The Medical Bill Mystery - <AUTHOR> http://www.nytimes.com/2015/05/03/sunday-review/the-medical-bill-mystery.html?smid=fb-nytopinion&smtyp=cur <comment><USER2> The entire medical bill and insurance system is insane. I say this after going through 2 pregnancies (with my wife) and now with 2 young kids.

The process is that you go to the doctor, they will NOT tell you how much it costs out of pocket because that amount is probably insane anyway but you need insurance to "bill" that insane amount to the insurance company. The doctor will send say $1000 bill to insurance company for a simple checkup (yes, it can be that bad). THe insurance company then will say "no no sir, we only allow $200 for this specific item". Then insurance company will figure out how much you the patient ius supposed to pay out of that $200 (copay, co-insurance etc) and THEN they will pay the remainder to the doctor.

See the issue here ? The price of a simple checkup is inflated from $200 (we can argue on this too) to $1000. This $1000 is just to scare you but really does not mean shit.

Imagine that the doctor could bill you that $200 directly anyway or whatever amount they eventually get from insurance company. It will save their time, your time, their staff hours and probably save more for them in terms of resource usage.

What we need is a system where not everything goes through insurance. This scare of having mandatory insurance is the root cause. Doctors/hospitals need to have transparent pricing just like other businesses and insurance should only bee needed for really catastrophic events like cancer, major accident etc.

I would much rather pay $200 to a couple of visits instead of paying insrance $1000/month just to "insure" myself.

<comment><USER3> Or you get a single payer and this charade goes away because the single payer's price list is fixed. This is how the rest of the world does it.

<comment><USER4> Western Europe != rest of the world.

The Indian system is a 1 billion payer system. The single price is also fixed and usually written on the wall, or maybe in a big book of prices. You ask for a price quote, receive it, pay that much and get it done. If the price is too high you go elsewhere.

It works nearly perfectly. For any medical conditions I have that permit flight, I'm voting for it with a plane ticket.

</comment></comment></comment><comment><USER5> The most important thing I've learned is that the "bill" is not like the bill that comes at the end of the meal at a restaurant. Medical bills are more like the first offer in a long negotiation process. Unfortunately for the uninsured who get serious illnesses these days, it often just amounts to an impossible demand that is then graciously negotiated down to merely everything they have.

<comment><USER3> Basically, Oracle pricing.

</comment></comment><comment><USER4> I had four surgeries last year. In all cases I was given a price quote plus a ballpark on the cost of incidentals (things purchased outside the hospital, e.g. antibiotics to consume at home). For example, I was told that my spine surgery would cost 1.4 lac only. The final bill: [https://imgur.com/Dbkrmo7](https://imgur.com/Dbkrmo7)

In all cases the final price agreed with my initial quote down to the rupee. The cost of the incidentals was also within the ballpark that I was told (and minor in any case - e.g. 1.4 lac for surgery and 2-3k for post surgery pills).

One of the wonderful things about India is that the medical system is almost entirely consumer driven - you have a problem, you pay the doctor, and he does his thing. Customers choose a doctor based (in part) on price, resulting in price competition. Nonsense like refusing a price quote will result in customers walking away.

Given a choice, I'll always choose to consume medicine in India. It's just a vastly superior system to anyplace else I've tried.

<comment><USER6> Couldn't agree more. I am an Indian and when I first came to US, my biggest surprise was that jobs would advertise 'health insurance' as a benefit. I never understood it till I had to obtain medical care.

If you want to experience true free market health care, you must go to India. Whenever I visit India, I make sure to get my teeth cleaning done. Person in my home town has a choice to get teeth cleaning done from 500 INR (7$) to 3500 INR (55$). On the low end, you get a clinic which is not in the hip part of the town, equipment is not the latest and greatest and the waiting room will be non air conditioned. On the higher end, the clinic will be fully air conditioned, serve you tea/coffee and will use the latest equipment. On my last trip, a real dentist (not a hygienist) performed my teeth cleaning and they took my teeth x-ray using those new machines where you stand up and the machine takes 360 degree scan. After the cleaning, the doctor took me to her office and reviewed the x-ray with me and then gave me a CD with all the x-ray images so that I can use them with my next doctor in case I decide to go somewhere else.

<comment><USER7> How long did the dentist spend cleaning your teeth? My experience is hygienists spend more time and are more thorough because _that 's their one job_. Also, several dentists over the years have recommended to me seeking a dentist that an employs a hygienist for this reason.

<comment><USER6> I have done teeth cleaning in both US and India and I don't think there was any difference in terms of the time spent.

</comment></comment></comment></comment><comment><USER8> As someone who has recently gone through a property purchase and had to deal with the forms mandated by the new "reform" laws mentioned in the article, it's pretty clear that the laws have made things much more confusing. I've purchased property before, and this time around the forms were much more confusing, and downright misleading at times. Talking with the pros involved in the purchase, they unanimously agreed - they were constantly having to explain what the forms meant to seasoned home buyers. It's clear that gov't bureaucrats should not be trusted to specify forms that are intended to make any sense.

This article is a good sign that now that high deductible plans are becoming the norm, people are actually interested in what's being billed and in controlling costs. Hopefully this will lead to a reform where health insurance is more like other insurances (purchased by the person needing it instead of employer, purchasable across state lines, ...). I know that one of the reasons I keep my car insurance company is that the mechanics of doing business with them is nearly frictionless.

</comment><comment><USER9> I had surgery last year. There was a steady stream of bills, some duplicates, some not, and I had no idea how much I needed to pay (to say nothing about what the charges were for). My wife went to the hospital to clear things up and they couldn't even tell her how much they wanted me to pay - and this was months after the surgery. Finally, after a couple weeks had passed, they decided what I was supposed to pay. Good chance someone just wrote down a number.

<comment><USER10> My feeling is that the experience could be improved dramatically right now if instead of ever directly paying providers, we instead always paid the delta to the insurance company. My experience with provider billing offices is that they actively weasel and trick you into overpaying the negotiated rates and hope you don't go over the bill. And then they stall and "forget" to refund. Nothing ever makes sense until the explanation of benefits document is generated.

In other words--if we're not going to do single-payer, then it should at least be single-payer-per-patient.

<comment><USER11> I guess insurance companies don't want be involved in the collection business.

So much so that, my dental insurance company (Delta dental, funny enough) cuts me the reimbursement check. And I have to pay my dentist.

<comment><USER10> Of course they don't. Everyone wants to externalize the unpleasent parts of business.

</comment></comment></comment></comment><comment><USER12> There's one simple fact that can save patients real money: network providers generally can't go after patients for fees that aren't covered by insurers. Forgoing that right is typically part of their deals with insurers. They often go ahead and bill patients anyway. But they back off when challenged, saying that they billed in error.

<comment><USER13> Can you explain further what you mean? I recently had an x-ray that was not covered by my insurance, and the hospital submitted it to my insurance to ensure that it would apply to my deductible.

I guess you mean a fee that is uncovered in the sense that it would not apply against the deductible.

(It's total BS, the price I paid was 5x the medicare reimbursement rate, like 15x the medicaid reimbursement rate and I would speculate at least 2x what the insurance company would pay (based on researching the 'typical cost' of the particular x-ray on the internets).)

<comment><USER12> I was specifically referring to stuff that's covered, and where the provider bills the patient for it's cash-price fee, less what the insurer paid. Network providers generally can't do that. But out-of-network providers certainly can, and those fees can be huge.

In your case, I'm guessing that your insurance doesn't cover outpatient services (or perhaps just imaging) at hospitals. Even if the hospital is in network. If that's the case, make sure to have that stuff done at stand-alone clinics, where it should be covered.

<comment><USER13> It was the imaging. Good to know that it should be covered at a clinic (I was actually at the urgent care clinic adjacent to the hospital, but they get their imaging services from the hospital).

</comment></comment></comment></comment><comment><USER14> The comments from those in India are interesting. Here in Thailand it is similar. Prices for standard procedures are published and you get an estimate in advance if it is a complex procedure. This is true for private hospitals. It is also true for public hospitals that offer "special clinic hours" which is when foreigners must go since they are not covered by the national health insurance scheme. To top it off, quality of care is better here than what I experienced in the U.S. at a fraction of the price. It drives me nuts to be reminded of the U.S. health care mess.

</comment><comment><USER15> It's not just the billing codes that are insane, it's also the differences in prices. I recently filled a prescription at CVS. CVS billed my insurance company nearly $200 for 90 days. I found out that you can get the same prescription at Target for $10 for 90 days. (I'm not sure that the insurance company will actually pay $200 - I'll have to wait to see what the claim says).

</comment><comment><USER16> > 1\. 25030731 HC RT OXYGEN DAILY CHARGE — $2,132.25.";

>The supplemental oxygen delivered into the nose after surgery, a routine precaution at many hospitals.

What is wrong with US healthcare in one sentence. two thousand dollars for oxygen is beyond ludicrous. There is no way this cost could be justified.

<comment><USER8> This is a completely rational price given that none of the prices are published, and that the prices tend to be set more on who is doing the paying than anything related to the actual cost.

Do an experiment sometime. Pretend that you need an MRI of your head. Call around to the various places that provide MRIs and see if you can get (a) the price, (b) a description of the equipment that will be used so that you will know if it will be a good MRI or an ancient one.

It's pretty laughable that we just had a major "reform" of our health insurance system, with lots of lip service paid to cost, and yet there is still no information available to allow people to make decisions based on cost and quality, and this appears to be by design.

<comment><USER17> "Your medical care would be paid for by others. And therefore you would gratefully accept, on bended knee, what was offered to you as a privilege. Your role being responsible for your own care would be diminished."

<comment><USER18> I've paid (either directly, or by an employer having paid money that otherwise could have gone to me) about $60,000 into the medical insurance system since leaving college. (That's 10 years times $500 per month, which is a low estimate.) I've also paid several hundred thousand dollars in taxes to a government that prioritized blowing up Iraq over protecting us from things that might actually kill us, like cancer and heart disease.

