MIT-licensed high-quality SVG icons - <AUTHOR> https://github.com/tabler/tabler-icons <comment><USER2> Neat! I tried my luck with unicode symbols once because they scale nicely as well, but many browsers just desecrate them.

⏪ ⏩ are two examples, while these ► are pretty plain. Not that I don't like the specific designs, but the customization destroys any chance of their use if you want to keep consistent looks. In chrome they are on a blue background. I think other browsers might display them differently. Would be cool to have a neutral design that could be adjusted by font color.

But anyway, thank you for your work!

<comment><USER3> This is the first time I see someone getting color inside their HN comment.

<comment><USER4> Wow yes... Are specific emojis allowed over others?

Test:

⏩⏫⏪⏬◀▶⤵↩↔↙↘↖↗⬆⬇⬅↕↪ℹ⤴🆒🈳🈶🈚🈵🆓🆗🆖🈴🈲🉐🈹🈁🆕🆙🈺🆔🆘🆑㊗㊙🈂Ⓜ🉑🈸🈷🅰🅱🆎🅾©®™‼⁉⭕〰◼◻◾◽▪⬜⬛▫〽

Course HN does just fine without Emojis. I can only imagine the amount of downvoting that would ensue. I could see maybe some being useful like the arrows.

Edit:

By the looks of it the emojis that are meant to be signs work. The ones that are actual faces do not.

<comment><USER5> > Course HN does just fine without Emojis. I can only imagine the amount of > downvoting that would ensue.

You're probably right on the downvotes but I do wonder why. Is there anything inherently bad about emoji or is HN sometimes just a counterculture for the sake of being a counterculture?

<comment><USER6> I may just be old and bitter but I've never found emojis to actually help in commentary and are actively distracting when people already have established norms in communicating in a particular language as to my eyes it becomes adding a second language where there was already one. There's no rock solid definition for any emoji that has been normalized with a universally accepted dictionary especially when it is intermixed in another language that has its own complex grammar rules. As a single character statement of a symbol e.g. 'thumbs up' it works well, but that's the limit of emoji usefulness.

As someone who works in tech I'm always aware of the hundreds of completely overloaded terms I have to use and redefine on the fly but I also have the structure of the language I am using to provide context clues to have my actual intent, meaning, and purpose of said writing last to any reader including myself five years from now. I have so little confidence in effectively using emoji to actually provide expression in a way that is persistent to myself in five years that I abstain from it entirely. In small communities of people I have seen emoji-esque symbols exist (slack/forums/odd IRC emoticons) but it is because that is part of the living culture of a particular community and has to be taught to each person that chooses to join a community. I feel that is fine because there is a context to it and an established rule of use that allows it to enrich the conversation, but on a site like HN where it's a lot of people coming together it seems like trying to put a wall up for communication. A simple example is well is most HN commenters fully understanding what a line that starts with '>' usually referring to a quote of a prior post that they want to highlight in particular. It is a useful shorthand compared to writing out longhand 'In your post you have written many things but I particularly want to respond to your comment that reads "x to y".' You have to learn that and it's overhead.

I also depending on theming/font of the emoji characters themselves can sometimes take the wrong tonal interpretation even to me. Some seem sarcastic, some seem more intimate, some seem hostile, even though the underlying emoji is supposed to be neutral in tone. This is another reason why I avoid them, as I don't want to give off the wrong impression based on that.

For a discussion forum like HN I'd say that emojis are generally harmful to making sure that the conversations last longer than the moment they were written in case it becomes useful tomorrow.

<comment><USER7> > For a discussion forum like HN I'd say that emojis are generally harmful to > making sure that the conversations last longer than the moment they were > written in case it becomes useful tomorrow.

I just had a horrible nightmare vision of having to debug a code repository entirely commented with emojis...

<shakes away>

But I agree with you, words work fine and, especially as full sentences, are less ambiguous than cutesy symbols.

</comment></comment></comment></comment></comment></comment><comment><USER8> Great icons, thanks! Very similar in style to [https://feathericons.com/](https://feathericons.com/)

<comment><USER9> True, but great design looks alike right?

[https://evil-icons.io/](https://evil-icons.io/) [https://css.gg/](https://css.gg/) [https://ikonate.com/](https://ikonate.com/) [https://boxicons.com/](https://boxicons.com/)

<comment><USER10> There seems to be a connection though. This project tabler/tabler-icons is part of Tabler, which features FeatherIcons: [https://preview.tabler.io/icons.html](https://preview.tabler.io/icons.html).

Not saying there's anything wrong here, for all I know it might be the same author on both projects. Taking a closer look, it might even be the case that tabler-icons is just a rebranding of FeatherIcons.

</comment></comment></comment><comment><USER11> You have to manually download them, but I find the licensing and scope of [https://iconmonstr.com/](https://iconmonstr.com/) to be great.

<comment><USER12> The downloads are here, on the releases tab: [https://github.com/tabler/tabler- icons/releases](https://github.com/tabler/tabler-icons/releases)

</comment></comment><comment><USER13> Nice!

What does "quality" mean for SVG icons though? I could choose the resolution to be whatever I want.

<comment><USER14> I take it to mean that they're composed well: there's a balanced and sensible spacing/padding, the lines are a good weight, they are easy on the eye, there's a consistent look and feel between all of them etc etc.

For instance, I could mangle some SVG icons and while you could scale them to an infinite size.. you wouldn't want to use them ;)

These look great BTW!

<comment><USER3> They look great indeed.

That said, some of the icons reminded me of this article:

[https://news.ycombinator.com/item?id=22490089](https://news.ycombinator.com/item?id=22490089)

</comment></comment></comment><comment><USER15> What is the business model behind this?

The GitHub account links to this site:

[https://tabler.io](https://tabler.io)

Which looks like a typical sales page. But it also says "free" everywhere. No info on pricing or business model.

The icons page tays to install the icons like this:

        npm install tabler-icons --save

Does this make you vurnurable to code coming downstream from this repo in the future?

<comment><USER16> > Does this make you vulnerable to code coming downstream from this repo in > the future?

The command is a standard way to install a module and save that specific version in package.json. By default I believe it's "^x.x.x", which allows patch versions that increment the last number when explicitly updating - otherwise re/install will always get that specific version.

It's no less (or more) secure than any other dependency. The last vulnerability that I heard about was the ability for modules for run arbitrary commands, for example from the pre/post-install step. If I recall correctly, they added an optional way to disable this, but many modules make use of it for compiling native code, etc.

So - I'd say yes, installing any dependency will make you vulnerable to code coming downstream. However, an SVG icon library with little to no executable code can probably be considered low risk.

<comment><USER15>
        can probably be considered low risk

How so? I would think it puts its files in a publicly accessible path. That means if it puts executable code there (python,php,js whatever) in a future release it allows for a server-takeover.

<comment><USER16> You're right, I had doubts while writing that.

Aside from pre/postinstall scripts, I imagine the SVG and/or CSS files gets copied into a folder of static assets.

Depending on how that's done - manual import or part of a build step; specifying file extensions or not; how assets are served, etc. - that could be "vulnerable to code coming downstream".

</comment></comment></comment></comment><comment><USER17> I am using [https://icomoon.io/app/](https://icomoon.io/app/).

I like that I can select only a few icons and generate a custom true type font straight from the web application.

<comment><USER18> What benefit would that have vs SVG? It strikes me as cumbersome if you wanted to quickly add icons to an existing project, plus your ability to style with CSS would be limited compared to inline SVG.

<comment><USER17> I used them in applications developed in C++.

The toolkit is Dear ImGui and I load the TTF font with the simple API AddFontFromMemoryCompressedBase85TTF.

Then when I need a button with an Icon I just use it like this: if (ImGui::Button(ICON_FIRST, button_sz)) { }

The trick in C++ was to define the ICON_FIST in this way:

#define ICON_FIRST u8"\uea21"

I can then rescale my interface by simply changing the font size and the icons keep all nice and clean.

</comment></comment></comment><comment><USER19> fix the title maybe?

"MIT License" is not the same thing as "MIT Licensed". MIT did not license these.

<comment><USER20> Suggested, "High-quality SVG icons with MIT License"

<comment><AUTHOR> Thanks! No way to edit it now though...

</comment></comment></comment><comment><USER21> Cool! That's a great way to maintain consistent representation.

</comment><comment><USER22> The year is 2020. Even icons have npm install.

        *eyeroll*

</comment><comment><USER23> Thanks!</comment>


Lars Rasmussen AMA - <AUTHOR> http://www.reddit.com/r/IAmA/comments/18gwza/i_am_the_pointyhaired_engineering_director_for/

<comment><USER2> removed?

EDIT: He is not scheduled until tomorrow, according to the sidebar.

<comment><AUTHOR> Correct, but I'd say now's the time to get your questions in if you've got one.</comment></comment>


Tell HN: Tim May, Author of "The Crypto Anarchist Manifesto", Has Died - <AUTHOR> The following is from Lucky Green's announcement on Facebook (https://www.facebook.com/lucky.green.73/posts/10155498914786706):
Tim May - Cypherpunks co-Founder, Discoverer of Radiation-Induced Single Event Upsets in Integrated Circuits, Uncompromising Firearms Proponent
Word has reached me that my dear friend, co-conspirator in many things and for many years, fellow Freedom Fighter Tim May passed away earlier this week at his home in Corralitos, California.
Death appears to be from natural causes pending autopsy. I.e. Tim did not die in a hail of bullets as so many who didn't know Tim all that well and largely from his public writings had predicted.
(...)
Tim's realization that any Manifesto, Constitution, or Bill of Rights wasn't worth the paper it was written on absent a broadly armed (and heavily armed) population left many of his critics and admirers alike confused. As with so many of his assertions, Tim was correct in this analysis, though his assertion that "private ownership of firearms is a public good" will likely not be as soon widely accepted as his assertion that "private ownership of strong crypto is a public good" was. As such, Tim leaves behind a very large firearms collection.
Please raise a glass of Bourbon, can be any brand, doesn't have to be the expensive stuff, it didn't have to be for Tim, to Tim May!
Ad Astra, Tim! <comment><USER2> The end of an age.

RIP, Tim.

