RISC-V Pros and Cons - <AUTHOR> http://semiengineering.com/risc-v-pros-cons/ <comment><USER2> > It tries to undercut the ARM model of establishing how CPUs or other cores > should work and how they should be valued."

Companies are not going for ARM just to license professor ISA's. They also license and value the underlying efficient and high performance architecture ARM has developed.

What can happen with RISC-V is that there are several competing IP companies that develop competing RISC-V architectures and ask royalties and license fees for their IP. This competition can bring down the cost somewhat. If ARM royalty is 1.5% today, the cost may be 0.77% in the future. It's also possible that one company will dominate others with superior design, price and foundry connections. That company might be ARM, AMD or Intel.

<comment><USER3> > Companies are not going for ARM just to license professor ISA's. They also > license and value the underlying efficient and high performance architecture > ARM has developed.

Depends on the company. Apple, Qualcomm, Samsung, AMD and Nvidia in fact do go to ARM just to license the ISA and implement the CPU entirely on their own. However, the ARM implementations are licensed by a whole lot of smaller companies. The bigger players are thus pretty much forced to forever chase ARM's changes to the ISA and implement these. I doubt they mind ARM's price but I suspect that they might be concerned about ARM's influence.

One big change from RISC-V, if it materializes, would be a standard ISA not controlled by a single company like ARM, and not evolving through a knife fight between a few companies racing to extend it, like x86. Will it materialize? Not sure which way I'd bet.

<comment><USER2> >and not evolving through a knife fight between a few companies racing to extend it, like x86.

Apple others you mention have an architecture license agreement with ARM. It means that they can develop their own cores but they must have full compliance with the ARM architecture.

Does RISC-V require fully compliance? If not, RISC-V might be evolving through a knife fight between a few companies racing to extend it just like x86. When one company gets large market share, their extensions become de facto standards.

<comment><USER4> Probably no compliance requirement given all the derivatives. SPARC is another open ISA where you might have to comply if saying it's SPARC-compatible along with a sub-$100 fee. I don't think there's a requirement if you give it a different name or say SPARC-like.

</comment></comment></comment></comment><comment><USER5> I'm excited by RISC-V. It has some interesting architectural decisions.

Remember the ARM started in the 1980s was solid but not a breakout architecture until the early 2000s. The x86's roots lie in the 70s and it took a killer app ( _IBM_ PC) to make it dominant. GCC took about a decade to get any traction.

So it's early days for RISC-V

<comment><USER6> The article says that the developers expect companies to add their own features and support, so I guess we're just waiting for some established player or startup to pick up the ISA and roll something out with it?

But it specifically says "same model as Linux", and that bothers me because RISC-V is not an operating system, and I'm not sure that Linux's business model is appropriate here...

<comment><USER7> Maybe the Chromium->Chrome/Iron/Opera comparison would be a little neater? That's the way I read it. An open source core with different vendors adding closed source components as value adds.

</comment></comment></comment><comment><USER8> An issue that's not mentioned is memory consistency. It's not something that's going to solve without $$, and may pose a serious economical obstacle.

EDIT: coherence -> consistency (sorry)

<comment><USER9> RISC-V is just an ISA, which can be thought of a s a very low level API. The memory (and most other subsystems') architecture is not tied to the ISA. Rather it has to do with load/store instruction implementation and cache organization.

<comment><USER10> "RISC-V is just an ISA"

tgragnato wasn't clear enough to be certain about what he/she has in mind, but the RISC-V ISA specification -- as presently written -- has been shown to have memory consistency flaws. This emerged in April when Princeton published their TriCheck findings. RISC-V foundation has since responded by promising revisions to the ISA specification to close the holes.

[https://www.electronicsweekly.com/open-source- engineering/ri...](https://www.electronicsweekly.com/open-source- engineering/risc-v-bugs-found-princeton-2017-04/)

[https://www.electronicsweekly.com/news/design/eda-and- ip/ris...](https://www.electronicsweekly.com/news/design/eda-and-ip/risc-v- foundation-replies-princeton-bugs-2017-04/)

</comment></comment></comment><comment><USER11> People like to compare RISC-V to Linux, which I think it is just wrong.

Linux is something that you can download from kernel.org, compile it and bring it up over night. It's a package with a bunch of scripts that compiles a working kernel for your machine. All the work is already done for you.

RISC-V, on the other hand, it is just a document describing an ISA. It is far different from a working implementation.

RISC-V might shine on micro-controllers and on power management control units, since those applications are more simple and more affordable to implement from scratch.

But on high-end applications, it will be no different from ARM's path. Implementing an high performant CPU costs money, someone will have to cater those costs, either by hiring a full team of highly specialized engineers (which will cost a bunch of money) or by licensing to third parties (which will also cost money through licenses or royalties).

<comment><USER12> As the article (and you) point out, the datacenter and mobile space is already lost to Intel and ARM respectively. The only path forward is through the IoT space. It's the only area where you might need something even smaller than ARM.

<comment><USER13> ARM Cortex-M is quite likely much smaller and more power efficient than RISC-V will be for the foreseeable future.

If RISC-V is going to go anywhere, it's going to have to start with hobbyists and RaspPi-like devices.

<comment><USER14> Krste Asanovic in [https://www.youtube.com/watch?v=KxuQW8HWBXI](https://www.youtube.com/watch?v=KxuQW8HWBXI) shows numbers that the Berkeley Rocket implementation of RISC-V is both faster and has smaller die size than the ARM Cortex-A5 and that the Berkeley BOOM is faster and smaller than the ARM Cortex-A9.

<comment><USER15> The Cortex-A series are big processors. They're generally used when compute power is more important than power consumption. While it's a promising benchmark, the RISC-V will need to compete with the M-series (and other 8/16 bit cores) to break into the IoT market.

</comment></comment></comment></comment></comment><comment><USER16> "Not everything exists for RISC-V that exists for the other ones, but that is filling in at incredible pace."

The RISC-V project is now 7 years old. Remember that the 6502 and its supporting hardware went from proposal to final silicon in 2 years. And that was done using a hand drawn layout.

<comment> yjftsjthsd-h The 6502 was also far more primitive; doesn't seem like a useful comparison point.

<comment><USER17> ~3500 transistors vs millions (tens of millions? hundreds?)

<comment><USER18> But the tooling is much better today. I read that the layout of the 6502 was mostly made by one person.

[https://research.swtch.com/6502](https://research.swtch.com/6502)

<comment><USER4> They also weren't working in contraints of 1000+ design rules today's nodes would need for custom design.

</comment></comment></comment></comment></comment><comment><USER19> Could a chip based on the SuperH ISA (off which the patents expire) [0] like JCore compete with RISC-V if similar effort would be put into it?

[0] [https://en.wikipedia.org/wiki/SuperH](https://en.wikipedia.org/wiki/SuperH)

<comment><USER20> _SuperH_ is 32b so that would need to be updated.

Another worthy contender to be rehabilitated is _DEC Alpha_. Indeed, the Sunway Taihu Light supercomputer (fastest the on TOP500 list) uses the Sunway SW26010 which is based on the Alpha 21164.

<comment><USER19> From what I have read [0] the j-core people have that on the roadmap for 2019+.

Seeing that Sunway TaihuLight still uses DDR3 I wonder how much power they could save by going with DDR4 and it's lower voltage.

It's cool to see so many older ISAs coming back.

[0] [http://j-core.org/roadmap.html](http://j-core.org/roadmap.html)

</comment></comment></comment><comment><USER21> I didn't read the article, but I have been trying to stay vaguely informed off and on.

The two 'cons' that really need to be addressed:

* Average consumers need /access/ to purchase working solutions (which means some prosumers and some developers will).

* Working solutions probably need to include: DisplayLink, USB, Ethernet, and /maybe/ WiFi (the later two /could/ just be USB devices) ports on the hardware. Standard bulk IO (like SATA, PCI(e) bus) would be nice to have, but not required.

<comment><USER2> Issues you mention have nothing to do with RISC-V ISA.

RISC-V Is just open source ISA, hopefulĺy without any patent issues.

Nobody is going develop open source high performance RISC-V processor architecture IP and give the design away free. You pay licenses and royalties just like before.

<comment><USER17> The RISC-V BOOM project looks like it might do something like that. Or am I missing something?

<comment><USER2> BOOM is something like that. But it's essentially prototype reference design that is automatically compiled to 45 nm (10-year old process platform).</comment></comment></comment></comment>


Ask HN: Alternative uses for P2P? - <AUTHOR>

Imagine that there is a perfect P2P technology, which can symmetrically connect a bunch of computers over a network -- what use cases can you imagine for that?<p>E.g. we all know about file sharing (torrent et al.), or simple data sharing (as employed by Skype); do you have any other ideas? Feel free to assume that any specific requirements particular to your idea were met by the technology, e.g. that it works perfectly across NATs in some way. <comment><USER2> Here is one that looks promising: [http://techblog.wikimedia.org/2010/09/video-labs-p2p-next- co...](http://techblog.wikimedia.org/2010/09/video-labs-p2p-next-community- cdn-for-video-distribution/)

It's a CDN that uses P2P technology to help distribute video. This would come in very handy for viral videos...if 30 of your coworkers have already watched the video, then you could stream it from them rather than fetching it from an edge server (in the case of a traditional CDN).

</comment><comment><USER3> P2P search and p2p social networking. If you've already got p2p media sharing and streaming and bidirectional chatting and talking, you've pretty much remade the internet. You've pretty much remade all conventional media too.

</comment><comment><USER4> What about p2p encrypted backup? There was some attempts but none gained traction AFAIK.</comment>


Optimizing dynamic JavaScript with inline caches - <AUTHOR> https://github.com/sq/JSIL/wiki/Optimizing-dynamic-JavaScript-with-inline-caches <comment><USER2> When it comes to optimization, less if often better. If you have branching it's likely that the CPU will run all branches anyway. You also want to stay in the CPU and off the memory. And bitwise operations are usually not faster in JavaScript. I probably missed the point but blame it on the stupid examples. I also think it's stupid to write dot net C# when you can write JavaScript with NodeJS _:P_

</comment><comment><USER3> ``` var dividers = { 2: function divideBy2 (lhs, unused) { return lhs >> 1 }, 4: function divideBy4 (lhs, unused) { return lhs >> 2 }, undefined: function divideByNumber (lhs, rhs) { return lhs / rhs } } ```

Does this actually work? I tried it out in the Chrome Debugger and it didn't work. It looks like the author is confusing it with Rusts match statement.

