A visualisation of all of the money in the world - <AUTHOR> http://money.visualcapitalist.com/all-of-the-worlds-money-and-markets-in-one-visualization/ <comment><USER2> The derivatives piece is totally wrong of course. Gross Notional is a completely meaningless number - it does not represent what value is owed or how much risk there is.

E.g GS could have 1tr of gross notional of derivatives with JP but with zero risk or monies owed if the positions all offset (as indeed in real life they do, banks run very little net exposure).

But of course newspapers and grotty rags like to perpetuate this narrative that derivatives are going to blow up the world.

<comment><USER3> Good, concise illustration from Reddit:

"If Powerball sells 1 million tickets at 2$ each, where the jackpot is worth 200,000,000$, is the size of that market 2M$ or 200 trillion $" [1]

[1] [https://www.reddit.com/r/Economics/comments/3xb2xh/all_of_th...](https://www.reddit.com/r/Economics/comments/3xb2xh/all_of_the_worlds_money_and_markets_in_one/cy3b623)

<comment><USER4> That's not a market at all. That's a $198,000,000 giveaway.

<comment><USER5> Well, not quite -- if odds of winning are in fact around 1 in 200MM or less, there is no market failure here.

Their point would still stand if they sold 100MM tickets though, so as not to confuse the two issues (ie. the notional amount and the expected value), perhaps it would have been a better example that way.

</comment></comment></comment></comment><comment><USER6> Fun mental experiment:

Should the world ever value the global stock of Bitcoin similarly to gold, Bitcoin's market capitalization would increase by around 1,300 times, from ~$6 billion to ~$7.8 trillion, and the price per Bitcoin would increase from around $460/BTC to around $600,000/BTC, give or take.

If this sounds "crazy," consider that in many ways, Bitcoin is more convenient than physical gold: it's cheaper to secure, transport, and hide; and unlike gold, it's backup-able.

\--

On a related note, here are some additional thoughts on Bitcoin I wrote four years ago, when its price was $9/BTC:

[https://cs702.wordpress.com/2011/05/29/on-the-potential- adop...](https://cs702.wordpress.com/2011/05/29/on-the-potential-adoption-and- price-appreciation-of-bitcoin-in-the-long-run/)

<comment><USER7> noone actually transports physical gold, they just transfer the certificates of ownership (physically or electronically)

<comment><USER6> Those certificates are issued by third parties who must secure, transport, and hide the physical gold.

Those third parties spend quite a bit to store the gold in secure facilities guarded around the clock, transport the gold from/to those facilities in armored vehicles, and keep the gold hidden from view, e.g., in underground vaults.

Guess who ends up paying fees to cover all those costs?

Certificate holders.

<comment><USER8> It's not like bitcoin is free, either.

A lot of someones burn a lot of electricity 24x7 in order for bitcoin to hold any value, too - and bitcoin holders pay for it just the same.

<comment><USER9> Divide the number of bitcoin transactions by the power spent mining, and each transaction consumes enough power to run an American household for a day and a half.

[http://motherboard.vice.com/read/bitcoin-is- unsustainable](http://motherboard.vice.com/read/bitcoin-is-unsustainable)

<comment><USER10> The biggest flaw with that calculation is that most Bitcoin miners are not located in American households.

They're naturally located where electricity is much cheaper: they're using environmentally-generated or surplus power, close to the source, at bulk industrial rates. The author even said it in the same article, but did not factor it into the clickbaiting comparison.

</comment></comment></comment></comment></comment></comment><comment><USER11> In a similar vein, going more in-depth:

[https://xkcd.com/980/](https://xkcd.com/980/)

<comment><USER12> I like xkcd's visualization better, because the quantities are displayed logarithmically: each part of xkcd's visualization uses squares which represent 1000 times more money than the previous part's squares.

</comment></comment><comment><USER13> As the commercial real estate guy, I am wondering where resisdential real estate is.

Also think there are quite a few asset classes left out of this chart (although it is awesome!).

CalPERS (one of the largest worldwide pension funds) does an awesome annual report showing thier holdings. For me it is an awesome way to see all the different ways one can invest. Link: [https://www.calpers.ca.gov/docs/forms- publications/annual-in...](https://www.calpers.ca.gov/docs/forms- publications/annual-investment-report-2014.pdf)

</comment><comment><USER14> Considering that the nominal value of above-ground gold reserves is comparable to that of commercial real estate worldwide, it looks overvalue to me.

There is so much productive use of commercial real estate, while gold is at best a medium of exchange and quite an inconvenient one relative to coins and banknotes. (Gold's industrial value is much lower than this and arguably its psychic value would not hold up well without its liquidity as money.)

<comment><USER15> If it looks overvalued to you, you should short it and test your intuition. Any amount that fits your risk profile.

</comment></comment><comment><USER5> Nice chart, although it would be really important to see references to the data sources and more notes on methodology (at the very least, they should have included dates on which the valuations were measured! Also, how exactly do we define "debt" and how is it computed/where is it referenced from?)

Also, the "Rest of the World" stock market capitalization is much larger than I would have expected, since it seems to exclude the largest exchanges (US+Europe+China+Japan). It would be nice to see a more detailed breakdown of that; perhaps I should do one :)

I would guess India+Brazil should be pretty large combined, and there are probably companies with tiny & illiquid float trading on obscure exchanges, but large capitalizations.

And yes, as another commenter noted, using the notional for derivatives valuation is really quite misleading -- I guess this is the easiest number to compute, and is probably the one supporting the point they are trying to make, but there should at least be more of a note telling people about it.

Still, nice work! It's good to see things in perspective.

</comment><comment><USER16> xkcd did it before

[https://xkcd.com/980/](https://xkcd.com/980/)

</comment><comment><USER17> When I scrolled down and saw that derivatives were so large by an order of magnitude I was reminded of this awesome 2010 Oscar winning documentary that I only watched a couple of weeks ago:

Inside Job: [https://archive.org/details/cpb20120505a](https://archive.org/details/cpb20120505a)

It's about how US executives created the financial crisis back in 2008 and is pretty relevant here. I'd well recommend watching it...some of the information provided is uniquely depressing and terrifying.

</comment><comment><USER18> Read this critique on Reddit this morning. Thought it was interesting.

Sharing here:

"Ah, this misleading derivatives stuff again... In two steps: Firstly, I'll use as an example something called an interest rate swap. If you have a loan with floating rate interest payments, then this lets you change that to a fixed interest rate of say 4%. As follows:

The lender requires you to pay floating rate interest. The swap is an agreement with a third party derivatives guy that you should receive a floating rate from him and pay fixed to him. So every month you will receive whatever the floating rate is from the derivatives guy, and pay a fixed rate to him - and the floating you receive pass on to the guy charging interest on the loan. For example: the loan has a floating rate payment which at the moment is 4%, and you agree with the derivatives guy that you should pay him a fixed rate of 4% and will receive whatever the floating rate is. If the floating rate rises to 8%, then you pay the derivatives guy 4% and receive 8% and pass those 8% on to the lender. If the floating rate falls to 2%, you pay the derivatives guy 4% and receive 2% and pass those on to the lender.

But 4% of what? For the calculation to work, you need a monetary amount to calculate 4% of. That is the notional. You receive cash of the floating rate * the notional, and pay cash 4% * the notional. You need some way to translate the percent into actual cash payments and that happens through the notional.

If your loan is 10m, then the notional amount you want is probably 10m. If you only want half fixed half floating, then you can set the notional amount to 5m. But the notional amount is just the basis used for calculation. It's not "money". It's a figure plugged into a formula. The notional isn't put into the bank and can't be withdrawn from it, and at the end of the period of interest payments the notional isn't there anymore because its only purpose was to calculate those interest payments.

If someone wanted to they could break that entire counting system by simply making a swap with a notional of 1 centillion dollars and deciding the payment isi equal to 5% * notional / 1 centillion. If you wanted to swap 100m USD you would need 100m of these contracts for a notional of 100 million centillion dollars. The actual money changing hands is nowhere near the notional.

Secondly: Sometimes people use derivatives for speculation. What they can do is enter a contract and then after prices change they enter the opposite contract. For example: contracts for oil 6 months from now are $50 per barrel. Someone buys contracts for 50 million barrels. Then the price changes to $60 per barrel. He then sells contracts for 50 million barrels.

The only practical effect of this trade is that he receives a cash sum today. In 6 months nothing happens - they are automatically matched and offset. In this case the notional amount would be the price of 50 million barrels of oil times 2.

Now, it's possible to do this at high speed. So rather than wait until the next day, he enters a contract and then the opposite seconds or milliseconds from each other. As long as the buying and the selling is for the same amount, this could make for an arbitrarily high notional.

There are absolutely risks in derivatives. For example, what happens if one party loses enough money to go bankrupt and all the bonds they placed as security for that event isn't enough to cover the loss. But the notional amount is not a good place to start to understand risks. Like, every type of derivative will have its own rules for how the notional translates into actual cash - e.g. for an oil contract it would be the full value of the oil, and for an interest rape swap it would just be the amount that's multiplied by the percentage.

Not someone who works with this daily, but covered it quite well in studies."

<comment><USER19> Debt can be considered money, but not all kinds of derivatives, especially swaps. Debt usually has some kind of collateral: physical, business cash flow etc. Insurance will have direct interest, an actuarial basis and reserves. Swaps may have neither of these. A metaphor is a blackjack table. The players place real money bets. The house/dealer pays on known statistics. Swaps are like bystanders betting on the players and hands they see and expecting the house to pay off.

</comment></comment><comment><USER20> My experience is that big tech company jobs are much better than at the typical startup.

