VW - <AUTHOR> http://blog.cleancoder.com/uncle-bob/2015/10/14/VW.html <comment><USER2>
       I suppose you could make the argument that these programmers did not
       know what they were doing. That they were simply given some specs, and
       they implemented those specs, and didn't know that they were
       accomplices in a case of massive fraud.

       I think that argument is even more asinine than Michael Horn's. They
       knew. And if they didn't know, they should have known. They had a
       responsibility to know.

I agree with all the points in the article except for the point that the programmers should have known.

For me it is a plausible scenario that the programmers have been told that his feature is needed for _some good reason_ (probably testing).

When I was a young engineer I had a mentor. He was a war baby and a strict pacifist. He was also very good and his advice was much sought after so he could afford to refuse all offers from the defense industry.

He once told me that for his whole life he manged to never designed anything that could be used to harm people - except for one thing. When he was young he was hired to design a gear rim for a crane. He told me, he was given the load specifications but never saw a drawing of the actual crane. That was a bit unusual but nothing he worried about.

It turned out that the gear rim was actually for a Howitzer. He never worked for that client again.

There are all kinds of reasons why a car has to behave differently while on a dynamometer and there are all kinds of special code branches that are executed only during test. For the programmers it probably was just another special case among many.

Don't be evil and don't be a fool, but you can't be expected to do a full ethics check for every feature you are supposed to implement.

EDIT: Spelling, style and removal of some superfluous chatter.

<comment><USER3> From what I've read, the trigger for the mode switch was very detailed and narrowly tailored to the EPA certification testing, and included barometric pressure as a factor.

That makes it quite a bit harder to believe that whoever implemented it thought it was for some legitimate testing. For testing you want a trigger that is hard for anyone to hit accidentally, but easy for people who know about it to hit. You would not include barometric pressure, because that narrows the ability to get into the test mode way too much.

An ideal sequence would be some nonsensical sequence of inputs, like a specific sequence of left and right steering inputs, with a specific sequence of turn signals (often opposite of the direction turned) if the ECU has turn signal data available, interleaved with a specific pattern of taps on the brakes.

<comment><USER2> I don't doubt that the developers where told to specifically write code to detect the EPA certification testing environment. I just think it is a possible scenario that they were left in dark about the real reason for the detection to exist in the first place.

Hypothetical example: The Lane Keeping Assistant can actively adjust steering. Turing the wheels during a test on the dynamometer can make the car jump off the rolls and harm people. The dynamometer is a highly artificial environment that can potentially confuse the Lane Keeping Assistant.

Do you ensure safety through testing guidelines or through safety measures in code? Would this be a plausible reason for a developer to write the dynamometer testing environment detection code?

</comment></comment></comment><comment><USER4> I find his assertion that the programmers "should have known" to be beyond naive.

There's a reason that teams designing these sorts of systems consult with lawyers who are experts on the relevant law. The programmer's job is to program. Expecting them to also deal with details of legality and morality (beyond grossly obvious things like hard coding dosage limits into medical equipment) is just wishful thinking.

That's the kind of talk that people want to hear. "Oh the developers were given shitty instructions, they shouldn't have listened" but talk is cheap. Stop to consider the implications of that sort of second guessing. Obviously things get wacky at both extremes but when you give someone a spec to meet you need to have an expectation that it will meet that spec. Our industry is built upon millions of black boxes that meet I/O spec sure having the developers turn around and say "we changed you spec because it was killing polar bears" comes with a much larger can of worms than just implementing what you're told to implement and accepting that it might not be morally agreeable and getting on to the next thing.

There's a reason people aren't all generic worker bees. It's efficient to have the lawyers worry about laws, coders worry about code and managers act as the interface between them and accept the blame if what the lawyers say isn't properly translated into the programmers' instructions. than it is to have all three groups worry about all three subjects.

I think law is interesting and has a lot in common with software developing but I don't want to have to go looking up case law as required research before coding a windshield wiper controller..

<comment><USER5> _The programmer 's job is to program. Expecting them to also deal with details of legality and morality (beyond grossly obvious things like hard coding dosage limits into medical equipment) is just wishful thinking._

We're humans, not robots. People can be expected to think about things and participate in society. It's generally held that we should expect pretty much everyone to concern themselves with details of legality and morality as part of being a good citizen... "I'm just a simple automaton doing what I'm told" is generally not a valid excuse.

Do you actually know programmers who literally just take specs and implement them and have no thoughts or opinions about the larger context of what's going on? In my experience, programmers have a lot to say about non-programming aspects of work.

The other issue here is, what constitutes "grossly obvious?" You just drew a totally arbitrary line based on your own opinion of what can be expected and what can't. Your argument is a bit of a strawman, nobody is expecting coders to go read up on case law.

Ultimately, we don't know anything about what happened at VW. We don't know who was responsible, or who knew what, and we're all just crafting up scenarios and speculation ("you see, the specs were such that the engineers couldn't possibly have known what was going on") based on our own experiences and biases.

<comment><USER6> _Do you actually know programmers who literally just take specs and implement them and have no thoughts or opinions about the larger context of what 's going on?_

Sadly, yes. I've found this to be the case with most outsourced developers I've managed. They follow the spec to the T even if there's a glaring issue staring them in the face.

</comment></comment></comment><comment><USER7> Writing the software is one act. Being the one to greenlight taking this software and putting it into machines that will be sold to end customers is another.

I can see many reasons why software might be written, or maybe even configured, in a way that could be lethal when deployed to an actual customer, but have completely valid and sane reasons for existing (all maner of testing comes to mind).

Unless it can be proven that the developers had intent and did follow through, there is no particular reason why the blame should fall entirely on them.

Additionally, if he is so intent on having a "profession" that punishes illdoers, he should first call for one that protects good members.

</comment><comment><USER8> It is absolutely plausible that the programmers had no idea.

From the excellent Metafilter thread:

> i mean, how do the product managers rationalize this feature to their > colleagues? what to they write in the spec that isn't all-out incriminating?

Modularity

Department 1:

Req 1: Software should enable emissions controls upon receipt of control signal A.

Req 2: Software should disable emissions controls upon receipt of control signal B.

Department 2:

Req 1: if epa testing device is detected send signal A.

Req 2: if epa testing device is not detected send signal B

[http://www.metafilter.com/153117/EPA-Accuses-VW-of- Emissions...](http://www.metafilter.com/153117/EPA-Accuses-VW-of-Emissions- Cheating#6213352)

<comment><USER9> Still seems kind of fishy, at least without some stated reason why it needs to know it's being tested.

<comment><USER10> See this comment from weinzierl, which has an example of a system that needs to behave differently while in a test environment:

[https://news.ycombinator.com/item?id=10409417](https://news.ycombinator.com/item?id=10409417)

</comment></comment></comment><comment><USER11> A wise future programmer might want to ensure that the software he writes acts mostly like science――it can be used for good and it can be used for bad but isn't inherently neither――and will thus force outsourcing decisions about the final product to someone else.

Maybe it's ok in the Volkswagen software to have a knob that controls the amount of NOX in the exhaust, for testing purposes and for adapting the car to various markets. Maybe it's ok for the software to provide heuristics for the driving conditions (highway, city, dynamometer) for some future telemetry application. But the wise future programmer does realize it needs to be someone else than himself who makes the decision to configure the system to couple those two things together, and make the car reduce pollution only when dynamometer mode is active.

Good old shifting of blame works for the bad guys as well as the good guys. It may not be pretty but it works well enough if only you're willing to draw the line of responsibility somewhere for yourself.

</comment><comment><USER12> > It doesn't matter that their bosses told them to do it. They did it.

It's not that easy. Sure, what they done can be considered "evil"... but what if they had refused to do it? They would have most likely lost their jobs and they would have no chance in a court trial. Volkswagen has a army of lawyers and is in tightly connected with every relevant government agency in Germany.

<comment><USER13> This is all very theoretical, since we don't know the situation.

But the other possibility would be to "blow the whistle" anonymously.

The chances of getting away with that still aren't great (if VW put some effort into flushing out the snitch, I think only a practised liar could get through it...), but it's another way forward.

And actually: it's possible this _actually happened_ , and the official story of how this was discovered is just a cover for an anonymous engineer who managed to get a warning to the right person.

<comment><USER14> There is some evidence indicating that there's corruption at play, not just within Volkswagen but also in the lobbies and government. Blowing the whistle would likely put them in a similar situation to Snowden (i.e. unable to take the legally blessed route, having to go directly to the media, denying them any protections otherwise granted to whistle blowers), legality-wise.

</comment></comment></comment><comment><USER15> Even if everything in the article were right, I disagree with the conclusion. I'm glad there we have no "profession" to act as another gatekeeper for people to do things. The negative consequences of such "licensing" system (which will probably transform into a political pact soon enough after introduction) are more profound than the cost of its nonexistence.

</comment><comment><USER16> The vast majority of people working on the Manhattan Project had no idea they were building a bomb.

What says the programmers knew?

</comment><comment><USER17> It's conjecture at this point to say anyone who programmed the ECU to do this knew what they were doing.

Saying that, it is likely they did know but this comes from above. There's a few psychology experiments that show many humans will do things they know are wrong or immoral when an authority figure tells them to do it even though they don't want to do it. The Milgram Experiment, for instance, comes to this conclusion, among others.

