GCE down in all regions - <AUTHOR> https://status.cloud.google.com/incident/compute/16007 <comment><USER2> I've been overall very impressed with the direction of Google Cloud over the last year. I feel like their container strategy is much better than Amazon's ECS in that the core is built on open source technology.

This can wipe away a lot of goodwill, though. A worldwide outage is catastrophic and embarrassing. AWS has had some pretty spectacular failures in us-east (which has a huge chunk of the web running within it), but I'm not sure that I can recall a global outage. To my understanding, these systems are built specifically _not_ to let failures spill over to other regions.

Ah well. Godspeed to anyone affected by this, including the SREs over at Google!

<comment><USER3> I'm totally impressed with gcloud. Slick, smooth interface. Cheap pricing. The fact the UI spits out API examples for doing what you're doing is really cool. And it's oh-so-fast. (From what I can tell, gcloud's SSD is 10x faster or 1/10th the cost of AWS.)

And this is coming from a guy that really dislikes Google overall. I was working on a project that might qualify for Azure's BizSpark Plus (they give you like $5K a month in credit), and I'd prefer to pay for gcloud than get Azure for free

<comment><USER4> Same, was considering GCP for the future, but this is bad. I'm not using them without some kind of redundancy with another provider. I hope they write a good post-mortem, these are always interesting at large scale.

<comment><USER5> How bad is it really? They started investigating at 18:51, confirmed a problem in asia-east1 at 19:00, the problem went global at 19:21, and was resolved at 19:26.

They posted that they will share results of their internal investigation.

That kind of rapid response and communication is admirable. There will be problems with cloud services - it's inevitable. It's how cloud providers respond to those problems that is important.

In this situation, I am thoroughly impressed with Google.

<comment><USER4> It's bad because it concerns all their regions at the same time, while competing providers have mitigations against this in place. AWS completely isolates its regions for instance [1], so they can fail independently and not affect anything else. That Google let an issue (or even a cascade of problems) affect all its geographic points of presence really shows a lack of maturity of the platform. I don't want to make too many assumptions, and that specific problem could have affected AWS in the same way, so let's wait for more details on their part.

The response times are what's expected when you are running one of the biggest server fleets in the world.

1: [https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/using- re...](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/using-regions- availability-zones.html)

<comment><USER5> Expecting that problems won't happen with a cloud provider that happen everywhere else is a pipe dream. They might be better at it because of scale, but no cloud provider can always be up. It happened at Amazon, now it's happened at Google. Eventually, finding a provider that never went down will be like finding the airline that never crashed.

Operating across regions decreases the chances of downtime, it does not eliminate them.

> The response times are what's expected when you are running one of the > biggest server fleets in the world.

That may be true, but actually delivering on that expectation is a huge positive. And more than having the right processes in place, they had the right people in place to recognize and deal with the problem. That's not a very easy thing to make happen when your resources cross global borders and time zones.

Look at what happened with Sony and Microsoft - they were both down for days and while Microsoft was communicative, Sony certainly was not. Granted, those were private networks, but the scale was enormous and they were far from the only companies affected.

<comment><USER4> > It happened at Amazon

AWS has _never_ had a worldwide outage of anything (feel free to correct me). It's not about finding "the airline that never crashed", it's finding the airline whose planes don't crash all at the same time. It's pretty surprising coming from Google because 15 years ago they already had a world-class infrastructure, while Amazon was only known for selling books on the Internet.

Regarding the response times, I recognize that Amazon could do better on the communication during the outage. They tend to wait until there is a complete failure in an availability zone to put the little "i" on their green availability checkmark, and not signal things like elevated error rates.

<comment><USER5> Here's an example from this thread: [http://status.aws.amazon.com/s3-20080720.html](http://status.aws.amazon.com/s3-20080720.html)

<comment><USER4> I stand corrected, my statement was too broad.

AWS had two regions in 2008 [1]. That was 7 years ago, and I think you would agree that running a distributed object storage system across an ocean is a whole different beast than ensuring individual connectivity to servers in 2016.

1: [https://aws.amazon.com/about-aws/global- infrastructure/](https://aws.amazon.com/about-aws/global-infrastructure/)

</comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER6> Spotify is down due to this, which is, uh, pretty hilarious [https://news.spotify.com/us/2016/02/23/announcing-spotify- in...](https://news.spotify.com/us/2016/02/23/announcing-spotify- infrastructures-googley-future/)

<comment><USER7> Was Google services (search, email, drives, apps) impacted at all?

<comment><USER8> No they don't use gcloud to host their own apps. Yes that's ridiculous.

<comment><USER9> Which is exactly why I won't use GCE. If Google isn't confident enough to use it for themselves, neither will I.

The fact that Amazon dogfoods AWS is a major advantage for them.

<comment> brown9-2 Even if Amazon.com uses AWS (the extent of which seems it may be a mixture of marketing hype and urban legend), there are many ways AWS could fail that affects customers but leaves Amazon.com unaffected.

</comment></comment></comment></comment></comment><comment><USER10> That was nuts. Interested to read the post-mortem on this one. Our site went down as well. What could cause a sudden all-region meltdown like that? Aren't regions supposed to be more isolated to prevent this type of thing?

Seems to have only been down for about 10 minutes, so I'm thinking some sort of mis-configuration that got deployed everywhere...they were working to fix a VPN issue in a specific region right before it went down...

<comment><USER11> To quote @DEVOPS_BORAT:

To make error is human. To propagate error to all server in automatic way is devops.

<comment><USER12> So, you're saying the servers are aladeen?

</comment></comment></comment><comment><USER13> So in all seriousness, how do folks deal with this?

In this case, it ended up being a multi-region failure, so your only real solution is to spread it across providers, not just regions.

But I imagine it's a similar issue to scaling across regions, even within a provider. We can spin up machines in each region to provide fault tolerance, but we're at the mercy of our Postgres database.

What do others do?

<comment><USER14> Most people just deal with it and accept that their site will go down for 20 minutes every 3-4 years or so, even when hosting on a major cloud, because:

1) the cost of mitigating that risk is much higher than the cost of just eating the outage, and

2) their high traffic production site is routinely down for that long anyway, for unrelated reasons.

If you really, really can't bear the business costs of an entire provider ever going down, even that rarely (e.g. you're doing life support, military systems, big finance), then you just pay a lot of money to rework your entire system into a fully redundant infrastructure that runs on multiple providers simultaneously.

There really aren't any other options besides these two.

<comment><USER15> If you are doing life support, military systems, or HA big finance, then you are quite likely to be running on dedicated equipment, with dedicated circuits, and quite often highly customized/configured non-stop hardware/operating systems.

You are unlikely to be running such systems on AWS or GCE.

<comment><USER16> And that's why IBM is still in the server business: There's nothing like a mainframe when it comes to uptime.

<comment><USER15> HP also has some good products in the highly available space - [http://h20195.www2.hp.com/v2/getpdf.aspx/4aa4-2988enw.pdf](http://h20195.www2.hp.com/v2/getpdf.aspx/4aa4-2988enw.pdf) , likely from their acquisition of Tandem.

<comment><USER16> > likely from their acquisition of Tandem.

Yep. Those were originally Itanium-only, so their success was somewhat… limited, compared to IBM's "we're backwards compatible to punch cards" mainframes.

Only recently did Intel start to port over the mission critical features like CPU hotswap to Xeons, so they can finally let the Itanic die, so we're hopefully going to see more x86 devices with mainframe-like capabilities.

</comment></comment></comment></comment></comment></comment><comment><USER17> Guys, I've got it- instead of locking ourselves in with one vendor's platform and being subject to their mismanagement and arbitrary rules, why don't we buy our own hardware and do it ourselves?

We can free up our OpEx budget too! My sales rep sent me a TCO that shows it is way cheaper to run a data center than to pay a cloud subscription!

I'm calling the CFO!

<comment><USER18> Will your own hardware have the same reliability as google?

<comment><USER19> I think it was sarcasm......

</comment></comment></comment><comment><USER20> AWS had several major outages in the past, especially between 2009 and 2012. In some cases, it was not only downtime, but also data loss, which is the hardest part. 8,760 hours in a year, if you are down for a total of less than 8.7 hours, you're in the >99.9% uptime category (also called "three 9s"). Four 9s (99.99%) is considered a nice plus. Very few businesses really need that.

However, uptime is one thing. Data loss is another different beast.

AFAIK, this one for Google is only downtime. Being able to maintain GCE up for most of the year, except a few hours, means more than 99.9% availability, which is what most customers need.

Operational excellence, or the ability to have your cloud up and running, comes only with a large customer set; Google is now gaining a lot of significant customers (Spotify, Snapchat, Apple, etc), and therefore I expect them to learn what's needed over the coming months.

2016 will be ok. 2017, in my view, will be near perfect.

If Google wants to differentiate them from AWS, they should offer an SLA on data integrity (at a premium, obviously). Here's how you can get thousands of enterprise customers.

Shameless plug: I've also extensively written about AWS, Azure and GCE here: [https://medium.com/simone-brunozzi/the-cloud-wars- of-2016-3f...](https://medium.com/simone-brunozzi/the-cloud-wars- of-2016-3f87e0a03d18)

</comment><comment><USER21> Great timing for that new book :)

</comment><comment><USER4> Seems kinda misleading from Google to claim repeatedly that they are hosted just on the same infrastructure of GCP, and not go down with it.

EDIT: Switched from "dishonest" to "misleading"; while it's abundantly clear that Google doesn't run on GCP, GCP feels like a second-class citizen to Google because you just cannot get Google uptime with it.

<comment><USER22> Google and GCP run on the same infrastructure, but this was a GCP problem, not a problem with that common infrastructure.

<comment><USER23> (I'm a Google SRE, I'm on the team that dealt with this outage)

This did impact common infrastructure. Some (non-cloud) Google services were impacted. We've spent years working on making sure gigantic outages are not externally visible for our services, but if you looked very closely at latency to some services you might have been able to see a spike during this outage.