Cypherpunk Movement, leaded by Tim May is an established ideology and movement since the late 80s. At the time, they were the most prominent supporters of individual privacy and digital liberty. It was them, who helped to build the EFF DES cracker to expose the lies of FBI about DES's security, and forced the U.S government moving to the 128-bit encryption standard. It was them, who successfully stopped the NSA's plan to install mandatory encryption backdoor on the telephone system. And it was also them, who fought against the regulation of cryptography through various means, and effectively ended it.

They were also the earliest researchers on practical technology to defend privacy. The very idea of an anonymous communication system was purposed by David Chaum in 1981, and implemented as Type I Cypherpunk Anonymous Remailer. By purely coincidence, the syntax used in the control messages allows the user to chain multiple remailers, and hence the concept of Onion Routing was discovered. Cypherpunks also recognized the importance of cash — an anonymous payment system in the past 3000 years, urgently needed a electronic version to stop the enablement of a surveillance state in the digital age. The original vision was also purposed by David Chaum, but it faced various difficulties, especially the problem of consensus and double-spending (Chaum's own centralized payment processor was good, but did not succeed commercially, but check GNU/Taler!), so it was under constant discussion throughout the entire 90s, until Satoshi Nakomoto, presumably a Cypherpunk, purposed a workable, but perhaps less-favorable solution 10 years later. The inventor of computer firewall, Steven Bellovin, and the first developer of a commercial firewall, Marcus Ranum, were also cypherpunks. The entire concept of deniable cryptography was also invented by the cypherpunks, specifically, first implemented in a Linux Full-Disk Encryption program by Julian Assange.

<comment><USER2> Cypherpunks, were also the root of many, if not all, security and cryptography tools and projects used by everyone today. You name it, it's probably has a cypherpunk personally involved, or derived from a cypherpunk prototypes, or at least some some degrees of involvements. SSH, PGP/OpenPGP/GnuPG, Tor, OTR, OpenSSL/SSL, GNU Radio, Warrant Canary, TrueCrypt, HashCash, WikiLeaks, Linux's /dev/random, just to name a few. Yeah, these are not just independent project, but they were created by the large Cypherpunk movement.

Yes, the original mailing list was a victim of its own success — it disintegrated in 2000 because the entire fields of privacy, cryptography the movement kickstarted, turned to be too diverse to be contained in a single mailing list.

>"The main reason the list doesn't seem to have the center of gravity anymore is the topic has gotten so big and gone in so many directions," Wayner says. "It used to be you could read maybe (the newsgroup) comp.risks and Cypherpunks and you had read all there was. Now there are so many things going on it can't be the center of gravity, it can't be the center of all things."

You don't have to agree Tim May's Anarcho-Capitalist position or everything he has said, but I think we can all agree that the victory of the First Crypto War is our timeless legacy and his largest contributions (as a leader) to the Internet.

</comment></comment><comment><USER3> The Manifesto:

[https://activism.net/cypherpunk/crypto- anarchy.html](https://activism.net/cypherpunk/crypto-anarchy.html)

<comment><USER4> Very interesting. Thanks for sharing!

</comment></comment><comment><USER5> > Just as the technology of printing altered and reduced the power of medieval > guilds and the social power structure, so too will cryptologic methods > fundamentally alter the nature of corporations and of government > interference in economic transactions. Combined with emerging information > markets, crypto anarchy will create a liquid market for any and all material > which can be put into words and pictures. And just as a seemingly minor > invention like barbed wire made possible the fencing-off of vast ranches and > farms, thus altering forever the concepts of land and property rights in the > frontier West, so too will the seemingly minor discovery out of an arcane > branch of mathematics come to be the wire clippers which dismantle the > barbed wire around intellectual property. > > Arise, you have nothing to > lose but your barbed wire fences!

<comment><USER6> The ability that the blockchain gives to economically coordinate across great spaces and at massive scale without a central authority may make Tim May's predictions come true.

"Crypto anarchy will alter completely the nature of government regulation, the ability to tax and control economic interactions, the ability to keep information secret, and will even alter the nature of trust and reputation." -Tim May, 1988

I would add that limiting the ability of the govermment to tax and control economic interactions does not imply eliminating the government's ability to collect taxes. It would instead mean governments shifting from taxing people's private transactions, which properly belong in the private sphere, to taxing immovable property within their jurisdictions, like land, which properly belongs in the public sphere.

</comment></comment><comment><USER7> RIP Tim May. He wrote thoughtfully and prolifically and shaped a generation's thinking.

For any of you younger folks who don't have much context for cypherpunks, here's a couple of good articles: [https://medium.com/@bruces/the-blast- shack-f745f5fbeb1c](https://medium.com/@bruces/the-blast-shack-f745f5fbeb1c) [http://projects.csmonitor.com/cypherpunk](http://projects.csmonitor.com/cypherpunk)

I'm still trying to get my head around the idea Lucky Green has a Facebook account.

<comment><USER8> Not Medium link: [http://www.webstock.org.nz/the-blast- shack/](http://www.webstock.org.nz/the-blast-shack/)

</comment></comment><comment><USER9> A recent interview RE: the tenth anniversary of Bitcoin - [https://www.coindesk.com/enough-with-the-ico-me-so-horny- get...](https://www.coindesk.com/enough-with-the-ico-me-so-horny-get-rich- quick-lambo-crypto)

Always sad to lose deep thinkers.

</comment><comment><USER10> * Timothy C. May - Thirty Years of Crypto Anarchy | HCPP16 - YouTube || [https://www.youtube.com/watch?v=TdmpAy1hI8g](https://www.youtube.com/watch?v=TdmpAy1hI8g)

</comment><comment><USER11> When May worked at Intel, the IC's would encounter unexplained state changes from time to time.

He looked into it - and eventually realized the problem was the ceramic/clay semiconductor packaging was slightly radioactive, causing single event upsets. Intel switched to less alpha-heavy packaging, plastic, and the problem went away. That's impressive debugging!

I knew him more from his cryptography and privacy work (and his curmudgeonly Usenet posts on how downtown Santa Cruz was going down the drain, in his opinion), but this feat always impressed me.

<comment><USER2> His paper is available at:

[https://sci-hub.tw/10.1109/IRPS.1978.362815](https://sci- hub.tw/10.1109/IRPS.1978.362815)

A New Physical Mechanism for Soft Errors in Dynamic Memories

</comment></comment><comment><USER12> These early documents are really interesting in that they often NAIL the future but underestimate the technical challenges required.

Onion routing being a good example... it's taken longer to get there and it's still not going to be the default for a long long long time.

<comment><USER2> I think the major mistakes of the early Cypherpunks include the following. If we want to go forward, these problems must be solved.

(a) informal approach to cryptography, the entire applied cryptography from late 1990s to the early 2000s suffered from this problem, we are still working hard to correct them since Post-Snowden. TLSv1.3 is the most recent effort to pay our debt.

We should understand that, even we can create lots of clever things by mixing and meshing different cryptographic primitives, if the cryptosystem is fundamental enough that you need to use them in serious systems, they must be formally designed and analyzed. Linux's /dev/random works by gathering various sources of entropy and mixing them, sounds extremely secure, right? But it doesn't have the rigorous security properties as shown by formal analysis.

One may argue the design is practically secure, but for something fundamental like this, formal approach should be used to keep it robust in all possible and impossible circumstances, just like a good symmetric cipher should resist all forms of known cryptanalysis, to ensure a strong fallback security — that even the adversary can ask you to encrypt any data of their choice, the cipher is still unbreakable.

Empiricism works well in many cases, and you can surely design cryptographic protocols and applications in this way, but it should know when it is needed to stop and call a true cryptographer. The Signal Protocol is a good example of well-designed, and formally analyzed protocol, while Telegram is a bad one.

(b) Overemphasize of Technical Possibilities, But Not Usability. The Cypherpunks were fascinated by cryptography's endless possibilities. As a result, they create systems which there are hundreds of user adjustable parameters and options.

Do you want AES? TwoFish? 3DES? The first one is the U.S. national standard, well-reviewed, fast hardware implementation, but it has a relatively weak key schedule and may have a small risk of related-key attack in 256-bit mode, but related-key is not a real issue in proper encryption, and… the second one is the security guru Schneier's cipher, years of cryptanalysis didn't discover any flaws, and the pure software implementation is typically faster than 256-bit AES, but… Do you want SHA-1? RIPEMD-160? SHA-256? SHA-512? SHA-3? BLAKE2e? SHA-1 and RIPEMD-160 is not recommended for new systems, SHA-256 is the best practice, but why don't you use SHA-512 for additional protections? By the way, SHA-3 is not vulnerable to length-extension attacks as it's not a Merkle–Damgård construction, and BLAKE2e is the state-of-art by utilizing Daniel J. Bernstein's ChaCha20 stream cipher…and so on, and so on, and so on…

You can see this in GnuPG, almost every aspect of encryption can be adjusted. Another example is Mixmaster remailer, which has more than 20 parameters to control the behavior of mail forwarding.

These designs are clearly from the desires to fit the personal preferences by different professional Cypherpunks, but has little actual security benefits. Instead, it greatly complicates the entire protocol, and expose a large surface for attackers. On the other hand, WireGuard, an execellent VPN protocol, doesn't allow the user to change anything. It is hard-coded to only use state-of-art, and proven algorithms, such as ChaCha20 and Curve25519.

Dreaming about the endless use-cases is another related issue, Cypherpunks spent too much time discussing them, such as trustless key management, etc. However, to bring real changes, we must have systems designed for ordinary people. An less-than-ideal encryption protocol that is simple enough for mass adoption, is superior to a completely trustless protocol, but only usable by a handful of Cypherpunk.

Cypherpunk may disregard these protocols for its imperfections by Cypherpunk's standard, but it's still essential to develop them as mass adoption is crucial for Cypherpunks to succeed.

(c) Unrealistic Overconfidence in Cryptography

In Tim May's The Crypto Anarchist Manifesto of 1992, it announced that, there will be the extensive re-routing of encrypted packets and tamper-proof boxes which implement cryptographic protocols with nearly perfect assurance against any tampering, and as more and more Cypherpunk decided to opt-out from the conventional social order and enters the cypherspace, the State can be therefore eliminated.

The security of any real-life systems is nowhere close to that level in the Manifesto, it could be done in theory doesn't mean it can be done in practice.

