The New Normal: 200-400 Gbps DDoS Attacks - <AUTHOR> http://krebsonsecurity.com/2014/02/the-new-normal-200-400-gbps-ddos-attacks/ <comment><USER2> Interesting article. The black market looks far away from me. I always want to know how to get one of those "hacking service" but I can't tell who is genuine and who is not. People literally take risk to do business with these people. I guess I should just get a GreenDot one day and use that to pay a cracker, right?

I don't know how old the kid is, but sounds like someone between junior high and high school. I don't even know how to launch such massive DDoS attack yet. How many do I need to send such? This is interesting...

Side note: Krebs is an interesting person. I have come across his blog many times but I never bothered to find out his actual job. He's a journalist. no technical background. Self-taught. [http://krebsonsecurity.com/about/](http://krebsonsecurity.com/about/)

This is the best example of a civilian out there interested in protecting his data. He would go out his way to eliminate worm and hacker from touching his laptop... we need more civilian like this (not to blog or to go on a strike, but to be aware of the seriousness of the unsafe nature of the Internet).

Also, his article is really well-written. No doubt; he's a reporter after all.

<comment><USER3> he is a former journalist was with WashingtonPost

</comment></comment><comment><USER4> CloudFlare is absolutely right. As long as the attacks are not coming from CloudFlares network, it's not up to CloudFlare to play judge and jury concerning the legality of _content_.

What would be next? Service providers taking down a white hat site because it discloses vulnerabilities?

I'm quite frankly shocked that Krebs would make the argument to put security before freedom of speech and due process.

<comment><USER5> Look at it this way. Without Cloudflare providing free DDOS mitigation, the attacks would not be happening as frequently.

Put that way, I see them as responsible for the attacks. Maybe you'd feel differently if you were the target of some of these attacks.

<comment><USER6> > Look at it this way. Without Cloudflare providing free DDOS mitigation, the > attacks would not be happening as frequently.

I don't see the cost of CloudFlare's service as a problem. In fact, free DDoS mitigation is great. The problem is that they're willing to provide service to booters/DDoS-for-hire services.

Reputable providers prohibit this kind of activity in their AUPs, and there aren't that many companies with their own large networks capable of DDoS mitigation (many are just resellers). If CloudFlare stopped supporting such services, it would immediately put a large dent in the entire booter market because the kids would take care of shutting each other down, and individual booters would find it difficult to find a provider who can mitigate attacks and is willing to provide service to them. (In other words, let them fend for themselves. Screw them.)

> Maybe you'd feel differently if you were the target of some of these > attacks.

I agree, and I think this is why a few of us (you and me, in particular) have different views compared to others.

(I have talked to you on WHT recently. Not under this name, but you might have an idea.)

</comment></comment></comment><comment><USER7> Background on these kinds of attacks: [http://blog.cloudflare.com/understanding-and-mitigating- ntp-...](http://blog.cloudflare.com/understanding-and-mitigating-ntp-based- ddos-attacks) [http://blog.cloudflare.com/technical-details- behind-a-400gbp...](http://blog.cloudflare.com/technical-details- behind-a-400gbps-ntp-amplification-ddos-attack) Or if you prefer audio/video: [http://twit.tv/show/security-now/438](http://twit.tv/show/security-now/438) (also worth a listen for a few possibly off details on NSA spying kit)

Possibly the implication against CloudFlare is that a service which makes money off DDoS attack prevention (and many other things) shouldn't drum up business by encouraging such attacks. Though in CloudFlare's defense, the attacks wouldn't stop if the sites did. And I'm not sure what else CloudFlare could do to get people to fix NTP servers.

<comment><USER8> The attacks would be a lot smaller and infrequent if cloudflare did not host them.

The reason why the DDoS market exploded is because you can now sell your services behind cloudflare for very little cost instead of competitors ddosing each other. You can see all the services being sold at hackforums.net.

Without a publicly assessable store front, you will not get funding.

Without funding you will not be able to rent servers to power reflection attacks and to process requests from hosts that turn a blind eye like ecatel.

<comment><USER9> Can you elaborate on "Hosts that turn a blind eye"?

<comment><USER6> Hosts that negligently allow (do not implement technical measures to block) packets to be sent from an IP address not routed to the sender.

Ecatel is the big one here. I don't know what it will take for their upstreams to shut them down, but it needs to happen. Do that and many of these reflected attacks will stop.

<comment><USER8> You can send spoofed packets from nearly every host.

However hosts like Ecatel are known to specifically allow their customers to send spoofed packets at full speed 24/7.

I think most hosts will notice heavy bandwidth usage, investigate, and then terminate your account. This is why people buy servers at Ecatel even if it is more expensive.

<comment><USER6> Sure, you can _send_ spoofed packets from any host, but any reputable host will drop them.

Reputable hosts use uRPF or at least an ACL at their edge to drop any outbound traffic with a source address that isn't in their network.

People buy servers from Ecatel because they're one of the few that (intentionally) do not have such measures in place.

<comment><USER8> No, very few hosts drop them because it costs time and money to do BGP38.

I have tested 5+ major hosts spoofing packets to a remote destination and they all allowed spoofing except OVH.

</comment></comment></comment></comment></comment></comment></comment><comment><USER10> Poor Rasbora, being an example of how you can be very smart and absolutely retarded at the same time.

I know retarded isn't the right word, but nothing else I can think of represents kicking your future self in the balls so hard they're permanently destroyed and you're crippled for life.

</comment><comment><USER5> > In a phone interview today, Prince emphasized that he has seen no indication > that actual malicious packets are being sent out of Cloudflare's network > from the dozens of booter service Web sites that are using the service. > Rather, he said, those booter services are simply the marketing end of these > operations.

This is how they justify hosting *booter.com. Personally, I don't see a big distinction. If you weren't hosting the frontend site, there would be no malicious packets going out from other people's networks. These booter sites attack each other all the time, so without DDOS protection they'd take of shutting each other down for us :)

<comment><USER6> I agree with you.

Having sent multiple abuse complaints to CloudFlare regarding booters, I have found them difficult to work with. As we've established, they will not censor anything; instead, if they determine your complaint to have some level of validity, they will send you to the actual host.

In one instance, the booter site had no information on registration or what was offered, so I gave them the hackforums thread where the service is being sold. I realize this is basically hearsay and not sufficient evidence to actually shut a site down, but remember that they won't shut a site down in any case. They did not consider this acceptable enough to release information about the host. They wanted me to register an account there and provide it to them for verification. Luckily, I could register without actually paying anything, providing me a nice UI with a big "launch attack" button, and this was sufficient for them.

More recently, they will not even release the site's IP address. All they will do is tell you to email the abuse department of [host] and ask the abuse department to contact them for details. This is ridiculous.

CloudFlare purports to be against DDoS attacks, yet has no problem providing service to admitted DDoS attack services. In other words, CloudFlare is a racketeering operation. They create the problem, indirectly, and offer services to solve it. (I realize they offer a free tier, but their advanced mitigation features are only available on paid tiers.)

</comment></comment><comment><USER6> And here's what CloudFlare isn't telling you: many DDoS attacks are made possible thanks to their service, openly providing service (they would dispute my use of the word "hosting") to booters.

This is called racketeering. Create the problem indirectly and offer protection. Sound familiar?

<comment><USER2> I don't see that being a problem. People have been developing tools like firesheep which can be used to benefit and against people.

Some people like me may suspect some viruses and trojans are created by AV companies out there. In fact malicious, money-greedy one (which no one would use until they got a nice pop that reads "your computer is infected now use our solution") do this. I don't know about the big players out there, but who knows?

If CloudFlare can handle such bandwidth and can defend such attacks for enterprise users, wow, that's a big win for them. Whether they should offer stronger mitigation for any level of users is a different story.

<comment><USER6> Firesheep is a poor comparison. It's a piece of software. The developer (or his associates) do not provide a product or service to protect against it, which would be a requirement to be considered racketeering. (Even if they were offering some "service," say to set up SSL on your server, I'd have a hard time calling it a racket simply because what Firesheep accomplished, i.e. packet sniffing for cookies, has always been possible.)

I don't have a problem with CloudFlare offering multiple service levels. That's just smart business. They are one of the relatively few companies with their own network that can mitigate attacks. And that's where the problem lies - they are using that capability to prop up booters (DDoS attack services, if you weren't familiar with the term). As others have said, booters would be largely uneconomical to operate without the cheap assistance of CloudFlare, because the booter "market" is similar to drug gangs - it's a "war" with the booter owners all trying to take out their competition. (So this makes DDoS attacks less easily available, a good thing for the rest of the Internet.)

The problem is that CloudFlare is choosing to allow them to operate, while offering protection services at the same time. This is the very definition of a racket. It is no different from "wouldn't it be a shame if your shop burned down, you should pay us money."

Now, I'm not saying that _all_ DDoS would instantly go away if CloudFlare stopped this. It wouldn't. It would make a significant difference though, IMO. Services like this make it easy for anyone with little skill to launch attacks, and with amplification techniques (NTP, DNS, SNMP, chargen, etc.) the booter needs very little hardware and bandwidth to launch massive attacks.

<comment><USER2> From some of your comments, it seems like you are heavily involved with similar situation as former CloudFlare customer?

put it this way: if I am a security researcher and I want to publish a paper on DoDs, I can make use of CloudFlare to accomplish my objective. How do you distinguish good from the bad?

What do you propose they should do?