<comment><USER4> It works just fine in Chrome's DevTools.

      > dividers[2](6)
      3
      > dividers[undefined](6, 3)
      2

<comment><USER5> The code uses dividers[divisor] so dividers[3](6, 3) so undefined(6,3) and that does not work

<comment><USER4> Oh, yeah the divideSomeNumbers() function doesn't work correctly. It should probably be using:

      var divider = dividers[divisor] || dividers[undefined];

</comment></comment></comment></comment><comment><USER6> I have been experimenting along these lines. Not so much aiming towards what is optimised but rather what is potentially optimisable.

for instance

        function callerOfAll(fns) {
          if (fns.length===0) return ()=>{};
          if (fns.length === 1) return fns[0];
          var first = fns.shift();
          var rest = callerOfAll(fns);
          return ()=>{first();rest();}
        }

This should take a list of functions and return a function that calls them all. An optimiser should be able to inline the function call if it notices each rest() is only ever called once. Ultimately it could turn

        [a,b,c,d,e] into ()=>(a();b();c();d();e());

or even further if those functions themselves are small enough to be inlinable.

Looking at V8 IR, it doesn't seem to get there.

I have wondered about making a benchmark suite out of such tricky but logically optimisable structures to give Javascript engines something to aim for.</comment>


FreeNAS 11.0 is Now Here - <AUTHOR> http://www.freenas.org/blog/freenas-11-0/ <comment><USER2> Well... that was fast. After the absolute disaster that was 10.0, I think they should have really reconnected with the community to restore their direction. Then, give themselves enough time to implement those changes.

The linked post makes it pretty clear that this is NOT a production ready release. 9.10 continues to be the workhorse. Did they just want to reach a new milestone for the optics?

<comment><USER3> I believe this is just what would have been 9.10.3 just rebranded. They wanted the major number to track the FreeBSD version number.

[https://forums.freenas.org/index.php?threads/this-week-in- fr...](https://forums.freenas.org/index.php?threads/this-week-in- freenas-4-21-2017.53798/)

 _Renaming to 11.0 - As many of you know, we've been hard at work on what was to become 9.10.3 in the next few weeks. As part of this update, we have also bumped the base OS version to FreeBSD stable /11\. This is a significant enough update that we wanted to take this opportunity to return to a saner form of versioning that more closely follows the underlying OS version. Moving forward you'll be seeing releases like 11.0, 11.0-U1 (Update #1), 11.1 and so forth, eventually moving to 12.0 once we rebase on FreeBSD 12 (still a couple years off)._

<comment><USER4> FreeNAS 9.x did not include virtualization. If this was just a 9.x.y release, why would it include major architectural changes like virtualization?

<comment><USER5> At least FreeNas 9.10 does, via iohyve/bhyve [0]. I installed a Ubuntu Server image using it the other day and it worked flawlessly.

[0] Docs are a little spartan, but google searches got me up and running a virtualized linux image in less than 15 minutes. [https://doc.freenas.org/9.10/jails.html#using- iohyve](https://doc.freenas.org/9.10/jails.html#using-iohyve)

</comment></comment></comment></comment><comment><USER6> I upgraded to 10, the issues caused me to just run ZFS on linux with docker and netdata for monitoring. Other than the UX are there really any benefits of using FreeNAS over ZFS on Linux?

<comment><USER7> I've had occasional issues with ZFS on linux after a hardware problem (sata card died in a weird way) and it left the system in a state where the then stable release would crash upon doing a scrub (git version had a fix for the problem i hit). I ended up booting to FreeBSD to clean it up rather than trying to get dkms going with the git version. That said, no data loss from the incident.

<comment><USER7> For those curious, data written to that port on the controller card was being corrupted. SATA CRC for communication was still good so i wasn't seeing SMART errors, but i was seeing zfs checksum errors. Was so glad that ZFS was catching it, first time i've seen an error like that.

</comment></comment></comment><comment><USER8> I found FreeNAS 9 very restrictive and ended up running FreeBSD 10, then 11. At times the learning curve has been vertical, but it's pretty good. I think I'd use ZFS on Linux with Debian if I were doing it over again.

</comment><comment><USER9> FreeNAS 10 single-handedly made me change my NAS box to a bit of a home-built solution with Proxmox. If they've fixed most of the issues I had with it, I might consider going back, since I tend to prefer BSD over Linux.

</comment><comment><USER10> I used FreeNAS years ago, version 8 as I recall and it seemed solid but there seems to be a lot of negativity in the comments here. Could someone fill me in with what went so wrong with FreeNAS 10?

<comment><USER11> FreeNAS promoted a major version to release, turns out it was half baked and they pulled the release a few _weeks_ after. Lost a lot of faith in the community.

[http://www.freenas.org/blog/freenas-corral-status-release- te...](http://www.freenas.org/blog/freenas-corral-status-release-technology- preview-status/)

<comment><USER12> These disasters always come after "ground up" rewrites. The lesson has been clear since Netscape almost imploded in the 90s, evolve the existing code - don't rewrite.

<comment><USER10> That's largely due to 'failure bias'. You hear a lot more about failed rewrites than you do successful ones. I've been involved with a number of full rewrites over the years and all of them ended up greatly improving the product and development process.

<comment><USER12> How large were these products? I've also experienced rewrites that went somewhat successfully, but I can't say we wouldn't have been better off upgrading the existing code in place.

</comment></comment></comment></comment></comment><comment><USER13> Really glad I didn't upgrade last time. Going to wait really long this time.

<comment><USER2> hear hear

</comment></comment><comment><USER14> I'd like to read a document that lists pros/cons of using FreeNAS vs just standard FreeBSD. To me it's not sufficient to just read something like "you're building a NAS, so of course you should use FreeNAS".

Okay, but why? Other than a GUI, what makes FreeNAS better than vanilla FreeBSD? The GUI isn't important to me.

I think I might know one other advantage? From perusing various discussions in the past I've gotten the impression that FreeNAS is more proactive than FreeBSD when it comes to fixing bugs related to storage. Is that true?

<comment><USER15> Well... using a GUI to get things done is why I went with FreeNAS. I just couldn't be bothered having to learn (and remember, or otherwise relearn every few months!) the various potentially fiddly options needed for samba/nfs/zfs/whatever.

... and it did turn out to be a good intro for getting back into FreeBSD anyway, as I needed to add driver support for Mellanox cards. :D

That being said, I still use it as my main NAS here, and would do so again. I can happily forget 95% of the command line stuff I'd otherwise need to remember, and put that time to good use on other things. :)

</comment></comment><comment><USER16> I moved to kubuntu LTS and zfsonlinux ( have a couple btrfs volumes too) after iXsystems provided me with absolutely the worst service possible on my appliance I bought from them. I got tired of restrictiveness of the platform, lack of features etc. I used unraid for a little while instead of freenas and aside from being btrfs only i found it was much much nicer to use. I really love being able to make good use of kvm on Linux now too.

Edit: forgot to mention how I absolutely hated how brittle the upgrade process of some of the plug-ins was too!

</comment><comment><USER17> I see it says they are using Angular now, does that mean they have finally implemented a proper front end routing system that doesn't break the browser's forward/back functionality? I was really disappointed when one of the developers told me that they intended to do it this way: [https://www.youtube.com/watch?v=8TS6vvpP1yQ&lc=z123fhi43onhe...](https://www.youtube.com/watch?v=8TS6vvpP1yQ&lc=z123fhi43onhefl4f04chdag0si4fhqaf3c)

</comment><comment><USER18> I sound like a broken record, but I want no glorious new features, I want easy configuration for OS X clients - and not learn about arcane commands I need to give to Samba.

<comment><USER5> Whats broken on OS X? I use FreeNAS with Windows and Linux. Windows works fine, and Linux doesn't require any special commands or config of Samba.

<comment><USER18> There are a myriad of problems, from locking directories, Affinity Photo corrupted files, MS Office temp files, permission problems, ...

<comment><USER15> Out of curiosity, is that with files shared over cifs or nfs?

I've been having better luck with cifs when using OSX with a FreeNAS 9.10 server, but do still seem to have the occasional weird file locking problem.

<comment><USER18> Cifs.

<comment><USER15> Damn. Yeah same here.

When 10 came out, there was mention of a newer major version of Samba being included. I'm not sure what version is included in this 11.0 release, but if it's a major release or two higher than that in 9.10, then I'm kind of hoping it'll help.

That being said, upgrading my NAS isn't a high priority task. It's working "well enough" for now as is. :D

</comment></comment></comment></comment></comment></comment><comment><USER19> There are quite a few irrelevant features.

Does it do everything Drobo does? That's all I want in an open source storage system.

The answer to that is a no, you need to resilver the disks if you add a new HD.

They need to focus on iterative improvements to their core value proposition. That's how they will win me back as a customer.

<comment><USER20> You'd have to take that up with the ZFS folks.

</comment></comment><comment><USER21> What S3-compatible object storage service they pre-packaged? I just hope it's not the owncloud.

<comment><USER22> [https://www.minio.io/](https://www.minio.io/) would be nice.

<comment><USER15> It's definitely Minio. :)

This kind of worries me though, as Minio is written in Go:

[https://github.com/golang/go/issues/15658](https://github.com/golang/go/issues/15658)

I've not seen issues with Go on FreeBSD yet personally though, so I'm hoping it's extremely rare. Or that it gets fixed by someone before I hit it. :D

</comment></comment></comment><comment><USER23> I ran into upgrade pain where jails created before a certain time (had to have been in the not-so-distant past because none of my jails are particularly old) lost networking post-upgrade. I rolled back to the previous release since I didn't have time to deal with it, but this is now 2 releases with some major caveats.

</comment><comment><USER24> I upgraded to Coral release and regretted it. The good news was downgrading was simple.

However I think I will pass on this 1.0 release of the new GUI for now.

