems not. The attacker is getting the compromised machine to sign in to a Gmail account set up specifically for this purpose - so it doesn't matter if you're signed into your account or not.

</comment></comment><comment><USER4> Earlier reddit search was used to update the malware, whats next!!!</comment>


Microplastic pollution in oceans is far worse than feared, say scientists - <AUTHOR> https://www.theguardian.com/environment/2018/mar/12/microplastic-pollution-in-oceans-is-far-greater-than-thought-say-scientists <comment><USER2> I live on the coast in North Cornwall, UK. I lead a group of local beach cleaners, we meet once a week to pick up beach litter and I have amassed ~2.5 years of data [1] to date.

Microplastic is a concern. Larger-than-microplastic (?macroplastic) is also a worry, because it degrades into microplastic over time.

Our location [2] means that we don't get the typical beach waste washing up with the tides, and much of what we gather is fishing industry consumables. Nylon nets can usually be identified to a given vessel or fleet, but when they reach EOL they are sometimes shredded at sea -- which turns one net into many thousands of pieces 5cm / 2" long -- or dumped on known wreck sites.

These sites are not fished by commercial fishing organisations and the nets become ghost nets, catching the marine life that typically teems on wrecks…which then dies, degrades, and attracts other feeders, and the process repeats.

Anecdotally, I've had conversations with people in the industry over the past few years and it's common for nets to be left in situ once quota is met, since it's cheaper to replace a net than go over quota in port.

I realise all this isn't directly related to the OP article, but there are other considerations outside the microplastics generated from cosmetics, etc.

[1] [https://docs.google.com/spreadsheets/d/1wDmlyQFluRCyT6m_ndoO...](https://docs.google.com/spreadsheets/d/1wDmlyQFluRCyT6m_ndoOS6MFMvcLCKqngZ5uVktJ4yc/edit#gid=0)

[2] [https://www.google.com/maps/place/Crackington+Haven,+Bude+EX...](https://www.google.com/maps/place/Crackington+Haven,+Bude+EX23+0JG,+firstname.lastname@example.com,-4.6507796,14z/data=!3m1!4b1!4m5!3m4!1s0x486b87be4d219c7f:0xa10f443eb98d2e0!8m2!3d50.7408519!4d-4.63327)

</comment><comment><USER3> I remember years back thinking 'there seems to be so much rubbish in the sea, oh well, guess its big enough that it doesn't matter'..

<comment><USER4> That line of thought never occured to me. Everything is finite, why would throwing trash in the sea not immediately pollute it? Its like those that never bother to think of where their trash (or 'recycling') actually goes. (Throwing things 'away'...) My father, a man of few words, summed it up thusly; Don't shit where you eat.

<comment><USER5> The volume of the Earth's oceans[1] is ~1.3B cubic km (or ~320M cubic miles). So I'd say what's more amazing/appalling is that we have managed to dump so much plastic into them that it is easily noticeable...

1: [https://oceanservice.noaa.gov/facts/oceanwater.html](https://oceanservice.noaa.gov/facts/oceanwater.html)

<comment><USER6> The volume is incredible, but I suspect that ignoring most of the depth is useful for microplastic, which is buoyant. You'll still have to consider some depth, vertical mixing will be a factor, but it will still be a fraction of the total volume.

</comment></comment></comment></comment><comment><USER7> We are all going to die buried in our own plastic Micky Mouse collectables.</comment>


GotCms 0.2.0 released - <AUTHOR> http://gotcms.github.io/GotCms/

<comment><USER2> Why do people insist on posting badly-written, poorly-designed, short-minded PHP projects? Grow up.</comment>


The MongoDB hack and the importance of secure defaults - <AUTHOR> https://snyk.io/blog/mongodb-hack-and-secure-defaults/ <comment> mike-cardwell When our sysadmin set up our Mongo cluster, he firewalled out all IPs except our production systems, turned on authentication, set things up to ensure we used SSL, and configured backups.