Also, as Cory Doctorow stated, the best encryption, the fastest computers, the most open networks, will not make you comfortable living in an autocratic, corrupt state. You and your radical friends will eventually make a mistake and be rolled up by state thugs, or blacklisted, or blackmailed, or publicly discredited. To evade this all-pervading power, you have to be perfect. To defeat your evasion, the state need merely find a moment's imperfection in your operational security. Even if your system is perfect, the human-element is the weakest link, the State just need to wait you making a single mistake to be hunt you down, the story of The Silk Road is a good cautionary tale for us.

We should continue the original vision and ideals, but also adopt an reality- based approach, keep quoting Doctorow,

The internet is a tool that can crack open a space in even the most totalitarian of regimes, a place where reformers and revolutionaries can organize, mobilize, and fight back. It's a forum for whispering dissidence in secret and for blasting the shameful secrets of the powerful at full volume.

The theory of change that goes, "We will walk away from politics and use the internet to evade state oppression" is a dead letter. It always has been. But the theory that goes, "The internet will let us organize to hold the government to account, to topple the corrupt, to rally the honorable and expose the wicked" — that theory has never been more important.

(d) "Cypherpunks Write Code!"

Linus Torvalds like to say "Talk is cheap, show me the code". The slogan of Cypherpunks in fact came earlier, "Cypherpunks Write Code!". The meaning is that, good ideas need real implementation, not just talks.

Unfortunately, the discussions of the Cypherpunks were too broad and pretty much ahead of its time, as a result, most ideas were not implemented, and few implementations were only prototypes. Even the best software package, suffers from Problem B.

It is not to say that discussions are unnecessary, but we must build something for mass adoption as well. So perhaps a new slogan, "Cypherpunks Build Apps" can be used, although "app" sounds like a corporate buzzword.

(e) Hostile Discussion Atmosphere

Cypherpunks were radicals, many are radical individualists and anarcho- capitalists, with very strong personally opinions on almost everything and very militant. The Cypherpunk mailing list suffered from endless personal attacks and arguments from day 0. I recommend everyone to read the Cypherpunk Mailing List archives to understand the situations.

If we want to build a public forum, we should take all the possible precautionary measures to prevent it from happening, and cooperate towards a common goal. Having an ideological civil war between democratic socialist, and libertarians only helps the Big Brother.

We should find a way to allow diverse groups of people of different ideologies to cooperate to accomplish things, meanwhile still upholding the same core values.

<comment><USER13> I gave a talk in October where I said that some things that original cypherpunks got right were

\+ _Money and payments_ as locus of power

\+ _Naming and identity_ as locus of power

\+ _Access to cryptography_ as locus of power

\+ Governments' appetite for electronic surveillance

\+ Anonymity enabling otherwise impossible interactions

and some things that they got wrong were

\- Vanguardism

\- Sybils and models of public discourse

\- Adaptability and resources of state actors

\- Software vulnerability

\- Decentralization is consistently expensive (in many different ways) and few people have agreed that they need it

\- Extreme technical fragility of anonymity (deanonymization, correlations, uniqueness of items in high-dimensional datasets, stylometry and behavioral uniqueness)

(This is not meant to suggest that the cypherpunks didn't talk or think about these issues, just that they tended to underestimate how big a challenge they would represent.)

<comment><USER2> Insightful comment, thank you!

I would like further to say, as I said in another comment, Cyphernomicon is one of the most valuable document worth to read, an amazing collecting of farseeing ideas. The widespread of data breach, privacy-invading computer systems and software, tendency of authoritarianism and mass surveillance in the digital world, how Internet will change whistleblowing, and even cryptographic ransomware were predicted.

They got a lot of things correct. But many great ideas are still not implemented. I'm listing a few that I really want to see and use today...

* In Tim May's Cyphernomicon, two concepts are of great significance: anonymity, AND reputation. The most common argument today against anonymity is, "how can you trust these people", but the problem has been answered early: you build a system and community based on reputation. Unfortunately, nowadays, only the first part of the vision, anonymity, is partially implemented, but there is almost no deployed reputation/identity system.

There are some of them, e.g. Web-of-Trust based, blockchain-based, Reddit/Hacker News karma, but I think we still don't have figure out a system that implements May's vision. I really want to see something similar to the Cyberspace in True Names or Ender's Game... Currently the best approximation is just 4chan + Reddit + Second Life + Tor, or perhaps OpenBazaar and BitNation?, which is not very interesting.

And of course, there are reasons. If you attach an identity to anonymity, it downgrades to pseudonymity. Having a long-term pseudonymity is very dangerous, once you have leaked ~30 bit of entropy, your anonymity is basically finished. Another hard problem of reputation is Sybil Attack.

* Dining cryptographers, or DC-net, a revolutionary anonymous network by David Chaum, which eliminates correlation attacks and information-theoretic secure. Cypherpunks saw the Onion Routing of Cypherpunk Remailing can be written in an afternoon of Perl hacking, it shouldn't be hard to perfect the system and move to DC-net within the next 5 years.

But the hard problems of DC-net has been overlooked, one non-cooperative participant can DoS the entire network. The solution is the construction of a BLAME protocol for kicking out malicious nodes out. I think we just managed to solve most of the problem with a functional prototype, DISSENT, in 2015 (20 years later!!). Until a practical network has been engineered, DC-net is still like One-Time Pad, good on paper but not useful in practice.

</comment></comment></comment></comment><comment><USER14> Tim was pretty much why I got interested in crypto. I'm glad I got to meet him in person once a few years ago, but lots of great interactions online over the years.

</comment><comment><USER15> RIP Tim. I remember him as one of the guiding forces of the early Cypherpunks.

</comment><comment><USER16> RIP Tim. I remember reading his work (usenet) back in the late 80's/early nineties - he once told me of his early days at Intel and later invited me to join the cypherpunks list a very long time ago. Tempus fugit.

</comment><comment><USER17> R.I.P. He and John Perry Barlow are true hero's.

</comment><comment><USER18> Oh man, that's terrible news.

R.I.P. Tim May.

</comment><comment><USER19> I wonder if any nyms will suddenly stop posting and be outed as his? One thing I've though about recently is that on a long enough timeline if you use a handle, eventually you'll die.

(I register new nyms occasionally for this reason)

</comment><comment><USER20> We will prevail over these mad people. A little piece of Tim lives on within me. Plant that seed & purvey the knowledge today through tomorrow until the end of our time.

Goodbye Tim

</comment><comment><USER21> Just to avoid the confusion, "crypto" means cryptography not currency in this context. I had to check myself.

</comment><comment><USER7> Worth remembering Tim also wrote some violently racist and hateful crap. A sample (there's lots more) "Liquidate the Jew and the negro and most of our problems fade away." [https://scruz.general.narkive.com/29QgNUds/commie-rag- praise...](https://scruz.general.narkive.com/29QgNUds/commie-rag-praises-mlk)

I admire Tim's writing on crypto and what it could do. I deplore his violent racism. They both came together in one person.

</comment><comment><USER22> RIP

</comment><comment><USER23> Okay, I'm curious - did anyone else get a screen flicker when they clicked on these comments? I'm on macOS 10.14.2 chrome 71.0.3578.98. I think it would be interesting if someone wanted to trigger software based on particular URLs, or, more likely, textual content in the page. Because it is personal, and transient, it would be very difficult to detect.</comment>


Ask HN: Is the old OCaml Rust compiler around anywhere? - <AUTHOR> Looking for the OCaml compiler that I've heard was used to bootstrap Rust. Just curious about it -- thanks! <comment><USER2> It's in the repository, just way back in the history.

[https://github.com/graydon/rust-prehistory](https://github.com/graydon/rust- prehistory) would also be of interest to you.

<comment><AUTHOR> thanks!</comment></comment>


Why extroverts fail, introverts flounder and you probably succeed - <AUTHOR> http://www.washingtonpost.com/national/on-leadership/why-extroverts-fail-introverts-flounder-and-you-probably-succeed/2013/01/28/bc4949b0-695d-11e2-95b3-272d604a10a3_story.html?hpid=z2

<comment><USER2> Here's my copy-pasta:

MBTI is braindead pop-science which is based on the rantings of Jung. It was good for the time (when measuring people's skulls to determine their personality was popular) but has no place in modern science.

The biggest problem is, it's deliberately polarising. Jung thought there were fundamental personality types, and that everyone would fall into a specific box. That's good if you want to write a "what career is best for you" article for Cosmo, or for school kids. But it's bad science. Most personality traits are normally distributed, not categorial.

Most people are ambiverts, not introverts or extrovert. There's plenty of people who are heavily introverted, and plenty of people who are heavily extroverted, and it's useful to have a word for it, but most people aren't.

The other problem is, the traits it measures aren't important. Big 5 (Introversion, Openness to experience (i.e. culture / intelligence), Conscientiousness, Agreeableness, and Neuroticism) is better. It uses more interesting traits, and puts them on a scale (rather than using categories). It's not perfect (there's no real model, it's just common factors in personalities - psychologists often say it's overrated) but it's much better than MBTI.

<comment><USER3> Meyers-Briggs was never meant to pigeon-hole people so that organizations could be better aligned, or for social engineering purposes. As a psychoanalytic tool, its main purpose is to help the subject understand his or her own inclinations.

Any application outside of therapy or introspection is pop-science; and any application within those fields is only relevant if the subject accepts the categorizations of the test.

<comment><USER4> In that sense it's never struck me as anything more than horoscopes for those who don't believe horoscopes.

<comment><USER5> Horoscopes base their descriptions on time of birth, Meyers Briggs on actual answers from you; they are hardly comparable.

</comment></comment></comment></comment><comment><USER6> Myers Briggs aims to measure preference rather than performance. A score highly biased towards extroversion is just as likely to indicate a weakness in "introverted" areas, such as approaching problems strategically, as it is to indicate a strength in communication skills.

A better rule of thumb when looking for the right qualities in a salesperson, especially a complex-software-solving-complex-problem salesperson, is to look for someone that listens to the other party more than they talk.

<comment> at-fates-hands This is how sales has changed drastically over the past 10-15 years. Before, high pressure sales and using hard closing techniques have been replaced by a more "consultative" approach. IT's a more humanistic approach to selling your company wares.