<comment><USER25> For what it's worth, I made the same mistake and have since discovered that ZFS on Linux is a smooth experience. Raided a pair of SSDs and now enjoy a (single) real command line and native docker containers.

<comment><USER24> This is for a home setup for sharing the family media file collection with the devices on the local network. Having the GUI just makes it simpler. I also own a FreeNAS mini so...along with a few TrueNAS at work.

</comment></comment></comment><comment><USER26> Why not use SmartOS (if you're fine with having your NAS in seperate VMs) or OmniOS (for a traditional server approach), both Solaris derivates, with native ZFS and Solaris Zones, both have the Linux KVM ported, so you can run a Linux machine as a Solaris zone, etc.? What you get is not a NAS, but a Home-/Fileserver.

<comment><USER27> OpenSolaris derivatives have incredibly restrictive hardware compatibility. Therefore, the likelihood of existing hardware being supported is poor and the list of potentially purchased hardware is short.

</comment></comment><comment><USER28> I've been fine with FreeNAS 9. Rather than upgrade, I will most likely build a new system instead.

<comment><USER29> Same. My current system is starting to show its age, so I might as well update the hardware along with the software.

</comment></comment><comment><USER30> Got burned by upgrading to 10 (and then making it work for me, which is now wasted effort), what a clusterfuck... The only thing 10 was missing for me personally were jails, but I wasn't a hardcore user of them

</comment><comment><USER31> "FreeNAS 11 requires 8GB of RAM to run properly" That's quite a lot, but then again it has tons of features.

I remember FreeNAS running on 1GB RAM years ago.

<comment><USER32> I think that's mostly due to the ZFS file system. It needs a ton or RAM to work well. I believe older versions of FreeNAS used or at least had the option of using a different FS that was less memory-hungry.

</comment></comment><comment><USER33> Oh boy, well let's wait and see if this release blows up on the launchpad...

</comment><comment><USER34> Looks like we should still wait for the next one.</comment>


Former FTC chief: Privacy fears are 'hyper-partisan hyperbole' - <AUTHOR> http://money.cnn.com/2017/04/01/technology/internet-privacy-protection-rules-jon-leibowitz/index.html <comment><USER2> Former FTC chief...now lobbyist for ISPs.

And the CNN guy is of course using the ISPs' talking point, that they should be treated the same as search engines.</comment>


Debuggers Make You a Bad Detective - <AUTHOR> https://www.thinkingmuchbetter.com/main/debugging-bad-detective/ <comment><USER2> It really depend on context. I did not use gdb at all before the end of my first year where i had to code my own posix-compliant shell (i don't think it was by the end of the project but we were close).

But gdb helped me understand why printf() was not working as intended, how those pesky register worked, remove memory leaks, and overall taught me a lot, fast. I had to rewrote malloc() using mmap at the start of my second year, i don't think any amount of printf() would've helped me as much as gdb and valgrind did. Also watchpoints basically do the same job as printf most of the time (but are more tedious to use).

I find pdb() usefull too (although it might be because i don't understand python as well as i should). I definitely use print() though, like said in the article, to narrow down where the break points should be placed. And i think than more than half the time i used pdb() it was on my test files, whether it was unit testing or feature testing (those are hard :/), so better test coverage would not help me much.

Also, debugging Common Lisp with (print) is usefull for beginners not used to the REPL, but once you understand how this whole slime/REPL thingy works, not using it to debug is bold.

</comment><comment><USER3> Depends really. If I've just joined a place where I've got no clue how the code works, the best thing I can do is use a debugger. It will make me understand how the code works, and will get me to the bugs quicker.

I agree though. If someone knows the code intimately and still doesn't have a rough clue about why a bug exists, and the first thing they do is look at the programs entry point and step into all the way until something pops out, it certainly will take you forever. And in this context, OP is certainly right.

</comment><comment><USER4> I tend to use ipython kernel for debugging in python, it is not a debugger but does the job for me to find what is wrong while working on a scientific project. What are your thoughts on it?

<comment><AUTHOR> That's like a python notebook, right? Given the quick feedback loop, and that you're seeing just what you need to see, that seems like an efficient way to debug that sort of thing.

<comment><USER4> Yes, the jupyter notebook thing, rightly pointed out by you, it does give a quick feedback. One can also start writing code from the beginning in it and push a working cell into a .py file. This way one is very sure from the beginning that how the code will work. The downside of it, which I think, it feels to me that code is written in a very linear fashion.

Coming to debugger in python (pdb), in your blog you criticize using debugger to step line by line. But this need not be the case, one can jump to debugger prompt and set a break point from the prompt itself where one feels something is wrong and continue to that break point and repeat this process. So one need not to jump through each line. In such a case it works equivalently to carefully put print statements, i.e judiciously put print statements = judiciously put breakpoints, what do you think?

<comment><USER5> I think a lot of people that criticize debuggers think professionals use them like a first year CS student, as a crutch because they don't understand the language they learning.

A professional uses them to trap events and then explore the programs state. And to inject faults and watch how the program explodes, or not. In that debuggers are vastly better than printf debugging.

<comment><USER4> "a lot of people that criticize debuggers..." But what really making me think is that big giants like Torvalds, Rob Pike, Guido van Rossum. Rober C Martin, John Graham they don't like using debuggers ([https://lemire.me/blog/2016/06/21/i-do-not-use-a- debugger](https://lemire.me/blog/2016/06/21/i-do-not-use-a-debugger)).

<comment><USER6> That article is a great example: It defines "debugger" as "single-stepping through code", and then argues against that. It's fine to argue against "single-stepping through code" as a default technique, but artificially limiting the scope.

EDIT: one of the comments by the author makes it very clear: they don't consider lots of things you can do with e.g. gdb as "using a debugger": [https://lemire.me/blog/2016/06/21/i-do-not-use-a- debugger/#c...](https://lemire.me/blog/2016/06/21/i-do-not-use-a- debugger/#comment-245502) </EDIT>

The submitted article here is similar, by opening with that ridiculous example and pretending that's what using a debugger means. Debuggers don't make you bad at finding problems. Not knowing when to use which tool makes you bad at it. (And knowing how to _make new tools_ out of your existing ones is also quite helpful)

<comment><AUTHOR> This is a good point, thank you! I am adding a quick note in the article to clarify that it's more about the code-stepping technique itself.</comment></comment></comment></comment></comment></comment></comment>


Merging mkdir and touch: Advanced New File - <AUTHOR> https://github.com/tanrax/terminal-AdvancedNewFile <comment><USER2> The readme of this says: "Thanks to the power of python"...

But why use python for this at all? Even with the edge case features like the `--change` flag, it's shorter to write this in Shell, and you have no requirement for python (which is admittedly fairly ubiquitous) or the "click" module (which is not).

I get that people write in the language(s) they're familiar with, but this is a bit ridiculous, no?</comment>


Launch HN: zeroheight (YC S19) – UX design docs that stay up-to-date - <AUTHOR> Hi HN!
We're Jerome and Robin, the founders of zeroheight (https://zeroheight.com/).
zeroheight is an online editor that lets companies create a wiki site to document their design process. The documentation is integrated with their design tools so that it's always up-to-date, which enables large design and development teams to stay on the same page, ship faster and deliver consistent user experiences.
Documentation is the first piece of the puzzle – our vision is to enable any company in the world to have a "design system": a system of reusable UX and front-end components, tools and guidelines. We want companies that don't have the resources of design giants like Salesforce, IBM and Shopify to be able to create design systems which are just as powerful e.g. https://www.lightningdesignsystem.com (Salesforce), https://www.carbondesignsystem.com (IBM), https://polaris.shopify.com (Shopify)
Our startup journey started 4 years ago at a YC Startup School event in London – it was the final push of inspiration we needed to make the jump and quit our Big Finance Co programming jobs :) We joined Entrepreneur First (a pre-seed incubator) with a list of startup ideas (including some really bad ones!) and spent most of our time emailing people and going for coffees. For two coders who were excited to code and build a product, this was a tough reality check of what starting a startup can be like in the beginning!
At the time, one problem that really resonated with people was that the design-development handoff process was pretty painful. This was something we had experienced at work: designers sending manually annotated PDF specs and PNG assets as email attachments etc. We thought it was an exciting space, so we went ahead and built a design-development handoff tool.
The problem was that there were already some great products in the space that had a head start – such as Zeplin (YC S15) :) – so despite gaining some customer traction, it wasn't enough for us to raise money. This led us to go back to basics: talk to users...
So we went for coffee with our customers to figure out what other problems we could solve in the space and built the following series of insights:
- Good design is now the default, most products need a great user experience to compete
- Because of this, companies are spending a lot more resources on design/UX and growing their design teams rapidly
- In order to be able to collaborate at scale, design teams have started adopting a component-based workflow – similar to how engineers have worked for years
- But breaking designs down into components is not enough. In order to successfully collaborate at scale, designers and front-end coders need written documentation on _how_ to use the components. The design components are the lego bricks and the design documentation is the much needed lego instruction manual.
So what's the problem? We dug deeper and found that there are two hurdles that tend to prevent companies from creating successful documentation for their design system.
1. Companies that _do_ have the front-end engineering resources to build custom design documentation in-house (or leverage a tool like Storybook) often end up with engineer-driven documentation that is up-to-date with production code, but is hard for non-technical designers to contribute to. This leads those designers to create their own, separate documentation, which in turn causes fragmentation between design and development teams — one of the problems that having a design system is trying to combat in the first place!
2. Companies that _don't_ have the spare front-end engineering resources to build custom docs use tools like Confluence, Google Docs, Notion etc. but these types of wiki tools aren't built for purpose and the documentation can easily end up out of sync with the latest designs and code
Based on this we built a minimal yet powerful editor (in the spirit of Dropbox Paper or Notion) that makes it very easy for anyone to document their reusable UX components, tools and guidelines (their "design system"). The editor is integrated with both design and development tools so that the docs stay up-to-date. On the design side we provide Sketch, Figma and Adobe XD plugins to sync UX components and styles. Designers can update the designs inside the docs at the click of a button without having to leave their design tools. On the engineering side we offer Codepen-like interactive previews as well as the ability to embed Storybook stories – so designs and front-end code can live side-by-side in the docs.
In order for it to be easily accessible by the entire company (and possibly made public), the documentation can be published as a standalone website and shared with anyone using a link (or protected with a password)
To get a better idea of what a zeroheight docs site looks like when shared, check out this example site from one of our users (https://zeroheight.com/22mjgbuf6/p/56796c) or our demo site (https://demo.zeroheight.com)
That's all for now... we'd love to hear your thoughts on what we're building in the comments below!
PS: if you're a full-stack / front-end engineer in London that would like to help us build zeroheight, I'd love to connect :)
PPS: our office is nice and leafy → https://secondhome.io/cmsimage/image/TB3BWi41LGEQLWbI.jpg <comment><USER2> > designs and front-end code can live side-by-side in the docs

This one sparked an idea. We all know that it's really hard to automatically convert designs to code (eg. React components). Right now the only feasible way is to code it manually.