Given the amount paid, I see health care as a right, not a privilege. We already have high taxes and high insurance premiums. Yet we live in a society where it's pretty much random whether your insurance even covers you when you get sick.

</comment></comment></comment></comment><comment><USER19> They always give me direct, flat prices beforehand, once I tell them that I don't have insurance, and after they pull out their "other" price chart.

</comment><comment><USER20> Where is the startup helping me to decode my medical bills?

<comment><USER21> How would knowing the meaning and even the average cost for a given code change your behavior? It's still basically impossible to get even an estimate of cost for even the most basic medical procedures before having one.

Also, the bills are much more complicated than what they print out and mail to you. The amounts can vary based on many different factors, such as BMI, alcohol/nicotine dependency, and other risk factors that make you more risky to provide care for.

<comment><USER22> Why would it need to change your behaviour - if your paying for something surely you have a right to have the bill explained to you and for you to be able to challenge individual items?

[NB I'm from the UK so I have no idea how medical billing works. But I do have plenty experience with lawyers and I know that getting a details breakdown of work charged is a _really_ good idea.]

<comment><USER21> Well, at the point that you have a bill, you are kinda beholden to the people that sent it. You can't easily dispute a charge with our system. It would definitely be useful to understand the bill later on, if you could actually do something about it. My point is not being able to know the estimated charge before you choose a provider makes it impossible for the market to work, because competition can't happen, at least not with costs.

</comment></comment></comment></comment><comment><USER23> Sometimes I wonder if I sent an incomprehensible bill to the hospital for services rendered if they would pay it.

</comment><comment><USER24> I just received a bill for some SEO that I never ordered. I explained to my mother that it was a common scam, then pitched it into the recycling bin.

If my company were larger than just myself, that bill would have gone to Accounts Payable, with a good chance that it would get paid. Accounts Payable staff at big companies don't have the headspace to chase down whether someone really ordered $85.00 worth of SEO service; such a small amount would not require managerial signoff.

<comment><USER25> I worked for a company that bought about £100,000 of electronic components (plus other stuff) per month. They knew where every single item was - down to the paperclips.

I'm kind of surprised to hear that tech companies might not know where their money is going, especially when it's $85.

See also "Cuckoos Egg" where a few cents difference in billing leads to uncovering hackers intruding on the network.

<comment><USER24> I expect your former employer was quite successful. Many aren't.

My full name is Michael David Crawford. I had a classmate in high school named Michael Dwayne Crawford who often skipped out of school. High school truancy before the age of sixteen is a criminal offense in California. Whenever Mike Dwayne would skip out, the police department's truant office would call my father at work, who then had to take leave from his important work of fighting the cold war then ride his motorcycle twenty miles - sometimes in the driving rain - then visit the principal, all to say "This is not my son".

This because the school's MIS system only recorded our middle initials.

</comment></comment></comment><comment><USER26> One minor, pathetic quibble:

> "The baby boomers have tolerated the current system," she said. "But > 20-somethings and millennials are not used to this and they won't."

So as a Generation Xer, what am I, chopped liver?</comment>


Trees, cabs and crime in San Francisco - <AUTHOR> http://www.flickr.com/photos/shazbot/3282821808/

<comment><USER2> There seems to be a lot of crime in San Francisco, that is sad. It was once a nice safe city. In the 1960's many young people from all over the country came there as a destination for peace and love.

Interesting map although I'm not sure there is any correlation between criminals and cabs or criminals and trees. There may be other factors at work here besides trees and cabs. I think the criminals will do their criminal activity where ever they can find an opportunity. Tree and cabs or not. Nice map though.</comment>


We don't know how to program... - <AUTHOR> http://blogs.azulsystems.com/cliff/2008/04/we-dont-know-ho.html

<comment><USER2> I have to say that this blog post is a fantastic summary of a lot of the challenges to concurrent programming past and present.

I sort of wish that there was at least brief discussion of things like software transactional memory or compare and swap

<http://en.wikipedia.org/wiki/Compare_and_swap> <http://en.wikipedia.org/wiki/Software_transactional_memory>

</comment><comment><USER3> I liked the article, specially since it comes from someone with long experience in the subject.

But what it seemed more interesting is the company. Specially here in HN it seems that many start ups are focused on social networks or other consumer applications. This guys are basically selling technology. They seem to have found an interesting niche.

</comment><comment><USER4> A great post. I remember the criticism of Java circa 1997. It has come a long, long way indeed.

Tangentially, this is a reason why many (very smart) programmers stick to "blub" like Java. In practical every day reality, the investments in VM improvements, libraries & tools play a huge role in productivity. As an example, most modern IDEs (really lots of macros in disguise!) take the pain out of most of the verbosity while writing code, and such verbosity actually is a plus for _reading_ code.

</comment><comment><USER5> > _In short, the easy pickin's have long gone, and now we need complex tools > and complex coding styles to get more performance from more cores using the > existing languages._

I don't think _more_ complexity is the answer here. All this massive multithreading just makes things impossible to debug.</comment>


DeepSORT: Deep Learning to Track Custom Objects in a Video - <AUTHOR> https://nanonets.com/blog/object-tracking-deepsort/ <comment><AUTHOR> Object Detection has seen several recent developments and reached a wide audience but a very important and not widely known extension of the OD is its applications in Object Tracking. This blog explains the theory and challenges in object tracking, how to use pre-trained object detection models to identify and count unique objects and track their trajectories over several frames using the DeepSORT algorithm</comment>


YC-Funded FanChatter Takes Social Media To The Ball Game - <AUTHOR> http://www.techcrunch.com/2009/08/01/yc-funded-fanchatter-takes-social-media-to-the-ball-game/

<comment><USER2> From the comments:

"that team could build very similar functionality using free or open source projects"

Are baseball teams really in the business of hiring a bunch of programmers to write a twitter clone? Seems like paying this company is much cheaper and much more likely to be successful.

<comment><USER3> A team could easily hire someone to write a twitter hashtag aggregator widget though...

</comment></comment><comment><USER4> I'd much rather if the FanChatters (and other YC groups) would just share what they were working on via the site. Using TechCrunch as a middle man in exchange for perceived authority is lame, and I think HN would develop a much stronger community and culture if we all just shared what we were working on directly and asked each other for help.

<comment><USER5> They do it for the publicity, not the authority. Only a small minority of people read HN. (And let's hope it stays that way.)

<comment><USER4> I understand the value of TechCrunch to get publicity with the general (tech) public. I just meant that within HN, I think sharing directly with each other would create a stronger community.

</comment></comment></comment><comment><USER6> Cool, sounds very similar to the project abossy and I worked on: www.twitterbowl2009.com

</comment><comment><USER7> Great job, guys, congrats on the launch!

</comment><comment><USER8> Congratulations guys, nice work!

</comment><comment><USER9> Congrats on the launch. As a passionate sports follower I would love to use fanchatter for my fav sports- F1 and Football.

</comment><comment><USER10> Congrats dudes!</comment>


Al Gore: ex-VP, environmentalist, gadget freak - <AUTHOR> http://www.engadget.com/2007/05/22/al-gore-ex-vp-environmentalist-gadget-freak/

<comment><USER2> Forget global warming. With _3_ 30" cinema displays and all of the computer and graphic power to push them, he should be more concerned with _office_ warming!

</comment><comment><USER3> I've always wondered where the 'internets' was born :)</comment>


Ask HN: Best teacher you ever had? Why? - <AUTHOR> Personally, I have a few.
Professor in college who ran my honors program. Awesome guy, approachable and laid back. He didn't teach to a textbook; everything was immersive. Instead of reading about Tesla, we visited the factory, for instance.
AP English teacher in HS. Kind lady that took no prisoners. Made for a funny combination. She was sharp as a whip and would call you out if your writing wasn't up to snuff. I learned more in this class than any other.
9th grade Honors English teacher in HS. The first class where I felt challenged in school. The teacher had been teaching the same class at the school for 40+ years. He was a moderate celebrity in our town by the time he retired. Didn't bother to learn a single student's name that year - nor was it needed for him to teach well.
3rd grade teacher. She would let me read Harry Potter all day. Very cool at age ~8.
There are a few others but these are the standouts that come to mind.
What about you? <comment><USER2> I had a professor from college who recently passed away. He was an unconventional teacher. High energy and sort of rambled on about the subject, his experience, and how non-tech folks experienced and reacted to tech.

His stream of consciousness communication style plus his decades of industry (steel mills) experience and expertise of the subject matter made him an excellent teacher. Computer Programming and Logic and Database Design classes were my favorites.

Also, he rewarded unconventional solutions to projects and test questions. One memorable example - I turned in a project and before he gave it back asked me to explain my thinking. After I defended my work he complemented my "creative" solution and followed it up with why, while it might work, was sub-optimal.

I really learned a lot from him.

</comment><comment><USER3> John "Jack" Minnick, higher math professor at De Anza College and author of multiple higher math texts.

I had to take the calculus sequence for my later B.S. in C.S. requirements. I entered Calculus I with some trepidation, but he structured his course so that you couldn't fall behind and stay in at all: lectures were daily, M-F, and most days began with a quiz based on the prior night's homework.

His lectures were thorough and just _flowed_.

He must have been in his 50s (based on when he joined the faculty) but looked 30s. He tragically died a few years later. I actually went to his memorial in SF; he had a broad base of friends spanning both arts and sciences. I recall one segment where a speaker read from "The Tempest". After the passage concluded, a member of the audience stood and proceeded to recite the next several passages from memory with the sturdy voice of a skilled Shakespearean actor.

</comment><comment><USER4> Mr. Andrews, high school computer science. I got bullied terribly in his class from other students[1], and he made sure I still got to take his classes.

He let me hide in his classroom and work on programming projects during mandatory pep rallies.

He taught me programming fundamentals like object-oriented programming and functional programming, database structure, and bug hunting I still use twenty years later.

He encouraged me and told me good classes he taught to take at the same time so I could work on skills in the right order, and when I had two of his classes at once he let me do work from the harder class during the easier class.