Peer pressure and obedience of authority are real phenomenons and that starts with the leadership that needs to be held accountable. Hearing an authority figure pass the blame to someone at the bottom is disgusting and barking up the wrong tree I believe.

<comment><USER18> Is that the experiment that showed that "assholes" are the ones who wouldn't do what they were told if they found it immoral?

While the "nice" and "obedient" always did as they were told? Then we're told never to hire "assholes".

<comment><USER17> I am not a psychologist, nor did I even take 101 in college, but I don't know if the Milgram Experiment came to a conclusion about perceived personality types. I did have a passing interest in these types of experiments for a few hours and read overviews and conclusions to them and I believe I recall "agreeableness" being something humans strive for to get accepted into a group. The Asch experiment in the 1950's showed people will purposely give the wrong answer if others in the group gave the wrong answer to a basic perception question. [1]

"Assholes", in your context would be people that don't fit the "culture" of the companies "group". Possibly off topic, but it's one of the reasons I always get a bit nervous when companies define their "culture".

[1] [https://explorable.com/asch-experiment](https://explorable.com/asch- experiment)

</comment></comment></comment><comment><USER19> When Goldman Sachs blamed their enormous options pricing fiasco on software engineers in 2013, it started the great brain drain of the last two years.

[https://www.sec.gov/litigation/admin/2015/34-75331.pdf](https://www.sec.gov/litigation/admin/2015/34-75331.pdf)

<comment><USER20> Great brain drain? Meaning software engineers are leaving banks in large numbers?

</comment></comment><comment><USER21> "The public has been made aware that programmers can be culprits. This will make it more likely that the next time something goes wrong -- a plane crash, a fire, a flood -- that the public will jump to the conclusion that some programmer caused it. Yes, this is a stretch; but it wasn't so long ago that the concept of programmer implication in disasters was non-existent."

"...it wasn't so long ago..." What?

[https://en.wikipedia.org/wiki/Therac-25](https://en.wikipedia.org/wiki/Therac-25) \-- This has been a thing since at least 1985 and probably far longer.

<comment><USER22> Exactly. There is an existing legal and moral framework for precisely these sorts of situations. It seems to work very well for the emissions scandal too, so why mess with it.

Even if the programmer was fully aware of what they were doing, VW would still be the only party that's legally and morally responsible for this.

(And may God help whoever made the Therac-25 mistake, just imagine making a bug like that)

</comment></comment><comment><USER23> What is stopping a company from hiring a contractor to code the illegal parts to thereby insulate them from responsibility? This happens with oil and gas disasters as discussed on John Oliver [https://www.youtube.com/watch?v=jYusNNldesc](https://www.youtube.com/watch?v=jYusNNldesc)

<comment><USER24> Because many contractors are too smart to do that kind of dirty work. Contractors are liable for harm they cause. I've refused contracting jobs because of liability.

</comment></comment><comment><USER25> Sometimes I would not mind if developing software would need a license, even if I'm speaking against myself ATM.

<comment><USER26> The trouble with licensing a profession like software development is that no- one really knows how to do it very well yet. It's far too young and diverse an industry to have that level of experience and consensus.

Lacking more objective standards, the most likely result of attempting to regulate at this stage seems to be regulators who talk a good talk -- such as the author of this article. Those people will not necessarily be the ones with either the best ideas currently available for building good software or the most useful experience and/or data to advance the state of the art in the future.

I sometimes work on software that really does have to behave properly because significant failures in production really could be very damaging. The idea that some of the careful, successful processes used on some of those projects might be required by regulation/legislation to give way to the kind of junk that a lot of consultants peddle is quite scary.

<comment><USER27> _The trouble with licensing a profession like software development is that no- one really knows how to do it very well yet. It 's far too young and diverse an industry to have that level of experience and consensus._

Only artificially so. Modern software development is mainly about re-inventing wheels from the 1970s with slightly different syntax and more bugs in. If we had settled on a language - doesn't matter what, Ada, ML, C, Lisp, FORTRAN - they're all Turing-complete after all - and gotten on with y'know actually building things, software engineering would be a mature discipline by now. Instead all the accumulated experience gets chucked out the window everytime fashion changes.

<comment><USER28> Luckily we settled on C and we've all seen how bug-free that turned out to be /s

<comment><USER27> If C was the only language, then a vast body of experience would exist in it and no-one would be writing new code with off-by-one errors in it. What we have right now is everyone "knows" many languages, but actually has little experience with each one. And given the chance to use a new language, we jump at it, even tho' we all know better.

<comment><USER26> Given the vast body of experience we do have with using C and given that we are in fact still writing new code with off-by-one errors in it, I'm not sure this argument holds much water. There are plenty of developers who have decades of professional experience programming in C, and some of those people are really smart and make software that millions of people depend on, and they _still_ make those mistakes. A bad workman might always blame his tools, but even a good workman will do a better job with better tools.

</comment></comment></comment></comment></comment></comment><comment><USER29> While the ethics behind the implementation might have been obvious, the actual legality of is not. The law could very well have been written in a way that makes this completely legal.

A software engineer would most likely not know the intricate details of the law required to know whether it was legal(in all nations) or not.

</comment><comment><USER30> Professions are tools workers use to increase their bargaining power over employers and put up barriers to entry into said profession. See doctors.</comment>


Who was your Childhood Inspiration? - <AUTHOR>

Personally, I was never more motivated to learn about computers than when I would look through Kim Schmitz's (aka Kimble) photo galleries online. I think anyone who visited that site as a pubescent boy will understand what I'm talking about.
For those of you who don't remember him, Kimble was a flamboyant, very (temporarily) wealthy, German hacker whose life consisted of buying exotic cars, hanging out with models, and traveling all over the world. Also, um, there was something about insider trading (but that's hardly inspirational).
http://en.wikipedia.org/wiki/Kim_Schmitz
 Who inspired you to focus on technology/startups? <comment><USER2> Steve Pavlina's and Paul Graham's articles circa 2002 and up; Bill Gates/Microsoft (QBasic, Visual Basic, C); volunteer work and after school clubs to learn that it doesn't matter if you're making money/getting graded/successful/one of the starters, if you're around smart people and having fun and learning a lot; business articles in general; learning to focus on taking things into my own hands and think logically, regardless of what people say is possible or isn't; thinking (maybe mistakingly) that inventing or discovering something is commonplace and therefore I have to do it.

Childhood inspiration for a startup? I was just happy to be learning English and didn't have a computer until I was 14.

</comment><comment><USER3> Never thought about startups until a combination of forces started coming into play all at the same time. Paul's article on what wealth really is, gave a different perspective.

As for childhood inspiration, I don't think I ever had one. I remember liking to read picture books on robots. That's probably where some of it comes from.

</comment><comment><USER4> my mother actually... for saying the internet is "no place to make 'real money'"

(i tend to try my best to prove people wrong w/ they say something i'm doing is impossible)

needless to say, after making money as a PHP hacker for several years now... she still asks if i've looked for a real job. heh...

<comment><USER5> What counts as a real job to her? Does she realize that computers and the web are now an integral part of society?

</comment></comment><comment><USER6> Paul Graham as of when "Why Nerds Are Unpopular" was published. Eric Raymond before that.

</comment><comment><USER7> Bill Gates :)

</comment><comment><USER8> MacGuyver</comment>


Ideas For Your Next Startup - <AUTHOR> http://devcodehack.com/5-ideas-for-your-next-startup/

<comment><USER2> The new news aggregator: Bradford Cross[1], founder of YC 09 FlightCaster, is giving his shot at this with GetPrismatic[2]

[1] <http://www.crunchbase.com/person/bradford-cross>

[2] <http://getprismatic.com/newsfeed>

</comment><comment><USER3> No. 2 has been done a lot and is very hard to monetize and scale? There's a lot of people tackling 3 and 5 (including tbe aforementioned pinterest) and 3 doesn't seem practical/useful at all, imho...</comment>


After three years, iPad sales are up again for Apple - <AUTHOR> https://arstechnica.com/gadgets/2017/08/after-three-years-ipads-make-money-for-apple-again/ <comment><USER2> I am an owner of an iPad mini (the one with the retina screens) and used to use it all the time as a gaming device I.e: GTA mobile.

I've recently bought one of the new iPad pros (10.5") and all I can say is wow, this thing is amazing, I use it very often for sketching out system diagrams with the apple pen, I used to use a surface pro 2 for that, I really feel like the new iPad pros , with the faster pen refresh rate are a game changer, now I'm still not happy about apples closed garden approach, but you can't have everything right.

It's seems like apple went through a period of denial about the usability of a stylus and have only recently seen the light, I guess back in the day it was a way to differentiate themselves with the multiple windows tablets out there (with horrible response time, the ones where you had to stab the screen to make your tap register)

<comment><USER3> In addition, I was the owner of an old iPad 2 which soldiered on until this year. 7 years, not bad. I was eventually tempted to upgrade by the cheapish- and cheerful 2017 iPad (sans stylus) and am very happy</comment></comment>


Google to push new ads on its apps - <AUTHOR> https://www.reuters.com/article/us-alphabet-google-advertising-idUSKCN1SK1YK <comment><USER2> > In Maps, ads will now appear [...] during navigation.

Unless I'm missing something, distractions whilst navigating (and thus possibly driving) seems like it could be dangerous.

