The Rising Threat of Digital Nationalism - <AUTHOR> https://www.wsj.com/articles/the-rising-threat-of-digital-nationalism-11572620577?mod=rsswn <comment><USER3> > As the internet turns 50, the global vision that animated it is under > attack.

The vision in 2019-50=1969 was in fact very far from globalist.

At that time it was the early stages of U.S. Dept of Defense project ARPANET.

It's largely the reason why IP/TCP largely lacks any security or DoS prevention features: you needed a U.S. security clearance to even access it.

First non-U.S. access of any kind to the "internet" was in 1973, though physical access continued to remain heavily restricted for years. (I say "the internet" because it was still ARPANET and the Internet Protocol did not yet even exist.)

Much later the WWW -- as the name itself suggests -- was a globally-minded endeavor. The World Wide Web is 29 years old.

<comment><USER4> > First non-U.S. access of any kind to the "internet" was in 1973, though > physical access continued to remain heavily restricted for years.

One could argue that the current "Internet" based on TCP/IP has only existed since 1983, and the 1969-1982 ARPANET was a different internet given it was based on a different and incompatible protocol stack (NCP).

"An internet" is just any network which connects networks. In that sense, there have been (and may yet be) other internets running other protocol stacks. "The Internet" is a particular internet running a particular protocol suite (TCP/IP), and defined as such the Internet began operation on 1983-01-01.

<comment><USER3> Correct. It's a matter of semantics. Though "50-year-old internet" could only refer to ARPANET.

As an aside, English style guides formerly required "an internet"/"the Internet" distinction, however that has been changing in recent years to lowercase "internet" in both cases.

In school I was marked down for writing "the internet", and now English professors say that is in fact the right way to do it. Not even English is immune to versioning.

<comment><USER5> English teachers are generally petulant pedantic crocks anyway. We'd probably have more/better writers without them ruining the subject for people as they do.

<comment><USER6> It's interesting that you say this. I find that I had about as many good/great English teachers as I did in other subjects, but there weren't many mediocre English teachers.

I had a math teacher who literally never got up from his desk, visibly counting down the years until he could collect his pension. I had similarly checked out history and science teachers.

The not-good English teachers I had, however, seemed mad at the world and out for blood. The name written on an assignment had a stronger correlation with the grade than the content, so the only path to an A was to stroke the teacher's ego

I even had a pair of friends do a blinded experiment to confirm this. They each would type out their assignment, then would call each other and flip a coin; Heads they write their own name, Tails they write the other person's name.

In another occurrence, I had gotten on a teacher's bad-side and so the grades on my papers had a hard ceiling of a C. I asked my dad for advice, and it was roughly: Talk to the teacher, apologize for "not applying myself" offer to redo back assignments. She didn't even have me redo any back assignments, but suddenly I was getting As and Bs again.

Another occurance: I got my first paper of the class back with the only markings on it "58, almost an A paper." Here was the dialog that ensued:

\----

Me: How many points is this out of?

Teacher: 100

Me: Is the class graded on a curve?

Teacher: No, straight 90/80/70

Me: So how is 58 "almost an A paper?"

Teacher: Well, just a few tweaks and it would be great,[encouraging tone] I'm sure you'll do well in my course!

Me: ...

\----

To this day I still have not figured out what was going on in that teacher's mind. It was a rare real-world moment where I honestly couldn't tell if I was being trolled or not.

<comment><USER7> You probably needed to stroke her, his, or it's ego again.

I had a math professor do that to me in undergrad. Fear of his type led me to leave the field entirely after that degree. Just way too much power over me with little to nothing I could do.

<comment><USER8> it's = it is. You were looking for "its"

gratuitous correction because of the topic. hth hand.

<comment><USER7> autocomplete made me do it.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER9> From what I can tell, the Internet still does effortlessly defy regulation.

The _businesses_ that operate on the Internet from meatspace don't.

Because they can't, at a fundamental level. They're based somewhere. They have visible employees in jurisdictions. They represent enormous juicy targets with tens, hundreds, thousands of millions of users to control.

They're huge companies. They have management structures, bureaucracies, whole departments that result in the sort of nonsense we see like GDPR popups or country blocks.

That's not the Internet of 50 years ago; it's not even the Internet of 20 years ago.

Alternatively, you could simply think of it like this - the everyman has been regulated. The power users (for lack of a better term) are in much the same situation that they were in 1990.

If you discount the fact that 'everyman' expects everyone to be on the "hip new platform" (fb, snap, insta, tiktok, whatever) then honestly the situation is way better than it was back then. It's just hard to ignore the cruft.

<comment><USER10> In the first point, I agree. What has changed is who's on the internet. The average person may be snooped on, but they're not very regulated. What's regulated are companies, especially large multinational corporations.

Essentially, when we say "regulate" today, that's kind of what we mean: regulating bodies that that make rules for large corporations. Increasingly regulated and a increasingly corporate came in tandem.

On your second point... I think it's kind of moot. Sure, the international "old internet" still exists. You can take part in it like you did in 1996. It's just dwarfed by the new internet.

I'd argue that's a technicality, the important parts of that internet's "freedoms" are pointless when it's a vestigial artifact.

</comment></comment><comment><USER11> I thought this was going to be an article about people who feel more attached to their digital communities than their geographical communities. That would be an interesting avenue to explore.

<comment><USER12> as did i; my favorite on the subject is this one: [https://www.gwern.net/The- Melancholy-of-Subculture-Society](https://www.gwern.net/The-Melancholy-of- Subculture-Society)

> As ever more opt out, the larger culture is damaged.7 The culture begins to > fragment back into pieces. The disconnect can be profound; an American anime > geek has more in common with a Japanese anime geek (who is of a different > ethnicity, a different culture, a different religion, a different language…) > than he does with an American involved in the evangelical Christian > subculture. There is essentially no common ground—our 2 countrymen probably > can't even agree on objective matters like governance or evolution!

> With enough of these gaps, where is 'American' or 'French' culture? Such > cultural identities take centuries to coalesce—France did not speak French > until the 1900s (as The Discovery of France recounts), and Han China is > still digesting & assimilating its many minorities & outlying regions. > America, of course, had it easy in starting with a small founder population > which could just exterminate the natives.

> The national identity fragments under the assault of burgeoning subcultures. > At last, the critic beholds the natural endpoint of this process: the nation > is some lines on a map, some laws you follow. No one particularly cares > about it. The geek thinks, 'Meh: here, Canada, London, Japan, Singapore—as > long as FedEx can reach me and there's a good Internet connection, what's > the difference?' (Nor are the technically-inclined alone in this.8)

<comment><USER13> An american anime geek does not have more in common with a japanese anime geek than an american evangelical. Race, nation, language, history, etc are far more potent than what naive utopian people wish it were.

Communists used to think like you. They felt that a german factory worker had more in common with a french or russian or chinese factory worker and that introducing communist ideas would let awaken them to this "fact" and they wouldn't join the army to kill each other. WW1 and WW2 proved that german, french, russian, chinese, etc factories were more than willing to kill each other by the millions.

> The geek thinks, 'Meh: here, Canada, London, Japan, Singapore—as long as > FedEx can reach me and there's a good Internet connection, what's the > difference?' (Nor are the technically-inclined alone in this.8)

I guess the "geek" hasn't tried to getting visas or immigrating to those places.

Also, you have to realize that all it takes in just one nationalist movement to spur nationalism almost everywhere. Nationalism has that kind of virtuous cycle.

Look at the current US-China trade war. It not only increases nationalism in the US, it also increases in China.

<comment><USER14> >An american anime geek does not have more in common with a japanese anime geek than an american evangelical. Race, nation, language, history, etc are far more potent than what naive utopian people wish it were.

Studies on international otaku subcultures show large commonalities between them. Perhaps you just chose a bad example, but I don't think your point is convincing.

</comment></comment></comment></comment><comment><USER15> The article starts with: "A network that once seemed to effortlessly defy regulation is being relentlessly, and often ruthlessly, domesticated."

And yet concludes with: "Fifty years after the birth of the internet, it may well be that national governments, wielding enlightened regulation, are the last best hope for maintaining a network that is—at least relatively—open and free."

Am I missing something? How could "regulation" be a possible answer to "digital nationalism"? Are there examples of what the author is referring to as "enlightened regulation" in which regulation has had the desired impacts? Seems to me that far more often we see a mix of intended and unintended consequences.

I would add that web != Internet. Internet is closer to printing press. A world in which there are billions of TCP/IP stacks on personal compute with Internet access is not one which is easily controlled (for good or for bad) by regulation.

<comment><USER16> > Am I missing something? How could "regulation" be a possible answer to > "digital nationalism"? Are there examples of what the author is referring to > as "enlightened regulation" in which regulation has had the desired impacts? > Seems to me that far more often we see a mix of intended and unintended > consequences.

How are net neutrality laws, a form of regulation, a safeguard to keep the internet open and free?

> I would add that web != Internet. Internet is closer to printing press. A > world in which there are billions of TCP/IP stacks on personal compute with > Internet access is not one which is easily controlled (for good or for bad) > by regulation.

This distinction is meaningless. The author may have have conflated the terms, but most people's primary (and often only) exposure to the internet is via a web browser. They're clearly not concerned about the spread of nationalism via IP cameras.

<comment><USER15> > How are net neutrality laws, a form of regulation, a safeguard to keep the > internet open and free?

Agreed, great example. The free market approach would be to ease the regulations on access and spectrum which have limited last mile competition in the US. Less regulation - not more - would lead to an enviro in which an ISP who was preferring certain content would be genuinely risking losing customers by doing so (and might gain certain types of customers, opening niches for other ISPs to win other customers, which would be fine too).

<comment><USER16> > Less regulation - not more - would lead to an enviro in which an ISP who was > preferring certain content would be genuinely risking losing customers by > doing so (and might gain certain types of customers, opening niches for > other ISPs to win other customers, which would be fine too).