I got my first job working for one of the big 3 tech companies a couple of years ago after a long string of startups that failed or fizzled going back to the dot-com days. I always felt like I was making reasonable-to-good base salary at startups with the potential to hit it big with stock options.

Starting my job as a regular IC at big tech company was immediately an eye opener. Out of the gate my base salary was 10% higher than I made as a manager at my most recent startup. With bonus and publicly traded stock value after a year, I was making ~50% more and stock becoming even more valuable over time.

My first startup was great as I went in at 25 with no college and only self taught tech skills. In hindsight, this was a great (probably only) way to start but pivoting to big tech would have been a better move instead of trying to strike it rich at a startup.

<comment><USER21> Wrong thread.

</comment></comment><comment><USER22> According to this, there are 1 billion ounces (35,000 tonnes) of silver and 186,000 tonnes of gold. But... I thought gold was rarer than silver.

Edit: I wonder if it has something to do with the fact that silver (unlike gold) is consumed in manufacturing processes such as photography.

</comment><comment><USER23> I imagined for whatever reason that if one would account the 'global economy' as a closed system then debt + value would come at a balance. Didn't consider derivates as holding such a huge value. That also mean most of the debt is backed by gambling with production yield, which is scary.

</comment><comment><USER24> I'm surprised Bill Gates is the richest individual again. I thought he gave away so much money that it pushed him off the top #5 list a while ago?

Is his fortune largely tied to Microsoft's share price?

<comment><USER25> Actually no... most of his fortune is split in several other investment since a while ago. I guess being friends with Warren Buffett helps :)

<comment><USER26> it would be funny if Bill Gates' bridge hobby ended up making him $30,000,000,000 over his lifetime.

(he was buffett's bridge partner.)

</comment></comment></comment><comment><USER27> So now if we just square that, we get all evil in the world!

</comment><comment><USER28> Wow, really puts into perspective the quote on Starfighters.io:

Willie Sutton: "I rob banks because that's where the money is."

You: "Amateur."

</comment><comment><USER29> Can't zoom.

</comment><comment><USER30> Interesting that there's more debt than money. Apparently a lot of money is borrowed to lend out.

<comment><USER31> Debt is backed by assets, which were undercounted by this graphic. I'd be very interested to see the estimated value of residential real estate compared to the derivatives market.

<comment><USER30> Yes but if I get a mortgage, the amount of debt issued is equal to the amount of money I get by taking on that debt. The fact that the debt is secured by the real estate doesn't change that.

</comment></comment></comment><comment><USER32> Once you taste the life of self-employment, you will never go back to working as an employee.</comment>


SpaceBase Can Now Be Used as a Spatial Redis - <AUTHOR> http://blog.paralleluniverse.co/post/27921446527/spatial-redis

<comment><USER2> I would kind of like for _Redis_ to be used as a Spatial Redis. Would antirez consider adding an rtree/kd-tree/whatever-else type if a good pull request for one was available, or is that the sort of thing that's meant to be done "above" Redis (by, say, geohashing coordinates into scores for a zset)?

</comment><comment><USER3> The comparison with Redis is totally misleading. SpaceBase is for completely different use cases and has a different underlying technology.

It is an interesting development though. It uses R-trees and the whole data set and index is keep in memory.

</comment><comment><USER4> Product appears to have nothing to do with Redis and isn't even remotely compatible. Marketer uses buzzword to attempt to get credibility and hence immediately loses all credibility with actual market.

<comment><AUTHOR> It can be used in the same way and for the same purpose Redis is used, only for spatial updates/queries. Take a look at the Thrift/Erlang documentation.

<comment><USER4> I don't think you understand Redis. Redis is also a key-value store, but implements a variety of structures, not just RTree, and has a large number of operations on those data structures (<http://redis.io>).

Spacebase appears to be a significantly more primitive KV store that implements RTree. Not that that's bad; looks interesting, even though it appears that the product won't be free, and so in my opinion is probably doomed.

Using 'Redis' in the title is just embarrassing for Spacebase and, by extension, for YC too. No need to troll the professional developer community with ridiculous comparisons.

<comment><USER3> I had the same impression. The author doesn't know Redis well or he wouldn't have made that comparison.

<comment><AUTHOR> The comparison is meant to be functional - not technical. Most people use Redis as a low-latency key-value store either for write-heavy uses, short-term storage or as a cache. SpaceBase is, indeed, not a key-value store, but it can now serve the same purpose Redis does, namely, a low-latency, write-heavy data-store, only for spatial indexing rather than key indexing. I think I've made an apt, fair analogy.

<comment><USER5> By your logic I could call memcached a "schemaless Redis" and it would be not only fair, but apt. Give me a break.</comment></comment></comment></comment></comment></comment>


How I found a Remote Code Execution bug affecting Facebook's servers - <AUTHOR> http://www.ubercomp.com/posts/2014-01-16_facebook_remote_code_execution <comment><AUTHOR> Hi. I'm the one who found the bug. Facebook's side of this story is at [https://www.facebook.com/BugBounty](https://www.facebook.com/BugBounty)

<comment><USER2> I'm curious: how much time would you say you worked on researching and identifying this bug? BTW, I don't begrudge you the payout one little bit, no matter how long you spent on it; such an amount is change down the back of the sofa for facebook, and the potential impact of the bug means they got a great deal!

<comment><AUTHOR> Well, I originally found the OpenID bug in 2012, but hadn't noticed Facebook was vulnerable until very recently. After I found their OpenID endpoint, the hardest part was getting them to make me a Yadis discover request. Then I had to squash a little bug in the exploit. Most of the time was spent re-reading the OpenID spec. I'd say total amount of work (including the time it took me to write the post) was about 2 days.

As I said in the post, I already had a strong suspicion that, once I could read files, escalating to RCE would be easy. But I decided not to do it without permission and they fixed the bug very quickly. As much as I'd loved to actually see the output of an _ls_ or something like that, I think I made the right call.

</comment></comment></comment><comment><USER3> The payment was apparently USD 33'500.

Not being in the bug bounty business, I had expected a higher payment.

<comment><USER4> Not bad for 2 days of work.

<comment><USER5> The part of the work you don't see is the hours, days and months spent, usually unpaid, spent auditing code to find the bugs.

It is like the anecdote of Tesla and Ford and knowing where to put the X[0], you aren't paying for time or manual labour - bug value is derived from how much damage it can cause, what its worth to Facebook to not be exploited and what the exploit is worth to the bad guys on the black market.

[0] [http://www.snopes.com/business/genius/where.asp](http://www.snopes.com/business/genius/where.asp)

<comment><USER6> He says that it took him about 2 days total

[https://news.ycombinator.com/item?id=7106482](https://news.ycombinator.com/item?id=7106482)

<comment><AUTHOR> The 10 years before those 2 days helped a lot too...

</comment></comment></comment></comment></comment><comment><USER7> Since this sounds like it affects a lot of people in a lot of places, I went about auditing my own code and found that if you're using libxml2 >= 2.9.0, you should be safe, _unless_ you're explicitly requesting entity expansion:

[https://mail.gnome.org/archives/xml/2012-October/msg00045.ht...](https://mail.gnome.org/archives/xml/2012-October/msg00045.html)

For the nokogiri users, there are a couple of proofs-of-concept in this ticket: [https://github.com/sparklemotion/nokogiri/issues/693](https://github.com/sparklemotion/nokogiri/issues/693) \- they should be patched with modern versions of nokogiri and libxml2, but if you're running older versions, you might want to verify their behavior before someone else does it for you.

</comment><comment><USER8> A lot of people think its not enough money. In this case it appears to be about 30K USD.

Here's an issue with paying more: the security engineers employes are paid around 100 to 150K a year.

Imagine you'd get paid 100K for a big exploit. It wont be valuable to be a security engineer anymore (since you can't be paid additionally for finding the bugs), it's better to be unemployed and spend your time finding the bugs.

I think that's one of the main issue, at least until bugs are extremely, extremely rare (which really, they aren't - these news are really the tip of the iceberg).

</comment><comment><USER9> Congratulations Reginaldo - great read, great story from A-Z. Don't worry about the payout. Apparently you got brains and a white hat, that's all you need for a carefree life.

</comment><comment><USER10> For those using the Java stack we have found HP's Fortify static analysis tool helpful in automatically detecting XXE vulnerabilities.

[http://h30499.www3.hp.com/t5/HP-Security-Research- Blog/Q2-20...](http://h30499.www3.hp.com/t5/HP-Security-Research- Blog/Q2-2013-HP-Fortify-Software-Security-Content-Update/ba-p/6119297)

<comment><USER11> HP's WebInspect, a blackbox testing tool, also can find XXE's. However, as the OP shows, XXE's can be tricky and involve a lot of nuance to cox them out. General dynamic testing tools aren't as good at uncovering XXE's as static analysis tools.

Disclaimer: I used to work on WebInspect's audit engines

</comment></comment><comment><USER12> So, why is it possible to have XML files reading arbitrary stuff from whatever place again?

XML is _data_. If your application needs to send a request for reading a file through XML this should really be explicit, not relying in a "permission happy" XML library, no?

<comment><USER11> Yes, XML is data, but it allows you to specify where other data is located that should be included when processing it. These links can be to addition data, or to definitions of how to process the data in the document (XML entities). It's a simplification, but it's as if XML can have #includes, where the source of the #include is a URL, and can even be a file:/// URL.

So the attack looks like this: Server takes input from evil user, inserts it into an XML document in memory. The input is malicious, and contains not only XML data, but XML directives to include other documents, specifically /etc/passwd on the location machine. The XML document is processed, the contents of /etc/passwd are automatically read by the XML parser/processor. However the data is not in the correct format, and the XML parser/processor spits out a detailed error message, showing the data that could not be processed/parsed, which is the contents of /etc/passwd.