He didn't do this because he's an amazing sysadmin. He did it because he's competent, knows how to put a service on the Internet, and RTFM.

I mean. If you can connect to something and use it without having to authenticate yourself, wouldn't it naturally cross your mind to check that others can't do the same? It's just common sense.

<comment><USER2> The article's argument is that users have no common sense and don't think about what they're doing, so we should reinforce this same behavior.

<comment><USER3> > _you may decide that not binding a database to local connections would be a > reasonable default...But assumptions like that are dangerous because when > not if someone does something that breaks that assumption, they're now > vulnerable to attacks—and they may not even know it. Understanding of the > potential security risks presented by these defaults is not exactly > mainstream knowledge._

I wouldn't call this reinforcing behavior...I'd call it protecting your users. Common sense is something that comes with experience, and MongoDB is popular enough that it's likely to be in many web devs' first projects in production. Is it their fault they haven't developed this "common sense"? Yes and no. On the other hand, is vulnerable-by-default _ever_ a good idea?

</comment></comment></comment><comment><USER4> I have never used MongoDB so I admit I'm talking blind here, but can someone explain how/why a piece of highly popular software gets to version 2.6 allowing unsecured remote connections by default? Further to that is that type of thinking you want in the development process of something as critical as a database engine? It just seems amazing to me that it got so far before the community in general pushed back that this was really bad design? Hopefully someone with MongoDB history can explain if this was a long term sticking point, etc. Thanks.

<comment><USER5> In production deployments, unsecured remote connections might be fine, because security would be handled at the network layer (e.g. by deploying MongoDB on a VLAN which only was accessible by your MongoDB clients which were on separate servers).

<comment><USER6> > In production deployments, unsecured remote connections might be fine

No. Absolutely not

Unsecured local connections yes, anything from outside 127.0.0.1 should be explicitly allowed and secured (like port 80/443). Rate-limited, fail2banned, fuzzed during testing, etc

<comment><USER7> "I opened the ports on the firewall and gave the user access, why doesn't it work!? This system is stupid."

"I changed my password on one system and then on the other, but somehow my account got locked up in that brief time between changeover, how the hell do you unlock an account? This system is stupid."

"We're scaling up and we're running into outdated rate-limiting settings on every service we use, some of them even having multiple layers of rate- limiting within a single service, and each setting requires hours of debugging to figure out which setting is taking down the whole project. This system is stupid."

There's a reason Mongo got adoption while "secure" systems did not.

<comment><USER6> To be honest, the issue is that a lot of secure systems make things more convoluted, unintuitive and/or frustrating than it needs to be, then calls the user stupid when they can't set it up

</comment></comment></comment></comment></comment><comment><USER7> Realistically, insecure defaults are part of the reason Mongo was adopted in the first place. Other databases are a hellscape of configuration, meanwhile Mongo is starting to get work done from the moment it's installed.

Security and usability are always at odds. If you make security a pain, people will give up on security. Mongo is the ultimate manifestation of that principle. Developers were _driven_ to Mongo by opaque and painful admin tasks.

<comment><USER8> A "hellscape of configuration"?

`apt-get install mysql-server` makes you enter a "root" password out of the box.

`apt-get install postgresql` create a local user `postgres` with access the local database.

Both bind to only localhost by default.

Those sound like _easy, reasonable_ defaults to me. (And this isn't exclusive to Debian-likes: RHEL almost certainly shares the exact same benefits)

<comment><USER9> _`apt-get install postgresql` create a local user `postgres` with access the local database._

Does it!? I'm sure I've had to do that myself.

<comment><USER10> Yes.

</comment></comment></comment></comment><comment><USER11> Microsoft took a rash of shit some time ago (15 years?) for shipping MS Proxy Server with every port open by default. From the POV of employee-at-the-time, it took them a disappointingly long time for them to not do that anymore.

