Google releases some Glass source code - <AUTHOR> http://arstechnica.com/information-technology/2013/04/google-releases-glass-source-code-declares-platform-open-to-hackers/ <comment><USER2> It's not as if they were making us a gift... As soon as they sold their first device it was required by the Linux kernel GPL2 license to release the kernel source code.

<comment><USER3> Technically, Google would only be required to make a written offer, and we could ship physical medium copies to folks who wrote them.

<comment><USER4> I dont care if I get down-voted for making a comment unrelated directly to this; Thank you.

You are my personal hero for today DannyBee, for speaking calmly and making sense on HN.

<comment><USER5> You should follow all his comments. He's like this all the time. It's a little freaky.

<comment><USER6> You can follow comments? I'd like to be able to just follow a user, and have their comments/submissions brought to my attention.

<comment><USER5> In the sense that you can bookmark the "comments" link off someone's profile, yes.

</comment></comment></comment></comment></comment></comment><comment><USER7> Misleading headline; they released the boring code and none of the interesting code.

<comment><USER8> It's not misleading headline, it's just a problem with tech blogs, they probably read this news on HN and stole it and tried to make it sensational to get some cheap traffic. The don't understand the code or it's implications for that matter. What is released is kernel source code (which hardly any one cares about) vs source code for google glass framework (which would be more interesting).

<comment><USER9> >It's not misleading headline, it's just a problem with tech blogs, they probably read this news on HN and stole it and tried to make it sensational to get some cheap traffic.

While that's generally how these outfits tend to work, Ars has built a pretty solid reputation for in-depth analysis and not having link-baity headlines.

<comment><USER10> I like Ars, but today's Ars is less Anandtech and more Verge. Which is to say, they indulge in their fair share of link-baity gadget-blog-type posts. They're not beyond redemption by any means, but the sad truth is that Ars doesn't always do the kind of in-depth analysis that they once did.

</comment></comment></comment></comment><comment><USER11> As an FYI, the git repo is here:

[https://android.googlesource.com/kernel/omap/+/glass-omap- xr...](https://android.googlesource.com/kernel/omap/+/glass-omap-xrr02)

</comment><comment><USER12> Surprised it took me this long to realize that Ars doesn't have much better quality control than VentureBeat et al, but it's crystal clear now. Tim Bray's twitter is obviously unofficial, and the headline uses broadness and extrapolation to make it misleading in a way that makes it seem more interesting.

Farewell, Ars Technica of old...

<comment><USER13> Did you see the "A-Z of Ubuntu" gallery recently? It was literally a few screenshots of Ubuntu variants and less than a paragraph under each.

<comment><USER12> Nope, missed that.

</comment></comment></comment><comment><USER14> Hey Google, disrupt the industry and open source the hardware as well.

<comment><USER15> Not sure why you are being downvoted. Google open sourcing Glass could bring on lots of manufacturers in very quickly and also create lots of derivative works. Google would theoretically have its core Glass software running on every device.

It's essentially taking their model with Android, which IMHO has been enormously successful, one step further. In two years time ZTE could be making 'The Reflector' a $100 version of Glass that has been been created from Glass' open designs. Of course their will be software modification as well, but theoretically just like Android, Google will remain at it's core.

I can see why Google will probably make more money by selling them for $1,500 a pop. But I think they could also make money by shear volume of increased search, maps, play store, etc. This seems to be inline with what they try to do now.

I hope that Google does not pull a Facebook and start forcing advertisements into everything. If that is the case it could be at the expense of the entire Glass platform which I think will be very cool.

<comment><USER16> I think it's being downvoted because it's got very little information. It's a seemingly naive random thought about Google's go-to-market strategy for Glass and considers nothing about Google's businesses or the opportunity cost of taking that action. Your post is probably the elaboration that it needed to avoid being downvoted. (I didn't downvote - just trying to explain why someone might)

<comment><USER14> Your right. My comment stemmed from my frustration as the many close sourced hardware being pushed by the OEMs and ODMs. I should have elaborated my comment further. Lesson learned.

<comment><USER16> I hear you. I'd love for Google to fully open up Glass. Might not be as appealing an idea from their perspective, though.

</comment></comment></comment></comment></comment><comment><USER17> Just throwing code over the wall is such a poor imitation of open source.

Develop in the open--reviews, patches, bugs, design discussions--everything should be visible. Let's not pretend that this is really what "open source" is about--it's about everyone making contributions, visibly, as they happen.

Anyone who takes this kernel and actually adds features is risking duplicating work or breaking future compatibility if Google ever decides to implement the same or otherwise conflicting features in different ways. This happens frequently with Android. Everyone is still stuck waiting on releases, and the fact that there is code involved is basically an afterthought.

</comment><comment><USER18> Why not open source all the code? What does Google have to gain from closed sourcing even part of Google glass?

<comment><USER19> There are three possibilities:

      1. Google wants to monetize the novel features of Glass
      2. Google is bound by licenses for the technology, and is unable to open source certain bits
      3. They will open source everything eventually, but decided to rush this bit for publicity reasons

<comment><USER20> There are lots more possibilities, but the one that I think makes the most chance is:

      4. Google is required to release the kernel code under the GPL

No such requirement exists for the other code.

The big pay-off for google is that to use glass you need to use google. If the devices were 'open' then you would not need google to use glass and they'd be in a cue-cat situation.

<comment><USER21> I sadly agree with this. I love Google and their open web attitude, however you cannot look at Apple's success over the past 5 years and not go green with envy. I fear that Google is going to want to try to copy Apple's business model. Of course it's the obvious thing to do but it's sad from a consumer's standpoint.

<comment><USER22> Or they're trying to not help the amazon's of the world that just fork their product and remove the monetizing bits of it, and replace it with their own monetizing bits.

</comment></comment></comment></comment></comment><comment><USER23> I'm still betting it'll be largely impossible to run a standard Linux distro on the device without a massive amount of hacking.

The kernel will no doubt require binary blobs for OpenGL drivers (IIRC it's an OMAP CPU so this is likely) and because they decided they don't like glibc the OpenGL drivers on the device will be a pain to link against. I always find this annoying while hacking on Android devices.

</comment><comment><USER24> So they only released the Linux ... and now we can have Ubuntu for google glass.

On I side note - it is a sad world when the fact that device is unlocked is news instead of the norm.

<comment><USER25> We've been living in that 'sad world' to a while.

</comment></comment><comment><USER26> For completeness of the headline (specifically 'declares platform open'), Google needs to also make the Mirror API available to those, who are not part of Explorer Program, may be via a simulator.

</comment><comment><USER27> Judging by the threads, no good deed goes unpunished.

</comment><comment><USER28> So it's open now but you're still not allowed to make money with applications? That's a strange definition of open to me.

</comment><comment><USER29> Hey Saurik - don't take the hating so personally man. Google gave you Glass precisely because they knew you'd rock the boat and piss a bunch of people off (and get people talking about Glass in the process). You're doing a wonderful job of that. Be proud.

In reference to: [https://plus.google.com/118343182830485155505/posts/ERUJ8e1y...](https://plus.google.com/118343182830485155505/posts/ERUJ8e1yKRd)

<comment><USER30> As a side note, that's a good example of my biggest problem with Glass as a product. Not even Google knows what to do with it, and they are expecting hackers to "show me something cool" -- Wait, what?? No, YOU TELL ME FIRST what Glass is supposed to do, then I might think about devoting some of my unpaid time to hack some "shit" for you.

Unless Google also open sources the Glass hardware, any "contributions" to their source code will be benefiting only Google and not the open source community.

</comment></comment><comment><USER31> That's nice.

Can we have the source code for Google Reader too, while we're at it?

<comment><USER32> Why? It would be useless to you; the effort required to write a web-based RSS client is as nothing compared to re-implementing all the internal infrastructure that Reader depends on.

If you want to run your own RSS client, starting with NewsBlur[1] or Tiny Tiny RSS[2] would get you much further than being able to see the Reader source.

[1] <https://github.com/samuelclay/NewsBlur>

[2] <http://tt-rss.org/>

</comment></comment><comment><USER33> This reminds me of Steve Jobs iPhone first presentation and hackers jumping onto the platform. However, Jobs had vision and charisma to follow. This doesn't make me as excited.</comment>


Use LESS to make CSS development suck less (part II) - <AUTHOR> http://blog.bugsense.com/post/24469714818/use-less-to-make-css-development-suck-less-part-ii

<comment><USER2> Very helpful!

</comment><comment><USER3> great reading =)</comment>


The economics behind today's new micro-restaurants - <AUTHOR> http://qz.com/7554/27-courses-16-tables-800-plates-so-how-do-they-make-money/ <comment><USER2> It took an unreasonably long time for me to find the scroll bar.

To add insult to injury, putting the mouse in the normal place the scroll bar will be, means you won't be able to use the scroll wheel as well!

<comment><USER3> They also hijacked your keyboard controls. Boo.

</comment></comment><comment><USER4> I'm not sure the first Japanese example (4 courses) jibes with the other examples -- they all seemed much more upscale, much more into the gastronomy scene, and thus much more expensive to urn. I think the former has potential to be much more profitable than the latter. To monetize the latter you probably need to bid for tables or similar -- if there is so much unserved demand you should be able to make that work.

Anyway, interesting article. I like this kind of stuff where they break down the economics of an industry.

</comment><comment><USER5> Mr. Pollo at 24th and Mission (SF) is a really great example of this trend and probably the best meal I've had in the city. It's great when creative types find the right scale to maximize their creativity and personal enjoyment in what they create.