Make sense?

<comment><USER12> Sure it makes sense, what doesn't make sense is the library reading anything it is thrown at it.

I'm thinking there should be a "root path" for the library to be able to access files. Sure, you want to include "base.xml" it's in a specific directory and the library is allowed to read only that, and no "../../../../etc/password" tricks.

</comment></comment></comment><comment><USER13> This was very interesting. What are good reasorces to learn more about this kind of stuff?

<comment><USER14> Its hard and I wish I had more info. One thing I do know is that blogs are the worst form of information. I would think being a whiz at Javascript and PHP would be a prerequisite but maybe you just need a good understanding of different specs and protocols.

<comment><USER4> You don't really need to be a master of a specific language. You just have to understand general programming concepts. The hard part is getting the right approach to searching for vulnerabilities. Learning to recognize everywhere the target system is taking input and estimating what it is doing with that input is where the skill is at.

</comment></comment></comment><comment><USER15> Wait, so how do you escalate this to RCE?

<comment><USER16> Don't think either party has disclosed that.

>and due to a valid scenario he theorized involving an administrative feature we are scheduled to deprecate soon, we decided to re-classify the issue as a potential RCE bug.

I imagine it might be some feature that could maybe be triggered internally through a file:// or [http://localhost/](http://localhost/) URL, and in doing so gain access to an interface that can issue shell commands. That's pure speculation though, and I'm probably way off.

<comment><AUTHOR> You're actually pretty close.

</comment></comment></comment><comment><USER17> Just curious. Would you be interested in checking (for a fee ofcourse) other web server products that use similar technology. If so please let me know and I would love to connect with you.

<comment><USER18> From the article, he says just shoot him an email.

        If you find this interesting and want to hire me to do a security
        focused review or penetration testing in your own (or your
        company's) code, don't hesitate to send me an email at
        firstname.lastname@example.com.

*edit: formatting

<comment><USER17> Thanks. I had not noticed it. I will definitely ping him!

</comment></comment></comment><comment><USER19> Extremely interesting (and open) write-up reginaldo. Congratulations on the payout.

</comment><comment><USER20> Very interesting, but there is a good chance that other people have stumbled upon, but they preferred to wear a black hat. Anyway, hats off.

<comment><USER21> from the FB post "In parallel, other members of the Security team investigated the logs corresponding to this issue and confirmed that it had not been previously exploited or used maliciously."

</comment></comment><comment><USER22> I'm very surprised that the php code isn't running in a chroot / jail...

</comment><comment><USER23> Great work dude, keep em' coming.

</comment><comment><USER24> Fb is so stingy with payouts.Bugs of a website with over a billion users can be sold for millions.Is fb ignoring this fact?

<comment><USER11> People here seem to have a strongly misplaced expectations about what bug bounties pay. Vulnerabilities in web apps/servers tend to be worth less than vulnerabilities in client computers for a few reasons

First, web app vulns are usually specific to a single site. (Unless obviously you find an issue in a common underlining framework, say, a session fixation attack in how PHP or ASP.NET handles sessions).

Second, and much more importantly, the vast majority of site's don't have financially actionably information. Unless you handle banking/credit card info, I am limited in what I can do to extract value from the server (compared to a compromised client). There aren't that many vectors to extract value.

-Dump their list of usernames/passwords? Ok, maybe some of those will also be used on other banking or commerce sites, but I have challenges/risks actually getting money out. And if I want stolen credit card numbers I can just buy them in card forums.

-Serve sleazy advertising? Ok, possible, but ad's are a crappy business to be in and its definitely a high volume/long time approach (ask how well Huffpo pays its writers). You can try affiliate spamming/stuffing, but again, not huge value. Both ads and affiliate approaches are dependent on how much traffic the server you hacked gets. Low traffic, you make no money. The more traffic, the larger the site, the smarter/better equipped the IT/security team. How long do you really think an Alexa top 10 or top 100 site won't notice an IFRAME pointing to .ru or .cn?

-Mining cryptocurrency? Not financially viable

What usually happens when a server is compromised is that an exploit kit is installed and it's used to attack the visitors (specifically exploit a vulnerability in the client). And so we are back to attacking clients to extract value over attacking (most) websites. Why do this? Simple:

\- There are orders of magnitude more desktops/browsers than web servers. \- They are running tons of diverse plugins and software so the attack surface is much larger. \- Most of that software will be out of date and have known vulnerabilities. \- Very few of these clients are "managed" by a personal IT person like a web server. The user is far less likely to notice anything bad.

All of that mean I can reach more targets, compromise a larger number of them, _and_ hold them for longer. Why is this better than pwning a server? Because lots of scenarios to extract value that don't work on a handful of web servers _do_ work when I have thousands and thousands of compromised clients:

-Show them ads -Stuff affiliate links -Changing their DNS settings and MitM all their traffic (bank.com? Why that's right over here!) -Keylog them to actually steal financial data, credits cards, bank logins, etc -Use them to send spam -Use them as a botnet to DDoS people and get paid protection money -Mining? perhaps?

To put this in prospective, very smart hackers doing crazy stuff to break out of Chrome's sandbox and exploit clients are getting $50-$100k in public contests like Pwn2Own. Getting $35,000 for a RCE is pretty awesome

<comment><USER5> Completely agree. To add, IMO the most valuable application of this exploit would have been to deliver drive-by malware. There are some groups that pay $0.5-3 CPM to get their Javascript onto much less targeted web sites. The Yahoo malware would have cost nearly double that.

Getting drive-by traffic is one of the most expensive pieces of the puzzle for malware groups. Last time I checked the forums, a thousand visitors was selling for around a dollar, and that isn't even well qualified traffic.

Having access to Facebook and over a billion pageviews per hour would be worth millions to any group who is capable of handling that type of volume. If they were smart about it, they could probably get away with it for up to a day (the Yahoo malware was active for a day and they didn't obfuscate it much).

Back of the envelope value is around $1M per hour, and that doesn't include the premium for the higher quality of traffic, but does assume you find a way to inject across all the servers and somehow not display it to Facebook internal IPs.

A big group with some fresh browser 0day would have loved to get their hands on this.

<comment><USER16> Considering Facebook's good security team (and Yahoo's notoriously poor one), I suspect that they'd probably catch the malware and perform some sort of emergency action in under an hour.

A much more devious attack would be modifying some of the code to silently siphon off login credentials, and grabbing the user database. Then once they were satisfied with that they could go with the malware route.

<comment><USER5> Facebook must be one of the only large sites that hasn't been hit directly with serving malware, closest I can recall are incidents like this:

[http://www.f-secure.com/weblog/archives/00002172.html](http://www.f-secure.com/weblog/archives/00002172.html)

</comment></comment></comment></comment></comment><comment><USER25> It should be 100,000USD. Read this article of microsoft bug bounty program. [http://blogs.technet.com/b/bluehat/archive/2013/10/08/congra...](http://blogs.technet.com/b/bluehat/archive/2013/10/08/congratulations- to-james-forshaw-recipient-of-our-first-100-000-bounty-for-new-mitigation- bypass-techniques.aspx)

<comment><USER11> Not at all. Your link is for someone finding an entirely new way to bypass protections/sandboxing in IE. That is an enormously impactful issue because it affects hundreds of millions of desktop PCs. Comparing that to a RCE affect a few web servers, even at a site as large as FB, is misplaced.</comment></comment>


Why Messaging Startup Slack Keeps Raising Money It Doesn't Need - <AUTHOR> http://www.bloomberg.com/news/articles/2016-03-15/why-messaging-startup-slack-keeps-raising-money-it-doesn-t-need <comment><USER2> Because if they keep raising money then their valuation keeps going up, and people will think they're a good investment and keep giving them money based on their rising valuation. There's a word for that kind of structure.

<comment><USER3> "Venture Capital"?

(I know that's not the P word you're going for, but alas...)

<comment><USER4> I always thought it was close enough in many times in practice. ;)

</comment></comment></comment><comment><USER5> IRC -> Campfire -> Hipchat and now Slack. I don't understand why large parts of the industry made these transitions, but it seems like for some reason we like to collectively abandon one chat solution and move on to the next hip one. Not sure why that will be different. I am not seeing Warren Buffet's famous moat and am thus not bullish on Slack.

<comment><USER6> I still really do not get why technical people don't just use IRC with a decent client (Hexchat?)

<comment><USER7> because businesses don't have only technical people, and you don't want to have multiple chat systems, which will eventually bring worst communication between different groups of people. If technical people are on IRC and all the other people are on hipchat, how do you make the 2 groups communicate?

<comment><USER8> Plus, the fact that someone is technical does not always mean they want to fiddle with getting chat systems working. None of the engineers in my department would be willing to mess with IRC when Hipchat and Slack provide turnkey solutions that just work, the first time you open them, and require no configuration or special treatment.

</comment></comment></comment></comment><comment><USER9> This just means that the slowdown that everyone is anticipating this year has not yet set in across-the-board or across all Institutional Investor segments. Thesefolks at Slack will probably represent the last major round before everyone starts thinking "what have I done?".

At this point I think a lot of the larger rounds are not even being publicized because they'd be so ridiculed.

I understand raising money if you get amazing terms. But the hubris of a chat company with this kind of overvaluation boggles my mind

</comment><comment><USER10> ...isn't this what an IPO is for?

<comment><USER11> In a world that makes sense: probably. Keep in mind, Slack is not only raising money because it can but also because the public markets would throttle it like the companies had been in 2015.

That said, Butterfield's move to raise more money simply to be attract more recruits sounds completely crazy. But hey, it's only crazy if it doesn't work.

He seems to understand the awkward position his company is in. As covered in a TC article, Butterfield is prepping his company for the public markets even though there are no real plans to do so. This is evidenced by the near profitability Slack has now.