Since then, I've learned to not assume that products are secure-by-default. At the same time, I kind of thought we learned our lesson and cut that shit out low these many years later. Add a line to a text config file that's probably buried eight directories down in a hierarchy that's owned by _root_? (I'm just hyperbolically guessing for effect; I generally avoid Mongo.) Do it, or you're hacked? And it's been this way for years? Come _on_.

<comment><USER12> Microsoft is a different beast. They ship things based on the principal of least surprise. There are incredible features in newer versions of SQL Server that aren't turned on by default when upgrading, even though no one would want to not have them on.

<comment><USER13> Can you give some examples?

<comment><USER12> Read isolation is probably the biggest stand-out in terms of "Wow this is way faster why would anyone* not use this?"

* Almost anyone, there are definitely potential pitfalls.

</comment></comment></comment></comment><comment><USER14> No matter what your defaults are, if a sysadmin doesn't understand that some software is OK to connect to a public-internet addressable interface while other software is not, their shit is going to get hacked (or, as in this case, accessed).

This is the equivalent of leaving your data in a file cabinet in your lobby and being surprised someone took it. The answer isn't to add self-locking little office locks to the file cabinets by default, it's to educate folks that this is a file cabinet that's designed to be inside the office, not in a publicly accessible place.

<comment><USER15> Network oriented software created after 2000 has zero excuse for allowing unauthenticated writes from the general internet by default.

<comment><USER16> Tell that to redis.

No, seriously. Please. I've been banging that drum for years.

<comment><USER14> Also, MySQL [1]. Are you sure that you're right and all these major db projects are wrong?

1\. note the default value of "bind to *": [http://dev.mysql.com/doc/refman/5.7/en/server- options.html#o...](http://dev.mysql.com/doc/refman/5.7/en/server- options.html#option_mysqld_bind-address)

<comment><USER15> Well, mysql was started before 2000, so it gets a pass. But I'm also pretty sure mysql doesn't allow unauthenticated writes, so it doesn't need one?

</comment></comment></comment></comment></comment><comment><USER17> The most common MongoDB versions that are being exploited with the ransomware come with secure defaults!

[https://www.shodan.io/report/kjVzjr3O](https://www.shodan.io/report/kjVzjr3O)

Originally, I thought the problem would disappear once MongoDB changed the default from "0.0.0.0" to "localhost". However, that has had no impact on the number of exposed MongoDB instances on the Internet. Bad defaults are definitely a problem but in this case that isn't what's happened.

Also note that the most popular location where these instances are hosted is on AWS where you explicitly have to open up the firewall.

<comment><USER18> Just a guess, but those people probably updated their installation with an existing (insecure-by-default) configuration in place. Very little software like this will mess with an existing configuration, so that upgrading doesn't appear to break anything. That's how they'd be on a secure-by-default version but still be insecure.

<comment><USER17> Yeah, I could definitely see that happening though the overall number of exposed MongoDBs has also increased. And there are Docker images that come w/ insecure defaults ala:

[https://hub.docker.com/r/swcc/docker- mongodb/~/dockerfile/](https://hub.docker.com/r/swcc/docker- mongodb/~/dockerfile/)

One of my concerns is that people are piling onto MongoDB because "it's web scale" and ignoring potentially systemic security issues that aren't specific to MongoDB. The same issue exists for Riak, Cassandra, Memcache etc.:

[https://blog.shodan.io/memory-as-a-service/](https://blog.shodan.io/memory- as-a-service/)

</comment></comment></comment><comment><USER19> While we should hope that server software is secure by default, you shouldn't rely on it either. A good rule of thumb is: _Distrust until verified_

If you're running any servers yourself, there's no reason to open up network access to the world. At most the specific ports you want to expose, to the specific IP ranges you want to allow, should be white listed. A default of everything to everywhere is insane.

Even with SSH key based authentication (v.s. say passwords) I'd consider it inept to expose all your infrastructure publicly. Set up a VPC or whatever the local equivalent is for your hosting environment and proxy SSH access via a bastion host. If you whitelist the inbound addresses to the bastion host (let's say to restrict it to just your office) then you've also eliminated the vast majority of auth log spam too.

