Morris Worm Incident Report #1 (1988) [pdf] - <AUTHOR> http://foofus.com/amuse/public/Morris_Worm_Incident_Report_1.pdf <comment><USER2> I remember this very well because I'd had JANet/Internet access since 1986 and was using Internet system daily at the time and for a period we had no Internet access. That didn't matter that much because I just couldn't access various Usenet newsgroups and anonymous FTP servers.

I remember thinking it was totally awesome.

Awesome because it was a demonstration of the power of this individual and what could be done with software and got me thinking seriously about computer security. A year later I opted to stay at university and do a doctorate in computer security.

That doctorate brought me into contact with RTM's father who was a terribly decent chap also named Robert. He used to come to the place I was with his wife. The first time I met him I misheard his wife's name as "Alice" (instead of "Anne"). I mistakenly thought that that they were the Alice and Bob in all cryptographic examples.

<comment><USER3> Yes I think we all recall it. What I found funny was that his farther was head or very high up with the NSA at the time.

But he was just playing what if and old school hacking with no intention of causing what he did, though he did badly think thru what he was playing around with. but we all make mistakes playing and learning, though usualy less public.

</comment></comment><comment><USER4> I was a teenager when this happened. RTM's worm probably started a number of security careers and brought career peak levels of excitement to many of the people involved with analysis. I remember being absolutely astonished that someone writing computer programs could cause such a commotion. Some people must have realized that it was a good thing that awareness was raised. I have a hard time putting much stock in the pretend damage estimates.

<comment><USER5> I was a college graduate with a degree in Computer Science and a dim awareness of the Internet. I remember being astonished to see an article about my esoteric field of work on the front page of the Washington Post, and wondered if maybe it wouldn't stay esoteric much longer.

<comment><USER6> I'd just started college and witnessed some of the havoc. Suddenly the Internet was a big topic of discussion, at least among the engineering students, everyone wanted to get email addresses and so on. It suddenly was in everyone's consciousness, but it was another 2-3 years before you could easily get 'on' the Internet.

</comment></comment></comment><comment><USER7> Does anyone know what came of this awful cyber terrorist? Given what we wanted to do Aaron Swartz, and what we are going to do to Weev, this guy should be facing capital punishment by comparison.

 _Edit: Haha, downvoted already. I'm kidding of course. I am a fan of rtm, and the eponymous worm._

<comment><USER8> <http://news.ycombinator.com/item?id=5078424>

Swartz, RTM, sure, but Weev? You can't seriously put weev in that list.

<comment><USER7> You can put him in that list only if you look at his crime objectively, and divorce that from the person you don't like. Which is an important thing to do when handing out justice.

Downloading and deleting a list of emails is not worse than spreading an internet-crippling worm. Nobody can make that argument with a straight face.

</comment></comment></comment><comment><USER8> Here are some other writeups:

Here's Eugene Spafford's write up: ([http://docs.lib.purdue.edu/cgi/viewcontent.cgi?article=1701&...](http://docs.lib.purdue.edu/cgi/viewcontent.cgi?article=1701&context=cstech))

Page 26

> However. at a recent meeting, Professor Rick Rashid of Carnegie-Mellon > University was heard to claim that Robert T. Morris, the alleged author of > the Wann, had revealed the jingerd bug to system administmtivc staff at eMU > well over a year ago.

Here's Seely's "Tour of the Worm" ([http://www.cs.unc.edu/~jeffay/courses/nidsS05/attacks/seely-...](http://www.cs.unc.edu/~jeffay/courses/nidsS05/attacks/seely- RTMworm-89.html))

> These notes describe how the design of TCP/IP and the 4.2BSD implementation > allow users on untrusted and possibly very distant hosts to masquerade as > users on trusted hosts. [Robert T. Morris, "A Weakness in the 4.2BSD Unix > TCP/IP Software"]

Here's Mark W. Eichin's and Jon A. Rochlis' "With Microscope and Tweezers" (<http://www.mit.edu/~eichin/virus/main.html>)

<comment><USER4> Spafford's write up is such a hoot. He complains about suboptimal file descriptor closing. Clearly, whoever wrote that worm (that targeted VMS and Unix in one worm, used numerous exploits, probabilistic replication, and required 40 pages of analysis) was some kind of mentally-challenged individual. Terrible, terrible ad hominems.

</comment></comment><comment><USER9> I was up late hacking during the night it happened, and was getting really pissed off how slow the system (a Vax 8600) was running, because sendmail was going ape-shit!

Anybody else remember when Jordan Hubbard tried to see what happened when he rwall'ed to a wildcard yp net group that included every computer in /etc/hosts? He received a whopping 743 email messages in response to it! "One of the people who received my message was Dennis Perry, the Inspector General of the ARPAnet (in the Pentagon), and he wasn't exactly pleased. (I hear his Interleaf windows got scribbled on)"

<http://catless.ncl.ac.uk/Risks/4.73.html#subj10.1>

</comment><comment><USER10> I remember at the time reading usenet postings about the worm as it spread, and I got the impression that for a couple of days many people really didn't know what was happening. The response was very improvised. I was an intern at IBM in 88-90, and all gateways between IBM's internal network (VNET at the time) and the internet were cut without warning - even though I doubt that IBM had many VAXes or Sun3s.

I'd also read Neuromancer the previous summer and me as a twenty-year-old thought this was all rather exciting...

<comment><USER9> It was more like "The Adolescence of P-1": <http://en.wikipedia.org/wiki/The_Adolescence_of_P-1>

</comment></comment><comment><USER9> Immediately after the Morris worm hit, somebody posted a patch to edit the sendmail binary, to keep it from switching into debug mode, and that was to patch the "DEBUG" command by replacing the "D" with a null. It certainly stopped the worm, but at what cost?

Well in my usual day-to-day mailing list administration, I telnet'ed to sun.com 25 to validate some email addresses, and pressed return a couple time to clear out the telnet protocol negotiation characters. Then I EXPN'ed an email address, and it dumped out a shitload of debugging information!

Turns out that "patch" to sendmail just turned the "DEBUG" command into the "" command, which I had entered by pressing return a few times at the beginning of the session!

I reported it to firstname.lastname@example.com and they closed that particular hole. Lesson: Don't just blindly apply binary patches you see on the net to system programs, without thinking about them first.

</comment><comment><USER11> I was reading this just last week for fun, can't remember why :)

Worm source code: <http://www.foo.be/docs-free/morris-worm/worm/>

Mailing list from 1988: <http://securitydigest.org/phage/bythread>

</comment><comment><USER12> With some elite shell scripts to boot. It's nice to know that if your primary skills in 1988 were UNIX, C, and shell scripting, should you be magically transported 25 years into the future, those same abilities would allow you to feed a family of four in 2013.

</comment><comment><USER13> How the hell has no-one mentioned Clifford Stoll's "The Cuckoo's Egg" yet? <http://www.amazon.com/dp/1416507787>

</comment><comment><USER14> Give it a rest! Why can't some people around here give RTM some slack? It was a long time ago. Time has show RTM to be super smart and successful, but dredging up this one inflammatory incident ever few weeks and posting it ON HIS SITE is just pathetic karma whoring.

How about next time we discuss his more amazing accomplishments like the continuation passing framework he developed for ViaWeb, or his efforts at YC, or his work developing and maintaining this very site?

<comment><AUTHOR> If it makes you feel any better, this PDF was just digitized and linked via the netsec community on reddit: [http://www.reddit.com/r/netsec/comments/19fyfr/recently_unco...](http://www.reddit.com/r/netsec/comments/19fyfr/recently_uncovered_in_a_dusty_file_cabinet_in_my/)

And was the first I had ever heard/read of the Morris Worm (though I assumed it would be well known to most). I'm a physical security guy w/0 digital security experience. Half of my friends are on the other side of the security aisle, though, which is why I bum around the netsec boards and enjoy the history of both fields a great deal.

I promise it genuinely wasn't intended as karma whoring. I actually assumed a long PDF would get limited attention here just due to the format. Only linked it because I was personally enthralled. I've really enjoyed reading the other posters share their memories of this moment in computer security history. It has added a context I wouldn't get most other places.

<comment><USER14> If you didn't know, I don't blame you, and I hope I didn't offend you too badly. At one time, long ago, before HN got popular, everyone around here knew who RTM is and knew he is one of the people responsible for giving HN to all of us.

These days, it seems most people don't realize that RTM is the "man behind the curtain" -- the real wizard pulling all the levers to make HN work. Sadly, some of those who do know of his efforts and involvement here act like jerks. They repeatedly bring up that one controversial thing he did a long time ago because it's excellent vote-bait, and they ignore all of the more amazing things he's done.

If someone showed up at your party at your house with your friends and repeatedly talked crap about the one controversial and possibly embarrassing thing you did eons ago in your reckless youth, then you'd not only want to throw them out, but you'd probably want to kick their ass. Even if you're too nice, reasonable, and civilized to actually kick their ass, you'd still want to do it.

You didn't know, but the repeated submissions about the Morris worm, and all the people up-voting them are being extremely inconsiderate and disrespectful. Maybe some people are envious of his success and are trying to take him down a notch by embarrassing him in his own house?

It's a truly legendary hack, and I giggled my ass off when it happened, but it's not "news," so why are so many people continuously reposting and up- voting it on a news site?

It's happened repeatedly, so can you really blame me for being skeptical of the real intent?

<comment><AUTHOR> Oh, I don't blame you at all! I really did want to be clear in my intent, not trying to knock you down a notch or anything, either. The example about inviting people to a party only to overhear conversations about your controversial/embarrassing "thing" strikes home for me, as I have some recent experience with that.

Thanks for taking the time to reply with details, by the way. I appreciate it.

</comment></comment></comment></comment><comment><USER15> What is this?

<comment><USER16> A very detailed report on an early computer virus called the Morris Worm (<http://en.wikipedia.org/wiki/Morris_worm>).

It's actually extremely interesting; the fix even goes into editing assembly if the source of the affect program isn't available to recompile.