<comment><USER3> I really, really, _really_ wish there was serious competition to Google Maps. That's the one Google product I've had to repeatedly come back to because there's nothing even close in terms of functionality available for Android. I was hoping Here WeGo would be an alternative, but it's kind of a joke. I'd install Apple Maps if I could. I'd trade in my Pixel for an iPhone if it didn't mean losing real Firefox, NewPipe, and root-level ad blocking.

The world of mobile computing is so confining!

<comment><USER4> What about having "real" Firefox is the important part?

Is it supporting Mozilla, or supporting browser engine diversity, or is because real Firefox has more checkmarks on caniuse.com?

<comment><USER5> Extensions like ublock origin.

<comment><USER6> This is a huge thing for me.

The ability to have the same setup on desktop, tablet and phone is just unbeatable.

(Yes, I know you can do this with Safari on Apple-things and chrome on the rest too)

</comment></comment></comment></comment></comment><comment><USER7> > The gallery ads are part of an effort to make search results more visual.

By distracting from legitimate results?

Like others will say here, I finally switched to DDG earlier this week. It's good enough and you get accustomed to doing a !g pretty quickly when needed.

<comment><USER8> Adding !s for startpage is a good option too. Google results without the tracking.

<comment><USER7> That's great, thanks. Didn't know about Startpage.

<comment><USER9> They often lag behind the Google and even DDG results by a while, so search anything time-sensitive first with DDG then with Google if you still can't find it.

</comment></comment></comment></comment><comment><USER10> This is "break glass in case of emergency" levels of desperation.

<comment><USER11> Why would Google be desperate, though? They are hugely cash positive, have enormous cash reserves, and essentially no competition outside of China.

<comment><USER12> They have had many years of revenue growth that exceeds eyeball growth. They did that by slowly pushing organic results down the fold in favor of ads. That trick is played out now...there's little real estate above the fold left to cede to ads now.

So, to maintain revenue growth that exceeds eyeball growth, they need new tricks.

Basically, they set the bar very high.

<comment><USER13> My wish is that adds fill the first SERP so that I can just go to page 2 and be done.

Damn you, Overture, why did you have to do that!

<comment><USER14> In my experience with Google search, it rarely gives me useful results on the first page. So much so that I've developed a bit of muscle memory. When I have to resort to doing a Google search, I have to consciously stop myself from immediately clicking to get the next page of results.

</comment></comment></comment></comment></comment><comment><USER15> "In Maps, ads will now appear in recommended search queries, on routing pages _and during navigation_ "

Ugh, this is sad and clever at same time - during navigation screen is on all the time and one usually glances at route from time to time even if it is just "straight ahead" for couple of kilometers. Moreover ad will be potentially visible to all passengers as well.

<comment><USER16> My thought was always that they were going to start using businesses as landmarks, aka:

"At Monument Dr. - just past the Starbucks where if you stop now you can get a piping hot Venti coffee for only $1.50 - make a right"

<comment><USER17> They already do this; it's roughly in the form of: "take a left at sunset boulevard, right past the jack in the box".

I suspected it was a paid ad, but never knew for sure

<comment><USER18> I believe they've stated these are not ads, but are strictly for navigation.

<comment><USER19> That makes it an unpaid ad.

<comment><USER20> Cynically, yes, but this is how humans follow directions anyway. Are your friends giving you an unpaid ad when they say "head down main st, past the Burger King"?

<comment><USER21> Plausable deniability is the name of the game. If an unusually well informed group has trouble telling, are they free to do either?

</comment></comment></comment></comment></comment></comment></comment><comment><USER22> As an investor this makes me wary. How much short term value are they gaining by sacrificing user satisfaction? Google's UX is pretty top notch today and they don't really have any relevant competitors. With this move, they are creating space for differentiation along better UX and potentially losing out a share of users over time.

<comment><USER14> > Google's UX is pretty top notch today

I very much disagree, but I also think that's a subjective thing.

</comment></comment><comment><USER23> I'm already considering ditching the Gmail app as it displays ads at the top that look just like new e-mails (I was an Inbox user before); although I am not quite sure what app to switch to.

Sadly there isn't really an alternative that even approaches Maps. There are a lot of 'ok' alternatives but Maps is just in an other league in terms of POI, Navigation and UI.

<comment><USER24> For mails i would highly recommend K-9 Mail. Using it for years now works really well. Has a bunch of Features like dark mode and what not.

As for maps tough...

<comment><USER25> As someone who disabled GApps on my phone and uses only OSMAnd, I've found it acceptable for me, but know others would not be satisfied.

At least if/when I search and fail to find, I remember and add it later when I get to a desktop. Slowly, OSM should end up being able to serve my uses well enough, and hopefully others too.

</comment></comment></comment><comment><USER26> What would the default ads be on a search homepage considering there are no "keywords" to scope it to? I'd imagine non-targeted billboard-style ads by default with some targeting at the account level? Would it include retargeted ads?

Edit: nevermind, it's not on a blank search page, it's embedded within some news-feed style UI, so it's probably just straightforward google mobile ads

<comment><USER19> Remember that on mobile by default google pushes the feed on the search page instead of leaving it blank. Desktop is spared the indignity, for now.

<comment><USER27> What is "the feed?" Feed of what?

</comment></comment></comment><comment><USER28> Time to install a mobile browser with ad-blocking capabilities. Suggestions? I haven't used Firefox on my phone in years, but I remember it being slower than a snail

<comment><USER29> Try Blokada ([https://blokada.org/](https://blokada.org/)), it blocks ads system-wide.

<comment><USER30> Can you vouch well for this? I'm always concerned with an app that routes all my traffic through a VPN.

<comment><USER14> > I'm always concerned with an app that routes all my traffic through a VPN.

Many of these use the VPN subsystem of Android, but are not actually VPNs -- that is, they aren't routing anything off of your device. Using the VPN subsystem is just a way to be able to filter network traffic without having to have rooted your device.

The only downside is that you can't use such an app and a real VPN at the same time.

</comment></comment></comment></comment><comment><USER31> To be honest I'm surprised it took them this long.

</comment><comment><USER32> Now Google maps will use more bandwidth, yipee.

<comment><USER33> This is actually the reason I stopped using Google Maps for most of my navigation. It used up most of my 5 gb monthly allotment over the timespan of a week of travel/driving.

I typically only use ~500 mb of data per month otherwise.

<comment><USER34> You can download a local cache of the map data. I have my whole city saved and I think the app is around 500mb in size now.

<comment><USER33> Yes, that's what I've done for my home city, but it's not especially practical when travelling, when compared to other mapping apps that let you download entire countries' map data at once.

</comment></comment></comment></comment><comment><USER35> Not gonna lie, I would rather just pay for google maps.

<comment><USER34> I would pay $1 a month, which would be exponentially more money google extracts from me than with ads I'll never engage with.

<comment><USER25> You're here; therefore, we can assume you're a high-value consumer to advertise to. When enough people take the $1/month option, advertisers will be primarily advertising to consumers with low purchasing power. As that happens, the cost of advertising on Google AdWords nosedives, and Google is left making substantially less money.

Maybe most people aren't like you and I. But I don't think anyone at Alphabet is willing to risk adding complexity to potentially earn less.

This ignores the potential fallout as the message can be distorted from "Optional payment for Google Maps" to "Google starts collecting money for Maps", and finally to "Google Maps costs $X".

</comment></comment></comment><comment><USER36> Apple pretty please launch a slightly cheaper phone for us tightwads so that we can ditch Android and Google, once and forever.

Already using DDG. Been trying to run my own mailserver.

<comment><USER37> The cheapest iPhone (iPhone7) is selling for $449 new in the US. I'm not sure how cheap you are but this is reasonable compared to Android phones

<comment><USER36> That is definitely a good price point, and works for me, and I'm genuinely tempted.

I'm waiting for the fall update to see if we're going to finally see the SE2.

<comment><USER9> You can get an iPhone 7 for a lot less than that too if you wait for a sale from a retailer like Best Buy or a cell carrier and not from Apple directly.

</comment></comment></comment></comment><comment><USER38> I get down voted often for saying iPhone is cheaper, like the old man said, price is what you pay and value is what you buy. Android and Google are expensive.

<comment><USER34> I got a 128gb SE for less than $250 shipped on ebay, graded at B condition but I couldn't find a scratch on it, not even by the ports (yes, plural :^) and the battery is at 95% health. Just as quick as an x in real world use, the screen repair is way cheaper, and I could stretch the battery life two days.

I love the size too, the last one handed iPhone and I forget it's in my pocket.

<comment><USER39> I love the SE too, I really hope they release another small phone within the next year.

</comment></comment></comment><comment><USER40> Does anyone have suggestions for an Android based alternative to Google Maps? (preferably open source, etc)

<comment><USER41> I would suggest osmand.

The basic version is free, you can download data state by state (country by country when you are traveling) so it doesn't need a data connection on the road (but online search is available if you do have a data connection). It does routing for cars / bikes / pedestrian and has decent turn-by-turn instructions that you can configure to your liking. The underlying data comes from OpenStreetMap (hence the name of OSM + and(roid)), so if the data is wrong you can fit it yourself.

<comment><USER9> You can get the paid version for free if you download it from F-Droid.

</comment></comment></comment><comment><USER42> I am from India and sometimes jealous of China and Russia for having good local Google alternatives, Baidu and Yandex respectively. Google has more than 95% search market share in India and there is no competitive product even close.