<comment><USER6> Meanwhile, in Montreal there's another good example called "Kazu." It's tiny, only has a handful of staff, there's always a 30+ minute lineup, and their opening hours are limited and irregular... but the food is amazing, the staff are courteous, and they've just got this warm and amicable atmosphere where patrons will strike up conversation with one another about how great it all is.

<comment><USER7> If you happen to be in Paris: Momoka is amazing.

</comment></comment></comment><comment><USER8> I've went to quite a few such places in Tokyo 10 years ago. I really liked it, and wondered when the concept my spread.

</comment><comment><USER9> I wish descriptions like this said "financial accounting" instead of "economics". Economics is about tradeoffs; part of that is money, but economics ≠ money.</comment>


AirSend – a new app to get work done in one space - <AUTHOR> Have conversations in channels, share large files, track next steps, keep notes and get work done in one space with 100 GB free storage.
Currently, we're giving free lifetime membership for anyone who signs up now.
Sign up here: https://live.airsend.io/signup
Or learn more: https://www.airsend.io/ <comment><USER2> Is pricing available on your site without having to create an account first? I could not find it.

<comment><AUTHOR> It's free, and anyone who signs up now has free lifetime membership.</comment></comment>


GEMM: From Pure C to SSE Optimized Micro Kernels (2014) - <AUTHOR> http://apfel.mathematik.uni-ulm.de/~lehn/sghpc/gemm/ <comment><USER2> This is a great master class, if you will, on iterative optimization for core loops. They progressively make improvements to their method until they approach the performance of standard, optimized BLAS implementations. (About as fast as BLIS, less than Intel's MKL, which is about as fast as OpenBLAS. [0]) Timing Eigen without linking against BLAS is a little misleading, since Eigen is meant to be linked against a system BLAS.

You wouldn't want to use this code, but it shows you the sorts of things to start paying attention to in this performance-critical sections. I was most surprised by the fact that reordering operations to spread the same instructions apart made a significant difference.

(As an aside, your best bet in practical tools is using a metaprogramming library [Blaze seems to be the best], wrapping core operations in a fast BLAS implementation. I personally choose to use Blaze on top of OpenBLAS.)

[0] [https://news.ycombinator.com/item?id=10114830](https://news.ycombinator.com/item?id=10114830)

<comment><USER3> [Not all the world is C++ -- I'm glad to say!]

Note that OpenBLAS doesn't have avx512 kernels, and the fallback to avx2 (unreleased) is a factor of three slower than MKL dgemm on Knights Landing. It looks as if the next release of BLIS will remedy the lack of free BLAS avx512 support with micro-architecture dynamic dispatch which includes fairly competitive avx512 (>80% of MKL dgemm on KNL).

I don't know about the competition on non-x86 architectures, but BLIS currently has more limited support than OpenBLAS.

<comment><USER2> Good to know! I wasn't aware. It doesn't matter too much for me, since the machines I'm using only support AVX2, but I do write my code to work generically on all vectorizations up to AVX512, and I'm likely to use MKL on Knights Landing+.

</comment></comment></comment><comment><USER4> I've implemented the whole course in Nim in my tensor library: [https://github.com/mratsim/Arraymancer/tree/master/src/tenso...](https://github.com/mratsim/Arraymancer/tree/master/src/tensor/fallback)

All BLAS libraries currently only care about float32 and float64, I wanted very fast routines for integer matrix multiplication and use this as a fallback for integers while using OpenBLAS/MKL/CLBlast (OpenCL)/CuBLAS (CUDA) for floats.

Thanks to this I achieved 10x speed compared to Julia and 22x speed compared to Numpy on a 1500x1500 int64 matrix multiplication on CPU: [https://github.com/mratsim/Arraymancer#micro-benchmark- int64...](https://github.com/mratsim/Arraymancer#micro-benchmark-int64-matrix- multiplication)

<comment><USER3> I don't know which operations are implemented for those types, but the "dnn" support in the libxsmm ("small matrix multiplication") library has I32, I16, and I8 <[https://github.com/hfp/libxsmm>](https://github.com/hfp/libxsmm>).

<comment><USER4> I did stumble upon libxsmm while looking for a BLAS library, I didn't see they had integers.

Do you know what libxsmm means by "small", there is nothing in their README/wiki. However it does say that libxsmm doesn't support 32-bit OS. My library is used in IoT devices.

<comment><USER5> * Small Matrix Multiplication: [https://github.com/hfp/libxsmm/wiki/Q&A#what-is-a-small-matr...](https://github.com/hfp/libxsmm/wiki/Q&A#what-is-a-small-matrix-multiplication)

* Big(ger) Matrix Multiplication: [https://github.com/hfp/libxsmm/wiki/Q&A#what-about-medium-si...](https://github.com/hfp/libxsmm/wiki/Q&A#what-about-medium-sized-and-bigger-matrix-multiplications)

There is indeed no support for 32-bit. Regarding integers, LIBXSMM supports lower-precision GEMM. However, we haven't fully represented this in our usual sample code (samples/xgemm, samples/bgemm).

Put aside a tiling scheme for big matrices - the code generation for low- precision GEMM kernels is here:

* [https://github.com/hfp/libxsmm/blob/master/src/template/libx...](https://github.com/hfp/libxsmm/blob/master/src/template/libxsmm.h#L135)

* [https://github.com/hfp/libxsmm/blob/master/src/template/libx...](https://github.com/hfp/libxsmm/blob/master/src/template/libxsmm.h#L139)

* Generic: [https://github.com/hfp/libxsmm/blob/master/src/template/libx...](https://github.com/hfp/libxsmm/blob/master/src/template/libxsmm.h#L124) with [https://github.com/hfp/libxsmm/blob/master/include/libxsmm_g...](https://github.com/hfp/libxsmm/blob/master/include/libxsmm_generator.h#L68)

* C++: [https://github.com/hfp/libxsmm/blob/master/src/template/libx...](https://github.com/hfp/libxsmm/blob/master/src/template/libxsmm.h#L372)

</comment></comment></comment></comment><comment><USER6> I appreciate the work done at the hardware level for streaming computations of structured data. But from the high level view, it's more critical to be able to compute efficiently matrix decomposition, it helps to solve systems of linear equations and obviously discretised PDEs.

<comment><USER4> It depends on your field, for engineering (structural, fluid dynamics, ...) it's key. For deep learning, it's useless ;).</comment></comment>


Critique my summer project: talkOlympics.com - <AUTHOR> http://talkolympics.com/

<comment><AUTHOR> Hey Hacker News,

I would love to get some feedback on my summer project:

talkOlympics aggregates the latest on the Olympics and lets you read it together with other surfers. While browsing, you see the people following the games and also the article that they are currently reading. You can follow the crowds to find interesting articles or join the group chat to discuss the competition.

We put together the site in order to test whether / how this whole idea of social browsing could work. Please let me know what you think - I have found out that HN is the best place to get high-quality feedback!</comment>


Digital Ocean Private Networking Is Not Private - <AUTHOR> http://incoherency.co.uk/blog/stories/digital-ocean-private-network.html <comment><USER2> I was about to express my outrage when I decided to actually do some research. Their posts pretty clearly indicate it is shared private networking - [https://www.digitalocean.com/company/blog/introducing- privat...](https://www.digitalocean.com/company/blog/introducing-private- networking/)

<comment><USER3> What a terrible name. So it is non-private private networking, great distinction there DO. I wonder why people are confused..?

What about "Shared Intranet" instead. Why has the word "intranet" fallen out of style? And why use the word private to describe something that is inherently non-private by design?

I actually think the addition of this free inter-droplet channel is amazing (and a potential massive cost saver), but the name sucks.

<comment><USER4> Technically, I think they're correct with their definition[1]. However, they should be more explicit with the "Shared" part and have some better documentation rather than an announcement blog post[2], a community guide[3], and a moderator comment on that community guide [4]. Especially in today's privacy-conscious world.

Having said that, people who are concerned about privacy should always be validating their setups themselves. The maxim of "trust but verify" comes to mind.

[1]: [https://en.wikipedia.org/wiki/Private_network](https://en.wikipedia.org/wiki/Private_network)

[2]: [https://www.digitalocean.com/company/blog/introducing- privat...](https://www.digitalocean.com/company/blog/introducing-private- networking/)

[3]: [https://www.digitalocean.com/community/tutorials/how-to- set-...](https://www.digitalocean.com/community/tutorials/how-to-set-up-and- use-digitalocean-private-networking)

[4]: [https://www.digitalocean.com/community/tutorials/how-to- set-...](https://www.digitalocean.com/community/tutorials/how-to-set-up-and- use-digitalocean-private-networking?comment=4486)

<comment><USER3> > Technically, I think they're correct with their definition.

I never said they weren't "technically correct," I said the name sucked and confused people [0].

They could also just use "Data Center LAN." No confusion there.

[0] [https://en.wikipedia.org/wiki/Privacy](https://en.wikipedia.org/wiki/Privacy)

</comment></comment></comment></comment><comment><USER5> When setting up multiple VPSs connected by "private networking" with a company like Linode, or Digital Ocean, or what-have-you, you need to assume that the inter-VPS links are not secure. It's a little piece of knowledge that comes with experience, hard for newbies to realize.

The first time you set up one of these clusters, you might follow one of Linode or DigitalOcean's handy guides, where they might suggest i.e. a reverse proxy server receiving (and decrypting e.g. HTTPS) inbound traffic, routing it out to multiple worker machines, and a single backend database system. Linode sells dedicated Load Balancers for the front end of exactly this sort of set- up.