Haha no, Ajit. You either take the ISP you get, charging whatever you for whatever they want [https://www.google.se/amp/s/arstechnica.com/information- tech...](https://www.google.se/amp/s/arstechnica.com/information- technology/2018/07/comcast-or-charter-is-the-only-25mbps-choice- for-68-million-americans/%3famp=1), or you go check your e-mail at the nearest coffee shop.

<comment><USER17> Less regulation would allow us to use all of those delicious adjacent bands the television networks bribe politicians into letting them squat on -- as well as the bands they actually use. Remove broadcasting regulations entirely and we'll have a crazy free-for-all of intermittent DDOSing (accidental and otherwise) coupled with legitimate free-market internet access where you can choose any provider whose signal can reach you. I'll take it.

<comment><USER18> Let's see what happen on the darknet to truly appreciate the absence of regulation :

Free markets and month of barely enough practicable bandwith to buy your pot on a darkmarket because hackers ddos as hell these market in order to blackmail their owner to pay them a huge ransom to stop their attack, and what should have been an easy transaction taking barely more time than to buy shampoo on amazon take more than 4 hours.

And don't get get me started with vaping canabis oil cut with tocopherol which cause an epidemic lipidic pneumonia or pedophile rings operating video sharing websites.

<comment><USER17> I appreciate the relevance of your username; keep loving Big Brother, brother.

Regarding cut products, it's an immature ecosystem, but thanks to efforts from folks like The LSD Avengers[0] drugs on the old Silk Road were becoming safer than normal street drugs when the government shut it down:

> Silk Road seemed to be a safe place to buy really good drugs, if you knew > what you were doing. The prices might be higher than what you'd pay on the > street, but dealers on Silk Road were held somewhat accountable by the > community. The seller-rating system built into the site, along with efforts > by unofficial groups like the Avengers, created a meritocracy that rewarded > dealers who sold good stuff (with the exception of the infamous tony76 > fraud, in which a well-reputed seller took a bulk of orders and > disappeared). And when law enforcement tested the wares on Silk Road, police > found they typically had a high purity level of the drug advertised.

If you authoritarians would just stop hunting down and arresting drug users then the ones who cared about purity and health would actually have options they were well informed about. The problem isn't a lack of regulation, it's that you've regulated the product so hard that it's legally dangerous to even review it, and you keep attacking/dispersing communities of buyers and sellers which means that it's difficult to keep organized/informed. That you would blame this on the free market is ridiculous. Let people sell and review products, they'll figure it out if you just _stop pointing guns at them and locking them in boxes._ This problem is absolutely a result of regulation; if you did not regulate LSD at all, finding a source of actual unadulterated LSD would be trivial. Same with cannabis oil.

[0]: [https://www.theverge.com/2013/10/14/4828448/silk-road-lsd- av...](https://www.theverge.com/2013/10/14/4828448/silk-road-lsd-avengers- drug-inspectors)

</comment></comment></comment></comment></comment></comment></comment><comment><USER19> Nationalism is a cult of humanity, and humans will use whatever tools are available to aid in the continuance of their interests. Hence, no amount of technolibertarian cleverness in engineering network protocols or cryptography is going to stop it. It can only be stopped in the messy, human world of politics and culture.

In the late 80s and 90s, I was a big fan of John Perry Barlow, the independence of cyberspace, crypto-anarchy on the internet, the idea that some combination of a uncensorable world wide internet (that could route around governments), could displace even their national currencies, could be end to end anonymous and encrypted, would be a nirvana from oppression.

The problem with the naive cyberlibertarian world view, is that it treats government as a wholly separate actor from the people who create the society they live in, and if your neighbors want to be Nazis, technological choices aren't going to protect you. It's not just "Digital Nationalism" that's rising. Nationalism is rising. You need only need at the US electing Trump, Brexit in the UK, at some of the neo-fascists elected recently in the EU.

The optimism of the 90s, has been replaced with a mentality of scarcity, and when that happens, people look to hoard, they become less generous, more tribal, they circle the wagons.

We are not going to fix Nationalism until we fix the underlying economic and social problems that are giving rise to it.

<comment><USER20> You call nationalism a cult, I call it a grand narrative underpinned by shared values that allow people to more easily trust each other (and hence coexist).

That just isn't going to happen globally.

<comment><USER21> It's the same thing at different levels of abstraction.

If you are from a locale where low-trust, feuding groups are interacting with each other but on a largely negative basis, and you're tired of it - <USER2> nationalism looks like something positive that can unify people into something more peaceful, and more capable of doing large scale projects together etc.

If you are from a locale where low-trust feuding nations are interacting with each other on a largely negative basis, and you're tired of it - then you want to develop a global structure which unifies them into something more peaceful, and more capable of doing large scale projects together etc.

What is it about nationalism that makes that particular level of abstraction become reified and hard to move beyond?

<comment><USER22> Pride I suspect is a large difference. While it might be accepted to alliance of neighbors foreign "others" don't cut it unless conquered as it doesn't vicariously massage their ego the same way to have partners with agency.

It seems to go back to before nationalism per se as a term. See Genhis Khan and the Mongols who ironically had little cultural influence over those they once conquered. Just uniting into a lack of war wasn't enough - they needed outside targets. Feudalism in general had that issue where a post unified country is left with an excess of fighters to burn off on foreign adventures for stability to prevent infighting fiefdom expansions. Both Japan post Sengoku Jidai and the Crusades fit that model as well. It also made them long term enemies even jf it didn't result in same generation "show up to pillage your holdings" retaliation.

</comment></comment></comment></comment><comment><USER23> Why are the terms nationalism, authoritarianism, and chauvinism used interchangeably?

<comment><USER22> Because they are the inevitable correlaries of the root ideal. "The nation above all else."(Nationalism) leads to "Dissent against the government is wrong and treasonous. Obey the nation and make it great!" (Authoritarianism) and "Others are less important." (Chauvanism).

<comment><USER24> > "The nation above all else."(Nationalism)

Googling that phrase, the first hit I get is Fascism, not Nationalism.

[https://encyclopedia.ushmm.org/content/en/article/fascism-1](https://encyclopedia.ushmm.org/content/en/article/fascism-1)

\</comment></comment></comment><comment></comment><comment></comment><comment></comment><comment>----

Definition and Beliefs

Fascism is an ultranationalist, authoritarian political philosophy. It combines elements of nationalism, militarism, economic self-sufficiency, and totalitarianism. It opposes communism, socialism, pluralism, individual rights and equality, and democratic government.

Fascism places the importance of the nation above all else. The unity of the national community is prioritized above the rights of individuals. This leads to an intense interest in defining which groups belong or do not belong to the national body. Fascism is characterized by:

        strident, often exclusionary nationalism
        fixation with national decline (real or perceived) and threats to the existence of the national community
        embrace of paramilitarism

\</comment><comment></comment><comment></comment><comment></comment><comment>----

These two ideas seem to have become synonymous _in the minds_ of most people, but academically they are distinct.

</comment><comment><USER25> > According to the New York Times, at least a quarter of the world's countries > have temporarily shut down the internet over the past four years.

I was a bit shocked reading this sentence. A quarter of the world's countries is a big percentage. But apparently that is the case.

There is a good report by Freedom House that analysis "Freedom on the Net"[1] and it seems that the trend of restricting access is a global phenomena. (especially across "less-connected" countries).

[1]: [https://freedomhouse.org/sites/default/files/FOTN_2018_Final...](https://freedomhouse.org/sites/default/files/FOTN_2018_Final%20Booklet_11_1_2018.pdf)

</comment><comment><USER26> As the article explains, the Internet is just a tool, and it's been aggressively used as a way to control user behavior to mostly benefit advertisers, producers, or conform behavior to governments. Even worse, political warfare is very easily imposed on today's social networks because they are designed to be echo chambers that receive outside messages from the highest bidder.

However, this doesn't NEED to be the case as we can design online experiences that bring people together. The last two years I've self-funded a foundation [1] to work on on precisely this problem of using the Internet to try to unify people together. Today we have two platforms we are providing to the public and organizations.

The first [2] service organizes people at physical events by maximizing the diversity of auto generated discussion groups, and we're having a fair amount of success in schools and events in the US and Austria. The other service [3] is purely an experimental free public social platform that matches people who have different viewpoints to have a timeboxed live discussion to chat about their views.

I'm not sure if what we've built so far can make a big impact online, but I hope it can serve as an example of what kind of tools that could be built if the focus is squarely aimed at unifying people instead of stuffing them into echo chambers with pay-to-reach walls between groups of people.

[1] Foundation: [https://www.newdialogue.org/](https://www.newdialogue.org/)

[2] Group diversity mixer: [https://www.mixopinions.com/](https://www.mixopinions.com/)

[3] Social platform: [https://www.dinnertable.chat](https://www.dinnertable.chat)

</comment><comment><USER27> I think this article focuses on the wrong kind of nationalism. I think that there are going to be virtual nations with virtual governments based around cryptocurrency ecosystems.

The existing physical governments will slowly lose their influence.

As existing governments become weaker, virtual nations will realize that they can seize companies (the means of production) and take possession of their revenues by strategically corrupting employees inside those companies.

The virtual governments will use seized company revenues to buy-back and burn their own cryptocurrencies to give their currencies more value and gain more power.

Eventually the virtual nations will take control of physical land in various countries by corrupting and manipulating existing government officials. Each new nation will be scattered geographically through all continents.

<comment><USER28> Which virtual nation do I become a part of? Does one just join whichever group of criminals make one feel safest?

<comment><USER29> Is crime that important to you that you would choose a group of criminals? I would guess that most people would form peaceful pacts with their family, friends, etc.

</comment></comment></comment><comment><USER30> A lot of these regulations are at democracies because of citizens demanding data protections. I founded the company InCountry that's mentioned in the article. What you're seeing here is that countries are starting to regulate the Internet like they regulate everything else. McDonald's has to comply with a ton of regulations on food, employees, tax, etc. everywhere they are. But for the longest time, not how they treated consumer data.