</comment><comment><USER43> Probably AMP sites? I wonder what will be the carrot and stick in this scenario for ad buyers.

</comment><comment><USER44> Simply avoid using google services. They are pathetic. Let's see what the European Union says about this aggressive advertisement. Especially the Google Maps thing will obviously trigger our consumer care responsibles.

<comment><USER45> Seeing as there are other options freely available, I doubt there will be any action because ads are annoying.

The safety aspect of displaying ads in a navigator on the other hand...

</comment></comment><comment><USER14> I'm so glad that I gave up using Google's apps and services.

</comment><comment><USER46> Google had a massive multi-quarter campaign to get people to install their Google App recently across all possible mediums...now it's clear it was tied to this ad-push.

</comment><comment><USER47> "Sun to rise, set"

</comment><comment><USER48> Pathetic.

</comment><comment><USER49> duck.com has really gotten good recently.

</comment><comment><USER50> The article has been corrected to reflect the fact that it doesn't include mobile site, only the app.

Perhaps OP could edit their headline as well?

<comment><USER51> Thanks! We've updated the headline from "Google to show ads on homepage of mobile site, app".</comment></comment>


When is an Erlang iolist an iovec? - <AUTHOR> http://www.cipht.net/2017/01/15/when-is-an-iolist-an-iovec.html <comment><USER2> [http://www.erlangpatterns.org/iolist.html](http://www.erlangpatterns.org/iolist.html)

This is also a very good introduction to how iolists work in Erlang:

[http://jlouisramblings.blogspot.com/2009/01/common-erlang- mi...](http://jlouisramblings.blogspot.com/2009/01/common-erlang- misconceptions.html)

Starts with:

\---

There is a common saying that Erlangs I/O layer is slow. Bullshit.

\---

I recommend all of Jespers' blog entries. The newer ones are here: [https://medium.com/@jlouis666](https://medium.com/@jlouis666)

This is another article focused on Elixir, but same idea applies:

[https://www.bignerdranch.com/blog/elixir-and-io-lists- part-1...](https://www.bignerdranch.com/blog/elixir-and-io-lists- part-1-building-output-efficiently/)

<comment><USER3> That Big Nerd Ranch post was eye opening for me.

</comment></comment><comment><USER4> I know what a nihilist, a populist, an evangelist, a violonist, are... But an iolist ? What's that ? :-)

<comment><USER5> A believer in Asgorath, the True Dragon of the Forgotten Realms?</comment></comment>


Major development in Facebook case: Paul Ceglia's lawyers quit - <AUTHOR> http://latimesblogs.latimes.com/technology/2011/06/major-development-in-facebook-case-paul-ceglias-lawyers-quit-.html

<comment><USER2> I wonder if Ceglia refused a settlement offer that DLA thoght he should accept? or did something else happen?</comment>


A Pentester's Guide: Osint, Breach Dumps, and Password Spraying - <AUTHOR> https://delta.navisec.io/osint-for-pentesters-part-3-password-spraying-methodology/ <comment><USER2> There are a few companies which are onto password spraying in this way, and use failed login attempts from a single source (e.g. IP address, ipv6 addresses within the same allocation block, etc) as a trigger state for additional monitoring or verification. That can just mean that the soc gets a notification, or can enable captcha for suspicious sources while the attack is going on.

This does of course fail when an attacker starts using multiple sources for attack traffic. That seems to be the next step in the cat and mouse game though.

</comment><comment><USER3> This is a fun read for novices who are interested in infosec stuff.

<rant> I wish infosec tutorials/articles pushed writing custom tools. I've always considered password spraying to really be just taking super common passwords and flipping them around a bit. <season><year><special char> or <month><year><special char>. Instead of pushing some existing tools, I wish this article encouraged writing custom wordlist generators using common knowledge/sense. </rant>

<comment><USER4> On one hand I agree with you, on the other hand I don't think the space is short on people writing their own tools. The number of DNS enumerators I've seen shared over the past month alone speaks to this.

<comment><USER3> I cant disagree with you there :)

<comment><USER5> While custom tools are nice and all I don't really see the point of reinventing the wheel all the time.

If there is a tool/script/exploit/etc out there doing most of what I want, you can be sure that I'm going to use it and modify it to my needs instead of writing my own.

I'd say that's usually the case in 80% of the cases when doing pentests. Besides, time is money.

</comment></comment></comment></comment><comment><USER6> Not discussed is the antidote for blue teams:

\- 2FA

\- Password blacklists

\- Application Firewall that detects this hijinx (haven't explored this yet - anyone know of a good one?)

<comment><USER7> It's also a reason we generally push everyone to centralize authentication on an SSO provider like Okta or Google Cloud Identity, both because those platforms allow you to easily set policy requiring 2FA, which breaks the attack, and because OIDC and SAML let you log into lots of services without exposing each of them to account takeover independently.

There are other good reasons to do this, too.

At Black Hat last year, I cornered a bunch of CSO-types at big startups and asked for what their first 3 initiatives would be, and this was something I heard a bunch.

You should have some kind of SSO set up, early.

<comment><USER8> What do you about providers who while they support SAML keep the front door open after setting up trusts?

<comment><USER9> You feed your strong preference for SSO into procurement, which can really help cut down on the number of such vendors.

</comment></comment></comment></comment><comment><USER10> Since they mention Office 365, it's worth noting Microsoft's Smart Lockout tooling has been pretty efficient here imo.

[https://www.microsoft.com/en- us/microsoft-365/blog/2018/03/0...](https://www.microsoft.com/en- us/microsoft-365/blog/2018/03/05/azure-ad-and-adfs-best-practices-defending- against-password-spray-attacks/)

There are also some great capabilities like forcing a password reset after multiple "correct password but failed MFA" logons.

</comment><comment><USER11> I need a tool which tells where have I registered using the breached passwords. Often, the problem is not knowing which services you signed up for in the first place.

The easiest way would be for the said services to do this for their users whenever a new password dump surfaces.

Or even a way to test my username and password on top 5000 sites in an automated way should help.</comment>


Does marijuana weaken heart muscles? - gm-conspiracy http://www.cnn.com/2016/11/13/health/marijuana-weakens-heart/index.html <comment><AUTHOR> "'This is a retrospective study, so we cannot determine causation' between marijuana and weakening heart muscles, he concluded."

Title should be changed to reflect that only a correlation has been found, not a causation. Or just change the title of the post to match the actual article title instead of editorializing it.

</comment><comment><USER2> People; Stop complaining about not having the primary source and spend 1 second looking it up.

Here: [https://www.eurekalert.org/pub_releases/2016-11/aha- mum11031...](https://www.eurekalert.org/pub_releases/2016-11/aha- mum110316.php)

The study was previewed at a poster session at the AHA's annual conference this week. The full paper will be released shortly.

Doctors looked at 33,000 people who were hospitalized with stress cardiomyopathy (sudden rapid weakening of heart muscle without the typical MI markers) and found that 210 were activate marijuana users (via interviews or drug tests). Compared to non-users, marijuana users were found to be younger and less likely to have high blood pressure, diabetes, high cholesterol, or other cardiac risk factors.

Even without these risk factors, marijuana users were 3x as likely to go into cardiac arrest and were 4x as likely to require an implanted defibrillator.

There were a number of confounding variables such as marijuana users being twice as likely to have a history of depression, 3x as likely to have a history of psychosis, 75% more likely to have a history of anxiety disorder, and much more likely to use tobacco, alcohol, or multiple drugs. These were all adjusted for and the heart problems still remained.

Yes, it's a retrospective study without the ability to draw correlations, but it's definitely concerning and definitely worth following up with further research.

From my own speculation, stress cardiomyopathy (aka broken heart syndrome, where a serious emotional trauma can cause literal heart damage) is thought to be linked to catecholamine-linked muscular dysfunction. There are some older studies that have shown left-ventricle performance loss and norepi increases for several hours after smoking marijuana, so it seems like the cardiomyopathy could just be the chronic result of repeated exposure.

</comment><comment><USER3> > The lack of regulation makes it difficult for users to know the amount of > THC, the psychosis-inducing chemical in marijuana, contained in a dose, > which can be dangerous.

Mmmhmmm

<comment><USER4> Also, In dispensaries I've visited, the percentages are printed right on the labels as a selling point.

But maybe I only imagined that in my state of total psychosis.

<comment><USER5> You must have been psychotic. On an unrelated note, how come "marijuana" is a proper scientific term, which is even used in source material? Why not call it reefer then. That term alone indicates bias.

</comment></comment></comment><comment><USER6> without a DOI there's nothing to discuss. these news briefs are not useful; we need the actual paper.

</comment><comment> gm-conspiracy Marijuana users in the study accounted for 1% of the sample size?

</comment><comment><USER7> I've had some health concerns about my heart lately, and following a period of pretty heavy pot usage. Anecdotal obviously.

Everything in moderation.

</comment><comment><USER8> Did I read this right? Only 210 people in the study?.....</comment>


Data-focused Docker clustering – ClusterHQ - <AUTHOR> https://clusterhq.com/blog/data-focused-docker-clustering/ <comment><USER2> Hey, it's Luke here. I'm one of the founders of ClusterHQ and the author of this post. Happy to answer any questions or discuss any comments here. :)

<comment><USER3> Some services, particularly those that have to perform complex operations (usually SQL services), have greater resource requirements than others. So the "homogeneous servers" requirement seems practically implausible to me, at least from a cost-optimization standpoint.