My colleagues managed to resolve this before it stressed the non-cloud Google services to the point that the outage was "revealed". If this was not mitigated, the scope of the outage would have increased to include non-cloud Google services.

</comment></comment></comment><comment><USER24> Back up as of 19:27 US/Pacific: [https://status.cloud.google.com/incident/compute/16007](https://status.cloud.google.com/incident/compute/16007)

</comment><comment><USER25> I do not envy the current on-call rotation.

<comment><USER26> I don't envy anyone with an on-call job.

<comment><USER27> What do you recommend? I figure that if you're working on something without oncall no one probably cares about it any way. I prefer to have a good rotation than no rotation.

<comment><USER28> Staffing such that on-call is handled by presently-in-office staff. This is, as I understand, pretty much what Google does. When you're in the office, you're in the office, but when you're not, you're not. Having global coverage means ops in several timezones, and this is what Google accomplishes.

Not knowing when, at any time, your phone or pager will go off wears in interesting ways over time.

<comment><USER29> It depends on the team and type of oncall rotation for the service. My team (a SWE team) has its own oncall rotation as we don't have dedicated SREs for all of our services.

Since we US based only, it means the oncall person will have pager duty while they sleep. Our pager can be a bit loud at night due to the nature of our services, so it's definitely not for everyone (luckily it's optional).

<comment><USER28> Is this at Google?

I'll note you're SWE not SRE. I'm talking _mostly_ about dedicated Ops crew on pager.

It's one thing if you're responding to pages resulting from other groups' coding errors or failure-to-build sufficiently robust systems. Another if you're self-servicing.

One of my own "take this job and shove it" moments came after pages started rolling in at 2am, bringing me on-site until 6am. I headed back for sleep, showed up that afternoon and commented on the failure of any of the dev team to answer calls/pages/texts (site falling over, I had exceptionally limited access capabilities and was new on team). Response was shrugs.

Mine was "That wasn't your ass being hauled out of bed. See ya."

<comment><USER29> _The opinions stated here are my own, not necessarily those of Google._

Yes, it is at Google. Our important and high visibility bits have SREs that help monitor our services (SREs actually approached us to take over some bits that were more important).

Google has a lot of oncall people that aren't going to go into a data center (most googlers never see a data center). So there is lots of oncall rotations that still have an SLA that can be handled from their bed if it happens at 2am.

(I sadly can't give any examples)

</comment></comment></comment></comment></comment></comment></comment><comment><USER30> There has to be a certain level of karma/schadenfreude of this happening in the week where they are pushing their SRE book...did they handle it well? It seems so, but a lot of their book is an ounce of prevention over a pound of on-call pagers going off.

<comment><USER31> Prevention is a big part of SRE, but an equally big part is formalizing a process to learn from the inevitable outages that come with running a large, complex, distributed system built by fallible humans.

You figure out what went wrong and fix it, of course, but more importantly, you figure out where your existing systems and processes (failover, monitoring, incident response, etc.) did and didn't work, and you improve them for the next time.

</comment></comment><comment><USER32> Ask HN: Is anyone using different cloud providers for failover and what's your DNS configuration?

Do any cloud providers allow announcing routes for anycast DNS?

<comment><USER33> I, too, would be interested in info on any cloud providers that support anycast.

<comment><USER4> I'm no networking expert but packet.net has a page on this: [https://www.packet.net/bare- metal/network/anycast/](https://www.packet.net/bare-metal/network/anycast/)

<comment><USER34> I see benefit on using anycast for your DNS, but is anycast actually a better option than DNS load balancing for my site? The idea behind using anycast is to use at least two different providers, so having packet.net only doesn't really cut it. Also I can do DNS load balancing with any provider by using something like Azure's Traffic Manager, so I struggle to see advantages.

</comment></comment></comment></comment><comment><USER35> So what Google services went down with this? looks like they are not eating their own dog food?

<comment><USER36> Google is self-hosted, but they might not use the same hardware GCE uses.

<comment><USER37> different hardware isn't really part of the equation - it's more that most of google's internal systems aren't _on_ gce, but _adjacent to_ gce. There's a cloud beneath that cloud, so to speak.

</comment></comment></comment><comment><USER38> Google Custom Search also seems to have gone down globally today. Likely related, although GCE is back up, CSE is still out, leaving many sites without an international search feature.

</comment><comment><USER39> I did not choose because GCE does not have server at Asia Pacific, Microsoft Azure, DigitalOcean and AWS has one. Sorry, correction, What I mean is South East Asia.

<comment><USER40> They have three zones in Asia Pacific[0].

[0] [https://cloud.google.com/compute/docs/zones#available](https://cloud.google.com/compute/docs/zones#available)

<comment><USER39> Sorry, I mean South East Asia. [https://azure.microsoft.com/en- us/status/](https://azure.microsoft.com/en-us/status/)

</comment></comment></comment><comment><USER41> i migrated from aws to google yesterday. fml

</comment><comment><USER42> Time Warner Cable's DNS server went down at roughly the same time (in Austin). I'm hoping that's just a coincidence.

</comment><comment><USER43> Correct me if i'm wrong, but it looks like Cloud VPN went down, not all of GCE.

FYI I run about 15 servers in Asia, USAEast, and Europe on GCE with external monitoring and didn't get a peep from my error checking emails during that timeframe.

</comment><comment><USER44> I know this will get downvoted but clouds suck and this is just one more manifestation of why they suck. Unless you have very spiky workload save yourself long term pain and don't go this route (applies if your monthly AWS/GCE/Azure bill is over few K)

<comment><USER45> I'm not seeing why not. Your data center could go down for a myriad of reasons (ISP goes down, HDs, tripping on power cable, etc). If that happens you're pretty much screwed. You could compensate by having multiple data centers with different infrastructure providers. If you do, you're probably spending more than the few K you referenced in your post.

Yes, it's bad that apparently all of the regions failed. Google will hear about it. People will get in trouble. But a screw up at this level is rare. If you use cloud, or even a VPS provider like Linode, you get auto-fail over and someone that is contractually obligated to deal with failures.

<comment><USER44> You are paying penalty in complexity, latency and poor tenant isolation when running on "cloud infrastructure" and when things blow up you have no recourse.

<comment><USER46> Do you have any examples of poor tenant isolation in AWS, GCE, or Azure?

Cloud complexity is also lower because you don't have to worry about power, cooling, upstream connectivity, capacity budgeting, etc. If 99.9-99.95% availability is fine for your application then you probably don't have to worry about your provider either.

<comment><USER44> AWS Netflix consumes enough resources that if they spike 40-50% everyone is screwed. The software required to run the cloud like AWS is orders of magnitude more complex then what avg project would need and results in major screwups. Both major AWS outages were due control plane issues second case was result of massive Netflix migration that triggered throttles for everyone in affected AZs. The throttles in the first place were put in due to the major outage that lasted for many hours.

</comment></comment></comment></comment></comment><comment> awinter-py five nines = 45?

<comment><USER47> No; 999.99% uptime.

<comment> awinter-py 1000% = 10 days per year

</comment></comment></comment><comment><USER48> so much for the SRE they publishd last week

<comment><USER29> 16-17 minutes of down time isn't all that bad if you consider the SLA for GCE is 99.95%: [https://cloud.google.com/compute/sla](https://cloud.google.com/compute/sla)

So they can have 262 minutes of down time a year and still be within their SLA.

</comment></comment><comment><USER49> Hmmm... would this have affected Netflix?

<comment><USER50> It's fairly well known that netflix runs primarily on AWS.

So probably no.

<comment><USER51> how come netflix is working on IPv6 then, when aws does not offer it?

<comment><USER52> ELBs do IPv6 at the edge and everything else (ELB->EC2) is IPv4.

<comment><USER53> Though notably, EC2Classic ELBs only</comment></comment></comment></comment></comment>


James Webb Space Telescope emerges successfully from final thermal vacuum test - <AUTHOR> https://phys.org/news/2019-05-james-webb-space-telescope-emerges.html <comment><USER2> Man, I really want this telescope to succeed its mission, but I just can't get over how complex its deployment procedure is. I am extremely pessimistic about it actually managing to deploy as planned.

<comment><USER3> Could you elaborate on the complexity, comparing it to other complex science projects that succeeded? I'm a layman, curious if this is actually riskier than what humanity has done so far.

<comment><USER4> This video explains it very well. [https://www.youtube.com/watch?v=k8yRDrl76d0](https://www.youtube.com/watch?v=k8yRDrl76d0)

Half way through the video, I understood why it's so expensive and risky.

On the other hand, Apollo 11 had many 'firsts' that couldn't be tested before the actual mission and it worked out 'first shot'. Of course there were some problems and Apollo 13 showed that the odd's where not too good.

<comment><USER2> Huge difference is that Apollo had highly trained human beings on board to fix things that could not be planned for. There were also 10 previous missions to Apollo 11 to work out the kinks, with one failing with loss of life.

JW is not designed to be fixed or fail, nor are there training runs. It HAS to work first shot.

<comment><USER5> Regarding the 10 missions before Apollo 11: It's a little more complicated. Apollo 1 is the name that was given to honor the astronauts who died in the pad accident. Apollo 2 and 3 didn't exists. But a whole bunch of other tests did exist testing Saturn 5 before we got to the unmanned Apollo 4, 5 and 6 tests. And starting with Apollo 7 humans were included. See [https://en.wikipedia.org/wiki/List_of_Apollo_missions](https://en.wikipedia.org/wiki/List_of_Apollo_missions) for details.

<comment><USER2> I probably should have known this. I've read alot on Apollo, but never really internalized some of these facts.

<comment><USER6> People forget there was an entire series leading up to the Saturn V: [https://en.wikipedia.org/wiki/Saturn_V#Saturn_development](https://en.wikipedia.org/wiki/Saturn_V#Saturn_development)

They've got a Saturn IB at an Alabama rest stop outside of Huntsville. Surprisingly small, but still towers above you!

<comment><USER7> > People forget there was an entire series leading up to the Saturn V

Well, sooorta. The Saturn V was the third in that series, after the Saturn I and Saturn IB. [0] While there were proposed intermediate Saturns (and ones past V, too) only two first stages were developed, and the V was the only launcher to fly with the F-1 engine.