<comment><USER17> It's also interesting to note that the worm's author went on to cofound YC.</comment></comment></comment>


Reasons to Prefer Ant Media Server over SFU - <AUTHOR> https://antmedia.io/5-reasons-to-prefer-ant-media-server-over-sfu/ <comment><USER2> Actually, I admired this technology and service.</comment>


How a Rundown Square Near Boston Birthed a Biotech Boom and Real Estate Empire - <AUTHOR> https://www.bloomberg.com/news/features/2018-10-05/how-a-rundown-square-near-boston-birthed-a-biotech-boom-and-real-estate-empire <comment> cbm-vic-20 > We started just with a business plan, a financial model and kind of a hope > that our $19 million that we raised from—you know—friends and family would > someday, maybe create a little company that could own a few buildings

I need friends and family who can scrape together $19,000,000.

(Disclaimer: I work in Kendall Sq., not in an Alexandria property)</comment>


Understanding Linux CPU Load - when should you be worried? - <AUTHOR> http://blog.scoutapp.com/articles/2009/07/31/understanding-load-averages <comment><USER2> There are two contributions to the load factor: number of processes/threads on the ready-to-run queue and the number blocked on I/O. The processes blocked on I/O show up in the "D" state in ps and top and also contribute to this number.

This article entirely ignores the number of processes blocked on I/O. A load average exceeding the number of CPUs (cores, whatever) does not automatically mean the CPUs are overloaded.

<comment><USER3> Not all processes blocked on I/O are in D state - for a common example, processes blocked on I/O to a network socket or terminal will simply be in the S state, and not count towards load.

<comment><USER4> In practice, processes typically go into D state ("uninterruptible sleep") when they're blocked on access to a local disk, whether that's explicit I/O (read/write) or implicit (paging). Not coincidentally, this is also the one type of blocking I/O that you can't get knocked out of by a signal.

<comment><USER5> Actually, they'll get blocked on access to NFS or other network-based disk, too. (but you can configure the NFS mount to allow signals to interrupt) I've seen NFS problems lead to loads over 100.

</comment></comment></comment></comment><comment><USER6> Three comments.

1\. I can't comment on the original article. Are comments closed, or am I dumb?

2\. The author seems to have assumed a web server responding to bursty traffic. Several people have pointed out workloads to which the 0.7 heuristic doesn't apply - compute servers, I/O bound servers, compile jobs, desktops. He should have stated that assumption up front.

3\. Hyperthreads. For purposes of load monitoring, you should be counting the number of threads, not the number of cores. Yes, hyperthreads are slower than cores, but that doesn't matter. The load average is the ratio of work available to work being done (oversimplified, I know), and, as such, it's scaled to the actual throughput of the threads available.

Fortunately, the author suggested counting CPUs by reading /proc/cpuinfo, and /proc/cpuinfo lists threads, not cores. So those two errors cancel out. (-:

<comment><USER7> Point 3 depends on the workloads. Most SMT [1] implementations replicate integer functional units - otherwise the threads would stall on basic things like computing addresses - but they don't replicate floating point units. So if you have lots of floating point heavy work, then you're limited by the number of cores, not the total number of SMT contexts provided by all of those cores.

So it's not that SMT pipelines are _slower_ , it's just that they share resources with the other SMT pipelines.

[1] Simultaneous multithreading (SMT), <http://en.wikipedia.org/wiki/Simultaneous_multithreading>, is the generic name for what Intel calls hyperthreading.

<comment><USER6> You are correct. I should have had two oversimplification disclaimers in that sentence. (-:

</comment></comment></comment><comment><USER8> I love reading stuff like this. As a kind-of sysadmin by need rather than by choice, I'm often confused and intimidated by systems that other sysadmins seem to be born knowing about. It's always refreshing to read a straightforward explanation for one of those important concepts that seems to be common knowledge for everyone but me, and never seems to be explained anywhere.

</comment><comment><USER9> Load average is an easy number to monitor, so lots of people focus on it. However, it doesn't provide you with much information. When your load is high, you have to examine other values (e.g. CPU time spent in user mode, system mode, and iowait) to determine why the load is high before you can start to resolve the problem. If you monitor and alert directly on those other values, you'll save time.

<comment><USER10> Exactly, looking at the load curves over time is useful to gauging how well you are doing overall and for spotting potential trouble issues but when it comes to actually dealing with these issues or predicting an eminent collapse i tend to look at mysql threads and performance, the slow query log, concurrent users, etc. for determining what needs to be dealt with and what will hit us on the head in the near future.

</comment></comment><comment><USER11> (if you don't know this you should read the link):

If (# CPU Cores / Load) > 1, shit has hit the fan

I disagree with 0.7 being the starting point for investigation on extraneous load, but you should be more worried about changes in 1st or 2nd moments in the load (velocity and acceleration), which as analogy on the link, you don't care too much about steady traffic, it's when traffic starts bursting at the seams.

Having a machine running at 0.75 load for a shared machined (say a development database) might actually mean your resources are actually being consumed regularly. Albeit seeing that average load climb slowly towards ~1.0 means you need to fix it before the pipes clog shut.

<comment><USER12> Would there be any reason that perceived performance would decrease when the cpu load is 50% of the total number of cores? We have an X5660 with 24-cores and once the one-minute average gets over 12, pageload times increase dramatically.

<comment><USER13> make sure you are looking at physical core count, not hyperthreaded cores (which should be a 2x difference for your CPU).

<comment><USER12> Am I using the wrong command to count physical cores (I'm guessing so? grep 'model name' /proc/cpuinfo | wc -l What should I use to count physical cores?

<comment><USER13> /proc/cpuinfo are hyperthreaded cores, as exposed to the OS. For basically all the modern multi-core Intel Xeon CPUs you can divide that by 2. It seems you can also find out by looking at physical ID and "cpu cores". On a 64 (hyperthreaded) cores machine, I see physical ID 0..4 and cpu cores 8 in this case, which would mean 8*4=32.

<comment><USER13> small correction: "physical ID 0..3"

</comment></comment></comment></comment></comment></comment><comment><USER14> Incidentally, on a Mac, this will give you your number of cores, along with other handy stuff:

system_profiler SPHardwareDataType

Hardware:

        Hardware Overview:

          Model Name: MacBook Pro
          Model Identifier: MacBookPro5,1
          Processor Name: Intel Core 2 Duo
          Processor Speed: 2.4 GHz
          Number of Processors: 1
          Total Number of Cores: 2
          L2 Cache: 3 MB
          Memory: 4 GB
          Bus Speed: 1.07 GHz
          Boot ROM Version: MBP51.007E.B05
          SMC Version (system): 1.41f2
          Serial Number (system): [snip]
          Hardware UUID: [snip]
          Sudden Motion Sensor:
              State: Enabled

</comment><comment><USER15> Nicely written... but looking at the last section "Bringing it Home" I'd like to point out that if you were to, say, do a make -j<#cores> in the Linux source tree (or any other bloated GNU monstrosity) you'll get a 15-min load of well over the 70% desired :) But it's not a bad thing... it just means Firefox will run like crap for a while. Also, don't do that on your web server, which is probably what he was talking about anyway.

<comment><USER16> "it just means Firefox will run like crap for a while."

Put an "ionice -c 3" on that job and you probably won't notice the performance effect on Firefox anymore. (You probably don't need conventional "nice" because compile jobs tend to get their priorities dropped anyhow because they are using a lot of CPU without yielding, but dropping the scheduler that hint can still be helpful in some cases.)

(Annoyingly, unlike nice, ionice requires the specification of the class; I wish it would just default to -c 3 like nice has a reasonable default.)

<comment><USER17> IO Nice will just affect the io scheduling (obviously), but you can also do the same thing to the CPU schedulers.

        schedtool -B -e ionice -c3 make -j10

That's the idiom I commonly use on long large compile jobs. means that anything else will always get the cpu or io time (maybe with some increased latency, which usually isn't too bad) that it needs while all idle time is taken up by the larger compile job. This makes for a very happy desktop system when upgrading (gentoo user here).

<comment><USER9> If you don't have schedtool available on your distro, you can use 'chrt --batch 0' instead.

</comment></comment></comment></comment><comment><USER18> I had heard that the load averages were the size of the scheduler's ready queue. If that is correct, wouldn't a load of more than 1.00 on a multi processor machine still be bad, since processes are ready to fire but are waiting for the next jiffy?

<comment><USER19> Here's a more thorough treatment (with maths and all):

<http://www.teamquest.com/pdfs/whitepaper/ldavg1.pdf>

<http://www.teamquest.com/pdfs/whitepaper/ldavg2.pdf>

</comment></comment><comment><USER20> <http://video.google.com/videoplay?docid=-8002801113289007228>

ftp://crisp.dyndns-server.com/pub/release/website/dtrace/

</comment><comment><USER21> So how does this change for logical/nonphysical cores. Should a hyperthreaded dual core system be considered full at a load of 2.00, 4.00 or something in between like 3.00?</comment>


Portugal Government Fuels Debate About Democracy in Europe - <AUTHOR> http://www.wsj.com/articles/portugal-government-fuels-debate-about-democracy-in-europe-1445804135 <comment><USER2> This is such a fuss about nothing. The fact that Cavaco Silva mentioned the EU when announcing this has blown this out of all proportion. This has nothing to do with the EU. It is a president allowing the incumbent prime minister and leader of the largest party (to which the president also belongs) to form a minority government. This is exactly what normally happens in Portugal in this situation. It has nothing to do with the EU, and nothing to do with a right wing stitch up. It was a decision made by the president, as he is supposed to do, with no input from the EU. But why let the facts get in the way when this can get both the left-wing anti-cuts brigade and the right-wing eurosceptics frothing at the mouth.

<comment><USER3> It is something. The dangerous message That the president passed is that in his view some partys can't be part of the government since they are not completetly pro Euro and don't agree with the austerity measures, the privatizations of a lot of public services. If you can change parties but you can't change the political agenda then you no longer have a democracy. Anyway we're not even talking about radical changes since the most left-wing parties would be the weakest part of the coalition.

I for one think this possibility of ps cdu and be forming a coalition would be a possibility to form a more balanced government.

<comment><USER2> That would be a more compelling argument if it weren't for the fact that he's doing the normal thing of calling on the largest party to form the government. Yes, he gave a partisan speech, but that doesn't make his decision anything out of the ordinary.

</comment></comment></comment><comment><USER4> Portuguese here.

Nothing abnormal nor illegal.

The coalition with the most votes will rule.

If everyone else is against that they can vote them out.