If you are able to import and show designs side by side with real React components using Storybook, would it make sense for you to tackle diff- checking between those two, making sure the design is coded correctly?

<comment><USER3> There's a Hard Problem here, and it's that in order for this to work, there has to be 100% parity between the component breakdown on the design side, and on the development side.

In theory this doesn't sound too bad, but in reality, it's very difficult to know exactly which bits of the UI are going to become a component in code, before implementation.

Therefore, there's a very high likelihood that the visual components coming from design are not going to cleanly align with the implemented components in Storybook.

<comment><USER4> I think there's a general issue with design at startups— the actual products of most design departments are "jpgs", and so most professional designers are really professional jpgers. This means designers are part of an upfront handoff process and not active participants in feature development.

I think the only recourse is to hire designers who understand how to interact with a UI component framework in code, and have design be a code stubbing process not a jpg producing process.

This does require for your design department to be built upfront to handle this kind of process, good luck trying to retrofit existing design departments codified around "jpg handoffs" to work with an implementation level source of truth.

<comment><USER5> It's worth noting that Design is a pretty broad term, and not a jpg department. There are various subsets of designers such as:

\- UX Designer: How it functions

\- Visual Designers: How it looks

\- Interaction Designers: How it behaves

\- Product Designers: Hybrid UX Designer, but with a focus on company goals, similar to a Product Manager.

Of course hyper specialization isn't necessary in tiny startups, but it is for larger orgs. Similar to engineering, it isn't necessarily feasible nor reasonable to have one person be an expert in every domain.

And if you _do_ know someone who knows everything, they'll also know they're a unicorn and charge accordingly.

I do agree that familiarity with the tech stack is very useful, but beyond that I'd argue its best to let those focus on what they do best.

<comment><AUTHOR> > I do agree that familiarity with the tech stack is very useful, but beyond > that I'd argue its best to let those focus on what they do best.

+1

</comment></comment></comment></comment></comment><comment><USER6> Super cool guys. Congrats on the launch. You're touching on a big pain. Will most definitely give it a try within our upcoming re-design of our app. [1]

By the way, if you're a remote team, I'm happy to talk with you guys and get in touch [2], love what you built. Sick landing page.

[1] [https://standups.io](https://standups.io)

[2] jp at standups.io

<comment><AUTHOR> Thanks! Standups looks great but we're currently non-remote :)

<comment><USER6> Thanks Jerome. And sure, no worries. I thought you'd probably had a few people working remotely apart from the office :)

</comment></comment></comment><comment><USER7> It irks me when a page's minimum width is wider than my phone's screen. I am still using an iPhone SE (I just did a warranty trade-in for a brand new one and I have no intention of "upgrading" soon) and these pages feel under- designed. The "floating" feel that comes from the page sliding back and forth as I scroll is not quite as bad as when the content is chopped off (e.g. elm- lang.org). The iPhone 5/SE dimensions are still available in responsive mode (at least for Firefox) so it seems like a choice to omit this use case from the design consideration.

</comment><comment><USER8> Confluence sucks for requirements, design capture even for software development but alternatives that are focused purely on design are rare. You should try and expand into design capture for SW development as well.

<comment><AUTHOR> As in front-end engineering? Or software _architecture_ design? If you mean front-end then this is already something we enable as we have integrations with front-end coding tools like Storybook and have plans to build on that :)

<comment><USER8> Meant software _architecture_ design :) Usually no one builds frontends in isolation. So will be good to have something e2e in one place.

<comment><AUTHOR> Got it, thanks for clarifying!

</comment></comment></comment></comment><comment><USER9> We've been using zeroheight at Modern Treasury and are big fans thus far. It's clearly built for design versus other platforms we considered, and was way easier than building something ourselves.

<comment><AUTHOR> Thanks for your support! :)

</comment></comment><comment><USER10> My first question was to ask if we could style the design guide itself to our design system, and of course you make that possible under 'Styleguide settings'. Fantastic, looking forward to using it! Congratulations on your launch.

<comment><AUTHOR> Cheers Omar! Looking forward to your feedback :)

</comment></comment><comment><USER11> When I read "design docs that stay up-to-date" I thought you meant system architecture docs that integrate with AWS, Azure, GCP, DBs, etc. I hope someone builds that.

<comment><AUTHOR> That does sound useful! Yeah I now realise the title is ambiguous :S

</comment></comment><comment><USER12> That's really nice. Well done.

<comment><AUTHOR> Thank you :)

</comment></comment><comment><USER13> So cool to see you guys go from strength to strength since the old days in our EF cohort!

Onwards and upwards!

<comment><AUTHOR> <3 Hope all is well with you!

</comment></comment><comment><USER14>
      in London

Will you be needing "boots on the ground" in SV later?

<comment><AUTHOR> Maybe :) TBD!

</comment></comment><comment><USER15> This is a pet peeve of mine, but I really hate when products like this don't affix a prefix to their tool description.

As in this isn't a "design" tool. It's a "front end" design tool or "UI/UX" design tool.

I may be flamed for this opinion, but seriously, stop referring to GUI/front- end design as just "design." There are a lot of people that are designing different things and it sucks when we search for new tooling and only get the next GUI tool.

Like when I read your title, my first instinct was that it was a CAD/EDA tool.

edit: <\gripe> this is a really cool product idea and clean implementation from the looks of it. imho quality/easy docs are the difference between loving a job and burnout!

<comment><AUTHOR> I agree with you and to be honest this is something we get picked up on often when talking to people outside the (UX) design world... we're just so used to people using the term like that in our space that we forget!

> imho quality/easy docs are the difference between loving a job and burnout!

That's a great quote :)

<comment><USER16> FWIW, in the title I parsed "design" as a verb, so I thought it was something like readme.io for more general documentation.

Cool product!

<comment><AUTHOR> Thanks for the feedback! Really helpful

</comment></comment></comment></comment><comment><USER17> wow!!!!!!!!!</comment>


Bending Your Computer's Keyboard to Your Needs - <AUTHOR> http://www.nytimes.com/2009/03/12/technology/personaltech/12basics.html

<comment><USER2> The floating arms keyboard sounds really cool.</comment>


The ultimate encryption guide against aliens and lizards, NWO. bilderbergs - <AUTHOR> 1. What kind of encryption types, schemas, modes, philosophies are? And pros/cons/uses of each? -entire disk encryption -encrypted containers -hidden volumes -file/folder level encryption (encFS) -container uploaded to the internets. Pros, cons? Any more types?
2. What to encrypt and how, where? What files should be encrypted and in what mode? Should all files, why? What files are most important to encrypt? Should web browser data be, how? Documents, projects?
3. What encryption software to use? Why? Pros cons uses? I wanna good interface (GUI) and user friendliness.
4. How to encrypt things like web browser or mail client profile/data? containers are mounted as separate partitions, so it's not possible. Need to use things like EncFS?
5. Any decent EncFS for windows? Or alternatives?
6. What happens when there is power loss? is everything safe except RAM (for minutes)?
7. What encryption? Or what chains? AES is backdoored or they have strong ASICS to bruteforce fast. There is a reason jewish Intel corp. has hardware acceleration of AES (ok maybe to steal keys, but maybe also other reasons).
8. What is the performance hit of encryption? Need strong CPU's?
9. Truecrypt container is shit as it's fixed size. So what then?
10. Encryption OPSEC.
11. Full disk encryption is shit. If one byte breaks, you are done. No way to fix filesystem, recover etc. I don't have enough space to do frequent full disk backups.
12. Can two factor authentication? Should?
13. What happens when you hibernate?
14. Is there an option to auto-dismount when unused for X time?
15. Should steganography my encryption file? How to? So for example my file won't be ENCRYPTED.tc but instead be hidden inside a PNG image or a mp4 video file (that will work as a video too) etc.
16. If not full disk encryption, what files directories should be erased often? Like temp dirs etc? So there is no copy of some evil files, caches etc <comment><USER2> yeah :)</comment>


JWT is Awesome - <AUTHOR> https://thehftguy.com/2020/02/18/jwt-is-awesome-heres-why/ <comment><USER3> Reasons why JWTs are not awesome:

\- to revoke a JWT you have to blacklist it in the database so it still requires a database call to check if it's valid.

\- JWT are to prevent database calls but a regular request will still hit the database anyway.

\- JWT are very large payloads passed around in every request taking up more bandwidth.

\- If user is banned or becomes restricted then it still requires database calls to check the state of user.

\- JWT spends CPU cycles verifying signature on every request.

\- JWTs just aren't good as session tokens which is how a lot of web developers try to use them as. Use a session ID instead.

Where JWT works best:

\- when a client can interact with multiple services and each service doesn't need to do a network request to verify (ie federated protocols like OpenID). The client verifies the user's identity via the 3rd party.

\- as a 1 time use token that's short lived, such as for downloading files where user gets a token requested from auth server and then sends it to the download server.

<comment><USER4> Don't blacklist, use shorter lived tokens and have the client refresh as needed. A 10-15m token is plenty long life and not so long as it's a huge risk window, more than even a shorter window,.