<comment><USER31> Not sure I saw a single rally in Europe where people demanded their data should be kept in the EU. Not sure I saw a single rally in Australia/UK where people were saying "yeah, block that porn for us".

<comment><USER8> I never heard of a rally demanding fines for people who run read lights, either.

</comment></comment></comment><comment><USER32> [http://archive.is/M8592](http://archive.is/M8592)

[https://web.archive.org/web/20191110215752/https://www.wsj.c...](https://web.archive.org/web/20191110215752/https://www.wsj.com/articles/the- rising-threat-of-digital-nationalism-11572620577?mod=rsswn)

</comment><comment><USER33> Extreme Nationalism was and is the symptom of the time. Plus Nationalism is perfectly normal as long as it doesn't go extreme.

<comment><USER34> There's no such thing as normal nationalism, as nationalism is a form of extremism by itself, more accurately what the perfectly natural love everyone of us feels for his/hers own country becomes once filtered and distorted by propaganda with the purpose of making people do nasty things under the belief they're necessary for a bigger good.

Try this test with some of the less extreme nationalists you know: show them a photo of planet Earth taken from space and tell them "this is my homeland. I love it and you should too", then watch their reaction. Some of them may agree, but most won't. The point is that planet Earth does indeed contain their entire homeland, but includes other countries too, which is what many people don't accept. This plain stupid test demonstrates how nationalism isn't about loving one's country rather than not loving other people ones.

<comment><USER35> Relevant video: [https://www.youtube.com/watch?v=9ce_nNAfVq0](https://www.youtube.com/watch?v=9ce_nNAfVq0)

Synopsis: there's a distinction between hypernationalism and nationalism; nationalism has become normalised for a long time, so any "nationalism" that sticks out tends to actually be "hypernationalism", which is destructive and dangerous.

<comment><USER35> As an addendum, also compare recent nationalism in Turkey and Kurdish nationalism:

Turkey is an established state. Nationalism in Turkey is a social movement for increased conformity (resulting in a rise of Islam, slowly converting it from merely a widespread religion into a state religion, and cultural homogeneity, rejecting e.g. Greek shared history and ethnic minorities). It has also fueled rhetoric strongly suggesting expansionism (though currently restricted to depopulating Northern Syria to create a "security buffer" and relocating a different, more trusted, ethnic group there).

Kurdish nationalism for decades was a struggle against Turkish nationalism (as well as Iraq, Syria and Iran), fighting for cultural and ethnic recognition of the Kurdish minority in Turkey. The stated goal was to create a separate Kurdish nation state to define and protect a shared Kurdish identity.

More recently, Kurdish politics have moved away from the idea of a nation state. Rojava, although predominantly Kurdish, was explicitly created as an autonomous territory rather than a state and as multi-ethnic, multi-religious and with all central power devolved to the lowest level (i.e. all power is granted directly and explicitly by households forming neighborhoods forming communities). They explicitly aimed to find common ground with Syria, aspiring to become a mere autonomous territory in Syria, rather than a separate state. They eschewed both nationalism (i.e. creating a homogeneous identity) and full statehood (i.e. full political sovereignty and independence).

In reverse order, these are an example of the absence of nationalism, nationalism to _create_ a new nation state (empowering a minority in an existing state) and hypernationalism (refining an existing nation state through increased homogeneity and militaristic expansionism).

</comment></comment></comment></comment><comment><USER36> Counter oppressive regimes by decentralizing. Build mesh networks.

</comment><comment><USER37> At this point I'm very pessimistic about the future of the open World Wide Web, and see little in the works in terms of securely replacing it when it does come apart.

We, its users, are all to blame. We've stood idly by as the concept itself went from a largely decentralized protocol for sharing information via hyperlinks, to a bastardized, immensely centralized platform for stealing people's attention, even creating addictions, mine their data while they stare on and use the two to sell them more shit they don't need.

At best we passively supported this, but most of us actively partook in it. We use Google products, buy Apple products, share our data on instagram/facebook/etc., click shitty clickbait links and more. In doing so, we made some companies incredibly rich, enabling them to buy out or use their money to fund lawsuits against emerging competition, further centralizing their power.

Not satisfied with simply supporting these actions, we're on a platform right here that actively encourages companies to spin up attention/data harvesting platforms with the goal of "going public" or being bought out by one of these giants. You could be easily justified in saying those of us in the tech industry are the most culpable.

The governments, rightly so, have recognized the threat that power bears. Some chose to work with them, and use FISA or other means to secure backdoors to all the data they hoover up on us, and then work around pesky laws by sharing it with buddies such as those in Five Eyes to give eachother mutual access to one another's data. We know this. We did nothing about it. Others chose to work against them, such as China.

Instead of taking a stand, the big, powerful tech companies we all revere bent over and did what they were told in order to access the markets of those working against them to steal more attention and make more money.

And we stood idly by. At the micro level, we're now in a phase where if a vocal enough internet group takes offense to some sort of content within our sphere of influence, or against something someone posted 10 years ago, that they can pressure providers to deplatform their targets. Some stand idly by, others applaud it as progress.

And so it will continue to crumble. Wise countries, recognizing both the threat of the internet giants and the opportunity of getting access within them, will apply the necessary pressure to have those giants make the internet "their way". "Wise" internet groups, recognizing both the threat of wrongthink and the opportunity to deplatform those who think wrong will apply pressure on the same giants to make the internet "their way".

The only possible saviour is some sort of international body, comprised of representatives of all nations, cultures and subcultures, coming together to agree on keeping things open and clear. Given that we can't even make the UN effective, such a group would never agree on anything and would merely continue to justify its own take on censorship and thus wouldn't be viable from the start.

And so the Web many of us came up on here, which provoked our interest in computers, networks, software and hardware, is doomed, and it's all because we are weak, and the giants we've allowed emerge are ultimately weak also.

And none of that has anything to do with nationalism.

</comment><comment><USER38> Open digital borders has had a number of positive and negative consequences, and of these the increase in foreign influence campaigns has been both positive and negative forces from a moral perspective, to a nation-state an open-borders internet is a huge security risk.

</comment><comment><USER39> Woodie Guthrie had a label on his guitar that read "This machine kills fascists." I was naive once. I thought that the internet was such a machine. But instead of a tool for decentralizing power it's becoming a tool for centralized power to wield control, to enforce conformity in ever greater detail.

What would a tool of actual decentralization look like? It wouldn't be something that helps us communicate or brings us closer together, because those things evolve into instruments of control. It would be something that divides us into separate ecological and memetic niches. The only example I can think of is a multi generational space ship.

We're in a race between diaspora and social lithification. I wish I thought diaspora was the better bet.

<comment><USER40> I disagree.

We are moving into a world where people have more freedom and liberty. Sometimes we take a (big) step backwards, but the trend is towards more.

These new freedoms and liberties are created by technology, increased wealth distribution (globally), and changing social norms towards individual rights and equality.

I can, for example, participate in international engineering efforts from any one of a billion places with steady internet that will allow me to stay. I can eat a greater variety of foods than my grandparents enjoyed. I can do research and study about my own medical alignments and make better informed decisions about my healthcare than every before. I have the option to marry anyone that agrees to it, regardless of race or gender. I can practice the religion of my choosing openly.

I understand that there is a lot of pain and a large risk of group think associated with our global information system. I have the individual freedom to choose which information sources I tune into, and I have never had a greater variety than today.

<comment><USER41> >These new freedoms and liberties are created by technology

Okay... let's see:

>increased wealth distribution (globally)

Trend began before the internet (the subject at hand).

>changing social norms towards individual rights and equality

Trend began before the internet (the subject at hand).

>I can, for example, participate in international engineering efforts from any one of a billion places with steady internet that will allow me to stay.

Irrelevant to the subject at hand.

>I can eat a greater variety of foods than my grandparents enjoyed. I can do research and study about my own medical alignments and make better informed decisions about my healthcare than every before. I have the option to marry anyone that agrees to it, regardless of race or gender. I can practice the religion of my choosing openly.

All irrelevant to the subject at hand.

>I understand that there is a lot of pain and a large risk of group think associated with our global information system. I have the individual freedom to choose which information sources I tune into, and I have never had a greater variety than today.

Disagree. It isn't about your basic individual freedom to choose. You can choose, yes. But it is about the field of vision presented to the focus of your mind, or rather the collective mind. It is about the narrowing of that field of view. Narrow the field of view: narrow the choices people believe they have. This, in effect, narrows their choices, regardless of their ability, or freedom, to choose.

<comment><USER40> > Trend began before the internet

Exactly. It's almost like the internet isn't the most important thing happening right now. Combining the world's networks into one is really powerful, but the world is a big place. The internet isn't going to cause a utopia or a dystopia.

</comment></comment></comment></comment><comment><USER42> Hey-uh, is there anything we can do about this awful paywall? Perhaps the devs should add a thing to all WSJ articles to bypass.

</comment><comment><USER42> How are any of you guys reading this with their horrific paywall?

</comment><comment><USER43> Again, it comes down a lot to privacy, especially in response to the growing inclusion of governments in our digital life.

-Alternative to Gmail: ProtonMail ([https://protonmail.com/](https://protonmail.com/))

-Alternative to Google: DuckDuckGo ([https://duckduckgo.com/?t=hk](https://duckduckgo.com/?t=hk))

-Alternative to Dropbox and GoogleDrive: Duple ([https://www.duple.io/en/](https://www.duple.io/en/))

-Alternative to Whatsapp: Signal ([https://signal.org/](https://signal.org/))

<comment><USER34> "Duple ([https://www.duple.io/en/)"](https://www.duple.io/en/\)")

100% closed source as for now. They promised to make almost all of it open source, sadly except the most important part. Security is a chain: a 99% open source app is still 100% insecure as a 100% closed one.

