Sales engagement startup Apollo says its massive contacts database was stolen - <AUTHOR> https://techcrunch.com/2018/10/01/apollo-contacts-data-breach/ <comment><USER2> The article talks about notifications and risks to _customers_ of Apollo, but it's not the _customers '_ data that was stolen... It was that of 200 MILLION people who probably never opted into having their contact information packaged and sold to third parties.

<comment><USER3> Waiting for GDPR. The information provided while not PII is still pretty useful for say, social engineering.

One wonders how much the dataset would go for in the black market.

<comment><USER4> Name and email are usually considered PII in most of the compliance world, no?

<comment><USER5> Does it apply if they are business contacts (business address/phone number)? After all your company-issued phone isn't personal to you -- it identifies a role ("the purchasing manager for foobartronix") and if you leave that number will reach someone else.

I don't know how the "compliance world" treats, that but I bet it's a loophole many many people are trying to squeeze through.

(I do actually consider it personal to you. And I am a fan of what GDPR is trying to accomplish, in principle, but it's clear the law doesn't really work yet).

<comment><USER6> GDPR has a broader definition of PII than is used in the US, and includes any data that can potentially be used to identify an individual (even IP address), so it's almost certain that it is within scope.

<comment><USER5> Here is the actual text of GDPR (there are many sites, hosted at .eu domains, that claim to tell you what the legislation says, but why not read the published law? (I chose English as HN is an English-language site): [https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=celex:32...](https://eur- lex.europa.eu/legal-content/EN/TXT/?uri=celex:32016R0679) )

My read is that the text of the law doesn't apply to people acting on behalf of a corporation, in their corporate persona (but this is why I linked to the text itself and not someone else's interpretation. It's not that long).

The law talks about identifying a person in their personal sphere (doesn't apply to being in your home; talks about ties to fundamental human rights, genetic and health info, etc) or things like credit approval, and many many many exceptions for "national security" an "legal" uses. It clearly _does_ apply to what your employer knows about you!

Normally I hate these kind of hair-splitting "gotcha" cases I write up below, so I feel weird typing them. But the economic value is so high and frankly some of the the use, and abuse, cases so clear, I wonder. It's still early days for GDPR so these questions are, at the moment, rhetorical.

Here's an example: part (26) says, "The principles of data protection should apply to any information concerning an identified or identifiable natural person." But if I call a company the telephone receptionist will answer and I will know I can reach them by calling that number. If they have three I know I can reach the one I want to by calling repeatedly. Yet you don't want to prevent publication of company phone numbers (and what about suppressing them until the receptionist leaves -- that leaks personal info too). (the section is actually about pseudonymisation BTW).

Likewise per your example of IP addresses (in 30) If a company uses NAT then the company's IP address does not identify any single person, though it could be presumed to identify a particular subset. (adding IP address to other info could ID one person, and that is covered in 30)

</comment></comment></comment></comment></comment></comment><comment><USER7> This smells like someone leaving a DB open to the world (remember the old MongoDB open by default?)

I think stealing a whole database raises very serious questions as to how technically this was done and how would you prevent this at your company.

Unfortunately "transparency first" aside, companies don't usually release this information which leaves us all wondering how we can better protect our users (outside of having sane defaults, closed by default, no ssh, private networks etc...).

<comment><USER8> You would be surprised to find out how many large companies(i.e top 500) lost theier databases, banks included. Many can be googled but most never made it public or didn't even know what happened to them. Chances are that your contact data has been leaked by several parties already. My conclusion is that you can't secure data unless you make a goal of that and even then it's not a sure thing. All your private networks have multiple public entery points and possibly a coordinator(i.e kubernetes admin). Most ecommerce companies and even payment processing companies think of security as an accessory to their business not a primary concern. If they are too focused on security they loose market share(i.e the vetting takes too much time) The only solution is to consider all unencrypted data public and use encryption at the client level(i.e mobile device).

<comment><USER9> That's why the EU introduced GDPR. So you are legally responsible (and the fines can be pretty steep) if you 'forget' to make the breach public.

</comment></comment></comment><comment><USER10> So is this must be the database that hundreds of relentless SAAS Sales Reps use to send me emails like " _Hi there, wanted to bubble this up in your inbox and see if you 'd be interested in a convo about your site and how we can increase xxx% revenue with our yyyy solution_"

<comment><USER11> Oh you just wait! If you haven't gotten one of these yet, the latest version of this is that they actually send a calendar invitation (through a 3rd party service) for a meeting out of the blue. Gmail will helpfully pencil that time in on your calendar automatically until you go in and delete the event. This prevents legit meetings from being scheduled since people are afraid you have some important sales call. If you're absent minded and click "No" to your RSVP, they know you saw it! Blech!

<comment><USER12> ah the "we are drowning in product market fit, so don't pass up this opportunity we are giving you"

</comment></comment></comment><comment><USER13> These articles are always a little frustrating, especially to those of us who aren't familiar with data management on that scale. For example, how was the breach carried out? How did the company know it occurred? Was there something the company should have done, but didn't?

I understand why those details don't make it into the media, but it's hard not to be curious about it.

<comment><USER14> It's probably kept secret because if we knew how easy it was to steal their data that would be bad for their image. Most companies have little to no security other than "no one will think to request this url". Could be a past or present employee who knows all the unprotected systems and wanted to make some extra money selling the data.

</comment></comment><comment><USER15> > Apollo's database contains publicly available data, including names, job > titles, employers, social media handles, phone numbers and _email > addresses_. It doesn't include Social Security numbers, financial data or > _email addresses_ and passwords, Apollo said.

Eh? So are email addresses included or not? They're listed in both categories.

<comment><USER16> Based on the grammatical structure of the second sentence, it sounds like they're [email,password] pairs weren't lost, while emails alone may have been.

<comment><USER17> That's a weird way to say it, it almost seems to imply that a list of passwords was lost, but the passwords aren't associated with emails.

<comment><USER16> Yea agreed, very poorly phrased.

</comment></comment></comment></comment><comment><USER18> Can someone with more experience of these things tell me how these breaches are discovered, and how they know what information was taken? I presume it's not an exact science.

<comment><USER19> Not overly experienced with this, but years ago we used to add honeypot email addresses to our databases for a super simple & cheap way to at least get an idea of whether data had been exfiltrated. If you add a new email once a month you can get some 'timing' info, and then could start comparing against logs.

<comment><USER20> that's actually pretty clever!

</comment></comment></comment><comment><USER21> "The email said that company said the breach was discovered weeks after system upgrades in July."

Wow. They emailed customers but made no public announcement that people's email addresses and personal info had been stolen and now available on the black market.

This is absolutely atrocious incident management and disclosure. I smell a lawsuit, possibly from the state or federal government.

</comment><comment><USER22> If you want to do something about this (and other) negligible organizations, head over to [https://opt-out.eu](https://opt-out.eu), search for Apollo, and the site will generate a GDPR erasure request that you can send. Disclaimer: I'm one of the site's creators.

<comment><USER23> Thank you, that was useful.

</comment></comment><comment><USER24> > Apollo's database contains publicly available data, including names, job > titles, employers, social media handles, phone numbers and email addresses. > It doesn't include Social Security numbers, financial data or email > addresses and passwords, Apollo said.

So I guess email addresses are a nullable field?

<comment><USER25> My theory is (I work in this space): \- Contact database was stolen \- User database with emails+passwords was not

Basically it's about the emails that they were scraping / guessing, not their users' emails.

</comment></comment><comment><USER26> I have just read an article that might be useful for everyone who has received multiple calls from legit businesses at [http://www.whycall.me/news/my-4500-payday-from-a- telemarkete...](http://www.whycall.me/news/my-4500-payday-from-a- telemarketer/). It's quite difficult, but I think if we could win against those telemarketers, it will feel really good.

</comment><comment><USER27> I am curious how the database was stolen. Did the person(s) who accessed the db delete the database afterwards or did they simply make a copy?

<comment> munk-a Ideally yes? It'd be nice to know the people who were so irresponsible with PII data ended up losing it...

</comment></comment><comment><USER28> Isn't that data freely available already on their website ? It looks like you can get full name, company, position just by creating a free account. Maybe they just scrapped it.

</comment><comment><USER29> How? I want to know so I can try to avoid doing something similar.

</comment><comment><USER30> How much does data like this trade for on the black market, and do vendors tend to partition it or just pursue quick turnover?</comment>


Andy Hertzfeld on the Demise of the Mac Pro  - <AUTHOR> https://plus.google.com/u/0/117840649766034848455/posts/StKLcccP4ny <comment><USER2> Supposedly Tim Cook has said that updates for "pro customers" are coming next year.