It doesn't seem reasonable to me that we should allocate Big Hardware to, say, an nginx HTTP proxy, just to make it possible (no matter how unlikely) to also host a MySQL container on it at some point in the future.

Or am I misunderstanding you?

<comment><USER2> Hey otterley, thanks for your comment!

The homogeneous server recommendation is based on experience running tens of thousands of containers (mixed application and database containers) in production. In that case, when you have lots more containers than you have servers, it makes sense to allow a system which can automatically distribute the load across those machines to do so, and getting the scheduling right for that automatic load distribution is easier with relatively (although not necessarily exactly) homogeneous machines.

Of course, every deployment is different, and I'm not categorically saying "never have dedicated database hardware", just "clustering with automatic load balancing is easier with homogeneous hardware". :)

<comment><USER4> Perhaps more so than database servers, homogeneity becomes impractical when you have containers that demand access to a GPU.

</comment></comment></comment></comment><comment><USER5> Your webpage doesn't render properly in Safari: [https://www.dropbox.com/s/753xgwjhvbb1ml7/Screenshot%202014-...](https://www.dropbox.com/s/753xgwjhvbb1ml7/Screenshot%202014-08-13%2016.02.50.png)

<comment><AUTHOR> Thanks for letting us know. We'll get that fixed.

</comment></comment><comment><USER4> Flocker, Fleet, Flynn — The Docker ecosystem is getting flippin' complicated.

<comment><USER6> Don't forget Centurion, Helios, Atomic/Geard, Mesos/Marathon, Clocker, Kubernetes, Consul, Deis, Shipyard, Shipper... :)

<comment><USER7> Yikes.

Anyway, with all the interesting container and deployment technology that's come out in the last few years, I get the feeling we're at the verge of something wonderful.

All the system configuration and applications under version control... Slinging around huge amounts of data using btrfs snapshots... SDN... It seems only a matter of time before entire deployments are completely reproducible. From top to bottom.</comment></comment></comment>


Does torture work well as an interrogation technique? - <AUTHOR> http://skeptics.stackexchange.com/questions/4498/does-torture-work-well-as-an-interrogation-technique/4500#4500

<comment><USER2> Obviously there is a well-known historical record that shows how how torture is ineffective and misleading, but that really doesn't matter. Even if it was effective, it is still a terrible idea that should never be entertained by a supposedly modern/advanced society.

Ethical reasons about basic human rights and cruelty should really be enough of a reason to never allow torture. It is also a completely stupid tactic, for reasons you would expect the military and and intelligence communities to understand: using torture escalates the conflict. You don't do it for the same reason chemical weapons are a bad idea: it invites the enemy to do the same in return.

<comment><USER3> > _Even if it was effective, it is still a terrible idea that should never be > entertained by a supposedly modern /advanced society._

Are you sure about that? Torture is ineffective: the intelligence you get is very likely to either confirm (incorrect) biases you already have, and failing that to lead you to new and incorrect wrong conclusions. Even if the fate of the world depended on it, resorting to torture is - at best - a gamble with very long odds. Aside from the ethical concerns, the main issue with torture from an intelligence perspective is that it usually makes the problem worse. It makes you stupider, not smarter (assuming you are actually doing torture to obtain real, actionable intelligence).

But what if it were effective? What if doing torture on a single individual was provably likely to make you 10% more effective at your job, and your job at the moment happens to involve trying to save a million lives? Don't get me wrong, I fucking _hated_ 24 for the way it glamorized torture - it would be disgusting for doing that even if torture were effective. But _if torture were effective_ it seems like you could build some utilitarian calculus around when to use it, and that sometimes it would be a good idea to do it.

<comment><USER2> Depending on what your goals are, VX gas can be very effective. There are quite a few situations where thermonuclear devices are _very_ effective.

So why don't we use them? Why are certain types of bio/chem/nuclear weaponry considered to be generally banned _internationally_? Why are they seen in such a poor light the use of e.g. sarin gas by a country can create a multi- national scandal with sanctions, UN observers, and even military threats?

My point, which you seem to have missed, is that that effectiveness for intelligence is not the question that should be asked, as it ignores the rest of the effects that happen when you torture (or use nuclear weapons, or VX, ...). Reputation matters. PR matters. In a conflict, these concepts are especially important because _escalation_ matters. Bringing out a gun in a knife fight _might_ win you the current battle, but it practically guarantees that the _next_ battle will be fought with guns from the start.

You should probably look up the history of what we did to the Japanese when they tortured Allied soldiers in WW2. A major goal about _not torturing people_ is that we don't want our _current_ soldiers to have to face similar treatment. Torturing (or otherwise escalating conflicts) _increases risk_ to our soldiers.

<comment><USER3> I didn't miss your point at all, only tried to add to it. The effectiveness of torture absolutely _should_ be questioned, and happily the real answer aligns with the answer we would like, and contributes to the argument _against_ torture, rather than the one for it. And even if it were effective, most of the time we would still rule it out for the reasons you already mentioned, however its effectiveness could no longer be used as an argument against it.

Not asking that question, and mentioning the answer, is just going to make your argument weaker either way: if it is effective you'll be ignoring a strength in your opponent's position, and if it isn't effective you'll be ignoring one of your own strengths.

</comment></comment></comment></comment><comment><USER4> Legitimate question:

Given the objective evidence that this is not reliable as an interrogation technique, _why was it done?_

I find it difficult to believe that US military brass are ignorant or stupid. These people spend their lives studying strategy, intelligence, etc. When educated and intelligent experts suggest or do incredibly irrational things, I often wonder if there isn't some _other_ reason that is not being publicly stated or discussed. In other words, do these irrational things become rational when viewed from a different perspective?

A somewhat cynical answer I've encountered is: it was done to deliberately foment anti-American sentiment based on a "fight them over there, not here" and/or "shake the tree" theory of operation.

A significantly more cynical answer I've encountered: the US defense establishment is an enormous make-work program and requires a constant supply of enemies to justify its budgets. By this reasoning ISIS would be an example of a successful result of this program -- a long-term enemy against which we can fight a low-grade war for a decade or more.

Of course I suppose I may be wrong. My assumption here is that educated and intelligent experts will behave rationally. This assumption actually underlies quite a bit of so-called "conspiracy theory" \-- the reasoning process goes "elite leaders of business and government act like idiots, but they're not idiots, so therefore there must be a big nefarious conspiracy or hidden agenda!"

But maybe they are idiots -- or at least are behaving very irrationally due to emotional or ideological drives or bad information. As the saying goes: conspiracy theory is actually optimistic. It assumes that human beings are rational, resourceful, organized, and in control of the situation. The other possibility is significantly more pessimistic: the world is run by delusional ideologues and "peter principle" apparatchiks who _really are that foolish_.

[https://en.wikipedia.org/wiki/Peter_Principle](https://en.wikipedia.org/wiki/Peter_Principle)

<comment><USER5> I think it's this one:

 _the US defense establishment is an enormous make-work program and requires a constant supply of enemies to justify its budgets._

The Communists where mostly gone by 2001 - the few left were either laughingstocks or Chinese. The Peace Dividend was a disaster for US "deep state" people and corporations. They latched on to the first easy boogeyman they could, Osama bin Laden. Notice that since Al Queada has effectively been droned out of existence, the emphasis has shifted to ISIS/ISIL, with Iran in the batter's box.

Terrorism has been immensely good for the US Deep State and defense contractors. I don't expect it to go away easily or quickly, cause, heck, it's more profitable than Communism.

<comment><USER4> Simpler version: war is how you sell stimulus to conservatives.

</comment></comment></comment><comment><USER6> Hard to say because the Bush Administration did not give details on information they got from torture that prevented terrorist attacks and didn't list any inaccurate information they got that was false because the person being tortured gave any info to make the torture stop.

We know that terrorist attacks on US soil stopped, but it might not be due to torture getting information, it may be due to the fact that terrorists use social networks and our military was able to obtain the info in the Middle- East when raiding terrorist buildings and recovering computer equipment. They could have just data mined social network accounts used by terrorists and gotten the data off hard drives with lists of bank accounts and people who are being paid to do terrorist attacks.

I think when the Obama administration killed Osama bin Laden they raided his hard drives from his servers and computers and got a lot of information off of them. More than one could get from torture. So there are other methods of getting information that are more effective than torture.

We also have the NSA Metadata program and Prism system of collecting information. While many consider it a violation of rights and privacy, it might have collected a lot of information used to prevent terrorist attacks.

Still these methods are unpopular with the people, torture, domestic spying, etc.

<comment><USER7> > We know that terrorist attacks on US soil stopped

Except they didn't. At most, they shifted from organized plots (like that of 9/11) to less-organized events (like that of the Boston Marathon bombing).

<comment><USER6> You have a point but the Al Qaeda and terrorist networks didn't do the Boston Bombing it was two brothers acting alone. The Islamic shooters were lone wolves. No ties to terrorist networks.

They weren't organized by terrorist networks but they were terrorism.</comment></comment></comment>


Better Encrypted Group Chat - <AUTHOR> https://blog.trailofbits.com/2019/08/06/better-encrypted-group-chat/ <comment><USER2> Author here. Happy to answer questions!