None issue blown completely out of proportion.

(vide the ridiculous #PortugalCoup)

Edit: or => nor

<comment><USER5> I'm Portuguese too, I can also confirm this, this is the usual procedure, the party with more votes is the one who forms government, having more than 50% of the votes or not. Yes it may have a hard time since the opposition can join forces and vote against everything.

This is nothing more than the losing side whining because it wanted to rule, the same side that said if it lost the elections would disaprove blindly the state budget everytime.

<comment><USER6> You can confirm what ptpttptp said? But you contradict him. He said the coalition with the most votes will rule (which seems to be the left-wing coalition), whereas you claim the party with the most votes will form the government, even if they have less than 50% of the votes (which would be really odd if there's a majority coalition willing to govern).

It sounds like the losing side is stealing government despite losing the election here. Unless of course that largest party can form a majority coalition with a moderate left-wing party. Then everything would be fine. But forming a minority government against the wishes of the parliament, should not be possible.

<comment><USER7> The right-wing parties ran as a coalition, single box in the ballot. The left- wing parties ran isolated and want to form a coalition after the results. The problem here is one of perspective: there are no winners or losers, there is only number of seats in parliament, and the left has the majority. The President can invite whoever he chooses to form government and he chose the right.

There have been successful minority governments before. In this case, the left (if they can reach an agreement) is claiming that they will pass a vote-of-no- confidence on this government.

There is another issue here. The President himself is on the way out and he cannot call for new elections. But everything is proceeding according to our constitution, so democracy is safe.

</comment></comment></comment></comment><comment><USER8> As a Portuguese I am amazed this is on HN, but as others have mentioned there is no coup.

The President just followed the rules and mandated the most voted party/coalition into government. Minority governments have been empowered many times before.

What he did wrong was to give an extremely polarizing speech that labeled some of the parties with seats in parliament as unfit for government. This makes him look suspiciously in favor of a government of his own party and has had the side effect of potentially unifying the left wing into a coalition with majority in parliament.

I think the current government is incredibly bad and stuffed with incompetent and corrupt people.

Unfortunately I don't know if the left will be any better.

There is no natural reason why Portugal can't be a much richer society.

It just needs more effective and less corrupt governments.

<comment><USER5> I have no hope for either side, the right we had 4 years to see how they are and it speaks for itself, the left considering the anti-euro speeches of the extreme ones makes me fear that if they manage to form a government will not reach an understanding between them, I remember reading that Jeronimo de Sousa does not want any written and signed agreement with Antonio Costa, that also makes me very distrustful of them.

While I can understand the motivations of Cavaco Silva to label some of the parties unfit for government (anti-euro etc), it does indeed make it sound like he is favoring one side, and to make it worse they are the same party, but I do believe he is being neutral about all this.

<comment><USER9> Antonio Costa (from second most voted party) has an history of anti-democracy and putting is personal ambitions first [1]. (Sorry, portuguese language only. Anyway we seem to be in majority in this thread :)

[1] [http://www.jn.pt/opiniao/default.aspx?content_id=4835053](http://www.jn.pt/opiniao/default.aspx?content_id=4835053)

<comment><USER7> That is an opinion article penned by one of his opponents!

</comment></comment></comment></comment><comment><USER5> Non paywall link: [https://www.google.pt/url?sa=t&rct=j&q=&esrc=s&source=web&cd...](https://www.google.pt/url?sa=t&rct=j&q=&esrc=s&source=web&cd=1&cad=rja&uact=8&ved=0CB4QFjAAahUKEwi9_66ht- LIAhUDQBQKHfWuBHA&url=http%3A%2F%2Fwww.wsj.com%2Farticles%2Fportugal- government-fuels-debate-about-democracy-in- europe-1445804135&usg=AFQjCNGNulnwcgYZazxDEnfneSPnczl1xw&sig2=xjf9b2brsrLL1m23d99-PQ)

<comment><USER4> Doesn't work for me.

</comment></comment><comment><USER9> This is completely BS.

Democracy is allowing 18% of euroskeptic portuguese to rule Portugal?

Democracy is allowing an unstable post-election coalition that nobody voted for to govern?

<comment><USER5> As a voter I feel betrayed by this post-election coalition (if it ever forms they seem too unstable), because there is a difference for me between voting for a party or a coalition of multiple ones, if I am against the ideologies of one of the parties I may not vote for them.

</comment></comment><comment><USER10> Paywall ...

<comment><USER11> Copy URL, paste URL into google, click result, no paywall. I cannot believe how stupid this is.

<comment><USER12> That's ridiculous, but thank you!</comment></comment></comment>


SBCL is now faster than Java, as fast as Ocaml, and getting better - <AUTHOR> http://groups.google.com/group/comp.lang.lisp/browse_frm/thread/25fb220a1da975fb# <comment><USER2> Of course it is faster than Java in some specific micro benchmark. That's what micro benchmarks are for!

Now try building something really big on SBCL that takes advantage of that quad core box. Huh. What do you mean half the Common Lisp libraries are not thread safe? :-)

<comment><USER3> Threads are not the only mechanism for parallelizing your code. You could just start 4 processes (which I actually recommended against here yesterday ;), or you can use something like STM. SBCL has an STM library:

<http://common-lisp.net/project/cl-stm/>

<comment><USER2> The only reason for recommending spawning processes is if you live in a non- threaded environment like Python, Ruby, Perl or Common Lisp. In a C/C++/Java world it is the normal thing to do and it generally makes communication between those threaded tasks 10x simpler.

Don't get me wrong, I love languages like Python or Ruby and I hack stuff with it daily. I would just _never_ do high performance stuff with them.

It's my observation that the 'threads are evil' mantra only seems to be sung by people who have never really experienced working with a really thread safe environment. It's like being stuck in the early Linux/BSD days.

We live in the multi-core era. Today 8 cores are not unusual, many-more-cores are coming. I seriously think that we're going to see some fallout with regards to programming environments that can't keep up.

<comment><USER3> _I seriously think that we're going to see some fallout with regards to programming environments that can't keep up._

Probably not. People are creatures of habit and will continue doing whatever they were doing before. That doesn't mean we need to care though.

But anyway, threads aren't the solution. They are way too low-level and too easy to screw up. That's why I recommended STM previously.

</comment></comment></comment></comment><comment><USER4> I find that the results of the GCLS are so specialcased and gamed and compiler-optimized at this point that they basically don't reflect anything even remotely near reality.

For example, Ocaml still seems to be the language I can go to for the best performance with high level code. C++ still seems to be somewhat slower.

It's one thing to implement an ackerman function in C++ and another entirely to make a real working application.

<comment><USER5> How can "C++ still seems to be slower" if C (or C++) is essentially a macro- assembler, i.e. you're free to hand-optimize any particular bottleneck.

Every time I hear someone say (or show a benchmark) where "C++ is slower than C" it always comes down to some STL usage instead of flat arrays or something (which is still valid C++)

<comment><USER4> Sure, but the whole point of using a higher level language is to use some of those higher level features. It seems somewhat... unfair to argue that C++ "can be fast" so long as you basically restrict it to its C subsets.

I want the code to be both high level _and_ fast. A language is of no use to me as a performance target if in order to get performance with it you have to use a tony subset of it.

Sure, every language has fast and slow ways of doing things

</comment></comment></comment><comment><USER6> It's a tiny bit dishonest... SBCL is faster than Java 1.4, but slower than Java 1.6. (And using the logic used for comparing OCaml, it's as fast as Java 1.4).

</comment><comment><USER5> Oh no! This post just taught me that Opera 9.5 still won't work with Google Groups... Dammit.</comment>


Uber Ex-CEO Travis Kalanick Knew of Stolen Google Files - <AUTHOR> https://www.wsj.com/articles/uber-ex-ceo-travis-kalanick-knew-of-stolen-google-files-1498163977 <comment><USER2> For those of you blocked by the WSJ's paywall, this is no longer speculation, it's coming from Uber's own attorneys that Kalanick knew Levandowski had the files and told him not to bring them to Uber.

I can't see this as a good development for Uber. Their lawyers say it disproves the theory that Kalanick wanted Levandowski to steal the files, and maybe that's true, but now Uber has to explain why they knew Levandowski stole IP from Waymo and then covered it up and hired him anyway.

Still plenty of popcorn left in this saga.

<comment><AUTHOR> There's one interesting point. Until they said they didn't know that Lewandowski had Waymo's material they could basically claim plausible deniability (don't know how that work in a civil lawsuit). But now they admitted they knew Lewandowski had that data. To me, that's kind of an admission that Otto's tech was tainted. Yes, probably Google still needs to demonstrate it has been used by Uber, but it is a huge move forward...</comment></comment>


The FCC ratified Wi-Fi 6E this morning - <AUTHOR> https://arstechnica.com/gadgets/2020/04/the-fcc-ratified-wi-fi-6e-this-morning/ <comment><AUTHOR> I just wanted to point out the Headline is slightly clickbaity, since WiFi 6E has nothing to do with FCC, the brand belongs to the Wi-Fi Alliance.

What FCC did however was ratified the 6Ghz Spectrum for unlicensed use in the USA.</comment>


Rails 3.0: Third beta release - <AUTHOR> http://weblog.rubyonrails.org/2010/4/13/rails-3-0-third-beta-release <comment><USER2> As a practical matter, it will be a while before I jump to 3.0. I am almost entirely on Rails 2.3.5 and Ruby 1.9.1 and that is working for me. Really it is a tradeoff between working at 100% speed right now or spending some time migrating to better tools.

<comment><USER3> I've pretty much switched everything to Ruby 1.9.1 and the first Rails 3.0 beta. Works like a charm. That's why I was so disappointed to see the 3.0pre2 rely on Ruby head rather than current Ruby stable (1.9.1).

<comment><USER4> Is beta 3 working on Ruby 1.9?

<comment><USER5> I would tell you to read the manual, but they didn't post release notes on the rails blog this time!

Anyhow, Ruby 1.9.2 is recommended.

</comment></comment></comment></comment><comment><USER6> _"This one spins out a few overdue extractions into plugins"_

This has happened to me several times -- upgrading to a new Rails release breaks my app because things have been _removed_ from Rails. Granted, a simple plugin install usually fixes said issue, but it's weird to me anyway.