These guides almost _always_ fail to mention that the data is observable as cleartext in the internal network. They ought to be reedited with big bold warnings starting that these links ought to be secured. (Can Linode's Load Balancers even secure these links?) Besides other eavesdropping customers, there could potentially be little magic government agency plugs installed -- or the eavesdropping customers could be government security agencies themselves. (Sorry, tinfoil, I know...)

OpenVPN connections are a lightweight, efficient solution. They're also transparent once you change IPs from those of the virtual network interfaces to those of the secure virtual network interfaces. Such a configuration is still non-trivial, though, for someone configuring their VPS via a control panel rather than the command line.

<comment><USER6> In your experience, is a single OpenVPN server sufficient on such a network, or is it possible to have a fallback (server)?

I previously tried using a distributed VPN setup without a single main server; that didn't work out so well however, mostly because the software was somewhat unreliable.

</comment></comment><comment><USER7> Most data centers actively want the default private networking to work across the datacenter with everyone. A better term would be non-routing. Rackspace calls theirs "service net". These non-routing networks encourage people to use cheap internal bandwidth (rather than bounce of an expensive leased line just to come back in) and possibly offer a special service just to that data center's customers. There are tons of companies offering sql and nosql databases as a service, and any number of other offerings.

Most cloud providers recommend you configure your firewall rules keeping in mind that other people could be on your internal network connection. This is really a security best-practice anyway.

</comment><comment><USER8> This is basically a billing feature, so that you can use "free" internal networking capacity instead of metered external networking usage. They are just following what Linode and other VPS providers do.

I think part of the problem is that people confuse DO, who just rent out cheap boxes, with more "full service" cloud providers. DO is partly to blame because they keep marketing themselves as a cloud platform when really they're yet another company who rents out servers with a few extra features.

<comment><USER9> Not that DigitalOcean currently bills for bandwidth over the external network, nor have they done at any point from conception through to today.

[https://www.digitalocean.com/community/questions/questions-a...](https://www.digitalocean.com/community/questions/questions- about-bandwidth-transfer-limits-and-billing?comment=27465)

</comment></comment><comment><USER10> It's "private" in the sense that it's not going over the public network, rather than private to your account. This was pretty clear when the feature was announced. I don't know why it's a surprise now.

You still have to secure your server, even if it's only communicating over the "private" interface. I usually use this feature for database servers, and lock down the firewall so that only the web servers can communicate with the db servers, and only via the "private" interface.

</comment><comment><USER11> This is the same way Linode's works as well. I'm curious, how many people here thought that Private networks were walled to only droplets/nodes on the same account?

<comment> vertex-four Amazon's private network is private by default, I believe Google's is as well, and I believe Azure's is. Digital Ocean is acting much more like a traditional VPS company than a modern cloud computing company here.

<comment><USER12> Well what you are describing is VPC (which for new accounts for a while now is enabled by default), but VPC is software isolation which creates private networks, but EC2 Classic is technically shared private IP space between all customers. There is a big difference between the two.

<comment><USER13> EC2 (and OpenStack) uses security groups to give you the best of both worlds: shared address space so you _can_ route to other customers; but the firewall means you have to explicitly allow the traffic.

<comment><USER12> Yup EC2 security groups are great for ease of management. Group to Group communication for something like load balancers to auto scaling back-end app servers is great as you don't have to worry at all about tracking IP addresses.

</comment></comment></comment></comment></comment><comment><USER14> I don't understand the outrage. There's a clear distinction between "Private Network" and "Private To Just My Servers Network." I've been a DO user for years and I've never been confused about this. Anyone I've ever recommended DO to has never been confused about it either.

I just automated the firewall and SSH tunnels/TLS certificates setup to restrict access and encrypt communication between my droplets when necessary.

<comment><USER15> I see a lot of people get tripped up by this via my work on rubber [1]. It's probably selection bias, but most of them are switching to DO as a cheaper alternative to EC2 and in EC2 your private network is "private to just my servers network" unless you go well out of your way to change that. It also seems like a pretty sensible default for a company that has a lot to lose if malware is able to propagate through a datacenter by anyone willing to invest $5 for the month.

[1] -- [https://rubber.io/](https://rubber.io/)

</comment></comment><comment><USER16> >In Digital Ocean's defence, nowhere do they state that their Private Networking mode provides privacy

The word "private" is kind of in the name, I would have expected it to be private (to my droplets) too.

</comment><comment><USER17> A private network has always meant "a network not accessible through the public internet". If people are using something they don't understand their outrage should not be taken seriously. Learn iptables, it's not hard to use!

<comment><USER18> Actually, I'd say it is, at least relative to the low barrier of powering up a droplet and apt-getting a few packages.

</comment></comment><comment><USER19> It continues to amaze me how many people blame the user for "doing it wrong" or being stupid or something when a company is found to be blatantly lying to reduce their costs.

It's like the whole industry has Stockholm Syndrome or something from decades of vendor abuse.

People, really: private means private. They lied. There's no two ways about it. We didn't misunderstand because we're stupid, we misunderstood because they were cutting corners and being intentionally misleading by using words that have definitions different than the thing that was actually happening.

This isn't new with Digital Ocean. Their contempt for their customers is palpable. A year or two ago I caught them leaking customer data and they made a huge handwavey blog post full of lies about how nothing was leaked.

Don't do business with liars.

</comment><comment><USER20> This is a complete non-issue; anyone really concerned with privacy wouldn't rely on DO's security.

Anyone who was using DO's private network for security reasons and complains is just being hypocritical. They don't care about security: if they really cared about security they would spend the time to implement it themselves.

<comment><USER15> You may as well written "anyone really concerned with privacy wouldn't use a VPS." You don't have to outsource security to screw this up. You're given a non-routable IP. It's called "private networking". And you've just been sold on moving from EC2, where you're effectively on your own VLAN. It's very easy to mess this up. And adding a firewall rule doesn't work because you probably added the subnet anyway. Even if you were diligent enough to detect that, you'd have to propagate rules per droplet every time a new droplet is created or another destroyed (wouldn't want a new account to get your old IP). Doing that in a fault-tolerant way can be a lot of fun. Oh, and your iptables rules look great, but Ubuntu won't restore them for you upon reboot. So even more chances to mess up.

This is deceptive and it shouldn't be acceptable. Maybe you shouldn't be a sysadmin without knowing all this, but I don't know how you learn it without getting burned by it every step upon the way. It's not like the defaults are sensible in most cases.

<comment><USER21> > And you've just been sold on moving from EC2, where you're effectively on > your own VLAN.

Mrh, not quite. If you are a relatively new EC2 customer, then you are a VPC customer, which might effectively be your own VLAN.

EC2 has also been this way for ages, but it has also always had security groups. If you open something up on EC2 Classic to 10.0.0.0/0, any other customer within that region will be able to access your services.

Sometimes this is desirable for collaboration sake, but bridging VPCs is probably a better solution.

> I don't know how you learn it without getting burned by it every step upon > the way. It's not like the defaults are sensible in most cases.

Welcome to #SysadminLife ;)

I do agree that everyone could be clearer about this, Rackspace, Linode, Digital Ocean, and Amazon. A substantial motivation is to keep your inter-VM traffic off the edge routers.

<comment><USER15> > EC2 has also been this way for ages, but it has also always had security > groups. If you open something up on EC2 Classic to 10.0.0.0/0, any other > customer within that region will be able to access your services.

Except that's not how anyone did it. You could define rules that used a security group as the source. And since every instance belonged to a default security group, locking down access to other machines you owned was quite trivial -- you only added rules to allow access from that default security group. If you wanted to add subnet rules, that was usually limited to special cases you would have to actively think about.

> Welcome to #SysadminLife ;)

> I do agree that everyone could be clearer about this, Rackspace, Linode, > Digital Ocean, and Amazon. A substantial motivation is to keep your inter-VM > traffic off the edge routers.

My source of issue was with the grandparent blaming people that get burned by it. As long as the only way to learn this stuff is to get burned by it, it's counterintuitive to blame people for getting burned by it. And in this case, there are measure DigitalOcean could take to make things easier on everyone. E.g., configure the droplets to save and restore iptables rules on shutdown/power-on and lock the instances down by default to only have port 22 publicly exposed.

<comment><USER21> > Except that's not how anyone did it.

I can affirmatively tell you that more than one of my employers, successful startups several years in, _did_ do this when I started.

Anyway, I don't blame people that get burned by this, very little in hosting is obvious.

That's a great example of why people need skilled ops help. Understanding how one computer connected to a cablemodem works and understanding what happens inside of a datacenter are very different things.

</comment></comment></comment></comment></comment><comment><USER22> When you buy a VPS you should assume that it's not private.

There have been plenty of POC's of side channel attacks against sharded/virtual infrastructure including retrieval of encryption keys from a co-hosted VM. On top of that you inherit the risk of potential vulnerabilities within the hypervisor itself which could be potentially exploited to execute code on the host or to compromise co-hosted machines.

There is no mode for any virtual infrastructure to give you neither truly private networking (since at best it's going to be on a virtual switch) or a private host for that matter. Unless you control everything including the datacenter it self any true sense of privacy should not be considered, especially not in a virtualized multi-tenant environment.

</comment><comment><USER23> When a PaaS/Cloud provider says private networking, they mean RFC1918 address space. It's not publicly routed IP space which is private. So saying they offer private networking is accurate against that long standard definition. The technology and effort involved in providing the equivalent of AWS' VPC is huge and most smaller providers don't have the scale, man power, or resources to do it. It's a non-trivial solution to deploy.