He wrote me a recommendation letter that showed he knew me, and I still have it framed in my office.

[1] I was the only girl, a year or two behind the majority of the students, and a sarcastic little thing. Kudos to him to telling me being aggressive and female at the same time was ok, and showing me how to do so in a better manner.

</comment><comment><USER5> I've taken Galileo's quote to heart:

>I have never met a man so ignorant that I couldn't learn something from him.

I think a lot of what this says too is that life experience is the best teacher, especially when it's shared among other people.

</comment><comment><USER6> I was on a year abroad exchange and had a professor on his 80s (who was also on an exchange). He was teaching a class called Organisational Change. On the first day he said to the class, "what is the most important problem facing the world today?" After much discussion, the class settled on climate change. He then proceeded to tell us Organisational Change was not important in the context of real problems, and as we decided on climate change, that's what he would teach us. And he taught it well.

</comment><comment><USER7> I'd say the best ones for me were the teachers in high school that understood we were too old to play the whole authority game any more - school with them became a place were I wanted to go learn from people who had more experience than me. Be it chemistry or an anecdote about their life, there was a lot to learn and a lot of teachers never forged that connection or taught us well because they still thought of us as mindless children. The ones that respected us were the ones I learnt from most and the ones I still appreciate to this day.

</comment><comment><USER8> Any tips on how to find a good teacher?

I do product management at startups, but often there is nobody more senior in product than me. For now I just jumped in to new jobs maximizing my responsibilities. I did this every time my learning rate dipped (usually after 1.5 to 2 years). I learned a lot from colleagues, but finding a more senior mentor in my field seems hard.

I also don't want to spend my free time going to meetups. I have the internet for democratic discourse and to learn from others experience.

</comment><comment><USER9> I don't remember his name, but he was my history / home room teacher in 7th grade. In terms of pedagogy he was pretty good, probably not the best. But I'll always remember him for being the first black male teacher I ever had. Previously my teachers were all white women. It really meant something to have someone who looked like me in that position of authority. I even considered becoming a teacher before coming to my senses. ;)

</comment><comment><USER10> It was an English teacher in high school. He was notoriously brutal with his grading, but always consistent and fair. The most important thing he taught me was that a two-page essay can say more than a 10-page essay, and it can do so in a way that maximizes impact.

It wasn't a lesson I truly appreciated until I joined the workforce.

</comment><comment><USER11> I had two exceptional teachers in college, in history and philosophy. As a compsci major, I hated both subjects before taking their classes, but ended up loving both subjects due to the professor's passion for their field and for teaching.</comment>


Ask HN: How would you improve the iPad? - <AUTHOR>

1 thing you would change about the iPad to make it better. It can be anything (including stuff that is not possible with today's technology).<p>I'm trying to get an idea of what the perfect tablet will be compare to what we have today. <comment><USER2> Not much. I would make it maybe 1/4 the weight and 1/4 the cost, but that'll take another few years. _An_ iPad is nice, about five of them scattered around the house is better. (Ever see Star Trek? They have so many fucking PADDs around they'll just _hand you one_ because they want you to read a single one page report.)

I would implement "multitasking" but the UI would still work the same: "closing" an app would just sleep the process and swap the memory out. I would allow some processes to spawn "background services" to play audio and maybe a couple other things.

They would be fully self-hosting machines with no dependence on a PC. Their data would sync to some type of cloud storage in some optimized semi-lazy way. For instance, if you download a recipe book on your bedroom iPad upon waking up, it'll show up on your kitchen iPad by the time you get to the kitchen. (If it's not actually loaded, opening it up will transfer it over, possibly p2p from the other iPad.)

And of course, it would have infinite RAM, storage, bandwidth, and CPU.

</comment><comment><USER3>
       1. A bit more ram.
       2. A camera
       3. Lower price.
       4. Time to mature.

</comment><comment><USER4> Without too seriously violating the design goals of the iPad: add a camera.

But without that constraint, I'd make it run a full OS (my preference would be Windows 7, but OS X would work for those who like it, I guess), with some kind of clever gesture layer of course.

<comment><AUTHOR> Front facing or back?

<comment><USER4> Front, for video chat.

</comment></comment></comment><comment><AUTHOR> Make it foldable in half. Advantages, it fits into a blazer pocket and makes carrying it much easier. And can also protect the screen. Here's for foldable displays.

</comment><comment><USER5> Multitasking with an elegant interface (which is a given for Apple). Also, maybe a little lighter. It's tiring to hold it up for long periods of time.</comment>


The Last-Access timestamp (2002) - <AUTHOR> http://www.xxcopy.com/xxgroup/m02/msg02599.htm <comment><USER2> Last-access time should just die. As explained in the article it is practically useless, and it causes unneeded disk writes, making disks fail sooner.

When installing Linux machine I always remember to add noatime to the mount options if it's not already there. Yes, I do know the default on Linux is "relatime".

</comment><comment><USER3> The only instances where I've ever even thought about atimes is noticing "noatime" flags on mounted filesystems.

It seems like even creation-times and modification-times took a hit in noteworthiness when home PCs got online and all the files on disk were no longer artefacts of only you and your OEM. What the ctimes and mtimes of stuff downloaded (and unpacked from various compressed formats) ended up being always seemed somewhat unpredictable and trained me to gloss over them during most modes of PC use.

</comment><comment><USER4> Since they can be disabled via the registery, it's not so much a shortcoming of programmers as a design feature.

[https://msdn.microsoft.com/en- us/library/ff794679(v=winembed...](https://msdn.microsoft.com/en- us/library/ff794679\(v=winembedded.60\).aspx)</comment>


I Will File Bugs for You (2014) - <AUTHOR> https://www.owlfolio.org/htmletc/i-will-file-bugs-for-you/ <comment><USER2> He's not only filing the bug, but also attempting to reproduce it. In the vein of doing things that don't scale, this idea is a clear winner.

It does seem like a valuable service: The project would get a verified/reproduced bug report from a known entity, and the reporter would get their issue addressed just by sending an email.

Under/over on how long before he can't offer this for free?

<comment><USER3> It was first posted on `14 August 2014`. So my guess is no one has really taken him up on the offer.

<comment><USER4> Well, it's getting a lot of attention now.

</comment></comment></comment><comment><USER5> I like this. Less so for his actual offer, but more because he is calling attention to how hard it is to do this for people who don't want to deal with a "bug tracking system... optimized for people who spend all day every day working with it".

It would be nice if there was a single, easy to use site for mere mortals to enter bug reports (and others can comment on them, vote on them, process them, etc).....one sort of like Github or StackOverflow, where we all sort of agree to use that site.

<comment><USER6> > It would be nice if there was a single, easy to use site for mere mortals to > enter bug reports (and others can comment on them, vote on them, process > them, etc).....one sort of like Github or StackOverflow, where we all sort > of agree to use that site.

Where they exist, they promptly get overwhelmed by all kinds of stupid shit. Then the devs have to filter through insane amounts of crap and sundry sorts of spam for the few things that are actually useful bug reports. Google code had this going on for a while, if memory serves.

With this in mind, the effort required to file a bug is not so much a bug as it is a useful filter. Yes, it cuts down on the actual bugs filed, but it cuts down far more on all the crap you don't want.

<comment><USER7> In my experience the "stupid shit" and "crap you don't want" is often useful feedback. At the very least, it tells you which parts of your app are most confusing.

For example, if you get lots of complaints about something you consider obvious, maybe you should reconsider what's obvious. Often minor changes like improved docs or more googleable error messages can improve the experience for many users. And you'll see if changes are effective as soon as a specific sort of "crap" stops showing up in your bug reporting system.

<comment><USER8> Except when tons of emails come in that can't even coherently describe the part of the program that doesn't work or the approximate process they are attempting.

<comment><USER7> You can always ignore these incoherent emails. But if you put up some kind of filter _before_ people can contact you, it won't be your decision which feedback you ignore.

And, if you really try, you can often extract valuable feedback even from what seems to be incoherent babble at first.

<comment><USER6> You can, but sorting through them has costs measured in time. Filtering through dozens of drug report and smug reports for a useful bug report is not instantaneous.

When your entire project is just you in your spare time or maybe a handful of volunteers, that filter is the difference between support being helpful and support being a useless hellhole. And believe me, when the vast majority of support requests are useless crap, you lose motivation to care about those people with truly impressive speed.

</comment></comment></comment></comment></comment></comment><comment><USER9> Y'know what, I'll extend the same offer. I'll find any free software project and file a bug. I do it enough for myself, I can do it for someone else.

email@example.com

Tell me which bug to file.

</comment><comment><USER10> I have always been ashamed that I rarely consider reporting a bug. Though, most of the time I assume that the "bug" is caused by my ignorance.

I think this man's efforts should be applauded. :)

Good luck!

<comment><USER11> I know you're probably refering to open source projects, but a lot of software doesn't even have ways to report bugs to send feedback.

<comment><USER12> Isn't it usually considered your distribution's responsibility to handle that? They may have done god-knows-what to the software, so the bug might not even appear in the upstream release.

</comment></comment></comment><comment><USER13> In 2011 I made a similar offer, to write patches for any documentation improvements to Ruby: [http://blog.steveklabnik.com/posts/2011-08-22-im- making-it-d...](http://blog.steveklabnik.com/posts/2011-08-22-im-making-it- dead-simple-to-contribute-to-ruby-s-documentation)

I think overall, about a dozen people took me up on it over the years.

</comment><comment><USER14> nice. however a more scalable approach would be a metabug site where people could post "it doesn't work" freeform text, and volunteers could accept a bug and resolve it when they had refiled it with the correct project.

<comment><USER15> uh, I think they made that, and called it StackOverflow

<comment><USER16> You do know that's nowhere near being the purpose of StackOverflow, right?

<comment><USER15> heh, yeah, was a snarky joke, and in hindsight not my best

<comment><USER17> Well, first to take the stackexchange and form BugOverflow wins :).

<comment><USER18> getsatisfaction.com

Launchpad.net

</comment></comment></comment></comment></comment></comment><comment><USER19> I bet this guy's going to get swamped in the next few hours.