I would expect code to be improved and proven in a plugin, then ultimately integrated into the framework. Rails tends to do the opposite for some reason.

Maybe someone smart can explain it to me.

<comment><USER7> This is one of my favorite things about Rails and the Ruby/Rails ecosystem. Removing features is viewed as a good thing. You might have to install a simple plugin but for all the users who don't need it that's a bit of code that they don't have to download, install, and run.

<comment><USER6> The feature I'm thinking of is/was (I thought) a core feature of the form helpers -- form.error_messages and error_messages_for.

I think since the beginning of Rails' inception, this feature has been included in scaffolding, shown in docs, etc. I would expect most Rails apps to use that particular feature.

And that's just one example.

<comment><USER8> I think you've just proved the point. I never use the form helpers, and do most form-like things through custom javascript and AJAX calls. Including form helpers is a waste of space for me.

Not everybody builds Rails apps the same way. I think that this flexibility is one of the framework's strengths.

</comment></comment></comment></comment><comment><USER9> No mention of whether it supports 1.9 again or not...

<comment><USER10> AFAIK, 1.9.1 incompatibility was due to a fault in Ruby itself, rather than Rails. And even though it seems to work with 1.9.2-head, that does have some major issues, like SEGV/Bus errors in native classes and gems alike (see <http://redmine.ruby-lang.org/issues/show/3132>)

I've put my Rails 3 projects on hold for a while.

<comment><USER10> Okay, so it appears 1.9.1 now at least doesn't crash outright. Not sure if it's 100% stable, though.</comment></comment></comment>


Ask HN: Do you feel/fear that you're more disposable as a remote employee? - <AUTHOR> <comment><USER2> Years ago when I was a remote employee, I definitely did become marginalized. Projects I took on and completed were often assumed to have been done by an on site employee. People on calls sometimes spoke of me as if there was no chance I was on the call. The CEO even talked about getting me to train my replacement, apparently assuming I wasn't part of the call concerning the department of which I was the lead.

I've found that the issue with being a remote employee is the employee part. My experience has been that trusting your job security to an employer is just not as safe as it used to be. Nowadays as a freelancer who works on mostly long-term contracts, it's possible that some of my clients wouldn't think much of replacing me, but if they do decide to stop using me, I can grab another contract. My office doesn't change. My machine is still my machine, i.e. they're often the more replaceable one.

However, and as others point out here, this only works if you have lots of experience in something highly in demand.

</comment><comment><USER3> Absolutely, yes.

My experience is that remote work is the exception, not the norm. The only way to get stability as a remote employee is to have an exclusive skill or some other advantage over the other employees, eg. "I'm the only remote employee, but I'm the only one who is a proven data science whiz," "The company cannot find enough locals who know Scala," etc. And even then, your stability is still contingent on this supply/demand imbalance.

</comment><comment><USER4> Yep. On the other hand, solid sofware engineers are never really disposable - it takes probably 6-12 months on average for SE to ramp-up to full productivity on a team. Even after that period, he/she will grow still, having more influence on the design, the process etc. It's not a smart move to ditch such highly performing remote worker for a fresh local one.

</comment><comment><USER5> The key to not being disposable as a remote employee is mastering communication, availability, and execution. That doesn't mean that you need to constantly be available, but rather that you need to be available and communicative with your team and, of course, getting your work done on time.

If you do those three things well, then you are no more disposable then any other employee.

<comment><USER6> Exactly. Perception is key. Communication determines how you are perceived.

When remote, the communication tools are different. Instead of walking over to talk to others, you're likely using chat, voice, or video calls. The meetings include shared screens with conference calls. After a meeting, you may chat or call someone for a private discussion. Those private discussions are likely how you build social bonds and get to know others personally. They can also make it clear you're available to help.

In the office or remote, your communication style builds a perception of how involved you are in projects, what you can contribute, and whether you're viewed as a needed or disposable.

</comment></comment><comment><USER7> I've only worked for small organizations remotely, but I did have the experience of working for a satellite office (~25 people) of a large company (~6000) and we felt very alienated. They did value our work, however. I think if you are working on something that brings value then you are valuable. If you aren't doing that then you don't have a lot of leverage.

</comment><comment><USER8> Proximity is always valued over remote.

There is something human about being able to see the person who is doing some work for you. To be able to say hello without agenda. Ask how it's going.

Yes you can do it with Slack and Skype but nothing beats walking over to someone.

In large companies, working remote made me feel disposable. Small companies, if you can get stuff done, you feel valuable while being autonomous.

</comment><comment><USER9> Given how much work and communication about work is technologically enabled today there shouldn't be a higher risk of being treated as disposable, but despite working remote for many years for a larger corporation it did feel like I might have gone on the chopping block somewhat sooner when the recession hit. Though in the end it might not have mattered because the recently appointed president of the company took the recession as an opportunity to replace most of the founding leadership team of our business unit with people of his own choosing.

</comment><comment><USER10> Nah...we're all remote :)

<comment><USER11> Same here, not a person in the office.

</comment></comment><comment><USER12> Yes, a little. A big issue is that people forget you're around, and so forget to include you, which makes you more disposable.

</comment><comment><USER13> Yes, absolutely, unless you work for a company where everyone is remote</comment>


NASA Is Having a Conference Tomorrow Regarding Latest Kepler Discovery - <AUTHOR> http://www.nasa.gov/press-release/nasa-hosts-media-teleconference-to-announce-latest-kepler-discoveries

<comment><USER2> Any significance to a guy from SETI being in the conference?

<comment><USER3> Could be something to do with the Stephen Hawking announcement of lots of money going towards SETI? Perhaps Kepler/NASA is announcing what they're doing as part of that.

Or, you know, aliens have contacted us. But probably the Hawking thing.

<comment><USER2> It must be hard to be associated with SETI.

"911, what's the nature of your emergency?"

"Well, we're here at the SETI Institute, and -"

"What, SETI? Are they here? What should we send? All of it?"</comment></comment></comment>


Ask HN: What American tech policy needs to change? - <AUTHOR> What tech policies are long overdue for change? Put differently: which policies would be best improved by someone with a technical background? Alternatively, what areas of tech would benefit from legislation that doesn't exist yet?
I'm currently an undergraduate in a technical discipline at a top school. I believe there is a problematic disparity between politicians' technical aptitude and the level of technical competence required to craft effective policy, which is exacerbated by the continuously increasing prevalence and complexity of technology. Based on these views and Bruce Schneier's writings on the importance of being a public interest technologist[0] I have decided to spend the upcoming semester doing a public-policy internship related to tech in Washington D.C. As such, I would like to know what this community views as some of the most important domestic tech policy issues that need fixing.
Some issues that come to mind for me: courts compelling decryption, copyright trolling, basically anything the EFF is working on[1]
[0]: https://public-interest-tech.com/
[1]: https://www.eff.org/work <comment><USER2> DRM (Digital Restriction Management) is evil. Cory Doctorow has written lots about it. A company can steal back all of the e-media you have purchased.

No software patents. No business process patents.

Copyright should be limited to 25 years. Only make money from new stuff, not really old stuff.</comment>


5 Question Interview with Twitter Developer Alex Payne - <AUTHOR> http://www.radicalbehavior.com/5-question-interview-with-twitter-developer-alex-payne/ <comment><USER2> Key takeaway here: Ruby on Rails is the new, hot fad, but apparently doesn't scale in the way web languages should. Dropping ActiveRecord, for example, cuts out the main piece of RoR coolness I still liked.

<comment><USER3> Disagree. It seems more like they've optimized one part of their infrastructure, so now a new bottleneck has popped up. Par for the course when you're optimizing anything...

Oh, and this interview was discussed by DHH on his blog:

<http://www.loudthinking.com/arc/000608.html>

The comments were interesting, especially one from Alex Payne (the Twitter dev himself). Here is an excerpt. Visit the link above to read the full comment (which is kind of long to post fully inline here).

"...We'd be running into scaling issues on Django or any other platform. We're happiest scaling on Rails."

</comment></comment><comment><USER4> Seems like RoR is great for getting something out very quickly but if the site takes off then you need to be prepared to take out the very features that helped get you there.

So, it comes down to, if you're shooting for something very high traffic (and who isn't) use a faster language. If not, use RoR.

<comment><USER5> Django gives you the benefits of speed and an easy to use framework. Rails just seems to have more hype around it.

The people who constantly say that the poor performance of Ruby and Rails isn't an issue are the same people who don't have large spikes in traffic, since their apps are subscription-based. For most of the typical Web 2.0 stuff getting built these days, huge spikes in traffic are exactly what you want, but using Rails is setting you up to have scaling issues once you get the press you're hoping for. You're likely to run into those same issues regardless, but why make things worse? Assuming Rails is better than Django, it's not so much better that it'll make up for the poor performance. The improvements in ease of development aren't unique to Rails, they're a byproduct of the philosophy that Django, Rails, and similar frameworks all share.

I'm far more likely to trust the opinion of the Twitter folks than that of people who have something to gain from my choice of framework.

<comment><USER4> I agree with you. I've been debating whether to focus on using Django or Rails - and I think I'm going with Django. If Rails has known speed limitations, why work with it if there's another option?

</comment></comment></comment><comment><USER6> Joel Spolsky told you so

<comment><USER7> Yeah, but then he went ahead and created Wasabi. Kinda lost points there.

<comment><USER6> Please explain what's wrong with the decision to create Wasabi</comment></comment></comment>


U.S. Postal Service is considering cutting as many as 120,000 jobs - <AUTHOR> http://www.msnbc.msn.com/id/44111973/ns/business-us_business/#.TkRjXmFRWUk

<comment><USER2> Seems inevitable, no?

I get perhaps one meaningful piece of mail a week tops, and nothing that can't wait a week. There are peaks (weddings, Xmas, etc) but very little that justifies the scale of the system. I suspect this is true for a large percent of the population under 60 - at least the urgency part. The trend will continue.

One secondary question - are the fixed costs so big that the system only works with huge volumes?</comment>


When the signal is in the noise: Exploiting Aircloak's Diffix anonymization - <AUTHOR> https://cpg.doc.ic.ac.uk/blog/aircloak-diffix-signal-is-in-the-noise/ <comment><USER2> Author here, feel free to ask me any question!