Not understanding the platforms you choose to use is not an excuse to write something like this article. It's also not an excuse to not understand how to manage the platform(s) you run your services on.

<comment><USER19> You're moving the goalposts. They didn't offer "rfc1918 networking", they offered private networking. Private is a word with a meaning.

They were caught lying. Why is it important to you to to cover for them?

</comment></comment><comment><USER24> I agree with shaggy. I don't know how you would expect to have a VPN accessible only by your account's droplets for $5. A private network means an internal network. So it's just using the internal infrastructure of the data center to communicate with other droplets in the data center. It's more performant than using the external network. Usually companies' advertise a fully private account infrastructure as a "Private Cloud" or something of that nature.

<comment><USER19> You would expect it because it has "private" in the name and because words mean things.

The "you should have known they were lying because $5 is obviously too cheap to provide the service they are claiming" argument doesn't hold water.

<comment><USER24> "Private Network" is often analogous with "Internal Network". They aren't lying,it's private as in it's using private IP assignment within their own infrastructure. Thus, private.

[http://en.wikipedia.org/wiki/Private_network](http://en.wikipedia.org/wiki/Private_network)

This is purely a case of not knowing industry terminology.

</comment></comment></comment><comment><USER25> I would have thought the fact that you can't set static internal IP's would have implied this. If you're looking for something that's stupid easy to setup and super flexible checkout tincd. A co-worker turned me on to it and it's fantastic so far, but requires a bit of re-thinking how you want to layout your VPN (if you want to REALLY use it the way it should be, otherwise you can just set it up like a normal VPN).

</comment><comment><USER26> As a secure alternative, would something like ZeroTier [1] or cjdns [2] work to create a private cloud? Or is there a simpler solution that would give you seamlessly encrypted networking between nodes (even across data centers)?

[1] [https://www.zerotier.com](https://www.zerotier.com)

[2] [https://github.com/cjdelisle/cjdns](https://github.com/cjdelisle/cjdns)

</comment><comment><USER27> It seems to me that would be quite easy for virtualization software to prevent individual VPSs from reading networks packets not meant for them, thus providing decent privacy. What's the technical hurdle that prevents this in practice?

<comment><USER28> It's tricky because the routing is completely dynamic. You also can't use the typical hardware tricks at scale - for example providers will have more customers than available vlan numbers.

So you have to have a dedicated solution running something comparable to openvswitch in software, or interface with your hardware really fast and really often. Usually the hardware is not really built to be reconfigured constantly every second (or more often).

Once you start adding more than address filtering, you get an explosion of rules. For example in openstack (neutron), it's pretty common to just put a hard limit on the number of entries - otherwise you end up with one vm spawning and suddenly every router has to add another entry for each of the ports to each of the possible 1000s of other vms. And then clean up and keep everything consistent when vms are killed again. It really does get hard beyond the bare basics.

</comment></comment><comment><USER29> It's amazing to me how people can not do their research, not understand the service they are choosing to sign up for, and proceed to publicly malign a company because of their (the customer's) ignorance about how the product works.

<comment><USER19> One has a reasonable expectation that services called "private" will be. It requires no further research.

Why is it amazing to you that people take a company's statements at face value? Why blame the user when the other party is actively misleading them to cut corners and reduce costs?

</comment></comment><comment><USER30> If you need real privacy, I highly recommend tincd to setup a mesh VPN network.

</comment><comment><USER31> This is news to no one. Every datacenter I've ever done business with offered 'internal transfer' for free and used basically identical verbiage to explain it.

</comment><comment><USER32> Someone needs to send them a dictionary.

Private: belonging to or for the use of one particular person or group of people only. "all bedrooms have private facilities" synonyms: personal, own, individual, special, exclusive, privately owned "his private plane"

<comment><USER33> Is a country club to which you pay membership dues a _private_ club?

<comment><USER34> Yes, in the US at least, "a private club for members and their guests" is a common phrase, and would likely apply to a country club.

This would fit Digital Ocean's interpretation of private - not accessible to the general public, but accessible to other members.

<comment><USER33> That was the idea, yes. =)

<comment><USER34> I'm a little slow. Blast you and your Socratic method!</comment></comment></comment></comment></comment>


The hidden messages in children's books - <AUTHOR> http://www.bbc.com/culture/story/20140318-hidden-messages-in-kids-books <comment><USER2> The "Werner Hertzog reads..." series on Youtube is pretty amazing. It ranges from a kinda silly, rambling take on Where's Waldo [https://www.youtube.com/watch?v=EvWh6PMi9Ek](https://www.youtube.com/watch?v=EvWh6PMi9Ek) through a pretty thoughtful version of Mike Mulligan and His Steam Shovel [https://www.youtube.com/watch?v=-Z1R5vDG2Tg](https://www.youtube.com/watch?v=-Z1R5vDG2Tg) to an incredibly deep interpretation of Madeline [https://www.youtube.com/watch?v=57EDxvldLD4](https://www.youtube.com/watch?v=57EDxvldLD4)

<comment><USER3> I should point out that the reader in these videos is not actually Wernor Herzog. Which you might think goes without saying, but it wouldn't be that out of character for him, given his views on professional wrestling, for example.

[http://therickbarry.com/2010/08/26/youre-welcome-world- werne...](http://therickbarry.com/2010/08/26/youre-welcome-world-werner- herzog-talks-about-pro-wrestling/)

</comment></comment><comment> at-fates-hands I must have been some highly developed child growing up. When I was around 4 or 5 my parents read to a lot of Shel Silverstein and of course plenty of Dr. Seuss.

When I saw the Lorax film, I immediately knew it was about over consumption of resources and a little later on (ages 8 or 9) felt a strong environmental pull during the whole movie.

Even the Sliverstein books made me sad. Take for instance, the Giving Tree. People to this day talk about what the meaning really is:

[https://www.mtholyoke.edu/omc/kidsphil/questions/Givingtree/...](https://www.mtholyoke.edu/omc/kidsphil/questions/Givingtree/givingtree_discussion.html)

When my parents read it to me, I was saddened by the fact the tree gave everything to the child, and the child never seemed appreciative of the gifts. On the one hand, I felt it was about being selfish and even when life has handed you everything, happiness was still elusive. On the other hand, it also spoke to me about generosity, and giving to others who don't have as much as you.

Other books just confused me. Alice in Wonderland just gave me nightmares, never mind what the actual meaning of the story was. I'm content to think it was just some crazy acid trip Carroll was recounting.

I feel like the more depressing themes seemed to connect with me as a child, while some of the deeper meanings (The LOTR series and Wizard of Oz) I totally missed. Even after seeing the Star Wars movies, a friend had point out all the biblical parallels. Like Darth Vader being his father. Father in German is Vater. Vader, Vater, it's so very close, but once pointed out, so obvious.

</comment><comment><USER4> I rarely see the deeper meanings that people claim are in these stories . . . I highly doubt many are put there deliberately. However, I do find it interesting what meanings people find. In the first instance, it is an interesting commentary on the way their minds work, but also, it is fascinating how ideas and new lines if thinking can be generated from truly unrelated material (which, in my opinion, is usually a good thing as long as you don't claim those ideas were put there by some sort of conspiracy).

<comment><USER5> One way of cutting through the BS is to see whether people agree with each other about the message. On one extreme, the Lorax clearly has an environmental message, and you'd be hard pressed to find an adult to read it and disagree with that. On the other extreme, the sheer variety of suggestions about what Alice in Wonderland is "really" about suggests that the vast bulk of them are quite wrong.

</comment></comment><comment><USER6> People in the UK can't read this... Now I want to know more

<comment><USER7> For UK readers: [http://web.archive.org/web/20140413055133/http://www.bbc.com...](http://web.archive.org/web/20140413055133/http://www.bbc.com/culture/story/20140318-hidden- messages-in-kids-books)

</comment></comment><comment><USER8>
      > BBC Worldwide (International Site)
      > We're sorry but this site is not accessible
      > from the UK ...

</comment><comment><USER9> This article is talking about "lit crit" (literary criticism) and deconstruction, presented in a light and superficial way so the reader doesn't notice the depth of the topic.

Ironic!

[http://en.wikipedia.org/wiki/Deconstruction](http://en.wikipedia.org/wiki/Deconstruction)

<comment><USER10> Well, it was until you pulled back the curtain.</comment></comment>


Streaming old movies for 24/7 - <AUTHOR> http://twitch.tv/jmallone_br <comment><AUTHOR> Disclaimer: movies in public domain</comment>


The Future of Remote Jobs Is Local - <AUTHOR> https://xn--x1aaa.com/the-future-of-remote-work-is-local/ <comment><USER2> There're some difficulties managing a remote team but they don't diminish the benefits. The main aspect is building strong communication within your team. In terms of remote work, only one thing matters — work! This is amazing because the ordinary question "What have you done today?" replaces many others such as: "What time did you come?", "Why are you late?", "What did you do today?", and so on. Teamwork becomes result-oriented, not process-oriented.</comment>


Samsung Galaxy S4 is out - <AUTHOR> http://m.techcrunch.com/2013/03/14/samsung-galaxy-s-4-beats-the-best-with-5-inch-1080p-display-1-9ghz-processor-gesture-controls-and-a-q2-2012-release/

<comment><AUTHOR> No eye tracking, but it tracks your head. The screen would not dim if you're looking at it, for example.</comment>


Making a toy shark fly using brain waves - <AUTHOR> http://spectrum.ieee.org/geek-life/hands-on/openbci-control-an-air-shark-with-your-mind <comment><USER2> Idea: motorize a weeping angel ([https://en.wikipedia.org/wiki/Weeping_Angel](https://en.wikipedia.org/wiki/Weeping_Angel)), use this mechanism to have it drive towards someone when their eyes shut

</comment><comment><USER3> Wow, respect for a great hack! I wonder if there are any other known actions that give as strong and recognizable an EEG signal as closing your eyes?