Unfortunately the people that would understand and implement things like this are the same set of people that wouldn't have publicly exposed MongoDB instances in the first place.

</comment><comment><USER20> I find it interesting that there's no firewall with a default deny rule between these exposed mongodb installs and the Internet. All I can think is that most of them are on cloud services which are directly exposed. It reminds me of the fiasco with all of the directly-connected vulnerable network cameras on the Internet.

<comment><USER21> I think the problem is developers running apt-get install mongodb and assuming all other considerations, like a firewall, are somehow magically taken care of, then patting themselves on the back for not needing a sysadmin.

<comment><USER22> I think it's more of a case of assuming that the database wouldn't expose itself to the internet at large, because why would it? It's like buying a new car, and checking for holes in the gas tank before rolling off the lot.

<comment><USER21> Your car analogy fails because safety is highly regulated by the government, and the manufacturer can be sued for their failings.

When it comes to server security, you are responsible, and should never make assumptions. If you don't know how, or simply can't be bothered to check, then you shouldn't be administering a server.

Also a firewall is a most basic requirement, even something simple like UFW would do.

</comment></comment></comment></comment><comment><USER23> I don't mean to defend Mongo here, but as a counter argument to the broad principle: Ubuntu doesn't ship with iptables blocking all incoming connections by default. Should it?

<comment><USER24> Honestly, in this day and age, it probably should. As well as whitelisting software that is allowed to make outgoing connections. At least for server installations. Network security is still a complete joke.

</comment></comment><comment><USER25> MongoDB has a history of using the insane defaults - not secure, and willing to loose your data.

</comment><comment><USER26> Relevant laptop sticker:

[https://twitter.com/ag_dubs/status/603273801783234560](https://twitter.com/ag_dubs/status/603273801783234560)

Source code to print your own:

[https://github.com/mikemaccana/stickers](https://github.com/mikemaccana/stickers)

</comment><comment><USER27> I wouldn't blame MongoDB.

Any machine connected to the Internet should start with a configuration equivalent to:

        ufw default deny incoming
        ufw allow ssh
        ufw enable

And then start punching very specific holes as needed.

</comment><comment> gator-io I had a situation where their cloud backup product was not backing up data and not issuing alerts when it wasn't working.

I gave them full access to logs, etc. and the support response was basically that they couldn't determine why it wasn't working or alerting, but it it works for them, so I should migrate to their hosted solution.

I sometimes think of the potential company-ending cluster-fudge that could have caused, while I stare wide-eyed at the ceiling at night.

</comment><comment><USER7> To play devil's advocate for a second, isn't Mongo following the unix philosophy here? Small, composable tools instead of bolting on redundant features to everything?

Opening/closing ports is the firewall's job. Mongo's job is storing and retrieving data (now, how poorly it does at _that_ is another conversation).

Having both Mongo and the Firewall handle ports means you do everything twice, which violates OnceAndOnlyOnce.

<comment><USER8> If that's the case, it should be behind something like inetd, instead of being able to daemonize itself ;)

</comment></comment><comment><USER28> I stumbled upon this (awesome) article that made me realize tons of things: [http://www.ranum.com/security/computer_security/editorials/d...](http://www.ranum.com/security/computer_security/editorials/dumb/index.html)

I'm not a security expert (far from it) but I hope that I understand enough the importance of security to learn a bit about it and implement it as much as I can.

Secure defaults is now maybe the first concept I'm trying to explain to people in my company.

</comment><comment><USER2> Defaults are stupid and dangerous.

First off, there's the constant problem of default passwords. The big IoT compromises lately were due to default passwords, and ever since they became popular they've been a bane to security everywhere. Wifi APs used to use defaults, but luckily most come with a randomly assigned password now (except those provided by an ISP, occasionally). All software that matters should not use default passwords.

Second, a "default" is not intended to be an operational setting. When developing software, a default is literally a placeholder setting so that your software won't immediately crash if a configuration value is missing. Some software is effectively meaningless without a configuration, but if they are obscenely permissive they can allow a user to still take advantage of it, which is how MongoDB is set up.