Because of this, listening, or the appearance of listening has become the new training tool for salespeople. As such, using an extroverted or introverted label doesn't really apply.

</comment></comment><comment><USER7> _Here's the best part, however. The distribution of introverts and extroverts in the population looks eerily like the results Grant found plotting revenue across his 1-to-7 scale. Some of us are heavy introverts. Some of us are stalwart extroverts. But the vast majority of us are ambiverts._

Surely these results could be explained by saying that we are better at selling to people who are like us then?

Assuming there are few extroverts or introverts but lots of ambiverts in a population of sales people and the same distribution is found in the people being sold to. If we are better at selling to people similar to ourselves then the ambiverts chosen for the experiment will perform well in a wider segment of the population and hence make more sales.

</comment><comment><USER8> Link-bait title for a mildly interesting study. I'm not surprised at the results, anyone with real sales/biz dev experience will tell you that listening and asking the right questions are the way to sell people, not "hustling" and being overly salesy/pushy - [http://www.amazon.com/SPIN- Selling-Neil-Rackham/dp/007051113...](http://www.amazon.com/SPIN-Selling-Neil- Rackham/dp/0070511136/)

That said though, how you define yourself as "extroverted", "introverted", or an "ambivert" is questionable altogether.

</comment><comment><USER9> Something sounds off here.

At face value the article is saying. If most people are "ambiverts" and ambiverts make the best sales people, and sales people are the best leaders, why are there not more leaders? Why is it that most people are not in charge.

Finding out that there is no correlation between extroversion and sales performance is interesting and all but I think it would be better to find a new scale to use, one with positive correlation for what you are looking for.

Pointing out that people's scores for extroversion fall along a normal distribution, and that people's sales preform aces fall along a normal distribution does not really say much.

Typically, a low correlation score means your model is wrong, not that you need to fix your model by choosing a different locus.

</comment><comment><USER10> The article casts a wide net for what defines an ambivert:

 _Ambiverts [...] are people who are neither extremely introverted nor extremely extroverted._

What can we really say about this third group if we are including everyone who is not an extreme example of the other two?

</comment><comment><USER11> > _"The distribution of introverts and extroverts in the population looks > eerily like the results Grant found plotting revenue across his 1-to-7 > scale."_

'Ambiverts' make better marriages?

</comment><comment><USER12> Well, this makes me feel better about wondering for years whether I was really an introvert or in fact an extrovert. Now I can be proud to claim the term "ambivert"!

<comment><USER13> I wondered about this, too. I took a Meyers-Briggs test as a team-building exercise once, and in the I-E continuum, I fell very mildly on the Introvert side. But there are sub-categories in each of the fields, and I scored full marks for "gregariousness".

So I've spent the last few years wondering what a gregarious introvert is.

I think it's someone who laughs very loudly at their own jokes.

<comment><USER14> To be honest, most people have a completely incorrect view of introverts. Many stand up comedians are introverts. Many artists are introverts. Being an introvert is not the same as shy.

<comment><USER15> That's something I've noticed myself, being something of an introvert. On a number of occasions I've been "accused" of being timid, which I'm not, although I guess it might come across that way. Or perhaps it's just that introvert is a difficult word :)

</comment></comment></comment></comment><comment><USER16> Disgusting.

<comment><USER13> You maintained a vow of silence for 225 days, and then broke it to write... this? That's quite fascinating, actually.

<comment><USER17> This made me laugh so much a little bit of wee came out.

<comment><USER18> This made me laugh so much a little bit of crap came out. Reminds me of the recent product announcements by Google.</comment></comment></comment></comment>


No HTML needed - <AUTHOR> http://kojika17.com/demo/4lines/

<comment><USER2> It's actually possible to do away with the HTML altogether (or rather have a 0-byte HTML file) by using the Link HTTP header to specify the stylesheet - [http://www.w3.org/TR/html401/present/styles.html#h-14.6](http://www.w3.org/TR/html401/present/styles.html#h-14.6)

There was a fun demo that showed exactly this, but I can't seem to find it now. This page - [http://annevankesteren.nl/test/html-element/style- header.php](http://annevankesteren.nl/test/html-element/style-header.php) \- uses Link header but also uses some HTML.

[edit - fixed second link]

<comment><USER3> Any chance you were you thinking of [http://mathiasbynens.be/notes/css- without-html](http://mathiasbynens.be/notes/css-without-html)?

<comment><USER4> There is an invisible character at the end of your link which breaks it.

</comment></comment></comment><comment><USER3> This is [http://mathiasbynens.be/notes/css-hidden- elements](http://mathiasbynens.be/notes/css-hidden-elements) all over again :)

Here's an even more extreme version with no HTML at all: [http://mathiasbynens.be/notes/css-without- html](http://mathiasbynens.be/notes/css-without-html) (read it + try the demo in Firefox)

</comment><comment><USER5> Page title directly contradicts the HN title: "I drew a camera in HTML and CSS".

</comment><comment> martin-adams What I find interesting is that the <title> attribute is styled and visible in the page, but not technically in the body. I didn't even know that was possible. I'm guessing it's because it's not inside a <head> tag.

<comment><USER6> Yeah, the first time I saw something like that I was pretty surprised.

You can actually display:block script elements, too. Kinda cool if you need to put a code example on a page and also have that same code actually execute.

<comment><USER7> Mind blown. That's phenomenally cool. Thanks for the tip.

</comment></comment></comment><comment><USER8> HTML is primitive. I'll take an internet application any day over a browser. I long for the day when my desktop is filled with application shortcuts, instead of browser shortcuts. I'm already there with android, where developers have learned that more rich, interactive and controlled experience can be had with an application instead of a webpage. I'm sure this burns with HTML developers, but it's only a matter of time before HTML is only a vehicle to direct the user to the app download link.

<comment><USER9> I am of the opposite mindset. I think there are just way too many apps out there and apps lack many things that HTML has - discoverability, cross- platform deploys, reusability and other things. HTML is not for every use case, and native is definitely not the hammer for all use cases. Every time I go to a forum and see the giant display to download a whole app just to see their forum, it makes me throw up a little.

<comment><USER10> I think the main problem for this decade is that HTML/HTTP aren't realtime (if I worded that correctly) like IRC or something.

<comment><USER11> HTTP Long Polling, while a little bit of a hack, works incredibly well for most cases. Add in WebSockets and WebRTC in more modern browsers, and you're able to do pretty much any realtime thing you can think of (if you design a server to support it).

</comment></comment></comment></comment><comment><USER12> The title/header is from HTML. The nicest thing is not the lack of HTML but the lack of an image. The picture is entirely painted by CSS.

</comment><comment><USER13> Off Topic(sorry): there was a thread here a few months ago about a simple webpage with just html and words. It inspired a whole raft of me-too jokey threads. I'm trying to find it but can't. Does anyone have a link please?

<comment><USER14> [https://news.ycombinator.com/item?id=5913381](https://news.ycombinator.com/item?id=5913381)

<comment><USER13> Brilliant! Thank you.

</comment></comment></comment><comment><USER15> Oh, and here's another hack. Re-interpreting HTML as JS:

[http://ajf.me/hacks/js_html/](http://ajf.me/hacks/js_html/)

<comment> qu4z-2 That reminds me of this (from HN a while back):

[http://daeken.com/superpacking-js-demos](http://daeken.com/superpacking-js- demos)

An html/png hybrid (among other hacks)

</comment></comment><comment><USER16> Besides the HTML to include the CSS... Nonetheless, still cool!

</comment><comment><USER17> Netrenderer shows that IE9 hangs after loading this page... IE10 however seems to work fine.

</comment><comment><USER18> I don't know... just because it can be done, doesn't mean it should be done.

<comment><USER19> No one's suggesting this should be done. Only that it can be.

</comment></comment><comment><USER20> how did he implement favicon.ico ?

<comment><USER21> The browser will attempt to retrieve a favicon.ico file from the root of the url.

[http://kojika17.com/favicon.ico](http://kojika17.com/favicon.ico)</comment></comment>


Ask HN: Would you support a unionization effort at your company? - <AUTHOR> <comment><USER2> I'm already in 2 unions. Pros and cons, with the biggest con obviously being pay since now you have to collectively bargain and most union leaders are selected based on popularity and political ambition and not their negotiating skills, so your wages and benefits will go down though your overall job security will increase, and they will have to pay you overtime.

A pro is the work environment is much more honest, you are free to speak your grievances about management in front of everybody without worrying about them trying to fire you or scheme to make your life hell. You will have employees elected as shop stewards to handle all employee disputes instead of bringing in the heavy hand of management to deal with petty personal issues. Anytime you are summoned to a meeting room for discipline you get to bring a representative, and you get to appeal every single bullshit disciplinary action they take and almost always win, managers have no clue of the collective agreement.

Your job also changes to being a contractor, as you are contracted to do specific things which of course means if you finish them early, you can leave and still get paid 8hrs. You can also refuse work you have not been contracted for, and this is of course the major complaint about union employees how 'they're lazy and won't do what I ask' but if you asked the plumber you contracted to install a dishwasher to also mow your lawn for free they wouldn't do it either. That's how a collective agreement works, you have entered into an agreement to do X, unless there are special provisions for Y you don't do it. One of my collective agreements has provisions for extra work, and every day we push software on time in a research lab without some manager hovering around.

<comment><USER3> "to also mow your lawn for free"

But it's not free, you just said they're paying you for at least 8 hours no matter what. Sounds like you're saying certain things are below that plumber and he won't do them, but still wants to get paid.

</comment></comment><comment><USER4> Absolutely. I love where I work, and I love my coworkers. I want to make sure that the culture of openness and transparency stays that way. I believe that the best way to do this is to form a union and give the employees formal power in the corporate decision-making process.

<comment><USER5> While ymmv, in my experience regarding all human systems, if you love something, injecting massive entropy into the system structure in the hopes that you will love it a little more, is not worth the risk that you'll break the whole thing.

</comment></comment><comment><USER6> Nope. I'm in the US. I have never seen benefits come to employees from unions. I've been in the teachers union. My wife has been in the grocery union, and my brother works at a place where the union started in a warehouse (Teamsters?). I've not seen anything work out for the employees, but lots of process and rules that mostly benefits the union leadership and the union as an org at the expense of everything else.