<comment><USER44> There is plenty of insecure open sourced software and secure closed source. I'd be surprised if there was any correlation here.

<comment><USER8> Depends on the definition of "insecure". I think we mean "the user is a victim of the owner of the product" or "the user has no choice but to overconsent to invasion from the producer". When ssh has a vulnerability, that's not a problem of me overconsenting to something OpenBSD wants to do. It's a problem where some third party has managed to fool OpenBSD into believing I want them to do something on my behalf, when I issued no such instruction.

But the vulnerability that is Google Mail is that Google will read any email sent to or from a Google Mail account, even incidentally, and use it to build up a profile which paying customers can use to manipulate me into doing things which, in the absence of the profile, I wouldn't've have done. Moreover there's just massive risks from all that data.</comment></comment></comment></comment>


Your Docker image might be broken without you knowing it - <AUTHOR> http://phusion.github.io/baseimage-docker/ <comment><USER2> The comments about the init process are true. It makes sense to run a proper PID1 system here such as runit.

I'd argue with the rest of the post. The problem is that phusion makes the common mistake of thinking of containers as faster VMs. That's fine, this is where almost everyone starts when first looking at Docker paradigm.

A good rule of thumb is: If you feel like your container should have Cron[1] or SSH[2], you are trying to build a VM not a container.

VMs are something that you run a few of on a particular computer. Containers are something that you will run thousands or tens of thousands on a single server. They are a lot more lightweight and loading them up with VM cruft doesn't help there.

[1] Cron: use the cron of the outer machine with docker run [2] SSH: use lxc attach

<comment><USER3> I disagree with running cron outside the Docker container. One of the reasons for using Docker is to lower deployment pain. The moment you use cron on the host machine you've introduced yet another moving part, and yet another dependency that must be installed on the host.

I also disagree that there is a mistake here involving thinking of containers as faster VMs. Yes, you can think them of applications, but the fact is still that there is a whole operating system running inside the container, and that many apps rely on cron and other stuff. Given that crond is so small and lightweight, and that a lot of people don't know what depends on cron and what not, I think it's better to turn it on by default. If you know for sure that you don't use cron, you can still turn it off.

Remember, the goal of baseimage-docker is to provide a base image that is correct for most people, especially people who are not intimately familiar with the Unix system model.

Lxc-attach, although it works, has several problems:

* You are doing things outside Docker so you won't be able to track it (logs, attach, etc). Also, docker might use LXC right now, but there is no warranty it will do so forever. For example, what if you're using Docker on OS X? No lxc-attach there.

* It does not allow you to limit access. What if you want to give a person only access to a specific container? You can do that with SSH through the use of keys.

* lxc-attach has caveats with --elevated-privileges, documented in the man page.

<comment><USER4> Just run another container that runs cron.

In regards of lxc-attach: this is a command that docker should expose to allow network operations. Even with baseimage-docker you won't be able to track it because all you can do is attach/log sshd. Also how do all these SSH keys and ports on a single host ?

</comment></comment></comment><comment><USER5> Fascinating. My first inclination, when I started running Docker, was to run /sbin/init and launch a full systemd and all services.

I even asked on ServerFault (ie, StackOverflow for servers) about it and was told, quite aggressively, that running a full OS is wrong:

[http://serverfault.com/questions/573378/how-can-i- persistent...](http://serverfault.com/questions/573378/how-can-i-persistently- run-a-docker-container-without-specifying-a-command)

Addressed individually:

1\. Reaping orphans inside the container.

Yup. If your app's parent process crashes, its child processes may now be orphans. However in this case your monitoring should also restart the entire container.

2\. Logging.

Assuming you run your docker image in a .service file (which is what CoreOS uses as standard), systemd-journald on the host will log everything as coming from whatever your unit (.service) name is. So if you `systemctl myapp start` output and errors will show up in `journalctl -u myapp` in the parent OS.

3\. Scheduled tasks.

For things like logrotate, it really depends whether you're handing logs inside or outside the container. Again, I'd use systemd-journald in CoreOS, rather than individual containers, for logs, so they'd be rotated in CoreOS. For other scheduled tasks it depends.

4\. SSHd

It depends. SSH isn't the only way to access a container, you can run `lxc- attach` or similar from the host to go directly to a container.

I do mention CoreOS here because that's what I use, but RHEL 7 beta, recent Fedoras, and upcoming Debian/Ubuntus would all operate similarly.

<comment><USER3> Regarding reaping orphans: orphans do not necessarily imply that something crashed or that something went wrong. Orphans is a very normal part of system operation. Consider an app that daemonizes by double forking. Double forking a common technique with the intention of making the process become adopted by init. It expects PID 1 to be able to handle that correctly.

Regarding logging: that only holds for output that is written to the terminal. There are lots of software out there that never log to the terminal and log _only_ to syslog.

As for all the other stuff: it is up to debate whether they should be handled inside or outside the container. The right solution probably varies in a case- by-case basis. Baseimage-docker's point is not to tell that everyone _must_ do things the way it does. It's to provide a good and useful default, for the people who have no idea that these issues exist. If you are aware of these issues and you think that it makes sense to do things in another way, go ahead.

<comment><USER5> > Consider an app that daemonizes by double forking. Double forking a common > technique with the intention of making the process become adopted by init.

But that's daemonization - if you don't daemonize (because your container is itself a daemon) you won't need it.

Ack re: syslog. The stuff I'm writing now uses stdout, and I let systemd do the work. If I had some proprietary app that needed a local syslog then I'd run that in the container. But I'd more likely ask the vendor if I could just disable the syslog requirement and either get stdout or journald for things like multiple field support etc.

The reason I'm writing is because the post gives the impression that everyone is likely to be 'doing it wrong'. There are definitely some things to consider, but I don't think that impression is accurate.

<comment><USER3> Correct, but how do you know your app never spawns anything that may daemonize? If you wrote your app yourself and know all your dependencies and how everything behave, then fine. But what if you're simply packaging someone elses app? What if you're building a database server container? Have you read every single source line to be sure that it will never behave that way and leave behind zombie processes?

 _That_ is what baseimage-docker is about. It's about providing a sane, safe default that behaves correctly. There are also other ways to make your system behave correctly of course.

As for "giving the impression that everything else is wrong": that is not the intent of the article. The title is only to catch the reader's attention and to encourage the reader to continue reading and to understand the edge cases. The title says other things MIGHT be wrong, it does not say that they ARE wrong. So let me make it clear: any solution which solves the edge cases and issues described in the article, is correctly. Baseimage-docker is _one_ solution, the one provided by us. It is not the only possible solution.

<comment><USER5> Good point and accepted re : database example.

</comment></comment></comment></comment></comment><comment><USER6> I've only been working with Docker for a couple of months, and I find this discussion really interesting. The goal of trying to get containers to behave more like a full system across various lifecycle events is somewhat orthogonal to my own aims, which have been to get my containers as close to stateless as I can.

Like some other posters here I view containers less as a lightweight VM, and more as a process sandbox. In the context of a scalable architecture I would like a container to represent a single abstract component, which can be spun up (perhaps in response to autoscaling events), grabs its config, connects to the appropriate resources, streams its logs/events out to sinks, reads and writes files from external volumes, and runs until it faults or you shut it down.

Ideally there would be nothing inside the container at shutdown that you care about. After shutdown the container, and potentially the instance it was running on, disappear. Spinning up another one is a matter of launching a new container from a reference image.

So far, in cases where I have needed daemons running in the container, I have pointed my CMD at a launch script that starts the appropriate services, and then launches the application components, typically using supervisord. That has worked fine, but I admit to not understanding the PID1 issue well-enough up to this point.

<comment><USER3> Baseimage-docker does not imply that your container becomes stateful. Using services like cron and SSH do not imply statefulness.

I also think that the container should be as stateless as possible. When state is necessary, it can be saved at a bind mounted directory.

The point of baseimage-docker is to ensure that the system works _correctly_. See its description about the role of PID 1. It has got nothing to do with the statefulness discussion.

<comment><USER6> Agreed, and a fair point. Statefulness is not a consequence of using Baseimage-docker, and I didn't mean to suggest it was. A clearer way to put it is perhaps to say that aiming for a container that is as simple and stateless as possible makes the "problems" outlined in the OP seem less compelling to me.

Take the syslog example. If I am starting processes that log to syslog, and I want syslog running because I care about those messages, then I should be taking steps to ship those messages out of the container, otherwise I am creating state that has to be preserved across system lifecycle events to be of any use. If I am pursuing a stateless container then I will not be blindly running things that create state without deciding how to handle it. Along those lines if you are pursuing this kind of design you want to have a good handle on everything that's running, and what state it produces. I don't know everything that's running and producing output in a full Linux installation. I'm sure I could figure it out, but it seems to me that Docker's minimalistic approach makes it easier to draw lines around this stuff.

The OP implied that you could design what looks like a solid container and that it might yet be broken in ways that aren't obvious. I'm very eager to know if that's really the case, as I am considering deploying some production components using the tool.

So far the system services argument doesn't seem very compelling to me. I haven't run into any issues launching services from scripts at container start. Examples would be logstash, redis, supervisord, etc. It could be very convenient to have an image already configured with a proper init system, but I am not sure that it is fixing anything that is broken.

I don't have enough experience to get deeply into the PID1 issue. All I can say is that I haven't run into any problems . I can't say, for example, whether everything is shutting down cleanly in all cases, but the way I build my containers I don't care that much. Unless I go back in for specific diagnostic reasons a container only gets started once.

<comment><USER3> Correct, fully agreed with what you said about syslog. But that's not the problem that baseimage-docker is trying to solve. Suppose that you're building a Docker container, and something fails. Nothing on stdout and stderr. You decide to look in /var/log/syslog, but nothing there too. You scratch your head. If only you knew that /var/log/syslog only works if the syslog daemon is running. _That_ sort of thing is what baseimage-docker solves. Whether you want to ship logs outside the container, that's up to you.