[http://www.macrumors.com/2012/06/11/david-pogue-new-imacs- an...](http://www.macrumors.com/2012/06/11/david-pogue-new-imacs-and-mac-pros- coming-probably-in-2013/)

"Our pro customers are really important to us...don't worry as we're working on something really great for later next year." - Tim Cook

<comment><USER3> That's what Apple was promising for years before the FCP update and look how that turned out.

<comment><USER4> I thought most of the FCX grouses had been responded to.

<comment><USER5> Some points, yes. Unfortunately, at least for my they have stated that they won't be bringing back the features that kill it for me (tape support.)

<comment><USER6> Tape's probably still used for a lot of work and will for some time, but it will be like bringing back the floppy disk:

[http://collider.com/film-camera-production-ended-arri- panavi...](http://collider.com/film-camera-production-ended-arri-panavision- aaton/120103/)

[http://arstechnica.com/gadgets/2012/06/the-silver-screen- no-...](http://arstechnica.com/gadgets/2012/06/the-silver-screen-no-more- distribution-of-film-to-cease-by-2013-in-the-us/)

</comment></comment></comment></comment></comment><comment><USER7> I read that Intel is no longer manufacturing the CPUs the Mac Pro used, so Apple had to do an unscheduled upgrade, which would explain this horrible spec-bump.

</comment><comment><USER8> You guys are totally missing the point. Although I'm typing this on a new Chromebook that does an amazing job at serving me the web I still need to run Pro Tools, which really does require a lot of hardware once projects become complex enough. Although a huge percentage of what we currently do with computers can effectively be accomplished on top of rather modest hardware, what is left is of critical importance: video/audio production, computationally intensive research, etc.

It can be argued that one could just do those things on Windows / Linux instead, but that is a pretty poor solution for anyone who is already used to Mac OS X or who owns other Apple hardware such as their Thunderbolt display.

<comment><USER9> I think the support status of OS X hardware (and software) is reason enough to switch to Windows or Linux for anything computationally intensive. They seem to throw it away at a whim.

Dells Precision machines are cheap, last a LONG time and always bang up to date. Never will you worry about being left behind.

Windows 7 is supported until 2020! Linux is supported until whenever you want it to be (you have the source).

Being used to something doesn't really cut it if you ask me.

</comment></comment><comment><USER10> Apparently someone has had a reply to an email sent to Tim Cook promising a bigger upgrade to the Mac Pros next year.

[http://www.macrumors.com/2012/06/11/david-pogue-new-imacs- an...](http://www.macrumors.com/2012/06/11/david-pogue-new-imacs-and-mac-pros- coming-probably-in-2013/)

</comment><comment><USER11> I posted this in the other thread, and I've been thinking about it more overnight.

Yes, this was a pretty "lame" update.

At this point, there are two things Apple could be doing:

1\. The Mac Pro is EOL. Dead. Gone.

2\. The Mac Pro is alive and well, and they're working on a new model.

Now, if the truth is option #1, why would they release this "lame" update now? There is no reason to. When they wanted to kill the xServe, they just killed it. Done.

I think the more likely scenario is option #2, but for whatever reason, they have not been able to build an Ivy Bridge/USB 3/Thunderbolt beast to their liking yet. At D10, Tim Cook clearly said they don't build things to "arbitrary schedules, or price points... they just build the best products they can". So a few months ago when it became clear the "new" Mac Pro was not going to be ready any time soon, they green-lighted this "lame" bump, to hold over until the new beast is actually ready.

I think this "lame" update shows a heartbeat for the Mac Pro, as a hold-over until something newer is actually ready to go prime-time.

(The difficulty I always think of is will the Thunderbolt port(s) be on the gfx card, or the motherboard? Hmmm)

<comment><USER12> I bet they're tired of the shape and are trying to figure out how to do something different.

Ideally they'd come up with something that could somehow work better in either rack mount or desktop usage.

</comment></comment><comment><USER13> Software keeps getting more nimble. Storage is moving to the cloud. There's really nothing super surprising about this move. No one had heard of thunderbolt a year ago and now all of the sudden it's a necessity?

The large majority of consumers will probably be impressed by the next gen Mac. That is the direction the entire line will be heading in and Apple clearly wants to make the differentiation clear, instead of marginally different and making people indifferent between the NGMBP and MBP.

These are not just creative decisions, they're marketing decisions, and so far Schiller hasn't done much wrong.

<comment><USER14> It's notable because creative professionals were once a very important market for Macs, and yet now Apple isn't even pretending to care about them.

And creative professionals always could use more power. Even a current top of the line PC isn't enough.

Updating a Mac Pro from Westmere to Sandy Bridge E is absolutely trivial compared to creating the next MacBook Air. You can even do it at home with a Hackintosh - they are almost entirely commodity PCs in the same old boxes they've been in for years.

And yet it hasn't been done.

<comment><USER13> Wouldn't creative professionals, at least those working in design and video, be pleased with the Retina display? Where else are they going to find a display of this caliber to work with?

<comment><USER5> Yes, but it's on a 15" screen. I haven't had a 15" screen on my desktop since 1994. Resolution is important, but for many tasks, so is size. The new MBP has a 2880x1800 screen, the old Apple 20" display had a 2560x1600 screen. So, while the MBP has a few more pixels, it's not that many more pixels.

Having seen neither, I can's speak to quality issues on the two screens.

</comment></comment></comment></comment><comment><USER15> I hope this doesn't mean Apple are moving away from people in the creative industries. They'v gotten good at making stuff for grandmothers, five year olds, yuppies and programmers etc. etc. That's really impressive and they did a great job.

But I think their roots in the creative industries were always one of the contributing factors to the quality of their stuff. The idea that a mac is _for_ doing things like video editing and music production is IMO a proxy for making it good at other things too.

<comment><USER16> Who is to say that the domain of people in creative industries are restricted to users of Mac Pros.

Creativity is not bound by hardware.

<comment><USER15> Nobody. Creative people use all sorts of things.

As a product though the Mac pro targets (not exclusively or exhaustingly) a section of creative professionals: designers, music industry people, video editors. The design choices & margins produce a price that basically targets a 'need what they need regardless of price' segment. They've been doing so for a long time. In the Apple dark ages these people were a big chunk of mac users. You can still see the vestiges of this heritage in modern macs, eg iLife: Consumer versions of what their professional (in that space) users use.

</comment></comment></comment><comment><USER12> Seems like there are a few different, not-necessarily overlapping use cases for Mac Pros.

There's the people who need lots of CPU. There's the people who need lots of RAM. There's people who want lots of fast disk. There's people who need to use specialized cards.

Trying to serve all at the same time dictates the shape of the machine. (For example, reduce space for cards, and you can make a 1U rack mount.)

Thunderbolt opens up the possibility of replacing the Mac Pro with something akin to a beefed up iMac or maybe a stretched shoebox-shape Mac Mini, with high-end CPUs, lots of RAM slots, and basic graphics and disk, with external Thunderbolt chassis available for disks or expansion cards.

If the main unit + disk chassis + card chassis cost the same as a similar Mac Pro, this would be a significant savings for those customers who only need the main unit and zero or one external chassis.

<comment><USER5> Unfortunately this is like a high end Commodore64: it starts simple but soon you have a rats nest of cables separate power for all the external devices. I want less cables not more. Also, I don't think thunderbolt cables can be screwed in, so you run the risk that a cable could get tugged and pulled out.

<comment><USER12> I'm thinking like an 8-drive chassis, and maybe 3- and 6- slot card cages, rather than lots of single-purpose external devices.

Rats nestery need not be too bad. Thunderbolt from the Mac to the drive chassis, then thunderbolt daisy-chained to the PCI card cage chassis. Power cords for the drive chassis and the PCI card cage chassis, if they can't be powered by thunderbolt. (Naturally, how ratty the PCI card cage gets would mostly be determined by what cards it contains and what are plugged into _it_.)

Not sure what the cable length limits are, but it might be possible to spread these out a fair distance, especially once optical-based Thunderbolt happens. Being able to put the PCI cards close to what they're connecting to, with just a single Thunderbolt cable running back to the computer, could be a cable management win, versus snaking multiple cables to a computer.

I'm sure someone could come up with a screw-in variant of Thunderbolt, but even so, I don't think Mac Pros have any screw-in connectors as it is, apart from the video cables screwing into the video card(s).

Thunderbolt PCIe expansion boxes are already in the works, such as this $979, 3-slot one: <http://www.magma.com/thunderbolt.asp>

</comment></comment></comment><comment><USER17> My issue with the lackluster update is that I purchase a computer to last me ~5 years. The last mac pro I purchased was the octocore mac pro. I use it to run Logic, Reason and associated plugins, and find I can comfortably run 24-48 track projects quite easily so I havent really felt a pinch to upgrade. I have 16GB ram and 4 TB of disk space in it, so I think it still exceeds what most desktop/laptops are capable of to this day. Back to the point, since I want my purchase to last, it better have the current state of the art on the day of purchase so that accessories and upgrades are easily added.