<comment><USER6> I'm not and have never been a CloudFlare customer. My experience with them stems from hosting game servers and dealing with many DDoS incidents, nearly all of which originated from CloudFlare-"supported" (I would like to use the term "hosting" but I realize they will dispute this, and I'm not interested in a debate on semantics) booters. As part of this, I also have experience dealing with CloudFlare, which I detailed in another comment here.

Publishing research papers about DDoS attacks is one thing. Selling a service that performs them (i.e. DDoS-for-hire) is completely different, IMO.

</comment></comment></comment></comment></comment><comment><USER11> CloudFlare is great, but will it ever be possible for them to expand the services that they can protect? Obviously short connection http requests work great with their platform, but will it ever be possible for them to say offer their protections on any service that requires some form of connection between client and server? Like a global TCP load balancing and DDOS protection for connections that need to stay open? For say game servers that are constantly being attacked, etc?

<comment><USER12> Probably not. CloudFlare only makes sense for websites because they can cache content, resulting in a more responsive website and better user experience. Games can't be cached, so whatever protections they can offer will come at a downside of having to use CloudFlare servers instead of servers designed to host games.

Also, DDoS isn't a big deal for most games. (MMOs, yes, but not most games.) If a gameserver is DDoSed, then a few dozen or a few hundred people are going to be unhappy. Whereas if a website is DDoSed, then tens of thousands of people will be unhappy at a minimum. Since most games aren't really affected by DDoS, it doesn't make much business sense for CloudFlare to try to offer gameserver protection. The market probably isn't big enough to warrant diverting CloudFlare time and resources.

<comment><USER13> Few dozen or few hundred? This isn't the 90s, games are played by millions of people daily. More than tens of thousands of people are effected by someone taking down, say, LoL servers with a DDoS.

<comment><USER5> you're forgetting that a lot of games use the individual server model. for example battlefield 4 has 70 player max on any given server. meaning a DDOS will only cause problems for that many

<comment><USER13> In those cases, there is usually a non-player server that can be targeted.. Also, there is absolutely nothing stopping this kind of attack from hitting multiple servers; the only limit is the total bandwidth.

</comment></comment></comment></comment></comment><comment><USER14> I am curious as to not only how did he find out the attackers identity but also got on the phone with his dad. I mean, this is straight out of detective novels.

<comment><USER15> You should see the work he did on finding the guys behind the Target breach. [http://krebsonsecurity.com/2013/12/whos-selling-credit- cards...](http://krebsonsecurity.com/2013/12/whos-selling-credit-cards-from- target/)

<comment><USER16> "After searching my huge personal archive of hacked cybercrime forums for Andrew's various email and Jabber addresses, I found several private messages sent by different users on the Spamdot[dot]biz forum who recommended to other members the "email@example.com" Jabber address as someone to contact in order to hire a service that could be used to flood someone's Gmail inbox with tens or hundreds of thousands of junk messages."

 _several private messages_ sent by _different users_ on the Spamdot[dot]biz forum who recommended to _other members_...

So, an archive of illegally obtained private communication? (Or, is it just questionably obtained by having several false identities across boards? The term _hacked forums_ seems to suggest otherwise)...

I guess that by doing illegal surveillance, one kind find out things that aren't obvious. How surprising.

<comment><USER17> The sites were hacked by other hackers, and uploaded as a dump to the public. Krebs just has copies of them, that's all.

<comment><USER18> I think that's still a bit questionable. I'm not allowed to have copies of child porn, even if the children were abused by someone else and they uploaded the photos to the public.

</comment></comment></comment></comment></comment><comment><USER19> There's something I find rather surprising. It would appear that attacks using spoofed IP addresses need help from a rogue ISP, unless both the attacker and the victim use the same ISP. Presumably, an ISP can easily block packets that originate in its network but have a source address that's not part of its own IP range.

Why does it take so long until most rogue ISPs are detected and cut off the rest of the global internet?

<comment><USER20> > an ISP can easily block packets that originate in its network but have a > source address that's not part of its own IP range.

Is it really so easy? How does the ISP know that the package came from within its network?

<comment><USER19> I'm not an expert on this at all, but I think that unless an ISP's customer is allowed to run a public facing router it would be trivial for the ISP to determine that. There simply cannot be any legit packets with a source address from outside its address range arriving at inward facing network interfaces. Maybe I'm not getting something here...

</comment></comment></comment><comment><USER21> I thought DDoS attacks were done through networks of hacked computers. Is that not the case here?

</comment><comment><USER8> The 400 gbps attack on Cloudflare was supposedly launched by this group.

[https://twitter.com/DerpTrolling](https://twitter.com/DerpTrolling)

</comment><comment><USER22> Imagine what it'll be when 100 - 1000 megabit connections are also the new normal. Is it possible that DDoS attacks will end up unstoppable?

<comment><USER23> Most DDoS attacks send the majority of their traffic from unsuspecting and unwilling hosts. Hopefully, as these patterns become more and more well known the weaknesses that allow that to happen will be increasingly less common.

<comment><USER24> Don't they do that because the servers tend to have a higher bandwidth connection, and NTP amplification attacks let you make use of that even if your own is slower?

</comment></comment></comment><comment><USER25> Link bait for CDN services</comment>


Kilo LISP - <AUTHOR> http://t3x.org/klisp/index.html <comment><USER2> I saw that Kilo Lisp claimed "constant space garbage collection." I understand why a project like Kilo Lisp might like this, but I was curious about how that was accomplished, so I looked through the code.

The actual GC cycle code is pretty small, and looks like a classic mark-and- sweep over a fixed heap:

        int gc(void) {
            int i, k;

            k = 0;
            for (i=0; Root[i]; i++) mark(Root[i][0]);
            Freelist = NIL;
            for (i=0; i<NNODES; i++) {
                    if (0 == (Tag[i] & MARK)) {
                            setcdr(i, Freelist);
                            Freelist = i;
                            k = k+1;
                    }
                    else {
                            Tag[i] &= ~MARK;
                    }
            }
            /* ... */
            return k;

}

Cutting out the verbose GC stuff, there is a finite number of nodes and a free list. Exactly what one might expect. Even sorta feels like hardware.

The function mark is a classic algorithm, the Schorr-Waite algorithm [1], which traverses a directed graph and reverses the pointers, which modifies the heap graph as it traverses it to keep track of how much the graph has.

This is an interesting choice, and gave me pause because in a traditional large heap this would be a fantastically bad decision. But it's pretty interesting that the entire memory image of KiloLisp can exist in side the L2 cache of a raspberry pi and and in some circumstances half the memory can be hot and still reside in L1.

So actually, this is pretty clever. I suspect it's a good case of mechanical sympathy in recognizing that filling L2 will probably remove any gains that a "fancier" algorithm or a non-constant algorithm would bring. Very cool.

[1]: [https://www.cs.cornell.edu/courses/cs312/2007fa/lectures/lec...](https://www.cs.cornell.edu/courses/cs312/2007fa/lectures/lec21-schorr- waite.pdf) is a good reference for this. The original article is annoying to get and hard to read.

</comment><comment><USER3> This is good, I had been searching for a decent little lisp like this for a while but most of the ones I found had garbage collector bugs (extremely difficult to locate and fix) or didn't properly implement tail calls. I ended up writing my own [https://github.com/rain-1/single_cream](https://github.com/rain-1/single_cream) but now there's a few solid ones!

Kilo lisp is just over 1000 lines of code, pretty impressive given what it does. It uses the parallel rails memory representation for pairs as taught in sicp. It even seems to be able to load and save "images"!

I'm not totally sure how the evaluator works. It uses these kinds of opcodes? enum { MHALT = 0, MEXPR, MLIST, MBETA, MRETN, MAPPL, MPRED, MNOTP, MSETQ, MPROG }; do they represent the control stack or something?

<comment> nils-m-holm Nice to see Kilo LISP pop up here! :)

Yes, it does use images. (SUSPEND 'NAME) creates an image file and KL NAME at the shell prompt will load the image.

The evaluator is basically multiple functions in one, where the variable "m" ("mode") controls which function to apply next. The codes (MHALT, MEXPR, etc) denote the functions. MEXPR means "evaluate any expression", MLIST evaluates the next element of a list, MBETA starts function application, MRETN finishes it, etc. Yes, they implement states on the control stack (mstack).

<comment><USER4> Good to see you back online, Nils. Your books are amazing - thank you.

<comment> nils-m-holm Thank you!

</comment></comment></comment></comment><comment><USER5> Impressive. This the tiniest Lisp implementation I ever saw. Having two strides of storage for pairs is an elegant solution. It even provides macro support by building atop of lambda which is impressive too.

This small kernal bootstraps itself with 'klsrc' file, and then it's able to provide 'cond', 'or', 'and' and other keywords for a conventional Lisp syntax.

I am eager to characterize the performance of this implementation. Tiny tends to mean fast but not always.

<comment><USER3> in language implementation the speed you get generally follows this path:

        AST interpreter < bytecode interpreter < native code compiler

and it's an AST interrpeter so it's (likely to be) on the lower end of the speed scale.

</comment></comment><comment><USER6> It's the first Lisp I've seen in which numbers don't evaluate to themselves. In fact, it doesn't even have a number type. A number-like symbol is just a symbol.

I now wonder whether this was the case with McCarthy's Lisps as well.

<comment> phoe-krk No, McCarthy's original Lisp didn't have numbers. See chapter 5 and the linked footnote 4 of [1].

I guess that the Lisp described by Graham does not describe any mathematical operations, since they aren't really required to construct a metacircular evaluator, which is the selling point of the whole article. You don't need numbers for purely symbolic processing; if absolutely required, you can emulate them using Church encoding. Or you could try and make your Lisp dialect practically useful, and extend it with numeric types and operations.