Right now I am building a web app in a Docker container. The web app is written in Rails, hosted by Nginx and Phusion Passenger. To make setup as easy as possible for users, the container also contains PostgreSQL. I run Nginx+Passenger and PostgreSQL at the same time by hooking them both on runit. The init system in baseimage-docker ensures that a 'docker stop' properly shuts down both Nginx and PostgreSQL.

</comment></comment></comment></comment><comment> josh-wrale Cross-distro support notwithstanding, why not just skip Docker, LXC and VMs. Instead, use cgroups on bare-metal to make processes behave. On that note, forget bridging, use SR-IOV virtual functions with VLANs for QoS and _Profit_.

Edit: It seems this comment has been voted down. I think perhaps this is seen as irrelevant, but I would disagree, because Docker uses LXC and masks its function in much the same way as LXC uses cgroups and masks their function. cgroups can be used to achieve similar goals without these many layers of abstraction. In this way, I believe this comment to be relevant to the discussion of full vs. application containers on Linux. There are certainly many reasons for using containers, but one of the leading reasons is process limits (e.g. RAM, network namespace). Limiting process usage of those resources, using only cgroups, is quite easy in comparison to all Phusion has gone through here to something with similar (though admittedly different) aims. Example: [http://www.andrewklau.com//controlling-glusterfsd-cpu- outbre...](http://www.andrewklau.com//controlling-glusterfsd-cpu-outbreaks- with-cgroups/)

Edit 2: I would also appreciate constructive criticism. That is, I've been downvoted without useful feedback. Specific feedback as to what is wrong with my comment would enable me to contribute more constructively to this discussion. Without such feedback, I believe the downvote can be seen as a simple and tribal "go away".

<comment><USER7> Constructive criticism, about how this sounds: it isn't clear that what you propose is actually more valuable than using Docker. It sounds like it's complex and requires a lot of manual intervention. It doesn't sound like your alternative covers Docker's use cases.

Your idea may need to be more fleshed out, but at a minimum it needs to be explained in a way that makes it clear why most users of Docker would see a significant benefit to use your approach instead.

</comment></comment><comment><USER8> You really should not run ssh in your containers. If you have a ton of containers then key management and security updates of SSH will be a pain. There are two tools that can easily help out:

\- nsenter lets you pick and chose what namespaces you enter. Say the host OS has tcpdump but your container doesn't. Then you can use nsenter to enter the network namespace but not the mount namespace: sudo nsenter -t 772 -n tcpdump -i lo

\- lxc-attach will let you run a command inside of an existing container. This is lxc specific I believe and probably not a great long term solution. But, most people have it installed.

</comment><comment><USER9> I disagree with the premise that using Docker to run individual processes is "wrong". Phusion is doing a disservice by suggesting as such. There ARE use- cases where such a base-image is useful, but I believe these should be the uncommon case, not the common one. Even yet, if running multiple processes in a container is needed, it's preferable to use Docker-in-Docker.

I suppose part of the problem is the two benefits of Docker and containerization are frequently confused. Docker provides portability and build bundling, but ALSO provide loose process isolation. You should want to take advantage of that process isolation and by doing so, should want to run SSH or cron in their own containers, not in a single container with your application process. If your application has multiple processes, each should have their own containers. These containers can be linked and share volumes, devices, namespaces, etc. Granted, some of the functionality one might desire for this model is still missing or in development, but much of it is there already and that's the model I aspire Docker to follow.

It might also be to some degree a matter of legacy versus green-field applications. For instance, I've been deploying OpenStack's 'devstack' developer environment (which forks dozens of binaries) inside of a single Docker container. In this case, the Phusion base-image might make sense. However, the proper way of using Docker would be to run dozens of containers, each running a single service.

The reason I don't do this is because the OpenStack development/testing tools provide this forking and enforce this model, using 'screen' as a pseudo-init process. From the Docker perspective, this is a legacy application. I could and probably will change those development tools to create multiple containers, but until then, it's easiest to stick to a single container.

<comment><USER10>
        I disagree with the premise that using Docker to run individual processes is "wrong". Phusion is doing a disservice by suggesting as such.

This is not the premise of the article. The premise is that someone goes 'from ubuntu; apt-get install memcache; cmd ["memcached"]' and thinks everything is going to be alright, when in reality they've just set up a rather buggy system.

If you're absolutely certain your app is going to be fine running as the sole (PID1) process in the container, then this article has no problem with that. It just says that if you're going to run something you've got from apt-get, then chances are, your system is going to have to be a little more like a Debian system.

</comment></comment><comment><USER4> It will work but things are addressed on the wrong level in my opinion.

syslog: each container now has it's own logs to handle. If you want them to be persistent/forwarded it might be better if all containers could share the /dev/log device of the host (not sure of the implications though).

ssh: lxc-attach. Docker should expose that.

zombies: it's a bug in the program to not wait(1) on child processes.

cron: make a separate container that runs cron.

init crashes: bug in the program again. it's possible to use the hosts's init system to restart a container if necessary.

<comment><USER3> lxc-attach: see [https://news.ycombinator.com/item?id=7258242](https://news.ycombinator.com/item?id=7258242) about why I think SSH is more appropriate.

Zombies: this is not about child processes created by the program. It's about child processes created by child processes! For example what if your app spawns another app that daemonizes by double forking? Your PID 1 _has_ to reap all _adopted_ child processes, not just the ones it spawned.

<comment><USER4> Then it's a bug in the child process. Turtles all the way down. Also, double- forking is a hack that should burn in hell.

EDIT to the reply below: It's still a design issue but I agree that it's not always practical to change existing software. A small PID1 wrapper that reaps zombie processes and execs the target program would be a good middle-ground.

<comment><USER3> It's not. Most apps rightfully expect that they're _not_ PID 1, and that the real PID 1 takes care of that sort of stuff. Only in a container does it happen often that your totally-not-designed-to-be-a-PID-1 app, actually is PID 1.

What if you're creating a PostgreSQL container, and your init script spawns a daemon, after which it exec()s the PostgreSQL server process as PID 1? The daemon then spawns a few processes that fork a few times. PostgreSQL only waitpid()s on its own postmaster worker processes and so those other processes become zombies. Are you telling me that PostgreSQL is broken and that you have to patch PostgreSQL?

I think using a proper init system, and running PostgreSQL under it, is a much saner view on things. The small wrapper that you mentioned is exactly the /sbin/my_init provided by baseimage-docker.

</comment></comment></comment></comment><comment><USER11> It may be a matter of opinion but advocating to run cron, sshd, and so on in your containers, let alone in every single one by providing a base image to do that seems plain wrong.

Let's take an example. You have Nginx, a web app, and a database. You can put everything in the same container or not. If you choose to put everything in different containers, you will be able to use tools at the Docker level to manage them (e.g. replace one of those processes).

And the fundamental idea is that we expect to have plenty of Docker images around that you can pick and play with, and those Docker-level tools will be able to manage all those things.

Now if you put everything in the same container, you're back to square one, reinventing the tools to manage those individual process. You can say that you don't need to re-invent anything, because you're used to full-fledged operating systems. Still, if you have a nice story to deploy containers on multiple hosts, to send logs across those hosts, and so on, the road will be more straightfoward when you decide to use multiple hosts.

This is about uniformity. I want processes (and containers around them), and hosts, that's it. I don't want additional levels. I don't want processes, arbitrarily grouped inside some VMs (or containers), and hosts. Two levels instead of three.

<comment><USER3> Right, cron and sshd are open for debate, but at the very least you have to make your PID 1 behave correctly by reaping adopted child processes. That is a major part of baseimage-docker.

Baseimage-docker is not advocating putting everything in the same container. It's advocating putting all the _necessary, low-level services_ in the same container. What if your app happens to use a library that needs to schedule things to run periodically using cron? To me it doesn't make sense to split that cron job to another container. The app might physically consist of multiple processes and components, but I think it should logically behave as a single unit.

For stuff like Nginx and the database, it's not so clear what is the right thing to do. It depends your use case. I don't think that putting those major services in the same container is always correct (though it might be), but I also don't think that splitting them out to Docker containers is always the right thing to do.

You say that that putting stuff in the same container puts us back to square one. I think splitting them puts us back to square one. Your base OS _already_ runs all your processes as single units. You have to worry about each one of them separately, resulting in lots of moving parts that all increase deployment complexity. The beauty of Docker should be that you can group things. If you don't group things then why would you be using Docker? You might as well apt-get install your app and have it run as a normal daemon.

One use case where it really really makes sense to put everything in the same container: when distributing an app to end users who have little to no system administration knowledge. For example, what if you want to distribute the Discourse forum software? It depends on Rails, Nginx and PostgreSQL. Users are already having a lot of trouble installing Ruby, running 'bundle install', setting up Nginx and setting up PostgreSQL. Imagine if they can just 'docker run discourse' and it immediately listens on port 80, or whatever port they prefer, with the database and everything already taken care of for them.

<comment><USER11> I guess we both understand things well enough to know that limits to draw are not rigid. That being said, here is my take on what you say.

An app should logically behave as a single unit. I would say that's true, and that unit is a cluster of containers. Docker is not yet ready as a tool to manage clusters of containers, but I believe it will. In the meantime tools like Fig or Gaudi are exploring the design space.

You say that having everything separate is back to square one, because you have to manage things separately. My opinion is to develop tools to manage cluster of containers, not to cram things to fit in a single one (I'm not being harsh, sorry if it sounds like). If you use Docker to group things (at the container level, instead of at the cluster of containers level), what should we do if I want to share something with you (a program) ? I can be nice and provide a Dockerfile, but you would still have to put it in your existing "logical single unit", thus loosing the benefits of, e.g. dependencies isolation.

The distribution case for enduser is a good one, where the limits will depend on what you really want. For instance if you don't expect people to expand your app by adding additional processes, why not. But I think it is still a workaround for the cluster-level tool I keep talking about.

