Dear Staging: We're Done - <AUTHOR> https://devops.com/dear-staging-were-done/ <comment><USER2> If you spend $100K on a staging environment and it doesn't give you confidence that it won't fail on production, the problem is Your Staging, not The Staging.

If we have something fail in production, the first question we ask ourselves is: Why didn't we catch this in staging? 90% of the time, the answer is: "We didn't test if properly but thought we did."

Our rate of patching for defect is rare.

As far as the cost, our staging is run in hardware retired from production, with some upgrades (mostly RAM and SSDs). I'm not sure we've spent the authors $100K over 2 decades, let alone in a single year. But YMMV.

<comment><USER3> Everybody is in the cloud now, where there are no hand-me-downs, or at least none we get to use.

<comment><USER4> A year and a half ago, IBM did a study and found that most companies are only 20 percent to cloud transformation. The reality is that there is a ridiculous amount of private datacenters and iron around.

[https://www.ibm.com/blogs/cloud- computing/2019/03/05/20-perc...](https://www.ibm.com/blogs/cloud- computing/2019/03/05/20-percent-cloud-transformation/)

<comment><USER5> This makes it sound like 100% is the goal. Some companies don't get added value by going to the cloud. The cloud isn't cheap for example (among many others) for storage heavy workloads. And sometimes it's also a regulatory thing.

<comment><USER4> Thank you for saying this, I am more than frustrated by that mentality whenever I go to conferences or message boards. There's a big world out there and most of does not resemble the practices of internet companies. It's this fallacy of inevitability for cloud.

</comment></comment></comment></comment></comment><comment><USER6> >>"With feature flags, I can safely test in production without fear of breaking something or negatively affecting the customer experience."

That's not true at all. It is a common misconception that feature flags have no risk.

<comment><USER3> I suspect it's the same quality of thought that can't fathom that a test could have a bug.

Implementing a flag takes fewer lines of code than the feature, and so while the odds are very high that the bug will be within a feature, there is a non zero chance that the bug is in the flag.

A bug might break a new feature. It might break the old behavior. It may turn the system into a latch (you can launch it darkly, turn it on, and then not be able to turn it off).

And then you can break the system while retiring the flag and making the new path permanent.

<comment><USER7> > I suspect it's the same quality of thought that can't fathom that a test > could have a bug.

I have to admit that I often find it funny when some talk about unit tests being the end of all. No manual QA needed, no staging needed, tests passed and everything is good to roll to production.

Unit tests are important, no question but it's still a piece of code which could have bugs or not enough scenarios covered.

</comment></comment></comment><comment><USER8> The amount of bugs we catch in staging is absolutely staggering.

From services that suddenly require new ports to be open through VPNs (development happens without intercontinental VPN's of course) — to commandline options not correctly propagating to our hardened variant of configs — to even latency or bandwidth issues and timeouts due to assumptions.

There's a difficult balance to strike when it comes to ease of development and not letting issues (security or issues with distributed systems) propagate to the customer.

Staging is also the place where you can safely let the chaos monkey reign supreme without fear of losing customer data! It's the last place to test the "fit" of your system.

Staging has a place, and if puff pieces like this cause the company as a whole to downplay funding for it then I'm going to be mighty displeased.

</comment><comment><USER9> > When I test my code, I want to know that it works in production. Staging, > you can't give me that.

This sounds like more of a problem with the author's staging environment than a general issue with the concept of staging environments.

The idea is staging and production should mirror eachother as closely as possible. If your staging environment is wildly different, of course it will be less useful. But it's also your responsibility to maintain a useful-enough staging environment. Why not just say, "it's too much effort for me to maintain a separate, identical environment" rather than dismiss the concept entirely?

<comment><USER3> It sounds like a problem with the author, one probably drilled into their head by management.

The longer you are here, the more weird shit you see, and the definition of "know" gets a lot murkier.