Edit. There is one case where I have seen benefits. My brother in law is a heavy machinery operator and works similar to a contractor does in tech. He goes in, does some work til the job is done, and leaves. He likes that he can get jobs through the union and that his wages were way higher in the last recession.

</comment><comment><USER7> No, and I'd advise people not too. Unions had a purpose, and sadly still do in some isolated instances, but tech (professional work in general) is not one of them. I say sadly because businesses should have matured to the point by now to make unions unnecessary, and employees should have evolved further to see the problem. But some business/industries have a lot of bad actors and the union does fill part of a need, but it isn't what employees think it is.

I have dealt with unions as a leader, I have dealt with a union trying to unionize employees that worked in my teams and I have dealt with union based employees in a plant and non-unionized employees in a different plant within the same company. Guess who got better benefits and pay? Wasn't the union employees, too much money had to go to pay the union dues, legal fees and unnecessarily inflated benefits, so we would fight every penny and ask on that side. And yes some states in the U.S. have rules around union employees can't be paid less than non-union doing similar jobs, but trust me large corporations know how to work those rules properly.

While I have lots of opinions based on my experiences, in the end what I learned is that unions are honestly not there for the employee, they are there to raise employee wages/benefits so that the union can collect more in fees (generally a percentage of total compensation, so salary + benefits). The sad fact is they honestly don't care about you, your family or making it better, they get paid more by making the business pay more wages whether the market and work demand it or not.

There was a good reason unions existed in the past, and I am a fan for their reasoning at the time, not today. They are now nothing more than a big business putting their hands in your pocket to take money from you. By the way, did you know in many states, if your fellow employees unionize but you opt out that you can still be forced to pay union dues? Yea, this has been litigated in the recent past and some states changed that law, but just beware of what you ask for or support.

<comment><USER8> " I say sadly because businesses should have matured to the point by now to make unions unnecessary, and employees should have evolved further to see the problem."

Without a counterforce it's just a matter of time until we regress to ever worsening conditions for workers. Capitalists never gave anything away voluntarily. We need unions or other workplace regulations to keep things in balance.

<comment><USER7> I agree there has to be a counterforce to protect workers from the early days of the industrial revolution where factory workers died and/or were mistreated because of no regulations, no safety and there was little if any oversight to give workers a recourse.

Today in the US there are at least 4-5 agencies that oversee companies and their behavior. Laws are now on the books to protect workers. Workers can now sue their employers for violating their rights. Workers have protection of whistle blower laws. Are any of these perfect, no, but these are the true reasons unions existed. It was to protect the worker from abhorrent conditions and treatment. That has happened through the new laws and agencies in place. What we should be doing is forcing the agencies and politicians to use the tax money they took from us to clean up the areas which are not good enough still, not giving away more money to a union which is just another business there to take their share of your earnings and the companies earnings. Unions are a tax on everyone, they are not free, so you are taxed twice for 90% of the same protections, and the other 10% I would argue are not protections but limits on your rights.

I still see places we need it to be better, but that doesn't mean tech is a place for unions. Can you imagine all these 2-3 year post grad engineers getting the title of Senior software engineer and getting the equivalent high salaries or out of turn bonuses for great work now learn they have to wait 20 years to be called senior, can never again get an out of turn bonus or special treatment for going the extra mile. Unions equalize by taking everyone down to the lowest level of commonality, you are no longer an individual you are a cog to be used to further the union leaderships goals, not yours. Sure, you get a few extras for that but I for one don't want to hand someone else my freedom to earn and advance at my pace so they can get what they feel is important.

* edited a few words to make it clearer.

<comment><USER8> Without unions employers will be lobbying relentlessly to weaken current laws. You can argue about what unions should be doing or not or how they should operate but they are absolutely needed to give workers a voice.

</comment></comment></comment></comment><comment><USER9> I work at a 5 person startup, so wouldn't want to endorse that at this stage but maybe if we get to 200 or 2000 employees it'd make more sense. I highly value protecting workers and ensuring fair compensation.

</comment><comment><USER10> I'm a co-owner of a company so you can imagine I wouldn't. I don't know what I'd do if I discovered something like this was going on to be honest, I'd be really disappointed that people apparently felt that working here was that bad and they couldn't change it except effectively by force.

I don't expect it would happen at my company or at others as the job market for software developers in London is excellent; typically if people don't like the work they just leave.

<comment><USER4> I mean, you have power over their lives with force. You can decide at a moment's notice that their livelihoods could be taken away. Or, you could sell your company to someone who would do that. A union just levels the playing field.

<comment><USER10> From my perspective, they have power over me. I need to keep them happy or they're going to find other jobs. Sometimes this means changing plans to ensure they're not overworked or to ensure that they get to work on interesting stuff after something reasonably boring like UI development (none of them really enjoy it but it has to be done). The business fails pretty rapidly without my development team and I know how lucky I am to have them.

</comment></comment></comment><comment><USER11> Sure. Well, there's no pressing need, for me because I'm self-employed (I'm member of a sort-of/kinda union for self-employed people, but it's not quite the same thing thing), and I'm currently contracting for a bank, and unions for bank employees already exist. Anyone who wants to join a union already can.

But in general, sure. I think it's good for employees to organise and be able to present themselves in a united manner to the concentrated power of corporations.

</comment><comment><USER12> Absolutely, without any hesitation.

</comment><comment><USER8> Obviously it depends on the nature of the union but in general I think unions are good.

</comment><comment><USER13> Yes, absolutely. I support the current unionization effort in my workplace.</comment>


Java StringBuffer and StringBuilder performance - <AUTHOR> http://alblue.bandlem.com/2016/04/jmh-stringbuffer-stringbuilder.html <comment><USER2> How about just using StringBuilder unless you _really_ (that 0.01% case) need thread synchronization of StringBuffer?

I'm a C++ programmer mainly, surely all Java programmers know why StringBuffer is bad by now?

Article also has a pretty pointless microbenchmark.

 _Most_ synthetic microbenchmarks are questionable by default. Even worse when there's any kind of limited resource utilization such as thread synchronization involved.

Synthetic microbenchmarks assume all the resources are just for them. Whole CPU instruction and data cache, all synchronization bandwidth, all memory bandwidth, etc.

Use profiling instead of microbenchmarks.

<comment><USER3> > How about just using StringBuilder unless you really (that 0.01% case) need > thread synchronization of StringBuffer?

You wouldn't necessarily know, or notice - your users would just experience occasional random crashes. How about just using StringBuffer unless you really (that 0.01% case) need the performance of StringBuilder? As you say, profiling is the right way to approach these things.

<comment><USER4> > How about just using StringBuffer unless you really (that 0.01% case) need > the performance of StringBuilder?

Because when writing new code you should opt-in to thread safety, not out. Collections are not concurrent by default, there is no `unsynchronized` or `non-volatile` keywords, etc. StringBuilder:StringBuffer::HashMap:ConcurrentHashMap. Also, if the performance benefit requires negligible upfront cost (e.g. providing length to ArrayList if known) you should do it and build it in your muscle memory as the default approach.

The problem is StringBuffer (unlike many other parts of the stdlib) was the only approach available for a long time so people need to change their default way of thinking. Luckily it's been a long time since 1.5 and basically everyone has changed.

<comment><USER5> As a non-java programmer, I'm wondering why you would want to opt-in to a safety system instead of out of it? My instinct would be to say that you should be safe be default, and if you find you need performance, then you verify it won't cause problems in your case and opt out of the default safety mechanism. Why is defaulting to non-safe ever the right choice?

<comment><USER6> Thread-safety is implicitly different than other types of safety: There are multiple answers to the same problem, and the default one present in StringBuffer is not necessarily the one you want. For instance, StringBuffer's thread-safety only guarantees that every write will be executed without corruption. What are the possible outcomes of this executing in two threads:

        stringBuffer.append("a").append("b"); // Thread 1
        stringBuffer.append("c").append("d"); // Thread 2

The answer is, any of the 6 permutations of "abcd" such that "a" appears before "b" and "c" appears before "d". However, maybe what you really wanted was just the two permutations of "abcd" or "cdab".

Just saying, "thread-safe!" doesn't answer the question of _how_ it's thread- safe and what its behavior will be if multiple threads are contending for it. All it means is that the program won't crash or corrupt just because multiple threads are in the same place at once, which is not really all that useful a guarantee when you're looking at very expensive locking mechanisms to get there.

<comment><USER5> I don't consider that a matter of _safety_ , as much as _data integrity_. Safety, as I've defined it elsewhere within this thread, being "does not cause memory corruption or crash". If neither technique cause that, then I don't really have an opinion. If one can cause a crash in certain circumstances, and the other cannot, I don't think it's responsible to endorse the one that can cause a crash.

Does that mean you may need to figure out why your data looks weird at some later date? Possibly. But to me that much preferred to entire program failure in hard to reason about circumstances, or in memory corruption, which can lead to the same.

<comment><USER6> Actually, I'd rather my program just crash at the point of use than silently corrupt my data. First, my existent data will be preserved, and after fixing the issue I can rerun the operation. Second, I will get a clear crash that immediately tells me where the problem is, instead of getting garbage output that I have no idea where it sourced from. Oh, and since this is a threading problem, it's probably even _transient_ data corruption.

<comment><USER5> That's not how threads work. Without thread safety mechanisms, you don't get occasional data corruption _or_ the occasional crash, you get _both_ , but often not at the same time. Occasionally data will be written out of order. Occasionally there will be enough weirdness you can have a crash. How often you get one or the other depends on the algorithms in use. Lock safe methodologies can prevent the crash, and if designed specifically for the data in question and the data structure supports it, can _possibly_ ensure no corruption.

Given with strings you probably have data corruption no matter what, do you want crashes on top of that or not?

<comment><USER6> > Lock safe methodologies can prevent the crash, and if designed specifically > for the data in question and the data structure supports it, can possibly > ensure no corruption.

Which was the entire point of my post. "Thread-safe" does not guarantee "usage-safe", and using them interchangeably is a fallacy. If the synchronized StringBuffer does not provide the guarantees you need anyway, there's no point in paying the cost of using it.