<comment><USER5> Stakeholder: "so you are saying that after a user is denied access they can still access the resources?" Dev: "yes, but only for 15 minutes. Also, it makes our system more simple and decreases database calls, increase performance, ..." Stakeholder: "nope"

<comment><USER6> Meanwhile on sales call with Microsoft:

"Authentication takes a few minutes to replicate throughout our systems so a SLO request should be resolved within a few minutes". Stakeholder: Ok sounds good

<comment><USER4> +1 on this... it can be up to a 30 minute lag in some orgs... oh, you have access to those systems for a while until things sync up... similar for LDAP/AD sync with Nix/windows.

<comment><USER7> Which makes sense when I think about how some of the more trigger happy orgs made a point of shutting peoples accounts of as they were being walked into a room...

</comment></comment></comment></comment></comment></comment><comment><USER8> Was about to write a rant that it's still not better than cookies & sessions, something that has been standard waay longer than JWT.

But this video says all I have to say (2018):

[https://www.youtube.com/watch?v=JdGOb7AxUo0](https://www.youtube.com/watch?v=JdGOb7AxUo0)

1 sec takeaway (More in the video):

[https://i.imgur.com/vUYTYfS.png](https://i.imgur.com/vUYTYfS.png)

That said, JWT's are great for stuff like 2-Factor via email link or redirecting from one domain to another. Single use, which it was built for.

<comment><USER9> That video is ridiculous. The whole time is spent talking about how cookies are superior to local storage which has little to do with JWT. You can use JWT and store it in a cookie. Session cookies are most certainly not automatically signed. Signing a session ID provides absolutely no value (signing claims, however, does). Revocation is exactly the same for both of them. JWT has a standard jti field for the session ID. I'm also not sure why you'd store all of a user's information in a JWT. You can just put in the minimal information to accomplish what you need.

<comment><USER8> If you cryptographically sign the session cookie, as suggested in the video, then you accomplish the exact same thing as a JWT token - so, then why use JWT at all, if you going to look up the session data from the database in any case.

JWT was meant to be stateless, if it's not, then it's just a layer of unnecessary complexity with potential security and implementation flaws.

<comment><USER10> depends on if need to call other apis like microservices, you can use the JWT on behalf of the user to request the contents from other services. JWT also introduces `scope` which determine services user consented and allowed your backend to call. These things are not supported by a simple session cookie.

<comment><USER11> I mean they're not supported OOB but you're just describing a session cookie with some signed metadata. If "the ecosystem" and interoperability with existing services is the goal then has the advantage.

If you're talking about something bespoke then it probably doesn't.

<comment><USER12> > you're just describing a session cookie with some signed metadata.

Isn't that JWT?

</comment></comment></comment></comment></comment></comment><comment><USER13> I'm always amused that with JWT, there never appears to be any separation between JWT-the-storage-format and JWT-what-I-do-with-it. JWT as a storage format is great indeed. If you pin the signing/encryption algorithm. Otherwise you shot yourself in the foot, which is bad, yes.

Everything else isn't JWT. Sure you can use it with OpenID/OAuth/whatever. Sure you can store them in cookies. Sure you can use them with or without sessions. But how is any of that related to JWT specifically?

One of the articles says with JWT I have to re-implement session management. Just use a different framework then. Sessions with cookies are also not magic.

Another article basically says you don't need OAuth 2.0 with access tokens and refresh tokens. Very true. Also not about JWT.

<comment> ben-schaaf > If you pin the signing/encryption algorithm. Otherwise you shot yourself in > the foot, which is bad, yes.

I recon if the library you're using doesn't force you to pin the algorithm (or opt out of pinning), your foot is probably already full of bullet holes.

<comment><USER14> Noob question, what is _pinning_ in the context of JWT?

<comment><USER15> Your question is a good one, and "pinning" is not a very appropriate term here. Whitelist acceptable algorithms by issuer, ok fine--you have to have a library of acceptable public keys or shared secrets to go along with each of the allowed algorithms anyway. The JWT consuming infrastructure here on top of jose4j uses a registry of keyinfo metadata to allow for provision of multiple expirable keys and supported algorithms for each authorized issuer, and I'm not sure why anyone would do it other than that way, really.

Disallowing the "none" algorithm is an important implementation detail, like, maybe your JWT library demands an environment value "JWT_ALLOW_UNSAFE_SIGNING_I_KNOW_WHAT_I_AM_DOING=1" or just doesn't support it in the first place. Maybe it was foolish to ever make any allowance for this in the first place.

<comment><USER16> > Maybe it was foolish to ever make any allowance for this in the first place.

Since JWT is used as a wrapper around data, it is possible that your needs will vary based on deployment scenario. In some cases, that data may need to be encrypted, in other cases only signed.

In some cases I may not need integrity protection/repudiation and am already sending over a mutually authenticated/encrypted channel. The implementations may not want signing to be forced on them, impacting their compute/data budgets - but they still want to write their standards to depend on a single data format.

In general there should not be a whitelist, but a precisely known strategy going into evaluation. This is because: \- unlike TLS, you likely have a relationship with the issuers \- unlike browsers, the different components are being validated against the domain

For JWKS-based distribution, that usually means that a key identifier maps to a specific issuer and to a specific validation strategy. If you supported CA- based trust models, that specific validation strategy should come from the certificates.

You shouldn't look at the public key data and decide based on the algorithm inside the JWT how to interpret it.

</comment></comment></comment></comment></comment><comment><USER17> [https://news.ycombinator.com/item?id=21785888](https://news.ycombinator.com/item?id=21785888)

      tptacek
      Credential attenuation in Macaroons is
      cryptographic; it's in how the tokens
      are constructed. I don't see the opportunity
      for a DoS (that didn't exist without
      attenuation already).

      Macaroons are a really lovely, tight,
      purpose-built design that happens to
      capture a lot of things you want out of
      an API token, including some things that
      JWTs don't express naturally despite
      their kitchen-sink design.

      JWT is more popular because there are
      libraries for it in every language, and
      people don't think of tokens as a cryptographic
      design (or nobody would be using JWT!), they
      think of them as a library ecosystem. JWT
      is definitely the stronger library ecosystem!

      This is also why I probably wouldn't ever
      bother recommending PASETO. If you're sophisticated
      enough to evaluate token formats based on their
      intrinsic design, then you should implement
      Macaroons if possible (it's almost always possible).
      If you're not, then you're going to use JWT.

<comment><USER18> I'd never heard of macaroons. Here is a website:

[http://macaroons.io/](http://macaroons.io/)

I note that the logo depicts macarons [1], rather than macaroons [2].

A parent comment also mentions PASETO:

[https://paseto.io/](https://paseto.io/)

Sadly, a paseto does not appear to be any kind of biscuit.

The PASETO site links to this searing indictment of JWTs and related things:

[https://paragonie.com/blog/2017/03/jwt-json-web-tokens-is- ba...](https://paragonie.com/blog/2017/03/jwt-json-web-tokens-is-bad-standard- that-everyone-should-avoid)

I am far from qualified to evaluate any of these!

[1] [https://en.wikipedia.org/wiki/Macaron](https://en.wikipedia.org/wiki/Macaron)

[2] [https://en.wikipedia.org/wiki/Macaroon](https://en.wikipedia.org/wiki/Macaroon)

<comment><USER19> Off topic: it gives me undue vexation that there are two dessert items with names so similar to each other that everyone keeps confusing them. Can we just all agree to come up with a new name for one of them?

<comment><USER18> To be fair, there is a similar situation with "cookie", which means any kind of small, flat, compact, unleavened flour-based sweet baked item in the USA, but more specifically a particular soft kind in the UK.

And conversely, "biscuit", which has the former meaning in the UK and means some sort of weird scone in the USA.

</comment></comment></comment></comment><comment><USER20> JWTs have made client side auth integrations look better. But the problem is that common security considerations and implementation details are generally overlooked.

1\. Tokens are typically stored in localStorage. (app becomes vulnerable to CSRF & XSS attacks).

2\. Tokens can be stolen. Now this is generally controlled by having a very short expiration time.

3\. Short expiration times mean persisting refresh tokens to do a silent refresh.

4\. Blacklisting of tokens adds complexity and defeats the purpose of decentralising the auth workflow.

5\. There's technically no logout. It's all done via very short expiration times. With multiple tabs open, logging out on one tab needs to be synced with rest of the tabs via some event listeners.

6\. SSR rendered pages need to send along the latest refresh token cookie so that the browser can use it.

7\. The refresh token is sent by the auth server to the client as an HttpOnly cookie to prevent XSS/CSRF.

My colleagues wrote a detailed guide which goes through these considerations - [https://hasura.io/blog/best-practices-of-using-jwt-with- grap...](https://hasura.io/blog/best-practices-of-using-jwt-with-graphql/)

<comment><USER21> > With multiple tabs open, logging out on one tab needs to be synced with rest > of the tabs via some event listeners.

that's a problem with every site in general, which doesn't use any kind of event listeners.

<comment><USER22> Well, yes, but it's not exactly the same. Session-based logout (or JWTs with blacklisting) automatically protect resources that haven't been fetched yet, but leave open the possibility of lingering previously-fetched resources. JWTs without a blacklist even leave open the possibility of fetching additional resources with a supposedly logged-out credential. That seems like a much bigger hole.

<comment><USER21> For me blacklisting is bad idea in general. It can be achieved without blacklisting downsides by using asymmetric keys per user. Where you could rotate keys after things like logout or password change. Keys might be stored in replicated storage, same as session, and deleted/rotated as needed.

Don't get me wrong, JWT it's not silver bullet nor it was meant to be one in first place. It's not session replacement, but there are places where right implementation makes lot of sense.

</comment></comment></comment></comment><comment><USER23> Counterpoint:

[https://paragonie.com/blog/2017/03/jwt-json-web-tokens-is- ba...](https://paragonie.com/blog/2017/03/jwt-json-web-tokens-is-bad-standard- that-everyone-should-avoid)

<comment><USER24> I'm impressed that you put your money where your mouth is and built & marketed an alternative: [https://paseto.io/](https://paseto.io/)

Anyone here got experience using Paseto in anger? (besides CiPHPerCoder who made it)

I would love a JWT-like thing that's equally common yet better designed. But especially when using it in public APIs and the likes, acceptance has to be pretty broad. Anyone got insights as to how mainstream Paseto is getting?