<comment><USER3> I've been working on a new scheme for decentralised encrypted (group) messaging bus over at [https://xn--nma.com/](https://ȱ.com/) unlike many other schemes, forward secrecy is _not_ a goal: When I invite a friend to a group chat, I _want_ them to be able to obtain historical conversation messages.

For your normal end user (at least what I think of as common: see how facebook messenger works, as well as slack, discord and even how many irc chat rooms have public logs), how is this MLS scheme useful?

<comment><USER4> Are you aware of matrix? Their olm encryption scheme is capable of PFS, but it's not used exactly in order to provide history.

<comment><USER3> Yes I'm aware of matrix. A couple of things that I don't like about the matrix protocol are: 1. identity is tied to a server and users are not free to move between servers. 2. servers are assumed to be always online and have low latency.

<comment><USER5> 1\. There is work to fix the identity problem with Identity Servers. See [https://matrix.org/faq/#what-is-an-identity- server%3F](https://matrix.org/faq/#what-is-an-identity-server%3F)

2\. I'm not sure what gives this impression? I have a server that is very much on flaky network, and it federates just fine. The point is that servers can go online/offline without breaking anything on the whole network.

</comment></comment></comment></comment></comment><comment><USER6> That was a great article. I learned a lot about encryption in group chats, which I've always been curious about.

</comment><comment><USER7> I think you missed a solution, which is a variant of #2.

To simplify things, consider a single global chat room, on an enormous server (probably in Salt Lake City), where every person on earth is connected and have a public/private key-pair, and every person on Earth can read everything anyone posts. You can post publicly ( anonymously or with a signature), or privately (pair key) to any individual on Earth. From this starting point, how do you make private group chats? (This starting point factors out a lot things we shouldn't worry about, and I think is simpler/nicer than a story about a Slack admin).

Your solution #1, pairwise encryption, clearly doesn't scale for the sender (as you point out). It is also aesthetically displeasing.

I feel like your solution #2, though, isn't what I would do, and I'm honestly surprised that's how WhatsApp, etc. works.

My first thought is that a person who wants a shared room creates a (symmetric) key K for the room, and then distributes K to all invited participants privately. To remove a user you generate a new K for the room, and send it to N-1 participants. They all agree to post using the new K (and a signature).

I don't see a performance issue with this solution. Consider that _every_ message to the "room" causes O(N) fanout. If the rate of "normal" message addition is _much less_ than the rate of participant addition/subtraction, well, that's performant enough. (Especially considering a new key for the room is some relatively small fixed size.)

(In a situation where you have a huge, passive audience and a single emitter, then yes my proposal will generate a lot of extra unnecessary traffic as people enter or leave. However, I'd argue that communication like this is probably better secured through more traditional centrally controlled means, e.g. a server process with ordinary user accounts that have a connection status.)

EDIT: There _is_ a coordination problem with my solution, in that you can't guarantee members will use the new K; it might be useful to have a bot or something remind anyone who posts using the old K to use the new one instead.

<comment><USER8> To distribute the new K you would need to encrypt it for each of the N-1 users of the group. That's why we need trees.

<comment><USER7> Ah, thanks. My mistake was assuming you could distribute new K as a normal message, encrypted with old K. Clearly (now) this wont work since new K will be distributed to everyone, including people who need to be omitted.

</comment></comment></comment><comment><USER9> Would just deriving a new pub/private key each time someone entered/left the chat be simpler? I'm assuming there is a reason why this wouldn't work.

<comment><USER10> Yes, much of the article is explaining why this is reasonable for a group of 2-5 and terrible for a group of 10,000, and ways to make this more manageable in non-obvious ways.

<comment><USER9> I'm talking about a shared private/public key for everyone which gets changed when members leave or enter.

<comment><USER11> What are you imagining a "shared private/public key" is ? Because that's not a thing.

A private key is _private_, it doesn't mean anything to share one of those, if you're doing that it isn't a private key any more and you wasted your time.

<comment><USER12> They probably mean a single symmetric key shared between all. And private is not mean that only one person knows a thing. Quite the opposite. If the entire planet minus 1 person knows something, that's a form of private as well. Either way you're arguing semantics.

</comment></comment></comment></comment></comment><comment><USER13> Balanced binary trees usually have some kind of rotations to maintain their properties like left-leaningness. In this application this is to be avoided in order to not not send so many messages.

I understood that all participating clients know about the structure of the tree, so could not all the clients do the rotations in this kind of mass removal without sending messages?

I mean that in the last example, the tree is not left leaning, but can be made so by promoting every Zayne to their ancestor nodes.

<comment><USER2> Good point. I don't think it'd be unreasonable to promote everyone to their parent in this example.

One thing that I left out of the post is that the MLS ratchet tree has something called a "tree hash". Every node carries a hash digest, which is the hash of its two children. The root node's hash is used to derive a bunch of group-specific values, so it's important to keep this hash up to date. If you promote every member to their parent, this would require about N log(N) total hash operations, since every path from a leaf to the root would have to have its hashes recalculated.

N log(N) hashes seems like a small price to pay for optimizing a structure that determines how many ECDH operations you end up doing. I'll ask other MLS people about this and see if I'm missing something.</comment></comment>


Blending complex systems made my latency 10x higher - <AUTHOR> https://srvaroa.github.io/kubernetes/migration/latency/dns/java/aws/microservices/2019/10/22/kubernetes-added-a-0-to-my-latency.html <comment><USER2> Very misleading title, was hoping for a more substantive read. Kubernetes itself wasn't causing latency issues, it was some config in their auth service and AWS environment.

In the takeaways section, the author blames the issue on merging together complicated software systems. While absolutely true, this isn't specific to k8s at all. To specifically call out k8s as the reason for latency spiking is misleading.

<comment><USER3> I think the point is that this was a real problem that happened because of combining k8s and aws, which is a pretty common scenario. And it underscores that the bug was hard to find - I'm not sure how many people on my team would be comfortable looking deeply at both GC and wireshark. It required asking "Why" a few more levels deep than bugs usually require, and I think a lot of developers would get stumped after the first couple of levels. So it's another piece of data just counseling that a proper k8s integration is not as easy as people might expect.

I also get the sense that that team has a better than average allocation of resources. Some teams I've been on, this type of problem would be the responsibility of one person within an afternoon, or with impatient product people and managers checking for status after that.

<comment><USER4> This is exactly what happens when you abstract away anything, in this case, infrastructure. Most of the time people focus on the value-added by the abstraction. This time somebody had to face the additional burden that was introduced by it, making it harder to track down the bug.

</comment></comment></comment><comment><USER5> "Once this change was applied, requests started being served without involving the AWS Metadata service and returned to an even lower latency than in EC2."

Title should be: My configuration made my latency 10x higher.

<comment><USER6> We solved our configuration problems, and most rewardingly, we managed better performance than the original EC2 baseline.

<comment><USER7> Too long to fit in the title, I suppose.

</comment></comment></comment><comment><USER8> The problem wasn't in Kubernetes at all! The problem was in KIAM and the AWS Java SDK.

It would be more accurate to criticize AWS's Kubernetes support. Both KIAM and the AWS Java SDK are specific to AWS.

<comment><USER9> We found EKS to be really disappointing in comparison to Self hosted solution. Not only you simply cannot tweak extremely important kubelet configuration, you also cannot run real HA. Most of AWS implementation around EKS was simply terrible and outclassed by community driven projects. For me personally EKS is the same failed service as Elasticsearch Service. Good for low to medium size workloads but terrible for anything 1st world class.

<comment><USER10> Why can't you run "real HA" with EKS ?

It is after all running the control plane in multiple AZs.

<comment><USER11> Also why can't you modify kubelet params? You are completely in charge of the nodes and can configure them freely.

<comment><USER9> There are some cluster parameters you simply cannot change because api refuses or are not available (node cluster dependant parameters also). Example can be HPA downscale grace periods..

</comment></comment></comment></comment></comment><comment><USER12> What grinds my gears is hard-coded magic timeout numbers. Somehow microservice people seem to think that these are good (e.g. for circuit breakers) without seeming to realize the unexpected consequences of composing like this. Your timeout is not my timeout. So firstly - don't do it. Time is an awful thing to build behaviour on, and secondly if you ignore that then make it a config parameter - then I've got a chance of finding it without wire level debugging (if you document it).

<comment><USER13> The timeouts this post is talking about are related to credential expiration and when to refresh, not request/connection timeouts like you'd see in microservices. In this case, not expiring credentials isn't a great option because you'd lose a useful security property: Reducing the time window when stolen credentials can be used.

For service behavior (e.g. request/connections), timeouts provide value for services and clients. For services, if you never time out then under failure conditions you either end up saturating your max concurrent request limits or growing your concurrent connections indefinitely until you hit a limit (connections, threads, RAM, CPU). Unless all of your clients are offline batch processes with no latency SLA there's a good chance that the work clogging up your service was abandoned by your clients long before it completes.

Timeouts also help clients decide if/when they should retry. Even if the service never times out, clients can't really tell if their request is just taking a long time or if something is wrong and the request will never succeed (e.g. network partitions, hardware failure). There's at least implicit latency SLAs on most things we do (1 second? how about an hour or week?). Given that there is a limit somewhere, it makes sense to use that limit to get benefits like resiliency in services.

>>>Your timeout is not my timeout.

Absolutely. Client deadlines are a great way to reduce wasted work across distributed systems. e.g. service has 60s timeout, but client has a 5s timeout for an online UI interaction. The client can tell the service to give up if it's not completed within the client's SLA.