> Given with strings you probably have data corruption no matter what, do you > want crashes on top of that or not?

I just said that, yes, I would rather the program crash than silently corrupt data. I would rather it crash 100% of the time, but I'll take intermittent crashes instead. A crashed process can be restarted; it's very much harder to fix data once corruption hits. And if data corruption hits anyway, at least if I also have a crash I have an idea of where to look for the issue.

</comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER7> I was surprised by the difference between the Simple and Chain results. Naively, I had thought they'd generate the same byte code.

<comment><USER4> The main deal is that an instance method (e.g. append) uses the latest stack value as the instance and has its return value put on the stack. So when chaining, it doesn't need to re-put the variable on the stack to call the next method. When not chaining, it has to pop (i.e. discard) that previous return value and then re-put the builder/buffer variable on the stack each time.

But this is seriously micro-opimtization only beneficial in the most strict of situations. Only in this crazy situations would I ever use this as justification to choose one approach over the other.

</comment></comment><comment><USER8> Wondering if the similarity in performance of StringBuffer and StringBuilder has to do with lock elision. Can see if the compiler is doing this by examining the generated bytecode.

<comment><USER9> It might. There are other optimizations for synchronization introduced around Java 1.6 after wisdom around StringBuilder was already common. I think it's still safe to say StringBuilder at least can't hurt performance. More info: [https://www.infoq.com/articles/java-threading- optimizations-...](https://www.infoq.com/articles/java-threading- optimizations-p1)

Separately, it's interesting to me chained calls can be more efficient. Personally I prefer these longer, multi-line type of statements from a readability perspective. So I'm happy it happens to be efficient.

</comment></comment><comment><USER10> I wonder what effect +OptimiseStringConcat has on those benchmarks. It's supposed to collapse a lost of .append calls and tries to use the minimum amount of StringBuilder objects

<comment><USER11> Huge, like several times faster (3x when I benchmarked IIRC). I'm a little surprised the author didn't mention it anywhere - it might account for some of the differences he saw.

However with a normal JVM the only way to know if its happening (AFAIK) is to look at the compilation logs or JIT'd assembly, bytecode isn't enough

<comment><USER12> FWIW I didn't mention/test the -XX:+OptimizeStringConcat, because the place where the changes were being made didn't have that flag enabled and as such wouldn't have been representative of the use case behind the blog post.

In any case, I re-ran the benchmarks with -appendJvmArgs -XX:+OptimizeStringConcat and saw no significant difference in the timing on OSX. You can of course run the gist linked at the bottom and see for yourself whether there is an impact for your OS but there is JEP280 which is looking at generating invoke dynamic for Java 9 which will change the measurements again and make the -XX:+OptimizeStringConcat flag obsolete.

<comment><USER11> -XX:+OptimizeStringConcat is enabled by default everywhere I can remember, AFAIK</comment></comment></comment></comment>


If hospitalized with Covid-19 and have no insurance, you'll likely owe $73k - <AUTHOR> https://www.businessinsider.com/coronavirus-covid-19-treatment-testing-costs-2020-3 <comment><USER2> If only there were a presidential candidate proposing to upend healthcare and make it affordable for all, and has been doing so for most of their career. Eh... won't get the votes. Who needs affordable healthcare, right?

<comment><USER3> The simple model that the other side presents where you get what you pay for and you only pay for what you need is easier to explain and thus easier to sell than the concept of forcing everyone to pay with the goal of ultimately reducing prices for everyone.</comment></comment>


Project Ivory - Features and the Testing Thread - <AUTHOR> http://pivory.com/#topic/1/1663

<comment><USER2> When Discourse was submitted to HN, this immediately came to mind, though I couldn't remember its name. It was a breath of fresh air in terms of approach and design style. It would be awesome to see chat-forum hybrids like this become popular, because I've wondered what could be done with a more evolved IRC. I only regret it's not in a language I operate in, and I'm not sure how easy it'd be to customise to add features.

A little tip - hit Ctrl+Enter to post your message.

Here's the relevant discussion thread (thanks davidcollantes), which got lots of comments and upvotes:

<http://news.ycombinator.com/item?id=4499845>

There's also an open-source release of it, but it seems not to have been updated in months:

<https://github.com/cheshirecats/CuriousWall>

(Also, is there a bug with scrolling on Chrome? No matter whether I scroll up or down, my mousewheel sends me down the page.)

<comment><AUTHOR> This is precisely the reason why I submitted the link once more. This project expressed a lot of potential when it was submitted some 6 months.

This is the first thing that came to my mind when project Discourse was announced. But unfortunately the project owner chesirecat lost interest and it's more or less abandoned.

<comment><USER3> He said he's opensourcing it feb 14th after he saw Discourse and that it was opensourced.

<comment><AUTHOR> Can you cite the conversation?

<comment><USER3> <http://pivory.com/#topic/1736>

</comment></comment></comment></comment></comment><comment><USER4> Boy is this new title lame. Formerly it was something like: "Pivory: the forum software that had a chance" , which told us that we weren't supposed to be looking at the thread, but rather the software used to implement it.

Which is pretty cool.

But - as was mentioned in at least one of the other cheshirecat/Pivory threads a homepage for this project would be really handy for these purposes :)

<comment><AUTHOR> Yes - the admins changed it. The new one does not capture the attention.

<comment><USER4> The bigger problem is that it also doesn't capture the purpose of the post.

</comment></comment></comment><comment><USER5> See:

<http://news.ycombinator.com/submitted?id=cheshirecat>

</comment><comment><USER6> Very elegant tool, but it could clearly do with a proper home/landing page to explain what it is, what it does etc.

</comment><comment><USER7> it does look nice. But forum owners want to monetize their traffic w/ banners and google adsense. But it looks like thats what your trying to solve.

<comment><USER8> I've tested revenue streams on forums, and neither of those things work.</comment></comment>


Route 53 Traffic Flow - <AUTHOR> http://docs.aws.amazon.com/Route53/latest/DeveloperGuide/traffic-flow.html?sc_ichannel=em&sc_icountry=global&sc_icampaigntype=launch&sc_icampaign=EM_158148660&sc_idetail=1063446210&ref_=pe_411040_158148660_9 <comment><USER2> Be careful with Route53 if you have low-latency requirements. In my experience, Route53 has highly-variable DNS resolution latency. When I contacted Amazon, they basically said it was good enough. Tellingly, Amazon itself uses Dyn for Amazon.com.

I do absolutely love the feature set and convenience of Route53, however.

<comment><USER3> Re: latency - be careful how you're testing. Providers often announce only a subset of their IP space from any given datacenter, so you might end up with eg. a nameserver in Virginia, Dallas, and NY. If you run a synthetic round robin test you'll get variable latency. But actual resolvers will hone in on and prefer the fastest from the set, only occasionally checking the others; your real customer latency is generally equal to the fastest of available NSs. This plus the amount of caching that happens in DNS makes the performance implications of the design minimal, and it comes with huge availability advantages.

That being said, you may still get crap latencies if all four of your NSs are getting anycasted to far away places. ;)

I wouldn't read too much into amazon.com not being on R53. That company behaves like a diverse set of companies under one umbrella name, and some of those move at a much slower, much more conservative pace than others (more like "if it ain't broke...")

<comment><USER4> If it ain't broke, why aren't we using it?

</comment></comment></comment><comment><USER5> This really just looks like a visual interface for what was already possible using Route53 (albeit in a much more convoluted way). It seems AWS is investing in visual alternatives for some of the more complicated aspects of its environment. They just released a similar visual editor for CloudFormation[1] a few weeks ago.

[1] [https://aws.amazon.com/blogs/aws/new-aws-cloudformation- desi...](https://aws.amazon.com/blogs/aws/new-aws-cloudformation-designer- support-for-more-services/)

<comment><USER6> Glad to see cloud formation getting some love.

The real problem with CF however is that if something goes wrong during a CF deploy you don't have enough control to stop it. If CF doesn't have perms to remove an interface or something it can just spin for 1 or 2 hours. During that time you can't make changes to your stack!

</comment></comment><comment><USER7> Can you use AWS53 latency, failover and geolocation for sites not hosted on EC2?

<comment><AUTHOR> Yes and no. You can use it, but with latency the only way to specify the location of your servers is by relating them to a AWS region [1]. This works more or less. Rather less for us-west [2]. For a simple failover this shouldn't matter.

[1] AWS Regions: ap-northeast-1: Asia Pacific (Tokyo) ap-southeast-1: Asia Pacific (Singapore) ap-southeast-2: Asia Pacific (Sydney) eu-central-1: EU (Frankfurt) eu-west-1: EU (Ireland) sa-east-1: South America (Sao Paulo) us- east-1: US East (N. Virginia) us-west-1: US West (N. California) us-west-2: US West (Oregon)

[2] For me the most parts of the US are mapped to us-east, even most part of the west coast. However, I am a noob in regards to DNS routing realities.

<comment><USER3> This. In general, you want to be measuring the latency directly to the resources you're routing to - the Internet's a screwy place, and latency to an AWS datacenter in Virginia might not match latency to your datacenter nearish Virginia. AWS provides a latency dataset for their infrastructure, but I'd probably stick to geo if I'm routing to resources not actually on their infra.

Other providers (eg. NS1) offer more ways to feed data into their system, so you may be able to create your own latency dataset and ship it off to them to use as a routing policy. Most large companies have built similar looking systems for tracking client latency to their DCs (look up Facebook's sonar/cartographer for an example). Synthetic, backbone monitoring like pingdom/gomez/etc. is usually not as useful for latency routing as RUM metrics.

Edit: And to be clear, failover and geo have no ties whatsoever to running on EC2. They're also common features across managed DNS providers, so it'd be very easy to run the same config across multiple providers for redundancy or migrate off of R53 without lockin (check out Netflix's denominator library).

</comment></comment></comment><comment><USER8> A great idea, but the pricing seems a little steep ($50/mo/policy) for something that can already be done using routing policies in your hosted zones.

</comment><comment><USER9> The #1 thing I want from Route 53 is a "redirect record", as I have what feels like an infinite number of hostnames whose sole purpose is to be typo-fixes for domain names with multiple obvious spellings, and the current solution from Amazon involves me having to use S3 static web hosting with redirects combined with Route 53 in a way that makes the S3 console almost impossible to browse anymore due to the insane number of bogus entries.