Link to relevant article:

[http://techcrunch.com/2015/11/24/ready-to- pounce/](http://techcrunch.com/2015/11/24/ready-to-pounce/)

</comment></comment><comment><USER12> What I find confusing is that he says compensation is crazy at companies like Google, where employees can sell their equity on a public market with an expected value significantly above zero. Does this mean they are fundraising to pay their staff more in salary, or hoping that repeatedly diluting their private stock somehow makes Slack preferable?

</comment><comment><USER13> Continually raising money means the current stockholders, including people recently hired,are being diluted and are seeing their percentage shrink. This won't matter in the short term as the valuation soars, but it definitely will matter when the company matures and the end value is worth less.

<comment><USER14> Well, the idea is that employees will own a little less of a company that now has $150MM more on it's balance sheet.</comment></comment>


3D Tetris with WebGL (Three.js) - <AUTHOR> https://github.com/fridek/Threejs-Tetris/

<comment><USER2> Looks very similar to Blockout from 1989: <http://en.wikipedia.org/wiki/Blockout>

In Blockout, you had a transparent falling block so you could see what was below.

<comment><USER3> also the rotations were animated

<comment><AUTHOR> It's inspired by Blockout. There is a lot to improve, but there is a little potential in such game. I was rather considering turning it into a tutorial, it's around 500 lines of code and may be a good, simple introduction to WebGL games. Would you like to read such thing?

<comment> iso8859-1 Yes.

<comment><AUTHOR> The submission is dead now, but just in case ;)

[http://www.smashinglabs.pl/3d-tetris-with-three-js- tutorial-...](http://www.smashinglabs.pl/3d-tetris-with-three-js-tutorial- part-1)

Part 2 is also online and part 3 is ready to be released on Monday,

</comment></comment></comment></comment></comment><comment><USER4> The tutorial would be great. It might also be a good opportunity to fix some bugs in the collision detection. I had a block disappear into other blocks that were 3 or 4 layers high. I could hear it keep falling and it finally hit the floor, which was interesting because there were several other blocks it had was passing through in those layers.

This was done without continual "wild" rotation. I was trying to complete a rotation immediately before it passed into the first levels of blocks, but then just observed once the block disappeared.

</comment><comment><USER5> Amazing! I would like to change camera perspective though. I lose at least 2-3 height layers just to figure out what the next block looks like.

</comment><comment><USER6> It would be nice if there was an option to turn off the game sounds (If there is, I'm not seeing it). It's pretty painful.

</comment><comment><USER7> Bug: I managed to bury stuff way below the ground by rotating wildly.

<comment><AUTHOR> I'm thinking if I should check ground hit better or disallow rotating blocks wildly ;)</comment></comment>


Is Npm worth $2.6MM? - <AUTHOR> http://words.steveklabnik.com/is-npm-worth-26mm <comment><USER2> It is an interesting insight that a VC can improve their internal rate of return by investing in open source. It seems like a continuation of the process of outsourcing manufacturing engineering for hardware.

It will be interesting when this becomes pitch material, something like "Hey all your portfolio companies need an HR resume/lead management system, fund us to build an awesome open source HR system and they can all use it for free!"

<comment><USER3> since npm doesnt scale they will sell private repos to big businesses...kidding. well almost,since the only money to be made with npm is in consulting fees.

</comment></comment><comment><USER4> Surely any money going into FOSS technologies, be it $2.60 or $2.6MM, is good news for everyone involved?

I don't use Node.js - RoR is more my thing - but if this money allows the project to hire talent and increase the quality of the codebase and documentation, they're going to attract developers from other frameworks.

Even the die-hard supporters that refuse to budge, Node may develop new paradigms that can be ported over.

Investment in FOSS is a good thing, IMO. Just because it came from a VC shouldn't discredit its possibilities.

<comment><USER5> Sure it's likely good for the FOSS community, but he's addressing the question of if it's good for the investor. On the face of it, an open source package management system doesn't have an obvious profit model, so it's not obvious to many people how anyone would expect to make a return on investing in NPM.

<comment><USER6> The recent interview on Javascript jabber with the NPM guys was very interesting, and covered some of this.

<comment><USER7> Link: [http://javascriptjabber.com/099-jsj-npm-inc-with-isaac- schlu...](http://javascriptjabber.com/099-jsj-npm-inc-with-isaac-schlueter- laurie-voss-and-rod-boothby/)

</comment></comment></comment></comment><comment><USER8> > This means that a16z and GitHub management are protected from a acquisition, > and can retain control of GitHub.

I don't know what this means, exactly. Avoiding acquisition isn't like avoiding, say, snipers; you can just say no. Certainly acquisition is, for the moment, not feasible, but that's not exactly protection (it's actually the removal of an option). Protected from the need to be acquired, maybe?

I'm not trying to be pedantic; I'm honestly confused by the phrasing.

<comment><USER9> Not always, i.e. drag along rights. Depending on how you structure your deal investors can override founders on acquisition offers.

<comment><USER8> Good point, but I can't quite square that with the article, so I don't think that's what it has in mind.

</comment></comment></comment><comment><USER10> > Someone has to pay that S3 (I guess CouchDB) and EC2 bills

Previous package managers have done well running on public mirrors donated by universities and businesses around the globe. rubygems finances itself via a non-profit. There is nothing _necessary_ about NPM's business model, IMO it's just a side-effect of the incredible tolerance for private ownership within the node ecosystem. I can't imagine this model would fly for any other language/platform.

<comment><USER11> Scala seems roughly similar.

<comment><USER12> How?

<comment><USER11> It is owned by a single corporate entity who is also its primary sponsor, Typesafe. This is similar to how Joyent owns node, and how they sponsor it's development, along with NodeJitsu, Microsoft, Heroku and others.

<comment><USER12> No. It's "owned" by the EPFL.

</comment></comment></comment></comment></comment><comment><USER13> As someone not so familiar with venture capital, why do you denote million with "MM" and not just "M"?

<comment><USER14> Technically speaking, the roman numeral "M" stands for one thousand. So "MM" = "thousand thousand," or million.

These days it's a matter of preference as to which abbreviation to use. You'll see different people and different firms using either/or. (And a lot of people are now using "k" for thousand and "M" for million.)

If we want to get even wonkier, we could note that the English word "million" derives from the French word "mille," meaning "thousand." ("Mille" derives from the Latin, and the original Latin denotation is used to mean "thousand" in familiar words like "millennium," "millisecond," and "millipede.") The word "million" was originally invented to mean "a great thousand," or "a thousand thousand."

<comment><USER15> I thought MM would be 2000 if one used the Roman system. It's some sort of weird Roman system with maths in between the the Ms assuming I'm correct.

<comment><USER14> True. I'll confess that I'm not 100% sure how "MM" originally came to be used in financial and accounting notation. But it's been used to mean "million" by way of "thousand x thousand."

It's possible the M's in the financial notation system are not actually Roman numerals, so much as abbreviations of the word "mille" (or some equivalent thereof).

</comment></comment></comment></comment><comment><USER16> Enlightened self-interest does not usually achieve preservation of the commons. It is not clear from this article, what specific additional insights into the community an investor can expect to receive as a consequence of their investment. i.e. over and above npm being a public resource available to all (including free-riders). Perhaps it is better to think of these infrastructure services as baubles of the VC. Much as a Venetian merchant might have "invested" in opera or a cathedral. Anyway, I don't think the hit-and-miss nature of VC justifies this type of investment; where it is known _in advance_ that a particular company does not make its 10X return.

</comment><comment><USER17> I think that the investors may not just be looking to solidify infrustructure for other investments. The majority of start ups have little income and relatively few customers. Npm has a huge number of customers and whether it can generate a huge amount of income through private registries or whatever services, the fact that it is a core piece of infrastructure is a huge advantage in launching services. So a VC has good reason to expect a useful amount of income. That isn't actually the case for many investments. I don't see how anyone could suggest that this is a large investment for such a core piece of infrastructure.

<comment><USER18> > Npm has a huge number of customers

> VC has good reason to expect a useful amount of income

I'm going to be pedantic, but within reason: users != customers. I know you mentioned that they have yet to attempt to monetize, but until they try we can't make accurate predictions on their level of revenue. I think the author is trying to say VC's aren't trying to play a game of make believe when it comes to future revenue, but rather are making the investment in the community.

</comment></comment><comment><USER19> This is definitely interesting and insightful, especially the lead-gen aspect of investing in OSS with the prospect of future leads. Kind of like a16z investing in PandoDaily - surely that won't provide a legit return, but it will give high visibility into the ecosystem.

However, I disagree about the Github portion.

The Github investment was the perfect type of investment. They conquered the consumer side of the market, they knew their customer acquisition cost, were growing quickly and were profitable. It was the perfect example of just pouring gasoline on a fire to accelerate things.

The next logical step is to move into the enterprise, which they have been doing. I suspect that their customer acquisition costs into the enterprise are just as low as the consumer side - because they will have internal advocates from the same developers that either have a free/paid account on the consumer side.

So it is the perfect, de-risked, investment for any investor. A16Z happens to be cream of the crop, so they were lucky enough to get that deal.

Aside from that...OSS companies actually do make a lot of money. See Sun, RedHat, etc. Selling enterprise versions and support can be VERY lucrative. The only way to do that is to grow significantly and become a major player in the industry - which npm was slowly getting there, with the investment it did accelerate that likely. So I don't think they would see it as a loss-leader just to build out a funnel for future deals. That was likely just a bonus, or even "down-side protection" as it were.

</comment><comment><USER20> I think this is great news. NPM is as vital to Node.js as Gems are to Ruby on Rails. If funding means NPM can provide better packages, better services and overall a better product as a result of the investment: everyone who uses Node.js wins in the end.