0: [https://en.wikipedia.org/wiki/Saturn_(rocket_family)](https://en.wikipedia.org/wiki/Saturn_\(rocket_family\))

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER8> Anyone know if there are any well paying jobs in space programs of any kind? I've been seeing a growing number of reputable universities offering a wider range of space / aerospace / engineering offerings* and I've been getting curious what's out there. Only issue is, a lot of places I looked pay well below market rates :/ (at least for software engineers). I'll admit my expectations might be off considering I've been in the NYC area for a while now, and am used to seeing NYC salaries, but the pay is well below half of what I would make now and the cut seems too drastic even in a LCOL area.

* I'm mostly talking about masters programs here.

<comment><USER9> Just a bit of warning: Software Engineering in Aerospace is NOT fun. You're basically in a supporting role to the hardware and system engineers designing the spacecraft. It's pure drudgery... process to the point of absurdity, specs and tasks being spoon fed to you with little room for creativity and/or problem solving, etc.

The pay, benefits, and level of respect on the job reflect all of that.

If you really want to work in space, I'd go and get a MS (or higher) in aerospace engineering or space systems engineering and work at the systems level.

I got out of aerospace and am much happier for it.

<comment><USER10> To be fair, the reason for this is that if you try to be creative and don't follow strict processes, things fail a million miles from Earth or blow up entirely.

<comment><USER11> You mean the strict processes that strictly demanded mixing imperial and SI units ?

<comment><USER12> The strict processes that got _even more strict_ after they realized they weren't being _strict enough_ when they mixed imperial and SI units.

</comment></comment></comment></comment></comment><comment> java-man what puzzles me all the time is why not build two instead. it looks like the R&D portion of the budget might be greater than the actual manufacturing cost, so building two would be less than 2x the price.

if one launch fails, we've got a backup. if both launch, we have two instruments deployed.

why don't we do it??

<comment><USER13> Is there any economy of scale? Why not wait until the first one fails to build another one?

<comment><USER14> Because that requires keeping all the specialized machinery and knowledge alive for the duration of the whole project.

Given the length of this project, I wouldn't be surprised if at this point NASA _couldn 't_ order a second one built even if they wanted to.

The unfortunate thing about advanced technology is that if you don't use it, you lose it. More specifically, you lose the research and machining setups and people with knowledge about them in their head; the main problem here being that documentation doesn't capture _everything_ \- a lot of tacit knowledge is captured in e.g. tuning of the machines, undocumented fixes made on-site, idiosyncrasies in manufacturing steps, etc.

<comment><USER15> Unfortunately that's already the case with many long running projects. A friend of mine that works on JWST recently fixed a mistake that was made by someone who retired 10 years ago.

</comment></comment></comment></comment><comment><USER16> At this price point it better be good. It has to make up for all the other astrophysics missions it killed with its (near) endless budget overruns.

<comment><USER17> That's a bit cynical. There are many examples of NASA missions that had far exceeded the original expectations.

<comment><USER17> Plus, check out some of the engineering on this $10B masterpiece.

[https://ntrs.nasa.gov/archive/nasa/casi.ntrs.nasa.gov/201800...](https://ntrs.nasa.gov/archive/nasa/casi.ntrs.nasa.gov/20180003965.pdf)

In my opinion, much better for Human advancement than the typical $10B infrastructure project

<comment><USER18> indeed, I would take a bunch of 10billion scientific instruments over trillion dollar fighter jets or mid east military incursions any day.

</comment></comment></comment></comment><comment><USER19> Obligatory xkcd: [https://xkcd.com/2014/](https://xkcd.com/2014/)

2026? Probably not. 2021? I doubt it. My money is on 2023-24.

<comment><USER20> They already built the damn thing, how hard could it be to land it in stable orbit 1.5 gigameters from the planet? This ain't rocket science, people. Wait a second.

<comment><USER21> I had !remind me in 2 years setup for it. Didn't really know why, but figured out eventually by how long it's taking them.

Also - isn't the tech behind it is going to be obsolete pretty soon?

<comment><USER22> Obsolete in what sense?

<comment><USER19> It is a big digital camera. They dont stay cutting edge for very long.

</comment></comment></comment></comment></comment><comment><USER23> > one step closer to its 2021 launch

boy, that's gonna be a nail-biter. who's gonna insure that launch?

<comment><USER24> No one. Or, more accurately, the government self-insures most launches, and eats the cost of a failed launch.

</comment></comment><comment><USER25> How many megapixels is this one?

<comment><USER26> The main imager is the Near Infrared Camera. It has ten 2048x2048 sensors. They're configured in two kinda-independent groups with separate optics. Each group uses one of those sensors for longer wavelengths (so you get two lots of 2048x2048), and four of them for shorter wavelengths (so you get two lots of 4096x4096). The two modules can (and I guess usually will) be pointed at adjacent regions of the sky; I expect they'll overlap them a bit so you'll get slightly under 4096x2048 for the long wavelengths and slightly under 8192x4096 for the short. These are monochrome sensors but they have an array of filters they can swap in to measure different wavelengths.

There are several other instruments, including some other imagers.

<comment><USER27> Considering how much camera sensors have improved in the last few years I wonder how outdated these sensors are (or not)

Edit: makes me also wonder if with all the delays they upgrade any equipment in the meantime.

<comment><USER28> Hard to tell, since you can't use off-the-shelf sensors. They have to withstand the harsh environment in space, for a very long time, without any maintenance.

<comment><USER29> They're also specifically designed to operate in absurdly low temperatures — one in fact requires temperatures under 7 Kelvin and so in addition to the sun shield there's a mechanical cooler.

[https://en.wikipedia.org/wiki/MIRI_(Mid- Infrared_Instrument)](https://en.wikipedia.org/wiki/MIRI_\(Mid- Infrared_Instrument\))

</comment></comment></comment></comment></comment><comment><USER30> This is so cool!

<comment><USER31> And hot.</comment></comment>


Arrington interviews Google's Mayer at LeWeb'10 - <AUTHOR> http://www.youtube.com/watch?v=M3iCAlQMUv4&list=PLF755D4E872F7AA47&index=2

<comment><USER2> I didn't realize at first that this interview took place so recently [2 days ago]. Arrington's interview style here is very similar to the way Zach Galifianakis interviews his guests on Between Two Ferns. It's pretty funny.</comment>


An approach to fair ad blocking - <AUTHOR> http://adblockplus.org/blog/an-approach-to-fair-ad-blocking

<comment><USER2> Mice want cheese. If you put a mouse at the start a maze, and cheese at the end of it, a mouse will likely go through a maze to get the cheese. It will likely pay attention to the maze to try to figure out how to get through faster next time. But if the mouse can figure out how to get around the maze, maybe by climbing over a wall, don't be surprised or angry. The mouse doesn't like the maze at all; it's just an obstacle. The mouse just wants the cheese, not the maze.

Advertisements are like the maze. In early days, people were forced to sit through them in between parts of shows on the radio. Print ads had to be looked at so that people could find the articles. Nowadays, people are able to get around these 'mazes'. Morally, people might want to support the content- creators, but if you ask any newspaper executive or journalist, guilt can't get you very far for very long. Technology has enabled the blocking of advertisements, and a few mice have had a taste of the easy-to-reach cheese. These mice will almost certainly not go back to trudging through the maze as they did before.

Many critics offer a better solution: Make the mice _want_ to go through the maze. This is certainly a more difficult solution than making a banner ad with a logo. It requires a fair amount of creativity, time, and effort. But some advertisers are already doing this. Take a look at the Burger King games: <http://www.youtube.com/watch?v=mt2do5oV2-8>

Burger King has made their brand fun and engaging, making the consumers _want_ to consume the advertisements. In fact, they pay for them! Now isn't that ingenious?

Another example is woot.com. People want to buy stuff, suppliers want to sell stuff. They connect at Woot, and are directly engaged with the product.

This is the way marketing is supposed to work. Plastering noise and garbage on a webpage _will_ drive your users to clean it up. They _will_ find a way around your maze.

<comment><USER3> Most people don't think like this. People click on ads every day. millions of clicks. That doesn't help them get the cheese, it helps them find out about new cool products they didn't know about. Those adverts are useful to them. They are glad to have adverts.

That's why people who block ads stand at 6% of firefox users, which amounts to maybe 2% of total users. Hardly worth worrying too much about.

It's like the people who tell you every second how they haven't owned a TV for years, yet fail to grasp the fact they're nothing like the average joe.

For some reason adblock users seem to consider themselves as 'early adopters'. They're not.

<comment><USER2> "Most people"? Really? I think you should read this: <http://www.smvgroup.com/news_popup_flash.asp?pr=1643>

"Heavy clickers skew towards Internet users between the ages of 25-44 and households with an income under $40,000," the study said, and they "are also relatively more likely to visit auctions, gambling, and career services sites – a markedly different surfing pattern than non-clickers."

"heavy clickers represent just 6% of the online population yet account for 50% of all display ad clicks."

Sure doesn't sound like most people...

<comment><USER4> A lot of advertisers don't want to reach those people though. They want to get their brand in front of influential 20-somethings, not to get clicks, but to generate brand awareness.

</comment></comment></comment></comment><comment><USER5> His suggestion makes certain sense, but ...

It's not the ads on a _specific website_ that I don't like, it's the _specific ads_ on all websites. Also it's not just the ads, it's also the tracking contraptions including javascript bloatware and such. It is far easier for me to just keep blocking them altogether than to rely on a subjective opinion of a webmaster if his ads are annoying or not, and not know what it is exactly that gets unblocked.

</comment><comment><USER6> The day they add this feature and enable it by default is the day I fork ABP and distribute it without that feature.

Yup, I know this is "stealing". I don't care.

<comment><USER3> I like the fact most websites are free.

You know what pisses me off far more than any advert in the world? The fact you have to _register_ to read an article on the nytimes website. Can't be bothered. If the web can't monetize through advertising, expect far more moronic walled gardens.