<comment><USER6> > _I use it to run Logic, Reason and associated plugins, and find I can > comfortably run 24-48 track projects quite easily so I havent really felt a > pinch to upgrade._

24-48 track projects? With slight "freeze" of some heavy reverbs and such, you could probably run those on a Dual Core MacBook Pro.

<comment><USER17> Absolutely, I have tons of headroom for more. However, just because I _can_ means I should :) Amplitube usually is the biggest CPU drain I use, and I dont really freeze tracks that often.

</comment></comment></comment><comment><USER18> If you want a high-end machine, buy a PC.

I had to buy a laptop recently and chose a PC because I could get 32G of RAM in a PC laptop. For my work, I need that much.

<comment><USER19> I want a high-end machine, and I want a Mac. Please stop telling people how to spend, or how they should want to spend their money.

The Mac Pro is still a powerful machine. We just didn't get what we hoped for.

<comment><USER18> Apple's the one that has strong ideas about how you should spend your money. PC makers listen and deliver a diversity of products.

Now, I'll grant that Apple products have advantages in terms of stability because there is less finger pointing when things go wrong -- you could get a mac laptop that sleeps correctly about 3-4 years before windows laptops got it right.

I don't see any real U.I. advantage on the Mac; if you try to put your photos in a movie, for instance, the Mac will drive you absolutely up the wall because it wants to make you look like a Shmuck who can't turn off the Ken Burns effect.

</comment></comment></comment><comment><USER20> This is an honest question, not a criticism, to the people who are disappointed with the Mac Pro offering: is a two-processor, 12 core machine at 3 GHz with 64 GB of RAM and 4 storage bays (up to 1 TB HDD, up to 512 GB SSD per bay) not enough workstation for you? If not, what do you use your workstation for, and what are your needs?

I ask because that seems like a hefty machine to me. The max specs on the Mac Pro are almost as much as the development nodes in the cluster I have access to, and those nodes host about 10 developers per node.

<comment><USER8> Thunderbolt is the #1 thing. Apple's own $1000 display is not supported by its high end desktop computer, which is just absurd.

<comment><USER12> They still sell their other $1000 display, the display port version, which is supported by the Mac Pros that they are selling.

<comment><USER8> True, but Thunderbolt is the newer technology. I recognize there might be some bias going on here, but the truth is that buying a display port display right now feels a bit like buying a S-VGA CRT to me.

<comment><USER12> I just recently bought the Display Port model. I just couldn't justify the additional expense of upgrading my MacBook to a Thunderbolt-supporting model.

It wouldn't be as bad, if it could easily be daisy-chained off a Thunderbolt monitor.

Unfortunately it appears that you need another Thunderbolt device after a Thunderbolt monitor, before you can connect a display port monitor.

(ie, Thunderbolt Display -> Thunderbolt Hub -> DisplayPort Cinema Display)

</comment></comment></comment></comment></comment><comment><USER21> As someone who hasn't been following the news in these last few days, I got very depressed after reading this headline - which of course (silly me) turned out to be complete and utter sensationalistic bullshit.

I agree the silent almost-not upgrade is not a good sign, but it may simply be due to the release schedule of Intel's server chip. Anyway, the Mac Pro still exists and it's still a good machine. By these standards I have an ancient 2008 Mac Pro and it's absolutely good enough for anything I can throw at it.

<comment><USER22> It was true that the Mac Pro didn't receive any updates in the prior two years because there simply wasn't a new Intel chipset to update to...

But Intel's Sandy Bridge Xeon chipset and new E5 processors have now been put for a few months, with Dell's Precisions and other workstations now using them.

<comment><USER21> Maybe there is a bigger update in the works and Sandy Bridge wasn't worth the investment, so Apple is holding out for the next step. I don't know Intel's roadmap. But I do know Apple has no problems throwing out products it deems superfluous, so I've been worried about the Mac Pro's future for quite a while. As a multi-screen kind of guy, I will definitely leave the platform once the only upgrade path left is the iMac.

The headline wrongly suggests that the Mac Pro was canceled. It wasn't.

<comment><USER23> "As a multi-screen kind of guy, I will definitely leave the platform once the only upgrade path left is the iMac."

You can connect two external screens to an iMac, making a total of three screens.

[http://gigaom.com/apple/new-27-inch-imac-supports-dual- exter...](http://gigaom.com/apple/new-27-inch-imac-supports-dual-external- display-output/)

<comment><USER21> I want my display and my computer separate. I want to connect non-Apple displays. Sometimes I want more than three screens. I want to be able to upgrade my graphics card, which I have done on my Pro 2 times. I'd love to be able to chain an arbitrary number of Thunderbolt displays together trading refresh rate for real estate but that's just not how it works, in fact it will probably never work this way.

<comment><USER12> Buy a 3-slot Thunderbolt PCIe expansion chassis, fill it with top-end Mac- compatible video cards, and connect it to a Mac Mini via Thunderbolt.

I think you can daisy-chain six of these Thunderbolt-PCIe boxes, which would give you, what 36 monitors?

And not thunderbolt monitors, they'd be whatever the gfx cards you use support, so probably DVI or HDMI or DisplayPort.

<comment><USER21> It's a good idea but the Mini isn't really in the same category as far as processing power and memory capacity go. And this extension chassis is ridiculously expensive for no reason. Still, it's a good alternative if/when the Pro goes out.

<comment><USER12> Yes, as I note elsewhere, what might be nice would be a "MacMini Pro", with appropriate CPUs, RAM slots, reasonable default graphics, and a couple hard drive/SSD slots, in a sleek, compact box with adequate power supply and cooling.

I'm sure Apple could produce extension chassis at a lower price point than 3rd parties, if they wanted to, but I doubt they want to get into that business.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER24> When people suggest Apple has an evil plan to impose the walled garden on our laptops and desktops, and turn all of our computers into appliances, I roll my eyes. But their neglect of the Mac Pro lends those arguments at least a little bit of credence.

On the other hand, despite Apple's huge cash reserves, I'm sure their human capital resources are limited. With iPhones, iPads, and MacBooks as wildly successful as they are (and for good reason, IMO), it would be really, really stupid not to allocate most of their resources to these products, and push for the major updates there.

</comment><comment><USER25> I think we did not see new Mac Pros and new iMacs because Apple wants to update them to use a retina display as well. I think it's more likely that Apple expects the displays to be available soon than that Apple doesn't care about these lines anymore. If Apple wants to update the big screens, it will need to update the iMac and the Thunderbolt displays at the same time. Since the MacPro should be able to use the Thunderbolt retina display, it probably should be updated at the same time. I might be wrong that it's the screens they are waiting for, maybe it's the graphics cards, but I am sure all those product lines will be updated at the same time and they all will get Retina and probably within the next 6 months.

</comment><comment><USER26> Looks like the Mac Pro is alive indeed.

[http://www.macworld.com/article/1167247/cook_apple_planning_...](http://www.macworld.com/article/1167247/cook_apple_planning_professional_mac_for_2013.html)

Quoting email from Tim Cook:

Franz,

Thanks for your email. Our Pro customers like you are really important to us. Although we didn't have a chance to talk about a new Mac Pro at today's event, don't worry as we're working on something really great for later next year. We also updated the current model today.

We've been continuing to update Final Cut Pro X with revolutionary pro features like industry leading multi-cam support and we just updated Aperture with incredible new image adjustment features.

We also announced a MacBook Pro with a Retina Display that is a great solution for many pros.

Tim

</comment><comment><USER27> I wonder what Apple uses for development internally - I suppose they have clusters for fast compilation. Sucks if you are an external developer who needs to build large codebases, if this Mac Pro is the best you can buy.

</comment><comment><USER28> At this point, I wish Intel had a non-Xeon multi-socket capable chip. The Xeon is serving two masters (enterprise server and pro workstation) and does a really poor job of it.

Its a shame Apple will not release a non-Xeon Mac Pro.

</comment><comment><USER29> I think you mean "Mac Pro".

<comment><AUTHOR> I fixed it. See how pervasive Apple marketing is? ;-)

</comment></comment><comment><USER30> Jesus christ, this sense of entitlement is fucking nuts.

Do you have a computer? Can it access the web? Is it less than 5 years old? Congratulations, you have a pretty amazing computer that should be able to do most things pretty reasonably.

I mean Jesus, some people make it seem like it's a personal attack when corporations don't pander to all.

<comment><USER31> Andy Hertzfeld's opinion is relevant because he was one of the key people behind the original Macintosh released in 1984.

<comment><USER32> For some background: [http://folklore.org/ProjectView.py?project=Macintosh&cha...](http://folklore.org/ProjectView.py?project=Macintosh&characters=Andy%20Hertzfeld&detail=medium)</comment></comment></comment>


The Most Expensive One-Byte Mistake (2011) - <AUTHOR> https://queue.acm.org/detail.cfm?id=2010365 <comment><USER2> Not the worst paper, but I had to get to the bottom before the author regains partial sanity. Of course we shouldn't really blame K&R(&K) for the _mistake_ right? (a little backhanded argument, IMHO).