I am using Docker to create a cluster of containers (for [https://reesd.com](https://reesd.com)). Since the infamous cluster-level tool of my dream doesn't exist yet, I'm still relying on Bash scripts (because I feel like exploring my possibilities and don't want to start writing a solidified tool). The script is pretty simple: a bunch of `docker run -d`, saving containers IDs and IPs around (this could be replaced by `docker inspect` and such).

Well that script is done so it can be run next to itself multiple times. So I can have multiple instances of the whole Reesd service on my laptop. To deploy it, I run the same script, possibly next to the live one. I have additional scripts to e.g. replace one specific container (say, the web app). So really when talking about uniformity, I want to be able to run Reesd on my laptop, or on multiple machines, and possibly side-by-side, using the same Docker features.

A possibility that I haven't tried regarding your last paragraph is the docker-in-docker feature.

<comment><USER3> Very interesting viewpoint. Yes, if Docker performs cluster management right then that would change a lot of things. I see that the CoreOS guys released Fleet today, possibly in response to this article. I'll have a look at this later. [https://news.ycombinator.com/item?id=7260596](https://news.ycombinator.com/item?id=7260596)

</comment></comment></comment></comment><comment><USER12> Why not just use

CMD ["/sbin/init"]

And start your app through an init.rd script?

The article says "upstart" is designed to be run on real hardware and not a virtualised system. If that is true, then perhaps there is value in baseimage- docker, but details are lacking.

<comment><USER3> So why don't you try it and see whether it works?

One of the things /sbin/init does is checking and mounting your filesystems. But you can't do that in an unprivileged Docker container because you don't have direct hardware access. This is only one example of where things go wrong. The entire init process is _full_ of these kinds of code where it is assumed that there is direct hardware access.

Even when your container is started with -privileged, you still can't do that. The host OS is already controlling the hardware.

Also, /sbin/init usually does not like having SIGTERM sent to it, which is what 'docker stop' does. Depending on the implementation, /sbin/init either terminates uncleanly (causing the entire container to be killed uncleanly) or ignores the signal outright (causing the 'docker stop' timeout to kick in, also causing the container to be killed uncleanly).

<comment><USER8> It depends on the init system, however.

systemd makes an effort to ensure that running /sbin/init inside of a container works and can be detected by the software and services underneath it[1]. In general this means that if you take a copy of Arch or Fedora and try to run it inside of a container it works properly without any hacks.

For your own services you can also start to do the right things by using the virtualization detection code[2] that is built in. The most immediately useful one being: ConditionVirtualization=container and !container. With these directives you can tell your services to run or not run depending on whether you are in a container or on real hardware.

[1]: [http://www.freedesktop.org/wiki/Software/systemd/ContainerIn...](http://www.freedesktop.org/wiki/Software/systemd/ContainerInterface/) [2] [http://www.freedesktop.org/software/systemd/man/systemd.unit...](http://www.freedesktop.org/software/systemd/man/systemd.unit.html#ConditionPathExists=)

<comment><USER13> ConditionVirtualization=container seems like a "with great power comes great ability to screw up in subtle and horrible ways" sort of feature, wherein when you need it, you really need it, but most of the time, a different approach will be vastly preferable.

<comment><USER8> Absolutely. This was in the context of the parent talking about doing things without certain privileges or skipping unnecessary steps.

</comment></comment></comment></comment></comment><comment><USER14> Docker is a container for running processes, or a process. Containers should be disposable and transient. I have begun to think of it in terms similar to OOP. Images are your Classes. Containers are your class Instances. When you are done with an instance, you discard it and make a new instance. So don't go shoving all kinds of crap into the instance like crons and sshd that don't belong there. Most devs don't expect to have their code be free of memory leaks when it comes to interpreted languages. And docker containers don't need to worry about child processes being stopped - they should just be disposed of and you make a new container from your image. Keeping containers around would be like trying to pickle a python class instance perpetually that has references to who knows what... Just make a new instance when you need it. And just make a new container when you need one. I use named containers and a Makefile that stops and deletes existing containers with the same name before starting a new one.

<comment><USER3> To me, that does not make any sense. Your _program executable_ is already like a Class. A normal _process_ is already like instances of your classes. If all you want is OOP, then why are you using Docker? Your Unix system has been doing that for 30+ years!

<comment><USER14> The benefits of me that docker brings is the ability to share containers with my team and to deploy those same containers to the server. The reason that I started thinking of it in terms of programming, like OOP, was to help me get my head around how to correctly use docker on a server. As I start to understand docker, finding the correct place for configuration, data, crons, debugging, and execution are all important and the closest paradigm that I can easily apply to it is OOP, even though it is not a perfect match. OOP can also help visualize how one image can inherit from another image and override both methods and configuration of that image so that instances will behave in a different manner.

</comment></comment></comment><comment><USER15> I think there's a lot of assumptions made, and there are a lot of assumptions made about your base image.

The Ubuntu base image (or how it's built) can be found [https://github.com/tianon/docker-brew- ubuntu](https://github.com/tianon/docker-brew-ubuntu)

Some excellent examples of how to use them with /sbin/init can be found [https://github.com/tianon/dockerfiles/tree/master/sbin- init/...](https://github.com/tianon/dockerfiles/tree/master/sbin- init/ubuntu/upstart)

Not everyone who uses Docker uses CRON, nor considers them long-term containers; rather short term process containers.

Docker is growing and how we use docker will change so be flexible and realize what you considered useful yesterday may not be required tomorrow. We will have to re-learn best practices and keep learning after that.

Note, the Ubuntu image isn't made by Ubuntu. Maybe Phusion should host their own Ubuntu image just for sakes of sakes.

</comment><comment><USER16> Is there a "explain Docker to me like I'm 5" post?

This seems like the old "I have problems with managing everything I need for my app so I'll just run docker containers. Now I have 2 problems"

<comment><USER10> The Linux kernel has some features that make it possible to isolate a process from all (most) system resources, without actually running it inside a VM.

Docker is a tool that makes it easy to launch such isolated processes. You just specify what the filesystem environment should be for the new process, and what process to run in a small file and off it goes.

In theory this could make provisioning easier, having each application come in a Docker container that satisfies its own system level dependencies, and does its service level dependencies over connections to other containers/external hosts.

</comment></comment><comment><USER17> So if you run anything other than Ubuntu inside Docker, this is useless because the steps to build your own aren't outlined.

I find Docker to be horribly counter-intuitive and ass-backwards anyway, so not much harm done there as people are in general better off with something else entirely (plain lxc, libvirt, virtualbox, xen, openvz...). I recommend to steer away from it at least until 1.0 is out.

EDIT: I put it in my .plan to build a better BusyBox image aimed at running statically compiled programs with minimal baggage, but I'm not sure when I'll get a round tuit*

*: [http://i.ebayimg.com/00/s/NDgwWDY0MA==/z/z-4AAOxyUrZSr82N/$_...](http://i.ebayimg.com/00/s/NDgwWDY0MA==/z/z-4AAOxyUrZSr82N/$_12.JPG)

<comment><USER3> Why do you think it isn't outlined? The website explains exactly what the modifications are, what they do, and what they are good for. The Dockerfile is on Github for everyone to see. The website makes explicit mention that the init system is /sbin/my_init, for which the full source is available on Github. It's trivial to take the my_init script and integrate it into your non-Ubuntu container. You can even write your own init system based on the website description if you so choose.

</comment></comment><comment><USER18> I think it is not related to Docker itself, but to the fact the it is using all purpose Linux distributions. I'm pretty sure that very soon we will see explosion on new distros addressing exactly these problem and built explicitly for running inside containers.

<comment><USER19> I used to think that that was what CoreOS was, but I have since become confused.

<comment><USER20> CoresOS is designed to host containers, not be a base container image.

</comment></comment></comment><comment><USER21> How does this play with the CoreOS premise where each docker should be hosting a single process managed intelligently through something like systemd?

Under this model I'd expect that systemd's pgroup support should help with zombie processes and generally take over many of the services that baseimage- docker is suggesting here. As other have mentioned in this thread, there's a fairly large difference of opinion between running containers like fast VMs or like thin layers around single processes—does baseimage-docker make sense only in the latter?

<comment><USER10> baseimage-docker is meant to make it easier to make a correct environment for the processes you run in it, so perhaps make it be more like a fast VM.

From what we've seen the CoreOS people and perhaps the Docker people as well like to see Docker more as a thin layer around processes, being managed by external services.

</comment></comment><comment><USER22> Off-topic, but I'd thought I'd screwed up my DNS for a moment and this article redirected to the silly side-project I've been working on: ipaidthemost.com.

I guess we borrowed the same template?

</comment><comment><USER19> I'm pretty suspicious of using runit instead of Upstart- nobody tests Ubuntu with runit, and you're liable to get in trouble if you depend on some other service running on the machine. Although clearly it works well enough for them.

I also sort of suspect that the closer you are to running a full distribution in your containers, the less benefit you're getting from the containers.

<comment><USER3> Baseimage-docker uses runit exactly to _not_ run a full distribution in the container. Upstart tries to boot a full Ubuntu. A full Ubuntu is not necessary inside the container. Therefore, baseimage-docker provides a custom init system that boots only the minimal subset of Ubuntu that is necessary for it to run correctly in Docker.

</comment></comment><comment><USER23> I was super stoked to read this, and went diving to borrow some of their work for my own Docker usage. However, I'm confused by their choice of Python for the my_init script. The site claims they chose runit because it is more lightweight than supervisord, a Python tool of similar merit. Making the init process depend on Python seems to negate that advantage.

<comment><USER3> It's not only Python that makes supervisord relatively heavy compared to runit. It's also the amount of code in supervisord (and its dependencies). my_init is only a single file, less than 300 lines, with minimal dependencies.

Baseimage-docker is also in a "minimal viable product" phase. We're still trying to tweak things until they're right. For example my_init recently received some features which are important in certain use cases; features which would have been much lower to implement in C.