[1] [http://lib.store.yahoo.net/lib/paulgraham/jmc.ps](http://lib.store.yahoo.net/lib/paulgraham/jmc.ps) via [http://www.paulgraham.com/rootsoflisp.html](http://www.paulgraham.com/rootsoflisp.html)

<comment> nils-m-holm Church encoding is not the only option, since you already have pairs. So you can use base-1 list encoding, which is what lots of Kilo LISP programs do. Or you can implement natural numbers using lists of digits, which is still inefficient, but probably much faster than Church numerals.

Try this in kilo LISP:

      (load 'src//nmath)
      (times '(1 2 3) '(4))

<comment><USER7>
        * (load 'src//nmath)
        ? undefined: null

You have to first load klsrc which defines objects required by src/nmath:

        * (load 'klsrc)
        t
        * (load 'src//nmath)
        t
        * (times '(1 2 3) '(4))
        (4 9 2)

<comment> nils-m-holm If you build Kilo LISP using the Makefile, it will load "klsrc" and create the "klisp" image file from it. Without the image file the interpreter is not very useful!

Edit: If you cannot/will not use MAKE, just do

      (load 'klsrc)
      (suspend 'klisp)

After that you do not have to load klsrc any longer.

<comment><USER7> Right, I just compiled the C file with gcc -o kl kl.c and it _seemed_ to work fine.

</comment></comment></comment></comment></comment></comment><comment> nils-m-holm Good to see Kilo LISP here!

Note: LISP, not Lisp -- I refuse to get the memo! :)

<comment><USER8> Ok, we'll give you LISP in the title above. Nobody else gets that :)

<comment> nils-m-holm You really didn't have to do this, but I'm glad you did! Thank you! :)

</comment></comment></comment><comment><USER9> TurboC compilation is 13KB and GCC is over 512KB. Very interesting Lisp-1. I am going to look at the C code. Should be good for embedding as a scripting language.

<comment><USER10> The "wackiest" Lisp embedding I have seen is of femtolisp [1] into Julia [2] to drive the language parser [3]. In hindsight, this is a fairly sensible design decision, but it did blow my mind when I first spotted it.

        # julia --lisp
        ;  _
        ; |_ _ _ |_ _ |  . _ _
        ; | (-||||_(_)|__|_)|_)
        ;</comment></comment><comment></comment><comment></comment><comment>-|</comment><comment></comment><comment></comment><comment></comment><comment></comment><comment></comment><comment></comment><comment></comment><comment></comment><comment>----

        > (apply cons '(1 2))
        (1 . 2)

[1]: [https://github.com/JeffBezanson/femtolisp](https://github.com/JeffBezanson/femtolisp)

[2]: [https://julialang.org/](https://julialang.org/)

[3]: [https://github.com/JuliaLang/julia/blob/d76a30a7178dd1e9b744...](https://github.com/JuliaLang/julia/blob/d76a30a7178dd1e9b74430302bf06ec5b28e20c3/src/julia- parser.scm)

<comment><USER11> A lot of people liked Lisp concepts but couldn't stand the syntax. One thing I keep telling people to try is wrap it in a better syntax hiding the ugly parts. Seeing Lisp in Julia, a language mainstream developers might embrace, brought a big smile to my face. Need more attempts. :)

Another language that tried this with a syntax change was Dylan. People interested in that can try OpenDylan.

<comment><USER12> I've been coding for years using a preprocessor that eliminates most parentheses: Indentation implies parentheses. A pipe "|" opens a parenthesis that auto-closes at the end of that line or at the next ")". A dollar "$" opens a parenthesis that auto-closes when the indentation recovers. The result has a lighter, more poetic look than any language I know, and the parentheses that are left actually matter, so I pay attention to them.

I've seen other proposals online, but they felt untested to me. Leave out either "|" or "$" and the above system gets clumsy. I check for the equivalent of "$" in other proposals exactly as I check for marrow in a stew recipe: Did they really think this through?

One can't change existing habits. An idea that appeals to me: Write a Lisp preprocessor for Rust, and happen to use this syntax.

<comment><USER13> Can you post a link to an example? This sounds like something I could use for my all-too-common convenience hacks, but I can't quite envision it just from the description.

</comment></comment></comment></comment><comment><USER12> Core: APPLY IF IFNOT LAMBDA PROG QUOTE SETQ Derived: LET LABELS COND AND OR QQUOTE LOOP

I was curious how quickly I could change the source to lowercase symbols. It turns out that all Lisp symbols are already lowercase in the C source, and all Lisp source is lowercase. The only uppercase is in the documentation. A nod to us "thawed out of glaciers" elders who actually remember old Lisps?

<comment> nils-m-holm A nod, a habit, and pragmatism. Many LISP books and manuals I have read reproduced code in upper case. Then, upper case is a simple way to make keywords stick out in prose.

<comment><USER12> Yes, but to some not yet seduced by Lisp, it reads like Bernie Saunders just texted "GET OFF MY LAWN!"

<comment><USER14> Not when one is used to Wirth languages, which used caps to differentiate keywords on teletypes that only had one font type.

Caps for keywords was the first use of syntax "highlighting". :)

<comment><USER15> I want to believe that Bernie Sanders uses LISP.

</comment></comment></comment></comment></comment><comment><USER16> Would be neat if this supported Clojure syntax.

</comment><comment><USER17> Now, can I get this to run on my HP 50g...

</comment><comment><USER18> "Kilo LISP A Kilo Byte-Sized LISP System"

But it's 25k of code, the executables and memory requirements are both greater than 1k.

Did it start off as 1k in size, and since expanded?

<comment> nils-m-holm Aaronharder is right, it is called Kilo LISP, because it's code size is measured in kilo bytes. In fact the code _contracted_ a bit since the first version.

That being said, I like S4M's explanation, too!

<comment><USER18> Thanks. Wasn't sure if it started as a 1k thing.

Sloccount on kl.c gives 1056, so either lose 56 lines, or 32 lines and put up with pedants.

Edit: Making specialp() return a single line, excluding 1 branch of the #ifdef and all the #defines gets you below 1024. So maybe you could argue the case?

<comment> nils-m-holm Sounds like a solid argument, but I think I will stick to the "kilo byte order of magnitude" narrative! :)

</comment></comment></comment></comment><comment><USER19> I still think if it is nit lisp-2 it is not lisp but scheme.</comment>


Ask HN: Your subjective takes on living a non-boring and pleasant life? - <AUTHOR> <comment><USER2> Read. Read ferociously. Devour everything. Read aloud. Read with friends. Read outside your comfort zone. Always be reading.

Take a break to write. Write about what you read. Writing is thinking and thinking is hard. You won't want to do this too much. But you should try it to anyway to stay sharp.

Talk to your neighbors. Get to know them. Lend them your books. Invite them over for tea. Play games. Share stories. Help them with chores. Get involved in their lives.

Put down your phone. Use the Internet deliberately and in small doses.

Keep a garden. And read in it.

<comment><USER3> _Write about what you read_

I'd add this - write on paper if/whenever possible, instead of computer.

<comment><USER2> I agree! The only thing more intuitive than a pen is perhaps a blade. Writing on a computer is messy and full of temptations to resist. When it's just paper there's nothing and that is important: you need space and time for your own thoughts!

</comment></comment></comment><comment><USER4> Get married, have kids, dedicate your life to making theirs better. There's a reason the vast majority of people in history have gone this route - it's very fulfilling.

<comment><USER5> Marriage has been shown to increase happiness. Having kids decreases happiness....

[http://fortune.com/2016/05/09/mothers-marriage- parenthood/](http://fortune.com/2016/05/09/mothers-marriage-parenthood/)

 _Comparing couples with and without children, researchers found that the rate of the decline in relationship satisfaction is nearly twice as steep for couples who have children than for childless couples. In the event that a pregnancy is unplanned, the parents experience even greater negative impacts on their relationship._

It's even worse for women than for men.

I for one do not like small children. Everything about small children and babies irritate me and I never wanted to be a father for that reason.

On the other hand, I became attached to my now step children from the first day I met them and I would move heaven and earth for them. But, they were already 9 and 14. Luckily, my wife also didn't want more kids when we met. I'll freely admit that it's mostly caused by selfishness. Not financial selfishness, but with a teenager and a preteen, we never had to find babysitters when we wanted to go out and my wife and I could have plenty of alone time.

When I hung out with just my (step) children we could actually relate. In a lot of ways, I'm a big kid and they always joke when I say something that "this is reason number X that I will never make father of the year".

<comment><USER3> _Having kids decreases happiness_

This is one of those things that can't be "tested", so it is better to be sure before having kids. Personally I've decided against having kids, maybe I'll regret when I am 50, but for now I don't. Fortunately for me, there are enough humans in the planet already, so a few of us not having kids should only have positive impact, at least in the short term.

<comment><USER5> Occasionally when I see other parents with babies, I imagine a life with my wife and I raising a baby and thinking I missed something. Then they start crying and just being kids and I quickly get over it.

</comment></comment></comment></comment><comment><USER6> Rather than trying to avoid being bored and just having a pleasant life, aim for a meaningful and useful life. This will lead to more fullfillment for you and hopefully a better world.

It is strange to me that so often questions along these lines are framed in selfish or hedonistic ways, as if all that mattered in life was one's own transient happiness.

The best way to have a meaningful and useful life is to create real structural improvements to the world. So for example working to reduce structural inequality is more useful than ordinary charity. Or creating useful services or products that improve people's lives.