</comment><comment><AUTHOR> Direct link to the research paper (might have less context): [https://arxiv.org/pdf/1804.06752.pdf](https://arxiv.org/pdf/1804.06752.pdf)</comment>


Teleport – Modern SSH server for clusters and teams - <AUTHOR> https://github.com/gravitational/teleport <comment><USER2> There have been several comments regarding authentication but what I see as the glaring issue is the lack of authorization. Without some sort of RBAC implemented within Teleport and/or integration with external authorization solutions the use cases for Teleport are going to be limited to very simple scenarios. The suggestion mentioned within a couple of github issues of using os logins as roles is a non-starter in a large number of environments due to security and audit considerations.

I understand that trusted clusters were originally intended as a means to allow Teleport to work through restrictive firewalls but the same type of environments which are going to necessitate the use of trusted clusters are also likely to require more restrictions regarding which users are allowed to access the cluster from a trusted cluster. The current solution of specifying individual allowed users is too limited and doesn't scale.

Gravity, which Teleport is ripped from, is a system to support SaaS providers in deploying and managing onsite implementations within enterprise networks. Maybe these issues are addressed at a different level within Gravity but if not I would be hesitant to allow a SaaS provider to deploy within my network using Gravity.

<comment> old-gregg tssva, great points. Gravity is basically Kubernetes-on-Teleport, and our distribution of k8s has additional security measures built-in, where Teleport (in a library form) is acting more or less on a lowest "root" level which the infrastructure owner can optionally turn on/off for pieces of their infrastructure, we'll be gradually publishing more documentation on Gravity soon, but you're right: RBAC lives one level higher.

</comment></comment><comment><USER3> It's interesting, but I don't think I'd take it over openssh just yet. I'm not at the scale where most of the features become relevant, and frankly, I don't trust it as much as I trust openssh, a piece of software that's been in active development for almost 17 years, has an excellent security track record, and a development team well known for its care for security and its response to security issues.

And in a piece of vital security infrastructure, trust is everything.

<comment><USER4> > "Teleport has completed a security audit from a nationally recognized > technology security company. So we are comfortable with the use of Teleport > from a security perspective."

It would be interesting to read more details about this audit. This blurb is pretty much "Trust us" with more letters.

<comment><USER5> Unfortunately, our current agreement with the security company we hired prevents us from sharing the details unless under NDA. We may revisit those terms so that we can publish it now that Teleport is garnering more interest.

Edit: tried to add more clarification to address jtchang's question.

<comment><USER6> Why is this? Doesn't it make sense to publish which company did the audit? I mean for financial companies like KPMG they definitely do it.

<comment><USER7> I'd guess it is something like "pay us $XX for an audit for your information; pay us $XXXX to tell other people we audited you"

<comment><USER8> It's exactly this. A private audit is generally cheap. The truth with these is that the audit really doesn't mean anything - you will often find such audits performing such a superficial sweep of the software that even glaring problems may not be found.

Publicly releasing an audit puts the auditor's reputation on the line. As such, the audit will always be performed very seriously, digging into the code and scrutinizing every possible angle - at a level usually not even remotely done for a private audit.

All said: a private audit means squat all.

</comment></comment></comment></comment></comment></comment><comment><AUTHOR> This project was posted here 6 months ago, but has since evolved quite a bit. Version 1.1.0 was recently released, so I personally wanted to hear HN's thoughts on this more stable version of the project. (I am not affiliated.)

<comment><USER9> Link to previous discussion: [https://news.ycombinator.com/item?id=11355976](https://news.ycombinator.com/item?id=11355976)

</comment></comment><comment><USER10> Why is ssh even needed on distributed clusters? Shouldn't provisioning the cluster be automated and the nodes be immutable by design? I can only imagine what a nightmare a huge fleet of special sniwflake machines woukd be to manage. Cattle not pets

<comment><USER11> This is a bit naive. If you've ran a production system with any decent traffic and never needed to SSH into machines, congrats. I haven't and I don't know anyone who has. You might need to go in for anything from auditing to troubleshooting, even if it's rare.

PS: How is your automated provisioning system reaching your cluster if not by SSH?

<comment><USER12> >PS: How is your automated provisioning system reaching your cluster if not by SSH?

Not sure about moondev, but Terraform + Cloud-init + Container Orchestrator means that I basically never need to SSH into my nodes, except in extreme/rare circumstances.

<comment><USER13> > _except in extreme /rare circumstances._

So you do need ssh after all?

<comment><USER12> I said "I basically never need to". Not that I never need to. But yeah, I basically never, ever need to. Short of needing to take a coredump or docker shits the bed, I don't really ever need to log into my nodes.

I guess that's an offensive thing to point out judging by my score...

<comment><USER14> So you need SSH.

<comment><USER12> Are you _kidding me_?

> _I said "I basically never need to". Not that I never need to. But yeah, I > basically never, ever need to_

It is interesting to imagine why this innocuous comment has ruffled so many feathers.

<comment><USER12> Boy, I sure hope I'm helping someone really sad feel better about themselves. Downvote away, it's not going to change a damn thing.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER12> So Teleport always records the SSH session? Doesn't that get expensive at times? Sometimes I stream logs over SSH or use `watch` on a fast interval. It's enough that tmux and ssh take a non-trivial amount of CPU, even just on the receiving end. I just wonder if that proxy recording becomes a bottleneck.

<comment> old-gregg Teleport is actually a Golang library, and that's how it's used internally at Gravitational, where session recording can be turned on or off [1] based on a use case.

The pre-built teleport daemon as you see in `tool` directory does not have a config switch for turning recording off yet, we should add it.

[1] [https://github.com/gravitational/teleport/blob/master/lib/se...](https://github.com/gravitational/teleport/blob/master/lib/service/cfg.go#L267)

</comment></comment><comment><USER15> Something (vaguely) similar can be achieved using Vault and an ssh-helper[1].

It enables one time passwords and password issuing can itself be tied to 2-factor, etc.

[1] [https://github.com/hashicorp/vault-ssh- helper](https://github.com/hashicorp/vault-ssh-helper)

<comment><USER16> Do you know anything about recording ssh sessions too perhaps? That was one of the more interesting points of this software in the OP.

I would like to see a proxying authentication layer for both ssh and rdp to manage accountability and access centrally.

</comment></comment><comment><USER17> No support for "plugins" as far as authentication, or to elaborate a bit, how do you go about running the 'auth' component in multiple VPC and have some degree of sync? Perhaps a use case for an underlying LDAP directory, or ..?

<comment><USER18> We support OIDC connectors, so you can plug in LDAP using [https://github.com/coreos/dex](https://github.com/coreos/dex) as one of the providers, or simply roll a new OIDC provider customized to your needs.

<comment><USER19> Why OIDC? Why not use something much more standardized like PAM?

<comment><USER18> Mostly because we wanted to support Google auth out of the box and OIDC is a good way to get this + give options for pluggable auth to everyone else.

</comment></comment></comment></comment><comment><USER13> Pet hate: projects that use existing common(-ish) words. 'ssh' is instantly recognisable. 'Teleport'... meh. Make your own word, be unique.

</comment><comment><USER20> Why do these fucking quasi-products never actually say what the fuck they DO? "<this> replaces sshd, possibly the most critical piece of software your server runs, with a magic black box".

There's nothing in the rather meagre list of suggestions at the top of the readme that can't be done already and 0 detail on how they intend to achieve it and why their dubious methods require wholesale replacement of your, did I say it's critical?, ssh daemon.

SSH is definitely not a tool I'll be replacing any time soon with the latest fly-by-night product from CADT BikeShedders Inc.

<comment><USER16> There was one very interesting feature, recording of sessions.

There is an increasing demand in large organisations to manage server sessions better.

That is to have accountability and manage access centrally.

So far I've only reviewed one solution, Cyberark, they promised to manage all our server sessions centrally with 2FA, recording ssh and rdp, and more. But in the end we weren't motivated enough to pick them.

I haven't seen any open source offering to do this.

Of course this product would be outside of your normal SSH server, as an additional proxying layer and not a replacement for ssh. Just saying that there was one very interesting point in that repo, I wouldn't replace OpenSSH ligthly either.

</comment></comment><comment><USER21> This just feels like a lazy solution.

<comment><AUTHOR> I'd be interested in hearing about non-lazy alternatives other than manual key shuffling.

<comment><USER22> Actually certificates can be used with openssh as well:

[https://news.ycombinator.com/item?id=12518902](https://news.ycombinator.com/item?id=12518902)

I'm not sure this isn't too "lazy" for some tastes, however.</comment></comment></comment>


Ask HN: Best Web Dev Talks? - <AUTHOR> I've been soaking up a lot of web development talks recently, mostly from tech conferences' you tube channels.
Some of these talks are great and only have about 50 views. Anyone know any web dev talks that deserve some more? <comment><USER2> If you're into WebGL dark arts, Ricardo Cabello (mr doob, threejs) likes to showcase the latest techniques ;)

Ricardo Cabello - Creating VR (and AR) on the web

[https://www.youtube.com/watch?v=8PzmjNgZyto](https://www.youtube.com/watch?v=8PzmjNgZyto)

</comment><comment><USER3> My personal favorite speaker on this topic is Chris Heilmann[0]. He's been in the trenches for a long time and highlights a lot of issues in webdev that are often overlooked, like accessibility, and a common thing: over-engineering.

[https://www.youtube.com/results?search_query=christian+heilm...](https://www.youtube.com/results?search_query=christian+heilmann)

</comment><comment><USER4> I saw someone create a web app for this on twitter a few years ago where you could view them by category and submit yt links as well, but I can't find it sorry, will let you know if I come across it again

<comment><USER5> I don't know, maybe CodeTalks [0] is what you mean.

[0] [https://codetalks.tv/](https://codetalks.tv/)

</comment></comment><comment><USER6> Would be interested also. :)</comment>


Best PC Laptop for Development (July 2016)? - <AUTHOR> Hi, I am looking for a good Laptop to do web development (RoR, NodeJS, Python, Docker). My budget is less than 1000€ (~$1100) to install ubuntu on it any idea ? <comment><USER2> Lenovo's Thinkpads, especially the T and X series. Look around the web for Lenovo employee discount program codes to help bring costs down significantly (sometimes 30% off)

<comment><AUTHOR> Thanks, I'll have a look.</comment></comment>


Australia to build $43b FTTH broadband network - <AUTHOR> http://www.smh.com.au/news/technology/biztech/broadband-plan-gets-go-ahead/2009/04/07/1238869956384.html

<comment><AUTHOR> To put that in perspective, that's $2,000 for every man, woman and child in the country. That's a huge amount. To put it into perspective, the same expenditure in the USA would be roughly $600b.