In the future we may optimize things by rewriting my_init in C. Right now it's laziness on our part.

<comment><USER23> Based on the points raised in your article, I ended up poking my own Docker images to get runit working on them. It looks like runit is A) pretty snazzy, and B) capable of being the init daemon. Am I missing some trade-off or issue there, that prevents it from being PID1 in your scenario?

<comment><USER3> Yes. Runit does not correctly reap adopted child processes, which is why we run runit under my_init. My_init (or an alternative that behaves like my_init) is absolutely necessary for correct operation.

</comment></comment></comment></comment><comment><USER24> They just described implementing an OpenVZ VM.

</comment><comment><USER25> "Note that the shell script must run the daemon without letting it daemonize/fork it. Usually, daemons provide a command line flag or a config file option for that."

fghack is an anti-backgrounding tool. [http://cr.yp.to/daemontools/fghack.html](http://cr.yp.to/daemontools/fghack.html)

</comment><comment><USER26> I've been trying to get some tools to run in a docker for a few days now. So far the problems have been that there isn't a convincing HOME folder and user, and that the locale isn't set (only explodes if there are unicode filenames, but there are plenty of those e.g. for SSL certs).

Does this script sort out those kind of things?

<comment><USER3> No, you have to take care of environment variables yourself. Unfortunately, Docker does not inherit environment variables from the base image, so in every Dockerfile you have to ensure that the right environment variables are set.

<comment><USER27> That's not "unfortunate" \-- it is by design. You use containers to minimize dependencies on the host.

<comment><USER3> What does minimizing dependencies on the host have anything to do with not inheriting environment variables from the base image?

Note: I'm not talking about inheriting environment variables from the _host_!

</comment></comment></comment></comment><comment><USER28> I don't understand the PID1 case. You are running a single process, why do you have to collect zombies?

In fact, I understand none of these points. This seems all very hard to relate to. These are containers and not VMs. Most of that stuff should run in a separate container.

<comment><USER3> Your single process might spawn child processes that double fork, resulting in zombies. Unless you've read every source code single line in the app, plus every single source code line in all its dependencies (and all dependencies of all dependencies), you really can't be sure that that _won 't_ happen. And when it does happen, your system is not behaving correctly.

And what if your single process spawns a child process that encounters an error, and logs only to syslog? If your syslog daemon is not running, you will never know that there has been an error. Again, if you've read every single line and know that this does not happen, then that's fine. But the point of baseimage-docker is to provide a good and safe default so that these edge cases are already taken care of for you.

</comment></comment><comment><USER29> just use the ubuntu-upstart stackbrew image.. compatible with all the packages etc..</comment>


Show HN: Tmuxomatic – An intuitive and flexible session manager for tmux - <AUTHOR> https://github.com/oxidane/tmuxomatic

<comment><USER2> This is interesting, although I'll echo the request of YAML.

A neat idea to add to this is using wildcards. For instance, rather than having to write

        AAAAABBCCCCCDDDD

you could write

        A*BBC*DDDD

or even

        A*B2C*D4

where A and C will fill in evenly with each other with whatever room is left over. This would probably work best if you defined how many rows/columns you're using ahead of time, so that each row could take advantage of it.

Going this way, you could have a nice little Python script to check your config, and send a warning message that "this config will output 5 panes, etc etc", or "this config does not have enough sections on row 3".

As it is, some of the current sample configs look daunting. You'd have to check your text editor, or manually count each letter to get an idea for how big a particular pain will be.

Other than that, it looks like an interesting idea. But I'm guessing ease of use is a major selling feature for this. So making it even easier to use would definitely help promote it.

<comment><AUTHOR> What you suggest will fast become confusing and difficult to follow. It's better to keep layouts in an immediately recognizable form. Also, I've built in a flexible window scaling feature to assist with fine tuning layouts. For example if you create "123", and want to change the "3" into a 2x2 grid, instead of copying lines or retyping the layout, you could just "\--scale 1 2x 2x --scale-replace" (assuming window 1), then edit the session file and fill in the details. It also has the ability to down scale. Play around with it and you'll see how helpful it is. Once you get the hang of designing layouts, you may find most general use layouts can be typed up pretty fast.

As mentioned in another comment, there will be support for YAML in version 1.1. I don't know how soon that will be, since I am working on another project right now, but keep an eye on tmuxomatic, it should be soon. Thanks for the feedback!

</comment></comment><comment><USER3> Related, tmuxinator, [https://github.com/tmuxinator/tmuxinator](https://github.com/tmuxinator/tmuxinator).

<comment><USER4> I've got 3 hours into wrestling with Ruby versions (1.7 vs newer) and xcode (command line tools),trying to get tmuxinator to work on my Mountain Lion system.

Just tried tmuxomatic - worked in 15 seconds.

<comment><USER5> I'm not surprised since managing ruby versions doesn't always go perfectly. I've been using tmuxinator for a while and been very happy. Didn't have any issues installing on OS X/Ubuntu.

Do mention how you like tmuxomatic vs tmuxinator once you get settled in.

<comment><USER4> I will - I really like the tmuxinator framework, and I'm determined to get it working... A lot of the use cases regarding setting up different environments in tmuxinator is exactly what I've been looking for - will probably save me 4-5 minutes two-three times a day.

</comment></comment></comment></comment><comment><USER6> Cool tool but I prefer teamocil since its configurations are stored as yaml instead of a custom format.

[https://github.com/remiprev/teamocil](https://github.com/remiprev/teamocil)

<comment><AUTHOR> I don't think YAML is good way to configure a tmux session. But it's popular, and simple to implement, so I may add it. I'll consider it in the next version.

<comment><USER6> Any reason why you think this? YAML seems like a more intuitive choice for describing the session/window/pane hierarchy IMO. Your "visual" notation does seem useful, but I'm not so sure if the benefits merit taking on a new configuration format in my tools layer.

I'll give it a fair shot though :).

<comment><AUTHOR> I'm all for standard file formats where they serve a purpose, but they don't really fit here. The point of tmuxomatic was to completely break away from the structure imposed by tmuxinator, tmuxp, and fundamentally tmux, and deliver something so simple and automated that tmux becomes almost transparent. Where any user, expert or novice, is able to create complex arrangements of practically any conceivable layout so intuitively that documentation is unnecessary.

However, if you prefer to do your editing in an IDE or graphical editor, a known file format is easier to deal with, and syntax highlighting is nice.

I'll add YAML support in version 1.1.

</comment></comment></comment></comment><comment><USER7> Nice concept, but the configs still look write-only to me.

Here's my two cents: [https://bitbucket.org/zserge/mucks](https://bitbucket.org/zserge/mucks)

Much-much simpler, and definitely less intuitive, but supports screen and dvtm as well: [http://zserge.com/blog/mucks2.html](http://zserge.com/blog/mucks2.html)

<comment><AUTHOR> I don't see how mucks is simpler at all, except maybe for single pane layouts.

Not sure what you mean by "write-only" in this context.

</comment></comment><comment><USER8> The ASCII art layout description it pretty cute. Not sure if the most ergonomic but still appreciated.

<comment><AUTHOR> I'm not sure it's possible to be more ergonomic while retaining the flexibility that tmuxomatic text-as-layout has to offer. Not with a keyboard anyway.

The next step in tmux usability may be to intercept mouse-as-cursor messages (assuming these exist) and allow a user with a touchscreen to literally draw out the windows. Or some kind of English interface where you verbally describe the window layout. Either one could leverage tmuxomatic for the pane layouts. Both of these are on the tmuxomatic todo list, but there are other projects I'd rather work on.

<comment><USER8> Yeah you're right it might be the less cumbersome input format.</comment></comment></comment>


Bashisms – a note on creating portable shell scripts - <AUTHOR> http://blog.goosoftware.co.uk/2012/05/03/bashisms-a-note-on-creating-portable-shell-scripts/ <comment><USER2> Agree about 75%, in the context of distributing a script.

However, for private use, and sometimes even for distributing a script, taking advantage of a particular shell's _isms_ is merely taking advantage of your tools.

The article author's shebang could easily have required bash rather than sh, and it would have been 99% as portable as a vanilla sh script, as bash is almost everywhere.

Distributed python scripts won't run in perl.</comment>


Native iOS 7 Styling with CSS - Pixate 2.0 Released - <AUTHOR> http://www.pixate.com/blog/2013-11-06-2-0-final/index.html <comment><USER2> Hi Pixate, looking just at your homepage, I had a hard time understanding what your product does. However, your kickstarter video is awesome [http://www.kickstarter.com/projects/pixate/beautiful- native-...](http://www.kickstarter.com/projects/pixate/beautiful-native- mobile-apps?ref=live)

You should have something similar on your main home page.

</comment><comment><USER3> Is it just me or do none of the intro pages explain what Pixate actually is?

I see the terms UI framework and CSS, so I think Bootstrap. But then I see developer API and engine so I think Sencha Touch.

</comment><comment><USER4> NUI is similar and OSS: [https://github.com/tombenner/nui](https://github.com/tombenner/nui)

OT but does anyone have any idea how much work it would be to port NUI or similar to Objective-J/Cappuccino? I really want to use Cap, but it's not designer friendly to theme and the default theme is looking a bit long in the tooth.

</comment><comment><USER5> Wow, I had a hard time figuring out what it does, even after clicking through 9 pages (still quite don't know).

</comment><comment><USER6> I'm really curious about this but I can't find any examples on the website.

Even in the documentation section, the Getting Started and Styling Reference both 404.

<comment><USER7> This is about style apps using CSS:

[http://www.pixate.com/docs/framework/ios/2.0/style- reference...](http://www.pixate.com/docs/framework/ios/2.0/style-reference/)

Similar to NUI [https://github.com/tombenner/nui](https://github.com/tombenner/nui)

I'm using it. Easier than UIAppearance, but still need some improvements in handling UICollection (it lags). However, overall is good.