Finally, there is effectively no such thing as a secure default, because something isn't really secure until it's been vetted through a process. Pretending your software is secure when you have literally not given it a second thought is just setting you up for eventual disaster. People should be actively thinking about their security if they care about it; defaults just leave them blissfully ignorant.

In my ideal world we would require software to no longer have defaults. Demand that users be aware of the configuration and running of their software so they understand what's involved with how it runs. This would teach them more about the software they're using, which would enable them to take better advantage of it, as well as make it more secure. If you don't have time to do that you probably shouldn't be using it.

</comment><comment><USER29> It's pretty simple folks, RTFM. If you are running MonogoDB on your laptop to build an MVP, sure you can run it unsecured no worries. When you go to production, you go secure. My hope is that no DBA worth his under-appreciated skills would drop a totally open DB on the public internet. That said, it obviously happens... Read the directions, have a plan, and follow the checklist: [https://docs.mongodb.com/manual/administration/security- chec...](https://docs.mongodb.com/manual/administration/security- checklist/?jmp=community-hub)

Everyone has a different security model. In my case all my DB servers live behind and API layer on the internal network, and the DMZ web layer talks to the API. That makes keeping things secure MUCH easier...

</comment><comment><USER30> The v2.6 open access issue in MongoDB is no new revelation, and has been rehashed over and over again. It's worth noting that this post comes from a company that profits from convincing its customers that the products they are using are insecure.

</comment><comment><USER31> I'll say this is even worse because whether or not to bind to localhost, all interfaces, or something in between is often highly dependent on how the software works - which you're less likely to know when just trying it for the first time. Even someone security conscious would have to pause and do some investigations to find out what mongo expected in terms of port and interface bindings. If the default was to bind to 0.0.0.0 my first assumption would be they require that.

</comment><comment><USER32> This was 100% preventable, MongoDB comes with great resources for securing your data. I pity whomever puts ANY database on the internet without taking proper security measures.

Here's some documentation to get you started.

[https://www.mongodb.com/blog/post/how-to-avoid-a- malicious-a...](https://www.mongodb.com/blog/post/how-to-avoid-a-malicious- attack-that-ransoms-your-data?jmp=community-hub)

[https://docs.mongodb.com/manual/administration/security- chec...](https://docs.mongodb.com/manual/administration/security- checklist/?jmp=community-hub)

[https://www.mongodb.com/collateral/mongodb-security- architec...](https://www.mongodb.com/collateral/mongodb-security- architecture?jmp=community-hub)

This really should have been titled "the importance of good DBA's..."

</comment><comment><USER33> This isnt a mongodb problem. redis has already been targeted and memcached and elastic will. e next. for more info: ise.binaryedge.io or [http://blog.binaryedge.io/2015/08/10/data-technologies- and-s...](http://blog.binaryedge.io/2015/08/10/data-technologies-and-security- part-1/)

</comment><comment><USER34> I just had to deal with an insecure default in our Hadoop cluster.

Hadoop, by default, enables WebHDFS, which provides read+write access to HDFS over HTTP. The service runs on name node using the same port which displays the Hadoop Jobs Web UI.

Now, it is very easy to not know anything about WebHDFS and every day authenticate/login to server, submit jobs, and track the status on WebUI (which is public). But then anyone can send a POST request pretending to be any user and Hadoop will happily execute the command (including deleting all files).

Maybe Hadoop developers believe that all Hadoop installations are behind a firewall (ours was, but an exception was made for Jobs Web UI as it seemed to be a read-only status page for running jobs) and/or have Kerberos integrated with Hadoop for authentication.

But that being said, enabling HDFS access over HTTP by default seems to a debatable choice. Also, if you have a small Hadoop cluster running, do set "dfs.webhdfs.enabled" property to False in hdfs-site.xml.

</comment><comment><USER35> I cannot believe, that so many users install MongoDB, only using default settings and installed on servers, which are accessible via the internet.