</comment><comment><USER7> Always try new activities. Be on the constant lookout for activities/skills that can open your mind to new paradigms. Learning languages/instruments/martial arts comes to mind.

Build relationships with people around you that might not be in your socio economic circle. Having a wide variety of friends definitely keeps life interesting.

If all else fails, move. Sometimes, just getting up and moving to a new city/country can enervate your life by exposing you to different patterns that your subconscious can explore.

</comment><comment><USER8> I keep busy volunteering. I play music for a number of churches in my area and also chip in to help the IT staff at a couple of local charities. They're both really gratifying. I also made it a goal to donate 12% of my salary this year to causes that have a direct effect on people's lives.

</comment><comment><USER9> Challenge yourself to discover the joy in "now". Regardless of the activity you're doing, whether or not you like it. The idea is to change prospective. When you start enjoying the work, and not worry about the fruits of it, you'll begin to develop unexpected peace and happy state of mind.

Simplify your life. The less clutter/complication without, the less the same within

On a more concrete level you may experiment with doing following things daily: A bit of exercise, charity, meditation, reading and learning.

With charity I mean random act of kindness toward someone. Help someone, be it physically, emotionally, financially or in whatever way.

Re learning, to be expert in any new skill it takes 10k hours, so pick something you're passionate about and keep learning/practicing it daily for couple or so hours.

Experts experience different state of consciousness and unexplicable joy while doing the mastered activity.

</comment><comment><USER10> Understanding the arc of life. Life in your 20s can be more about horsing around with your friends, but after 40 its more about spending time with your family (your friends become less available because they all started families).

Discovering fitness. Imagine someone who sits in their car on the way to work, then sits at work, then comes home and watches TV while sitting. That person is unhappy because they are sitting all day. Think of kids, they want to run around and play soccer, go to karate, do gymnastics... we're not so different. Hit the gym, hit the bike machine/trail, hit the weights, do a 5K, hit the climbing gym, stretch, do a handstand, do a butterfly kick, do an aerial

Live in a walk-able area if possible. Learn a foreign language. Eliminate vices

</comment><comment><USER11> Here's what I try to do:

\- Outsource chores or tasks I hate doing (like shopping and laundry).

\- Optimize for free time where I have no obligations...I find that very pleasant.

\- Say yes to things I've never tried before...if I hate it I'll say no the next time but I'll forever be able to tell people I tried X. This also makes conversations with strangers and acquaintances easier because I've tried a lot of stuff and can contribute to more conversations.

\- Travel with friends. This can be hard to coordinate but is incredibly fun.

\- Treat myself on occasion. I try to minimize the "stuff" I own but I just bought a nice pair of shoes that I've been looking at for a while and they make me happy every time I wear them.

\- Only use social media for staying connected instead of entertainment. If I want to send a message to someone specific or look at pictures of my nephew, I'll log into Facebook. But as soon as I find myself scrolling through any sort of "feed" I pinch myself and log out...it's 95% bullshit I don't care about and 100% stuff I don't NEED to see right now anyway.

</comment><comment><USER12> \- non-boring: skip things you find boring

\- pleasant: skip things you find unpleasant

In other words: resist outside pressure, experiment by yourself, take responsibility.

Taking responsibility could be seen as the first step. Once you're OK with the idea, it's easier to experiment out of the box, and to resist outside pressure that would force you into a boring, unpleasant life.

That's how I do it. I'm 46, live happy, in a happy couple for 7 yrs, nomading, currently in Malaysia, remote software engineer, working as little (<1wk/m) as possible to sustain this life. I own nothing and don't crave anything, I did nothing as they said, I learnt to not care about what they think, I'm responsible for my own fate. My priorities changed a lot after an ischemic stroke 14 years ago: life is short, too short to let others tell you how boring your own life should be.

</comment><comment><USER13> \- Travel

\- Don't take life too seriously

\- Party. Enjoy the nightlife. Go to clubs and bars and meet people.

\- Approach anybody you are interested in.

<comment><USER14> This is by far the best advice for anyone who's young and/or single. I would only add:

\- Hobbies (preferably social ones; commit at least 5-10 hrs a week) \- Don't overwork while young; the marginal gains aren't worth it unless you get really lucky. If your job/role comps well but is more than 60 hrs a week (and even that's pushing it), it's not worth it. Or maybe you do want to play the startup lottery; just fully appreciate that it is in fact a lottery and make your choice accordingly.

^Highly opinionated

</comment></comment><comment><USER15> Having at least some flexibility regarding working hours and location seems to be a disproportionately big win for me. There are few more frustrating things than being in an office at 9am on a lovely day when I'd rather be walking/cycling, even when I'm not really in the middle of something and nothing is on fire. I'm actually going to be more productive for the day if I go for a walk, mull things over, and perhaps sling some code in the evening.

Flexibility and keeping synchronisation points reasonably infrequent is far more important to me than reducing overall workload.

</comment><comment><USER16> Learn to cook interesting recipes and challenge yourself by shopping at ethnic grocery stores.

</comment><comment><USER17> Good food, opportunities to create (e.g, photos, apps), thrill (e.g., roller coaster, whitewater rafting), prefer nature more than concrete jungle, funny TV shows, social circles that I don't need to fit into.

</comment><comment><USER18> My take is that WHAT you do and WHERE you do it are much less important than WHO you do it with. Building strong family, friend, and romantic relationships is all that matters.

</comment><comment><USER19> Explore, discover, travel, experience, create, contemplate and hopefully improve the world or at least someone else's time on it in the process.

</comment><comment><USER20> A lot of people are living the lives others expect them to, like their parents. That includes a lot of people with kids, too.

</comment><comment><USER21> be passionate about _something_ , help others by giving away your time and money and expect nothing in return, but also be selfish sometimes and invest in yourself

</comment><comment><USER22> A bicycle is a wonderful thing.

</comment><comment><USER23> Do more of what makes you happy, right now, despite whatever "society" says you should do instead.

<comment><USER24> Happiness is a fleeting feeling that's frustrating to hunt down. Too many happiness highs can leave you feeling disgusting. Better to aim for "contentedness".

Candy TV/popular advice always tells you to try to be happy, happy, happy, which seems criminally misguided to me.

</comment></comment><comment><USER24> There are basic human desires, those are a good start. Here's a random garbage link (first hit on shit search engine): [https://explorable.com/16-basic- desires-theory/](https://explorable.com/16-basic-desires-theory/)

The list however, basically nails it. Some or all of those will add meaning to your life if you aim for them.

Personally, creation does it the best for me. There's a massive amount of things you can create, and an endless amount of skills you can learn/improve on. As long as you don't have delusions of becoming famous and treat it as a hobby, you can do it for life. Not so many fellow adults have as much free time as me though, so I'm not sure how viable this particular path would be for others.</comment>


Moore's Law graphed vs. real CPUs and GPUs 1965 – 2019 - <AUTHOR> https://www.reddit.com/r/dataisbeautiful/comments/cynql1/moores_law_graphed_vs_real_cpus_gpus_1965_2019_oc/ <comment><USER2> Nice visual. Wasn't there a 36 billion transistor ASIC just announced a week ago?</comment>


An Electron alternative done right - <AUTHOR> http://nodekit.io/ <comment><USER2> What are the specific differences between this and electron?

<comment><USER3> The biggest one is that this uses a common runtime instead of bundling one with each application.

<comment><USER4> Also: "As slim as you want, NodeKit uses the embedded JavaScript engines provided by the operating system."</comment></comment></comment>


New hotness: Pwning devs with targeted poisoned stacks - <AUTHOR> https://www.theregister.com/2020/09/04/disclosure_developer_targeting/ <comment><USER2> As I mentioned in another comment, I'm apparently the person who said this, but I think the tone of the article strips the talk of all of its context. The talk was largely meant to be salty and humorous, not critical security advice.

Talk here: [https://www.youtube.com/watch?v=Zu4zzfbvO_w](https://www.youtube.com/watch?v=Zu4zzfbvO_w)

<comment><USER3> The article seems fine and it's good security advice. It's absolutely right that quite many developers constantly download and run hundreds of unverified 3rd party programs.

<comment><USER4> [http://gkoberger.github.io/stacksort/](http://gkoberger.github.io/stacksort/)

</comment></comment></comment><comment><USER5> > Jones advised basic steps for devs such as not storing production code on > their local machine...

This does not sound basic at all.

<comment><USER2> In my talk, I said production data, not production code.

<comment><USER5> That makes much more sense.

</comment></comment></comment><comment><USER6> Poisoning StackOverflow posts that some developers will easily detect, report and have removed seems like a "stupid" hypothetical that this "brilliant" hacker has sold to a reporter.

<comment><USER2> Weirdly enough, this article is about me.

I only noticed because I read HackerNews - I was never contacted by the author.

The talk was a comical one, not one meant to be a grand security revelation reported in this way.</comment></comment>


Blue Ocean - <AUTHOR> https://jenkins.io/projects/blueocean/ <comment><USER2> Seeing how much people recommend other solutions, I've actually moved from Travis to Jenkins, and never looked back.

Yes, Jenkins has its issues (crappy UX, poor/awkward docs), but where it shines is the fact it's self-hosted, so I can SSH onto the instance to debug a failing build or replay it with a modified Jenkinsfile on the fly.

I'm quite proud of the current setup we have; We're hosting our app with Google's Container Engine (Kubernetes), so what we're doing is on every build Jenkins creates a slave agent within the same cluster (just different node pool) as the production, so the environment in which test containers are ran is identical to production, and what's more it actually talks to the same Kubernetes master, which means I can, for example, test our Nginx Reverse proxy with real backend endpoints and real certificates (that are mounted through glusterfs).