Except, um, it wasn't a mistake. It was an on-purpose. They were fully aware of the pros and cons of the approach they picked, and the long term success of their systems is testament to them balancing those trades, and a hundred others, very effectively.

The author even goes on to explain he had no information about why they choose that option. Which undercuts the whole argument. Still, a sensational headline though!

Furthermore null-terminated strings are not the _cause_ of any particular problem. They work fine. They are merely a contributing factor to the bugs. The enable a certain class of common bugs, but do not cause them.

I'll tell you another not-a-mistake they made. Making things like string handling part of the library, written in the high(ish)-level language, not part of the compiler and language itself. You are completely free to use whatever kind of strings you want, if they are better. Like [http://bstring.sourceforge.net](http://bstring.sourceforge.net). Which I have never done - why? because C-strings work just fine for what I need. But the library is just a toolbox and C-strings are one of those tools.

It is a poor workman indeed who blames his tools.</comment>


Kanren – Logic Programming in Python - <AUTHOR> https://github.com/logpy/logpy <comment><USER2> I am currently using PyKnow ([https://github.com/buguroo/pyknow/](https://github.com/buguroo/pyknow/)) as a rules engine for dialog management (to drive topic stack frame selection). It's just a prototype so far and I have barely scratched the surface of expert systems, GOFAI and logic programming in general.

It is based on CLIPS [1] which is a knowledge-oriented expert systems thing developed at NASA. It allows encoding logic as "gates" that solve for constraints with left-hand-side facts triggering right-hand-side consequences. I like to tell the business people it's like "IFTTT for X".

Can someone with experience contrast this kind of thing with real logic programming? Is it just the level of formality and provability? Are there many logics like we have in philosophy (symbolic, predicate etc.) that are used in programming?

[1] [http://clipsrules.sourceforge.net/documentation/v640/ug.pdf](http://clipsrules.sourceforge.net/documentation/v640/ug.pdf)

</comment><comment><USER3> When viewing HN in Firefox Mobile on Android, this submission's title has a square with "OBJ" in it after the word Kanren.

Is that intended? It doesn't look like the "your device lacks this Unicode character" glyph.

<comment><USER4> Does it look like this: [https://en.wiktionary.org/wiki/%EF%BF%BC](https://en.wiktionary.org/wiki/%EF%BF%BC)

<comment><USER3> Yup

<comment><USER4> Looking at the source, it seems to be part of the title. Chrome (and Chromium based browsers don't appear to display it.

It was probably just a bad copy paste. I have seen invisible characters used intentionally as markers or invisible water marks but I doubt that's happening here.

<comment><USER3> Looking at the link, wondering if perhaps the Travis CI logo got pulled into the title?

Either way, thanks!

</comment></comment></comment></comment></comment><comment><USER5> Is there any utility in logic programming like this?

I'm not trolling, I really don't know. All examples I've seen so far seem to be easier to achieve from "normal" Python or similar...

<comment><USER6> I've recently completed my PhD in the automated design/generation of constrained ship hull form geometry. This is a method that originated in the 90s for generating the basic geometry of a ship from "scratch" \- well actually from lists of "form parameters" which are really constraints. The method uses nonlinear programming to solve for B-splines (other representations could be used) which minimize some functional and satisfy constraints.

Ship hull shapes can get pretty complicated. Now the trick is to specify, ahead of time, constraints which are consistent with each other, so that, in the first place, the nonlinear solvers don't waste time on bad designs, and really, we'd like to be able to search the design space without such waste.

The way I found to address this issue was to view the design space as interval valued. (By the way the design space is usually viewed as the space of all possible combinations of real valued constraints). With intervals we could reason about the design space using our constraints, but we need some kind of solver to narrow down the answers. There is an enormous amount of interval and constraint solving literature here, of course.

First, being from a numerics background, I tried working only with the intervals themselves. Nonlinear interval solvers for constraint systems. Long story short, the global methods need local help to make progress when the domain contains singular points and other places where the numerics are not so nice, in real or floating point. Local methods are really simple - just invert a single constraint at a time, in the simplest case. The issue here is that you need to solve for each constraint variable in terms of all the others. This is relational constraint programming and is something that Will Byrd has stated that miniKanren is good for. (Will is co-author of miniKanren, and a really nice guy)

Now, the second trick is that we want to compose with any random constraint that the ship designer dreams up (within reason, and my personal time constraints ;). So I hacked out an interval valued version of "miniKanren" which lived within Python. (think reverse mode automatic differentiation facilitated by operator overloading to embed the math operations directly into numpy. Take that programming idea, and change it to compose a computational graph of constraints, instead of differentiation.)

In short, it worked as well as I'd hoped. The relational logic front end can "quickly enough" narrow the design space as new rules come in, and then even a random number generator can select feasible designs. (Hint hint, time to add more efficient design space learners.)

It's a long story, shortly told, but I'd claim there are applications in the engineering space.

<comment><USER7> This is great. Is any of it available? I've spent a lot of my winter break working on fitting splines to my hand-drawn chines and then make developable surfaces out of them for stitch and glue kayak building. I'm still in the hacky Jupyter notebook phase of the project but I'd love to see what you've produced.

<comment><USER6> Thanks a lot! It would be cool to have some of it get used! I've been trying to get all of it online. Right now there is not really anything coherent ready to put up yet - a smattering of Jupyter demos using/explaining aspects of the code. this keeps getting triaged for another day, and yet I keep seeing bezier and B-spline stuff get popular on here.

It's a huge swath of messy python with the first stuff dating back to 2012. I used Piegl and Tiller's book C++ converted to python for the underlying B-spline stuff. (needed to implement anyway in order to compute constraints and objectives for custom auto-diff solver...) Then convert the spline control points into an overloaded automatic differentiation type for use in construction of the basic curve solver. That we at least have documented publicly in the journal of CAGD here: [https://www.sciencedirect.com/science/article/abs/pii/S01678...](https://www.sciencedirect.com/science/article/abs/pii/S0167839617301474)

The stuff above made it easy to be really flexible about what constraints are used in any given curve. (Or surface, but I did not go there for direct optimization.)

Next comes... all the interval arithmetic and relational constraint logic to pare down the design space to only the feasible domain on the front end. It's going to take a while to clean up the code and tell the story better.

The trick for kayaks is that my professor had me focus on industrial applications. -Designing offshore supply vessels, that sort of thing. I could work with you to try and re-tool a bit to see what we could get. I can't make promises though! I am swamped with a new baby and various other job related things at the moment.

Nevertheless it should be pretty easy to get started, since a kayak is a sort of generalized canoe, which is the first hull form anybody generates. The outstanding issue is that I've not yet worked on developable constraints! (Actually I've been tooling up to bring some discrete differential geometry to bare on this) The issue here is that nonlinear B-spline surface optimization direct is expensive. See, e.g. [https://www.cs.cmu.edu/~kmcrane/](https://www.cs.cmu.edu/~kmcrane/) Developable triangle meshes and other such papers. Cool stuff. Of course the shape representation is different. There are the old directrix techniques as well.

</comment></comment></comment></comment><comment><USER8> These kind of Prolog-like systems are actually not very hard to make using Python generators. I think it's a nice exercise to really understand the intricacies of Prolog! My own try is here: [https://github.com/evertheylen/logicpy](https://github.com/evertheylen/logicpy) (not as extensive as kanren though)..

</comment><comment><USER9> similarly, pydatalog [https://sites.google.com/site/pydatalog/](https://sites.google.com/site/pydatalog/)

found on this 5yo thread [https://www.reddit.com/r/Python/comments/18y1mj/logpy_logic_...](https://www.reddit.com/r/Python/comments/18y1mj/logpy_logic_programming_in_python/)

</comment><comment><USER10> There is already Problog with probability and logic. Could somebody help me understand benefits of Kanren?

<comment><USER11> I think you maybe need to know quite a lot about both in order to have a good answer. If you want to learn a bit, the reasoned schemer is the best jumping off point imo.

This is maybe the best internet answer, by the author:

[https://stackoverflow.com/questions/28467011/what-are-the- ma...](https://stackoverflow.com/questions/28467011/what-are-the-main- technical-differences-between-prolog-and-minikanren-with- resp/28556223#28556223)

</comment></comment><comment><USER12> Kanren is Japanese and means connection or relation. 関連

The "kan" is not the same kan as in Kanban. 看板

Why the Japanese name?

<comment><USER13> I don't see it mentioned in the readme that the name is from Japanese, maybe it isn't?