That is fundamentally wrong application design. The application connects to the database, so the database must not be public accessible via internet.

I mean, if you push something into a production environment, you must think a bit about the tools you are using and how they are configured for security.

On a development system, I don't want to setup users or auth-mechanisms.

There are so many resources from MongoDB, how you can secure your MongoDB database: \- Security Architecture White Paper: [https://www.mongodb.com/collateral/mongodb-security- architec...](https://www.mongodb.com/collateral/mongodb-security-architecture) \- Security Best Practices blog post: [https://www.mongodb.com/blog/post/how- to-avoid-a-malicious-a...](https://www.mongodb.com/blog/post/how-to-avoid-a- malicious-attack-that-ransoms-your-data)

There is even a checklist which you can work through: [https://docs.mongodb.com/manual/administration/security- chec...](https://docs.mongodb.com/manual/administration/security-checklist)

And for those, who don't want to read anything ;-), there is a comprehensive Video-Course on the MongoDB-university: [https://university.mongodb.com/courses/M310/about](https://university.mongodb.com/courses/M310/about)

If I enter a car and don't use the seat-belt or switch on the light at night (defaults are off), then I cannot blame the car-manufacturer. If I use something important (here the database in a production environment), then I have to learn the ropes and read the material specifically on security topics.

</comment><comment><USER36> While we are at this, this checklist is worth looking at: [https://github.com/FallibleInc/security-guide-for- developers...](https://github.com/FallibleInc/security-guide-for- developers/blob/master/security-checklist.md)

</comment><comment><USER37> Postgres' defaults barely let you connect to the DB. You don't hear stories like this about Postgres.

<comment><USER38> Well, sure but then people just open the flood gates because it's such a pain in the ass to change postgres access policies.

I guess secure by default means there aren't likely to be massive hacks like this, but it does not mean people are running securely.

<comment><USER39> Is it just that no one's running exploit scanners for Postgres then?

</comment></comment></comment><comment><USER40> Speaking of defaults, if you install Mongo on EC2 using a default instance of Ubuntu using the default engine, Wired Tiger, you will get ceaseless server crashes. Wired Tiger is NOT STABLE on the default volume - ext4. You have to use xfs.

This was only recently added as a startup check.

</comment><comment><USER41> Education, experience, diligence. I'd expect that of anyone basing their livelihood on delivering production systems.

Secure out of the box is nice, except that when the boxing is done by others, and delivered to under-informed, unexperienced people. It's too easy to npm yourself a "full stack" or just pick a Docker container with full stack on it, then place it on public inter-web... there are dangers to be had, and others can save you. It's up to you.

And yeah, the click-bait titles including the word "hack" are laughable.

</comment><comment><USER42> I have recently been working with mongodb wanted to start the service with auth enabled with defined users and security. Here is the way I did. [https://medium.com/gitignore/automatically-start-mongodb- in-...](https://medium.com/gitignore/automatically-start-mongodb-in- authentication-mode-using-predefined-admin-users-48dca5d1f075)

</comment><comment><USER43> I found another piece of useful information from mlab, so I will share it.

[http://blog.mlab.com/2016/07/mongodb-tips-tricks- collection-...](http://blog.mlab.com/2016/07/mongodb-tips-tricks-collection- level-access-control/)

</comment><comment><USER44> The news is too late for me. Two of our development servers are already compromised. Anyway I added those servers under NAT so those servers are inaccessible from internet. Added admin access credentials also. The news should have been spread without any delay.

</comment><comment><USER45> It's worth noting this isn't unique to MongoDB. The "Marked" npm package, with it's 2 million downloads, doesn't sanitize input by default. "st", another popular package, allows directory listing by default. Quite a few of those...

</comment><comment><USER46> If I were a mongo dev, I wouldn't want to write authentication and have to manage crypto.

Default bind to localhost. If you want to handle external connections, the network layer provides your security.

</comment><comment><USER47> The MongoDB hack and the importance of hiring competent people.