</comment><comment><USER20> Interesting idea, letting someone more familiar with the project make a bug report. It's almost like crowdsourcing tech support.

I wrote about how open source project bug trackers aren't as inviting as they might be a few months ago: [https://www.benburwell.com/posts/open-bug- tracking-empowers-...](https://www.benburwell.com/posts/open-bug-tracking- empowers-users/).

<comment><USER21> I agree that JIRA is probably not what you want as your user-facing bug tracker, but Bugzilla seems significantly less complicated, and the github issue tracker is easier still (though I think it is over-simplified for a user-facing bug tracker).

Someone above mentioned wanting free form bug trackers, but this runs into the problem of bad bug reports. You want bug reports that you can reproduce, or at least some artifacts such as crash dumps or stack traces that give you something to analyze. Short of that you're left guessing about what the problem is. Hence, bug trackers tend to ask people for more information up front so that there is less back and forth.

</comment></comment><comment><USER22> Normally, I think of ways to _increase_ involvement with OSS communities.

He's helping people, and probably learning in the process, which is great. But it would be even better if he could add a touch of "help people help themselves"; otherwise I'm concerned that the OSS process will feel a little more sterile.

<comment><USER23> I think providing a lightweight action->result cycle is just as or more likely to engage people as a process that requires a deeper involvement before there is any chance of a result.

</comment></comment><comment><USER24> He _could_ get paid for doing this over at [https://www.pay4bugs.com](https://www.pay4bugs.com)

</comment><comment><USER25> Maybe I am off, but that read almost like sarcasm (see reference to "copious free time" in fine print).

<comment><USER26> The phrase "copious free time" is itself sarcastic, but it usually just implies "please be patient" rather than "I won't do it".

</comment></comment><comment><USER27> article text is 190 pixels wide in 1600px wide browser window, maybe it should file this bug for me too?

<comment><USER27> [http://i.imgur.com/0c1fGpR.jpg](http://i.imgur.com/0c1fGpR.jpg)

<comment><USER10> Holy crap!

Do you really have ~100 browser tabs open?

<comment><USER27> Takes <2GB ram and doesnt cost a thing when starting up on SSD, so why not? Better than bookmarks ;-)

On a serious note its the morning rush, goes down to ~30 by noon. I dont let stuff control my timing (like TV used to), instead I open everything in the background and read/watch at my own pace through the day (between coding/soldering).</comment></comment></comment></comment>


A practical approach to Open Source network security monitoring - <AUTHOR> https://www.graylog.org/blog/62-a-practical-approach-to-open-source-network-security-monitoring <comment><USER2> Great to see real world examples.</comment>


TSMC Builds a Dedicated 28nm Fab for Sony Orders - <AUTHOR> http://image-sensors-world.blogspot.com/2020/07/tsmc-builds-dedicated-28nm-fab-for-sony.html?m=1 <comment><USER2> CIS = CMOS Image Sensor, apparently. Gotta love macronyms/nested acronyms.

<comment><USER3> Thanks. I hate it so much when people do not explain the acronyms they use, at least once.

It is like a map without a legend. It is so confusing.

And I am an expert on electronics, I can guess it, most people will read that as nonsense.

<comment><USER4> My wife was talking about OHP which she used when teaching while explaining something today. I was a bit confused as we didn't have anything called OHP when I was in school. After a bit of explaining we realised she had only ever known it as OHP. She has never stopped to think about what it was an acronym for. Turns out she was talking about the overhead projector which we had plenty of in school. Reminded me of the five monkeys experiment [https://workingoutloud.com/blog/the-five-monkeys- experiment-...](https://workingoutloud.com/blog/the-five-monkeys-experiment- with-a-new-lesson)

<comment><USER5> We live in a "5 monkeys" world.

<comment><USER6> Feeling more like 12 Monkeys these days.

<comment><USER7> So much nostalgia for that movie

</comment></comment></comment></comment></comment></comment><comment><USER8> Sony is trying to own the market for image sensors.

The Nikon D850's image sensor was designed by Nikon but Sony made it.

They have a 'firewall' in place between the custom-contracted fab work they did for Nikon vs the team that designs Sony sensors, so that the Nikon IP stays only with Nikon.

See [https://m.dpreview.com/news/1234108119/nikon-d850-sensor- con...](https://m.dpreview.com/news/1234108119/nikon-d850-sensor-confirmed-as- sony-made)

Only Canon at this point has stuck with their own image sensor IP and designs, as I understand it.

Not sure where Ricoh/Pentax gets their sensors from, it's believed some are Samsung and some are Sony.

<comment><USER9> Where does R3D source their sensors?

<comment><USER10> [http://image-sensors-world.blogspot.com/2019/09/red- camera-s...](http://image-sensors-world.blogspot.com/2019/09/red-camera- sensor-conspiracy-theories.html)

TLDW, Forza Silicon. ( [https://www.forzasilicon.com/](https://www.forzasilicon.com/)) now owned by [https://www.ametek.com/](https://www.ametek.com/)

May not be true for all of Red's sensors. Other hardware is made by [https://www.sanmina.com/](https://www.sanmina.com/)

</comment></comment></comment><comment><USER11> Why do Sony want 28nm specifically?

<comment><USER12> Because image sensors need to have a certain size, not a certain amount of transistors.

<comment><USER13> Ding ding ding!

The physical size of the sensor is locked because it is tied to entire families of camera, lens, etc sizes that are very difficult to change. So that is the given constraint, and the other parameters flow from it.

It's not that they really _want_ this size/node. It just is the optimization of what they are allowed to work within.

<comment><USER14> You can still keep the physical sensor size the same but use a smaller process. Of course, if you can use 450mm+ wafer sizes at 25nm vs. 300mm wafers at <=10nm then suddenly it's a _massive_ price difference.

<comment><USER12> But you still need to have the same wafer area if you are keeping the same sensor size. So you can't have 300mm wafers at <10nm, you still need 864+mm (for a FF sensor).

<comment><USER15> That's the sensor area. GP is referring to the diameter of the wafer, on which you can fit many 36x24mm full frame sensors. Larger wafers improve throughput and thus reduce cost per sensor.

<comment><USER12> Oh yep, misread it.

</comment></comment></comment></comment></comment></comment></comment><comment><USER16> This is really interesting from a business relationship perspective. Sony helped TSMC build and install a new fab that TSMC will run exclusively for Sony. This is like a cloud provider bringing up a new DC just for one customer using that customer's equipment.

Is TSMC just going to start rolling up every mom and pop fab? Are they the Sinclair of Silicon?

</comment><comment><USER17> I can't wait for the same efficiencies we've seen in mobile CPUs to translate to other areas, like image sensors. The latest Sony a7s III is supposed to have a giant heat sink as one of its flagship features, but just imagine if they were working on TSMC 5nm tech.

<comment><USER18> Sensors such as CCDs are largely analog devices (up to the A-to-D converter), where thermal noise / shot noise etc. are things that matter. Cooling a CCD via active cooling or a heat sink will help lower the noise floor and improve the signal-to-noise ratio and thus picture quality.</comment></comment>


A Polar Bear Hunts Bitcoin Trading Bots - <AUTHOR> http://to.sfox.com/1Mk9DBq <comment><USER2> I forget to tell you guys I start with $1500 and now I have $35865, this is true only in few months less than a year

</comment><comment><USER2> I hunt bitcoins with SFOX for few months now I made a lot of money, I am thinking to work full time hunting on SFOX

</comment><comment><USER3> I like SFOX way to trade in Bitcoins, you can trade with fraction to trade like a millionaire

</comment><comment><USER4> What is the minimum amount to trade with?

<comment><USER3> $5 is the minimum transaction</comment></comment>


Frightened doctors face off with hospitals over rules on protective gear - <AUTHOR> https://www.nytimes.com/2020/03/31/health/hospitals-coronavirus-face-masks.html <comment><USER2> Minus the retaliation this jives with what a friend who is a doctor at a hospital in the Midwest has told me. Hospital administrators and even other doctors who should know better making obviously incompetent policies and saying obviously wrong things about when to wear PPE.

I also think the headline characterizing doctors who want to wear PPE as "frightened" is extremely inappropriate. I don't wear my seat belt in the car because I'm frightened of dying in a car wreck I wear it because it reduces my chance of a bad outcome in the event a crash happens.

<comment><USER3> > I also think the headline characterizing doctors who want to wear PPE as > "frightened" is extremely inappropriate. I don't wear my seat belt in the > car because I'm frightened of dying in a car wreck I wear it because it > reduces my chance of a bad outcome in the event a crash happens.

I have several friends in the medical health field who have described themselves as "frightened" to be at work because of the lack of PPE (1 N95 mask, 1 scrub kit per day). They are exposed, repeatedly throughout the day, every day they go to work, while working 12+ hr shifts. I would expand on your seat belt analogy: they are like professional truck drivers, forced to drive the wrong direction on freeways, dodging cars throughout the day, and their seatbelts degrade with every car they dodge. One of them is already showing symptoms, all the rest are sure they've been exposed to heavy viral loads.

<comment><USER2> No doubt, point is that the way the headline is written implies wanting to wear PPE full time in the hospital is some how the irrational action of a frightened person when in fact it's really a very rational level headed thing to want to do irrespective of whether or not that person is afraid.

</comment></comment></comment><comment><USER4> Illuminating - _When Dr. Nikicicz insisted on wearing a mask, he received a text from his boss, the chief of anesthesia, accusing him of overreacting. The text read: "UR WEARING IT DOWN A PUBLIC HALL. THERES NO MORE WUHAN VIRUS IN THE HALLS AT THE HOSPITAL THAN WALMART. MAYBE LESS."_

Well. It seems, it is this - [http://paulgraham.com/cred.html](http://paulgraham.com/cred.html) \- _These people constantly make false predictions, and get away with it_. The question is, how to reconnect ability of making good predictions and credibility?</comment>


Got Skype? Want Skype? - <AUTHOR> http://webpoet.wordpress.com/2008/05/15/got-skype-want-skype/

<comment><USER2> Well, that's a minute of my life I'll never get back.