<comment><USER6> "Delete domain cookies."

But actually, I subscribe to the NYT, so registering for the site doesn't bother me. I'd rather get something I pay for than get a bunch of crap I don't want (ads) just to read an article.

<comment><USER3> What if you had to register with 100 websites?

<comment><USER6> What if the Earth exploded and everyone died?

<comment><USER3> yeah I think my scenario is _slightly_ more probable.

</comment></comment></comment></comment></comment></comment><comment><USER7> If this feature becomes popular among webmasters (it should, as many use only Adsense which is usually far from intrusive), it will become annoying for the user.

I see a possible solution in tracking users' decisions to show or disable supposedly unintrusive ads. This way ABP will be able to see which websites likely abuse this feature and which websites are likely fair in claiming non- intrusiveness. So, in 'obvious' cases ABP could make an automatic decision to show or hide the ads.

P.S. I hope the above is readable.

</comment><comment><USER8> I will not tolerate ads, but will pay money to be able to access certain web sites. I see the purpose of Adblock Plus as being to force site owners to provide an alternative (e.g., subscriptions, micropayments, whatever) to ads for people like me. So, the way I would like Adblock Plus to restore the balance to be more fair to site owners is to refrain from blocking ads on sites that give the surfer some practical way to contribute to the cost of the web site without being exposed to ads.

<comment><USER3> They'll more likely ignore you, notice their CPM is low, and make the ads more intrusive for the rest. Well done you.

If a site is using intrusive or irritating advertising, don't visit it.

<comment><USER9> If sites ignore individual users' behaviour, wouldn't it be naive to do something expecting to change their advertising patterns?

OTOH, if blockers are such a tiny minority, why are you so concerned?

<comment><USER10> > OTOH, if blockers are such a tiny minority, why are you so concerned?

I'm concerned by the general decline of morality online.

</comment></comment></comment></comment><comment><USER3> >> "A webmaster should insert this tag into his pages if he thinks that the ads used on his site aren't intrusive. "

Erm in what way is that fair? How about the default being that you assume websites won't do intrusive crappy advertising,

and only block ads on the minority websites that persistently abuse that trust.

<comment><USER11> That _is_ the Web's default. It's users that make the conscious decision to over-ride the fault by installin AdBlock.

FWIW, I never block ads because I'm happy to have free content and pay an ad tax.

</comment></comment><comment><USER12> All I've ever wanted from adblock was a 'Disable ads on this site' button. Maybe they could even make it social so a central list of blocked sites could be generated.

Normally I'm happy to see the ads. For me it is part of the experience.(Maybe I'm biased in this way cause I work in online media). But there are certain sites that have crappy ads that take too much from the experience.

</comment><comment><USER13> His proposal seems fair enough to me. But I don't use an ad-blocker. I vote with my feet as they say and don't revisit sites which have a poor signal to noise (useful content to annoying ad) ratio. I personally find those sites which have genuine annoying ads are those websites with a poorly aligned moral compass anyway!

</comment><comment><USER14> Why not put algorithmic constraints on what is an acceptable ad?

For example, acceptable ads are:

1) Text only, no larger than the average font size on the page 2) Non-animated images under a particular size 3) Not served by blacklisted domains 4) Or listed by a whitelist-----

\</comment><comment>-- _screeecchhh_ stopping myself right there, new thought:

What about a plugin which annotates ads with thumbs up and thumbs down buttons. Do what the Gmail "Report spam" button does: develop reputations for advertisers, products, domains, etc. There is probably a great market resource business in here too somewhere....

I guess the summary of my post is that there must be a win-win-win solution in here for users, webmasters, and advertisers.

</comment><comment><USER15> Hi Hacker News! (my 1st comment here ;)) How about this solution: Make AdBlock to think more. Now it's every ad or no ads situation. How about middle ground? AdBlock would block only very irritating ads, these ads that tend to pop up on screen, animated ads (you can "deanimate" them, privoxy already implement this) and very big ads. Maybe we can have some way measure how much of advertisements given page contains? If site has 50% of ads we can reduce them to half of it. Also, adding something like <img adblockpriority="(0-6)"/> might help.

So, what do you think?

</comment><comment><USER16> Theoretical question (loosely related) if it is ethical to remove adverts from "free" websites is it ethical for those websites to ban ABP users from the site?

How far does that argument go?

(I am not sure my position on it TBH, thought I would throw it out to you lot).

<comment><USER17> I'd say "yes" to both questions. I should have control of my computer and how it displays data, and you should have control over whom you send that data to.

Everything else is a cost/benefit analysis.

</comment></comment><comment><USER18> I honestly hope advertisting does die a horrible death. I liked the web a lot more before it was commercialised.

<comment><USER19> Unfortunately the web as we know it would largely not exist without advertising revenue. Think of all the free services we enjoy each day, they are all funded through advertising of some description.

If there were no advertising on the web, I can't help but feel it would still be nothing more than a large internet newsgroup/forum without much that makes it the rich experience it is today.

<comment><USER8> Did you experience the internet before ads? If not, you might be surprised by how rich the experience was.

<comment><USER19> I started using the web around 1995, so I guess that depends on what time period you are referring to. I certainly didn't use it before the first graphical browsers appeared!

I guess my point is things like Gmail, flickr, last.fm etc would struggle to exist on subscription only. Perhaps we can do without them all though?

Also, I agree with the poster below with regard to finding content these days, it can be tedious. A search on a subject can find pages of aggregators, e-commerce sites and little in the way of true content. I don't find this the norm, but it happens.

<comment><USER18> Flickr _does_ exist on subscriptions only.

</comment></comment></comment></comment></comment><comment><USER20> _As I stated many times before, my goal with Adblock Plus isn't to destroy the advertising industry._

I'll play the devils advocate, with conflicting interests, so

Nope, your goal is perhaps to earn money on the back of the webmaster and that might be considered theft. Some ads are intrusive, yup very. Example in point, the economist. It has so many ads, I hate being on that website for more than a bit. What do I do, click away. Problem solved. I still have the power you see, without necessarily punishing the other webmasters who aren't as intrusive.

Now, of course it is a free market economy. The advertisers want sales so they become intrusive, the publisher wants revenue so they hold the ads, the visitor wants free content so he bears the hassle, or of course being smart installs an adblock and leaves the previous two in cold water. Fair enough, power to him who has the knowledge that such option exists, but no need to come back playing the fox saying you do not really want to give them such option. You clearly are providing a service and that service is attracting only low subscription currently, if it was higher subscription then your service would go cold as the webmasters would adapt. But seriously if by definition a blocker of ads does not destroy advertising then perhaps it should change the name to blocker of something else.

P.S. No wonder I hardly get revenue from Firefox users, perhaps as a way of regression every webmaster should block the smart firefox users and be stuck with the hell of internet explorer.

<comment><USER3> It's quite simple to detect and block only adblock users if you wish. It's about 6% of firefox users on my webapp. Or you could show them "Donate here if you're not prepared to see my ads" links everywhere.

<comment><USER20> How do you do so? I am not a programmer although have some experience of it, just a curious guy who happened to stubble upon this place with people which seem at least able to share a love for umm 'thinking' :P . I do not plan to implement a blocking of them guys, as I said fair to them, they have the knowledge and are not quite a threatening statistics. I'll save the time load for this thing I am trying to figure out of how to automate the change of the most viewed articles.

<comment><USER3> Simple method would be to try and load content from often blocked domains and see if it loads properly or not using js. I did this a while ago and measured the 6% firefox users using adblock.

For example:

      // cb = function to call with result
      function detectAdblock(cb) {
          var tt = document.createElement("div");
          tt.style.display = "none";
          document.body.appendChild(tt);
          var i = document.createElement("iframe");
          i.src = "http://adv.foo.com/ads/-adspace?ad_id=&affiliate=&advert=678";
          var foo = i.style.cssText;
          tt.appendChild(i);
          window.setTimeout(function() {
              cb(foo!=i.style.cssText);
          }, 200);
      }

This works because adblock is pretty primitive and just checks for keywords in the iframe src, and if there sets the visibility or display css style etc.

To get around adblock, you can proxy through your own domain, and stay clear of showing the ads in iframe/image/flash. Use js to put them in with everything else as text links which perform far better than any other type of advertising anyway.

<comment><USER4> There was some discussion on Reddit recently about ABP usage figures ([http://www.reddit.com/r/programming/comments/8j4c7/we_create...](http://www.reddit.com/r/programming/comments/8j4c7/we_created_a_plugin_for_jquery_jplayer_that/c09gqbb)). My rough estimations came out at 6% of FF users having ABP installed, sounds like that was about right.

Out of curiosity, what kind of audience does your site have? Particularly tech savvy?

<comment><USER3> Pretty tech savvy yup. Like 75% of so firefox users.</comment></comment></comment></comment></comment></comment>


Google USB-C Titan Security Key available in 9 international Google stores - <AUTHOR> https://9to5google.com/2020/02/18/usb-c-titan-key-international/ <comment><USER2> I use the Yubikey 4 nano cause I like that I can just leave it in the develop and it doesn't take extra space (except occypying a USB port). It seems like Yubikey 4 nano is also now available for USB-C and is called Yubikey 4C nano.

It seems that the Google Titan is missing the nano format which I prefer.

[https://www.yubico.com/products/compare- yubikey-4-neo/](https://www.yubico.com/products/compare-yubikey-4-neo/)</comment>


San Francisco, Oakland could be first cities in nation to ban facial recognition - <AUTHOR> https://www.eastbaytimes.com/2019/05/06/san-francisco-oakland-could-be-first-cities-in-nation-to-ban-facial-recognition/ <comment><USER2> It is likely the Department of Homeland Security cameras that see you see next to stoplights are using facial recognition.</comment>


Dear Dumb VC - <AUTHOR> https://medium.com/what-i-learned-building/e17153fde5f1 <comment><USER2> It's easy to sympathize with the OP.