You aren't going to "know" if it works in production, even if you put it into production. Which is something that only makes sense about the fourth time you encounter a piece of shipping code that is so fundamentally rotten that you are not sure how it ever came up with the right answer.

You don't know if the whole car is working. You only know it's moving the direction you wanted it to move and it hasn't exploded, made horrible sounds, or smells. So it's mostly working.

Every tool and process should be working to make you less afraid of trying things (like deploying to prod). Otherwise they're just helping you build a bureaucracy instead of software.

<comment><USER10> Yes, it's about confidence levels.

There will always be _known_ differences between staging and production, e.g. service names, networking.

The point about staging is that it lets you run risk-free tests on a set of things, in a way that give you confidence about the things that are the same as production. The fact that a set of things works in staging is never an absolute guarantee that it will work in production.

If you are in the position of needing to ship releases rapidly, and you can't run meaningful tests in the available time, then no, it's not useful.

</comment></comment></comment><comment><USER11> This is a joke right?

Staging is supposed to be _architecturally_ identical to prod, that doesn't mean it should be _actually_ identical. In practice, this means that if your prod has 10 API servers that are load-balanced behind HAProxy or something, you can probably get away with only have 1-2 API servers in your stag environment, as long as they're still behind HAProxy. If your prod PostgreSQL primary has 64GB of RAM, in stag you can probably get away with 4GB (or less). The key here is to have the same architecture, but on smaller scale (because you're not actually trying to service your customers).

From there, if you have a staging env that costs "$100k", but you don't "infra as code" (with Ansible, K8s, Chef, Puppet, Docker, etc), you're doing it wrong. The difference between deploying to stag and deploying to prod should probably be a one-line change.

<comment><USER12> > In practice, this means that if your prod has 10 API servers that are load- > balanced behind HAProxy or something, you can probably get away with only > have 1-2 API servers in your stag environment, as long as they're still > behind HAProxy.

I think if you have more than one instance of a component in production, you really need to have more than one instance in staging. You can get a lot of issues with more than one node (e.g. session cookie stickiness in load balancers, clustering framework issues, replication issues) which you won't get with only one. I've seen before people get burnt by production issues which they can't reproduce in staging because it only has a single node for everything.

<comment><USER11> Yeah fair point, one is probably too aggressive with the downscaling. Though a stag environment with an LB and 1 API server will still help you catch problems that you otherwise might not have caught without the stag.

</comment></comment></comment><comment><USER13> It should be noted that the author is Developer Advocate at Split.io, a commercial feature flagging SaaS product.

<comment><USER14> So with this piece of context, this is essentially content marketing?

<comment><USER15> Isn't everything content marketing in one way or another?

<comment><USER16> But some are more content marketing than others.

</comment></comment></comment></comment><comment><USER17> Well, it's nice that the author is considering the costs compared to the benefits drawn from doing something "just because".

I don't think the article does a convincing job of arguing that releasing behind feature flags would be much easier to maintain than a staging deployment, though.

For making this consideration, it'd be worth seeing why the costs can't be lowered, why the effectiveness of staging can't be increased, or what cases might be difficult to handle with feature flags.

</comment><comment><USER18> _Why not both?_

As others have said, staging is useful for certain types of changes that may be high-risk and not time-sensitive. For other changes that are time-sensitive and are low risk (like changing some incorrect/offensive copy), being able to bypass staging is also useful. I don't mean to disrespect the author but it feels like the article was designed to take an extreme stance for views. It even reads like clickbait. I bet this article leaves a bunch of people believing that using an intermediate testing environment can never be useful.

</comment><comment><USER19> I know we're mentioning the $100k number, but I'm genuinely curious: how do you spend $100k on staging? I currently spend $75k/year on production, $3k/year on staging, and around $2k/year for a full cloud environment per developer that wants one. For me, $100k for staging would mean >200k monthly active users on staging.