<comment><USER3> IMO moving from Travis to Jenkins seems like a very disruptive change.

As for me, I had used Travis just a bit, and same for Jenkins, and didn't like any of those options very much.

So when my team needed to setup a CI solution, we ended up using GitLab CI, and it brings the best of both worlds:

\- Free service version if you use the GitLab.com deployment (granted, gitlab.com is a bit slow because it's the new thing and everybody is using it now), like travis.

\- Open source so that you can host it yourself in the future if you need to, like Jenkins.

\- Easy to use and configure, like Travis.

\- Free service for private repos in GitLab.com (neither Travis nor any Jenkins-service provider offer this, AFAIK).

I plan to never look back.

<comment><USER4> Honestly my experience is that SaaS / hosted CI is just generally annoying due to constant stability and performance (both transient and in general, eg. caching in Travis) issues.

Self-hosted CI on the other hand requires a lot of resources, especially when you're not only testing Linux or BSD, but proprietary OSes (OSX, Windows, although the latter at least has the Edge images that work everywhere).

Ultimately I feel like the use of CI in many open source projects isn't very high due to constant annoyances and difficulty debugging the CI environment.

<comment><USER5> Just a note - you can host your own CI node (runner) for project(s) on gitlab.com. It's super simple to setup, too.

[https://docs.gitlab.com/runner/install/linux- repository.html](https://docs.gitlab.com/runner/install/linux-repository.html)

<comment><USER6> This doesn't solve issues in runner-to-base comms. I had tried this kind of setup relatively recently, and almost every 10-15th build had failed for me because GitLab wasn't healthy (502 from Docker registry or problems up/downloading artifacts between stages, etc.)

Fully self-hosted looks like the only sane way. Harder to set up, but at least one can check the whole chain that way.

<comment><USER7> Sorry about GitLab.com having performance problems. Self hosted is indeed the only way to work around it in the short term. I hope you can set it up quickly. Please use the Omnibus packages that should install in a few minutes [https://about.gitlab.com/installation/](https://about.gitlab.com/installation/)

</comment></comment></comment></comment></comment></comment><comment><USER8> Hey there,

I am the community leader for Jenkins Blue Ocean and Product Manager for the project at CloudBees. It's really great to see Jenkins users getting excited about Blue Ocean!

Please let us know if there are any missing features that are blocking your team from adopting Blue Ocean. We know there are some gaps between Jenkins Classic and Blue Ocean and while we have some good ideas, we are relying on your feedback to help us prioritise what to work on next.

If you've got any questions feel free to drop a comment here and Ill do my best to answer them or join our Gitter community [1]

Thanks, James

[1] [https://gitter.im/jenkinsci/blueocean- plugin](https://gitter.im/jenkinsci/blueocean-plugin)

<comment><USER9> Some pieces of feedback on Blue Ocean, which we've used on and off but haven't been able to switch to:

\- The console interface needs work. The "click on text to link to it" thing is making it very hard to select stuff. Line numbers on the left are useless for a log, timestamps would be _much_ more useful. (Also please add ANSI color support!)

\- Artifacts view is awkwardly empty. Instead of the artifact name being a link, there's a separate download button.

\- I have a GH project linked to my various build-master jobs. Why is the "commit" column empty?

\- Build -> Changes -> The commit column shows the commit; with Github integration it could use a link to the actual commit on GH itself.

\- "Duration: A few seconds" is not helpful for builds <1 min long. If your build takes 4 seconds average and one build takes 33 seconds, that should be immediately visible.

\- I can't immediately see which builds were recently triggered and when from the main view. Regression from the legacy main view.

\- Bug: "Display the log in a new window" -> the log is being sent as text/html instead of text/plain

Thanks for your work.

<comment><USER8> You're welcome and thanks so much for this feedback. There's a lot here for us to cover - would you mind if we could have a short chat over email or even a Google Hangout? My email is firstname.lastname@example.com

<comment><USER9> Sure, sent you an email.

</comment></comment></comment></comment><comment><USER10> Esoteric use case from someone in AI: Jenkins is the only CI we've been able to use even as an open source project due to needing gpus. CI and things like special hardware is a "semi-common" edge case and a big reason to have something self hosted.

Referencing other comments here: We've also found periodic builds and arbitrary jobs to be a must as well.

A lot of providers out there support most of the basic stuff out of the box, and I understand why they won't go after an edge case like that. It's great to see improvements in the UX on the horizon, that has been our biggest pain point.

If anyone's curious, our CI setup involves a multi OS cluster: Mac,windows,linux for power,linux x86 (with cross building for android) with 1 linux master running a gpu for gpu tests.

<comment><USER7> In GitLab CI you can use any machine for a build as long a you can install GitLab Runner on it. We kept the design of that simple with few dependencies and it is written in Go.

<comment><USER10> We just don't use gitlab heavily enough yet :). We are mainly a JVM shop so the bias jenkins has for things like maven and what not out of the box is pretty appealing. I've been watching your integration play :). Maybe 1 day.

<comment><USER7> Thanks! I agree that great Maven support is key. We're working to integrate a package repository in [https://gitlab.com/gitlab-org/gitlab- ce/issues/19095](https://gitlab.com/gitlab-org/gitlab-ce/issues/19095)

</comment></comment></comment></comment><comment><USER11> They should rethink the deployment model instead.

You cannot provision jenkins unattended without 3rd party hacks and undocumented features. Until this is fixed I recommend avoiding it, as you'll get pet servers. This is totally retrograde to the devops mindset. Now why should I not use that mindset if that proves to be productive at other parts of work?

<comment><USER12> If I understand you correctly, you are talking about managing Jenkins configuration as code. For that, see

* configure jobs as code ([https://wiki.jenkins-ci.org/display/JENKINS/Job+DSL+Plugin](https://wiki.jenkins-ci.org/display/JENKINS/Job+DSL+Plugin))

* system configuration as code ([https://issues.jenkins-ci.org/browse/JENKINS-31094](https://issues.jenkins-ci.org/browse/JENKINS-31094)) and its current prototype ([https://github.com/jenkinsci/system-config-dsl-plugin](https://github.com/jenkinsci/system-config-dsl-plugin))

* bypassing setup wizard ([https://issues.jenkins-ci.org/browse/JENKINS-34035](https://issues.jenkins-ci.org/browse/JENKINS-34035))

There are also puppet modules, Chef cookbooks, and etc that a lot of people use. Some of those are maintained by people who are also in the Jenkins community, so I don't consider them "3rd party hacks" if you are referring to those.

<comment><USER13> And this is one of the major shortfalls of the Jenkins mindset. Everything is a plugin and an afterthought from the main design of the system. Something as crucial as configuring the system should be a top design priority, not shoved into a plugin 5 years after the launch of the project.

So, great, there is a plugin to deal with configuration. How do I bootstrap my infrastructure? If it's a plugin, it sounds like I need to install that in an already running Jenkins setup, no? Currently, both this and the bypassing setup wizard seem like hacks to me.

Configuration of a critical piece of your infrastructure should never be a hack.

<comment><USER14> Jenkins is more than 10 years old :)

Regarding plugins, you can just plop them in the plugins folder an start Jenkins.

<comment><USER13> Totally, I just was considering the fork point from Hudson back about 5 years ago. As an independent project they've had 5 years to think about design and it seems like no one really has cared.

I still think core functionality shouldn't be put into plugins in any software system. You should have sane functionality and defaults right out of the gate. Plugins or modifications are for extending the base use case. Configuring your software to me is a base use case.

<comment><USER14> Jenkins is incredibly popular and has a huge community. Dropping backwards compatibility would be very harmful.

What they did instead was to move most of the core functionality in plugins maintained by the core contributors, so they're plugins all but in name. I.e. they can be installed separately, uninstalled, etc., but about 100 plugins are supposed to be used together and you see them frequently in examples, docs, etc.

<comment><USER13> Plenty of systems can and do evolve their community forward with it. The sentiment of backwards compatibility at all costs is the same that leads you down the road of having to support IE 7. No one is saying play fast and loose with core functionality, but do it responsibly and with community input.

That "about 100 plugins are supposed to be used together" is indicative of bad design to me.

They really should be taking a look at modern systems like Concourse CI to see what they can do to improve.

</comment></comment></comment></comment></comment></comment></comment><comment><USER15> Wow, this looks amazing. I really want to try this out.

On my current contract, we've been moving away from Jenkins and towards Gitlab CI. I still work on an opensource project that uses Jenkins to build. The screenshots show a really good pipeline layout. It seems like it's similar in power to Gitlab CI, but also looks like it has way better visual representations and UI.

I'm glad the Jenkins team is still moving forward and developing plugins/tools like this.

<comment><USER16> Why Gitlab CI? What makes it better than Jenkins?

<comment><USER17> I think the consensus is that Jenkins offers more power and flexibility at the cost being more complicated to set up. GitLab CI is easier to get up and running with and superbly integrated with GitLab (as one would hope).

<comment><USER7> We also want to offer all the power and flexibility of Jenkins but we still have some work ahead of us. The idea is to add those features to GitLab itself and not to plugins. Plugins tend to cause brittleness [https://news.ycombinator.com/item?id=13218391](https://news.ycombinator.com/item?id=13218391) We want to make sure that you can upgrade GitLab without having to worry about things breaking.