</comment><comment><USER21> Although the idea of investing because of indirect benefits is interesting, I think the investment thesis is much simpler: You can build profitable business around open source, even if you make money by selling consulting.

Redhat has $10B market cap, MySQL was sold for $1B back in the days. nginx inc. received a substantial investment. Can you build profitable business around package manager? Sure, there is a big community of developers that are using npm on daily basis for mission critical work. It's really hard to build that kind of community of professionals in any field. I don't see why you couldn't build business around that.

</comment><comment><USER22> I thought basically the same thing when I heard about it, but from a different angle: what would happen to VC investments if NPM imploded? Some stability for these companies is valuable.

I'm not sure of some of the implications of this article though; open source and money are not inextricably connected. While open source may be a loss leader in some cases, it does not need to be. All of what we now consider open source descends from a time when it was considered radical to think it was possible to make money from open source.

</comment><comment><USER23> Is there any evidence that this thinking is true? has any VC employee ever implied that VCs invest in infrastructure firms to increase the probability of their other investments succeeding?

<comment><USER24> Of course not. It's pure speculation. But it was an interesting read.

</comment></comment><comment><USER25> I have nothing insightful to add, but I like this writing style.

</comment><comment><USER26> This post is interesting, but I don't think it is entirely on target (the latter portion could be, but I'd need more evidence to be swayed). The author essentially paints a picture where open source startups are losers on their own, but that the smartest investors fund them to provide infrastructure to the community, like they are cooperating in a giant prisoner's dilemma of some sort. Also, that by investing in infrastructure you gain insight and access (this is the part I may agree with).

I don't think that investors (even Andreesen Horowitz) look at ANY investment and think, "Well, some of my investments are going to fail, I can take on this one and accept the hit to my returns." Getting LP commitments is very competitive, and you are stack-ranked. You can't afford to make investments that you don't think are going to be winners. To be fair, if there is anyone that could do this, it's Andreesen Horowitz, but that doesn't make them smarter, it's because they have the benefit of the doubt with LPs.

He says that these smarter investors will fund an open source project to multiply the returns of their other investments, but that ignores a likely truth. The opportunity cost of investing in the open source company to benefit from the infrastructure isn't that the infrastructure doesn't exist. It is that it is created slightly more slowly and you still get to benefit from the majority of its power, or that you are forced to use the next best infrastructure, which, if we are being honest, is quite nearly as good. I think it's likely that the next best alternative to npm is going to be 90%+ as good for your project with the same developers. Optimizing on a thin margin like that with respect to your other investments doesn't seem like good strategy.

Another factor to consider is that there have been open source companies that provided good returns to investors. MySQL sold for 20x invested capital, for example. You don't need to appeal to tenuous arguments about ancillary benefits of an investment when it could simply be that a company sponsoring an open source project with a boatload of traction just happens to be, from a risk-reward perspective, well-positioned to make returns in all sorts foreseen and unforeseen ways. We also don't know the valuation or deal structure, which could mean that the $2.6m investment is quite a bit more favorable to the investors than one's first impression.

I believe the strongest point he made is the last one, "They get insight and access at unprecedented levels into the future of Node, at the cost of something they can already afford to lose." Much of the effort in being a VC actually relates to "access." If you can get into some of the hot node deals by being known to be a shop that favors node, I could see how that might be worth it, though I'd need more evidence to be convinced they are thinking this way or that it's a good strategy. (Andreesen Horowitz can probably get into any deal they want, which is not the case for True Ventures) But that's different from thinking that by investing in npm you are going to make your other companies stronger by making npm available to them.

As miscellaneous commentary on his examples: GitHub is minting money, so investing in them was a crazy good decision no matter what the reason. Even if you think the liquidity event could be challenging for some reason, it still provides good reward for risk, and ultimately there are ways to handle lack of liquidity events (I also suspect that Andreesen Horowitz are more flexible in this regard for structural reasons, venture capital partnerships are quite complex in the details). Jeff Bezos doesn't have LPs so he can invest in 37Signals/Basecamp even if they are never selling, he just punches his dividend checks like the other owners, which can be just as good a return. The focus on liquidity events is a quirk of the standard fund structure rather than inherent to the asset class.

<comment><USER27> > _I don 't think that investors (even Andreesen Horowitz) look at ANY > investment and think, "Well, some of my investments are going to fail, I can > take on this one and accept the hit to my returns."_

I'm not sure that's what the OP was saying. a16z is a $2.5b fund, so spending $100MM is only 4% of their fund. The point that he's making, is that the micro risk gained on just GitHub decreases the macro risk overall the whole portfolio. In other words, keep the assumptions concrete and businesses that utilize those assumptions will flourish.

Imagine you're an auto company, and money stops going into road construction, and therefore less people use the roads. A smart auto company may invest in construction companies. The only argument here is now do these constructions really need any extra money to keep them going? (I would argue no, they're already making enough money) In the same vein, does GitHub need more money to be motivated? (the answer is probably no, but as you point out, it's an extremely safe bet) That being said, it doesn't hurt to throw a small percent of your fund into road construction.

</comment></comment><comment><USER28> In my opinion it's OK as long as NPM Inc will follow the same model as github and docker, i.e. free public open source repositories and paid private repositories.

Another reason why VCs invest in open-source ecosystem is that it indirectly helps their other portfolio companies, even if original investment doesn't pay off.

</comment><comment><USER29> I made this question to myself and couldn't understand how would they make money. Now with these great insights the answer is clear: they don't need to

I just wonder what will happen when they run out of money. Will be they able to raise another funding round?

</comment><comment><USER15> Slightly off topic, but mm or MM as an abbreviation bothers me. Isn't there something better? How does it even work? Is is some sort of bastardisation of the Roman system where is would mean 2000? Am I missing something?

</comment><comment><USER30> There are a lot of great insights in this post that most people who talk and write about startups completely overlook. Thanks for bringing reason and logic to HN.

</comment><comment><USER31> If the seed round was for $2.6MM, does anyone have an inkling as to what valuation that was done against?

<comment><USER6> If you are referring to the model and not the amount, it will simply be private repo management.

</comment></comment><comment><USER32> Then RubyGems (thoughtbot) would be worth more after gem signing security is set to MediumSecurity by default (warn on unsigned gems) and certificates are managed.

Can do it today yourself instead... ~/.gemrc:

        gem: ... --trust-policy MediumSecurity # add this

</comment><comment><USER33> Headline is incorrect. The actual value is $2.6MM.

<comment><USER34> That's referenced in the article itself. The phrasing was intentional, to fulfill Betteridge's law of headlines.

[http://en.wikipedia.org/wiki/Betteridge's_law_of_headlines](http://en.wikipedia.org/wiki/Betteridge's_law_of_headlines)

</comment></comment><comment><USER35> No.</comment>


The Daya Bay Reactor Neutrino Experiment | Lawrence Labratory Research - <AUTHOR> http://newscenter.lbl.gov/news-releases/2011/08/15/daya-bay-first/

<comment><USER2> OP: can you fix the title? It's "Lawrence Berkeley National Laboratory" (include 'Berkeley' so people don't get it confused with Lawrence Livermore, which is named for the same person, E.O. Lawrence, but is in Livermore, CA) (fix spelling of Laboratory)</comment>


The mystery of Julian Assange's cat: Where will it go? What does it know? - <AUTHOR> https://www.washingtonpost.com/science/2019/04/12/mystery-julian-assanges-cat-where-will-it-go-what-does-it-know/ <comment><USER2> Well, the cat better not state it has information that will lead to arrest of Hillary Clinton.</comment>


Ask HN: May you list some HN-like sites? - <AUTHOR>

Some example:
http://www.cryptocurrencylive.com
http://www.datatau.com
http://news.dbanotes.net <comment><USER2> [http://www.boredbanker.com/](http://www.boredbanker.com/)</comment>


Stack Scripts: Library of Linode Deployment Scripts - <AUTHOR> http://www.linode.com/stackscripts/

<comment><USER2> While I'm a big fan of Linode, and make frequent use of Stack Scripts, it seems kind of random to post a link a feature that's nearly a year old...

<comment><USER3> I'm sure there are plenty of Linode users that don't know about this feature, or even long-time users that never bothered to read up about it.

<comment><USER4> stack scripts were the reason i chose to move away from mediatemple and slicehost...</comment></comment></comment>


A Note from one of Cloudflare's upstream providers - <AUTHOR> http://cluepon.net/ras/gizmodo <comment><USER2> > This is definitely on the large end of the scale as far as DoS attacks go, > but I wouldn't call it "record smashing" or "game changing" in any special > way. It's just another large attack, maybe 10-15% larger than other similar > ones we've seen inthe past

Heh. Nice. Yeah, I expressed skepticism that 300G/sec qualified as "largest ever" - I mean, I personally have been hit by 10G+ attacks, and Cogent mostly shrugged. (I mean, my cogent side was down until the target was blackholed at the cogent border.) I know 10 gigabits is a lot less than 300 gigabits, but I am a nobody compared to the people involved in this little kerfuffle.)

<comment><USER3> Can you describe Cogent's reaction to your request to blackhole the route? We had a very small incident with XO recently (perhaps 500Mbps reflected DNS flood), and it took them 24 hrs to get back to me to blackhole the target! We just packet filtered in our edge switch. Was Cogent any faster?

<comment><USER4> If you run a network of any size you should be speaking BGP with your upstream, even if its using a private AS. You can then announce a prefix to them specially tagged with a "blackhole community" that drops traffic at the edge of their network.