It would be better to quote some actual data on VC returns, So, recently we have seen:

(1) As in Fred Wilson's post of

         Feb 21, 2013

         Venture Capital Returns

at his

         http://www.avc.com/a_vc/2013/02/venture-capital-returns.html

over the past 10 years, early stage US venture capital on average has had return on investment (ROI) less than the S&P 500.

(2) As in remarks on venture capital at the Web site of Peter Theil's The Founders Fund, at

         http://www.foundersfund.com/the-future

where click on "Read More" in a tiny image near the bottom of the page, with

         'Founders Fund:'

         'What Happened to the Future?'

         By Bruce Gibney

in section "VC's Long Nightmare", see:

"Along the way, VC has ceased to be the funder of the future, and instead has become a funder of features, widgets, irrelevances. In large part, it also ceased making money, as the bottom half of venture produced flat to negative return for the past decade."

Wow! Negative return for a decade!

It would be good for the VCs to 'up their game'.

<comment><USER3> I think VCs behave in the same way as _majority_ of investors: buy high and sell low. Also, there is also herd mentality - majority of VCs and entrepreneurs try to work on similar things.

However, I would like to point out that VCs are very important. Without them there will be no SV as we know (I do see how VC landscape is getting disrupted by YCombinator, Start Fund and similar).

And - it is not nice to call people dumb if they are not dumb (at least I wish I'm dumb as the dumbest VC I met).

<comment><USER4> And the herd mentality is not new, in the '80s there was overinvestment in PCs and disk drives. If my memory is not failing me, at one point there were around 40 (sic) mostly? entirely? VC funded disk drive companies (not that most actually got a product to market). It was a really crazy time, some/many of them shipped a lot of drives that they knew didn't work, and MiniScribe, a fairly well established one that had been cooking the books for a few years after losing an IBM contract, ended by "shipping bricks" (!!!; <http://en.wikipedia.org/wiki/MiniScribe>):

" _The primary scandal erupted in the final weeks of 1989, when after failing to procure short-term financing, the company executives decided to embark upon a fraudulent course of action to bring in the financing unwittingly from their customers. As each unit sold was tracked via serial numbers and also sat uninspected for some weeks inside warehouses in Singapore awaiting use in production, the decision was made to ship pieces of masonry inside the boxes that would normally contain hard drives. After receiving payment, MiniScribe then planned to issue a recall of all the affected serial numbers and then ship actual hard drive units as replacements, using the money received to meet financial obligations in the short term.

However, MiniScribe embarked upon a round of layoffs just before their Christmas shutdown, including several of the employees that were involved in the packaging and shipping of the masonry. These people immediately called the Denver area newspapers...._"

</comment></comment></comment><comment><USER5> _The VC was seventy-five minutes late to the meeting. She refused to see him even though he was in the office and her calendar was clear. Later that week she raised money from someone else. He kept emailing her saying his partners were going to kill him, please take the meeting with me.She never took the meeting, and she never called him back._

Good for her. If he's 75 minutes late the _very first meeting_ , that signals you're not a priority and could suffer in the future when you most need it.

I don't care how "big" you are....if you want people to respect you, respect their time.

<comment><USER6> Probably depends on the reason for the delay. If he delivered his child to the hospital for example, I wouldn't want to be his priority.

<comment><USER7> I thought this too, but the article makes no indication that he ever attempted to explain. He could have called/emailed and explained in advance, and asked to reschedule—even for the same day—, or he could have explained in one of the emails he sent afterwards.

Of course, this information could just be omitted from the article.

</comment></comment></comment><comment><USER8> Good points, but what a sad level of discourse. "Dumb VC"? If you don't like the VC, or find them unprofessional, there's no reason to lose your own professionalism, certainly not to write "dear dumb VC" articles on Medium.

<comment><USER9> Paul Graham's Hierarchy of Disagreement

[http://www.acceleratingfuture.com/michael/blog/images/disagr...](http://www.acceleratingfuture.com/michael/blog/images/disagreement- hierarchy.jpg)

<comment><USER8> I explicitly said I wasn't disagreeing with his point, just pointing out the lack of courtesy that I find endemic in rantings that are posted here. Your posting of the "hierarchy of disagreement", on the other hand, looks like classic middlebrow dismissal.

<comment><USER10> On yet another hand, courtesy and manners are social inventions of _aristocracy_ that constitute a tone argument, which is pretty low on the PG hierarchy and at any rate is an argument that benefits only the (in this case) VCs.

</comment></comment></comment></comment><comment><USER11> The author makes the mistake of taking a single data point (a throwaway comment at that) and generalising from it.

If you've got a board member or advisor (be it from a VC or elsewhere) with strong experience, then it's crazy not to talk to them about the problems you're having.

It's not just about product strategy, it's about building a company. If you've never had to scale a sales organization, if you've never had to open offices in foreign countries, etc. then it makes a huge amount of sense to speak to someone who's not only done it but has sat on half a dozen boards of companies who've had to go through the same set of problems you'll face.

What you should however take away from the article that it's important to do due diligence on your investors. You want an investor whose advice you'd want even if they weren't invested in you (this applies both to the VC firm and to the VC partner you'll be dealing with).

Why would anyone chose a top-tier VC over another VC - it's not because they offer the best terms of investments. It's because their value-add in terms of expertise, etc. is higher than everyone-else.

There's no point in going after a top-tier VC if all you want is money.

</comment><comment><USER12> After working as an analyst for one of these Dumb VCs, this is the first piece I have written that summarizes everything I feel about them adequately. Especially the last snarky remark about the 94% of VCs that read the article.

I genuinely feel like there is an incredible market out there that is waiting to be tapped: No Bullshit VC's. Give entrepreneurs a commitment: Once you get to the stage where they want to meet with you, they meet with you once, have an agreed upon time period for research, and at the end of the time period, they give you a term sheet or a refusal. Extra points if they give straight- forward valuations without the salesmanship bullshit of trying to quantify intangibles like the value of their advice or connections. And extra extra points if they avoid meddling.

<comment><USER4> One thing I noticed about some of the major successes in the good old days (the '80s for me) is that they had a "No Bullshit" early investment, one where a VC took a good look at the company and without wasting time signed a check. Sun I think enjoyed one of these....

</comment></comment><comment><USER13> More medium.com linkbait. You can't generalize like this. I've seen VC's rescue companies that were on the skids and I've seen VC's invest in companies being more than happy to be hands off. I've also seen them contribute to new management after the original CEO met with some really bad luck right after the investment.

All VC's (unlike whiny articles on medium.com) are not created equal. If you're going to go out and write a piece like this anyway you might as well go all the way and name the party, as it is it's an unverifiable one-sided ploy for attention.

</comment><comment><USER14> We were the first company to transmit cable television signals over fiber optic cable, but during a board meeting, our VC's representative heard we were using lasers, and wondered if we could expand the business by selling tattoo removal equipment. There are instances where a VC should give you money (assuming you're a good bet), and yet NOT get a board seat (or as the article says ... a returned telephone call).

</comment><comment><USER15> I don't understand. They want a VC who is "hands off," yet at the same time they want a VC who "cares about the product," citing the example of a VC showing up wearing their company's pants. Why does a VC need to care about your product if you want them to just fork over cash and remain hands-off?

</comment><comment><USER16> Why are sites like this still hijacking the back button on users browsers?

(Go to the link, then click back, and again to see what I mean).

<comment><USER17> Works when I do it, in Chrome. If it's failing in Firefox, my guess is it's an issue related to the JS history API, which differs slightly between the two (and is generally a giant pain in the ass to use correctly.)

</comment></comment><comment><USER18> Being angry doesn't help you make good decisions. This post highlights the author is pretty junior in his thinking.

Even if he has a good business.

</comment><comment><USER19> very well put together - great piece. As op expects, there will be flack as 'dear dump startup' etc but we all know that as its the norm and VC's have an aura as if being on the other side of the fence they are playing a different ball game. Nope !

</comment><comment><USER20> Pure Genius</comment>


IFixit's Self-Repair Manifesto - <AUTHOR> http://www.ifixit.com/Manifesto

<comment><USER2> I've always been peeved at how so many people consider recycling the only way to be 'green'. Remember the old slogan, "Reduce, Reuse, Recycle"? Reducing your consumption and reusing as much as possible are way better than just recycling. Unfortunately they also reduce spending so there's not a lot of incentive to encourage it via marketing dollars. iFixit seems to have found a viable model to push people to "Reuse" rather than "Recycle", but I'm still hoping somebody out there can push us to "Reduce" first.

<comment><USER3> Amen to that. Instead of taking old hardware to green citizen for recycling, lately I've been donating it on craigslist. In silicon valley, it's surprising how many people will get use out of your old electronics.

</comment></comment><comment><USER4> > we can't run a linear manufacturing process forever.

If only we _were_ running a linear manufacturing process. The market punishes companies that don't post _exponential_ growth in the form of seemingly linear quarter-over-quarter growth.

This is a great way to present the problem to non-hackers, if you haven't seen it: <http://www.storyofstuff.com/>

</comment><comment><USER5> One of the inspirations to the Self-Repair Manifesto is the equally awesome "Maker's Bill of Rights"[1], which is a little more focused on the practicalities of such a concept including gems such as "Screws better than glues"

[1] [http://blog.makezine.com/archive/2006/12/the_makers_bill_of_...](http://blog.makezine.com/archive/2006/12/the_makers_bill_of_rights.html)

<comment><USER6> This is made even more evident by the fact that iFixit runs Make's <http://makeprojects.com/>

</comment></comment><comment><USER7> I spent a good part of my teenage week-ends at a dump in France with my brother and our friends recuperating small engines and moped parts, hacking them back together, creating strange 2 or 3 wheel novel vehicles. Every time we see each other, we have the best time remembering those memories. We all have all in one way or another kept doing the same thing at work with other types of technologies.

All this to say that this manifesto goes for companies too of course!! and that it's not owned by ifixit.com, but should be yours too if you care about waste and overconsumption.

</comment><comment><USER8> Fixing things can be fun and educational; however, as a matter of routine maintainance there comes a time when it is no longer desirable or economical to repair. It's better to discard and replace.