<comment><USER4> Hand in boiling water would probably fire some neurons.

I don't see any wow factor here. This isn't control. It's a one-dimension (up/down) input based on activity. There are many commercially available toys that do this without any physical motion required. I've seen some at airport dutyfree.

[https://www.youtube.com/watch?v=RM6nwZBBbAo](https://www.youtube.com/watch?v=RM6nwZBBbAo)</comment></comment>


Germnany's chancellor Merkel speaks out against net neutrality - tech-no-logical http://www.thelocal.de/20141204/merkel-speaks-out-against-net-neutrality

<comment><AUTHOR> '"If we want to have a driverless car or if you have specific, applications for telemedicine, then they have to have reliable and always secure connections," Merkel said.'

So long as this is government-specified, industry-wide preferential treatment (IE, ALL driverless cars, not just Toyota's because they paid), this seems somewhat reasonable. It also seems abusable, and adding the capability for preferential treatment seems like a potentially dangerous step, but it's much more nuanced than simply "speaks out against net neutrality".

<comment><USER2> If this is what they are planning, then you are right.

However, the fact that she made this statements on a conference organized by one of Germany's largest ISPs doesn't make me very optimistic.</comment></comment>


Leaked Apple iPad mini photos - <AUTHOR> http://launchticker.com/story/leaked-aapl-ipad-mini-photos-shown-on-top-of-ipad-w-lightning

<comment><USER2> Classic shader problem in a 3D rendering app - when the flat surface meets a curved edge you get a crease along the line. This is because most shadow calculations are done on a per-face basis.

In real life, getting such a fine crease is really difficult. In a 3D render? All but certain.

<comment><USER3> Also, the flawless wooden table.

</comment></comment><comment><USER4> Looks photoshopped to me. Unless its a weird lighting effect on the metal, the shadows between the two devices don't look right.

</comment><comment><USER5> Everything about it looks like a render, the desk texture, the lighting of the white leads. Looks nice though.</comment>


Police are out of control. It's time to hit them where it hurts: their budgets - <AUTHOR> https://craigcalcaterra.com/blog/police-are-out-of-control-its-time-to-hit-them-where-it-hurts-their-budgets/ <comment><USER2> I'd say it is two fold but the primary change needs to be in their training. Stop the military style training, tactics and supplies. Stop all the military threat engagement and move more towards the social worker style of training. No I don't mean make cops all defenseless, but the fact is over the last 30 years we have militarized our police and forgotten to teach them to use their words to disarm people and instead given them more and more training on how to get physical with people.

Cops are literally trained how to yell and how to intimidate people and given military style equipment and training -- so what do we expect them to do?? How about instead, we teach them to use their compassion and voice to reason with the vast majority of people. No not all problems can be resolved with compassion and reason, some require a gun and someone willing to use it, but we shouldn't start there. It is called escalation of violence/force and police used to be trained to prevent it, anymore it feels as though they are the ones to escalate resolvable problems into all out fights.

I am not saying all cops are bad, there are a huge number which will first use their words and compassion, the problem is as a group, it feels like those who will use their brain first are no longer the majority.

<comment><USER3> Is this what you have experienced or what you are seeing on the news? In my own experience, most cops are usually really nice, but I have also come into contact with those that have ego's and are just plain assholes. However, from my own experience this is the case for society/people you come across in general.

<comment><USER2> Combo of both. I spent ~8 years working on EMS/911 systems and interfacing with law enforcement fairly regularly. I also worked for one of my parents businesses which built (software) law enforcement systems in the 80's and 90's. I know quite a number of very good people who are LEOs who work hard to help their community and care about what they do. And I'd say the vast majority of people go into being a LEO so they can do good for their community, not because they are dicks (but like any profession some are). Three of the people I know that are officers in the recent past have told me personally the training has gotten too focused on militaristic tactics and on physical enforcement (threat neutralization to prevent officer harm). Even pointing out the types of surplus military gear their departments are purchasing etc. So that's one of my primary sources for that specific comment. The news seems to confirm much of it once you remove the sensationalism most news outlets like to put out there, but look at the gear and training tactics they are using, much of it comes from the military.

My own personal interactions have varied over the years, but have been net positive, that said, I am a 40 something entrepreneur/professional who is white. However, even with that, I have had more than a few run ins where a LEO tried to use intimidation and threats instead of conversation to understand what is going on. To be super clear, I am not against them doing their jobs in any way, I know their job is hard and I first hand know (from EMS work) how hard it is when you are dealing with people who abuse the system. But as an example,. less then 2 months ago I had a cop in a neighboring city screaming threats at me and stopping my vehicle for driving around a car accident. What made it interesting is I was following the instructions of the Sgt that was directing traffic who had told me to go around a specific way (which I was doing at less then 10 MPH as he said proceed slowly). My luck is I knew the Sgt could hear this tantrum and the Sgt came over to put a stop to it. Sadly though, this was after the cop had already asked me if I was "fucking stupid" and threatened me with arrest, but I hadn't even said a word yet. When the Sgt walked over he told me to have a nice day and go ahead and made a point of saying that I did nothing wrong. In one example, I saw the good LEO and the dickhead. So that is a recent personal interaction with a bad cop, who I don't think is in the majority, but nonetheless he is out there and is getting training that focuses on threat neutralization instead of calm deescalation. I mean he had every right to stop me and say hey, wth dude why are you driving through here, and I could've said I was told to and that'd be it, he could/would confirm and all is good. No need for the crazy talk.

My overall feeling is the vast majority of cops are good humans doing a hard job where they deal with mainly societies troubled people all day long. So when you train them on threat neutralization or in other militaristic tactics it gives them muscle memory of the wrong nature. Even good ones. And for the bad ones it only intensifies their ego and trains them to be better at their aggression.

</comment></comment></comment><comment><USER4> As long as the castle doctrine becomes federal law and we make it really easy for citizens to get a firearm to protect their families in every state.

Wealthy activists, politicians, and movie stars have private security. They don't care if we have less cops to protect the average person or we make it impossible for the average person to protect themselves.

I have no issue with the protests. My main issues is with radical separatists groups like BLM that are going to make the average citizen unsafe and ruin the city around them to prove some sort of point.

They also want to abolish all prisons.

If this does happen, people like me will just get weapons illegally and take our chances.

<comment><USER3> ^ THIS. I am all for protests, but BLM leaders are turning that movement into a movement of terrorism. I am all for different view points and freedom of expression and dissatisfaction. However, if someone attempts to endanger my family because they feel they were disrespected by someone else, I WILL protect my family by all means possible.

<comment><USER5> Umm, police have been terrorizing citizens legally for decades.

<comment><USER3> I didn't mention police at all, nor does that thread have anything to do with police. Read the thread again, it's about stupid people terrorizing their communities.

</comment></comment></comment></comment><comment><USER3> This isn't like taking a child's allowance away. Less budget means less police, and less training for those police. Hitting budgets is an easy rebuttal but a poor one.

</comment><comment><USER6> Like some others I'm a little skeptical of the budget argument. A lot of the equipment that one would typically see employed for a protest or riot response (riot gear, crowd control weapons, armored vehicles) are often obtained via funding from federal Homeland Security and DOJ grants. Hitting the local city/county budget wont impact the militarization argument, and with a president like Trump, I can easily see an increase in federal grants swooping in to offset that, at least partially.

My second concern is that pay for police is often considered not great. Hitting the city/county budget will likely impact salaries, pay increases, health care benefits, vehicle maintenance, and many other areas. Sadly the fastest thing to get cut from municipal agencies is often training, so I'm skeptical we can "defund" the police while simultaneously adding additional training requirements around mental health, de-escalation, etc.

I'm not inherently against the defund argument, particularly when it involves shifting those funds toward more community services that would reduce crime and poverty anyways. It just seems like the problem has less to do with the amount of money police departments actually have and more to do with a lack of oversight on how they're spending it.

<comment><USER3> Just so we all have the facts straight - police militarization was also happening during Obama (not sure about bush or clinton). This isn't new. So much spare military equipment from Iraq war with no where to go.

<comment><USER6> Yea 100% true, I didn't think I suggested otherwise but appreciate the clarification. I only mentioned Trump because he is 1. the current president, and 2. seems to support militarization of police. To me this puts him in an ideal spot to directly rebuke the desired impacts of defunding since the departments could just get their money from UASI (Urban Area Security Initiative) DHS grants, that I'm assuming Trump could get funded with at least some ease.