<comment><USER14> From the readme, this is based on miniKanren, so the name is a reference to that language. miniKanren itself has a Wikipedia page that also mentions the Japanese etymology of the name.

Logic languages like Prolog are usually based on relations (or "constraints"), which is likely where the name ultimately came from. As for why Japanese, I don't think there's going to be a particularly good answer to that question.

<comment><USER15> probably just because it's fun to use foreign words as the name of things since you can have something sound like a name and not just a word but have a direct meaning or represent a concept.

also, weren't (maybe it should be "aren't") the japanese heavy users of prolog?

<comment><USER14> > it's fun to use foreign words as the name of things

Oh definitely! I wrote a FAT16 stack for an embedded system and called it "FutoiFS" (ha, ha) [1]. I think whimsy is a _perfectly_ good reason. It sounded like the OP wanted a reason for choosing Japanese specifically, though, and I don't think such exists.

[1] Definition of "futoi": [https://jisho.org/word/%E5%A4%AA%E3%81%84](https://jisho.org/word/%E5%A4%AA%E3%81%84)</comment></comment></comment></comment></comment>


Effectively using AWS Reserved Instances - <AUTHOR> https://stripe.com/blog/aws-reserved-instances <comment><USER5> Despite being a strong advocate for AWS, this is where I will say Google completely outshines Amazon.

Google's approach to pricing is, "do it as efficiently and quickly as possible, and we'll make sure that's the cheapest option".

AWS's approach is more, "help us do capacity planning and we'll let you get a price break for it.".

Google applies bulk discounts after the fact, AWS makes you ask for them ahead of time.

<comment><USER6> Using GCC still feels like comparing an early android to a modern iOS. I guess they have to sell it cheap when the features and quality is not there.

<comment><USER7> Whatever GCP has is rock-solid and often superior to AWS.

For example: when AWS encounters non-catastrophic issues with their hypervisor, you are on the hook for moving the instances away (meaning stop- start, or termination and relaunch for instance store). Depending on the instance type, this can cause service disruption.

GCP will transparently migrate the VM _while it is running_ for you. You never see it, you customers don't either.

Same for networking: if you use their "premium" network, you can have anycast IPs to the closest POP, which will route traffic on Google's Network, not the open internet. AWS does not have anything close to this, the closest is multi- region VPC peering, without the fancy routing.

AWS offers more features though, which could be important if you require them.

<comment><USER8> > _GCP will transparently migrate the VM while it is running for you. You > never see it, you customers don 't either._

This is just hot-migration between hosts. It "stuns" a VM for a fraction of a second - very high performance databases and videogame servers will sometimes notice, while everything else just sees a spot of lag and keeps going.

AWS are an odd cloud vendor who don't support many common cloud features:

\- No hot migrate between hosts.

\- No hot-add RAM or CPU.

\- No memory-state snapshot, only disk snapshot.

\- No arbitrary CPU or RAM quantities, only "t-shirt" sizes - can't build servers in "nonsensical" configurations like 12 CPUs and 1GB RAM, or 1 CPU and 128 GB RAM.

This is on top of having arbitrary separators in their data centers, so they send you strange messages about having to delete and rebuild your servers in the same data center. AWS may think it's cute to sell different "areas" in their data center, but the way to have redundancy for servers in AWS us-east-1 is to have servers Azure US West 2 or GCP us-central-1.

Like early iOS in the smartphone space, AWS are dominant in the VM space through marketing, not features.

<comment><USER9> >AWS may think it's cute to sell different "areas" in their data center

[https://aws.amazon.com/about-aws/global- infrastructure/](https://aws.amazon.com/about-aws/global-infrastructure/)

From re:invent presentations, we know that even availability zones might be made up of multiple datacenters. In 2014, James Hamilton's presentation said that one of the AZs in us-east-1 had 6 separate datacenters.

I don't think it's really accurate to say AWS is selling us different 'areas of a datacenter' when we know that AZs are not only not sharing a datacenter, but might be multiple datacenters themselves.

<comment><USER8> From a certain point of view, it's Amazon using different terminology - <USER2> others call a data center, they call an AZ...or even a subset of an AZ, and we'll never know exactly - nor the capacity of each[0]. And what they call a data center, others call a region.

[0] When a server class is "sold out" in a region, you can't start your server - but there's no indication of this anywhere until you try to start your server. Other cloud providers auto-rebalance VMs to make space - using AWS is sometimes more like using physical servers than VMs - maybe moreso with paravirtualization.

<comment><USER9> I'm really confused as to what you're trying to say.

AWS has been very open over the years about what their terminology means. When they say datacenter, they mean it in the traditional sense of the word. When they say an AZ is made up of at least one but sometimes multiple datacenters, they mean that that an AZ has multiple physical datacenters. They're not slicing up a server room and calling these multiple datacenters.

We also know that AZs are physically separated from each other.

So an AWS region has at least as many physical datacenters as it has AZs, and potentially quite a few more.

James Hamilton has talked pretty extensively about this stuff at re:invent, and as an AWS customer, his talks have been some of the most interesting to me.

Other people calling a datacenter a region doesn't suddenly reduce an AWS region down to a datacenter. A datacenter is a word with a pretty specific definition, and an AWS region does not fit that definition.

<comment><USER8> The confusion is entirely mine. Your clarity is appreciated.

<comment><USER9> You're welcome!

My apologies if I came across as combative.

</comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER10> Google Cloud's pricing approach seems much more sane than each company having to spend all this effort juggling reserved instances.

<comment><USER11> It's not so much sane, as possibly a little more friendly to those who can't - or don't want to do capacity planning.

Visibility in terms of outcomes means savings, or rather, variability means cost.

Ultimately, you're going to bear the cost if you cannot provide visibility because Google is not likely ever going to do it as well as you can for your own business.

Ultimately, if you knew exactly what you needed over the next few years, the cost would be significantly cheaper as there's no need to have slack or wasted capacity. Google effectively forgoes this option entirely and assumes at least some minimum volatility, which means more cost.

I think it would be nice to have Google's offer, but then also a longer term 'lock in' low price option as well, as frankly, this fits a lot of businesses. Most of the economy is not as dynamic as Valley startups.

<comment><USER12> Disclosure: I work for Google Cloud.

> I think it would be nice to have Google's offer, but then also a longer term > 'lock in' low price option as well, as frankly, this fits a lot of > businesses.

We hear you. That's why we offer Committed Use Discounts [1]. Are you saying that a 3-year commitment to a specific price (or lower, as we do price cuts) is insufficient though? (I want to understand)

[1] [https://cloud.google.com/compute/docs/instances/signing- up-c...](https://cloud.google.com/compute/docs/instances/signing-up-committed- use-discounts)

<comment><USER11> I'm only making a very general reference to the fact that long-term visibility and predictability entails lower cost and therefore lower price, and that business owners are likely more empowered to determine that outlook than the cloud provider, either AWS or Google. Ergo - some kind of customer oriented long term lock-in would likely, in the long run, produce the cheapest prices in the system. That's all.

<comment><USER12> Ahh, I misunderstood your point! Yes, it's certainly easier for us providers if you provide a clear demand signal. RIs, CUDs, SUDs, and even general contracting terms each provide some measure of information between customer and provider.

We actually had an interesting debate about this topic at the NSF Workshop on Cloud Economics [1]. The AWS person sadly had to cancel, but both some Google people and MSFT people were present along with CS and Economics academics. There are lots of industries where similar behavior exists, e.g., airlines or hotels. If you book in advance, or commit to a room block, you get a discount in exchange for certainty. We had lots of amusing debate about how similar cloud actually is to say energy markets (which turn out to be incredibly distorted, regulated, and confusing). Hopefully David and the rest of the organizers will have their summary report out within a few months.

[1] [https://umass-sustainablecomputinglab.github.io/nsfw/](https://umass- sustainablecomputinglab.github.io/nsfw/)

<comment><USER13> (as a ridiculous aside, apparently having 'NSFW' in a link can trigger overly aggressive web filters)

</comment></comment></comment></comment></comment></comment><comment><USER14> The notion that the break even point is 70% is ignoring some really important stuff.

If you reserve workload x on hardware y for n years, you're effectively strapping yourself into a sure-to-be-obsolete and more expensive platform which you'll have to then move off of at an arbitrary point n years in the future.

If you don't move, you wind up paying a premium to be stuck with the obsolete / more expensive platform just to avoid the cost of migration.

RIs are a lock in.

<comment><USER15> I wonder how this is better than buying hardware. Some of the same problems but more flexibility than RI.

<comment><USER16> It's not _unless_ you depend on a huge amount of other AWS services. Buying hardware and colocating - or even paying month to month to rent servers from a dedicated hosting provider will typically be much cheaper than reserved instances.

<comment><USER17> Which is likely the reason AWS bandwidth charges are so high. That's their lock-in factor that often makes it infeasible to use cheaper servers elsewhere as long as anything else is on AWS.