The exact details vary by network, but here is how Hurricane does it <http://www.he.net/adm/blackhole.html>

<comment><USER2> Yup. The details are slightly different for Cogent (I think we had it setup as a separate BGP session rather than as a community tag like he.net does it, but that was because my customer requested it that way.)

But yeah, you give them /32s to null, and they drop those /32s at the network edge.

It stops the attack, well, almost immediately, but the problem is that it kills the target site completely.

(well, often people have web frontends to this, which, well, work poorly when your pipe is completely full, and for that matter, just getting the bgp data to your peer can take a few tries. but yeah, it's still pretty quick and effective, compared to calling someone to whine.)

What we really need is to get everyone to implement bcp38 anti-spoofing rules. If everyone did that, we'd be able to block the sources of the problem, rather than the destination. But, well, that's unlikely to happen, so for now, you just, ah, finish the job.

<comment><USER5> This is what I don't understand about DoS mitigation. So i'd null route the target, but then I have to move the service to another IP. I will also announce this IP to the customers, but that would simply redirect the DoS to the new address and take it down too... I mean, there seems to be no way to deal with DoS without throwing a baby (customers) with the water (attackers) or am I missing something?

<comment><USER6> Well services like Cloudflare or Blockdos try to mitigate this problem by absorbing the bad traffic and filtering it so that it is spread out across nodes and then dropped by firewalls with custom rules.

<comment><USER5> I don't follow. How do they know which traffic is "bad" and which is legit?

<comment><USER6> With ordinary DDoS attacks an effective method (which Cloudflare uses) is to prompt you with an captcha before letting you pass or dropping your connection when you fail often enough. As far as I understand it was not that hard to block this attack because it follows traffic patterns (DNS responses from open resolvers). The actual problem was that the attack was so massive that it clogged the pipes before it could reach a router (belonging to Cloudflare) that would've been able to drop the packages.

Disclaimer: I am no network engineer so don't rely on my reply being factually 100% correct.

<comment><USER5> Captcha. Right.

</comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER7> I never read the Gizmodo piece, because I think they're mostly trolls, but I really liked this response. Kudos to him.

<comment><USER8> The Gizmodo piece was better journalism than the nytimes or bbc articles which regurgitated Cloudfare's over the top PR uncritically.

<comment><USER9> I disagree. Calling the story a straight-up lie was a mistake, and link bait to boot. I thought Biddle failed to understand what the risk to "The Internet" truly was, and how an attack like this (based on a known architecture vulnerability), if repeated or made more common or effective, could cripple a tier 1 provider and cause serious routing issues, among other things.

</comment></comment></comment><comment><USER10> That was a very nicely worded response that echos what, I hope/believe, most of us think.

Plus; that was in ASCII. Damn. :)

<comment><USER11> Word. Respects given to serving in text/plain (as is proper in this context).

<comment><USER12> Uber respect if the file had gzip content-encoding.

<comment><USER13> Or if the output was gzip without encoding header. The FBI will be all over your place the next day with a warrant for the encryption key :D

</comment></comment></comment></comment><comment><USER14> For those of you who don't know Ras is one of the people that run/ran nlayer (now part of GTT) which is Cloudflare's primary provider.

<comment><USER15> RAS has been pretty awesome in the community. He was actually the cofounder of the company we called nLayer. He's given a bunch of very valuable "101" talks at NANOG (think of this as the Hacker News for networking people), and until the acquisition, he was pretty active on the mailing list.

</comment></comment><comment><USER16> What if this had been Akamai and not Cloudflare? Would we even hear about it? Why is Cloudflare in the news regularly and never Akamai? Do they just like drama? Is that good or bad for their business?

<comment><USER17> Cloudflare uses it as advertising. "Look at this attack we mitigated for our client!", which then gets picked up by HN and similar sites because Cloudflare does write fairly good blog posts about it. As others have said, Cloudflare does a fairly good job explaining parts of the internet that most of us don't get to see, so it gets attention.

<comment><USER18> It gets picked up by HN as CloudFlare post it to HN themselves.

That said they're interesting articles if you ignore the hype.

</comment></comment></comment><comment><USER19> > But, having a bad day on the Internet is nothing new.

That's my new quote of the year.

</comment><comment><USER20> It amazes me how little I know about overral internet traffic infraestructures

<comment><USER21> Same here. Can anyone point to a good starting point for someone who understands TCP/IP to start understanding the Internet topology?

<comment><USER22> You might want to check out the NANOG mailing list. There is also a list of Internet exchange points [1], these pages are packed with details about how many of them function.

TCP/IP and Internet topology are different things. Think of it this way, internet topology is the highway, and TCP/IP is a vehicle that travels the highway (along with UDP, ICMP, etc).

[1] [http://en.wikipedia.org/wiki/List_of_Internet_exchange_point...](http://en.wikipedia.org/wiki/List_of_Internet_exchange_points)

<comment><USER4> Just please don't post to NANOG when your cablemodem/DSL stops working. _sigh_

<comment><USER23> I had to post a response to this:

LOL for 1 minute...

Also: don't post if your business DSL stops working. Or your ISP. But maybe if you find your BGP from your upstream is poisoned/severely b0rken.

</comment></comment></comment></comment></comment><comment><USER24> This is a great writeup and aligns with what we saw at CloudFlare. The most interesting part of the attack was that the attackers went after the IXs.

<comment><USER24> PS - This was written by nLayer/GTT's CEO, one of CloudFlare's bandwidth providers. They have been a terrific partner and were extremely helpful as we mitigated this attack.

<comment><USER25> Would you mind explaining this piece of the story in a little more detail?

"When the attackers stumbled upon this, probably by accident, it resulted in a lot of bogus traffic being injected into the IXP fabrics in an unusual way, until the IXP operators were able to work with everyone to make certain the IXP IP blocks weren't being globally re-advertised."

It's pretty fascinating and I think most of the HN audience, myself included, would be able to understand the actual technical detail.

<comment><USER26> Updated with a few more details for you (but still trying to keep it in laymen's terms for those who don't do advanced networking). I wasn't really expecting this thing to take off or get linked anywhere, it was just a dump of the e-mail I sent this morning so I could link it to Facebook. :)

<comment><USER27> Thanks for the very informative write up!

I have to smile when people are praising you for the plaintext writeup whose purpose was to link from facebook. It's like saying you finally got your house fully off-grid using your hand made windmill that generates power so you can watch the Kardashians. ;)

<comment><USER28> This may be the only HN comment I've ever committed to Evernote. Well played :)

</comment></comment></comment></comment></comment></comment><comment><USER29> Fantastic response. Thank you so much for writing and sharing. Cuts through all the spin and FUD effectively.

</comment><comment><USER30> This incident drives home the fact that there is no one entity responsible for "The Internet." It is run by a network of for-profit companies, governments, and non-profit public and private standards bodies.

</comment><comment><USER31> >The next part is where things got interesting, and is the part that nobody outside of extremely technical circles has actually bothered to try and understand yet.

Isn't this talked about in CloudFare's write-up?

</comment><comment><USER32> I think this just reminds everyone that as large as google, facebook, etc seem to be, they are just a small part of this huge global network we humans have created.

As large as Google, Facebook, Amazon, etc is on the web, the major telcos have to be even larger (in terms of network size, capacity, amount of fibre, switches, datacentres) in order to carry the traffic.

<comment><USER33> That's only true to a point. In addition to the consumer-directed packets, large volumes of traffic for Google and Amazon never leave their networks. Shuttling data between datacenters for Google; moving data within the many cloud services of Amazon; or transferring between the two companies (e.g. GCS to S3). This means it's no longer a given that telcos must be larger.

The closer we get to living "in the cloud", the more our traffic can be seen as a window into operations taking place within and between cloud services.

</comment></comment><comment><USER34> My first reaction to these kinds of news is fear. As someone who builds stuff for the web, I really hate the idea of some malicious being trying to purposefully ruin your work.

My second reaction is that of "bring-it-on". Basically this is an impulse for improvement, and as with any major threat you either stand your ground or get run over.

</comment><comment><USER35> Nice response, nice sentiment, nice format. I often dislike the sensationalism surrounding attacks or viruses - it makes people distrust and gives others excuses for issues.

</comment><comment><USER36> Richard you can hit me with your cluepon any day.

</comment><comment><USER37> Related, <http://cloudscare.com>

</comment><comment><USER38> Straight up Lie. Talking with Google Engineers, and Amazon Engineers they say this is not happening. So unless someone picked a fight with CF, it is more likely CF is just having a bad day.</comment>


The Fight Over Free Speech Online – The New Yorker - <AUTHOR> http://www.newyorker.com/magazine/2017/08/28/the-fight-over-free-speech-online <comment><USER2> >Smith claims that his activism wasn't doxing. "If these people are so proud of their beliefs, then they shouldn't have a problem with their communities knowing their names," he said last week.

I understand the need for justice, and I believe people do this with (initially) good intentions - but it's witch hunting. The problem with trying to dox/shame people it that things get out of hand very quickly and it's hard to separate the truth from the justice mob mentality. The reddit/boston bombing situation is a good example of this.

I also take issue with the need to expose peoples identities because of a disagreement on political views. The people that demand exposing these protesters in the name of justice are the same people who are paranoid about big tech selling their private data without permission, and otherwise champion privacy.

</comment><comment><USER3> "When private companies take down Web pages, it isn't a First Amendment violation, but it does enrage many on the right."

The right, and anyone who still remembers [https://en.wikipedia.org/wiki/Jane_Akre#Whistleblower_lawsui...](https://en.wikipedia.org/wiki/Jane_Akre#Whistleblower_lawsuit)

But I'm sure the _current_ corporate gatekeepers of speech would never do such a thing as silence reports they don't like.