I look forward to the time when we have sufficiently abundant power and other relevant knowledge to recycle _everything_ by heating waste to a plasma, sorting, and converting the condensed atoms into useful stock compounds.

<comment><USER9> Thus replacing consumption of material by consumption of fuel?

<comment><USER10> You can use the waste heat to generate electricity.

But presumably this is only done once energy is very cheap/abundant.

BTW this plasma thing is real: <http://en.wikipedia.org/wiki/Plasma_arc_waste_disposal>

</comment></comment></comment><comment><USER11> _"We have the right"_ should probably be _"We want the right"_ From what I know, in the US at least, a warranty void sticker for example is legally valid.

<comment><USER12> It is not the case in Russia. The manufacturer (or repair service provider) must prove that it was your intervention that caused the product to break [ЗоПП 18.4].

Unfortunately, a lot of people don't know this, and are mislead by sellers and service providers.</comment></comment>


Facebook Dating launch blocked in Europe after it fails to show privacy workings - <AUTHOR> https://techcrunch.com/2020/02/13/facebook-dating-launch-blocked-in-europe-after-it-fails-to-show-privacy-workings/ <comment><USER2> Clickbait headline.

Facebook was not "blocked" \- they voluntarily halted the rollout of the feature themselves. NOBODY told them to do this.

Reading between the lines, someone at Facebook's legal department was asleep at the wheel and forgot to provide the authorities with the required documentation. The DPC nudged them a bit and Facebook hit the panic button.

<comment><USER3> A raid on their offices is perhaps a bit more than a nudge?

<comment><USER4> A Klingon nudge, then.

</comment></comment></comment><comment><USER5> It was garbage anyway. I used it briefly during the first week it launched in the United States and, at least here in Indy, about every fourth girl was blatantly in a relationship. Some even had kissy-face wedding photos in their profiles. Facebook only gives you the option if your profile is set to single but that's just a toggle.

That first week it was also already full of blatantly fake profiles. You're telling me there are three women that look identical to Kevin Smith's daughter and just happened to be at the same red carpet event, with the same dress, in the exact same pose? And then despite me having it set to female it showed me several men that I'm 99% certain were not trans and were either idiots and set their Facebook profile up wrong, or intentionally input things wrong to try and obfuscate their data profile.

It also made the promise (I think they did anyway) of not showing you people you were friends with. It didn't, but it did show me a bunch of my graduating class from 16 years prior and gobs of friends of friends. I saw considerably more people on it that I knew/knew of than I ever did with Tinder/OkCupid/Bumble.

<comment><USER6> So on par with Tinder?

</comment></comment><comment><USER7> Only one week and regulatory forces managed to push back?!

I wonder when someone from the same regulatory forces will help Ruben out: [https://ruben.verborgh.org/facebook/](https://ruben.verborgh.org/facebook/)

He's been waiting for over a year now for his actual dataset - fighting for us all.

<comment><USER8> Ok, I assume it would help if he could state his demands in more formal and legally actionable form instead of joking and telling fun stories of meeting FB employees at a conference, but regardless:

> Facebook has not replied after three months, even though they are legally > required to answer within one month

So, I'm ready to accept everything else is a subject to some legal debate, but this seems like pretty straight-forward violation of the law, isn't it? I mean, shouldn't they be actually punished for it by, like, paying money?

<comment><USER9> Facebook seems to believe (understand?) that it is part of the new reality where due to their size and revenue the law only loosely applies to them, and mostly at their convenience.

<comment><USER10> That's not _new_ reality. That is the world we live in. If you're big enough/your product is widespread enough then you get to set the rules. From a practical point of view it even makes some sense. It's up to the authorities (most likely a DPA) to actually do something about Facebook not adhering to the rules.

</comment></comment></comment></comment><comment><USER11> Just in time for Valentines day, you just know somebody in marketing will be emoting over this..

<comment><USER12> The Valentine Day is not a big event at this side of the Atlantic. There is some chance, the marketing has caught up with the younger generation, though.

<comment><USER13> Just wanted to point out that Valentines day is originally a European tradition.

<comment><USER12> Indeed, the 'tradition'/origin has the roots somewhere down the Roman Empire, 3rd century. Now it has been commercialized to a high degree.

My point was something like: take US holidays grade on the scale 1-10; Christmas 10, Halloween, Thanksgiving Day - 9, 4th of July, New Year - 8.... Valentine's Day - 4, Memorial Day - 2. (not all rated, obviously)

Germany - barely registers as anything; Spain, Sweden, Estonia - not a thing at all. There might be promotions, advertising, etc. but it's not an engraved thing for the decision to matter the date/proximity of Valentine's Day.

</comment></comment></comment></comment><comment><USER14> Ireland has a lot of strange relationships with large tech companies, but I can say for sure, we have some great data protection laws.

Genuinely delighted that some people pay attention to these things and know what they're talking about.

<comment><USER15> Laws maybe, though these are set at the EU level (and one might argue about the greatness of GDPR).

Still, the rest of the EU (or at least Germany) is quite unhappy with the enforcement of these laws in Ireland. It is absurd that the Irish Data Protection Commissioner is supposed to control the privacy of most larger tech corporations for the whole EU. A few years ago, they only had 22 employees and their only office was literally co-located with a supermarket in the suburbs [1]. They got a second office since then and apparently are now at around 100 employees [2], but that is still quite small if you have to control giants like Google, Facebook and more.

So, from the outside it looks like Ireland's "strange relationships" also include privacy matters.

[1] [https://www.gutjahr.biz/2012/07/facebook-eu- datenschutz/](https://www.gutjahr.biz/2012/07/facebook-eu-datenschutz/) [2] [https://www.dataprotection.ie/en/news-media/press- releases/d...](https://www.dataprotection.ie/en/news-media/press-releases/dpc- publishes-annual-report-25-may-31-december-2018)

<comment><USER16> This stuff should be handled at a union level. Seems like low-hanging fruit to me.

As in: I don't think many EU citizens would object to having this being taken from the national level to the union level.

Create a single, strong EU data protection authority, placed somewhere in the union, after the typical competition. I'd suggest Sweden, but would also be happy with Denmark, Germany or the Netherlands.

<comment><USER17> I don't know much about the EU - why is the physical location of the office important?

<comment><USER18> Which office? Facebook's or the data protection agency's?

EU (more or less) has rules that the countries are primarily responsible for execution of the law and it makes sense that if a local shop causes privacy issues they should be handled by a local authority.

Now companies like Facebook play the system a bit. As first line of defense they claim that their European offices are just resellers of ads etc. and the actual operations are done by Corp U.S. (or Corp Bahamas or something) and for a second line of defense pick the country with the "best" enforcement and taxation track record. That can be done as in order for not each country trying to go after their local subsidiary the country with the European headquarters can go after that HQ for all larger cases.

Now the Irish government is smart - they see that 1% taxes on all of European business of Corp is better than 40% of only Irish business, thus they don't employ overly strict oversight.

Does it make sense for corporations like Facebook? Probably not. But for changing this this requires a unanimous change of EU law in the EU council and getting Irish to agree to that is tough, essentially meaning to pay them subsideries for their farmers or something to compensate.

Also, why to U.S. corps go there besides taxation? Language and common law. Essentially going to UK and Ireland is the easiest for U.S. lawyers to work with, as legal traditions and language are closer than on the continent ... and especially now after (formal) Brexit the choice is simpler ...

</comment></comment></comment></comment></comment><comment><USER19> What's up with the F word being liberally used in the article ? oO

<comment><USER20> Liberally? It appears twice, I honestly didn't even notice first read-through.

</comment></comment><comment><USER21> Comments from FB are boatloads of bullshit, as expected. How nice to see that not everybody lets themselves get fucked over by them as a matter of course, like in the US. Cheers to Ireland.

<comment><USER22> The only people being fucked over here are consumers who are being denied free choice in the list of services they might voluntarily use.

I hate surveillance as much as anyone, but it's hard to see how it might be a good thing that someone's website launch is being censored by the state.

<comment><USER23> I hate pollution as much as anyone but it's hard to see how it might be a good thing that someone's paper mill launch is being censored by the state.

I hate cancer as much as anyone, but it's hard to see how it might be a good thing that someone's tobacco advertising is being censored by the state.

I hate sex trafficking as much as anyone, but it's hard to see how it might be a good thing that someone's Russian bride catalog launch is being censored by the state.

——

I guess my point is that your broad objection to government interference is completely meritless without considering the specific harms and benefits under discussion. The problem with surveillance is that the harms are distributed and delayed. Meanwhile Facebook does everything it can to obfuscate what these harms might even be.

<comment><USER24> >The problem with surveillance is that the harms are distributed and delayed. Meanwhile Facebook does everything it can to obfuscate what these harms might even be.

The harms of regulation are also distributed and delayed. The Backpage.com sex workers who were selling their services online have to go back to the danger of working the streets as a consequence of new online sex trafficing laws. People previously buying drugs safely online now have to go back to the streets, with dangerous dealers and worse infrastructure for testing drug safety. GDP grows a little slower, nobody notices for a while, until a couple decades later the standards of living in that country are lower than their neighbours and what they could have otherwise been. Some people miss out on meeting the love of their life who they might otherwise have met on Facebook Dating.

It's not enough to consider the benefits and harms of the thing you're considering banning, you also need to consider the harms of the ban itself, and of creating the political infrastructure to enforce the ban, that could be turned against you the moment a far-right government wins an election (may I remind you that the People's National Front won 33% of the vote at the last French election).

<comment><USER25> The harm of not allowing Facebook dating while it fails to meet privacy regulations is that people have to use alternative dating services that do meet privacy regulations.

Social harm: nothing.

The implication that any government ban is bad, because fascists, is silly. The concept that some bans have net negative consequences is fine, but there is nothing to suggest that is the case here.

</comment></comment></comment></comment></comment><comment><USER26> I am on several dating apps and there is now way in hell I would ever use Facebook dating. It used to be called the poke function anyways.

</comment><comment><USER27> It's Facebook after all, so of course there is no privacy there. Imagine using this service and with their total lack of privacy and having your preferences spilled out. Same as putting them on a billboard.