</comment></comment></comment></comment><comment><USER18> My experience with AWS reserved instances has not been very good previously.

1\. Once you buy a reserved instance, you're locked in to that type and price for the duration, even though newer types at lower prices may get introduced (as they almost definitely would over 1-3 yrs).

2\. If you're from outside the US, you might not be able to resell your reserved instance. So you're stuck with an old instance type at an inflated cost.

In contrast, Google Cloud just gives you a price equivalent to a reserved instance price (or better), based on hours of usage, without asking for an upfront commitment.

<comment><USER19> I've gotten proactive emails from our account manager when they release new/cheaper instances and they offer us the option to transition and get a credit for our existing RIs.

We aren't a huge account (less than 30k/month) so I thought this was a nice gesture on Amazon's part.

<comment><USER20> Our 15k/month account did not get such an email when they introduced the dc2 redshift class, despite most of our spend being on Redshift.

<comment><USER13> I'm consistently surprised at how big the variance in quality of service is from different AWS account managers; seemingly regardless of the size of account.

The 2/3 reps we've had have been night and day in the level of service they've given us, and we're a top 10% customer by volume.

</comment></comment></comment></comment><comment><USER21> The best answer is of course not to at all. Burst into the cloud, static workloads in your own DC.

<comment><USER22> This is terrible advice for all but the largest of organizations.

Running your own hardware is AWFUL. Get ready to dedicate an entire team to network engineering, fixing broken hard disks, patching operating systems, screwing around with RAID controllers, upgrading switches, planning power and cooling, and endless vendor negotiation -- with ISPs, hardware manufacturers, datacenter operators, etc.

Oh, and did I mention, throw elasticity out the window -- all of this has to be planned in advance, and purchased, and installed, months ahead of when it will be operable. So forget the ease and convenience of just spinning up more capacity.

Also, there's a massive distraction of having to focus management attention on this non-value-adding part of the business, all so that you can shave down some cost, rather than investing in growing revenue.

Having been in this position firsthand, don't do this. If netflix can run 1/3 of Internet traffic off of AWS, I guarantee they're much larger than you, and it should say something, that they'd rather outsource this part of their business than dealing with all this crap.

Focus on software and product/market fit. It's just a much, much, much better use of expensive technical people, that will be done on day 1, without any risk, hassle, or complexity, than trying to replicate something someone else already does for you, much better and at competitive costs, than trying to reinvent all of this yourself.

To be honest, I don't even want to deal with EC2 anymore; I'd rather just use a PaaS.

<comment><USER23> It's been a few years since doing the cost benefit analysis between AWS and self-hosting, but for around 50 racks worth of servers and storage, the numbers came in on AWS's side.

That didn't even take into account the "free" multi-region capability you get from Amazon. Splitting our physical servers into a second region with enough capacity to failover would have nearly doubled our costs.

<comment><USER24> Why would you compare AWS vs managing your own data center?

You could also compare AWS vs building your own silicon.

I think it would be better to compare AWS vs renting dedicated servers from a large provider? I think you will find that the scales tip heavily in favor of renting bare metal as far as price is concerned.

<comment><USER23> _Why would you compare AWS vs managing your own data center?_

Because we were already managing our own data center.

 _I think it would be better to compare AWS vs renting dedicated servers from a large provider? I think you will find that the scales tip heavily in favor of renting bare metal as far as price is concerned._

We offloaded a lot of work to Amazon that we were doing ourselves -- database hosting, storage system management, etc (lots of little used data went into S3/Glacier that previously we had on live disks)

Also, we liked the ability to have a failover region essentially for free - <USER3> only pay for enough servers to replicate the key data we need for failover, and keep the rest of the infrastructure powered off.

<comment><USER25> > storage system management

I was a bit incredulous that any truly all-inclusive analysis could ever show AWS being cheaper, but this phrasing made me realize that it could have been the one (remarkably common) case where it usually does: enterprise hardware.

That world is _easily_ more expensive than AWS, especially considering that hardware maintenance contracts are a thing (and a shockingly expensive one, to those of us accustomed to the commodity hardware world).

> Also, we liked the ability to have a failover region essentially for free - > we only pay for enough servers to replicate the key data we need for > failover, and keep the rest of the infrastructure powered off.

That's a useful advantage, though there's a pitfall in that there's no powering off EBS volumes.

</comment></comment></comment></comment></comment></comment><comment><USER26> One of the major issues we've seen with our customers is that many of them (especially startups and SMBs/SMEs) don't have the ability to dedicate a team to just managing their RI capacity. We've also seen enterprise customers optimizing up to 70% of their EC2 usage, but many of them have trouble ensuring a level of utilization due to rapidly changing infrastructure. I'd definitely argue that GCP has a better model for some use cases as it requires less active effort for optimizing billing, however if you manage your RIs on AWS effectively you can often get a better price. Looks like Azure has also gone down the same route as AWS, which is quite an interesting move on their part.

Disclosure: I head engineering/devOps at Engineer.ai - one of our products Cloudops.ai allows our customers to save up to 15% of their AWS bill without making RI purchases, as well as get discounted prices and additional flexibility (custom lock-in periods) for RIs they do wish to purchase. Feel free to reach out for information - my email address is in my about section.

<comment><USER27> Disclosure: I am a PM on Oracle Cloud Infrastructure (OCI).

I am aware that AWS and GCP are the go-to options for this audience, and that Oracle isn't particularly favored for the Java lawsuit (among other things). If you are able to set these grievances aside, the OCI pricing team has done something unique: they have created a means by which you can effectively buy credits from Oracle and use them for whatever service (current or future) you need. It is called the Universal Credits Model (UCM) [1].

If you anticipate usage above a certain threshold, tier-based discounts are available at the time of purchase. It's like a store gift card; buy whatever you want. This takes away some of the stress of capacity planning and instance-type selection. Additionally, you can adopt new services and avail lower prices in the future.

With UCM, customers:

1\. Sign one single contract that provides unlimited access to all current and future Oracle PaaS and IaaS services (Compute, DB, Block Storage, Blob Storage, Network, etc.) spanning both Oracle Cloud and Oracle Cloud at Customer. 2\. Gain on-demand access to all services plus the benefit of the lower cost of pre-paid services. Depending on the projected spend, customers can negotiate discounts. 3\. Possess the flexibility to upgrade, expand or move services _across datacenters_ based on their requirements. 4\. Have the freedom to switch PaaS or IaaS services they are using without having to notify Oracle. 5\. Can adopt new services when they GA.

Please send any questions my way, and I will get answers to you.

(1) [https://www.oracle.com/cloud/bring-your-own- license/faq/univ...](https://www.oracle.com/cloud/bring-your-own- license/faq/universal-credit-pricing.html)

</comment></comment><comment><USER28> My experience from Sumo Logic is to take full advantage of RIs you need to do capacity planning and that takes some effort. Still that's way over 30% of savings which are needed if you run at scale.

Would recommend using CloudHealth or other tool vs. using custom ETL. I tried do it myself on my tools, but got worse results than using dedicated tool.

However, dedicated tool need input from development. Sometimes it's worth to buy non-convertible RIs for bigger instance. Sometimes convertible RIs are easier. I just found that convertible RIs with some upfront are incredible tricky to calculate amortisation.

</comment><comment><USER29> > To automate this, we built an ETL process in SQL and Python that detects > when we fall outside this band and automatically prepares a purchase for us > to approve.

@Stripe: Will this (or parts of it) be open sourced?

<comment><USER30> They published the code in a gist. It doesn't have a license, but since the python code is only 61 lines, would be trivial to rewrite yourself from their example.

[https://gist.github.com/lopopolo- stripe/e00b4bfa0839c125ed7a...](https://gist.github.com/lopopolo- stripe/e00b4bfa0839c125ed7aeb205a58164c)

<comment><USER31> We've licensed the code with the MIT License.

</comment></comment></comment><comment><USER32> Tangential to the point of the article but when did writing a select query become an "ETL process"?

<comment><USER33> Suppose you have a data source and business logic which you want to run periodically on the data source. Here are two scenarios which you could reasonably implement this as:

Method one: You write a SQL query and some Python. You put a sticky note on your computer "Remember to run that biweekly."

Method two: You pull up your shop's documentation for how to add the (BIG_NUMBER)th entry into the data processing pipeline. This gets you automatic scheduling, retries, monitoring, audit trails, alerts to the right people in case of breakage, etc etc. You write a SQL query and some Python. You plug it into the existing infrastructure.

</comment></comment><comment><USER34> Similar idea to rolling your own, my company uses Cloudability for AWS purchase planning. It saved a bunch of money as far as I remember.

[https://www.cloudability.com/](https://www.cloudability.com/)

</comment><comment><USER6> I thought that payment processors are using their own hardware. How is AWS protecting their own customers' privacy? - can uncle Bob insert his fancy flash drive, copy my data, and sell it? Before you say it is encrypted - <USER4> does the encryption happen and doesn't AWS employees have access to the keys too?