Whoops: [http://gizmodo.com/5882102/mythbusters-was-banned-from- talki...](http://gizmodo.com/5882102/mythbusters-was-banned-from-talking- about-rfid-chips-because-credit-card-companies-are-little-weenies)

Well, 5 years is a long time to change their ways.

Whoops again: [https://www.nytimes.com/2016/05/06/business/media/cartoonist...](https://www.nytimes.com/2016/05/06/business/media/cartoonist- fired-from-farm-news.html?mcubz=0)

But hey, I guess the people listening thought they were assholes, and showed them the door: [https://xkcd.com/1357/](https://xkcd.com/1357/)

<comment><AUTHOR> Isn't there a world of difference between, say, blocking someone from commenting on your blog, or even booting someone off twitter, and blocking domain registration?</comment></comment>


ShowHN: Hacker Tourist - opinionated ecommerce for photographers - <AUTHOR> http://hackertourist.com/

<comment><AUTHOR> I'm totally eating my own dog food on this one. I figure that I can't sell something I wouldn't use myself, so here goes my best attempt at making a living with photography that doesn't involve babies or weddings.</comment>


GraphQLize: JVM library to build GraphQL API instantly from PostgreSQL and MySQL - <AUTHOR> https://www.graphqlize.org/blog/announcing-graphqlize-alpha <comment><USER2> I feel that by using these types of tools you could really miss out on a fantastic opportunity to create a schema that models the business domain as accurately and elegantly as you want to make it, regardless of the underlying service topology or the databases behind it.

That's what I find the most attractive about GraphQL. Large companies and companies that have grown fast often have all kinds of APIs made at different time by different people with different standards. GraphQL lets you paper over that without breaking existing, revenue making code.

<comment><USER3> If you really do that, people tend to accuse you of doing RPC and not building a "true" API, because you're creating a lot of special case functions for the remote caller's business case.

<comment><USER4> That is _exactly_ what GraphQL is designed to do. Taken straight from the spec:

> Product‐centric: GraphQL is unapologetically driven by the requirements of > views and the front‐end engineers that write them. GraphQL starts with their > way of thinking and requirements and builds the language and runtime > necessary to enable that.

The whole point of GraphQL is that since each client asks for exactly the fields they want, having those "special case functions" is not a problem because other clients don't need to ask for those fields.

<comment><USER3> I was speaking of higher-level abstractions than that. For instance, do you have your API allow all possible arbitrary aggregations for your data or do you only special case the 3 or 4 that are pertinent to your business model?

Doing the former leads to basically reimplementing SQL in GraphQL. Doing the latter leads to functions like `resolve_month_over_month_profit_and_loss_segemented_by_sector`.

<comment><USER2> There can be a lot in-between here. You might end up with something like `Report(type: PROFIT_AND_LOSS, unit: MONTHLY, segment: SECTOR)`

Like every tool, there's a sweet spot where it really shines and others where it doesn't fit. If you need to have access to a bunch of disparate datasources it's really nice to have that layer of abstraction.

</comment></comment></comment></comment></comment><comment><USER5> For the love of god, this is never how GraphQL was intended to be used. The official graphql website is very clear:

[https://graphql.org/learn/authorization/](https://graphql.org/learn/authorization/)

> Delegate authorization logic to the business logic layer

If you take security or performance debugging seriously, you should never expose database models through APIs directly in a production app.

To illustrate, say you have an Employee model:

      query {
          employee(userId=uuid) {
              name
              salary
          }
      }

Say you add some hacks on top of this to only allow users to query their own employee data, believing this provides adequate security.

The next day, someone creates a Manager object, a relation from employee to Manager, and Manager to employee.

Now, without having consider security for a second, you've granted all employees the ability to query each other:

      query {
          employee(userId=uuid) {
              name
              salary
              manager {
                  employees {
                      name
                      salary
                  }
              }
          }
      }

To say that these problems occur in the wild frequently is an understatement. Since these graphql frameworks also expose introspection capabilities, discovering these exploits can be automated using crawlers. If you write a bug like this, and you will, people will find it.

Please, please stop encouraging people to directly expose their databases through an API.

<comment><USER6> The solution to this should be to use the db's security/permissions model.

For example, with postgres: [https://stackoverflow.com/questions/49261452/combining- row-l...](https://stackoverflow.com/questions/49261452/combining-row-level- security-with-column-grants)

<comment><USER7> i was thinking this, too. [http://postgrest.org/en/v6.0/](http://postgrest.org/en/v6.0/) comes to mind. Its security is based on postgres user permissions.

<comment><USER8> Separate DB user per application user makes connection pooling difficult. And PostgreSQL has more costly connections

<comment><USER9> Pgbouncer

<comment><USER8> Does that help with fragmentation though? If the connecting user must be the same then it doesn't add much, except lower connection latency.

</comment></comment></comment></comment></comment></comment><comment><USER10> [https://hasura.io/](https://hasura.io/)

</comment><comment><USER9> [https://github.com/graphile/postgraphile](https://github.com/graphile/postgraphile)

</comment><comment><USER11> Been playing around with GraphQL in the last day or so and just can't see any reason to use it over REST (or REST + an ORM). Am I missing something? Is it just so people don't have to learn SQL?

<comment><USER12> Client-side shaping of queried data without directly writing SQL against a back-end database, and without having to pre-arrange queried data structure with the back-end.

<comment><USER13> Wouldn't SPARQL be a better choice for this? It's an actual Web standard, unlike GraphQL so a better fit to general-purpose clients with no "pre- arranged queried structure".

<comment> miles-po SPARQL is a flat result set, just like SQL. Also so much like SQL, it's not actually an advantage over SQL, just removed from a relational database.

GraphQL is hierarchical. The queries look substantially like the output JSON. SPARQL (and SQL) require training. With a common tool like GraphiQL or Playground, queries are simple enough and abstracted enough (am I querying Redis, PostgreSQL, S3, or some combination?) that clients don't have to know much of anything except what data they want. That's huge.

It puts the onus on server developers to audit their data and security models, but they should be doing that anyway no matter what the stack looks like.

</comment></comment></comment></comment><comment><USER14> Nice! Is it stable enough for production? Or at least as stable as PostgREST?

<comment><USER15> No. The web page says he expects it to be ready in a few months.

</comment></comment><comment><USER16> Interested in comparing with Postgraphile. Besides JVM vs TypeScript.

<comment><USER16> Looks like early day project. Had this exact project in mind when working with Postgraphile. JVM tooling around databases are amazing. Using clojure on top of that foundation with honey-sql was something I wish existed. Good luck! I might look into helping build it someday.

</comment></comment><comment><USER17> Based on how polarized the feedbacks are, I think they are onto something :). Auto generated graphql schema May replace FileMaker and Access one day

</comment><comment><USER18> This approach can be super helpful for dealing be with reference data... See [https://clearpoint.digital/blog/struggling-with-reference- da...](https://clearpoint.digital/blog/struggling-with-reference-data-heres-a- great-approach/)

</comment><comment><USER19> I have been planning a graphql adapter for presto, so we can query graphql apis as though they were sql tables.

I guess it is inevitable that somehow some sql database will be exposed via graphql, and someone will use something like presto to make it appear to be an SQL database again...

</comment><comment><USER20> Another interesting point is a library written in Clojure and designed to used in both Java and Clojure

</comment><comment><USER21> Why is it so important that it runs on the JVM?

<comment><USER22> If all it provided was an API server then it wouldn't really matter. But this is pitched one level down ie: you can integrate this into your existing app as a library and expose it. I don't know what the utility of that is, but I'm kind of assuming it might mean you can add in interceptors and business logic to customise the API behavior which I think is pretty useful.

So the fact that it lets you do this with any JVM language is actually a key property that gives it very wide application.

</comment></comment><comment><USER23> hasura

</comment><comment><USER24> I understand this stuff is "cool" but this is only one step removed from db->query(input[sql]). I'm not talking about SQL injection either, I'm talking about wholesale data exfiltration of your entire database because you've auto- generated some slick GraphQL API and you don't take the time to think through what should, and should not, be exposed to end users or bother to implement any form of access control.

<comment><USER25> Security is done via row level access control, a system that is vastly better then the ad-hoc systems people reinvent outside the database for every application.

You also absolutely take the time to think through what should and should not be exposed to end users. Either you creates a namespace for your API with views that expose only the necessary data, or with something like Postgraphile you can specify which functionality, columns, and tables are hidden. Personally I prefer the view approach as it decouples your API from the database implementation.

<comment><USER26> RLS is one of the shittiest things about Postgraphile and why I decided against for one project and am doing my best to root it out of a current project.

RLS is difficult to unit test, to configure with flags, not portable to secondary stores, and requires knowledge of arcane database features.

When you put some private data on a cache somewhere and query it, now you need to write your access layer twice since the other one is so tightly coupled to the database.

<comment><USER25> We'll have to agree to disagree. Writing a manual security layer that doesn't understand your data model is one of the worst things you can do. Multiple databases? Now you're also manually doing integrity and probably manually doing joins. That's a ton of extra things to go wrong.

As an example, consider a query that is fairly complex. How exactly are you going to make resuable security tests for it? How do you know that an error in the query won't expose unexpected data, or that a modification to the query that introduces and error exposes unexpected data? Your security now has to be customized to every query like this.

The alternative case is that you only use super simple queries so that you can write resuable security checks. But now I'm going to ask why you are using a relational database in the first place? Because almost certainly you're doing manual joins in this scenario and incurring huge performance hits.

If you are using a relational database to its full extent, there is nothing as secure as built in row level security. You wouldn't dream of doing integrity checks outside the database, why do security?

<comment><USER27> > If you are using a relational database to its full extent, there is nothing > as secure as built in row level security. You wouldn't dream of doing > integrity checks outside the database, why do security?