</comment></comment><comment><USER14> And this is why I find DevOps work more interesting than programming. System integration is just endlessly challenging. I always enjoy reading a well- documented integration debugging session!

<comment><USER15> In my opinion DevOps shouldn't exist at all.

<comment><USER16> Okay. So based on 20+ years of experience, I can say that most developers have no interest in automating deployment, configuration, monitoring, performance, logging, etc... Who should do this work?

<comment><USER17> Yeah, operations-focused engineers will continue to have a niche carved out for them because too many devs black-box infrastructure.

Companies can either choose to have their devs take on ops responsibilities or continue having dedicated ops jobs.

In either case, whether or not dedicated ops jobs exist, ops responsibilities always will. I'll be there to pick up the slack because designing and maintaining systems is an interesting job that has to be done that a lot of people can't/won't do and it pays accordingly.

<comment><USER3> People overlook that there's a common systematic belief that looks like this:

      1) Developers don't code on prod
      2) Prod needs to be protected
      3) Therefore, developers need to be restricted from prod

One of my teams went through the process of "let's do DevOps!" with the intent of giving developers the ability of pushing something all the way through to prod on AWS. Months later, this resulted in having a poorly-supported dev-only VPC with IAM/policy restrictions, and other "official" VPCs that devs are locked out of in various ways. Since then, devs had little incentive to learn and are again reliant on Ops for any deployment problems.

<comment><USER18> There's a common systematic belief of that because that's the sort of thing a lot of actual compliance regulations de facto require (i.e., they demand controls around software deploys, and putting enforcing that in the same hands as those wanting to deploy it, i.e., devs, will fail an audit).

Source: My employer is currently undergoing SOX compliance

<comment><USER14> And there's a good reason that separation of duties is in every compliance standard...

<comment><USER18> Not saying whether it's a good or bad idea, just that it's a common systematic belief because it's a required thing in many organizations.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER19> This issue has been hit by quite a number of people in the last year [1]

AWS have recently added the feature natively [2], so once that version of the SDK is in use by all your pods you won't need Kiam any more.

[1] [https://github.com/uswitch/kiam/issues/191](https://github.com/uswitch/kiam/issues/191) [2] [https://aws.amazon.com/blogs/opensource/introducing-fine- gra...](https://aws.amazon.com/blogs/opensource/introducing-fine-grained-iam- roles-service-accounts/)

</comment><comment><USER20> We have hit similar issues with GKE. GKE has a soon to be deprecated feature called "metadata concealment"[1], it runs a proxy[2] that intercepts the GCE metadata calls. Some of Google's own libraries made metadata requests at such a high rate that the proxy would lock up and not service any requests. New pods couldn't start on nodes with locked up metadata proxies, because those same libraries that overloaded the proxy would hang if metadata wasn't available.

That was compounded by the metadata requests using DNS and the metadata IP, and until recently Kubernetes didn't have any built-in local DNS cache[3] (GKE still doesn't), which in turn overloaded kube-dns, making other DNS requests fail.

We worked around the issues by disabling metadata concealment, and added metadata to /etc/hosts using pod hostAliases:

        hostAliases:
          - ip: "169.254.169.254"
            hostnames:
              - "metadata.google.internal"
              - "metadata"

[1] [https://cloud.google.com/kubernetes-engine/docs/how- to/prote...](https://cloud.google.com/kubernetes-engine/docs/how- to/protecting-cluster-metadata#concealment)

[2] [https://github.com/GoogleCloudPlatform/k8s-metadata- proxy](https://github.com/GoogleCloudPlatform/k8s-metadata-proxy)

[3] [https://kubernetes.io/docs/tasks/administer- cluster/nodeloca...](https://kubernetes.io/docs/tasks/administer- cluster/nodelocaldns/)

</comment><comment><USER21> I really enjoy find-the-issue stories like this. Bug hunting can be such fun.

</comment><comment><USER22> "We are blending complex systems that had never interacted together before with the expectation that they collaborate forming a single, larger system."

I suggest more people read the first few chapters of _Specifying Systems_ by Lamport. Maybe the rest is good also, but that's as far as I got.

It works through a trivial system (display clock) and combines it with another trivial system (display weather).

Nothing Earth-shattering, but it really stuck with me. Thinking about it at that level gave me a new appreciation for what combining two systems _means_.

</comment><comment><USER23> Isn't this more of an AWS-specific issue?

</comment><comment><USER24> Agreed about poor title, but:

> DNS resolution is indeed a bit slower in our containers (the explanation is > interesting, I will leave that for another post).

I would like to see this expanded upon or hear if anyone else has suffered similar.

<comment><USER25> Exactly! On our OpenShift production cluster we ran into ndots problems with DNS and slow DNS resolution overall. This blog post was very helpful in understanding the issue and ways to fix it, [https://pracucci.com/kubernetes- dns-resolution-ndots-options...](https://pracucci.com/kubernetes-dns- resolution-ndots-options-and-why-it-may-affect-application-performances.html)

<comment><USER26> Yeah, Tim Hockin and I still regret not designing the DNS name search process in Kube better. If we had, we would have avoided the need for 5 and could have kept 90% of the usability win of "name.namespace.svc" and "name" being resolvable to services without having to go to 5. And now we can't change it by default without breaking existing apps.

Forwards compatibility is painful.

<comment><USER24> Pardon my lack of Kubernetes knowledge, but any regrets supporting the hierarchical lookup where they don't have to qualify their dns requests (and maybe could have used some other way to find their "same namespace")?

<comment><USER26> Good question. I certainly use the "name" and "name.namespace.svc" forms extensively for both "apps in a single namespace" and "apps generic to a cluster".

I know a small percentage of clusters makes their service networks public with dns resolution (so a.b.svc.cluster-a.myco is reachable from most places).

The "namespace" auto-injected file was created long after this was settled, so that wasn't an option. I believe most of the input was "the auto env var injection that docker did we don't like, so let's just keep it simple and use DNS the way it was quasi intended".

Certainly we intended many of the things istio does to be part of Kube natively (like cert injection, auto proxying of requests). We just wound up having too much else to do.

</comment></comment></comment></comment></comment><comment><USER27> Isn't this a KIAM bug? The default configuration of any piece of software should not cause pathological cases in other pieces of software _that are commonly used with it._ Maybe I'm just a bleeding heart, but I think good software delights its users; the deployment and configuration story is a part of this.

</comment><comment><USER28> this is good info but the title is misleading. This could have easily been "my latency increased because my local time was off" or something like that. This had nothing to do with kubernetes..it was a problem with their set up.

</comment><comment><USER29> It was a nice read. The real lesson here is how to diagnose issues like this.

</comment><comment><USER30> > Kubernetes made my latency 10x higher

The title is a bit misleading, kub didn't cause the 10x latency - also latency was lower after they fixed their issues

TL;DR version - Migrate from EC2 to Kub; due to some default settings in Kiam & AWS Java SDK, latency of application increased, fixed after reconfiguration and kub latency lower than EC2

<comment><USER31> It is relevant though as k8s makes everything more complicated so you have to deal with stuff like this. Also if it was a brand new app theyd maybe not notice the problem in the first place.

<comment><USER30> I'm not saying it's not relevant - it was actually a good technical read, they went through alot of detail with their troubleshooting.

I'm just saying the title is misleading, and clickbaity.

</comment></comment></comment><comment><USER32> Listen to Grace Hopper. Count the feet (nanoseconds) data has to travel at speed of light so the Admiral respects the laws of physics.</comment>


Show HN: A Chrome extension to show GitHub projects activity - <AUTHOR> https://chrome.google.com/webstore/detail/github-activity-checker/agebcpekpbkaibjghgakombjjkefmcol <comment><AUTHOR> I was frustrated that there's no way to see how active a GitHub project is from its main page, so I decided to scratch my own itch!

This way you don't need to go through Graphs -> Commits every time to see what's going on.

Source (Apache 2.0): [https://github.com/MasterScrat/GithubActivityChecker](https://github.com/MasterScrat/GithubActivityChecker)

<comment><USER2> Curious why Apache license. Not questioning it.

<comment><AUTHOR> I'm really not an expert... Reading more in details I see it requires some annoying stuff, eg you need to state what you modify. Looks like MIT would be better.

<comment><USER2> Apache requires administrative overhead in regard to contributions, but has some advantages for larger scale long roadmap projects.</comment></comment></comment></comment>


Why Vietnam Is Quitting Facebook - <AUTHOR> http://www.atimes.com/article/why-vietnam-is-quitting-facebook/ <comment><USER2> the title should be 'why some vietnamese activists might move on from facebook'. i think conducting any kind of foreign policy operation would be a mistake.

the problem is: people seem to enjoy great freedom and are generally content. by supporting the activists by having facebook pull out the USA might cause a few problems but it is not going to force regime change, so they might as well do nothing. it would just make the lives of ordinary vietnamese a bit worse.