</comment><comment><USER48> A bit off-topic but related: how secure are the defaults of an AWS RDS MySQL (created by a BeanStalk environment, if it matters)?

</comment><comment><USER49> Not defaulting to 'localhost' (or 127.0.0.1) is pretty bad in general.

</comment><comment><USER50> Why would someone still use v2.6? There isn't much trouble to upgrade.

<comment><USER51> Based on the article at least 30.000 internet-accessible installations.

</comment></comment><comment><USER52> Who, when wanting to write a secure piece of software, thinks: "I know! I'll use JavaScript!"? Security was always going to be an afterthought at best. There are legitimate reasons for writing things in JavaScript, and none of them apply to a database.

<comment><USER53> What does this have to do with Javascript?

<comment><USER52> MongoDB is written in Javascript.

<comment><USER54> In part. According to the Github repo, it's 75% C++, 18% JS.

[https://github.com/mongodb/mongo](https://github.com/mongodb/mongo)

<comment><USER55> The JS is from docs and examples, not from core MongoDB code.

<comment><USER52> So [https://en.wikipedia.org/wiki/MongoDB](https://en.wikipedia.org/wiki/MongoDB) is wrong? Well, guess I trusted Wikipedia a bit too much.

<comment><USER55> I'm confused, what about that page are you claiming to be right or wrong? The code is here for all to see: [https://github.com/mongodb/mongo/tree/master/src/mongo](https://github.com/mongodb/mongo/tree/master/src/mongo)</comment></comment></comment></comment></comment></comment></comment>


ConstraintJS: A library for creating dynamic web apps - <AUTHOR> http://cjs.from.so/

<comment><USER2> There are about a million JS libraries that do data binding, from just about every angle, going back a decade or more. I suspect that most JS devs have even written their own version (I certainly have).

That's not to say there isn't value in creating new libraries, if they have something new of value to add. I think ReactJS falls into this category, amongst others.

But if you are trying to re-solve a problem that has been solved to absolute death, please put at the top of your web page a rational for why you created this library, and why all the existing efforts fall short. Otherwise I, and I suspect many other developers, will never take the time to find out.

<comment><USER3> Databinding can be seen as poor-man constraints: better than nothing, but still not full fledged constraints! One-way databinding is still even more impoverished.

Unfortunately from what I can tell, ConstraintJS is just another databinding framework without an expressive general constraint solver. It really is too bad that the constraint systems that were explored in the 80s and 90s have yet to resurface (production has just made it to the 70s).

<comment><USER4> Constraints have two problems though:

1\. The semantics of data binding is much better behaved. Constraint solving doesn't have an obvious sweet spot, where you can say that you can solve a certain obvious class of constraints. Which is why you had such a cottage industry of constraint solvers.

2\. Data binding is powerful enough for most things you want to express, and for those things that it's not powerful enough for, a generic constraint solver isn't powerful enough for either (e.g. ui layout, you quickly start to want a linear programming solver or something else that's domain specific).

<comment><USER3> A physics engine is the ultimate constraint solver and works well for problems like layout :)

</comment></comment></comment></comment><comment><USER5> I think they could have added a better explanation for this. I looked at the first example and assumed only 'friend' could be the input.

Turns out I was wrong :p

But, seriously, what's the difference between this and say, Angular.js? They seem to be solving a similar problem with similar syntax

</comment><comment><USER6> At first glance this reminds me a lot of the reactive templating that Meteor does using handlebars like syntax. It even registers dependencies with invalidations, a lot like Meteor. I'd love to see a comparison between the two to see if there is any big difference.

</comment><comment><USER7> My first thought was that this would be like iOS constraints, which position elements on the screen. This is more of a dynamic templater. I'd be interested to see the performance of this

<comment><USER8> That would be [http://gridstylesheets.org/](http://gridstylesheets.org/)

</comment></comment><comment><USER9> Its not a "web app" if it isn't dynamic.

</comment><comment><USER10> meh</comment>