<comment><USER3> Question: Wouldn't funding be congress rather than a president? In regards to funding, every president seems to have been for it. Obama may not have been verbal about it, but certainly "funded" it:

Source: [https://m.huffpost.com/us/entry/us_3566478](https://m.huffpost.com/us/entry/us_3566478)</comment></comment></comment></comment>


Asynchronous procedurally-generated competitive multiplayer in the browser - <AUTHOR>

Procedurally generated content seems to be all the rage these days. It can be a useful tool for extending content and increasing replayability, but at the slight cost of players losing relative comparisons. When the level design is always different, it can be difficult to compare player skill levels.<p>In [this browser-based alpha](http://cryptrun.lostdecadegames.com/), procedural generation is deterministic, backed by a simple linear congruential generator. Each time a dungeon is generated, the seed value for the pseudorandom number generator is cached. When a player's game is over, a URL is displayed that has the seed and score information encoded within. This makes for a very small amount of data that can easily fit within HTTP GET limitations. When the challenger's game is over, the two scores are compared, and comparative skill levels can be determined. <comment><USER2> Very nice. I liked the screen rotation in the death world.</comment>


Snakisms - <AUTHOR> https://pippinbarr.github.io/SNAKISMS/ <comment><USER2> There are so many completely novel flavors and shades possible with the apparently blank canvas that is snake (I'd rather see it called Nibbles...). I certainly like the philosophy names. Even more, I appreciate that the game somehow behaves in a ways that, in each case, can only be responded to with a bit of delight, and a sense of "I don't know what I was expecting ..."

It really made me think about how important a well-structured philosophy really is in creating a game, story, interface, and a lot of other things! One needs to understand their own view of the universe in order to create another one effectively, I imagine.</comment>


How Super Mario Run Onboards New Users - <AUTHOR> http://www.useronboard.com/how-supermariorun-onboards-new-users/ <comment><USER2> This is hilarious, but the only thing I disagree with is taking a screen to introduce saving the princess. Yes the original Mario didn't need a narrative hook and this one doesn't either. But reinforcing the narrative of Mario adds value to their brand that has a long term payoff. Mario isn't just a video game anymore, in case you missed the closing of the Olympics. Yeah, saving the princess is a worn out narrative, but they get grandfathered in on being able to use it.

</comment><comment><USER3> I wonder through how many hoops devs have to jump to ship a "simple" game for a big company.

The numerous steps until the game starts makes me think there are more managers than actual [gaming] experts chipping in on the concept. The game is more fun if those who are making it have fun too!

</comment><comment><AUTHOR> Super Mario Run was a smash hit in terms of downloads -- over 50 million in its first couple weeks -- but was a disappointment in terms of revenue: not quite so many of those trial players turned into paying ones as anticipated.

What part did player onboarding play in that surprise?

<comment><USER4> >What part did player onboarding play in that surprise?

Most important part of onboarding for Super Mario Run and the most important part in it's success* was the 31 year onboarding that a chubby red plumber jumping on pipes is actually fun.

* can't really call it success by Nintendo standards only current day App Store standards.

</comment></comment><comment><USER5> At least he didn't have to create a nintendo account. That was brutal, especially on an old phone, where the in-app browser kept crashing without error notification.

</comment><comment><USER6> 73 clicks to go through the slides just to reach a to be continued for the game portion.

The irony...</comment>


Inviolability of Telegraphic Correspondence (1879) - <AUTHOR> https://archive.org/details/jstor-3303981/ <comment><USER2> There's a lot of stuff that has happened in the past couple of years that proves to me that history is not necessarily a monotonic increase in state across a number of measurable parameters, there are a ton of cyclic elements. Some of those cycles are sinusoidal (pendulum like phenomenon) and some are of the sawtooth variety (slow rise with eventual crash).

In 1879 the world was ahead of us in some ways and behind in many others, if we're not careful then we may end up behind 1879 in many others as well.

<comment><USER3> Re: Sinusoidal vs Sawtooth patterns, in fourier analysis a sawtooth is just a bunch of sinusoids with the phase aligned. I wonder if these sharp transitions just occur when many factors with different frequencies happen to align in phase. 1848 and 1968 come to mind as years when this seems to have happened.

<comment><USER4> In Fourier analysis, _everything_ is just a bunch of sinusoids ;) And it seems to me that there are also sawtooth patterns that aren't clearly the alignment of lots of sinusoidal patterns, such as market bubbles.

<comment><USER5> There are definitely graphs that can only be approximated by Fourier methods (such as square waves). The issue is related to Gibbs phenomena: [https://en.wikipedia.org/wiki/Gibbs_phenomenon](https://en.wikipedia.org/wiki/Gibbs_phenomenon)

<comment><USER4> You're correct; I was thinking of L^p (p > 1) convergence almost everywhere.

</comment></comment></comment></comment></comment><comment><AUTHOR> This analysis was written by Thomas M. Cooley, who was Chief Justice of the Michigan Supreme Court at the time. It was mentioned in passing in a Guardian article discussed here recently: [https://news.ycombinator.com/item?id=10401416](https://news.ycombinator.com/item?id=10401416)

The first page is here: [https://archive.org/stream/jstor-3303981/3303981#page/n1/mod...](https://archive.org/stream/jstor-3303981/3303981#page/n1/mode/2up) Not sure why the link shows the final page as the thumbnail.

</comment><comment><USER6> Blocked in China: the irony.</comment>


Show HN: Typesafe Java microservices fwk without codegen - <AUTHOR> https://github.com/guven/microb <comment><AUTHOR> Microb is in working prototype stage.

You adhere to a convention on the server side code and as a bonus you get typesafe client code without code generation and/or writing a contract.

Comments and contributions are more than welcome.</comment>


Taming the asynchronous beast with ES7 - <AUTHOR> http://pouchdb.com/2015/03/05/taming-the-async-beast-with-es7.html

<comment><USER2> I promised Nolan a response on why I didnt particularly agree with this post when I merged it, figure may as well here.

I think all the caveats applied to async function (ensure its inside a try/catch, dont use for in) points to how complicated it can be, [http://jakearchibald.com/2014/es7-async- functions/](http://jakearchibald.com/2014/es7-async-functions/) had to be amended with notes because a bunch of people very familiar with this style of coding still get it wrong. I cant see myself explaining to a new programmer how this all works.

I would really like to see us return to nice obvious blocking functions, taking the example the simplest way of all seems to be ...

      let db = new PouchDB('mydb');
      let result = db.post({});
      let doc = db.get(result.id);
      console.log(doc);

Let workers (or whatever equivalent they come up with in node) to make sure we dont block a single event loop and live happily ever after.

Basically copy erlang, but without actually having to use erlang.

<comment><AUTHOR> I agree that a purely blocking style would be best, and maybe we can hope for that in ES8. :) But async functions are still much nicer than promises.

And in practice, I don't think it will be that hard to explain to newbie programmers. Most of them will not be writing code that actually _produces_ promises, just the code that consumes it (because they're not writing ajax/database libraries). So the "await" basically becomes part of the library API from their perspective.

E.g. they type "await library.doSomething()", their editor tells them that the surrounding function needs to be async, so they add the word "async," and they're done. They don't have to learn a completely new system in order to work with this library.

As for the uncaught Promise rejection project, it is certainly nasty (and has burned me many times as I worked on Pouch), but I'm hoping this can be solved by better tools. E.g. in Chrome, they recently started logging uncaught promise rejections to the console.

<comment><USER3> agreed! async/await is much easier to understand (and explain) than promises, and let's agree to not even talk about callbacks.

</comment></comment></comment><comment><USER4> I like that we're all starting to wake up from this callback nightmare in pretty much every language. It's funny to me that it took us going through a full blown callback orgy for us to realize that all we wanted to begin with was an abstraction of spawning threads and doing non-blocking i/o (makes sense, having to reason about locking is, often, unnecessary). I realize callbacks/lambdas have their place, but it was really starting to chaff.

</comment><comment><USER5> Cool and concise article.

This is just me thinking out loud, but the look-ahead...will it ever end? You say ES7 is bleeding edge, but that's contingent on the context. In terms of browser support/widespread adoption right now, ES6 is bleeding edge. How many years... _decades_ is something like ES7 away from ever being implemented in the majority of browsers out there? How much more will the web development landscape have even changed by then?

<comment><USER6> This kind of adoption will be much faster with evergreen browsers.

</comment></comment><comment><USER7> Does this offer any benefits over building coroutine functions with generators? The "co" library (and probably some others) do this.

[https://github.com/tj/co](https://github.com/tj/co)

It seems mostly like a syntactical difference to me - with coroutines you "yield" instead of "await." You can still wrap things nicely in try{} catch{} blocks.

But the readme for co does mention that it's a stepping stone towards async/await. I like that ES7 will allow us to write this style of function without including an additional library, but apart from that, is there a big gap in functionality between the different approaches?

</comment><comment><USER8> > However, promisey code is still hard to read, because promises are basically > a bolt-on replacement for language primitives like try, catch, and return

I find promises quite readable when combined with arrow functions. async/await certainly is nice, but the difference in readability doesn't seem that big to me.

<comment><USER9> That's more a property of arrow functions than of promises, though, isn't it? We could expect any promise-equivalent to look OK with arrows, too. Callbacks are certainly more palatable in coffeescript, for example.

<comment><USER8> Well yes, arrow functions are the magic ingredient.

But the point is that with them you can express custom control flows trough custom functions instead of built-in syntax without much of a loss of readability.

So we don't necessarily have to wait for ES7. We already have alternatives. Some people have also built async from generators (yield) + promises. So that's another ES6 alternative.

</comment></comment></comment><comment><USER10> Seems like there are a lot of edge cases described in this article that could be confusing when using async/await. Is anyone else feeling ambivalent that async/await is actually a nicer syntax than just using promises?