</comment></comment><comment><USER8> I've used Pixate a lot in my last app (client work), and I have mixed feelings. In general I love the idea (I'm a Kickstarter backer) but I had lots of small issues and found the documentation quite lacking. I don't have particular examples right off the bat, but I distinctly remember that I had issues getting gradients working correctly, and that borders did only work for all sides at the same time, while the documentation clearly has border-left, border-right, etc. But just setting one or two of these doesn't do anything. These may have been bugs in prior beta releases, but there was no documentation on this whatsoever.

There's also a help forum where people can ask questions and people reply on it. I could not figure out to actually _read_ the answers. you can only read parts of it if you search the answers. I may be really stupid here, but I found nothing I could click that would open the thread and show me the answers to the questions. I may be really dumb here, but I just gave up. NEVERMIND: I tried again, it is working now. Maybe it just wasn't working when I tried it, sigh.

<comment><USER9> Their forums definitely need help. I'm sure their plan was to make it good and I don't know if it's Zendesk or the way they implemented Zendesk, but it's not a fluid process.

</comment></comment><comment><USER10> Cool idea! There's ton of broken links on the website tho.

[http://www.pixate.com/docs/framework/ios/2.0/getting- started...](http://www.pixate.com/docs/framework/ios/2.0/getting-started/) Half of the links in the bottom are broken.

Is there any performance considerations to considerate when using Pixate? How fast is the CSS parsing and rendering?

</comment><comment><USER9> This framework is excellent. I used it to style my iOS7 game[1] and it's hard to even go back to native styling. I'm compiling all of my CSS via LESS and then using the CSS as embedded themes.

[1] - [http://appstore.com/xo9](http://appstore.com/xo9)

</comment><comment><USER11> Just to clear things: Pixate is a native framework (iOS, and Android coming soon) which let you style your application using CSS. Their ability to execute is awesome and they're moving at the speed of light. And with Titanium SDK support.

</comment><comment><USER12> After reading the buzzword heavy and (intentionally?) confusing site, I'm reminded of the parody Color pitch deck:

[https://news.ycombinator.com/item?id=2364128](https://news.ycombinator.com/item?id=2364128)

</comment><comment><USER13> What kind of CSS framework doesn't have a live demo on the site?

I have to download it to find out what it looks like, how it performs, and how it's written?

<comment><USER14> It seems it's not actually a CSS framework (was personally excited about the prospect of an iOS7 CSS kit), it allows you to use css to style your iphone app.

</comment></comment><comment><USER15> Lots of people are confused about this. You guys should have some css app layouts on your front page, along with photos of them on a phone.

</comment><comment><USER16> So the trend now looks to be webifying the appification of the web.

</comment><comment><USER17> Another cross-platform UI toolkit. Which using CSS.</comment>


Enhancing the Placebo - <AUTHOR> http://opinionator.blogs.nytimes.com/2010/05/03/enhancing-the-placebo/?hp <comment><USER2> But see

<http://www.sciencebasedmedicine.org/?p=4304></comment>


Microsoft, Apple and Others Withdrawal Support for SOPA - <AUTHOR> http://informationweek.com/news/government/policy/232200069 <comment><USER2> Can anyone on the inside explain how this kind of thing works?

This is my thinking:

These companies belong to different trade groups. They pay their dues, contribute opinions on different things, but mostly leave these groups alone and go on doing their actual business.

Meanwhile, the trade groups advance their own agenda, given a mostly free hand by their constituency, which again, has better things to do. The group doesn't actually do all that much that's useful, otherwise their staff would be working for real companies. But they shuffle papers around, undertake activities like, say, harass small businesses about software licenses, and generally look like they have a reason for being.

Then, occasionally, these groups will step in dogshit and have to field a bunch of phone calls basically saying "Why the fuck am I paying you dues in exchange for this bad press? Make it go away."

And then the offending group needs to walk back the cat as happened in this blog post.

Plausible? Is that how this works? The explanation with the most incompetence involved seems most likely to me.

<comment><USER3> I don't think we need to dig into specific technicalities of this, especially with our limited knowledge of the hidden, behind-the-curtain power structures. This law was specifically designed to create an internet weapon of suppression of the unwanted. Apple could have use this to suppress jail breaking. Microsoft could use this to suppress Linux. Lobbyists could use this to suppress the Occupy movement. The powers that be as such could use this to destroy the power internet gives to people, first time in history. However for some reason, they have miscalculated - they did not expect this kind of organization, backlash and opposition. Now they are just trying to distance themselves to save what's left of their images.

The reason why they miscalculated is a mystery to me, perhaps they have realized they have let this "internet" thing go way too far, they cannot control it anymore using controlled disinformation techniques, and this was one of their last attempts to stop this trend.

Yes, it's really that bad out there. But it's getting better.

<comment><USER4> Personally, I agree with all of the points you made here, except for the suggestion that we don't need to dig further. The SOPA bill (still) has a lot of potential to enable Internet censorship, and for something that far- reaching I think it's fairly important to be transparent about the various lobbying groups and their aims.

</comment></comment></comment><comment><USER5> I guess the question that gets immediately raised in my mind is: what the heck were these companies doing supporting the damned thing in the first place?

It's like the rats scattering when the light turns on. Is all of corporate America happy to support these egregious pieces of legislation as long as the public doesn't find out?

That last part was mostly rhetorical... _mostly_.

<comment><USER2> As I've said elsewhere, conservation of incompetence seems the likeliest explanation. The companies have better things to do, so no one in charge realizes that they're dues paying members of an organization that's advancing a truly moronic cause.

Until the press gets involved, then things get escalated and straightened back out.

Assuming that's in the neighborhood of truth, it highlights the importance of a press free from government _and_ corporate interference.

<comment><USER6> SOPA is pretty egregious, and it looks like it could get everyone in a lot of trouble given the way someone can merely allege copyright infringement and get a site blacklisted.

Any company with a crucial web presence definitely does not have better things to than stop this bill from being passed.

</comment></comment></comment><comment><USER7> Interesting how fast they distance themselves from SOPA now they know we are paying attention. Won't fool me. I only hope the next SOPA, wich will certainly sound less outrageous, in special when compared to this, is met with equal opposition. SOPA is not commendable. Nor will be its offspring.

</comment><comment><USER8> The word in the title should be "Withdraw", not "Withdrawal"

<comment><USER8> An explanation would be appropriate if you're downvoting.

<comment><USER9> I up-voted you, that was the first thing I noticed when reading the title.

</comment></comment></comment><comment><USER10> I think you mean "Adobe" and not "Apple", since "Apple" is not mentioned anywhere in that article.

<comment><USER11> According to this page ([http://www.bsa.org/country/BSA%20and%20Members/Our%20Members...](http://www.bsa.org/country/BSA%20and%20Members/Our%20Members.aspx)) Apple is a member.

<comment><USER12> Yes, a member but it is not mentioned at all in this article.

yumraj's original point still stands.

</comment></comment></comment><comment><USER12> Wait a second - there is no mention of "Apple" at all in this article (or the one it references).

</comment><comment><USER13> This idea that BSA's view = Microsoft + Apple's view has always been an utterly ridiculous assumption for the press to make. This posting's title is equally ridiculous for directly equating the two. It's infantile and this kind of fact skewing doesn't belong on HN.

BSA acts independently, but on behalf of it's members. BSA have proven themselves to be a bit nutty when it comes to infringement, so it wasn't surprising that they jumped on SOPA initially.

However, as above, it was already a stretch by the press to connect BSA's view point on SOPA to the idea that all BSA members unanimously supported SOPA.

This sudden change of face from BSA indicates that indeed the members have spoken up and they do not agree with SOPA, and that the entire thing was just a load of fuss to generate clicks.

Companies like Microsoft and Apple also have a significant amount at risk by this wayward legislation.

</comment><comment><USER14> "The definitions of who can be the subject of legal actions and what remedies are imposed must be tightened and narrowed."

Glad he pointed out the obvious. (not being sarcastic)

</comment><comment><USER15> This is great news. I think HN and it's members probably helped a lot in making this happen. Give yourselves a pat on the back, you're enacting change!

<comment><USER16> Or at least preventing change that wouldn't have been good. But of course, this thing will be back next year, probably chopped up into little pieces and inserted into other bills.

</comment></comment><comment><USER17> Get it rolling, and then distance yourself safely.

<comment><USER18> That's pretty cynical. If big business is backing out, SOPA is dead. The people don't want it, the politicians don't care either way so long as they get money.

</comment></comment><comment><USER19> This HN title is inaccurate. There's no evidence that Microsoft or Apple actually supported SOPA. Merely an industry association of which they are members, supported it. This association removed its support.

A more appropriate title would be "Business Software Alliance withdraws support for SOPA."

I'm pretty sure most people on HN who know what SOPA is, know who the BSA is, and if not they'd learn it from reading the article.

I don't think its fair to imply that Microsoft or Apple (or any of the other BSA members) supported SOPA, as it seems likely the BSA was engaging in knee jerk support and didn't consult its membership.

I, personally, think the BSA should strongly opposes SOPA because it doesn't represent the interest of its member companies in the long run. But the title given here is just unfair.

<comment><USER5> I'm not saying you're wrong, but why then was the "Business Software Alliance" supporting SOPA in the first place? I don't think "knee-jerk support" covers it. There's a political reason there, surely.

If MS/Apple/whoever didn't like it, why weren't they publicly saying so?

<comment><USER20> Maybe their previous strategy was fully backed by most of their members, maybe some members changed their opinion during the last days, maybe some members were always against their previous strategy, maybe the BSA acted somewhat autonomously until members started waking up, it's hard to say.

One thing I might be willing to infer from the change in direction is that there was no consensus before and that there still isn't one. I think it's very plausible that some members were always against and some always for the BSA's strategy. Members seemingly also decided to solve this problem internally by lobbying for their position privately inside the BSA.</comment></comment></comment>