<comment><USER35> AWS has different options for different companies/data. They even have options for US government data that are certified by DSS I believe, and they have options if you need PCI, HIPAA, and other types of compliance.

See: [https://aws.amazon.com/compliance/hipaa- compliance/](https://aws.amazon.com/compliance/hipaa-compliance/)

[https://aws.amazon.com/compliance/pci-dss- level-1-faqs/](https://aws.amazon.com/compliance/pci-dss-level-1-faqs/)

<comment><USER7> It's worth noting that none of this is available on 'AWS' China.</comment></comment></comment>


Big foreign cyber attack targets Italian certified email accounts - <AUTHOR> https://www.reuters.com/article/us-italy-cyber/big-foreign-cyber-attack-targets-italian-certified-email-accounts-idUSKCN1NO2I6 <comment><AUTHOR> Commentary from a hacker in the financial sector:

"[...] certified emails guarantee the validity of a sender's identity, as well as the date and time of sending and receiving the email, giving them a clear legal status. This is a major hack and very important for it undermines the legal status of government emails. The repercussions can be extremely significant. This calls into question ALL legal emails from the government regarding taxes." [1]

This is very bad. Non-repudiable emails from a government that has been in economic turmoil recently.

[1] [https://www.armstrongeconomics.com/world-news/technology- wor...](https://www.armstrongeconomics.com/world-news/technology-world- news/italys-certified-email-system-has-been-hacked/)</comment>


A Job Ad that is Ideal for a Budding Startup - <AUTHOR> http://mixpanel.com/jobs/

<comment><USER2> Why is this ad "ideal for a budding startup"? I'm sure mixpanel is a nice place to work, but there doesn't seem to be anything unique about this ad, so I'm not sure why it's being held up as a model to emulate.

<comment><AUTHOR> Simply, I hold it as a good example because I'm working on my own startup and the Ad does a good job of summarising what a software engineering role should be advertised as.

No false promises of using technology X or Y, and no over inflated expectations of the kind of knowledge expected from a candidate. A startup is all about learning and using the best tool for the right job with a hands on approach.

<comment><USER3> Except its missing an important part. Salary. Yes, I know you're thinking "but this is a startup and the opportunities and experiences are more important!". People still have bills to pay.

<comment><USER4> It's pretty unusual to see salary laid out in a job ad

<comment><USER5> Really? Usually a rough salary/opportunities segment is provided.

If a salary isn't provided my assumption is that it is negotiable.

</comment></comment></comment></comment></comment><comment><USER4> I like this ad a lot. It's not overblown and avoids obnoxious cliches (ninja, pirate, whatever). It's succinct, to the point and honest.</comment>


Five Charts Show U.K. Stocks Struggling a Year After Brexit Vote - <AUTHOR> https://www.bloomberg.com/news/articles/2017-06-23/five-charts-show-u-k-stocks-struggling-a-year-after-brexit-vote <comment><USER2> This is more interesting for casual investors than the headline would suggest, because it also has a little insight into _which_ UK stocks have been struggling and why.</comment>


How to Prepare for the Y Combinator Interview - <AUTHOR> https://tryzen99.com/blog_posts/prepare-y-combinator-interview <comment><USER2> Great post Tristan. Solid advice. I'd also add [http://ipaulgraham.herokuapp.com/](http://ipaulgraham.herokuapp.com/) in the list of resources on the bottom. It forces conciseness.

</comment><comment><USER3> We're alums (YC W12 and S09). We do mock interviews every batch. If you're interested, reach me at jason at 42floors.

<comment><USER4> Also happy to help here (S12). seth at amicushq

</comment></comment><comment><USER5> Good article.

I'd suggest that your strongest points are:

1\. "Traction trumps all." Demonstrable opportunity is the primary currency.

2\. "Be a nice person." Successful people don't like to work with assholes.

3\. "Prepare, and be brief." Anything that doesn't add significant value needs to come out of your pitch.

4\. "Don't be deterred by interruptions." These are opportunities. Think of these as buying questions. If they're asking you questions, they're telling you what you need to do to convince them to believe in you.

Good luck all in the next round or other endeavors!

</comment><comment><USER6> Nice, I think this is actually by far the best thing I've seen written on YC interviews.

<comment><AUTHOR> Appreciate the kind words!

</comment></comment><comment><USER7> > It's relatively easy to pick up on someone's personality in their > application.

From the written application that's supposed to be as terse as possible? I think I could get a feel for someone in person since I could dig into particular questions on the spot, but seems I'd have a real hard time judging meanness if I could only see the 1-way communication of the written YC application.

<comment><AUTHOR> Good point, I could have made that clearer. Wasn't meant to be specific to "meanness", more so just personality. This can obviously be complicated by things like language barriers/etc, so isn't a catch-all.

In general, the point was that humans usually make subconscious judgments before they even start talking to you; at the least, you should be aware of this.

</comment></comment><comment><USER8> Y Combinator sounds like such a great experience. Now if only I had a startup.

<comment><USER9> I used to think so too. But then again, is it advisable to start a startup just for Y Combinator?

</comment></comment><comment><USER10> I'm having trouble understanding how one would demonstrate traction at the idea stage.

Would it be a combination of 1) demonstrating past successes gaining traction and 2) having a catchy prototype? Or are there other things?

<comment><USER11> Have a list of 400,000 users waiting to buy your product [1].

1\. [https://getfinal.com/](https://getfinal.com/)

<comment><AUTHOR> +1...just make sure you ship before everyone forgets about you :). I've heard 10% conversion from signup list isn't unrealistic when products finally ship.

<comment><USER12> It's great to have a blog with some traffic where you can find interested future users. If you have enough traffic, you can keep the signup-to-invite time short so your conversion will be better.

Keep in mind that if the idea is novel and something people want, you'll get most of them converted no matter what if you initially promised that novel thing during the signup.</comment></comment></comment></comment>


"You're on UE4, why do you need an engine programmer?" - <AUTHOR> http://gamasutra.com/blogs/LeszekGodlewski/20150710/247996/quotYoure_on_UE4_why_do_you_need_an_engine_programmer

<comment><USER2> 'Engine' programmers are still indispensable.

While not directly related to the graphics pipeline, I'm very intrigued by all the physics grid and networking code that the teams working on Star Citizen are doing for their future title.</comment>


Github reviews as a way to improve code quality? - <AUTHOR> http://antirez.com/post/github-review-to-improve-code.html

<comment><USER3> _The test culture of Ruby helps a bit..._

Uh, right. Ruby folks have no idea how little of a test culture they have. Doesn't stop them from complimenting themselves though. What, you say, why do I say this about Ruby? Consider the following facts.

\- Ruby itself has fairly bad unit tests.

\- By default you don't run tests on gems when you install them.

\- Many gems that have tests, have tests that only make sense on the developer's machine and can't easily be run elsewhere.

\- There is no automated process for identifying which gems are doing a standard list of good things (have documentation, tests, clear license terms, properly identified dependencies...) and which are not.

\- There is no easy way for someone with a spare box and an interesting environment to contribute their machine to tracking down which gems fail their tests in your environment.

If you're a Ruby developer, you may be saying, "This sounds like a nice wish list, but look at everything we do..." Stop right there. Everything on this list, the Perl community has been doing for years. And Perl folks are doing all of the other good things that you were going to talk about.

In fact the state of the art of Ruby's "test culture" does not even match the test culture among good Perl developers during the last millenium. You don't believe me? The standard CPAN client has defaulted to actually running unit tests since Perl 5 was released in the mid-90s. And the core Perl test suite back then was much more comprehensive than Ruby's is now.

But there is good news. It is easier to copy someone else's working thing than it is to write your own in the first place. Perl got this working several years ago, and has had time to iron out the kinks. If you are interested, feel free to copy.

<comment><USER4> <http://test.rubygems.org> addresses all your concerns related to RubyGems, except that it's an opt-in thing — you must configure RubyGems to run tests upon gem installation, and the results are optionally uploaded for use by the gem author.

A pearl from Perl, of course.

<comment><USER3> That is nice.

It is too bad that it is opt-in. And it doesn't immediately fix the problem that some authors write tests for themselves only. But it is definitely a good step in the right direction.

</comment></comment></comment><comment><USER5> This doesn't sit well with me. We are talking about open source software! Let's assume I have some cool little gem I wrote that works well for me, but maybe not the ideal solution for everyone. However, there is enough utility in it that I want to push it up to github. Someone can take it and make it better, using my base as a start.

I believe the above scenario is common. But now I have to fear being reviewed on something that wasn't meant to be a complete work anyway? You don't like it...branch it and make it better! The community will win! People will end up using your version instead of mine if I don't pull the changes back in. Isn't that the way this is supposed to work?