<comment><USER20> You want staging to be as close to production as possible, but obviously not exactly he same size.

If you spend 1M on production, you might have a staging environment 1/10th of that size. Say 10 machines in a cluster instead of 100. But some technologies also have minimum implementation cost requirements per tier of usage. Like if you have a multiple data centers in production, you will need to test that in staging. You can't just have 1 machine in a cluster, so your staging environment needs at least 3 to make a quorum. Therefore, to have 5 data centers in staging, you now need 15 machines... which is more than the base of 1/10th of production.

Issues like that can balloon staging costs if you try to properly implement it.

<comment><USER11> Honestly with the right architecture you shouldn't even need 10 machines in a cluster, 2 should do. After all, the whole point of clusters/load-balancing etc. is that 2 machines behind your LB should function the same as 1000 machines behind your LB, just the latter gives you a lot more throughput.

</comment></comment></comment><comment><USER21> This article is too simplistic to take seriously. Basically it says: "staging is expensive (but $100k !?) and is not the same as prod because data (how many tests fail because of this?), so I'll use feature flags and test in prod".

<comment><USER7> Data consistency between prod and stage is also simple to solve for use cases where it's not an issue. For example, we have a job which restores each day's prod backup to staging.

<comment><USER22> I do this, easy to implement, and it works pretty well -

      dropdb $PGDATABASE || true
      createdb -T template0 $PGDATABASE
      pg_dump $DUMP_DATABASE | psql -q $PGDATABASE

<comment><USER22> whoa, am i doing something wrong? please share thoughts

</comment></comment></comment></comment><comment><USER23> You can't test everything in production.

Be it an infra change or application. It should always be like:

Staging -> Canary -> Production

If you invest time in making the above pipeline automated it will cause less outages.

P.S we use feature flags but it won't solve many other challenges around infra and application changes.

Some examples: \- Changing from Classic ELBs to ALBs (We care about latencies so ALBs served 1% traffic in the start) \- Zero downtime single mysql master upgrade. (ProxySql) \- New k8s controllers. \- New metrics adapters.

Staging should be like a playground to test all edge cases before you go to canary and then to prod.

<comment><USER24> > Be it an infra change or application. It should always be like:

> Staging -> Canary -> Production

Ironically, the author says exactly this when she presents on it. Why she wrote this article in this fashion is beyond me.

[https://www.youtube.com/watch?v=adPQCuotAr4](https://www.youtube.com/watch?v=adPQCuotAr4)

<comment><USER25> The article is a lot more recent than that presentation, its possible the author's opinion has shifted.

<comment><USER26> So to "solve" her staging problem, she pushes the complexity of multiple feature flags and branching unto developers? Sounds a bit short-sighted given how quickly those complexities is known to multiply. Who is going to pay down those growing technical debts?

</comment></comment></comment></comment><comment><USER27> I disagree whole-heartedly.

Personally, I have worked in an environment where staging was a pain, full of cobwebs and issues and data mismatches. I sympathize because I know how painful it can be.

But if you respect your end-users, you cannot delegate the duties of a staging environment to them.

</comment><comment><USER28> This article has reduced the argument for staging, calling it unnecessary. Its upto the devops to use staging effectively. It you have a waterflow like deployment and useless e2e tests running in staging, then it wont be helpful. Instead, if you use staging as another prod (Blue Green deployment cough cough.. ) then, it would be a lot more useful.

Than blaming staging env as a whole, I would blame archaic devops practices for SaaS.

<comment><USER29> Are you saying e2e tests are useless or they are useless in staging because it doesn't reflect prod?

<comment><USER30> e2e tests tend to be very brittle and not that informative

<comment><USER29> I agree they are brittle but why are they not informative? They usually catch edge case bugs in situations I wouldn't have time to manually test.

</comment></comment></comment></comment><comment><USER31> Ideally you'd run tests both in staging (first) and production (only if staging says OK), with the goal to catch 99.99% of issues in staging, safely away from the paying end users.