<comment><USER3> My reaction exactly. I am not sure what that was about.

</comment></comment><comment><AUTHOR> would you use skype if google bought them?

<comment><USER4> Yes.</comment></comment>


Ask HN: What do you guys think of codeschool.com's ruby course? - <AUTHOR>

<comment><USER2> I went through the Ruby course, Rails for Zombies I && II, and thought they were fun and intuitive. However, the main things that I retained were how rails works such as migrations and generations. Being new to frameworks, the "auto-magical" aspect behind all of this was fairly confusing so I guess that's not a bad thing to walk away from. Your question is, however, for Ruby itself, and I have to conclude with saying that although it was entertaining, I didn't retain much technical knowledge of Ruby.

<comment><AUTHOR> Sorry, I meant the full Ruby on Rails track. Do you think it provided sufficient enough introductory knowledge to enable you to start building web apps?

<comment><USER3> Maybe? Rails 4 isn't finished yet it is still in RC Have a look at: [http://teamtreehouse.com/library/programming/build-a- simple-...](http://teamtreehouse.com/library/programming/build-a-simple-ruby- on-rails-application/getting-started-with-rails/introduction-to-the-project)

Then when your want to know more: <http://ruby.railstutorial.org/> The videos were a huge help

I kind of gave up on it when they had a ton of security problems. So I'm refreshing with headstart rails from o'reilly.

It is a pretty complex subject. Just starting small is hard enough.</comment></comment></comment>


The scrypt parameters - <AUTHOR> https://blog.filippo.io/the-scrypt-parameters <comment><USER2> Password hashing functions are very useful, but can cause operational issues.

A common advice is to allocate as much memory as possible, and as much CPU as possible, to make bruteforce attacks as long as possible.

Unfortunately, it only makes sense if a each user is assigned a dedicated server. Which is almost never the case in APIs and web applications.

Doing all the stretching work on a server scales poorly. And predicting how many users will try to log in is impossible, unless you set up drastic limits. One way or the other, this makes the whole service vulnerable to very cheap denial of service attacks.

There are a lot of discussions about password hashing functions and their parameters, but almost none about server relief, which is far more important IMHO.

The idea is to delegate most of the work to the client. The server just provides the salt. It's acceptable to use as much resources as possible for a short time on the client, since it's unlikely to do anything else important at the same time.

The stretched password is sent to the server instead of the actual password, so that it's acceptable for the server to keep the stretching work down to a minimum before storing the password. This also has the advantage that the server doesn't see the actual password.

This solves scalability issues, and drastically reduces to ability to perform cheap resources exhaustion attacks on the servers.

In a webapp, this can be efficiently achieved using WebAssembly, or with WebCrypto's PBKDF2 implementation. Obviously not an issue in native apps either.

Legacy protocols such as FTP and IMAP don't have that luxury, though. There's no way to run a password stretching function on the client. So, while it's nice to see software like Dovecot adopt functions like Argon2 to store passwords, this can actually do more harm than good.

Finally, while password hashing functions are typically described as suitable for storing passwords, they have other usages as well.

Password-authenticated key exchange mechanisms such as SPAKE2 don't get the attention they deserve. They can be extremely useful to add a strong security layer on top of another authentication mechanism, using a simple password. And they also usually leverage password stretching functions.

<comment><USER3> Doesn't sending the salt to the client void a whole layer of security?

<comment><USER4> I don't see how that'd be the case. An attacker who has visibility into the client that has the salt can already see the plaintext password. And an attacker on the service side of things can see the salt anyway, it's in the database.

<comment><USER2> An attacker that would have the ability to impersonate the server could precompute a rainbow table for a given salt, and send that salt to the client.

OTOH, without client-side prehashing, an attacker that has the ability to impersonate the server doesn't have to precompute anything in order to collect all passwords.

<comment><USER5> If an attacker is able to impersonate the server, then it is also able to ask the client for the password by modifying the Javascript sent.

<comment><USER2> All clients are not web browsers, but sure.

</comment></comment></comment></comment></comment></comment><comment> Ruud-v-A "Cache line sizes have not significantly increased since 2009, so 8 should still be optimal for 𝑟."

Cache line sizes don't change insignificantly — they change in powers of 2. Cache lines sizes for Intel x86_64 CPUs have not changed at all since 2009, it's still 64 bytes.

</comment><comment><USER6> Assume that all clients for a site use password managers with good random password generators, which they use to generate their site password. They are all, say, 40 characters chosen from [a-z][A-Z][0-9], so about 238 bits.

Would it be terrible in that case to just say "screw it", and just go with the old classic salt + single hash (SHA256, probably) instead of scrypt or bcrypt or PBKDF2 or similar?

<comment><USER7> Well, sure, if all users were guaranteed to use a strong password that wasn't reused for any other site, we wouldn't need a lot of password safety rules. Heck, you could just store them in plaintext.

In practice though, users don't.

<comment><USER8> A single hash is still a good idea since otherwise anyone who steals the password database can log in as any user. Sure if someone can steal the password database they may be able to steal passwords as users log in, but that is at least harder.

To make sure users have secure passwords, the server can just generate them and tell the client what their password is. It is, as far as I can tell, entirely a historical accident that this is not how it is generally done.

For web sites, I'm fairly sure this could be done via browser password storage without the user needing to ever see the password if they only use one system to log in (or browser sync between all systems they use). IMO, 21 character random base-64 passwords are good, enough security and still possible to memorize (three groups of seven) over a couple of weeks if necessary.

</comment></comment></comment><comment><USER9> To illustrate the level of idiocy we reached with slow hash functions. The official NIST recommendation #800-132 is to use 10k iterations for PBKDF2, or 10M iterations for important keys.

10k iterations was half a second when we tried it on our server.

10M iterations took 8 minutes for a single hash.

<comment><USER10> Were you using it to hash data for integrity? Or even worse, were you abusing it as a MAC [1]? That's the only way I can see it being so slow.

PBKDF2 is a password-based key derivation function (it says so, right in the name), not a data integrity verification function. You should only ever be feeding a password and high-entropy salt into it.

It's something of a disservice to call all these things "hash functions". It makes people think they're interchangeable, but that's very far from true.

[1] The reason I say using it as a MAC is even worse than using it for data integrity is that was never intended to work as a MAC. A KDF doesn't care (in theory) if the salt input can be derived by looking at its output. For the intended use case of a KDF, the salt is stored with the output anyway. So a cryptanalysis of a KDF wouldn't see the revelation of information about the key by the output as a theoretical flaw. But that would be a _huge_ flaw in a MAC, where the output is often conveyed by an untrusted party between two parties who keep the key secret. From a practical standpoint, a KDF that did leak details of its key in its output is inefficient (redundant use of storage space), but it isn't sufficient by itself to break the security properties.

<comment><USER9> It's hashing a password. It's used exactly the way it's supposed to be.

</comment></comment></comment><comment><USER11> Iterative password hashing functions need to be slow to be secure. Their cost factor is borne through consumption of real-time resources such as CPU cycles and memory bandwidth, and therefore cost is roughly synonymous with _latency_.

BlindHash is a completely different approach. I used data as a cost factor — a massive array of random data, which can grow over time but once a bit becomes part of the pool, it never changes.

Here's how it works;

First, a fast hash (SHA512) and a secure salt (64 byte CSPRN) turns your password into a random number, call it Hash1. That 64 byte value is sent to a BlindHash Server.

On the BlindHash server Hash1 is used to generate 64 uniformly distributed i.i.d indices into the data pool, which imagine is ~100TB of data, and you read 64 bytes from each location. Accumulate those 64 reads into a 4KB buffer, and hash that. Return that result.

Back on the authentication machine, use the result from BlindHash to HMAC your Hash1 to produce a Hash2. Store/Verify the Hash2 value. Hash1 is never stored.

What this accomplished is basically entangling the password hash with an arbitrarily large pool of data, where an attacker needs to steal >90% of the data pool in order to even start attempting an offline attack.

The bigger you make the data pool, the more data an attacker would have to steal, but the _faster_ the system runs — because more data spread across more SSDs increases read bandwidth since the read pattern is perfectly uniform.

The network carries 64 bytes in and 64 bytes out with each BlindHash request. Size the network pipe to handle your desired authentication load, e.g. 64 * 100,000 = 6.4MB/sec.

Divide the data pool by the available bandwidth, e.g. 100TB / 6.4MB = ~180 days. That's how long it takes to steal the data pool over the network at full line rate. And the attacker needs virtually all of it to even try to start an offline attack.

For large scale secure password storage, BlindHash provides the means to eliminate the possibility of an offline attack. It's faster and cheaper than burning expensive CPU cycles, and most importantly security (growing the data pool) and performance (logins/sec) are positively correlated, not negatively. It Scales.

Disclaimer: I'm the inventor, patent holder, and CTO of BlindHash, and I've been working on productizing this technology for several years now. As a longtime HN member/contributor I do feel like it's OK to occasionally pitch my company when relevant topics trend on the front page, as long as there's an interesting technical component to go along with it!

If you're responsible for securely storing customer passwords at a large corporation, scrypt/bcrypt/argon2 is not the right approach for you. You're better off spending those cycles mining Monero.

Let me help you eliminate the possibility of a breach and actually save you money in the process. You can have your own on-prem data pool, or share a massive geo-replicated pool with other large corporations at an even lower cost. </pitch>

<comment><USER12> Hashing as a service seems like a bad idea. I like the core concept though. The patent description seems pretty vague [0]. Do you think I can whip up my own project (maybe called FatHash) that does this without your remote server and without infringing on your patent?

[0]: [https://www.google.com/patents/US9225729](https://www.google.com/patents/US9225729)

<comment><USER11> That's not the right patent - that's something else entirely! Goes to show how poorly written most patents are.

Hopefully you'll find this one more informative:

[https://www.google.com/patents/US9021269](https://www.google.com/patents/US9021269)

Part of the reason I've been able to raise money and spend several years of my life trying to build and evangelize this new/better way of protecting passwords is because the USPTO has granted us the exclusive right to license it in the US through ~2033.