This isn't exactly PostgreSQL's fault, but mapping application users to database roles is not as easy in pretty much any framework I've worked compared to implementing basic post-retrieval filters.

I absolutely think bringing security into the database is good, but it's also not straightforward to integrate in even assuming you know how to define the necessary database elements.

<comment> miles-po If you're trying to map app users to DB users for more than 1,000 users, you're doing it wrong. Roles at that scale tend to be more vague: admin, hr, analysis, etc. Users (and tags) go in a table. Then row-level security authorizes through the user table for individual queries.

Row-level security is absolutely not dependent upon DB roles. Table-level security on the other hand is sufficiently coarse-grained that mapping GRANT/REVOKE to applied roles should be feasible.

If you're punting all of this security to the app layer, that's your prerogative, but don't pretend that it's somehow more straightforward or secure. If it seems simpler at the app layer, you may very well be missing something.

<comment><USER27> I'm talking more along the lines of "hr user logs in, now you need to SET ROLE for the request and make absolutely sure RESET ROLE is called when the connection goes back to the pool". A lot of frameworks make this harder than it needs to be.</comment></comment></comment></comment></comment></comment></comment>


Globalization Is Not in Retreat - <AUTHOR> https://www.foreignaffairs.com/articles/world/2018-04-16/globalization-not-retreat <comment><USER2> Those AlphaEdge4Ds though...</comment>


Every Application Fails in Unique but Predictable Ways: A Study in Zoom - <AUTHOR> https://rethinksecurity.io/posts/every-application-fails-in-unique-but-predictable-ways-a-study-in-zoom/ <comment><USER2> The main lesson to be learned from Zoom is that you can be known for shipping insecure products and there will be absolutely no repercussions in the marketplace. Any startup CEO who invests in security is failing at their job.

<comment><USER3> It probably also helps if you're already at the top and have a product people generally like and prefer to the competition. Something like this could possibly kill a company before they get off the ground. But once they're established and everywhere, it takes a whole lot for users to care enough to stop using something they otherwise don't have strong issues with.

It also helps if there's a tangible issue that end users actually see or feel. Zoombombing is an example, but it's easily prevented (unless there's an internal collaborator on the call intentionally leaking the meeting ID and password), and they can do various things to address that.

Other examples would be some sort of worm infecting computers through the Zoom client, or direct evidence that any stranger could've been or was spying on _their_ calls undetected (rather than the more abstract China routing and E2E issues).</comment></comment>


The world's first computer made entirely with Carbon-nanotube FETs. Meet Cedric. - <AUTHOR> http://www.nature.com/nature/journal/v501/n7468/full/501495a.html

<comment><AUTHOR> The paper published online in Nature today is here: [http://www.nature.com/nature/journal/v501/n7468/full/nature1...](http://www.nature.com/nature/journal/v501/n7468/full/nature12502.html)</comment>


Twitterlogical: The Misunderstandings of Ownership - <AUTHOR> http://www.canyoucopyrightatweet.com/

<comment><USER2> Excellent, excellent post on the topic!</comment>


Best Tools and Strategies for Software Project Management - <AUTHOR> https://brainhub.eu/blog/2016/11/04/best-tools-strategies-for-software-project-management/ <comment><USER2> Not very easy to read

[http://i.imgur.com/G7ivBBs.png](http://i.imgur.com/G7ivBBs.png)</comment>


Introducing Unity 2017 - <AUTHOR> https://blogs.unity3d.com/2017/07/11/introducing-unity-2017/ <comment><USER2> Has anyone tried unity services? How have you found them? The more in depth the better as i am thinking about using them in the next couple weeks</comment>


Steve Jobs talks technology and Apple in this video from 1995 - <AUTHOR> http://thenextweb.com/apple/2011/11/02/watch-steve-jobs-discuss-apple-technology-and-his-life-in-this-1995-interview/ <comment><USER2> Apropos, sorta: do I ever identify with Jobs' statement about "getting the curiosity beat out of you" in school. I was "the smart kid" until I decided I wanted to fit in, so I stopped going after the math and science as aggressively. I've always felt like I gave part of my brain away to be "cool" that I'll never get back.

<comment><USER3> Social curiosity is valuable too

</comment></comment><comment><USER4> Interesting to see him mention the 'Live each day as if it would be your last...' quote here (and again a decade later in the 2004 commencement speech)

</comment><comment><USER5> Is there a version that doesn't hang all the time?

<comment><USER6> yeah that's so annoying - if you look in the Net panel in firebug, you can get the flv file url and download it from there (it's about 2GB)</comment></comment>


Machine-checked explicit state: An arrow in the heart of complex web apps - <AUTHOR> https://blog.reifyworks.com/machine-checked-explicit-state-an-arrow-in-the-heart-of-complex-web-applications-bbe1ef2038ed <comment><USER3> I'm not sure that Elm architecture really solves the fundamental problem, so much as just moves it to another layer.

If you have a big global model, with messages modifying that model, then eventually you're going to notice that many places in that model are similar. E.g., widget state for identical widgets on different parts of the page. So you tag the messages that pertain to a particular widget with some kind of coordinate into the global model, and then you call generic widget code with the local widget state as an argument, and the message, to produce a new local widget state. Congratulations, you've reinvented objects.

<comment><USER4> I've looked into Elm a little bit, read the docs and watched the videos, and I tend to agree with the first paragraph. The architecture is mostly about how to handle updates to a single state machine and render it. There is no deep insight about how to compose stateful components into larger stateful components, and up and up, to build a sophisticated app without things getting out of hand, except: "A component is just a module with types and functions. Compose them however you want." As people build more and more sophisticated widgets with Elm, it pushes the state of the art in this respect, but the problem is still there as far as I can tell.

<comment><USER5> I think that Elm's deep insight into composing stateful components is that _if you keep important state hidden inside components, it will always hurt_.

<comment><USER4> "Hidden" isn't the same as implicit. State might be hidden in the sense that it is encapsulated. For example, sometimes we want to treat a text field component as just an "editor for a string value," without worrying about the cursor and selection state, or the state of the autocomplete dropdown if there is one, etc. That said, in the fullness of time, you do eventually find yourself wanting access to this state for some purpose or another.

Every time you use an HTML input tag, you are using an abstraction over state, and the first time you need access to the input element's cursor and selection, you realize you've been pretending the element had less state than it had, which is a pretty useful thing to do.

If I can write a form component that needs an "editor for a string" component, specified as a type, and fill that need with a "fancy editor for a string" component that has a more elaborate model that I can abstract away, then I think we're in business, but I can't quite picture how that would work.

</comment></comment></comment></comment><comment><USER6> > state is the stuff that changes. In the Elm architecture, State has to be > represented in code, in a very specific way, for it to be available in your > application to your users.

I don't understand this. There's a lot of things that is "available in the application to your users" that is outside of the control of Elm - <USER2> example, the text selection, scroll position, window position and resolution...

> With Elm, there's no place to "hide" state in your application that aren't > threaded through the type checker

State isn't so much hidden as collaborative. Multiple components participate and have a need to store independent UI state. For example, a table component might want to control scrolling, filtering, and selection state, while delegating populating the row data to the app.

Is it possible in Elm to allow separate software components to maintain their own independent states, without requiring some god-component to have global knowledge?

<comment><USER5> Detailed UI state like scrollbar position usually isn't interesting in the sense that you would need to directly respond to it, share it, persist it, etc. That's why you don't usually include it in your application model.

State being collaborative is precisely the problem. If all the components owned important state, they would need to share it with each other. This gets real complicated very quickly, especially when multiple parts of the app need to change that state.

So the main proposition of Elm is exactly that separate components should not hold important state and whatever that needs to be shared should be centralized and modified in one place. Which sounds like the God Object antipattern, but is not, mainly because you can only change the state indirectly, by sending well-defined messages.

</comment></comment><comment><USER7> Maybe better titled "Type-checked explicit state" ..."?

<comment><AUTHOR> Maybe! But I liked separating it from type-checking for the sake of the title.

</comment></comment><comment><USER8> Sounds a lot like Redux?

<comment><AUTHOR> I think the ideas are similar, but does Redux have the statically checked component? That's the killer here.

<comment><USER9> If you use redux with a type checked language like TypeScript or Flow it does.

<comment><USER10> Not without conscious effort on the part of the developer. I almost wish there were a Typescript-first re-implementation of Redux.

<comment><USER11> Redux makes it a bit annoying with the actions/actions creators. I've switched my project (written in TypeScript) from redux to mobx and, since it's just calling normal functions, everything is typed without making any extra effort.

</comment></comment></comment></comment></comment><comment><USER12> This doesn't make much sense to put in the view. The view is the state and the data that is not visual or the representations of the visual (checkbox :checked = 1 otherwise 0 in the model) isn't solved by this. You have now just made the whole view more complicated. Your webservices (or equivalent datasource layer) should have these guarantees about service availability and data formats checked by both sides. I don't understand how this is an innovation, since checking the contextual data representation in multiple layers does nothing to address the complexity. Also, testing is increased by spreading it over development time, to solve message format issues...leaving the sinister reality that models are often either mistranslated to/from visual elements or there are business logic conditions that are unaccounted for. Complex systems are named such, when you cannot remember every single control in every state. That only takes a few weeks of coding to achieve.

</comment><comment><USER13> uhh so is this supposed to be web devs meet state machines?

I see they've invented a new name to label the innovation as such.

<comment><USER14> Yes, because of course every state machine use is the same thing, regardless of the domain and other considerations...</comment></comment>


We can't send mail more than 500 miles - <AUTHOR> https://www.ibiblio.org/harris/500milemail.html <comment><USER2> One of my favorite stories, from 2002.</comment>