For the current GitLab release (8.15, December 22) we planned the following CI improvements (not all will be ready, some will slip to Jan 22):

Pipelines for Merge Requests [https://gitlab.com/gitlab-org/gitlab- ce/issues/23902](https://gitlab.com/gitlab-org/gitlab-ce/issues/23902)

Remove Builds tab from Merge Requests and Commits [https://gitlab.com/gitlab- org/gitlab-ce/issues/23638](https://gitlab.com/gitlab-org/gitlab- ce/issues/23638)

Make pipeline graph nodes bigger and responsive [https://gitlab.com/gitlab- org/gitlab-ce/issues/22088](https://gitlab.com/gitlab-org/gitlab- ce/issues/22088)

Direct link from pipeline list to builds [https://gitlab.com/gitlab- org/gitlab-ce/issues/19703](https://gitlab.com/gitlab-org/gitlab- ce/issues/19703)

Part of the issues in Improve reliability of CI/CD [https://gitlab.com/gitlab- org/gitlab-ce/issues/24361](https://gitlab.com/gitlab-org/gitlab- ce/issues/24361)

<comment><USER18> Does these pipelines thing imply moving away from Sidekiq? At work that's our biggest issue with Gitlab. Sidekiq dies all the time and Gitlab has to be restarted for merge requests to work again.

<comment><USER7> These pipelines do not imply moving away from Sidekiq. Have you tried using the Omnibus package? It contains logic to make sure restarting Sidekiq is automatic. How much memory does GitLab have and how many users?

<comment><USER18> Only 5 users. We are using Gitlab from Bitnami which I'm sure is using the Omnibus package. Maybe they configure it differently. I'll check, thanks.

<comment><USER7> The Bitnami package indeed doesn't include any of this. I strongly recommend switching to Omnibus.

From [https://about.gitlab.com/installation/](https://about.gitlab.com/installation/) "One-click installers are frequently out of date and might not contain our Omnibus packages. An example of this are the Bitnami packages in the past couldn't be updated and are now much harder to update than the Omnibus packages. We advise to not use one-click installers but instead start an vanilla Ubuntu instance and use the recommended Omnibus package installation. This is almost as quick as a one-click install and you're sure of the latest version and easy upgrades."

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER19> I just want to mention that I loved the idea of BlueOcean at the begining. It looks sleak an works well with pipeline. However, for us it's unusable in production setting. I know that it's still in beta, but as one example it doesn't support parameters. When user starts a job through BlueOcean it will fail.(Officialy they don't plan to implement it any time soon as I found out) That means It stays disabled in our jenkins. PS: For now its just a presentation tool for management :)

<comment><USER20> Well, that's Jenkins in a nutshell. You usually need to extend Jenkins with lots of plugins because they provide functionality that should have been in core in the first place. Then you realize that those plugins are not properly sandboxed and often do not work well together (especially with multi- configuration builds), not to speak of how updating Jenkins becomes a nightmare with plugins breaking left and right because of some internal API changes which are not yet properly handled by some plugin.

<comment><USER21> In fairness, Jenkins did not have the benefit of hindsight. Plugins were the this-is-how-you-support-extension architectural style of the period (see also Wordpress, Eclipse).

I've been working on a Concourse tutorial video series. One of the points I've made is that plugins are unsafe to compose. They need to know too much about each other to prevent interference.

Concourse instead composes on resources, which all have an identical interface (check, get, put). You can pretty much use any resource with any other resource if they achieve your purpose.

We're still calling Concourse "CI/CD", but folk are now jokingly referring to "Continuous Everything" at Pivotal. Because it really is becoming the first tool for everything. We're running large automatic tooling with small teams, because it's easy to extend and relatively easy to rearrange.

Disclosure: I work for Pivotal, which sponsors Concourse development.

<comment><USER22> I'd love to see -- or even better, read :) -- about how you "compose on resources".

</comment></comment></comment></comment><comment><USER23> I love to hate Jenkins. Such a nice (and remarkably simple, for what it accomplishes) piece of software.

I've tried to replace it so many times, and so many times come to realize what an asset it is.

</comment><comment><USER24> We used Jenkinsfiles and pipelines recently. And also introduce Blue Ocean on our jenkins server.

It come with a few glitches: Some plugins are not compatible with Blue Ocean, causing a white-page-of-death. However I found there where already issues created for them, i just turned off the plugin.

But the biggest downer, is that blue ocean is just a small UI on viewing pipelines. Its not a replacement for jenkins. And you still need the normal jenkins UI. Which doesn't handle pipelines well.

I think its still very much a beta project.

<comment><USER8> The blank screen issue is extremely important to us to fix and we hope to have a change that fixes it shortly. It's a consequence of the new REST API depending on all the plugins installed on your system and exposing its data for JS plugins. If one plugin misbehaves then it 500s the REST response. We've got an approach to isolating per plugin failures so that you can load the page even if one plugin fails.

You can follow progress here [https://issues.jenkins- ci.org/browse/JENKINS-39647](https://issues.jenkins- ci.org/browse/JENKINS-39647)

</comment></comment><comment><USER25> I have been using Blue Ocean as the radiator view for our Jenkins projects for a long while now and it does look really nice and sleek. That said, currently that's pretty much the extend it can be used for. I'd say it has about ~5% feature parity with the "old" UI currently, which means that there's not much to do than just look at the pretty progress bars. Can't wait for this to progress though, the old UI of Jenkins is archaic at best.

<comment><USER8> Thanks for the complement. It's hard building a new UX for a tool like Jenkins. It can be difficult to pick the next thing to work on because one feature could be the killer feature for one developer but not the other. Is there anything in particular that blocks you from using it day to day?

<comment><USER25> Thanks for replying! (First, our Blue Ocean plugin is at 12b currently, so some of these might be already there).

I agree with the difficulty with picking the next UX piece to build and as such I guess most of my "wants" are mostly for me. I spend most of the time in Jenkins fiddling around in the settings, plugins and credentials and such I'd love to see "/credentials", "/configure", "/configureSecurity", "/pluginManager" and maybe "/log" and "/load-statistics" under the Administration tab.

These would alone lower the need for the old UX for myself close to nil, as the pipelines are mostly automatically managed by our (Jenkinsfile based) integrations. I do see how the administration part will be really painful, as all the conventions used by plugins would be have to be "ported" somehow first I assume?

<comment><USER8> Administration tasks are not really in our scope yet (at least not for 1.0 as it's a huge job to boil the ocean, so to speak) and our focus is on making the best developer experience for CD Pipelines.

There's a lot of job level configuration that's moving into the Jenkinsfile with Declarative Pipeline [1], such as triggers, and you can expect that process to continue.

You're right on the plugin conventions having to be entirely ported. There's a whole new UI stack that those plugins have to adopt and we have to think carefully about how we design those extension points rather than blindly pulling them into the UI.

[1] [https://jenkins.io/blog/2016/12/19/declarative-pipeline- beta...](https://jenkins.io/blog/2016/12/19/declarative-pipeline-beta/)

</comment></comment></comment></comment><comment><USER26> This news is from September, I gave my first impressions on Hacker News then, here's my blog post including an interview from the team behind Blue Ocean.

[http://blog.alexellis.io/tag/jenkins/](http://blog.alexellis.io/tag/jenkins/)

They are doing a great job at reinventing JenkinsCI (but remember it's still Java)

<comment><USER27> What's wrong with Java?

<comment><USER26> Restrictive licensing and then there's the fact it is a huge memory hog. I have Blue Ocean running on a home lab with 16GB RAM and Jenkins + SSH slave drains almost all the resources.

Also - GitLab Travis / CircleCI etc being quite trendy/new remember that if you need to extend Jenkins you're dealing with a legacy product.

<comment><USER14> Jenkins is both being actively developed and in a different niche than the others.

Something isn't legacy just because there's something newer out there. Or everything is legacy :)

</comment></comment></comment></comment><comment><USER28> I like blue ocean - but wouldn't moving to something like Concourse CI or GOCD be a better idea in the end?

<comment><USER29> We currently have a Jenkins setup and recently looked into both Concourse CI and GoCD as candidates for a change.

We decided not go with Concourse, because it has a complex setup with bosh. Not much other use cases are really covered in the docs other than a simple one machine setup so you are left to figure things out on your own (don't really have the time to go into all that, jenkins + ec2 plugin is very simple and just works). Also the minimal GUI, very CLI-centric. this is more of a particular thing, since I don't think that our current team will be comfortable with that UX and we have to weight this in.

We did like the docker-centric approach and specially the postgres backend that makes for a much more flexible maintenance story.

We decided not to go with GoCD simply because it feels very similar to jenkins in several aspects, but all concepts and workflow are different so we would have to relearn all that we do in jenkins in the GoCD way. Also redo all ops involved in backup, update etc. I just didn't find the killer feature to justify going through it. The postgres backend would maybe have caught my attention if it wasn't offered as an add-on for the expensive paid version.

In the end just decided to leverage more of Jenkins 2.x pipelines with shared libs instead of having independently configured jobs that are bothersome to maintain. Will probably make some changes to our agents to leverage more of docker instead of messing with AMIs.

Another major factor is the size of community, which alleviates a lot of worries.

As for Blue Ocean, I hope it evolves in the right direction, but right now it simply does not solve any problems for us. As said somewhere else, you can't build a pipeline with parameters. This is really a show stopper, parameterized builds are central to a lot jenkins use cases. Another problem is a single view for all jobs but no filter? The favorite jobs feature does not substitute either search or the view and folder way.

<comment><USER30> A note on concourse deployment: their docs recommend bosh deployments, but they also provide standalone binaries [0] and the deployment workflow in this case is extremely simple. Run "concourse web" for the UI, "concourse worker" for a worker, and all the basic connectivity stuff is handled via command line parameters.