<comment><USER25> Judging from the number of stars of the various git repositories for different languages, there are a few people using it but not a whole lot. The most popular implementation seems to be php based. That suggest to me it's still early days for this. E.g. the Java implementation only has 13 stars, which is not a lot. Also it has a native dependency, which is not ideal. E.g. JWT has a pure Java implementation from oauth0.

JWT has been out there for a few years and there are many uses of it that are fine. I've used it in the past and it was easy set up and get started with. The main criticism seems to be that users have too much wiggle room to do silly things like using alg=noneor that certain widely used algorithm combinations have some weaknesses. I guess that's valid but not a huge concern if you know what you are doing.

Paseto looks like it improves by narrowing down the choices to some sane choices, which is a valid approach. Of course IETF could update the relevant RFCs to use the same algorithms for JWT at some point.

<comment><USER26> Popularity != value. Get over false signals.

<comment><USER27> As soon as AWS supports PASETO we can talk, until that time popularity equals value.

<comment><USER23> Give me a few months, then. :P

If they agree it's a good idea, it should pick up quickly.

<comment><USER26> Don't count on it. As it happens, I used to be a AWS consultant w/ a third- party preferred vendor. Their product direction involves more politics, job security and creating a labyrinthian platform that's difficult to emulate precisely.

</comment></comment></comment></comment></comment></comment></comment><comment><USER28> Can we finally stop conflating an encoding/signature/encryption method with a transport/storage mechanism?!

<comment><USER9> Apparently not

</comment></comment><comment><USER29> JSON Web Token [1]

[1] [https://en.wikipedia.org/wiki/JSON_Web_Token](https://en.wikipedia.org/wiki/JSON_Web_Token)

</comment><comment><USER30> Everytime I see a headline with "JWT" in it, I get excited hoping that it is for "JWt" [1], the "Java Webtoolkit", which I love. It happens when I search for it as well, I look for "Jwt ..." and instead of the beloved toolkit, it comes up with all these json web tokens and HMACs. Aaah, well, I'll keep looking for that wonderful day when it really is the toolkit. I guess it goes without saying that, I recommend it highly.

[1] [https://www.webtoolkit.eu/jwt](https://www.webtoolkit.eu/jwt)

<comment><USER31> Thank you, looks interesting. GPLv2, if anyone is curious.

</comment></comment><comment><USER9> A couple more points

* Why wrote your own format when JWT already has predefined keys. If you write your own encoding format instead of crappy JWT interoperability you have none and have to write everything from scratch

* If you're following API first using cookies for machine to machine API interactions is ridiculous (cookies are for browsers and humans)

* JWT being fairly standard plays nice with load balancer a/auth proxies/API gateways which can off load auth or even route it before hitting the application (database calls are expensive compared to in memory cached auth and you probably have an LB anyway)

</comment><comment><USER32> This article is conflating the benefits of a particular way of doing implementation, and JWT as an implementation of that approach to authentication. That's dangerous because it n discourages people from thinking carefully about the semantics involved. Authentication is a topic where the trade-offs should be carefully evaluated for your particular situation.

I do agree that if you need the particular way of doing authentication that JWT is designed for, JWT is indeed a great implementation and can save you a lot of time.

</comment><comment><USER33> "9) Myth: JWT doesn't support logout or invalidation. (It can with OpenID Connect)"

Iterating on how invalidation work with OpenID Connect when in a point before the author said an authentication service which can go down is a single point of failure you should avoid. So he added a spof by using openid connect...

<comment><USER34> It's all about trade offs. If you want full session management, not everything can be decentralized. People often say that JWT can't handle sessions at all so I am merely explaining that it actually can out-of-the-box and how to make it work.

Anyway, there is always a single point of failure somewhere. There's got to be something that authenticates users and creates tokens in the first place.

</comment></comment><comment><USER35> The string 'JSON Web Token' doesn't appear anywhere on the web page. If you're going to use an acronym expand it out the first time you use it.

<comment><USER36> Like JSON? I think for some acronyms, JSON and JWT included, those are their "proper" names, with the expanded name being just a curious historical note.

<comment><USER37> I'd say it's good writing to link to the wiki entry for a less common concept like JWT in the first paragraph, right next to where they first mention it. It's definitely not ubiquitous like JSON, SQL, or FBI.

<comment><USER36> Right, linking to the wiki makes sense. I just don't think expanding the name gives you anything.

</comment></comment></comment></comment><comment><USER38> JWT is great for some use cases but if you need auth to be very centralized, just use one of the existing auth mechanism instead of bolting it on top of JWT. I don't see what would be the point of using JWT if you need highly centralized auth.

Where JWT shines is when the auth service does not need to know the clients that might want to authenticate using it. A system where it can issue tokens to any other service on behalf of a user and say, "here you go, you can use this for the next N minutes". This is very useful when it's not practical for every service/client to "register" itself with the auth service before hand like oauth.

</comment><comment><USER39> I highly recommend watching "Deconstructing REST Security" by David Blevins: [https://www.youtube.com/watch?v=9CJ_BAeOmW0](https://www.youtube.com/watch?v=9CJ_BAeOmW0)

</comment><comment><USER40> JWT is not awesome. I spent yesterday implementing it. The smallest usable JWT I could create was 137 bytes, not including the Authorization header.

This is absurd -- the total amount of data I needed to store in the JWT was about 10 bytes.

This inefficiency bloats requests. At a time when we're migrating to http/2, which which deliberately reduces headers to speed things up, JWT is going in the other direction.

<comment><USER41> An organization I was at in the past attempted to use them as a replacement for sessions, which turned out to be a terrible idea as I suspected it would.

I've found that arbitrarily re-inventing the wheel because a new thing becomes popular should be done deliberately and with great caution. More generally - <USER2> think it's important to look for solutions to fit a specific problem, not problems to fit a specific solution.

However, back to JWTs - I'm currently using them for authorization in an EXTREMELY high traffic websocket server implementation. It's really nice because it's short duration (the ones I am issuing have a expiration of 60 seconds), and allows the service to operate entirely within memory except for interacting with a Kafka cluster.

<comment><USER34> Author. I wouldn't recommend to do less than 2-5 minutes. Some OpenID Connect providers actually ignore token expiry time silently when it's below a couple minutes.

Consider that host clocks are not always in sync (even NTP could leave 10 seconds of difference) and the many authentication redirections can take quite a bit of time for slow clients. Limiting tokens to 30 or even 60 seconds is asking for troubles.

But then again, I have to work with thousands of hosts, applications and datacenters, so I feel every edge cases. A single application on a single host would not.

</comment></comment></comment><comment><USER42> While HN is full of Javascript enthusiasts who would never dare mentioning anything negative about the language making praise of JWT probably redudant, even if the token mechanism and the language are complete separate issues, I have to state that I also think JWTs to be helpful.

I mostly use them in IOT voice enabled devices that get their time limited authorization to access popular voice services through such a token. Voice enabled devices suck, but that is not the fault of JWT. I think without JWT being that common already, we wouldn't have a situation where a devices need to sign requests against voice services and we would have additional security concerns.

It is a given that you can use a complete different token or other cookie mechanisms that work just as well. But I like them to provide at least some common ground. Even if there is valid criticism about the implementation.

Authentication != authorization should always be mentioned on the topic of JWT. And yes, they are often abused to do things beyond their intended scope. I would think this to be a user error.

</comment><comment><USER43> I would be interested in opinions on the approach taken by Laravel Airlock. It seems to be a hybrid approach between stateless auth and session.

[https://laravel.com/docs/master/airlock](https://laravel.com/docs/master/airlock)

</comment><comment><USER44> JWT always felt a bit strange to me. The fact that we pass user attributes back and fourth from the client feels more like evidence of flaws in the web as a platform than it seems like a real solution.

</comment><comment><USER45> I agree JWT can be very useful, but its implementations are unfortunately all over the place in terms of what algorithms they support, especially lacking in the asymmetric space. Also the docs are pretty bad—spread out over multiple documents, with no explanation of the basic concepts, and they assume a lot of pre-existing domain knowledge.

And then you still have to use JWTs correctly which is very easy to screw up. OIDC has improved this situation somewhat, at the cost of another layer of even more complexity that's easy to screw up.

</comment><comment><USER46> JWT - because you were told sessions and cookies aren't cool anymore.

Then you come to realize that JWT is basically pointless except for doing MFA (which you could probably have done with a random token).

</comment><comment><USER47> Nitpick: on point 10)

      cause issues down the lime.

"lime" is a typo, should be "line"

<comment><USER34> Good catch! fixed.

</comment></comment><comment><USER48> Another Pro is that they can be read client-side, so the server and the client have an agreement on who the user is and what their attributes are (if they are defined in the JWT payload).

</comment><comment><USER49> JWT can be used as cross server auth

sign in on www.example.com -> click visit www.example2.com while being logged onto accout based on example

</comment><comment><USER50> would you secure api via JWT? Session token are not an option, basic auth can be an alternative.

<comment><USER34> JWT works well. Securing API is one of its main use cases.

That being said. Please do NOT use basic auth for anything in 2020. This is the worst anti-pattern one could do for authentication.

Basic auth simply transmits the username and passwords in clear text with every request. No application should be receiving username and password in clear text besides a single auth service. The passwords will get leaked all over the place between developers debugging, verbose logs, exceptions, etc... And unlike tokens that are meaningless and expire, textual passwords last forever and are extensively re-used by user across websites.

</comment></comment><comment><USER51> JWT is for when you really really need to re-invent certificates.

</comment><comment><USER52> "Pro: JWT is secure"

Yes, but I see a lot of implementations where the token is sent to JavaScript and is stored there.

It's best to store it as secure cookie (HttpOnly) so JavaScript cannot access it.