</comment><comment><USER3> There doesn't seem much evidence in the article or otherwise that Vietnam is quitting facebook. As it says facebook had 53 million users out of a population of 96 million. Also I've got about 40 Vietnamese facebook friends and have not noticed any quitting. It's pretty well known there that if you publish overthrow the government type stuff in any public media it's asking for problems and I don't think anyone thinks of facebook as a secure medium that no one can track you on. At least it's openly available as is the rest of the internet unlike China next door.

re

>"there is now no safe place left in Vietnam for people to speak freely," said Clare Algar, Amnesty International's director of global operations

You'd imagine if they want to post overthrow the government type stuff they'd use some anonymous service like reddit etc. Facebook isn't really the place.</comment>


OpenWrt Wants You - <AUTHOR> Like any open source project, OpenWrt thrives on the efforts of its users and developers.
◾
If you want to develop the software, please refer to our Developer Guide to learn how to get the source code, build it, and contribute your changes back to the project. ◾
If you're not a developer, you can still help. The documentation can always be improved (even if it's to verify that the instructions match your experience), or you can help other community members with questions. Don't hesitate to Register yourself in the wiki, or join our mailing list and IRC channels to get in touch. <comment><AUTHOR> mailing list [https://lists.openwrt.org/mailman/listinfo/openwrt- devel](https://lists.openwrt.org/mailman/listinfo/openwrt-devel) IRC channels [https://openwrt.org/contact#irc_channels](https://openwrt.org/contact#irc_channels) Developer Guide [https://openwrt.org/docs/guide-developer/source- code/start](https://openwrt.org/docs/guide-developer/source-code/start) OpenWrt Forum [https://forum.openwrt.org/](https://forum.openwrt.org/)

</comment><comment><AUTHOR> OpenWrt help on Twitter: [https://twitter.com/openwrth?lang=en](https://twitter.com/openwrth?lang=en)

</comment><comment><AUTHOR> Communication within the OpenWrt Project: [https://openwrt.org/contact](https://openwrt.org/contact)</comment>


Hedonist GTD - <AUTHOR> http://journal.rinich.com/post/261583256/hedonist-gtd

<comment><USER2> "Arrange your life around what you like. That's it! You're done. You'll be happy forever."

Who would have thought that heroin addicts had the secret of life?

Not everything is pleasurable - sometimes you just have to suck it up and take out the f*cking trash. :P

<comment><USER3> I like taking out the trash because it makes my place less smelly. Like, there's a logic to doing some of those things beyond just "somebody told me." But in other situations you find yourself doing things maybe you don't have to do.

<comment><USER2> Taking out the trash is not intrinsically pleasurable, like playing Call of Duty, or masturbating. Or masturbating while playing Call of Duty. You take out the trash, study instead of playing games, or save your money for the longer-term effects, which is precisely my point. Saving money sucks in the short term, which by "Hedonistic GTD" would disqualify it for almost everyone.

The article is pretty much contentless fluff, and would be made 100x better if it was just replaced with the quote "do what you love and the money will follow." Still debatable, but at least it has brevity going for it.

<comment><USER3> Understandably I disagree. Specifically: I'd like you to point out where I say delayed gratification is a bad thing. If you want a house, you save money until you can buy a house. Otherwise you're not getting what you want. But if you _have_ a house, and you have comfortable money, and still you find you're working long hours for the sake of making money and nothing else, then there's a problem because you're not really doing the things you'd like to be doing.

But it's not about money. It's specifically _not_ about money. It's about being happy with your life. And it's less about doing what you love than it is about _not_ doing what you hate. There's an important distinction.

</comment></comment></comment></comment><comment><USER4> The problem is the huge difference between what I want to do right now and where I want my present actions to lead my future. For example, I'm not going to amass wealth by playing marathon sessions of Modern Warfare 2 in my sweatpants, but damned if I don't want to do that instead of sitting down to work on my projects almost every day.

<comment><USER5> But WHY do you want to amass wealth ? If the answer is "to be happy", it's very much the wrong answer, per TFA. If it's "to play MW2", even more obviously so. The same about "to be respected", "to have status", or similar. So ?

PS : I'm an European, US guys seem to have pretty much a stereotype about us all as being "godless communists" who need complicated reasons to work. Well, kind of.

<comment><USER6> the elephant in the room: increased mating opportunities.

<comment><USER3> If somebody dumped a million dollars in a pile in your bedroom, would that fact alone make you more desirable to women?

Of course not. What would make you theoretically more desirable: You might stop caring so much about individual women once you're well off. You might have more free time to socialize. You might dress nicer. You might cook more or get yourself a nicer place.

That's what makes you more desirable. That's all achievable without the money. You don't need to be rich, you just _think_ you do.

<comment><USER6> not sure what planet you're from, but it sounds really nice. can I come?

<comment><USER3> What about what I said do you disagree with?

<comment><USER6> "of course not"

or maybe your experience with women has simply been much better than mine. I live in a very wealthy area, thus there are a lot of women looking for "good marriage material" around here.

</comment></comment></comment></comment></comment></comment></comment><comment><USER7> "Arranging your life around what you like" does not mean mindlessly overdosing on some activity. Essentially this piece is about a somewhat higher than average level of self-awareness.

The problem is, by constantly avoiding unpleasant things, one might lead a semi-happy life, but there is a downside: this way a large part of possible outcomes becomes simply unreachable. (There ARE outcomes, which can not be reached without considerable amount of unpleasantness.)

One might argue, such (hard to reach) outcomes worth more (= bring more happiness).

This is the real question here.</comment>


Why Do Rich Kids Commit Crimes? - <AUTHOR> http://www.psmag.com/navigation/health-and-behavior/rich-kids-commit-crimes-80286/

<comment><USER2> I don't buy the theory that it was his injury that set him down the wrong path, by causing him to lose his lacrosse scholarship which sent him home from college back to live with his parents, away from all his friends.

His family was rich enough to send him to a prep school with a $35k tuition. His college, University of Richmond, had $45k tuition and fees, which is only $10k more. Surely his family could have come up with that. Furthermore, Richmond has generous financial aid, with a cap of something like $8k per year on the amount of loans they will put in an aid package.

I think it is more likely he had gone bad long before college, and probably only went to college to play lacrosse.

</comment><comment><USER3> I went to a high school that was full of rich kids. Not filthy rich, but rich enough to have a sense of entitlement.

This sort of outcome is almost the norm. Out of the people I knew, I wouldn't be surprised if over 50% went to rehab at some point. Every couple months you hear about the son of surgeons or lawyers getting arrested for something big, such as armed robbery or dealing of hard drugs. I'm glad this article was able to shed some light into why.</comment>


Building a high available Anycast infrastructure in under 5 minutes - <AUTHOR> https://medium.com/@atoonk/building-a-high-available-anycast-application-in-5-minutes-on-packet-198c82eaabc <comment><AUTHOR> fun :)</comment>


Show HN: Strategr – cross-platform time management application written in C++ - <AUTHOR> https://khrykin.github.io/strategr/ <comment><USER2> I'd love for this to come to Linux and Android and if it does I hope it could remain open source.</comment>


The Amateur Problem - <AUTHOR> http://stuartsierra.com/2013/07/28/the-amateur-problem

<comment><USER2> This sums up the most common case that I've encountered:

\</comment><comment></comment><comment></comment><comment>-

Simplifying assumptions do not belong in libraries; they belong in applications, where you know the boundaries of the problem space. On rare occasions, the ground of one problem is trod often enough to warrant a framework. Emphasis on rare. A framework is almost always unnecessary, and, in these days of rapidly-changing technological capabilities, likely to be obsolete before it's finished. Frameworks written by amateurs are the worst of the worst: brittle constructs that assume everything in service of one or two "dead simple" demos but collapse under the weight of a real-world application.</comment>


Cascadia Code, an OSS coding / terminal font with ligatures from Microsoft - <AUTHOR> https://devblogs.microsoft.com/commandline/cascadia-code/ <comment><USER2> I like the style, but I'd like to see it through a Nerd Fonts patch. [https://www.nerdfonts.com/](https://www.nerdfonts.com/)

I live from a terminal with vim for coding, so It's nice to have devicons for file icons in NERDTree and symbols for my oh-my-zsh config.

</comment><comment><USER3> This looks like it will replace Consolas for me. I like the zero and that l and 1 are very easy to distinguish.

</comment><comment><USER4> I really like this. Feels easy on the eyes (at least to me). I've used Fira Code for as long as I can remember, but going to give this a go!</comment>


AWS Serverless Days – Tim Wagner Keynote – Vendia Launch [video] - <AUTHOR> https://youtu.be/A1bL4pHuivU <comment><AUTHOR> I do not work there. It seems to be pretty much what a friend and I spent a year and a half of our lives trying to build, with pretty limited programming experience, so I hope you'll find it as interesting as we do.</comment>


Linux Desktops for Minimalists: Getting Started with LXQt and LXDE - <AUTHOR> https://opensource.com/article/19/12/lxqt-lxde-linux-desktop <comment><USER2> How is this considered minimal? When I think of minimal, I think of something like dwm ([https://dwm.suckless.org/](https://dwm.suckless.org/)) or awesome- wm ([https://awesomewm.org/](https://awesomewm.org/)).

<comment><USER3> That's definitely minimal, but those are window managers and not Desktop environments. Off course the line could sometimes be blurry if you let's say take Openbox and a few other packages will it constitute a new Desktop env?

</comment></comment><comment><USER4> I use LXDE and i3wm, I had to spend some time removing duplicate UI elements but aside from that it has worked really nicely.

</comment><comment><USER3> Another minimal, blast from the past desktop that you could run: [https://www.trinitydesktop.org/](https://www.trinitydesktop.org/)</comment>