That being said, depending on your company habits, the fact that concourse is very opinionated on how to run the jobs (every is built around docker) and how configuration is done (yaml files, no UI) can be either a blessing or a showstopper.

[0] [https://concourse.ci/binaries.html](https://concourse.ci/binaries.html)

<comment><USER31> > the deployment workflow in this case is extremely simple. Run "concourse > web" for the UI, "concourse worker" for a worker

By which you mean, of course, "write systemd units or whatever for the web and worker jobs", because you don't want to be starting your CI system by hand. That's not rocket science, but it's not quite out of the box.

That said, the emphasis on BOSH must really be hurting Concourse adoption. Nobody outside the Cloud Foundry bubble (which includes Pivotal) has any interest in using BOSH at all, and honestly, quite rightly so. It's cool there's a BOSH option for fans, but the primary deployment option has to be something accessible by the general public.

<comment><USER21> > _That said, the emphasis on BOSH must really be hurting Concourse adoption._

It did, I think. My gut feel from watching the Slack chat is that lots of people are deploying using the prebuilt docker containers. There are even projects that set up k8s clusters for you.

</comment></comment></comment></comment></comment><comment><USER32> See also thread from May this year: [https://news.ycombinator.com/item?id=11790900](https://news.ycombinator.com/item?id=11790900)

</comment><comment><USER33> I think in the what is AI argument what has actually happened is that there have been two conversations about AI over the years - what AI is and what AI can do by virtue of being AI.

In that conversation the assumption has been that AI would be in some ways self-aware and intelligent like 'Data in Star Trek' and by virtue of being self aware and intelligent it would be able to learn things from its users, it would be able to make aesthetic judgements about music and art, it would be able to create interesting art of its own and so forth.

As it turns many of the things that AI will be able to do for us has been done by programs that are 'just math', the question is if in the future more or even all of AI's perceived benefits for humanity can be accomplished by just more and more complex 'math'.

In the end perhaps the essence of what AI is will only be beneficial to AI itself.

<comment><USER34> Replace 'AI' with 'Jenkins' and this becomes some great satire.

<comment><USER33> also if you replace my name with Mark Zuckerberg.

</comment></comment></comment><comment><USER35> This is nice! I've been looking for a way to schedule deployments of multiple code bases at the same time, with automatic rollback support. Does this support that?

</comment><comment><USER36> This looks great. Not because of the aesthetics, but because it finally acknowledges that Groovy is absolutely useless for Pipeline. I want to try out this new workflow.

</comment><comment><USER37> We've actually built Pipelines [1] for that very reason; Jenkins has always felt over-engineered and unfriendly.

I'd be very interested in hearing from folks who are familiar with it what they think of our alternative.

[1]: [https://github.com/Wiredcraft/pipelines#readme](https://github.com/Wiredcraft/pipelines#readme)

<comment><USER21> I'm a bit confused -- is this a UI for Jenkins, or a different system altogether?

<comment><USER37> It's a different Python thing. You can install it with just `pip install pipelines`.

</comment></comment></comment><comment><USER38> Looks awesome really. The pipeline U.I. is similar to PIVOTAL's Concourse C.I. I wonder if each job is in a separate container?

<comment><USER21> Pivotal is the sponsor of Concourse. It's an open source project in its own right.

Blue Ocean is a definite improvement for Jenkins shops, for some such places it may be a more sensible alternative to switching.

Disclosure: I work for Pivotal.

<comment><USER38> I also work for Pivotal T.O & used Concourse on a recent project. Thats why this thread caught my attention :)

</comment></comment></comment><comment><USER39> Can't wait to try this out. It looks very good. It also looks very simplified which I like.

</comment><comment><USER40> This look nice, is there a hosted version of BlueOcean?

I've been looking into (preferably hosted) pipeline-based CD options because simple CIs like Travis and CircleCi are not really meant true CD. What does everybody recommend?

<comment><USER41> Jenkins isn't really CD either. I'd suggest looking at GoCD or spinnaker, though you'd have to host both yourself.

You can get away with using any of the CI tools to just run through pipelines (heck, you can do this with fancy bash scripts if you're a real masochist ;), so I guess you could use any of jenkins, CircleCI or Travis to run a pipeline. I guess it'll depend on how much you really don't want to manage a CD server yourself.

</comment></comment><comment><USER42> The new release of GoCD, 16.12, is also filled with amazing UI improvements. It's great to see Jenkins making Pipelines as first class citizens.

<comment><USER21> I'm a Concourse nut, which was partly inspired by GoCD.

I'm not sure Jenkins is really making pipelines first class in the same way GoCD or Concourse do. In particular, there will be a painful period where some plugins work well and some don't, because plugins are difficult to cleanly compose.

Disclosure: I work for Pivotal, which sponsors Concourse development.

<comment><USER42> I tried the new Jenkins update, it's quite buggy at the moment. I am going to stick to GoCD for now.

</comment></comment></comment><comment><USER43> I've given up on Jenkins and switched to Travis. The overhead of managing a good Jenkins setup for a small team is not worth the effort.

</comment><comment><USER44> What's the most amazing thing you have done with this technology?

</comment><comment><USER45> This looks very much similar to HP CDA (Continuous Delivery Automation), the project was later scrapped. Wish they had open sourced it.

</comment><comment><USER46> You'd have to imagine that the term Blue Ocean would be trademarked for contexts like this

<comment><USER47> Given the competition in the space, would it not be more aptly named Red Ocean?

</comment></comment><comment><USER48> This looks great. After this the next step for Jenkins should be to change the name.

<comment><USER22> It kind of did already. It used to live at [https://jenkins- ci.org](https://jenkins-ci.org), and was moved to [http://jenkins.io](http://jenkins.io) to communicate that it's not "only CI", but also CD.

<comment><USER49> It was also renamed once, from Hudson. [https://en.wikipedia.org/wiki/Hudson_(software)#Hudson.E2.80...](https://en.wikipedia.org/wiki/Hudson_\(software\)#Hudson.E2.80.93Jenkins_split)</comment></comment></comment>


Citing Clinton, sailor seeks leniency in submarine photos case - <AUTHOR> http://www.politico.com/blogs/under-the-radar/2016/08/sailor-seeks-leniency-in-submarine-photos-case-by-citing-clinton-226995 <comment><USER2> so a sailor stationed on a US Navy nuclear submarine is facing four to five years in prison (and a dishonorable discharge) for taking six photos from inside the submarine. The subject of the photos--the propulsion system--seems alarming until you read a little later how "uninteresting" the photos actually are--ie, the US Navy classified each of the six as either "confidential" or "restricted".

i reviewed thousands of classified documents during time in the service-- ts/sci and everything below it. So first, i should think anyone who has handled classified information quickly realizes the strong inflation in security designation--makes sense though because no one wants to under- classify a document, better to be conservative. Second, "confidential" is the lowest category of classified information and very few documents/messages in that category ever seemed to me not already general public knowledge. Third, while some of the six photos were classified "confidential"\--the lowest classification; others (we aren't told how many) were deemed "restricted". "Restricted" is not a classified category--it's about the same as "for official use only". Once more, this is the US Navy's own security designation of those photos. (By contrast, Clinton's email server contained _eight_ email chains classified top secret, while many chains having a lower security designation, were found.

That said, if i were a sailor on board a nuclear submarine i can't imagine i would ever point a camera anywhere near the propulsion system; but if i did, i would expect little mercy even if i photographed nothing whatever classified. The Captain has sufficient authority in an instance like that to bust the sailor down to E-1, fine him six months pay, and throw him in the brig for a month or two--just for being reckless, again, even if there is no breach of classified information.

<comment><AUTHOR> It certainly wasn't a very smart thing to do.

But I think the main point of the article was "different rules for them than for us."

<comment><USER3> Yes, but the article is deceptive. The sailor:

1 - took photos of classified materiel;

2 - admitted he knew that they were classified and that he wasn't authorized to possess them;

3 - after being confronted by law enforcement, destroyed evidence

Clinton

1 - at worst only accidentally had classified material;

2 - the state department disagrees with the cia/nsa over whether the 110 documents that were unmarked yet classified at the time of sending/receipt should have been so classified;

3 - did not destroy evidence.

A far better comparison is General Petraeus. He [1]

* was a 4-star general;

* knowingly gave classified information to someone not authorized to possess it;

* lied to the fbi (a felony all on its own, even if what you lied about wasn't a crime! Never ever talk to the fbi without your lawyer. For any reason.)

* committed adultery

Petraeus got probation, a $100k fine, and to keep his rank (which controls retirement benefits.)

The differences, as the fbi director pointed out when discussing Clinton, revolve around knowingly taking classified material and lying/destroying evidence. One has to conclude the lawyer used Clinton to be sensational rather than as a genuine comparison.

[1] [https://www.washingtonpost.com/news/fact- checker/wp/2016/02/...](https://www.washingtonpost.com/news/fact- checker/wp/2016/02/24/why-the-clinton-email-scandal-and-petraeus-leak-are-not- really-alike/)

<comment><USER4> > 3 - did not destroy evidence.

Like with a cloth?

Let me correct that for you, Clinton attempted to destroy evidence but was incompetent at it.

<comment><USER3> She was not under investigation at the time, and none of the emails she deleted ended up being responsive. It's in no way the same as destroying documents or digital storage after the police/fbi talk to you. Even according to Comey, there is no evidence the emails were deleted in an attempt to conceal information [1].