</comment><comment><USER53> What's a JWT?</comment>


What is the best way to learn to code from absolute scratch? - <AUTHOR> We have been hosting a Ugandan refugee in our home in Oakland for the past 9 months and he wants to learn how to code.<p>Where is the best place for him to start from absolute scratch? What resources can we point him to? Who can help? <comment><USER2> Here's an answer to a similar question: "Ask HN: How to introduce someone to programming concepts during 12-hour drive?" [https://news.ycombinator.com/item?id=15454421](https://news.ycombinator.com/item?id=15454421)

[https://learnxinyminutes.com/docs/python3/](https://learnxinyminutes.com/docs/python3/) (Python3)

[https://learnxinyminutes.com/docs/javascript/](https://learnxinyminutes.com/docs/javascript/) (Javascript)

[https://learnxinyminutes.com/docs/git/](https://learnxinyminutes.com/docs/git/) (Git)

[https://learnxinyminutes.com/docs/markdown/](https://learnxinyminutes.com/docs/markdown/) (Markdown)

Read the docs. Read the source. Write docstrings. Write automated tests: that's the other half of the code.

Keep a journal of your knowledge as e.g. Markdown or ReStructuredText; regularly pull the good ones from bookmarks and history into an outline.

I keep a tools reference doc with links to Wikipedia, Homepage, Source, Docs: [https://wrdrd.github.io/docs/tools/](https://wrdrd.github.io/docs/tools/)

And a single-page log of my comments: [https://westurner.github.io/hnlog/](https://westurner.github.io/hnlog/)

> To get a job, "Coding Interview University": > [https://github.com/jwasham/coding-interview- > university](https://github.com/jwasham/coding-interview-university)

<comment><AUTHOR> Wow, thank you so much. This is incredibly useful.

</comment></comment><comment><USER3> If you do not know any code, I suggest the MIT free online college. [https://ocw.mit.edu/index.htm](https://ocw.mit.edu/index.htm) Explore this. As to the particular initial language, I suggest you browse this search. [https://www.google.ca/search?ei=4hR2WoPPM- zQjwSnoaTQBw&q=bes...](https://www.google.ca/search?ei=4hR2WoPPM- zQjwSnoaTQBw&q=best+newbie+code+2017&oq=best+newbie+code+2017&gs_l=psy- ab.3...107950.114637.0.115184.108.40.206.0.0.0.103.595.3j3.6.0....0...1.1.64.psy- ab..0.4.394...0i22i30k1j33i22i29i30k1j33i21k1j33i160k1.0.QyGmJB0uYmc)

<comment><AUTHOR> Thanks, this is great.

</comment></comment><comment><USER4> Freecodecamp.org is awesome!

<comment><AUTHOR> Sweet. Passing this along to him.</comment></comment>


Why do we still shame adults who live with their parents? - <AUTHOR> https://www.theguardian.com/commentisfree/2018/feb/28/michael-b-jordan-live-with-parents-millennials-shame <comment><USER2> Why do we do it? America was literally founded on the idea of independence. That idea got turned into a personal virtue embedded into every citizen that was born and raised or immigrated here to "make it".

The independent spirit was commercialized capitalized on by advertisers and used as a way to sell us things. Houses with big yards in a quiet neighborhood, two cars, family vacations - all paid for by the sweat off your own back. Your value as a citizen and person was measured by how many things you could provide for your direct family.

We should adopt a more family-centered valuation of life (and not just the nuclear family, but extended family and 'found' family as well). But we won't. Somehow Americans have this idea that sacrificing something for someone who isn't your chosen partner or offspring is bad, and accepting help by anyone else is a sin.

It will be interesting to see how things will turn out in the next 25-50 years. People are becoming increasingly hyper-connected and at the same time mental health issues directly related to loneliness and depression are rising [1]. Will the new generation(s) finally reject the "American Dream" work ethic and self-reliance? It seems like it may be the only option moving forward.

[https://www.sciencedaily.com/releases/2017/08/170805165319.h...](https://www.sciencedaily.com/releases/2017/08/170805165319.htm)

<comment><USER3> I was in Mexico not too long ago at a friend's hacienda. Our conversation turned towards the frequency of multi-generational housing arrangements in Mexico versus the U.S. His explanation? Trees. The U.S. has always had an abundance of cheap lumber. Not so in Mexico. Consequently, houses are built of stone (or, more recently, cinder block) in Mexico. They have the potential to last centuries. The U.S. houses, on the other hand, are stick-frame wooden structures that won't last even the lifespan of the owner.

The upshot is that there is no great attachment to the home in which you were raised for an American; it will be eaten by termites or blown over in a storm long before your kids are born.

In Mexico, though, the house in which you were raised will be standing long after your parents are gone. And, if you stand to inherit it, there's no point in moving out.

Just one of many factors, of course. But, I enjoyed his immediate answer... it was very obvious to him.

<comment><USER4> > The U.S. houses, on the other hand, are stick-frame wooden structures that > won't last even the lifespan of the owner.

I'm... confused about this. Our house was built in 1912 making it about 106 years old now. Sure - things have needed to be upgraded - gas lamps to fuses to breaker panel; single pane windows to double hung double pane; coal heating to gas furnace, etc... but the frame is still solid. Nothing is 16 inches on center, hahahaha (hahah :( ), but even the hard wood floors are original. A sanding and a re-stain / poly and their just as good as new.

<comment><USER3> When discussing populations of 300+ million, generalizations are to be expected.

</comment></comment></comment></comment><comment><USER5> Our economy wants for everyone to have their own place. Companies lose sales if multi-generations share items. Look at advertisements and you'll see them emphasize the 1 generation home.

It wasn't always that way. The 20th-century economy and advertisement brought that to fruition.

We don't give the adman enough credit for the shape of our society. Advertisements are very powerful in shaping how we live but they only care about profits, not the overall impact.

</comment><comment><USER6> It's not "adults who live with their parents" who are shamed, but specifically men. For women, it's completely acceptable and probably even "proves" that they're more responsible than men.

Must be male privilege.</comment>


Ask HN:  Thoughts on 40Billion.com - <AUTHOR> http://40billion.com/

<comment><USER2> The clip art all over the site makes me feel like my email will get sold the second I register.

<comment><USER3> The handshake picture is positively _chilling._ Does anybody respond well to such imagery these days?

<comment><USER4> According to A/B testing I have seen: yes. (Ditto the ubiquitous "cute girl with a headset".)

<comment><USER5> Wasn't there an entire image gallery site dedicated to cute chicks with headsets?

<comment><USER4> You must mean headsethotties.com

</comment></comment></comment></comment></comment><comment><USER6> My opinion. 1\. Most professional investors are overwhelmed by proposals. Not lack of it. 2\. Even on seed level, i'm not sure if i want to invest in a company through social network. I would prefer something more personal if i want to pick a company. And, referral often is the key to that. If you can't connect yourself up to the investors, i would say, you haven't tried hard enough. 3\. As an entrepreneur, i don't think i feel comfortable to expose everything that i have in the arsenal to the social network (especially strategy etc). It's one thing to be paranoid, it's another to be totally open- source! But, if you don't do that, how can investors pick you over the other through that massive companies in the social-networks?

It's still a nice try though. Would like to see how it goes.

</comment><comment><USER7> Advice: Make it do one thing well before you ad a job search and all this other stuff.

I don't think I'd use this for a serious business, but I might use it if I needed 10,000 for some little project.

</comment><comment><USER8> Check out Angelsoft and Kiva and figure out how you differentiate yourself from them.

</comment><comment><USER9> buy nicer stock photography</comment>


US Education system must compete with China, India: Obama - <AUTHOR> http://news.rediff.com/report/2009/jul/15/edu-system-must-compete-with-china-india-obama.htm <comment><USER2> The article is a bit short on details of Obama's policy initiative, here's a link from the White House:

[http://www.whitehouse.gov/the_press_office/Excerpts-of- the-P...](http://www.whitehouse.gov/the_press_office/Excerpts-of-the- Presidents-remarks-in-Warren-Michigan-and-fact-sheet-on-the-American- Graduation-Initiative/)

While the rhetoric is good, the realities are far more complex and I don't see much in this plan that addresses deeper, long-term rot in the system of American higher education. Watch the documentary "Declining by Degrees" to get a big-picture assessment. Major problems: costs that are spiraling out of control (outpacing inflation for decades), incentive structures for professors that largely ignores students and student learning (e.g. research papers that few read versus teaching well), no agreed-upon evaluations of what students are actually learning, and broadly declining standards at all levels (e.g. increasing numbers of remedial classes for entering high school students, grade inflation in college to retain students).</comment>


Pokémon Go Is Not Good Enough - <AUTHOR> https://medium.com/@bozhobg/pokémon-go-is-not-good-enough-e251475d268 <comment><USER2> > I cannot avoid the comparison to Ingress, the first popular game of this > kind.

Interesting comment as Ingress and Pokemon Go are both developed by Niantic, Inc. So maybe what is a "bad" game design decision that makes it less fun is just a good business decision for some reason that only Niantic knows.

<comment><AUTHOR> Exactly. Niantic apparently knows how do to things. Or at least they knew</comment></comment>


ProtonMail DDoS Attacks Are a Case Study of What Happens When You Mock Attackers - <AUTHOR> https://www.bleepingcomputer.com/news/security/protonmail-ddos-attacks-are-a-case-study-of-what-happens-when-you-mock-attackers/ <comment><USER2> After watching Lavabit and other encrypted services of America get shutdown. I wouldn't be surprised if the group is being funded by the NSA or other government programs that hate these services for the near absolute privacy. Sure this is just a theory, but there is reason with it. Protonmail has been under attack since its conception. Corrupt government hate the very idea of it.

</comment><comment><USER3> If there's something I've learnt of irc is that you don't taunt those who can bring your connection down. Maybe this will teach these kids from ProtonMail a lesson.

<comment><USER4> > kids

Yeah, all those CERN researcher kids at ProtonMail.

<comment><USER5> One of the PIA co-founders made a pretty convincing case that protonmail is probably not ran by a bunch of CERN researchers.

[https://news.ycombinator.com/item?id=17258203](https://news.ycombinator.com/item?id=17258203)

<comment><USER6> The argument is that ProtonVPN is run as a joint venture between Protonmail and the people who run NordVPN. It states nothing about Protonmail.