<comment><USER28> What could be worse is if the same patterns and culture of allowing targeting and monetization carry over to Facebook Dating from the rest of the Facebook platform and organization.

Combined with romance scams[0], it seems possible that Facebook Dating would provide narcissists, manipulators and fraudsters with a lucrative marketplace to operate in.

[0] - [https://www.bbc.co.uk/news/business-51459517](https://www.bbc.co.uk/news/business-51459517)

<comment><USER29> This is basically a Nigerian prince fraud. What's new?

</comment></comment></comment><comment><USER30> I got this sinister mental picture of a facebook human farming department trying to add a breeding sub div.

</comment><comment><USER31> I'm personally thinking it's sad such resources and effort are expended over something as frivolous as a dating app. If there are significant irregularities it's better to just fine them a couple of billion later. Better for the wallet, too.

<comment><USER32> Not better for anyone who ends up being stalked and/or raped as a result of a badly monitored/regulated dating app, though.

There's a public safety issue here: dating requires interpersonal negotiation for personal intimacy with consent, which in turn implies that a dating app needs to be "safe space". Facebook is notorious for leaking personal information to third parties (typically but not always advertisers). I have no knowledge of _specific_ risks associated with Facebook's dating app, but the precautionary principle should apply in those cases where personal safety is at risk, and the sheer scale on which Facebook operates means that a dating app backed by the big F needs oversight.

Luckily, GDPR FTW.

</comment></comment><comment><USER33> It feels wierd to read an american article that uses word like 'fuck you' and 'fucked up'. I kind of like the brutal honesty of the word usage.

</comment><comment><USER34> Slight tangent, but it seems that TechCrunch are also quite bad at privacy - following the link initially redirects to [https://guce.techcrunch.com/consent?brandType=nonEU&done=htt...](https://guce.techcrunch.com/consent?brandType=nonEU&done=https%3A%2F%2Ftechcrunch%2Ecom%2F2020%2F02%2F13%2Ffacebook%2Ddating%2Dlaunch%2Dblocked%2Din%2Deurope%2Dafter%2Dit%2Dfails%2Dto%2Dshow%2Dprivacy%2Dworkings%2F&gcrumb={{CRUMB})} with a 307, which, when followed redirects to [https://guce.advertising.com/collectIdentifiers?sessionId=3_...](https://guce.advertising.com/collectIdentifiers?sessionId=3_cc- session_{{GUID})} with a 302.

I like that the "consent" URL doesn't actually ask for consent - it just immediately redirects to "collect identifiers" \- it's possible they already assume they have my consent, but since this was checked with a cookie-less cURL command, that seems unlikely. Since my adblocker is blocking the guce.advertising.com domain, I guess I don't get to visit TechCrunch.

<comment><USER35> Another post where the top part of the thread is a tangent/unrelated to the post. This is becoming common on HN and I don't find it helpful.

<comment><USER36> Totally agree. It's especially annoying because it's the top thread.

<comment><USER37> It's the top thread because people find it interesting. If you don't, just click the [-] and it will close the whole thread.

</comment></comment></comment></comment><comment><USER38> Website hijacks my back button in Safari. Is there something that can be done to prevent this?

<comment> dao- I know we (Mozilla) are working on fixing this in Firefox: [https://bugzilla.mozilla.org/show_bug.cgi?id=1515073](https://bugzilla.mozilla.org/show_bug.cgi?id=1515073)

You may want to check Apple's bug tracker, they likely have an open issue on this already.

<comment><USER39> It would be a better idea to block ads served from such sites, or to even send punitive requests.

<comment> dao- It's possible Firefox already does that via its enabled-by-default tracking protection. At least I don't seem to have an issue with the back button here.

<comment><USER39> Fixing the bug only fixes it for Firefox users, but disincentivizing it fixes it for everyone.

For me, uMatrix blocks it; it redirects through [https://guce.advertising.com/collectIdentifiers](https://guce.advertising.com/collectIdentifiers). I could disable it or go through IA or whatever, but I really haven't the patience to deal with these websites.

</comment></comment></comment></comment></comment><comment><USER40> Finally, some sanity applied.

</comment><comment><USER41> Are they going after the 40+ dating market? Surely the dating app demographic isn't on Facebook anymore, though maybe Facebook is still popular in the 18-30 age range in Europe? I just don't know.

<comment><USER42> In the UK its certainly not popular with the late 20's crowd. There are still some people hanging on in there but most people seem to have (thankfully) given up on it for anything other than messages and the occasional event.

</comment></comment><comment><USER43> There are various takes on that, which of course depend on values each person (and country) considers as the most important.

In my personal opinion, Europe (in which I live) as an "Amish bias" [1], i.e. by default being more cautious about introducing new technologies. I am already annoyed by the constant cookie pop-ups that significantly affect my browsing experience but on mobile.

Yes, there are risks with all technologies. But with the current mindset, Europe is setting itself way back comparing to the USA... which is much more cautious than China. Or in other words, Europe sets itself to be the World's calm countryside, in which people live as they used to.

Some (maybe even the majority) may like it. Personally, I am asking myself from time to time - when it is time to move to Asia.

[1] [https://kk.org/thetechnium/amish- hackers-a/](https://kk.org/thetechnium/amish-hackers-a/)

<comment><USER44> Being concerned about privacy is not an Amish Bias, it means our citizens are less likely to be abused by some tech company.

<comment><USER45> And by extension a government, see the Nazis (invoking Godwin's Law here), but also the Snowden revelations - you can safely assume the NSA and co have access to all data held by the big tech companies. If Trump or his even more extreme successors decide that a certain demographic needs to be rounded up, they can requisition a dataset from Facebook and they'd have the list of people matching that description. Combine that with the military + the militarization of the US' police force and you realize you're only one executive order away from genocide. And I don't know if the world will go to war with the US over that.

<comment><USER24> So the problem with Facebook is that powerful governments might use their data to do horrible things, and the solution is to give governments even more power over our lives by letting them dictate what sites we're allowed to visit? If there wasn't so much of this "oh no, a problem, better get the government to solve it" thinking in the first place, the US government would never have gotten as powerful as it has.

<comment><USER46> > "oh no, a problem, better get the government to solve it"

Erm, that's exactly why we have governments: to solve society-level problems.

<comment><USER24> Yes but governments also cause problems, and if they get big enough the cure can be worse than the disease. E.g. if all governments in Europe had not had the power to override citizens' freedom of choice by drafting them and taking their factories to make bombs, there'd have been no WW1, saving tens of millions of lives. If Russian and Chinese governments in the 20th century had not had the power to override their citizen's freedom of choice and expropriate their property, Stalin would not have been able to conduct his purges, Mao would not have been able to conduct his great leap forward, the great famine would have been avoided, saving close to a hundred million lives.

As the quote goes, "A government big enough to give you everything you want, is a government big enough to take away everything that you have.". People think "oh it couldn't happen here"; well that's what people in Germany thought in the 1930s.

</comment></comment></comment></comment></comment></comment><comment><USER47> EU doesn't want me to find a girl, how sad :/ still thinks this could be much more usable than what become of Tinder, especially when there is no filters, which when you live near border could be sometimes really bad. Not that I have something against other nations, it's just convenient to look only for locals.</comment>


Unofficial documentation of the Tesla Model S REST API - <AUTHOR> https://github.com/timdorr/model-s-api <comment><AUTHOR> Docs are here: <http://docs.timdorr.apiary.io/>

This was discovered via the Android app in particular: [https://play.google.com/store/apps/details?id=com.teslamotor...](https://play.google.com/store/apps/details?id=com.teslamotors.tesla)

I did some sniffing on the traffic, which is SSL encrypted, but luckily it's pretty easy to install your own CA in Android 4.1+.

They have both a Rails app and a nodejs server. The nodejs server is for live streaming car location and driving metrics. I haven't gotten that documented yet (but I'm accepting pull requests!), but some people have already been making use of it: [http://www.teslamotorsclub.com/showthread.php/13410-Model-S-...](http://www.teslamotorsclub.com/showthread.php/13410-Model- S-REST-API)

One guy already has his Model S tweeting: <https://twitter.com/pureamps>

<comment><USER2> I _love_ Tesla, and the Model S seems great, but having a rails app server on my luxury car seems capricious.

How does it get updated? An attacker can _at least_ unlock the doors or drain the battery (lights & HVAC control), and possibly it is an entry point for something much worse (unlocking & starting, or disabling controls while enroute). Is this a major security flaw or am I just spreading FUD?

<comment><USER3> It doesn't have a rails server on the car. The car communicates to Teslas datacenter, which is where the Rails servers are. You then query the API by querying the datacenter.

<comment><USER4> I certainly hope the engineers their are staying on top of the recent deluge of Rails patches. Tesla's database has a huge amount of private data; mostly containing information about rich and influential people. A black hat could undoubtedly profit by tracking people and correlating their location to affairs/secret business meetings/etc.

<comment><USER5> According to Elon Musk, it only sends data if you explicitly enable it.

<comment><USER6> I'd just like to add that they enabled it by default for cars they lend to media outlets for reviews after the Top Gun thing. Some people in the other thread were freaking out about how much Tesla knows about your car but a regular customer can just opt out.

<comment><USER7> I think you meant "Top Gear". ;)

</comment></comment></comment></comment></comment></comment></comment><comment><USER8> Using GET to trigger horn honking... Not sure I'd consider that good REST practices.

(At least honking the horn doesn't incur permanent state change; unlocking the doors is obviously not safe.)

Edit: idempotency vs safety... I knew I was being stupid.

<comment><USER9> Unlocking doors absolutely is idempotent. What different state would you see if you issue Unlock once or a thousand times?

<comment><USER10> Solenoid melted?

<comment><USER11> Thinking like an embedded systems engineer (I am) instead of a mathematician (I'm not), I would have a sensor to know the state of the lock and only whack the unlock solenoid if the lock has been discovered to be closed.

Always treat mechanical devices in a non-deterministic fashion.