Putting aside the fact that this is desperately needed in AU's miserable internet market - this is exactly what a government should be doing at a time like this. Spending huge amounts on wisely chosen infrastructure projects is just the ticket to pull a country out of recession, IMO.</comment>


First U.S. Wireless Pacemaker Gives Patient Freedom - <AUTHOR> http://www.nytimes.com/reuters/2009/08/10/technology/tech-us-pacemaker.html?_r=1&partner=rss&emc=rss <comment><USER2> It's not very clear from the article, but people with pacemakers have been able to transmit diagnostic information over the phone for at least a decade now. The real gain is that the frequency of communication is now much higher than it was previously.</comment>


How did you use slack in no team? - <AUTHOR> We know, many great Slack bot there, and also great team or any company use Slack in communication. But, how do you use Slack in case you have no team?<p>Are you make your own team with no member except you? <comment><USER2> I've seen some integrations where it uses Slack like a memo app, or for keeping records. I guess it's kind of feasible to use it that way, you just won't have anyone you can actually chat with... unless u want to install some AI chatbots... (most are shitty).

<comment><AUTHOR> Install some AI chatbots like I have no life lol</comment></comment>


Ask HN: What is your advise to move up the ladder?  Any anecdotes? - <AUTHOR> Hi HN,
I am asking for some specific advise regarding my case.  I am on H1B visa working for one of top 10 software firms in the valley.  There are about 10000+ employees in my org.
In 2013 , I actually joined startup to move up but our startup got acquired by big software company.
My question is  -  How do I move up ?
I have 9 years of experience so far in software development.  I hold Engineering degree from India and 3 certifications that are business , management related.
To move up I finished Stanford APM certificate in 2013 before joining said startup.  However, that didn't help in getting management position.
I like coding , system design, large scale systems, scalability, contribution to business in general.  I would say I am good , if not best, programmer and can get stuff done fast without any supervision. I can contribute to technical discussions, can mentor junior programmers, can help determine long term approach and more.
However, after 9 years of programming I am feeling there is too much stuff now to learn.  Everyday I hear about new tool, every other week / month there is new language out there.  I am also 31 years old and unmarried.  I would like to have some time for personal improvement rather than running every second like everyone else in bay area ( at least ).
What are your tips for moving up in the organization?  I would love to do coding but I want to make equal contribution to business.  I look to someone like Jack Dorsey , Paul Graham, Marissa Mayer as inspiration on who I want to be when I will be 40.  Jack is not favorite of many people ( especially on HN ) but I think he is strong leader.
My goal is both money and position in new company.  I don't care about size of the company. I can switch jobs but that might not be immediate due to visa.  Does joining Google, FB make any sense or should I join startup and move up ?
Any tips ?
How did you move up in large organization ?
Thank you !! <comment><USER2> I'm curious if you discussed your desire to move into a management position with your supervisor. If you did discuss it, what, if any, feedback did you get?

Based on your statements in your question, the frustration is obvious, so is a sense of entitlement, like you've earned this right but it's not happening for you.

I am sorry that you are feeling like that, it's a terrible place to be and it can drive you to make some really stupid decisions. Hopefully, in simply asking this here has helped you relieve some of the stress, if not, maybe the following will be of some help.

This is not a direct answer, but should give you some ideas and thoughts to ponder, plus a couple of next steps.

Here are some of the themes I'm seeing in your question:

* Too much stuff to learn when it comes to coding

* Want to spend more time on personal projects instead of on technology treadmill

* Feel like you can complete coding tasks quickly

Let's address these themes:

I'm going to treat leadership / management interchangeably here, even though there are some serious differences between the two roles. For the purposes of being a line manager, they can be treated interchangeably.

Moving into a leadership role, whether you're looking for a tech lead or a management role, does not stop the first bullet point above. If anything, you have to be aware of all of the new trends enough to make a judgement call on it's validity, maturity and use-cases. You need to know this because you'll have your reports coming to you on a regular basis wanting to use some of these techniques / tools / languages / etc. How do you say no without offending your report? On the flip side, you'll have your manager(s) coming to you asking if something is a good idea. How do you explain the tradeoffs if you're a one-trick pony?

To the second bullet: you have, significantly, more time as an individual contributor than as a manager. As a manager, you have to make sure everyone is on target with what they need to do, run 1-1s to make sure the people are satisfied / happy and are not planning to resign shortly, report up the progress, report down the needs of the bosses. You are, perpetually, stuck between trying to communicate up, down and across the organization, while sitting in a lot of meetings (assuming a large org) and being on the hook to get more stuff done. This is doubly so if you are new to management. The hard truth is that the role doesn't matter, you have to know where to draw the line(s) and have a life. It's a constant tradeoff, do you pick up a new hobby or go out with your friends or learn the latest framework / language / algorithm / etc.

Your ability to code or get engineering tasks done quickly has very little to do with your ability to lead / manage. You need to learn new skills, mostly around communication, relationship building, messaging, ownership, delegation, accountability of others, etc. Just because you are a good developer does not mean you'll be a good manager. I would argue that most developers should never be allowed to lead as the skills and roles are so different, they are not transferrable. This means that you're starting from scratch, again. By the way, as you get promoted, you're constantly starting from scratch, unless you are, already, doing some of the things your manager is doing.

None of this directly answers your question, as there is no direct answer or how-to guide, it is very industry- and organization-specific.

Being a manager at a startup is very very different from being a manager at a large corporation. Moving into that role is, also, a different process. In some ways, moving into a leadership role at a startup has more to do with raw leadership skills then anything else; you see a problem, you own solving it - rinse and repeat, boom you're a leader now. By the way, replace __boom__ with months, potentially.

In a larger company, it's more involved as managers are expensive, both in terms of salary and training / knowledge acquisition. Imagine the disruption to the team, the delivery flow, unofficial communication channels (aka social glue), etc. when a manager leaves.

To be perfectly blunt, if you have ask the question, you need to really think about what it means to be a manager / leader. Look at how your role models came to be leaders, what paths did they take? Based on what you stated, your goals are position and money, that will make you a terrible manager, if you don't care about the people. You'll have a hard time retaining people or producing results in any high-performing organization as you won't be able to motivate anyone based on those drivers.

Another thought, position is meaningless in a high-quality tech environment. Power does not come, just, from the title, it comes from the group differing to you because of respect. Having worked at places where the position/title alone denoted power, it's a crappy place to be.

My suggestion, as to the next steps, is to:

* Reflect on the instances when you were put in charge of something and how people reacted to you, how they treated you and how you treated them

* Have several coffee dates with managers / leaders in your organization (don't go outside of your org) You are looking for people doing the role you would move into as your next step and their managers. Tell them you're interested in being a manager and what lessons they learned, what their day looks like, what keeps them awake at night, etc. You want to learn as much as you can from them and get your name out there. This is part of building relationships but also information gathering. This will tell you if you actually want the job and are willing to put up with the politics and dealing with people without the context of code to help you.

* Sit down with your manager in your next 1-1 and explain what you're seeking and ask for help to move into that role.

Also, read Managing Humans by Michael Lopp. It will give you a good idea about what it's like to manage engineers.</comment>


TransparentCompilation - <AUTHOR> http://martinfowler.com/bliki/TransparentCompilation.html <comment><USER2> I think an important note would be to add that transparency is not a binary property.

For example, he mentions ClojureScript as a language that compiles opaquely. Fair enough; it's certainly more opaque than CoffeeScript. But it's still relatively easy to read the emitted code, _much_ more transparent than GWT, which is the other example he mentions.

<comment><USER3> As I read the article, I don't think that's what Fowler was talking about. I think he noticed a trend in things like Less, Sass, Haml, CoffeeScript, etc. The relationship between, say, Haml and HTML is qualitatively different than the relationship between Clojure and Java (or JVM bytecode).

So, it feels like something new is happening and this essay was an attempt to more precisely define an otherwise qualitative feeling. In my reading, here's how he did it.

We say a compiler from language X to language Y is _transparent_ when two things are true:

1\. The compiler produces a clear and human-understandable mapping between the syntax of X and Y. That is, given code in language X, a human could predict the compiler's output in Y.

2\. (1) is not merely a happy accident, but a stated design goal of the compiler or underlying language X. That is, it's not whether (1) is the case, it's whether we're guaranteed that (1) is the case.

It's (2) that separates ClojureScript and CoffeeScript. Lots of compilers satisfy (1), e.g., a really naïve C compiler, but it's not by design. There's no intention, no promise to the developer, that the mapping from X -> Y has property (1).

For example, ClojureScript's priority is not about producing a clean mapping between Clojure and JavaScript, it's about bringing the expressiveness and power of Clojure to client-side development. If you look at the ClojureScript example page you see lots of "Here's how you do X in ClojureScript, but there's not native way to do X in JavaScript."

If we had two ClojureScript compilers A and B, and A produced 10x faster JavaScript than B at the cost of lots of crazy optimizations, we might very well choose A.

It'd be a much harder call for CoffeeScript, because part of the pitch CoffeeScript makes to developers is that it's "like JavaScript without all the bad parts."

I don't necessarily agree with the above, but that's my understanding of Fowler's argument.

</comment></comment><comment><USER4> I've been playing with the lively kernel lately and noticed that it serializes everything to a web page that includes CSS and javascript. My first reaction was "how horrible", but then I realized that you never actually have to edit the page itself -- whenever you change anything or need to debug, you load the page first into the lively kernel (deserialize it).

So, there could be an addendum here -- the HTML/CSS/Javascript trio doesn't need to remain fixed. It is totally possible (maybe tedious and slow) to build a browser development environment where you write SASS and coffeescript in the browser and execute it there. It would be interpreted and compiled on-the-fly, and errors caught in that process, rather than in the browser's normal execution. That way you could provide feedback about the sass and coffeescript, rather than whatever it gets compiled into.