<comment><USER12> That is a much better patent. Sorry for the confusion. The "index into a random data block" is already a primitive cryptographic operation in key expansion and hashing algorithms, but the block is deterministically generated pseudo randomly from a seed. It would be interesting to replace the seeding operation with an offset into a large static pool generated from a source of true randomness.

</comment></comment></comment></comment><comment><USER13> An "expensive" hash function like scrypt provides both the user and the attacker the same slowdown/cost multiplier.

A longer secret key makes the users cost multiplier linearly increase, while the attackers exponentially increases.

Most people dramatically underestimate the dramatic scaling of the word exponential. It's the kind of "if I have 2048 bits then trying every key takes longer than the age of the universe" type slowdown.

Hence:

* Use long secrets (ie. not human-rememberable passwords)

* Use cheap hash functions.

* Don't use scrypt. It's made for passwords (short keys), which really shouldn't exist in 2018.

<comment><USER14> > An "expensive" hash function like scrypt provides both the user and the > attacker the same slowdown/cost multiplier.

Not really. The user only has to wait for the computation once, a few times at most, and it can easily take less time than typing the passwords.

> * Use long secrets (ie. not human-rememberable passwords)

That's very often not the case. Some people like me put truly random passwords on every service. But 99.9% don't.

Also, you can perfectly combine _both_ long keys and expensive hashes.

<comment><USER13> Passwords shouldn't exist at all. Web services should use OAuth. Oauth providers should use two factor where one factor is a 2048 bit key (Yubikey/Client Cert/etc.). Point to point connections (ssh, VNC, network shares) should use client certificates or centralized auth (Kerberos or active directory).

Scrypt is a bandage which doesn't resolve the core problem - there is insufficient entropy in typical users passwords. If there was enough entropy, the speed of the hash function wouldn't matter.

<comment><USER15> This is a bit like saying "human-driven cars shouldn't exist: the roads would be much safer".

True, certainly. You're unlikely to get much debate about hardware tokens / certificates / etc being more securable; the reason we still have passwords isn't because they're more securable, it's because their UX for the vast majority of users is much better.

If you're suggesting there's a reasonable path to get from $the_world_today to $the_world_you're_proposing, I suspect that's a more interesting point to make.

<comment><USER16> I looked into Yubikey but it seems absolutely impractical for day-to-day authentication unless you only use it for a finite amount of sites.

For example, you'd want at least one backup. Maybe buried somewhere or in a safe deposit box. But the workflow for keeping it synced would be hilarious.

Ever since then, I can't take anyone seriously on HN who says "we shouldn't have passwords, just hardware key fobs". Not to mention your authentication security doesn't matter when there's a customer support line an attacker can socially engineer.</comment></comment></comment></comment></comment>


Things for sale that I will mail you - <AUTHOR> http://davidhorvitz.com/if/index.html

<comment><USER2> There have been several posts lately about "stupid" or "unlikely" ideas that make money. I could see this falling into that category. It's an interesting attempt, if not singularly creative.

</comment><comment><USER3> I thought I was browsing Hacker News, but I guess reddit changed their layout today.

<comment><USER4> Actually, I was sure it was Hacker News as soon as I read the whine comparing it to reddit.

</comment></comment><comment><USER5> Paraphrased from Full Metal Jacket:

Pvt. Joker: "Is that you, reddit? Is this me?"

</comment><comment><USER6> I don't get it.

</comment><comment><USER7> I'm sitting in SFO waiting on a four hour delay to JFK. That page made me laugh really, really hard.

</comment><comment><USER8> It's like the guy that sold the page for $1 per pixel. At least it's tongue- in-cheek cyber-begging.

</comment><comment><USER9> A friend tried cyberbegging about 10 years ago. It appears to be more successful nowadays.

</comment><comment><USER10> thought it was decently artistic.</comment>


A model for using equity as compensation in the early days - <AUTHOR> http://www.grubhubmike.com/2011/03/overcompensating-with-equity.html

<comment><USER2> The real question is how far above market do you want to go and what should the equity/cash split be. If you pay 20% cash + 80% equity to employee, the wage has to overcome stock liquidity issues, and control issues. 5% after 18 months may not be motivating to someone early on who's taking you at your word your map is correct while they do all the driving.</comment>


RapidShare is Shutting down - <AUTHOR> https://www.rapidshare.com/home <comment> nezza-_- When Megaupload (and some other sharehosters) died, quite a lot of interesting things just disappeared from the net.

I'm talking about things like small tools that were shared on e.g. xda- developers before Github came, about fan-mods for games etc... The 'big' ones continued living, but if you now e.g. search for a special kernel/ROM for your G1/ADP1 you are mostly out of luck.

It's sad that there's basically no way for an organisation like archive.org to archive things from sharehosters given the unclear (or quite clearly black/gray) law situation and also the missing cooperation with the sharehosters themselves.

<comment><USER2> >I'm talking about things like small tools that were shared on e.g. xda- developers before Github came, about fan-mods for games etc... The 'big' ones continued living, but if you now e.g. search for a special kernel/ROM for your G1/ADP1 you are mostly out of luck.

This is something that has always sketched me out about the Android rooting and moding scene. "Download this suspect binary from rapid share and run it as root" seemed to be a cornerstone of it.

<comment><USER3> It's the same with things like game trainers, save editors, etc.. Sign up and give your e-mail address to this forum so that you can see the download link for this file. Which is an outdated version. The new version is in another forum thread on a separate forum, but you have to register to see links. The link is to a rapidshare download page, which rest assured is totally legit.

I honestly don't understand why more people don't create Github accounts and use that to distribute, or at least use their ISP's free web space. Most of these tools have names, are well-known, and are the top hit on Google, but none of them have an actual website that you can go to to see if they've released new versions, something for other games, etc.

It's all very sketch.

<comment><USER4> Trainers, save editors, translations are basically a common entry point into programming, like a closed knit group of people that love video games and who wants to modify/hack/translate their favourites games. At some point, programming comes to the table and people will start sharing knowledge about it with their own way of doing things. A popular project will get hosted somewhere and the following projects will get hosted there too, simply because they're learning by looking at the popular one. Rapidshare, megauploads, all of these are tools people know before getting into programming, so they just use it. Github is something that comes later, if things get serious.

Dwarf fortress stuff is like that, Minecraft is even worse, you get adfly in the middle :D

<comment><USER5> >Dwarf fortress stuff is like that

dffd exists for things that aren't github(etc)-appropriate such as tools. No real reason to use anything else unless you're trying to monetise it with adf.ly etc (which might also count as a reason not to download).

</comment></comment></comment></comment></comment><comment><USER6> Even as an indie software developer, this makes me sad.

Rapidshare was the most responsive to copyright complaints out of all the filesharing sites, they took down links within 2 hours of being reported. But instead of nuking cracks to my software on Rapidshare immediately, it meant I let the Rapidshare links stay alive longer, because I knew I could turn them off whenever I wanted. I'd rather people uploaded cracks to RapidShare where I could see how popular / unpopular a link was & had control over when to remove it, than somewhere like MegaUpload that would deliberately take a long time to remove links.

I never saw evidence of piracy helping sales (always hurt sales) and I never used it for promotion, but I was more worried about cracks that came bundled with a virus, or that came bundled with a collection of illegal images. That stuff had to be nuked straight away for the protection of customers (and since much of the time, customers never understood that cracks don't come from the company that makes the software).

<comment><USER7> > (and since much of the time, customers never understood that cracks don't > come from the company that makes the software).

I never saw that. Even when I was young, that was something obvious, and I never heard someone else mention that he beliefs cracks come from the company making the original software. Where is that coming from? Is that your impression because you get support requests for cracks?

<comment><USER6> Yup, I get some support requests where I have to explain to the customer that they never bought the software. They'll tell me the Photoshop Tutorial they downloaded my software from, inevitably with a link to a Rapidshare download. They're not looking at URLs and might not even understand they're downloading from a different website to the tutorial. Some have told me they got my software from "a Photoshop Tutorial that you advertised your software on". Ugh.

It's worth noting that while I have customers of all ages, many are older / elderly (many in their late 60s and a few in their 80s & 90s). They're not the most tech savvy, they don't understand the cracking scene & some need a lot of time-consuming handholding. Often wonderful & friendly folks, but they don't grok computers the same way the usual Hacker News reader will.

</comment></comment></comment><comment><USER8> Torrentfreak has some good editorializing and context around this shutdown:

[https://torrentfreak.com/file-sharing-icon-rapidshare- shuts-...](https://torrentfreak.com/file-sharing-icon-rapidshare- shuts-150210/)

"Hoping to clear up its image the company made tremendous efforts to cooperate with copyright holders and limit copyright infringements. Among other things, the company adopted one of the most restrictive sharing policies while (re)branding itself as a personal cloud storage service.

"The anti-piracy measures seemed to work, but as a result RapidShare's visitor numbers plunged. The dwindling revenues eventually cost most of RapidShare's employees their jobs."

<comment><USER9> I don't see how this could have ever ended any other way.

RapidShare was clearly only popular in the first place because of piracy. Once they started restricting that they became just another Dropbox/OneDrive/Google Drive competitor.

<comment><USER10> It worked for YouTube. They got their start with pirated content and pivoted quite successfully.

<comment><USER11> >They got their start with pirated content and pivoted quite successfully.

By being bought by Google, then having Google spend 100s of millions of dollars defending YouTube in court.

</comment></comment></comment></comment><comment><USER12> Rapidshare died because the market moved on. "File hosting services" like rapidshare have been replaced by cutthroat "cyberlockers" like Keep2share and rapidgator.

The most successful cyberlockers do what Rapidshare decided not to: pay uploaders, even those who share illegally. And also pay linking sites through referral schemes far more resilient legally. They aren't trying to appease anyone not either a customer or a very active uploader. Working with copyright owners beyond base legal requirements (DMCA et al) isn't the business plan anymore. Getting into bed with copyright owners was megaupload's and rapidshare's first mistake. The new plan is to make as much money is possible then abandon the ship the moment the MPAA looks their way.