<comment><USER12> As a software developer I'd always try to unlock it. The user probably has a reason for pressing the button. Maybe your "is the door locked" sensor is broken? If you're afraid of overheating it wait a bit after the second try before enabling it again.

<comment><USER13> You might be surprised by the semantics assigned to double clicking the button by some manufacturers. On some BMWs (mine included) locking it twice DISABLES the alarm. It's intended for ferries / low-loader recovery etc. but if you don't know it...

<comment><USER14> VWs can do a thing where the windows open if you hold the lock key down - fortunately this can be turned off in the cars configuration settings for people who live in rainy countries!

<comment><USER15> Just to be precise, the windows open when holding the unlock button, and close when holding the lock button.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER16> Does Tesla describe it as a _RESTful API_ , though? By the looks of things, the author has discovered it and decided to call it RESTful himself, even though it's just an HTTP API.

A RESTful API is more than just using GET to access resources.

<comment><USER17> I agree. This interface is not RESTful, and that's good, because it's not a good fit for REST. I may be wrong, but it seems REST is best suited for accessing and creating _resources_. And it seems you would have to do a lot of conceptual mashing to represent all this API needs to do as resources. I am happy to be corrected.

<comment><USER18> What "conceptual mashing" is required? Your resources are things like locks, batteries and thermostats. It seems pretty straightforward to me.

<comment><USER17> You may have a point that I didn't consider. So if we wanted to unlock the car, would we perhaps post new a version of the lock resource (in json, xml, or whatever serialization format the system uses), representing its new state, to the uri representing it?

Exampe: POST {"state": "unlocked} to <http://doors/front-left/lock>

I realize I don't understand this, so your comment, and any further points you have, are sincerely appreciated.

<comment><USER18> Exactly. (except you would probably want to PUT the state instead of POST, since it's an idempotent operation)

You would GET the lock to see if it's locked, GET the battery to read its charging state.

You could PUT to the battery (or to some more abstract, finer-grained resources) to set the charge mode and turn charging on and off. The HVAC and thermostat would work the same way.

The only tricky stuff is "flash lights" and "honk horn"; they're inherently commands, so you might as well implement them in the RPC style that Tesla has used. They can't benefit from anything REST has to offer anyways.

<comment><USER17> Thank you. That is very helpful. But what about if it was necessary to have one command that changed the state of more than one resource?

And as you say, since certain aspects of the API (like honk horn) are unfit for REST, does it make sense to have the other parts of the API in REST? And then you've have two API's at once?

<comment><USER18> > But what about if it was necessary to have one command that changed the > state of more than one resource?

Then you need to have another resource that encompasses the aspects that need to be changed. Sometimes resources have to be somewhat abstract.

> since certain aspects of the API (like honk horn) are unfit for REST, does > it make sense to have the other parts of the API in REST?

If the application benefits from the constraints that REST provides then why wouldn't it make sense? It's still one API, "honk" and "flash" don't need to be walled off from the other elements of the API in any way.

</comment></comment></comment></comment></comment></comment></comment><comment><USER19> Hope this is secured against cross car request forgery.

<comment><USER20> My first thought was "Holy Shit! Cookie only authentication and you can unlock the doors, among other things!"

It's absolutely vulnerable to XSRF with cookie only authentication. This is a huge security issue.

</comment></comment><comment><USER21> What I would like to see is USB plug in every car, which provides diagnostic and maintenance data according to a standardized format. This should be available to the owner and to any shop they authorize to work on the car.

<comment><USER22> The OBD2 standard does this today. Not pretty, but works well enough. I always check my fault codes before going to the mechanic.

>which provides diagnostic and maintenance data according to a standardized format.

Except the values you get won't make any sense outside of your particular model. Its like reading SMART data from a hard drive. Okay, you can generate this csv and have all this data, but without the manufacturer telling what thresholds matter (and these are arguable), its kinda meaningless. SMART was supposed to predict failures and do all sorts of things, but its kind useless in practice. I think most controllers just stupidly rely on bad blocks appearing than trying to interpret the tea leaves of SMART data.

With OBD systems, all this information is internal and we get a fault code when we pass a certain threshold. I think this makes it a lot easier for mechanics and lay people to work with. Data addicts, of course, will never be satisfied unless they can pull every bit out of the system, but that may not be practical or useful. I could see a hybrid system where a car has the old fashioned OBD2 protocol and something else for nerds to download.

<comment><USER23> Getting at that level of data would be possible if you could access the CAN bus. It's part of the OBD-II standard, but most manufacturers don't forward the CAN bus data to that specific connector hidden under your steering column. However, _a few_ do, and there are other connections in other locations for the other makes.

<comment><USER24> You can access the CAN bus pretty cheaply (there are several cards available around $200 with linux drivers, maybe cheaper if you're willing to do more than plug it in and turn on wireshark). That said, the last time I worked on ECMs, the messages were not standardized at all. You needed a spec to define what variations of ECMs were available as well as what the individual values would mean. I feel like GM was standardizing this more than others in an effort to consolidate ECMs they were shipping (runtime config via "calibrations" I believe), and all manufacturers might be using standardized parts now, but you'll still need to know not only the message inventory for your vehicle, but you'll want to know whatever diagnostic protocol that your manufacturer uses to sit on top of CAN. Keyword Protocol 2000 was used by DaimlerChrysler was used when I was still in the business and GMLAN was used by GM for these purposes.

<comment><USER25> The Goodthopter [1], an offshoot of Travis Goodspeed's 'GoodFET' project, allows CAN access for about $35 all in. It's basically a MSP430 + a CAN controller.

Even 'simple' CAN protocols, like J1939 used in trucks/agri/marine, are purposely non-standard. It's rather annoying.

I'm curious as to what systems will emerge from Mercedes/VW/BMW (and I guess Google) as more high speed sources like LiDAR, active dampening, etc become the norm. The current BMW 5/7 series and Mercedes' S-class already have separate CAN-like systems for high speed buses.

[1] <http://goodfet.sourceforge.net/hardware/goodthopter11/>

</comment></comment></comment></comment></comment><comment><USER26> Wow, finally a way for us nerds to interact with our cars, besides of hunting undocumented CAN bus commands via OBD2!

<comment><USER27> Would also be nice if we had publicicly available IVI computers with proper car APIs to tinker and play with. Any ideas if there are other available than upcoming Tizen IVI reference hardware (which is not yet available for 2.0 afaik)?

</comment></comment><comment><USER28> It has an active 3G connection at all times and can be queried for its GPS position ? Damn, future is both exciting (tech wise) and scary (privacy wise).

Now that I think about it I'm sure it's not the only car with this, but I didn't realize before

<comment><USER29> This is really actively used in fleet management domain today. Mostly for utilization analytics, fuel usage, idling detection, driver behavior etc. It is amazing how many efficiencies can be found in the data...

</comment></comment><comment><USER30> I use this every night from a python script to force the charge to start after the electricity becomes cheaper. So far it is fast and reliable.

</comment><comment><USER31> Neat! Couple of nits, though, if anyone from Tesla is reading:

\- Wish it used OAuth or some other revocable token mechanism. What if I lose my device? Sell the car? Get a divorce? etc..

\- GET for things that change state? Looks like these are all idempotent, so they should be PUT.

\- Versioning might be nice. :)

Still, progress! Clean API over HTTP that returns easy-to-parse JSON _for a car_ = win.

</comment><comment><USER32> Coming soon to the HN front page: RoadRage.js

</comment><comment><USER33> This would make an interesting music instrument. I hope someone writes something that makes it MIDI-compatible.

</comment><comment><USER34> I hate to think what would happen if tesla's user database was hacked. Not that that's a reason not to have a REST API of course, I hope to see a lot of car-app innovation come from this!

</comment><comment><USER35> Do the cars have an onboard wifi for the server-client communication? Is this API also open to the Internet over the car's cellular connection? (if there is one of course)

<comment><AUTHOR> It's over 3G for now. There is wifi hardware in the car, but they haven't built out an interface for it yet.

All Model S's come with 3 months of cell service and they will be offering data plans shortly. It's running on AT&T, so we should be able to add it to Mobile Share plans (which I plan to do).

<comment><USER36> Is the SIM soldered? Or can you drop a T-Mobile SIM card in?

/T-Mobile user

<comment><USER37> I looked around and didn't see a SIM slot. Tesla hasn't disclosed the carrier in use either.

They did however say that you'll be able to tether a phone with a data connection to the car via USB to avoid paying a subscription for the car.

<comment><USER36> I don't mind paying the subscription; I just hate AT&T with the passion of ten fiery hells.

</comment></comment></comment></comment></comment><comment><USER38> It is weird that you connect to the API through http and send user and password in plain text.

<comment><AUTHOR> It's https, actually.

</comment></comment><comment><USER39> [http://www.youtube.com/watch?feature=player_detailpage&v...](http://www.youtube.com/watch?feature=player_detailpage&v=meY1R43fJIQ#t=35s)

</comment><comment><USER40> Lovely

/vehicles/{id}/command/door_unlock

<comment><USER41> Exactly what I was thinking... one vulnerability in their stack and every car is pwned.

<comment><USER24> Meh, you've had these for years. I'd put it at even money that some RF protocol stacks on recent vehicles are vulnerable to exploitation and connected to one of the CAN buses on the vehicle so you can pivot to a more critical system. Hurray for drive by exploits (literally).

I'm honestly surprised that criminal organizations haven't paid/coerced engineers working how to steal certain cars using a remote control, because I'm pretty certain that with some effort, it's possible.

</comment></comment></comment><comment><USER20> Hello XSRF! Cookie only authentication? Seriously?

<comment><AUTHOR> This is only accessed directly via library, so CSRF isn't a factor. Also, everything is happening over SSL.

<comment><USER42> SSL wouldn't save you, but if you never get the magic cookie into a browser then you're safe from XSRF.

</comment></comment></comment><comment><USER43> This is great! Can't wait until they add steering, gas, and brake to the API.

</comment><comment><USER44> Not a new thing - Tesla not the first automotive to do this.

</comment><comment><USER45> wow....they are using GETs for everything ! :)</comment>