The lively-kernel (and squeak before it) does this quite well already. It even provides readable tracebacks for javascript errors, rather than just a script and line number like most web inspectors.</comment>


Show HN: 3D printing molds for pressed dough (speculoos) - <AUTHOR> http://makefastworkshop.com/hacks/?p=20171116 <comment><USER2> We call it Speculaas, not loos.</comment>


Unicode in, Zawgyi out: Modernity finally catches up in Myanmar's digital world - <AUTHOR> https://www.japantimes.co.jp/news/2019/09/27/business/tech/unicode-in-zawgyi-out-myanmar/ <comment><USER2> [https://en.wikipedia.org/wiki/Zawgyi_font](https://en.wikipedia.org/wiki/Zawgyi_font)

Seems like what "Zawgyi" refers to is a Unicode font that uses the Burmese block in Unicode but maps the characters in a way that's completely incompatible with standards-compliant fonts. Sounds horrible.

<comment><USER3> > Furthermore, there were significant revisions in Unicode's implementation of > Burmese script up until Unicode 5.1 in 2008.

So they didn't have full Burmese support anyway until as recent as 2008?

</comment></comment><comment><USER4> This is good news to hear. Last year I helped set up Android phones with Burmese immigrants in Thailand and they gave me confused looks when I switched the script to Unicode, especially since all their friends on social media would be using Zawgyi, so I ended up switching the phones to English and Zawgyi on a per-app (e.g. Facebook) basis.

However, it may be toughest to make this switch for casual users since the "broken" Unicode essentially stops them from being able to communicate with others.</comment>


Map overlaying the 4 next largest economies over the USA - <AUTHOR> http://flickr.com/photos/22994175@N03/2205172655/sizes/l/

<comment><USER2> I don't get it. Like, it's a pretty map, but after staring at it for a couple of minutes I can't figure out how it's supposed to relate to the real data:

[http://en.wikipedia.org/wiki/List_of_countries_by_GDP_%28nom...](http://en.wikipedia.org/wiki/List_of_countries_by_GDP_%28nominal%29)

</comment><comment><AUTHOR> The idea, I think, is to show the relevant chunk of the United States which is equivalent to the economy of each given country.

</comment><comment><USER3> Wait a minute, the Southeast produces ~5x more than the Northeast? Please tell me it's not about (Golf Coast) oil.

<comment><USER4> No, you're misinterpreting it. The Northeast produces more than the southeast. What that map says is that the Northeast's GDP is approximately that of Japan (both ~$4.3 trillion), but $40 billion more than Japan's. Similarly, the Southeast's GDP is $216 billion more than that of the UK (both ~$2.5 trillion).

<comment><USER3> I gotcha. So you need to know those countries' GDPs to interpret the graphic. I thought it was a comparison based on land area and that those countries GPDs were roughly equal, which is way off.

</comment></comment></comment><comment><USER5> Any updated data, other then 2006?</comment>


Gameboy Advance Development by Example: Drawing and Moving Sprites - <AUTHOR> http://kylehalladay.com/blog/tutorial/2017/04/04/GBA-By-Example-2.html <comment><USER2> Every time I read about GBA internals I'm still amazed something like Super Monkey Ball Jr ([https://www.youtube.com/watch?v=K-AZQKTlUMs](https://www.youtube.com/watch?v=K-AZQKTlUMs)) could have been created on that platform...

<comment><USER3> would love to read a technical making-of of one of these games that pushed the boundaries of their respective target platforms. Anyone got any suggestions?

</comment></comment><comment><USER4> I have one nitpick here:

>I'm using 32 bit integers to store tile data because the GBA is a 32 bit machine at heart, and I've found a couple places online that talk about how much faster the GBA hardware is at working with 32 bit integers vs 16 bit ones when possible. Since I have no way of verifying this right now (no timers yet!), this is also a matter of faith for the moment.

This is true if you're doing calculations. However, memcpy works in bytes (logically, anyway) so it wouldn't make any difference for tile data. Storing tile data as ints would complicate things if you ever want to modify any of your tiles.

Nitpicking aside, this is an excellent tutorial. The simplicity of the code makes it easy to understand.

<comment><USER5> IDK anything about GBA dev. But on x86_64, memcpy is traditionally implemented by copying 64-bit data until len / 8 == 0, and then copying the remaining bytes[0]. I suppose this is faster because accessing data with the proper cpu alignment is faster.

0: [https://github.com/lattera/glibc/blob/master/string/memcpy.c...](https://github.com/lattera/glibc/blob/master/string/memcpy.c#L39)

<comment><USER6> I'd contend that the in this day and age the most space efficient and fast way to implement memcpy on x86_64 is to "rep movsb", which triggers internal memcpy on the CPU anyway as per Intel® 64 and IA-32 Architectures Software Developer's Manual, Volume 1 Section 22.214.171.124

<comment><USER7> Last time I checked, the movs variants were microcoded slow path; you used SSE to get the fastest memcpy.

</comment></comment></comment></comment><comment><USER8> Has anyone written a Unix-like OS that runs in a GBA? Maybe you could even build a cartidge with IO (keyboard support) and a simple com port for networking.

<comment><USER9> Yeah, there was this: [http://www.kernelthread.com/publications/gbaunix/](http://www.kernelthread.com/publications/gbaunix/)

It's of course severely limited due to the small amount of memory and lack of an MMU.

</comment></comment><comment><USER10> Enjoyable to see the youngsters discovering MOBs all over again. :-)

[https://www.c64-wiki.com/wiki/Sprite](https://www.c64-wiki.com/wiki/Sprite)

</comment><comment><USER11> Nice. I have a GBA Micro and a development cartridge taking dust in a box, I might very well jump into this. Do you have a tutorial where you explain how to set up the development environment? Anyway I skimmed your tutorial here and it looks clear and fun!

<comment><USER4> I think the Tonc tutorials, which are linked to in the articles, go through all that.

</comment></comment><comment><USER12> Cool to see the follow-up based on feedback so quickly.

<comment><AUTHOR> Thanks! I think the feedback that I got last week on here was very good. Despite my initial desire to stick with the bitmap modes and try some 3Dish stuff, it really didn't make sense to try to learn new hardware by ignoring the most common use case.</comment></comment>


Ask HN: Does anyone actually use Keybase? - <AUTHOR> Every other HN profile lists a Keybase public key and a proof, but has anyone actually needed to prove their identity on HN? Does anyone use Keybase for encrypted communication? <comment><USER2> I have used Keybase since it first showed up on HN for Comms and Git. Technically I have done the proofs for identity, but no one cares about that.

The Git usage was really nice. It's fast and secure. While I didn't use it for most projects (because I want them on github/gitlab for various reasons), it was very useful for backing up machine specific configs and history (using a script and mackup). Knowing that it was well encrypted made me not worry about what was being backed up, if there were credentials, etc.

As for comms, I used the 1:1 chat with a friend for quite a while. While it worked, it's slow. Sending messages is a little slow, sending images is VERY slow. Anytime the app is closed (like constantly on the phone), re-open times were slow (for decryption). Eventually I gave it up and moved those few chats over to Telegram (Because it's secure enough for most conversations).

<comment><USER3> Did you consider Signal when you moved to Telegram, if so any particular reason(s)?

<comment><USER4> I tried Signal and Telegram. But I prefer Wire instead. Its secure by default, cross-platform, multi-device, and simple enough for Mom & Dad to use.

<comment><USER5> How does that differ from Signal?

<comment><USER6> No Signal Web app. So, not as cross-platform.

<comment><USER7> Wire & Telegram are both cloud connected, while Apps on the Signal protocol depend on your phone to be functioning and in reach AFAIK (huge annoyance/problem for me).

<comment><USER8> That's not true about Signal. You may probably be facing some bug that should be reported to the Signal team.

Telegram is completely cloud based. So all your conversations, except secret chats that are end-to-end encrypted, are stored on Telegram servers in plain text for as long as your account is active. This is why you can get a new device, activate it for your account and get all your conversations back on it from the Telegram servers.

Wire and Signal work differently. They use their servers as a temporary storage to hold your messages until the recipient comes online and then deliver them. Wire also retains the messages for a few days to allow delivery to multiple devices that a user may be using, with each device possibly coming online at different times. Signal doesn't have to support this because it's tied only to a single device, which is your phone.

</comment></comment></comment></comment></comment></comment></comment><comment><USER9> I used it initially but then found out that bare gpg covers most of my needs.

For example:

\- passwords using pass [0] decrypted with Yubikey, and with Password Store [1] on Android (the same repo, the same Yubikey),

\- FDE with LUKS decrypted on boot with Yubikey [2],

\- encrypted e-mails with Enigmail and K9/OpenKeychain on Android, works with the same Yubikey 4C token! Web Key Directory on own domain for easy e-mail -> key mapping,

\- OpenKeychain also has "linked identities" (verifying social profiles) but at this point I consider it barely useful stamp collection,

\- for E2E instant messages Conversations [3] with OMEMO.

[0]: [https://www.passwordstore.org/](https://www.passwordstore.org/)

[1]: [https://github.com/zeapo/Android-Password- Store](https://github.com/zeapo/Android-Password-Store)

[2]: [https://github.com/fuhry/initramfs- scencrypt](https://github.com/fuhry/initramfs-scencrypt)

[3]: [https://conversations.im/](https://conversations.im/)

</comment><comment><USER10> I don't, but I've rarely needed to send files etc to other hacker news users.

I would LOVE it if I could use keybase to send a copy of my passport to companies (for example) which is nessesary for day to day life, and always done in a redicously insecure way. :(

<comment><USER11> Sounds like what Telegram Passport is trying to do.

[https://telegram.org/blog/passport](https://telegram.org/blog/passport)

<comment><USER10> Its a much bigger stretch to have companies change the underlying method of verification instead of the method of transport though ...

</comment></comment></comment><comment><USER12> I've been using it for encrypted communication for years, but I only provided an HN identity because I was essentially collecting stamps.

</comment><comment><USER13> Keybase is shitty. They had the ambition to somehow build a new generation of keyservers, they built it using technology that could easily be a distributed protocol and then they made it a completely centralized and commercial bs crypto startup. So much waste since keyservers and distributed identity (and reputation, and naming system in general) is a field where everything is still to do. They could have overthrown DNS (machine names) _and_ HTTPS (certified names; any CA-based ssl system) _and_ google contact ("people" names). I'm very salty that they've diverted so much hype in that area for so few results.