Maybe I'm misunderstanding this post entirely. It's hard enough for a lot of us to post our work publicly - then to have it scrutinized and attached to my github profile seems unfavorable to me. You don't like my stuff - don't use it! Have I done something incorrectly? Email me and let me know! Github seems to be doing just fine w/o this feature and the good projects somehow rise to the top.

BTW - I'm not opposed to being critiqued on my code. I just don't know if a public rating system is the way to do it! And I do believe I would be more reluctant to release anything if I felt it could be rightly criticized for things I know it lacked. Make sense?

<comment><USER6> Maybe a simple:

      - tests [5 stars]
      - documentation [5 stars]
      - code quality [5 stars]
      - usefulness [5 stars]

And, rating could simply get enabled/disabled if you don't think it has value for a quicky hacky project.

But I get your point, I've got the real bad habit of not wanting to upload not finished stuff.. and since code is rarely finished, I tend to upload way less project than I should. A rating system might only get the matter worst.

</comment></comment><comment><USER7> There seems to be a curious lack of history here. I'm not a Perl programmer at all, but even I know that CPAN has had reviews and ratings and this sort of stuff for forever (in Internet terms).

It seems to me that this blog post could be replaced by a single line - <USER2> would be better, actually - if that line was 'GitHub, please do that review stuff however CPAN is and has been successfully doing it for years'.

Bonus points if he knew enough to explain how CPAN avoids all the obvious failure modes raised by commenters here.

</comment><comment><USER8> Instead of making it anonymous, it should just be tied to your github account.

Make it known who rated what project and for how much (and only once per project, obviously). Then the project owner can message those people to change their rating once they fix the documentation or whatever they go the bad rating for.

<comment><AUTHOR> Yes possibly this is the only possible alternative...

</comment></comment><comment><USER9> One solution to potential issues with this would be to limit the visibility of the reviews/ratings to just the project owner.

There's two main benefits to reviews/ratings:

1\. The project owner would get an assessment of his project

2\. Potential users/committers would know the "quality" of the project

Making the reviews/ratings private would eliminate #2, but it would also solve most potential spamming, gaming, and stale issues caused by making them public.

<comment><USER10> In this case you could also just as well promote the existing message feature that's already a part of Github. Promote conversations instead of a one-way "rate this" system.

</comment></comment><comment><USER11> _Honestly I saw testing as part of the problem from time to time, with the attitude "if it passes tests it can be merged". Testing is useful but not so powerful, unfortunately._

I get into this argument with my coworkers from time to time, and I have to say I disagree a million percent. Tests are the only way you can see if the software is going to work.

After you make a change, how do you make sure the software works? By trying it out? Congratulations! That's testing! Now you just need to invest some mental effort in teaching the computer how to do that test for you, and now you can _automatically_ achieve the same level of safety that you had before.

I'm all for code reviews _too_ , but code reviews do not scale the way that tests do.

<comment><USER12> Yep. Everything you said makes loads of sense. Seems provably true. But I'd be honestly curious how many people have noticed a correlation between a large unit-test suite and the quality of the software they use? I haven't. Of the projects whose source I've been exposed to it feels like I've dealt with as many bug-riddled projects that had lots of tests as I have solid projects that lacked them.

I think projects get off course... teams can develop a culture of 'having unit tests' instead of a culture of 'writing high quality software'. The way the TDD/XP camp talk about software bums me out. As if the test they decided (key word) to write set the software on some Manifest Destiny vector to perfection.

Again, I agree with you. Unit tests are awesome, and the benefit as scale is huge.. but I took antirez's comments as a shot across a different bow.

<comment><USER13> > _I think projects get off course... teams can develop a culture of 'having > unit tests' instead of a culture of 'writing high quality software'. The way > the TDD/XP camp talk about software bums me out. As if the test they decided > (key word) to write set the software on some Manifest Destiny vector to > perfection._

The tricky part is that anything can become a cargo cult rallying point. Mediocre programmers can drive anything into the ground. Even a seeming no- brainer like the Law of Demeter can be misapplied to create byzantine systems if someone knows how write code, but isn't very good at it. The situation is ten times worse with test code because it's meta—there's no objective measure of quality for test code. At least with application code it's obvious for any user whether it works or not, but with test code it's all about how much manual testing time was saved, or how much smoother refactorings went.

I've long been skeptical of the claim that TDD or whatever makes you write better code. The way I see it, TDD forces you to put in the time to learn how to write automated tests. Once you are good at it, tests help you move faster by covering regressions and documenting your intentions. In Ruby tests can give a nice sanity check that is built into strongly-typed compiled languages. I truly believe in TATFT, but at the end of the day tests are still meta, and you can't polish a turd.

<comment><USER12> Really well put, and I should start off by saying I really like TDD. A lot. (also.. for anyone like me who had to look it up.. TATFT = Test All The Fucking Time)

> _Mediocre programmers can drive anything into the ground_

Sure, totally. But the XP/TDD cult gives them easy to follow instructions for doing so. There's almost a lowest-common-denominator talent-smoothing mantra behind some of these cultures. I think plenty of projects, teams, and people don't end up finding their potential as developers because they're obsessed with a religion that favors obedience to a silly process over intelligent, clever, elegance.

Okay. At this point we're probably drifting steadily off topic :)

</comment></comment></comment></comment><comment><USER14> The big problem here is that once you address the issues you have to get a bunch of people to change their old reviews.

<comment><USER15> Why? Just let the project owner hit a button that says "This issue has been addressed" or "This issue is being worked on", adding an optional note, which marks the review accordingly somehow. Then you can look and see how proactive the project owner is in addressing his feedback.

<comment><USER16> 1,392 people rated my project as having 1 star for documentation. I've made documentation better. A few people have now rated it four stars while some still believe it's one star and don't see the point of changing their votes from one star to one star.

I think it's a great idea to show users what parts of a project are weak (it'd help them understand how they can help), but I have the same problem with reviews on Apple's app stores, Android Market, Amazon, etc...

Some of those are handled a bit by the complaints being about previous versions, but stuff on github isn't necessarily versioned.

<comment><USER15> I guess I am skeptical that a "star" rating could ever be meaningful for Github projects. Frankly, the whole thing seems like a bust regardless if you have a thousand reviews; what kind of meaningful information could you get from a thousand reviews all talking about different versions, different use cases, different kinds of "quality"?

However, for the majority of long tail projects that might have a couple pages worth of reviews, it would be useful feedback, and the project owner could address each review individually with ease.

</comment></comment></comment></comment><comment><USER17> I like this idea. I've often found projects that are useful or interesting, and clicking a "Follow" button doesn't seem like a fitting action. Ratings would let the community reward good developers and let the not-so-good developers know what they're doing wrong.

To give more "weight" to the system, GitHub users could have their average project ratings displayed on their profiles, and rankings / leaderboards could be generated. Users could receive badges, maybe: "Documenter of the Month — March 2011", etc.

</comment><comment><USER18> One-to-five rating systems have many problems--gaming, relevance decay, shifting the economic incentive to focus on getting the rating/karma up which may or may not have a correlation to creating value. The only star rating system that I've seen that's actually useful to a consumer is Amazon--but Amazon deals with finished, immutable works and products, not evolving, living software, where every single individual rating becomes stale with the next commit.

To address what antirez needs--an at-a-glance, summary assessment of the quality of the project--github could provide a standard rating of a number of dimensions. Project followers, recentness of commits, forks, merge history, code analytics, presence of tests, volume and activity on documentation, etc. This is still subject to gaming, but here's how you fix that: allow each github user to express their own values/constants for the various measures, and allow you to assess any project based on what that user values: "What would antirez say about a project with no documentation, lots of downstream forks, great testing coverage?" Now you've introduced a trust metric, correlating values of people you trust with projects you might be interested in.

Think OKCupid meets GitHub, with bulk rating of projects rather than potential mates.

</comment><comment><USER19> How about letting us 'un-watch' a project until a specified bug is resolved?

</comment><comment><USER16> I think this makes a lot of sense, but it'd be a bit complicated to do it well.

One thing I'd want is the for the older votes to carry less weight. For example, if one of my projects gets voted way down due to lack of documentation, I'd want a documentation effort to be able to counter those votes that may come from people who don't come back to adjust them.

</comment><comment><USER20> I wouldn't mind if there was a way for people to review my code. I might not need star ratings, but maybe a way for someone to make a case why doing something different or the same way would be a good idea. In terms of value I would see something more along the lines of something of more of a 'discussion'.

It's also interesting for people to be talking about testing on this thread. There might be some good points made but you might miss the point/concept that was posed in by the OP.

</comment><comment><USER21> I'd rather that Ohloh implemented something like this.

</comment><comment><USER22> related post: <http://news.ycombinator.com/item?id=2324934></comment>