[1] [http://www.politifact.com/truth-o- meter/article/2016/jul/19/...](http://www.politifact.com/truth-o- meter/article/2016/jul/19/politifact-sheet-hillary-clintons-email-controvers/)

<comment><USER4> Let's be honest with ourselves here. Director Comey isn't exactly impartial here. His boss (President Obama) has a vested interest in a positive outcome for Hillary, and therefore, so does he.

For the record, I'm not saying that he did anything improper regarding this investigation, I'm just saying that he is hardly a neutral third party in this.

<comment><USER3> Feel free to revisit Comey's interactions with George Bush re: nsa wiretapping to see if Obama could intimidate him. If he said Obama didn't interfere, we should take him at his word.

</comment></comment></comment></comment></comment></comment></comment><comment><USER5> It is perfectly logical, an unintended consequence of Secretary Clinton's actions. When you downvote, please tell me why I'm wrong.

<comment><USER6> Downvoted because you shouldn't complain about downvoting, read guidelines.

Personally I find it a particular bad form of karma whoring. You are saying it to get karma.

By implying people will downvote you, you are implying people disagree without any evidence at all.

But inexperienced people take this as a given and will upvote you even if they only partially agree with you because you have fooled them into thinking most people totally disagree with you, it's a clever scam that works. Hence I believe the guidelines.

<comment><USER5> Thank you! Did not know about the perfectly logical prohibition on such complaints. I shall avoid it in the future. Was definitely not karma whoring, FWIW-- I fully expected an avalanche of downvotes. Appreciate the education, though not the assumption of guilt. I upvoted your comment and would have downvoted my own if I could.</comment></comment></comment>


Feel Like I'm Stuck in an Architect Role. I Want Out - <AUTHOR> I have 17 years experience as a software developer. I took a job as a Solutions Architect about a year ago, and I hate it.  I realize my place is in the code, the details of getting the product shipped. All I do as "Architect" is schedule meetings to define requirements, review work, answer customer questions, and other meaningless crap. I've interviewed for a few Senior Students Software jobs, but get the impression I'm tainted by my recent Architect work.<p>I'm looking for a little perspective on what to do next? <comment><USER2> Now that you have this role, you can try to adapt it to focus on the technical architecture.

This will require you to distinguish between the functional architecture, the logical architecture, the technical architecture, the physical architecture, the deployment architecture and the security architecture; but it will allow you to explain the differences to your interlocutors and especially to delegate what does not interest you and to keep tasks where you feel relevant.

You can take advantage of your position as an architect to choose :)

</comment><comment><USER3> Don't see why you'd be tainted. Why do you feel that? Have you seen this in your interviews/conversations?

</comment><comment><USER4> you have heard this a million times and know what it means but here it is again: LIFE IS SHORT and it can be shorter than you think it will be. your time is just that, your time. so go do what you want to do, and if it is wrong well you tried it. that's what really harms folks imho, it's not the paycheck but what you would do for free that matters the most. if someone is happy flipping a burger, not only is that honorable work but to the folks that like burgers, they get their food made by someone who loves flipping burgers. it could be you are 'burned out' per say and who knows, maybe working for yourself or getting into a new field or something as mundane as gardening or doing something 'outside' might be just what the doctor ordered.

</comment><comment><USER5> Solutions Architects are usually customer facing engineers who enable sales. You shouldn't have any trouble switching back, just come up with a good narrative about how you're looking to bring your focus back on to the engineering side of things.

</comment><comment><USER6> Maybe the role of product owner might be something to consider. You get in touch with developers and use your programming background for guidance them and then you can focus on adding feature clients will love.

<comment><USER7> How would that help? It sounds like the OP wants to code and deliver a product.

</comment></comment><comment><USER7> I'm in a very, very similar position. I would like to chat off HN if possible. Do you have contact info?

</comment><comment><USER8> When Endeavour is lost - your talking to a the difference between savage and an endless computer.

</comment><comment><USER9> consider changing the title to "Ask HN: Feel Like I'm Stuck in an Architect Role. I Want Out"</comment>


Page Views on Black Friday and Cyber Monday - <AUTHOR> https://blog.cloudflare.com/the-truth-about-black-friday-and-cyber-monday/ <comment><USER2> _> Despite all of that mobile browsing activity, desktop devices are more commonly used for checkout actions. People seem to browse more on mobile, committing to buy more often with desktop..._

Could this be because people are also doing comparison shopping for deals, and that using tabbed browser interfaces is easier and more convenient on the desktop than on mobile with smaller screens?

Regardless of the reason, using standalone browsers (as opposed to apps), especially on desktops, gives users _more_ (this is relative) freedom and control to avoid being tracked and also block ads and annoyances, resulting in a much better user experience. That's something I'd always encourage.

P.S.: Off topic, but in the back of my mind I worry about Cloudflare becoming the new Google, at least as it pertains to collecting information on the sites that it sits in front of and profiling and monetizing that. Also given that many sites may use the free SSL solution from Cloudflare, the traffic from Cloudflare to the site would be visible to it. I wish Cloudflare would provide cheaper paid plans in multiple tiers so that there's more to it than just free vs. (a relatively steep) $20 a month.

<comment><USER3> Is $20 really that steep for that? I'd say it's amazingly cheap for what you get.

<comment><USER4> Yes, but do I need all that or could I live with a small subset of it for cheaper?

</comment></comment></comment><comment><USER5> >Black Friday is spreading internationally despite these still being normal working days for the rest of the world. //

My feeling, in the UK, is that it's not stuck. Peak seemed to be 2 years ago, last year was big but more organised to avoid the violence (!) of the previous year. This year ... some kids in my city had the day off school, other than that it seemed calm, some companies definitely avoiding it, perhaps it's moved primarily online?

A UK consumer rights company "Which?" published price comparison info showing most items are cheaper at other times of the year. I think this realisation may in part be why the super-hype is not working.

<comment><USER6> Yeah honestly I completely forgot about it till I went to buy something from Amazon and saw their banners everywhere (UK). Got a decent enough discount on the item I wanted but not going to remember it next year either.

</comment></comment><comment><USER7> It is deeply concerning that regular employees at cloudflare have access to analyze the content of user traffic like this.

<comment><USER8> Much of this would be semi-public anyway, they could be analysing HTTPS traffic to find most if not all of these conclusions.

Most of it seems to be domain and user-agent based. I'd suspect you could even guess the device type based on IP with reasonable accuracy. It wouldn't be entirely correct, but with the kind of scale Cloudflare deal with it doesn't have to be to be useful.

The domain (which is public) gives you the info about whether users are browsing or checking out (if a browser hits api.stripe.com, worldpay, PayPal, some checkout API domain for Amazon, etc, then you can infer).

<comment><USER7> The particular part that is concerning:

 _If you imagine a typical ecommerce application makes a purchase with a HTTP request like "POST /store/checkout HTTP/1.1" we can look for requests similar to this to understand the activity._

<comment><USER8> Yep that is more concerning. They might be using unencrypted HTTP to get an idea of the breakdown and then inferring volumes based on HTTPS traffic and known differences between the two.

I basically wouldn't jump to "Cloudflare have a bunch of sensitive data and will use it in bad ways", I suspect they have less data than we might assume from the article, and in general their security/privacy stance is great.

</comment></comment></comment></comment><comment><USER9> >We can see here that Black Friday has an almost 200% increase in checkout interactions compared to the previous Friday.

Anecdotally I hear a lot of people say they are "waiting for Black Friday".

Is it best to compare to the previous Friday here, or to average Fridays? some other number?

</comment><comment><USER10> A lot of other stuff might be analyzable from those "POST /store/checkout" requests, too, so please keep sharing with the world. Thanks! You're awesome!

</comment><comment><USER11> I would love to see this data for Singles' Day (the Chinese holiday). Alibaba's claims are staggering.

<comment><USER12> Singles day is also migrating around the world now.

There are some numbers from Alibaba that I've seen in Apache Flink presentations, though I can't remember which ones off the top of my head

</comment></comment><comment><USER13> These plots seem to be very deceiving. Obviously if you aren't one of the big players like Walmart or Amazon, it may not look as dramatic as it really was. I'm assuming cloudflare is not a cache for those two?

</comment><comment><USER14> I suspect google could do the same with "Anonymize Data" from FREE Google analytics platform.

</comment><comment><USER15> Why is the content only taking up a middle third of the available space on a 20" monitor making the text on the graphs almost unreadable? Not even an option to zoom/click on the graphs.</comment>


The Bielefeld Conspiracy - <AUTHOR> https://en.wikipedia.org/wiki/Bielefeld_Conspiracy <comment><USER2> It is a lot easier to create a successful conspiracy theory than it is to create a successful conspiracy.

</comment><comment><USER3> This is one of those memes that stopped being funny around 1998, but is somehow still repeated all the time.

<comment><USER4> As someone being born and living in Bielefeld I can assure you that every local is tired of it...

<comment><USER5> Aha! You're one of them!

Sorry, I actually never thought that meme was funny in the first place, until I realized how much it pisses off people from Bielefeld. That's when I suddenly had a mission.

What's rather funny about it is that the author just intended it to be a fleshed out example of how conspiracy theories work and their followers think and argue, but that aspect of it got completely lost along the way, only the slightly humorous aspect of the whole piece remained and got memed to death.

<comment><USER4> Interestingly, people visiting Bielefeld often think it is a great way to start a conversation with locals. Having no intention of using it as a meme, but rather as a way of "breaking the ice", not knowing that they will induce the complete opposite reaction.</comment></comment></comment></comment>