</comment><comment><USER14> I use KBFS and encrypted Git almost every day.

I've never needed the identity proofs. The teams/chat features are great but I rarely use those either. Maybe when adoption increases, but until then I'm loving my free 250 GB cloud drive and unlimited Git repos up to 100 GB.

</comment><comment><USER15> I use it solely for hacker cred.

</comment><comment><USER16> Prove identity: no

Encrypted communication (and files): yes, we use it for Solo, and we also have a public team [https://keybase.io/team/solokeys.public](https://keybase.io/team/solokeys.public)

</comment><comment><USER17> I considered using it, tried registering but had some issues. Tried reaching out to them but it seems like there is absolutely no way to contact them (other than their twitter, which looks somewhat abandoned).

This made me pretty suspicious, but especially since [https://keybase.io/support](https://keybase.io/support) is just another user claiming to be Keybase support. That's a huge red flag in my book, more so for a security product.

I don't know, but for me this didn't really inspire much confidence.

<comment><USER18> I've had good luck communicating with them on the public team keybasefriends. They have various channels for different features, but asking on #general is usually a good way to get help, either from someone from Keybase or someone else who knows the answer to the question.

<comment><USER17> Interesting. I guess only being available for help on the app one made is one way to crank up the number of installs.

</comment></comment></comment><comment><USER19> Yes, mostly as a means of verifying identity across accounts.

I'd probably pay a few bucks a year (thinking 20) for the _base_ identity service, if we're being frank. Even if the only separation between a free tier and a paid tier is e.g. more service integrations and an uptime SLA... sure, why not?

</comment><comment><USER20> I use it. I've been impressed with all the improvements they've made over the years. I've struggled to get other people to use it though, but I have had some success and when I've talked other people into signing up it has worked well.

</comment><comment><USER21> I use keybase almost exclusively as an encrypted git tool. My personal notebooks live there.

</comment><comment><USER22> It's hard enough to get people to use signal...

</comment><comment><USER23> When I first heard about it, I signed up for it and set it up on all of my computers and devices.

I also evangelized it pretty heavily and managed to get about 10 other people to use it.

Unfortunately, I ran into some pretty major issues with the desktop clients. They seemed to be coded pretty poorly, eating up massive amounts of CPU and/or RAM, and sometimes even causing my computer to freeze.

In practice, there also didn't seem to be much point to encrypting conversations if there was no password required to actually see them (if someone got a hold of my computer). And (at the time) there was no way to delete a message.

Due to these issues, I ended up installing it.

I'm curious if things have gotten any better since then?

<comment><USER24> Editing/deleting messages is now possible, along with options for automatically expiring messages.

Not sure if the desktop clients have improved, but I haven't had any issues in the last year or so.

</comment></comment><comment><USER25> I've used it in several communities to prove identity and statements in cases where I both have either authority or a need to be trusted, since I choose to remain pseudonymous.

It's easier for people to grasp/verify than the alternative ("pure PGP"). They go to /verify, paste in my message, and make sure it confirms as me. Keybase being compromised is outside the scope of the threat model - the threat model is mostly "impostors pretending to be me trying to get you to download potentially harmful files". People have no reason to know who I am but they do have a need to verify I am who I say I am.

</comment><comment><USER26> I host my website on keybase and use git and messaging to do freelance jobs. If anyone's interested here it is [https://turbocafe.keybase.pub](https://turbocafe.keybase.pub)

</comment><comment><USER27> I use it, in the sense my public key is on there, and I follow a bunch of people on there, but since they invented their own crypto model, it's just a place to store public keys.

</comment><comment><USER28> I use it the git aspects of it heavily for projects where I get lazy and should be using proper secret storage (for example Ansible playbooks with secrets not secure...). This is far from ideal, but makes personal development a great experience.

Secondly to that, we heavily considered and trialed it a work to unseal Hashicorp Vault. You can add a single identity that is able to unseal, and having that person verify in the keybase-esque method is a great idea.

</comment><comment><USER29> Maybe if I had the need to prove my identity but I'm just an anonymous coward.

I do like keybase but practically in my day-to-day life GPG ends up filling all my needs.

</comment><comment><USER30> We use it as a quick and dirty shared secret storage at work (when you need to pass someone an API key or stash some service credentials somewhere). It works, and keeps those things from sitting around in plaintext, but I've been trying to move everything that's stored there to something like Hashicorp Vault or GCP/AWS KMS so we have a proper audit trail and key rotation.

</comment><comment><USER31> I've started using kbfs for personal notes and encrypted git for financial planning code.

We're also trying Keybase out as a family chat channel. I really like the CLI interface and the integration with kbfs, and of course the e2e encryption. We're probably going to stick with Slack for now, though, mainly because it runs on Chromebooks.

</comment><comment><USER32> It has mostly replaced gpg in my usage. It's not common, but it's present. HashiCorp Vault has a nice integration.

</comment><comment><USER33> I've been using the encrypted git feature to backup dot files and other bits of system config. At work, my dev team uses the FS and chat features for sharing sending sensitive files we don't want sitting around on email, google drive, etc. Overall I think it's a pretty great product and I hope it stays around for a while.

</comment><comment><USER34> When it was new I was excited about it and it pushed me over the edge to actually starting my usage of GPG and setting it up properly with smartcards etc.

Then I started to go to keysignings etc and started using the keyserver infrastructure etc.

And then it took a while and I realized that I never used keybase and removed my account.

</comment><comment><USER35> I've had others use their browser-based encryption form to send me sensitive data before — that's pretty handy.

</comment><comment><USER36> Right now I use it for encrypted file storage and private git repositories that I don't want anyone looking at. I don't have 100% trust in the security of the platform, but I prefer it to Dropbox or Google Drive where the probability of someone snooping around my files seems higher.

<comment><USER18> At least the Keybase code is open, so even if you can't personally validate that it's secure, someone else can.

Neither Dropbox nor Google encrypts and keeps the keys client side, so not trusting them is probably the right thing to do (also Dropbox has been misleading in the past about their security, so that's another reason one should be careful).

</comment></comment><comment><USER37> I use it for private repos and convos. I want to use it a lot more. It just makes sense. Unfortunately not a lot of people I know use it.

Add me if you care to make a pen pal. [https://keybase.io/dfischer](https://keybase.io/dfischer)

</comment><comment><USER38> Our team uses it to share sensitive docs (logs, user details, api keys etc.) and occasionally as a secure chat channel (i.e. if we want to communicate off work Slack).

I have a copy of some important docs (taxes, etc.) in my private KBFS.

</comment><comment><USER39> I'm currently using it for git, principally for storing personal dotfiles (.ssh/config, etc.) that I need on a couple workstations. It looks neat, but it suffers from a mindshare problem as a social network.

</comment><comment><USER40> Yes, I use its git feature for certain projects, and have used it for chat for a while. I have found if I come across a developer who has a profile its the easiest way to get in touch with them.

</comment><comment><USER41> I would use it if they provide a way to "lock" local installation or to make it portable: I want to use it in my office PC, which can be accessed by lots of people...

</comment><comment><USER42> Yes, it's critical to bind pubkey to identity: [https://keybase.io/qertoip](https://keybase.io/qertoip)

</comment><comment> vaer-k I've reached out to people with it, and it turns out that they actually respond! Who'd've thunk? It's nice for encrypted cloud storage too.

</comment><comment><USER43> A Keybase key could be used to signal you are a 'real hacker'. A bit like using Vim, Emacs or butterflies could be used to that end.

</comment><comment><USER44> I use it for a few of my personal Git repos, but that's about it. Some file storage but nothing too huge or important.

</comment><comment><USER45> The Keybase filesystem docs still contain the text:

"At the time of this document, there are very few people using this system. We're just getting started testing. Note that we could, hypothetically, lose your data at any time. Or push a bug that makes you throw away your private keys. Ugh, burn."

And considering that kbfs is one of the more mature parts of Keybase, it has never inspired confidence in me that any of it is really ready for serious use.

</comment><comment><USER46> I used it to sign my "will"...reading this reminds me I gotta get a real lawyer to take a look at that!

</comment><comment><USER47> I use it for git repo management on some of my home things. Have not used it for much outside of that.

</comment><comment><USER48> Few engineers at my start-up were using keybase to share credentials between them, as well as between company and/or personal laptops. A lot of information was exposed to the wild internet (machine names, developer names, connection between them,...) posing a clear security risk. My experience is that most engineers do not understand how to safely use keybase at that point.

<comment><USER27> How is that information a security problem greater than say LinkedIn?

Also, I'm curious where machine names were being exposed in Keybase?

<comment><USER49> Machine names, example from a Keybase founder: [https://keybase.io/chris/devices](https://keybase.io/chris/devices)

<comment><USER18> You choose those names when you add the device. It can be anything.

That said, it would probably be good if they added a note saying that the device name you choose is public, which is not really clear in the current UI.

</comment></comment></comment></comment><comment><USER50> specifically to prove my identity? no.

i used the filestorage/filesharing earlier and was happy about the git repository support though.

there were however very few of us, and we all dropped it when they jumped on the crypto currency wagon.

</comment><comment><USER51> I deleted my account after not using it for a long time for anything.

</comment><comment><USER52> Sure thing. I do.

I keep asking my friends to join up. Let's try the team feature!

So far, no luck.

</comment><comment><USER53> I created an account last week, but I haven't used it yet.

</comment><comment> donkey-hotei My current team and I use it to share files for the most part.

</comment><comment><USER54> Frequently for chat and file sharing.

</comment><comment><USER55> For cloud storage backups

</comment><comment><USER56> Why would anyone tell you if they did?

<comment><AUTHOR> Why would anyone want to hide that? Not an expert in security, maybe I don't have the mental model.

<comment><USER49> It's just a way of minimising your footprint. If you google me, and can't find what services I use, it makes it that much harder to try and find a foothold into hacking something, or building up a profile.

<comment><USER25> Then you wouldn't be using Keybase if that was part of your threat model - since a significant point of using it is to tie together and prove identities across some popular sites on the net.

See: [https://keybase.io/nadya](https://keybase.io/nadya)</comment></comment></comment></comment>