</comment><comment><USER11> await* is awesome too:

        let arr = [/* an array of promises *]
        await* arr;

Essentially the same as Promise.all

        let arr = [/* an array of promises *]
        await Promise.all(arr)

</comment><comment><USER12> I'm using channels (with the awesome js-csp lib) for managing server-side asynchronous code and so far it's really good. As a bonus I can use transducers with generators :)</comment>


Please Poach Me - <AUTHOR> http://pleasepoach.me <comment><USER2> I work at LinkedIn, so I think I'm reasonably qualified to provide my opinion. I'm certain that this won't work well. Charging $5 per profile view ($50 per 10) is simply outrageous. Most profiles will be junk or irrelevant - recruiters work very hard to sift through the chaff. Even of those that ARE relevant, there's a small chance they'll wind up working at your company. You'd have to have an unprecedented algorithm here. It's unlikely that you do, given we've had engineers working on optimizing search for recruiters for years.

That said, LinkedIn doesn't do the best job of allowing employees to anonymously signal that they are looking for a job. I think there's space for you to make an impact, but I think your payment model will hold you back.

<comment><USER3> LinkedIn likes to brag about how it's reasonably priced... Just $18 per resume.

"The cost to obtain a qualified resume on LinkedIn was less than CareerBuilder; $18.33 per resume versus $175.50."

[http://talent.linkedin.com/blog/index.php/2009/12/cost- per-r...](http://talent.linkedin.com/blog/index.php/2009/12/cost-per-resume- lower-with-linkedin-job-posts/)

I don't think pricing is going to be the problem here.

<comment><USER4> That's not comparable at all. Or rather it is, but it makes LinkedIn look exactly the same price, with a bigger candidate pool.

The $18 per resume there is after _human_ screening removed the bad resumes. Pleasepoachme charges $10 per _match_ \- and as far as I can see all they do is a text match on the requirements.

In the post you linked to, he had to review 39 LinkedIn resumes to get 11 qualified candidates. Based on the Pleasepoachme rates, looking at 40 resumes would be $200. Assuming 11 candidates were found, that is $18 per qualified candidate.

<comment><USER5> Opposed to how pleasepoachme works; here is a free experimental web site we created; <http://www.jobrupt.com>. Jobrupt is for job seekers to initiate a job application by asking publicly the companies to create or open a job position for them by telling how they can add value and why they are the best candidate. Could anyone provide me with some hints or ideas if jobrupt would help anyone? Or is the idea too unrealistic?

</comment></comment></comment></comment><comment><USER6> I'm not trying to crush your startup dreams but you should stop right now and immediately talk to 20+ recruiters or hiring managers about your app before you invest any more time or money.

I built a prototype for a similar idea about 18 months ago - it imported your linked in profile, your network could write skill specific references which back-linked and allowed recruiters/employers to search for skills/experience/geography/salary range they wanted to generate an anonymous short list of candidates in seconds; they could browse shortlisted CVs, read references and they only paid when a candidate agreed to release their details to the recruiter. Great idea eh?

The problem was, just about all the recruiters & employers I talked to about it (in Australia) weren't that positive. Their reasons were: * network effects - it only becomes useful once plenty of candidates were in it. * many recruiters already had their own database of candidates that they didn't want to share or duplicate. * many recruiters needed near immediate response (they had 48hrs to fill a role). Waiting for candidates to respond to a request was a negative for them. * some recruiters saw it as a threat and didn't want to support that kind of system. * Companies often wanted a full service solution so while this could generate a quality shortlist for them, many wanted hand holding.

HR is ripe for disruption but execution is everything. What does your app do that paid access to searchable linkedin profiles doesn't?

</comment><comment><USER7> I like the idea, +1 for originality. Just some thoughts though: Not that I have much experience from the employer standpoint, but the fact that I have to keep paying (even if it's $50) each time, will always leave a constant reminder that I'm spending money. That, coupled with the fact that I'm not sure what quality of candidates you'll be showing me (and I KNOW how bad headhunters can be trying to cram someone where they don't fit, just for that commission) seems like you'd have trouble getting anyone to fork over $150+ on this. Not that I have better specific suggestions, but trying to get one big lump sum might work better, as it's easier to spend once, as opposed to multiple times. And one last thing, I don't how long ago you launched, or if you already did this, but i'd try to find as many alpha tester companies (give it to em free) and candidates as possible, cuz if I just spent my third round of $50, and I"m seeing the same people, kiss it GOODBYE, and I'll be sure to warn my friends. Like I said though, you could be there already, I don't know, it's just a thought that crossed my mind.

<comment><USER8> $50 is really nothing for recruiting.

<comment><USER9> Actually, in recruiting you pay nothing until one lump sump when you hire someone. Here, you pay EACH TIME, and it adds up (even if it adds up to less than 20% recruiting fee, it still feels like constantly paying)

<comment><USER10> That's true but once an agency finds the right candidate you have to pay a lot to hire him/her, like 3 months salary.

<comment><USER11> I am a recruiter. My team and I charge by the hour.

</comment></comment></comment></comment></comment><comment><USER12> Some feedback:

1\. About the name: Non-native speakers may not know what "poach" means. I've lived in California for four years in the past and I was confused.

2\. The cartoon fox looks like it's about to steal my mouse. It looks like you're trying to sell me lockpicking tools...

3\. I think you should better explain what recruiters get out of this versus what LinkedIn offers.

4\. Your landing page is really two landing pages: one for the people (they're the product), and one for the recruiters (they're the customers). I think you should better seperate the two, or just drop one of them altogether.

<comment><USER13> Just curious about your fourth point above... Why do you think two landing pages would be better?

I've seen this approach used on a number of other sites that are seemingly successful, and am debating the single landing page approach for a project of mine, so I would be interested to hear the pros and cons.

<comment><USER12> I'm not really an expert on landing pages, it just seems to me that coming up with a good landing page for one set of users is hard enough...

This isn't that bad until the first horizontal line (except for the fox), where it's clearly targeted at the users, with a smaller link for companies. But I don't think it works below the line.

I think they should focus on the users and assume that the recruiters are professionals willing to jump through more hoops.

<comment><USER5> We would love if you could also give some hints about www.jobrupt.com; a free web tool - in beta, for people to initiate job applications. (pls excuses for the design and language)

</comment></comment></comment></comment><comment><USER14> As a hiring manager, this does not make sense. Why should I pay $50 just to make initial contact with one person, and then still have to do the full recruiting and interviewing process?

Recruiters will do all that for me for free, and pre-screen everyone, so it is the same net result to me, at least on the front-end of the hiring process.

FYI, answering this question here isn't the point - your site needs to clearly tell hiring managers why it is better for THEM. You won't get a chance to open a dialogue with them when they view your site.

<comment><USER7> Good points, does the website charge for anything besides the connection? They aren't that clear. A headhunter could cost 10% or more of whatever I'm going to pay some guy (lets say cost would be ~10k) _edit: and have my hire_ , or I could pony up $500 to meet some people and hopefully make a hire. I don't know if that's how it's being run, but that's the advantage I see.

<comment><AUTHOR> Also - you know people on pleasepoach.me want a new opportunity, increasing the likelihood of finding someone interested in moving to a new company.

</comment></comment></comment><comment><USER15> I like the idea. Two implementation critiques:

1) Let recruiters see the value before making them pay (e.g. wait until people want to reach out to somebody).

2) Come up with payment terms that don't discourage use. You want people to pay you and then use your service religiously. Per-use pricing forces people to ration the extent that they use your service which gets in the way of maximizing the value you provide them.

<comment><USER16> I agree. There's no way I'm giving over my credit card details and being pre- billed when I have no idea if there is even anyone registered to be poached.

Take a lead from dating sites - tease and squeeze.

</comment></comment><comment><USER17> I'd love "pleasestoptryingtopoach.me".

<comment><USER18> I got a call from a recruiter recently. Turns out he thinks I'll be a great candidate to be the new CEO of some algorithmic trading/financial services company in New York City...given my decades of experience in the field. MBA required.

I'm a 21-year-old who just took a leave of absence to concentrate on Kout.me ; how is it that I'm even a target of these people yet?

<comment><USER19> They're desperate, and they get paid a _lot_ if everything goes well. They _could_ carefully screen each person for exact suitability, throw out bad matches and bring in only a few good ones. Or they could throw huge numbers of resumes and see if any stick.

If the recruiter doesn't have excellent technical judgement (few do), the approaches basically pay the same.

<comment><USER17> What I don't understand is: why don't the recruiters that _do_ carefully screen people just wipe out those that don't? Are there enough companies that are too clueless to hire a good one that the bad ones still get enough results to keep doing it?

<comment><USER20> I believe the answer to that is the market segmentation. There are so many different type of segments (by programming language, years of experience, company size, industry etc.) that it is very hard for recruiters to spread across too many different segments. So they stick with a few, work them for years, build up a huge network and get really good in these few segments. But of course there is still lots of room in other segments for less qualitative focused recruiters to make a buck by just playing the numbers game.

</comment></comment></comment></comment></comment><comment><USER21> I think this is brilliant. And I think that it will be successful as evidenced from the _strong_ opinions in this thread. Strong opinions help products spread. The fact that some people hate this app is only evidence that they'll tell someone else how much they hate it; which can only help you. I'm a big fan of polarizing products.

<comment><USER20> I agree, it is super polarizing. The fact that it was ranked at #1 at HN for quite a while is proof of it. I am excited, that someone tries to tackle the passive job seeking market. The market for active seekers with indeed.com, simplyhired.com, monster.com, careerbuilder.com etc. is already pretty crowded, but nobody has really cracked the passive job seeking market. Granted that it's current form has its flaws (I assume it is just a first version), but this could be huge.