[http://stackoverflow.com/questions/10115799/set-up-dns- based...](http://stackoverflow.com/questions/10115799/set-up-dns-based-url- forwarding-in-amazon-route53)

(And S3's feature is brittle and itself complex to configure correctly. And it requires talking to Amazon to get a bucket limit increase. And it is actually super slow, for something that can and should be implemented using Amazon's Route 53 infrastructure rather than using Amazon's S3 infrastructure: if those same nodes that already are set up for anycast also listened for HTTP and returned what are essentially DNS requests made via HTTP for that one kind of record, the problem would be solved in a way that is clean from a conceptual level and efficient from an implementation level. It would be absolutely amazing.)

This seems like a use case literally every person with a website has: you need to redirect the .net and .org to .com, for example. I have a ton more, as I have things like {cydia,mobile}{-,}impactor.{com,net,org}, but everyone has at least a few. I mean, we also all have a redirect for "www." either to or from the bare domain, right? And that one is super performance sensitive as it is used constantly: it is stupid to have that in your app layer using those resources and incurring that latency, but that is how many people set that up.

It really seems like a simple problem to solve. Maybe "too simple"? Is it just not fun to work on? There are a ton of these things that would benefit every single user, from users who barely know how to build websites to people who build complex networks of cloud resources. Another example is virtual serial console access.

Many years ago I requested this one on their forums, and I just got an email notification earlier this year telling me someone else has added a +1, after this thread died down the year after I posted it. Way way too often there is an issue on a server where the SSH daemon can't start because of some tiny mistake: you just need to log in and correct one configuration option, or even more infuriatingly, press "y" at some operating system prompt that is blocking you. I catalogued other reasons I used that feature from my old hosting provider on the thread.

[https://forums.aws.amazon.com/thread.jspa?messageID=233302](https://forums.aws.amazon.com/thread.jspa?messageID=233302)

Back in the day this was fatal to the server. With EBS you can unmount the disk from the computer, attach it to another one, modify it, and then put it back in the original computer... but that is not a reasonable way of solving this problem.

And this also comes up for experts: I have deployment scripts that automatically build computers, and debugging them is a pain in the ass. Amazon lets you see the console output, but it has some ludicrous delay on the data. If I could watch the process happen interactively, and then fix and continue issues while I debug my scripts, it would save me a ton of time.

My old hosting company actually had this feature, and I still use it to this day occasionally when there are network issues. If I want to mess with the box's firewall, I log in via the serial console, so I don't have to worry about firewalling myself from accessing the machine. It is downright epic.

All of the comments on Route 53 Traffic flow I am seeing here are "I can already do this better" and "I wouldn't use Amazon to build this kind of thing anyway". Solve the redirect problem: people seriously advocate for getting hosting from a cheap non-Amazon provider to do these redirects (that's what I do!) because there is no truly good way to do this currently. Build me a serial console: it is crazy that I feel like there is anywhere at all where a company like 1&1 has a better cloud-oriented feature for virtualizing running systems than EC2 :/.

<comment><USER10> Cloud instances are ephemeral. Stop treating them as long-lived pets and all the deploy/config pain you described simply vanishes. You won't even want to tail a serial port anymore. It'll be like living in the future.</comment></comment>


Fission: Serverless Functions as a Service for Kubernetes - <AUTHOR> http://blog.kubernetes.io/2017/01/fission-serverless-functions-as-service-for-kubernetes.html <comment><USER2> From the article:

> To optimize cold start overheads, Fission keeps a running pool of containers > for each environment. When a request for a function comes in, Fission > doesn't have to deploy a new container -- it just chooses one that's already > running, copies the function into the container, loads it dynamically, and > routes the request to that instance. The overhead of this process takes on > the order of 100msec for NodeJS and Python functions.

100 ms of overhead is pretty steep. Google recommends a limit of twice that for the entire server response ([https://developers.google.com/speed/docs/insights/Server#rec...](https://developers.google.com/speed/docs/insights/Server#recommendations)):

> You should reduce your server response time under 200ms

Still, I've heard that AWS Lambda may run around 200 ms, so perhaps Fission is doing OK here.

But with modern progress in fast-starting compiled languages like Go and Rust, I'd love to have some easy way to supply small static binaries instead of source code. With compiled web server frameworks, it's feasible to handle over 250,000 (very simple) requests per second, or thousands of requests while Fission is trying to figure out where to send your source code. It doesn't always make sense to pay for interpreter startup overhead on every request (EDIT: this is not the case according to the Fission developers), especially not now that compiled code is so easy.

<comment><USER3> Everything old is new again.

So in the old days there was a way to supply a binary rather than source code. That binary could be fast starting. There was even an open standard for connecting those binaries to different web servers. The standard used unix patterns such as reading stdin and writing stdout.

Sometimes it seems like people have created an insanely high learning curve to run their CGI programs. Sometimes it seems like most of the magic and value add of some of these platforms is that they reduce some of the overhead they added.

<comment><USER4> Someone needs to start a "container global initiative", and then we can keep all of our binary containers in "cgi-bin".

</comment></comment></comment><comment><USER5> Zappa author here, very excited by this project!

We've been planning on supporting other DIY/non-AWS offerings in this space - particularly IBM's OpenWhisk[1]. If the Fission authors are here - can I ask how the two stack up? OpenWhisk's ability to write your own custom even sources seems like a leg up, as does their wider language support, but Fissions's Kubernetes foundation seems preferable. Curious how the two compare!

[0] [https://github.com/Miserlou/Zappa](https://github.com/Miserlou/Zappa) [1] [https://developer.ibm.com/openwhisk/](https://developer.ibm.com/openwhisk/)

<comment><USER6> Hi there, it would be awesome to have Zappa support Fission, happy to talk more about it!

We're working on a detailed comparison with Openwhisk, but basically -- we bet on Kubernetes as a good foundation to build this on, and it seems to be going well so far. It's true that we're at an earlier project maturity stage than Openwhisk is. In particular, we're actively working on integrating event sources and adding support for more languages.

<comment><USER5> Awesome!

Can you talk more about Fission Router? This seems to be where most of the hand-waving is happening right now :) AWS API Gateway doesn't get very much love, but it is actually a very important part of the server-less ecosystem.

Why did you write your own Router and not make an nGinx plugin, for instance? How well does it scale? How do you deploy it? What features does it have?

<comment><USER6> Agree on the importance of API gateway.

Feature-wise, fission router is very simple right now. It's a service based on gorilla/mux. We had to write our own router because of cold-starts -- basically, the router needs to be able to talk to the pool manager and to get an instance when one doesn't exist, while holding on to the incoming request. (I'm not sure how much of this is possible to write as an nginx plugin.)

I don't have perf numbers just yet, but the router is stateless and you can just run more replicas when you reach its limit. It caches results from the rest of fission components, and most requests are on this fast path.

(We're also thinking about adding some existing feature-ful API proxy in front of the router, to get stuff like authentication, rate limiting, etc.)

</comment></comment></comment></comment><comment><USER7> It might be the case that docker was just some enabling technology to go back to static binaries even with dynamic languages that IMHO expect a more complicated runtime setup.

So if one goes with statically compiled web services written in e.g. Go, Rust, Haskell or any other language supporting static binaries (most languages support this actually, but not all of them encourage you to do it), the only thing missing is a deployment framework that distributes your binaries to your (potentially virtual) machines. So am I correct that this is the point where Kubernetes comes in?

So how to use Docker in production is a controversial topic and the consensus seems to change rapidly, but in my opinion is mostly used as a weapon against dependency hell, but this problem is mostly solved using static binaries. Other use it for sandboxing, but I am not sure what security guarantees one can expect here.

If one compares static binaries with Docker containers how do they compare from a security point of view if one is hyperparanoid that the code executed may harm the host?

<comment><USER8> I would add another advantage: You get to escape the steaming mess that is configuration management. Our legacy landscape uses VMs configured with Chef, and our new landscape has containers on Kubernetes. I like the latter approach much better since I don't have to care about idempotency or whatever. I just scrap the container, start a new one, and its startup configuration is handled by a (usually trivial) shell script that `exec`s into the application binary at the end.

<comment><USER7> But if the shell script is trivial, why not just give the binary its runtime constraints via arguments or environment variables?

IMHO configuration management overlaps with dependency hell, or could be seen as a dependency. You do not have to bake the dependency into the binary, but just have to setup the runtime environment.

<comment><USER8> Putting a shell script in front of a third-party binary is easier than setting up a build pipeline to build that binary with the modifications that you need, and maintaining those patches across releases. (And that's implying that you have the source code for the binary at all.)

Of course, the perfect solution is to upstream the necessary changes into the binaries that you need, so that you can supply all configuration via args and env.

</comment></comment></comment></comment><comment><USER9> I'm relatively new to the Serverless/FaaS space. Or to be more precise: I missed AWS Lambda and only heard about it when OpenWhisk was donated to Apache.

I have a couple of questions, maybe someone here has answers for me:

1) In particular I'm wondering about expensive one-time/setup operations (e.g. opening a database connection) that are usually done once at startup of a service. But that doesn't really apply here. How are these things handled?

2) As a Java guy I also wonder which of these tools support Java and how they deal with dependencies and JVM startup times etc.

3) And my last question: How do these integrate into development workflows? Continuous integration? Run this offline/local etc. Will I need a Kubernetes instance on my machine?

<comment><USER6> 1\. One time operations like that are run at module init time. Here's a trivial example: [https://github.com/fission/fission/blob/master/examples/pyth...](https://github.com/fission/fission/blob/master/examples/python/guestbook/add.py#L9)

2\. We don't support Java yet, but we'd like to. The JVM would already be running by the time there's a request, so there won't be a JVM startup in the request path.

3\. Dev workflows: Lots to do on that front. A big part of our roadmap is improving the dev workflow, better versioning support, CI/CD.