<comment><USER7> This is also not true. ProtonVPN and ProtonMail are not related to NordVPN in any way. The only possible "connection" if you can call it that, is that we might use some of the same server providers (Leaseweb, Amazon, OVH, etc).</comment></comment></comment></comment></comment>


Attack of the Cosmic Rays - <AUTHOR> https://blogs.oracle.com/ksplice/entry/attack_of_the_cosmic_rays1 <comment><USER2> This happened to me many years ago. All of our sites (asp classic) on a single server went down at the same time. We had a library we shared across them all that handled some of the db interactions. We discovered that all of a sudden a sql query had the letter 'a' replaced with a 'q' (ie 01100001, vs 01110001).

I like to think my afternoon was sidetracked by cosmic radiation from millions of years ago :)

<comment><USER3> _"All of our sites (asp classic) on a single server went down at the same time"_

Honest curiosity here (I'm not judging): you were running several sites on a single server that didn't have ECC RAM but regular RAM?

Did you then switch to ECC?

I like the thought about radiation from far away in space and time : )

<comment><USER2> I'm fairly sure we didn't, no. It was a small agency and we were all pretty junior.

</comment></comment></comment><comment><USER4> For more on this topic, see DRAM errors in the wild: A Large-Scale Field Study <http://www.cs.toronto.edu/~bianca/papers/sigmetrics09.pdf> and Cosmic rays don't strike twice: Understanding the characteristics of DRAM errors and the implications for system design <http://www.cs.toronto.edu/~bianca/papers/ASPLOS2012.pdf>

I think there's another one from MS based on Windows error reporting, but I can't find it.

<comment><USER5> This might be the Microsoft paper you're referring to: [http://research.microsoft.com/pubs/144888/eurosys84-nighting...](http://research.microsoft.com/pubs/144888/eurosys84-nightingale.pdf)

I worked on one of the Windows Error Reporting (WER) server components that detected memory corruption from bluescreen memory dumps submitted to the WER service. It's a debugger extension called !chkimg ([http://msdn.microsoft.com/en- us/library/windows/hardware/ff5...](http://msdn.microsoft.com/en- us/library/windows/hardware/ff562217\(v=vs.85\).aspx)). It compares the executable code in the memory dumps with the actual binaries that Microsoft shipped and flags differences between the two. This way you can tell what code was actually running on the machine vs what it should have been running. It was quite effective at detecting corruption patterns this way. Usually one-bit corruptions (just a single bit flip) and stride patterns (i.e. one corruption after every 4, 8, 16 or 32 bytes etc) were a good indicator of hardware problems.

</comment></comment><comment><USER6> Common way to detect memory errors in practice (i.e. how it can easily beat you) is by compiling stuff, the bigger the better. When you see the famous

        Internal compiler error

it may be caused by some memory problem.

A few years ago I was doing lot of Linux kernel builds. My desktop computer, which is Athlon 64 X2 4600+ and 2x GeIL PC2-6400 DDR2-800 C4 ULTRA DUAL CHANNEL (2x1GB each; 4GB total), was doing make -j6 (or -j8, don't remember now) of kernel one after another. After many many hours some builds started to failing with mentioned error. Let's say 1 of 4. I had to do it, so I was repeating make (automatically) till it succeeded, but later I fiddled with memtest86+. It was running day and night on all 10 tests (I believe that was test count back then) and something popped up finally (I wasn't checking it constantly) [1]. But you know what? When I switched to showing badram patterns later and the problem reappeared, it was red line without any pattern! I used to see some addresses and such whenever error was detected by memtest (or experience computer halt, etc.), but that time I had seen nothing - it was quite enigmatic. I've checked memtest sources and test 5 was filtered out from showing badram patterns as apparently not being reliable. I changed it (I've just found the changed sources on the disk and diffed it to the original release [2]), recompiled the memtest and run it again. I got badram patterns this time [3].

I needed BadRAM patterns to secure myself from being constantly hit by this memory problem, but I don't remember whether I used them in the end.

I still use this computer. No big compiles, no big problems, but sometimes I get the iffy feeling. :) I had a few BSODs since then and I believe they were caused by this memory problem. Haven't seen its manifestation for a long long time. Maybe my computer was simply overheated back then? Since then I'm much more into checksums than I used to be...

      [1] http://i.imgur.com/RMhCOLM.jpg
      [2] https://gist.github.com/przemoc/5250861
      [3] http://i.imgur.com/jFHZkVA.jpg

<comment><USER6> Another thing I don't really remember is that BadRAM thing. When I fiddled with it [1], memmap [2] was already there, but for some reason I wanted to use BadRAM or maybe I was unaware of it. BadRAM wasn't present for the kernel I was using, so I attempted porting it to my 2.6.32 one. In the end I haven't really tested it, I guess, had to move on with other things.

Now I remembered something! Some time later I tried contacting Rick van Rein, thinking that maybe he would be interested in a new version of the patch, or rather he could review it and I would learn something, but I never got the reply from him.

I hope my attempt isn't too embarassing, yet can be interesting for someone, so I just published my mail to Rick with the attached patch [3]. Feel free to show me how wrong I was in my poor "refinements" of the original patch! I would be more than happy (even though I'm not into kernel now at all) to get constructively bashed about it.

      [1] http://rick.vanrein.org/linux/badram/
      [2] https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/plain/Documentation/bad_memory.txt
      [3] https://gist.github.com/przemoc/5251104

</comment></comment><comment><USER7> Lovely read and educationaly. Also an area most overlook and why reboot mentality whilst solving this issue would not make you any the wiser. Why I always enjoy bluescreens of death, though they become non exsitent once you spot the guilty driver or hadware firmware or bios update or card moved to another slot so does not share DMA, etc... But always worth it in the end for stability.

I had a system once that would have memory errors after being run for 5 days, could thrash it for anything upto 5 days without any problem and after that would get memory errors. If restarted the memory errors would return. Basicly turned out this memory would overheat after 5 days of slowly building up the heat, though a hour turned off would resolve it. That was a fun RMA given most would soak test for 3 days :(. Cheaper memory won out in the end just fine and never had a problem with it.

As for single bit errors, well had fun on many a ISDN line which would get the odd error, not on networking thats fine, error correction. On realtime video, you see it. Then if a line gets so many errors it shuts off, you call up the teclo, they run diagnostics and all is fine and its suddenly working again. As part of running the diagnostics it turned out the diagnostic software would reset the error count, run diagnostics and be within tollerance. Over time the errors would increase the counter until it hit a threshold and the line would go down.

Moral being howeve hard you look into a problem you will still come across those magic moments and remember bit happens.

</comment><comment><USER8> djb has been preaching this for a while. It's amazing to me how much computer hardware trusts itself:

<http://cr.yp.to/hardware/ecc.html>

</comment><comment><USER9> Interesting, I've got 16GB on my desktop machine (ECC) and it has reported a correctable ECC error about three times in probably 18 months of run time.

</comment><comment><USER10> I would have left a comment on the main article, but it asked me to solve 3+53 as a captcha, and expr kept segfaulting for some reason.

</comment><comment><USER11> I remember a guy sitting at the next desk to me spending a whole week trying to figure out why his Direct3D code crashes. He was blaming buggy ATI drivers. He figured it out when eventually a bit flip ended up in his _source code_.

</comment><comment><USER12> [http://nakedsecurity.sophos.com/2011/08/10/bh-2011-bit- squat...](http://nakedsecurity.sophos.com/2011/08/10/bh-2011-bit-squatting- dns-hijacking-without-exploitation/)

Great article on "how bit-flipping in memory chips or CPU caches can also cause you to visit a wrong domain that may be one character off from the real one." I think I remember seeing it on HN awhile back.

</comment><comment><USER13> Just as crazy -- random network packet corruptions that get past the simple checksumming.

<comment><USER14> It's quite common for TCP stream to let corrupted data through, because of 16 bit CRC. Start moving large compressed files (gigabytes) and you'll find that out the bad way.

<comment><USER3> _"Start moving large compressed files (gigabytes) and you'll find that out the bad way."_

Not if you do that over SCP / SSL / TLS that said... (and the bottleneck is the network, not the symmetric encryption used once the public/private symmetric key exchange has been made).

So, yeah, everytime I copy big files I'm using _scp_ (small files too actually but it's just out of convenience).

<comment><USER13> How does random bit flipping and check-summing to fix it work with encryption.

This is actually pretty interesting! How well does encryption handle bit corruption in encrypted data? I would guess it would depend if signature is used and the chaining mode used.

</comment></comment></comment></comment><comment><USER15> The sucky thing is ecc memory does not need to be so much more expensive than non-ecc. It is only more expensive because those who make it, and server vendors have conspired to use it as a margin driver.

</comment><comment><USER16> Not to spoil anyone's fun but the radiation doesn't have to come from far away in space and time... just earthly background radiation is enough to flip bits from time to time. Place your server closer a "flashy" neighbor (let's say radiotherapy equipment in a hospital, a floor away from your server room or an equivalent industrial setting) and your potential bad luck increases :)

</comment><comment> mark-r How hard is it to install ECC memory into a random desktop computer? Are they all compatible with it? Do you have to change BIOS settings?

<comment><AUTHOR> Pretty hard. ECC ram will work as normal RAM on non-ECC cpus. To use ECC you need a Xeon (or amd equivalent) processor and supporting motherboard. You can get the Xeon equivalent of the latest i7 cheaper than the i7, you (i think) still need to get a server mobo though.

<comment><USER3> It's a bit of a pain to find ECC mobos for desktops.

I looked for some when I built my last workstation seen that I was putting 16 GB in but ended up using stupid normal RAM : (

Now between SSH, SCP, SSL / TLS, Git, diffs before commits, unit tests, etc. I'd be really unlikely to have a bit flip really "destroying my work" : )

So, yeah, 16 GB of non-ECC memory on a Linux workstation which regularly reaches 6 months of uptime: no need to enter in a paranoia either for a desktop/workstation.

For servers, ECC is great...</comment></comment></comment>


An Expert's View on Google's Goggles - <AUTHOR> http://www.technologyreview.com/blog/guest/27711/?p1=blogs <comment><USER2> Thought this was going to be an article on Computer Vision.

<comment><USER3> I thought this was going to be an article on the actual Google Goggles product: <http://www.google.com/mobile/goggles/#text>

Missed the critical ' in the title.</comment></comment>