Filesharers are ok with this. They purchase monthly subscriptions in full knowledge that the service might disappear any day. They aren't looking for a long term relationship anymore. The blind panic resulting from the megaupload raid ended that expectation.

<comment><USER13> what's the difference betwwen a "cyberlocker" and a "file hosting service" ?

<comment><USER12> A hosting service pretends to be a dropbox-style service for backing up and sharing important files. A cyberlocker abandons the pretense, all but calling for people to share files they don't own in exchange for money.

For me, the line is when you start paying website that host links to files on your service (referrals) or when you reward known pirates even after, literally, hundreds of valid takedown notices against their files.

</comment></comment></comment><comment><USER14> So, that's a business that shuts down gracefully. They clearly identify their last date, and, continue to serve a useful function (for their customers, at least) right up until that date. They even continue to take new customer business right up to 30 days prior to their last day of business.

"Kindly note that RapidShare will stop the active service on March 31st, 2015. Extensions of STANDARD PLUS and PREMIUM will be possible until February 28th, 2015."

<comment><USER15> This isn't exactly a graceful shutdown. The majority of their files were already deleted in the past on very short notice. I have no idea who still used or trusted their service.

</comment></comment><comment><USER16> I've interviewed an ex rapidshare employee some time ago. Might have been just one disgruntled ex employee, but they told me the CEO wouldn't hand out access to the servers to anyone and insisted on keep doing that himself and other stuff.

They weren't competent though, so maybe he just didn't want to give that employee access. I asked them what they did at Rapidshare and the only answer I got was "multicore stuff" (sic).

However it seemed inviteable, Rapidshare tried to rebrand to a personal cloud storage provider without providing the features needed to be one while still cracking down on piracy. Maybe they should have pulled a dotcom, shut rapidshare down and announce rapid. And then stick to the old business model.

<comment><USER17> They also refused to change their name. The founder wouldn't rebrand. They had a decent chance, if you think about it: storage know-how, a bunch of servers, some good techies, and - which could have been the killer - a Swiss location with Swiss data privacy laws, right in the Snowden era. Forget Dropbox and google drive and amazon with the NSA tapping into them here and wherever. Could have been a great selling point. But the owner couldn't face 'swissshare' or 'swissbox' or something else... had to keep Rapidshare with all that implied.

</comment></comment><comment><USER15> Rapidshare shafted their paid users long ago (announcing the deletion of files on short notice) then they came back with a business model that was not exactly well thought-out.

</comment><comment><USER18> I was doing research on anti-piracy, torrent kills all the file sharing portal more than government. File share portals comes directly under law of punishment for hosting and sharing infringed content. Torrent is a general public, mass, there could be many ways to protect innocence against strict law. Hoping that rapidshare made enough money, may try to leave the shit off and spend their time on vocation.

These all hall of fame, rise and fall of empire, giving way innovations and technologies.

</comment><comment><USER19> Rapidshare links have continuously died whether they were legit or not for a long while. Sure, a lot of it was illegitimate, but people simply moved on.

</comment><comment><USER20> I like the "187,864 users trusted rapidshare in the last hour" in the bottom left corner of the announcement...nice touch lol

</comment><comment><USER21> Anyone remember those hard to figure out capchas Rapidshare had? specially the cats.

</comment><comment><USER22> Hi,

I came across this thread whilst searching for info on File Hosting and there's certainly a lot of good information here.

I'm writing an app that uploads small documents to public file hosting sites (e.g. via REST-HTTP Post) so that others can download them again, preferably via simple HTTP GET.

Rather than coding to a particular API for each and every Hosting site, are there any public code libraries (preferably C++ or C#) that do this already presenting a common API across a number of different supported hosting sites?

Ideally I'd be looking for an Apache/MIT license code rather than GNU.

</comment><comment><USER23> Is anyone else here surprised that Rapidshare is still even a thing and lasted this long in the face of Mediashare, Megaupload, Zippyshare and all those other sites? I haven't seen a Rapidshare link shared in a very long time.

I remember once upon a time if you downloaded leaked music or even software, then Rapidshare was the go to site for that kind of thing. Funny how things change.

<comment><USER24> For me the service to use was eDonkey/eMule. You could find anything there.

Nowadays it's mostly torrents.

</comment></comment><comment><USER25> Reminds me of Xoom [1]. It's very hard to pivot a legit business when you're basically know as the best place to download pirated software/music/games.

[1] -[http://web.archive.org/web/19990515000000*/http://xoom.com/h...](http://web.archive.org/web/19990515000000*/http://xoom.com/home)

</comment><comment><USER26> I completely forgot about RapidShare till I saw this, I'm probably not the only one...

<comment><USER27> LOL me too. I have switched to torrent since megaupload was banned.

</comment></comment><comment><USER28> imo they failed to adopt to the Cloud Model . one interesting company which I think pivoted form being a similar site to cloud/backup space is Mediafire

[http://www.mediafire.com/](http://www.mediafire.com/)

</comment><comment><USER29> It actually happened later than I would have thought. Rapidshare built their entire brand around warez uploading and piracy, so when they changed their concept to please anti-pirate organizations, it was just a matter of time.

</comment><comment><USER30> I'm surprised they never adopted to the cloud model of their competitors such as Dropbox, surely they would of had the resources (at least the hardware) to compete. Such a shame.

</comment><comment><USER31> RapidShare was my childhood hero!

I think appearance of google drive/dropbox is the main reason of this. People easily share data with them.

</comment><comment><USER32> I remember it being the pirate king in the old days. Won't miss it much now.

</comment><comment><USER33> Good, their new premium features shut out large treasures of content on the web.

</comment><comment><USER34> goodnight sweet prince/and flights of angels sing thee to thy rest

<comment><USER35> Many memories of waiting for their little countdown timer to finish so I could click the "Free download" link, switching to another tab during the countdown, and then forgetting to come back in time before the download link became stale and having to do it all over again.

</comment></comment><comment><USER36> Back to BBSs?

</comment><comment><USER37> man I had the most amazing time with Rapidshare during the 2007~2009 era. I remember being in an all you can eat candy store. Same with megaupload. Stuff you couldn't find anywhere were popping up, old vintage rare tv shows, games, magazines. The monetary incentive provided an explosion of content you couldn't get elsewhere.

I will really miss the golden era of filehosting services.

<comment><USER38> There should be a public list of cool stuff on RapidShare. That way, people can sift through all the pr0n/Disney movies and start archiving this stuff in a distributed sense. That way, the artifacts aren't lost forever.

<comment><USER26> There was load of blog sites which kept posting up new stuff with links back to Rapidshare in the footer, but older page just ended up have dead links as the content got deleted.

</comment></comment></comment><comment><USER39> We could assume that Rapidshare got shut down because of evil copyright blah blah...

Or maybe they just couldn't compete with Dropbox et al.

<comment><USER40> Well it's both. Copyright crap eliminates the market they were in. Then they were forced to compete in a different market with established players (e.g Dropbox)

</comment></comment><comment><USER41> To me Rapidshare was a very shady place to be full of warez, never visited, never cared. good riddance

</comment><comment><USER42> It's not that hard to create a Tor hidden service, locally or on a VPS or hosted server. And using OnionShare <[https://onionshare.org/>](https://onionshare.org/>) it's trivial.</comment>


How $96,000 can buy you a top 10 ranking in the U.S. app store - <AUTHOR> http://venturebeat.com/2013/06/04/how-96000-can-buy-you-a-top-10-ranking-in-the-u-s-app-store

<comment><USER2> I just wanted to point out that that last graph is outrageously misleading. The bars start at around -20,000, which makes the 11x difference between the USA and Spain bars appear to be only a 4x.

I doubt this is intentionally misleading, since I can see no incentive for doing so, but it just goes to show that you have to be careful with infographics - they're very easy to lie with, even accidentally.

<comment><USER3> This appears to be a marketing/advertisement piece so take it with a grain of salt.

<comment><USER4> Venture Beat always seems to be filled with click bait and advert pieces.

</comment></comment></comment><comment><USER5> I participated in Free App of the Day promotion about 4 years ago. For the week that it was featured, we experienced about 360% growth and made it to the top ten in our category. Free App of the Day took a percentage of our profits afterwards for a few weeks riding the long tail. In the end, it was win win for both of us.

</comment><comment><USER6> We experimented at work with them and yes it "worked". Thousands downloaded the app in India, China and Egypt, drove us to #2 in our category, then 2 days later back to the basement again. Not worth it. I hope Apple kills these folks.

<comment><USER7> you experimented with appgratis, trademob, or who? curious to know who didn't work for you. if you don't mind sharing, was it a game, or what kind of app was it? thanks!

<comment><USER6> Not a game, travel, and it was the site shown, fiksu. A $10,000 experiment.

</comment></comment></comment><comment><USER8> If I were Apple, I'd be kind of embarrassed that my organic ranking system could be gamed this easily. I mean, there's a huge cottage industry (with its own jargon and professionals) built around figuring out the exact wizardry needed to get your web page highly ranked, yet on the AppStore, apparently the only thing that drives their ranking is "number of downloads".

I wonder if the result of all of these "discovery" apps will be a more complicated ranking system from Apple that takes into account more than just downloads...

<comment><USER9> I completely agree. It's honestly quite hard to believe that they have calculated it to be precisely 80k downloads.

</comment></comment><comment><USER10> The organic install part of this calculation seems pretty suspect. In order to get the organic lift mentioned in the article the app would need to be pretty highly ranked _and_ likely sustain that rank for a while before getting 65%-100% the additional installs.

Whenever running a burst campaign it is important to follow it up with sustained installs afterwards to try and maintain the rank for as long as possible to attempt to get some of the organic lift mentioned. It does not simply happen instantly.

</comment><comment><USER11> I don't think it's a surprise that "advertising works". In any market (iOS or bars of soap), spending money up front on commercials/ads/promotion gets you some sales, and the rest happens through word-of-mouth, social sharing, social proof, etc.