For running locally, yes, the best way is to run a local Kubernetes instance on your machine. minikube makes it very easy to do that, see the instructions in the README: [https://github.com/fission/fission#setup- kubernetes](https://github.com/fission/fission#setup-kubernetes)

<comment><USER10> OpenWhisk actions (equivalent to functions in other frameworks) have two life cycle events: initialization and execution. The very first activation of an action (a cold start), will initiate both events. Future activations of the action, if they're contemporaneous, will only generate execution events. This is the warm execution, which can take advantage of previous activations. To provide scaling, it is necessary to sometimes create new execution environments for the repeated actions, and so that means new initialization events.

While one cannot rely that all executions after a cold start are warm, it's possible to for the action code to check if it's warm and forgo internal initialization as needed. This is a convenient trick that's common to avoid expensive setup.

For Java actions running in OpenWhisk, this can be done with static fields.

A nice flow of the lifecycle can be seen on slide 24 here [http://www.slideshare.net/psuter/openwhisk-deep-dive-the- act...](http://www.slideshare.net/psuter/openwhisk-deep-dive-the-action- container-model).

<comment><USER9> Thank you both. That was very informative. Trying the OpenWhisk Vagrant demo now.

I've seen a couple of issues and I agree that it would be fabulous to have OpenWhisk integrated into OpenShift/Kubernetes.

<comment><USER10> It remains to be seen if the abstraction that Kubernetes adds to manager containers will have performance characteristics that serverless demands - considering the need for container reuse, reclamation, pause/unpause, and elastic scaling.

Should you need help with OpenWhisk please reach out to us on [http://slack.openwhisk.org/](http://slack.openwhisk.org/) or GitHub.

</comment></comment></comment></comment></comment><comment><USER11> This is handy. It would be great if you could add Go as a supported service language.

<comment><USER12> While native support is always better, this seems to be implemented similar to AWS Lambda sothe same approach should work there as well. You can have a husk of a nodejs app exec the precompiled binary of your go program. You'd just have to make sure the CPU arch matches up with the k8s infrastructure (i.e. it's going to be Linux x86-64).

</comment></comment><comment><USER13> A serverless framework using k8s to hide the servers make a lot of sense

</comment><comment><USER6> Hi all, Fission developer here. Happy to answer any questions.

<comment><USER14> Hi, on the kubernetes blog[0], there's a command:

`fission function create --name hello --env python --code hello.py --route /hello`

The `function` function, doesn't seem support route, and should be broken up into two parts:

`fission function create --name hello --env python --code hello.py fission route add --function hello --url /hello`

Taking a look at the help menu for function it's not there, I'm running:

`fission version 0.0.0`

[0][http://blog.kubernetes.io/2017/01/fission-serverless- functio...](http://blog.kubernetes.io/2017/01/fission-serverless-functions-as- service-for-kubernetes.html)

<comment><USER6> I think you're on an older version of the CLI, can you try updating it? [https://github.com/fission/fission#install-the-client- cli](https://github.com/fission/fission#install-the-client-cli)

<comment><USER14> Tried it, still isn't working.

<comment><USER6> Oops, sorry, the option is supposed to be --url, not --route. I'll submit a fix for the blog.

$ fission function create --name hello --env python --code hello.py --url /hello

</comment></comment></comment></comment></comment><comment><USER15> I think it feels like a competition for celery. It fits into those tasks that are too heavy to run on the primary web server, but too small to set up the dedicated deployment/replicaset.

On slightly different note, I am still looking for a good job pattern for my use case. I run jobs on very custom docker images (including deep learning and computer vision stuff). I currently use redis queue with todo items, each pod in deployment picks up items from the queue in the loop, but I dislike some things about it. Fission is not the good fit, but I am wondering if HN community would have some suggestions. I thought about kubernetes jobs, but they have some things I don't like.

<comment><USER16> Happy to hear more about what we can do around jobs!

Disclosure: I work at Google on Kubernetes.

<comment><USER17> Not the OP, but I'll chime in with what we're missing when we took a look at it. AFAICT there is no way to tell k8s to retry a job X number of times; you have to futz around with deadlines.

<comment><USER18> Job ordering/dependencies! Job1a must finish successfully before Job1b and Job1c.

Alternatively, all Jobs matching this query must succeed before this job. Failures can be OK if a configurable threshold of success is met. Exceeding the thresh fails the dependent jobs before they get to run.

You can do all of this with supervisor pods, but since you asked...

</comment></comment></comment></comment><comment><USER19> Kubeless from Skippbox is another open source serverless offering for Kubernetes [https://github.com/skippbox/kubeless](https://github.com/skippbox/kubeless)

</comment><comment><USER20> Your article mentions the reason you chose client code vs docker images, which I understand and can agree with. However, is there any plan to support docker images in place of client code?

What you're suggesting [initially] is very similar to what the folks at iron.io did but I'd really want to ship containers all around, not pieces of code. Iron.io addressed that a little too late in my opinion and their feature set around docker leaves a lot to be desired.

IMO, AWS Lambda and Google Cloud Functions are going to support docker in the near future, they have to if they want their ecosystem to be adoptable by all.

<comment><USER6> So we've started by focusing on improving the whole workflow, which is why we're operating at the source level. But we have occasionally heard the use case for working at the image level, and it has pros and cons, so we're thinking about it. I'd like to learn more about what you're trying to do -- did you consider just using Kubernetes Deployments and Services? Or are you saying you'd like to combine the on-demand start with working at the image level? Is this basically a resource optimization use case?

<comment><USER21> (not GP) I'm actually building something that would require running large amounts of containers of varying usage (some almost never used, some constantly queried) that serve up webapps and other network services, and being able to run services inside of containers instead of functions from fission would be awesome.

</comment></comment></comment><comment><USER22> Isn't one of the big benefits of serverless functions being able to scale transparently? Can a kubernetes cluster give you anywhere near the elasticity of something like lambda?

<comment><USER16> By and large, yes. However, the responsiveness is highly variable. Both pods and nodes can automatically scale, though it is intended that this is somewhat gradual, by design (you don't want to spin up 4000 nodes because you have a 30 second spike). Because the functions tend to be _very_ small, you can (likely) pack many of them together without having to scale.

Disclosure: I work at Google on Kubernetes

</comment></comment><comment><USER23> I've spent some time on a PoC FaaS project with Docker Swarm primitives and Docker 1.13 features - exploring things like auto-scaling.

[http://blog.alexellis.io/functions-as-a- service/](http://blog.alexellis.io/functions-as-a-service/)

Long version:

> FaaS is a platform for building serverless functions on Docker Swarm with > first class metrics. Any UNIX process can be packaged as a function.

> Enabling you to consume a range of web events without repetitive coding.

</comment><comment><USER24> Please see: [https://github.com/stackvana/microcule](https://github.com/stackvana/microcule)

We've got better functionality, streams ( not a buffered context ), more language support, and better response times.

</comment><comment><USER25> I'm a long time software developer, have recently implemented a series of web application servers on Heroku using Node.js, and I have no clue what this article is about. My suggestion is a better introduction might broaden it's readability.

<comment><USER8> I had the same problem with docker.com a few years back. I read through pages of "successful developer stories" and shit, and was sitting there like, "That's great and all, but what does it actually do?"

On the upside, this has led me to a good practice: When I do a website for one of my apps, the first few sentences will state in the utmost clarity what the software actually does.

</comment></comment><comment><USER26> This popped up a few days ago and it seems worth it to compare: [https://github.com/alexellis/funker- dispatch/](https://github.com/alexellis/funker-dispatch/)

</comment><comment><USER27> How does this compare against funktion ([https://funktion.fabric8.io/](https://funktion.fabric8.io/))? Both projects seem very similar.

</comment><comment><USER28> so basically a host your own AWS Lambda? very interesting wondering if this has any of the cold boot time lags

<comment><USER29> According to the article it has ~100ms "cold boot" times for Python and Node.js

<comment><USER28> I wonder why someone would host their own aws lambda, isn't the whole point of serverless so I don't need to mess with servers?

<comment><USER30> I was talking to a financial company about aws lambda and they wanted control over the underlying containers/VMs that is running the aws lambda, unfortunately AWS lambda doesn't give you that control and 'fission' does

<comment><USER24> You should look at [https://github.com/stackvana/microcule](https://github.com/stackvana/microcule)</comment></comment></comment></comment></comment>


Linkers and Loaders - <AUTHOR> http://www.iecc.com/linker/

<comment><USER2> I read this in paper format, and I can say I recommend it. It is however, fairly out of date, but the text should bring you up to speed on linker+loader ideas.

<comment><USER3> Linkers haven't changed since the invention of the relocatable program in the late 70s, though. None of the mainstream languages and operating systems implement Java's security or JIT features, so Levine's book is still valid and relevant, it just needs to be supplemented with the reading up on one's executable header formats of choice.

</comment></comment><comment><USER4> I have that one. It's a good book, and learning about that gray area between kernels and your code, that is inhabited by linkers, loaders, the C library, etc... is very interesting.</comment>


The math of why it's so hard to build a spherical Death Star in space (2018) - <AUTHOR> https://arstechnica.com/science/2018/09/the-math-of-why-its-so-hard-to-build-a-spherical-death-star-in-space/ <comment><USER2> >The Death Star was constructed in space, a realm where massive things (moons, planets) tend to take on a spherical shape due to gravity. But when Orlin did the calculations, he found that the size at which objects take on the shape of a sphere is about 400 kilometers in diameter, which is significantly larger than the ~160km Death Star.That's why Orlin's hypothetical Imperial team physicist keeps insisting the Death Star should be more lumpy, shaped like an asteroid. Orlin's conclusion: "The Death Star is not nearly big enough. But maybe Imperial steel is very, very dense and thus goes spherical much faster."

So the death star isn't big enough to collapse into a sphere by itself, except that's totally irrelevant because it's an artificial construct and not a natural object. The author of this book cannot possibly be as much of an idiot as the article is making him sound.</comment>


An Eulerian Hoax (follow-up to an impossible puzzle) - <AUTHOR> http://cjauvin.blogspot.com/2012/02/eulerian-hoax.html

<comment><USER2> What's the solution to the "easy" puzzle?

<comment><AUTHOR> I'm aware that it's not particularly easy to read, but a solution (there are many) is actually the path found by following the red dashed arrows (starting at the top node) in the second graph of my latest post.

<comment><USER2> Oh, my mistake was misinterpreting the puzzle as one where you had to _draw_ , not cross, each line in the shape.</comment></comment></comment>