</comment></comment><comment><USER22> Pet peeve: Are these really "job offers"? (I've seen similar terminology used when companies contact people due to their open source projects and that bugs me, too.) I think a more proper way of describing this is that companies are offering interview opportunities.

</comment><comment><USER23> This is connected to an employee's LinkedIn profile, so why wouldn't an employee just change their contact settings to "I am open to career opportunities"? I know a lot of people that have that setting on, even if they are very happy with their job, and I don't know of a single person who has gotten flak for it from their employer.

<comment><USER19> Unfortunately that's very error-prone from the potential employer side. It's not a very strong signal that they're actually looking.

<comment><USER23> Very true. However, the impression I've gotten from recruiters emailing me is that most of them are just sending uncustomized emails to a lot of people who match some keywords. If that is the case, then contacting 100 people instead of to 25 people means an extra hour of work. I don't think it's worth paying $5/contact to avoid something that takes so little time.

<comment><USER24> Conversely most e-mails from recruiters get ignored. I'd be far more likely to take an e-mail that I know someone had to pay to get to me seriously, on the assumption it'd likely be better targeted.

<comment><USER19> That might be an argument for premium job sites like TheLadders advertised as ($100k+ jobs). It seems like they've backed off on that branding, though. So maybe that doesn't work out well in practice?

</comment></comment></comment></comment></comment><comment><USER25> If I wanted to look for a job anonymously, the last thing I'd want to do would be to sign in with my LinkedIn profile. I'd probably rather make an extra email account somewhere and use that.

It seems way to easy to implement a third column to this offer: Companies! Find out which of your rat bastard employees is about to abandon ship for only $50 (per month). Get email notifications as soon as one of your employees logs into our site and use our handy Word template to fire them automatically!

<comment><USER26> I think that goes completely against the whole point of the website, it's a platform where you can let people know your interested in finding a new job _without_ your employer finding out about it.

<comment><USER27> I think he was being sarcastic.

<comment><USER26> I feel so stupid, I didn't read the last sentence :/

</comment></comment></comment></comment><comment><USER28> I went to sign up as an employer, but stopped since I didn't want to fork over $50 before even seeing what quality of engineers you have. I'll bet you'd get a lot more employer interest if you let people inspect the goods before entering a credit card number.

</comment><comment><USER29> if you work for a small company (10-200), displaying the company name basically destroys any anonymity. why display your current company name?

<comment><USER30> When you sign up, they have a question "does your company have less than 10 employees", which is presumably to deal with this issue. Of course, 10 is a pretty low cutoff for this question.

<comment><USER31> Yep. We hide the company name if you mark this as "Yes".

</comment></comment></comment><comment><USER31> We built this with the hope that people will find the jobs they truly want. Let us know what your thoughts are.

Most importantly, have fun with it ;)

<comment><USER32> Cool idea! The biggest risk of volunteering yourself to get poached is that your company finds out BEFORE you get poached. Everyone loses :-(

If you block people at the same company, that could be a good way around it for sure.

Do you think salary is the only thing that motivates people wanting to leave? Ancillary benefits to the job may be greater motivators for current employees to switch jobs, no?

<comment><USER31> Since the emails are anonymous (e.g. email@example.com) and your name isn't provided, there's no way your company can find out if you're on the site--unless it's just you and your co-founder :(

<comment><USER33> Unless they happen to read your resume and see that your experience directly lines up with what your company/team is working on?

<comment><USER34> Or they see requests to pleasepoach.me in their network logs, which depending on their resolution can nail you to a wall pretty easily.

<comment><USER35> Any company that punishes you for exploring your employment options probably isnt worth working for anyway

</comment></comment></comment></comment></comment></comment><comment><USER36> Putting aside all the costs of how much it costs to recruit a talented engineer/designer, I think the current monetization model these guys are using for the site is terrible for gaining traction.

When I first saw this on HN, I thought, "Sweet! If I can browse through the candidates and only pay $50 per email, I think this could be manageable!" I immediately started to look for where I could begin browsing before I realized I needed to enter my CC #.... There wasn't even a free trial... It was straight up, "Hey! You don't know how good/bad our candidates are, but give us $50 and just trust us!"

My suggestion? Make it like the dating sites like many here have already suggested. Let me browse your PF and see your qualifications. Why not set a bidding system on the 5 emails sent out a week? That way you can even rank how good each candidate is and what the demand for them are.

All in all, current model for me is no bueno. For all I know, you're grabbing people off CL.

</comment><comment><USER37> This is a great idea. The only feature I think you need is the ability to block companies, specifically the one you're working for right now.

<comment><USER31> Yep, we thought about that. We only provide a way for companies to contact you through an anonymous email (similar to Craigslist) so we decided it wasn't a key feature.

<comment><USER38> Yeah, but I don't think it would be difficult to match experience and projects to a person, especially if the company is small. I love the idea, though.

<comment><USER39> And given a lot of people use GitHub or their own blog as their primary method of showcasing what they can do, the anonymity this provides doesn't seem as useful as it might first appear.

</comment></comment></comment></comment><comment> brown9-2 As someone who would consider signing up to be poached, I would really want to know more about these "high quality job offers" before giving you my personal information.

</comment><comment><USER40> FWIW, this isn't especially interesting to me as someone trying to hire engineers. I can look at resumes on LinkedIn all day long for free. Why should I pay you $50?

<comment><USER41> Presumably because only a small percentage of people on LinkedIn are actively looking for jobs; also, I think you need a premium account on LinkedIn if you want to contact a lot of people who aren't on your network.

Besides, U$50 isn't much compared to the fees recruiters charge. Even if you have to contact 20 candidates before hiring someone, $1000 is still cheap compared to, say, 15% of $100k.

</comment></comment><comment><USER42> Nitpicking: "Don't like your job?" feels too negative IMHO.

I think the concept is good, but reading this as the first words in the site sparked a mental "I like my job, no thanks." response, and would have just closed the tab if it wasn't a HN submission.

Wanting to get poached if there is a good opportunity doesn't mean hating one's job. Instead if I hated my job I'd try to run away from it within three months, and wouldn't expect to get poached within this timeframe.

</comment><comment><USER43> To start with, let me tell you its an ingenious idea. but,

How do I know if this site is active or not? This site looks to me like a proof of concept. I mean the creators are testing out if it would work based on the number of registrations. May be they would be working on the actual promise now. This could be a classic launch first and iterate example.

</comment><comment><USER44> You need to clean up the homepage copy. Multiple errors inbound:

"Pleasepoach.me is built to give people who don't like their job out an option to transition quicker and easier. It's also build with the belief that companies don't want people who don't want to work there - so this is better for them!"

<comment><AUTHOR> whoops.. thanks!

</comment></comment><comment><USER45> As a hiring manager, why would I hire people who advertise themselves to be poached? In a couple of months, I'm not really sure if they will still be interested, or if they are already on the site again.

I guess that depends if you can keep them interested first.

<comment><USER46> Doesn't that logic apply to every potential hire who comes to you while employed somewhere else?

</comment></comment><comment><USER47> As a developer I won't use this. I would rather charge myself for someone to contact me with job offer considering the market right now.

</comment><comment><USER48> Really fucked up (from a engineers point of view) that it only supports linked in and not Github to begin with.

</comment><comment><USER49> It took me a while to figure out what I don't like about the design, but I think it's just the yellow highlight on "anonymous": it the throws off the colors and visual balance.

More importantly, though, it was quickly clear what exactly the site did and how it worked. I'm impatient, so I appreciate that.

</comment><comment><USER50> Generally speaking the best jobs are given through word of mouth and knowing the right people, so you'd still be far from getting the cream of the crop positions. I think the HN crowd can be more ambitious than this.

Also, startups and small businesses most likely cannot afford this service.

</comment><comment><USER51> Great idea, bad name however. Also, might I suggest SSL for the "enter your credit card number" part?

<comment><USER31> We're moving the entire site over to SSL a little later tonight. :)

<comment><USER51> Good. Now set DEBUG = False in your Django settings file. Seriously. You know, private keys and stuff. For, you know, important stuff like stripe.

</comment></comment></comment><comment><USER52> If the job market for the target audience is so great (which it is), a service like this doesn't make sense. You'll only attract employees who are not competitive. Also, grammar check your landing. Even the first sentence has an error.

</comment><comment><USER53> Great idea. Filtering linkedin contacts who'd like to be poached. I'd like to sign up but I can't work out how! The login link doesn't take me to a register link. The big red poach button seems to do nothing.

<comment><USER51> It seems they put <a> inside of <button>, when it should be the other way (<button> inside <a>)

</comment></comment><comment><USER54> I mistyped my e-mail address, so, presumably, the confirmation will bounce. There's no mechanism I can see to change it, even though I can still get to the Settings page.

<comment><USER31> This is on the todo. Thanks!

</comment></comment><comment><USER55> Good idea, but saying "I work at X company doing Y" for most companies is about as 'anonymous' as the average Facebook profile.

</comment><comment><USER56> You REALLY need to be able to limit your "browse" results to location.

</comment><comment><USER57> $50 for one reference? Are you serious?

</comment><comment><USER58> Isn't this what linkedin is for?

</comment><comment><USER59> clever idea, but it sort of sounds like a way to find bad apples who any company would be glad to have poached.

One idea: Offer a "honey pot" service to companies to see if their employees are trying to be poached.

<comment><USER60> Unless that's an "aggregate data only" service (you have 3 people trying to get poached), it undermines the entire premise of the site. Even then, for small companies, it can be easy to spot the guy who doesn't want to be there anymore, if you know that someone is trying to leave.</comment></comment>