$96K is a lot of money to spend if your goal is a top 10 non-game app. Not everyone can put up that kind of money.

And the more people do that (buying installs to kick off a campaign), the more expensive it becomes and more difficult to get in the top 10.

<comment><USER12> Everybody who matters can put that kind of money up. Remember, the more expensive it gets, the more the ad space is worth for publishers and the more they can earn. As advertising gets more expensive, publishers earn more and can ultimately do more.

<comment><USER13> "Everybody who matters can put that kind of money up."

Everybody who matters to whom? I understand what you're saying - it just seems like a very deterministic view on the state of the gaming industry.

</comment></comment></comment><comment><USER14> So how does this work for paid apps? If you sell your app for 2.99 and you're paying 1.20 an install, aren't you making money? I know I'm missing something here because otherwise anyone could pay for infinite installs and make infinite money.

<comment><USER15> I think it's not 1.20 for a paid install. Buying users can cost quite a bit more for paid apps (for instance I know from googling that Flurry's 'buy user' service doesn't work very well for paid apps).

But in the end, it's just a mad rush to be on the charts to get organics. Without that, it's kind of difficult with apps to make your money back from ad spending. It's not like you are advertising a hotel room where one purchase through your adwords can net you a 100+ dollars (plus all the room service that person will consume!). In apps, typically, you lose money buying users (if you were only counting ad-spend vs revenue from those users that installed).

<comment><USER14> It's a shame that the App Store is becoming this commercialized. One of the best things about it in the early days was the fact that indie games could get noticed internationally. Sure we get games like Infinity Blade but indie developers gave us Tiny Wings.

Maybe Apple will implement something similar to Steam, where this is still possible.

<comment><USER15> Yes, and I think it's true of many platforms. It's best to be there in the beginning, before the flood haha. Look at Youtube, it was much easier to become a Youtube celebrity (or just garner MANY views) if you were on there since/near the beginning.

</comment></comment></comment></comment><comment><USER16> How many actual sales would $96000 worth of paid installs ultimately translate into for an app that isn't particularly original, addictive or brilliant. Would it even make the $96000 back before sinking back down the rankings without trace?

<comment><USER17> You don't just throw money at things. You take a calculated risk.

So before this spending on paid installs happens you need to have metrics on the Customer Life Time Value (CLTV). Now since you are buying users this calculation could be off.

If:

Customer Life Time Value > Cost Per User Aquisition

Then:

Spend money to acquire customers

So if you rank high and word of mouths spreads then you hopefully have organic growth where user acquisition costs equate to $0.</comment></comment>


When developers design (be invisible: don't create something that some people may love, but the majority completely hate) - <AUTHOR> http://www.boagworld.com/archives/2007/06/when_developers_design.html <comment><USER2> The advice is great but based on the site I wonder if it's linked-jacked :-)

</comment><comment><USER3> How much time do developers typically spend designing their application?

<comment><USER4> For me? _Way_ too much, it seems.</comment></comment>


Rudder: An etcd backed overlay network for containers - <AUTHOR> https://coreos.com/blog/introducing-rudder/ <comment><USER2> I'm glad to see this since an easy overlay for Docker is badly needed. But ugh, userspace encapsulation. This would be a lot better if it used OVS + VXLAN.

<comment><USER3> The plan is to add more backends; we started with userspace encapsulation because it works everywhere and is easy to setup and control.

Initially we wanted to use an existing in-Kernel encapsulation format like a simple ip-ip encapsulation. However, IP-IP doesn't work on AWS. Then we looked at VXLAN but it relies on multicast which doesn't work on most cloud networks either. Most recently we started looking at the VXLAN DOVE extensions and are getting a prototype together for this.

tl;dr the initial goal is to show that something generic is needed and can work, we will get something that is performant and/or has encryption next.

<comment><USER4> The kernel VXLAN implementation actually supports manual endpoint configuration via NETLINK (or newer versions of the iproute2 package).

</comment></comment></comment><comment><USER5> Would this allow you to mesh together containers in separate datacenters? Or mesh together, say, the containers on your home PC with containers in the cloud? I'm guessing not.

What I'm really excited for are the possibilities of docker containers with public-routable IPv6 addresses. It would move the world away from "one host: many services on different arbitrary ports", and back to the "one host: one service, possibly speaking a few protocols with ports being used for OSI- layer-5/6 protocol discovery" model of the 1970s (and eliminate the madness of SRV records, besides.)

Imagine if, say, bitcoind (which normally speaks "JSON-RPC" to clients -- a specific layer-6 encoding over HTTP) sat on "bitcoind.host:80" instead of "host:8332". Suddenly, it'd be immediately clear to protocol clients (e.g. web browsers) which hosts they could or couldn't speak to, based on the port alone! The whole redundancy between schema and port in URLs could go away: they'd be synonymous. And so on.

<comment><USER6> I totally agree that containers in general, and Docker in particular, could play a big role in moving the status quo towards IPV6 and a more sane approach to service-oriented networking. I would love to turn on IPV6 by default on every Docker runtime everywhere - the question is, how do we deal with 1) existing host systems, 2) existing networks and 3) existing applications which may not be IPv6-ready? We are already upgrading the guts of Docker for more powerful networking and clustering in general, so if you give me a solid answer we can get this out the door pretty quickly :)

</comment></comment><comment><USER7> Only recently did I realize what a power house the team at CoreOS is. They're building some really cool shit. I can spend hours on their blog just right- clicking and searching on Google. Definitely a good way to learn tons about distributed computing and that whole subject area.

</comment><comment><USER8> This is interesting, it's pretty similar to [http://tinc-vpn.org](http://tinc- vpn.org) which is a mesh VPN.

<comment><USER9> Correct, tinc is another example of a mesh overlay network. However tinc requires configuration files to be created on each host and then distributed to others. If machines are part of an etcd cluster, you can use Rudder to create a mesh without the need to create and distribute configuration files.

</comment></comment><comment><USER10> Sorry, what problem does this solve?

 _Things are not as easy on other cloud providers where a host cannot get an entire subnet to itself. Rudder aims to solve this problem by creating an overlay mesh network that provisions a subnet to each server._ ... is unclear.

What host for virtualized infrastructure needs an entire, fake, non-internet- routable subnet that it cannot provision itself?

I believe there's a broken one size fits all network architectural assumption or provisioning methodology at the root of all this.

(Edit as reply to child as rate-limited: Sounds like I was right, and it's docker's fault. How is this not better solved with the standard approach of applying network namespaces and/or unique interfaces to containers?)

<comment><USER2> It solves port conflicts caused by running multiple copies of the same service on the same host. Kubernetes likes to have a few sidecar containers hanging off each service instance (e.g. memcached might have an sshd sidecar that wants to be on port 22 and nginx might want to have its own sshd sidecar also on port 22), and if your host only has one IP address then Docker has to do dynamic port mapping and your service discovery system has to track port numbers and such.

<comment><USER11> sshd is kind of a poor example.

Kubernetes has an idea of a pod -- a group of containers that share an netns and have an IP.

Reasons you might want a pod: * A thick client or client side proxy that follows the ambassador pattern for service discovery and access. * A data- loader and data-server pair. The loader would grab data from some persistent source and write it to disk or a shared memory segment. The data-server would then use that data and serve it up. You'd could run the data-loader at a lower QoS so it doesn't stall the data-server. * Some sort of server and a log saver. The log saver could periodically batch up and compress structured log data and upload it to a persistent store (such as BigQuery in GCP). You want to build/configure/restart/upgrade the log saver separately from the server. You'd also run the log saver at a lower QoS.

Inside of Google we have all sorts of examples where we have sets of containers/tasks/processes that are co-scheduled onto a machine and work together.

</comment></comment></comment><comment><USER12> FYI there's already an open source software going by the name of Rudder : [http://en.wikipedia.org/wiki/Rudder_(software)](http://en.wikipedia.org/wiki/Rudder_\(software\))

</comment><comment><USER13> "... it has almost no affect on the bandwidth." \- looking at those numbers it's not the case at all, those numbers are really low to start with (as AWS isn't exactly the fastest) but obviously this would be much more noticeable at the higher end of the scale when we're talking about 100-200MB/s transfer rates, not to mention nearly doubling the latency!

</comment><comment><USER14> also works great with lxc, i pushed a juju charm which automates the config for lxc [http://bazaar.launchpad.net/~hazmat/charms/trusty/rudder/tru...](http://bazaar.launchpad.net/~hazmat/charms/trusty/rudder/trunk/view/head:/readme.txt)</comment>


IE WebGL - <AUTHOR> http://iewebgl.com/index.html

<comment><AUTHOR> He has a pretty novel way of monetizing this

        Q: I'm a web developer, what I'm paying for, if I want to use IEWebGL ?
        A: You pay to hide UNREGISTERED VERSION banner for your domain, that otherwise will be shown to end user. Or you can think - you pay to widen your project's audience to virtually all IE users. Also you can use all updates for free during the paid period.

It looks really good though, webgl is definitely starting to become a viable target platform, despite all the hysteria

<comment><USER2> In general, it's not a new idea; software companies have long sold expensive authoring software for their free viewer programs. Shockwave, Flash, QuickTime, RealPlayer, and Viewpoint have all tried to use this business model for browser plug-ins. However, it's the most direct attempt I've seen to apply the business model to an already open standard.

</comment></comment><comment><USER3> Installs as a plugin, whereas JebGL <http://code.google.com/p/jebgl/> is a java applet. JebGL has to use software rendering without OpenGL so perf probably aint so hot in IE... whereas it appears the IEWebGL guys have the perf situation under control

> Our perfomance tests shows high FPS rates even in HD resolutions.

Also it looks like their plugin adds Typed Arrays to IE8's JScript engine. handy.

</comment><comment><USER4> Looks great, but why would someone suggest installing this rather than Chrome Frame?

<comment><USER3> Ditto. GCF would be a better recommendation all around. Worth noting: both of these projects don't require admin privs to install.</comment></comment>