Because realistically, something will go wrong sooner or later and it will cost the company (and its customers) a lot more money and reputation if it happens in the user-facing environment.

</comment><comment><USER32> Hi. We open sourced our feature flagging product [https://github.com/BulletTrainHQ](https://github.com/BulletTrainHQ) not long ago and would love any feedback from HN.

I still have concerns with deploying production upgrades behind flags due to the inherent issues surrounding things like database schema mismatches, terraform/infra upgrades that are not compatible bidirectionally etc. Has anyone worked on ways to manage these with feature flags?

<comment><USER26> It is possible but you need to design versioning in message and storage schemas from the start. It's a non-trivial thing, but can be done. I'm not aware of any general solution available, so need a bespoken design effort. You need to map out requirements for versioning beforehand, and the complexity and future limitations will follow exactly from requirements.

If instead of converging to versioning, you want full-on branching that never merge, this sounds like very chaotic design. You'd then maybe want to design everything around feature isolation (see: UNIX philosophy), but comes with own caveats around new requirements and cross-cutting concerns.

</comment></comment><comment><USER33> Isn't this pretty much what "cloud" is for? And, y'know, terraform, ansible etc?

</comment><comment><USER34> There's the production cluster then there's the development environments one of which happens to be the staging branch but it is not different in configuration from any web-1234 feature or bugfix branch. It doesn't add anything in costs as I doubt we could use a smaller machine (or is it two machines? can't remember but doesn't matter) than the current one just because we allow one less env... I thought this is what virtualization and all that was about?? And I absolutely can't see how could we drop the environment for feature branches -- not only QA is necessary but also if you want to talk to a stakeholder, how are you going to?

</comment><comment><USER35> Getting an application to the state where you can use feature flags for any new functionality is a massive and continuous effort. Any change in data structures or APIs become a huge pain.

Whether this is worth it, depends a lot on the particulars of your apps.

And where do you test if your feature flags work correctly with production data and environment if not staging? Yes yes, you might have tested in on your development environment, but if testing on staging doesn't work because the environments are too different, testing on localdev or CI is even worse.

</comment><comment><USER36> everyone gangsta until they have to feature flag a database schema change

<comment><USER37> having a database schema at all is the root of that problem. i wish people who are writing systems from scratch would reflect on whether they actually need an RDBMS or RDBMS-like schemas.

Everything I've worked on in the last few years would have been in far, far better shape if they had just started with a no-schema data management system like Bigtable and just adapted their backend code around its limitations.

Imagining you are safe because you are smoke-checking DML statements in staging is just begging for a week-long outage.

<comment> john-shaffer This is a big reason why I like Datomic so much. I get the benefits of a schema, but the schema is basically append-only, so it's very easy to reason about. Updating the schema is instant.

The last time I tried a project with a no-schema DB, it was a huge PITA. It sucks having a function fail on one single document because it had a number instead of a string. I love flexibility, but it is very valuable to have the right constraints in the right places. I quickly learned that a schema is just that.

<comment><USER38> I don't see how you'd have a number instead of a spring in a document in a typed language. Do you just directly dump user supplied data in your database without parsing/processing it? Otherwise, how is this not caught when it enters your system?

<comment><USER26> It is caught by the schema and never stored in the first place. Or you can solve it for every column/field in your system manually, and probably introduce subtle bugs and inconsistencies along the way. I'm for schemas, but not necessarily RDBMS for everything.

</comment></comment></comment></comment></comment><comment><USER39> I've not had a staging environment for a good 6 years, if not more.

Thats not to say that a staging env is bad, they can be very useful, if setup properly. It also might be the case that you really can't test in prod. (stuff that provides safety)

I am very keen on feature flags/magic routers. They have the advantage that you can test the inputs of the system with _real_ data. But that can also be a drawback.

</comment><comment><USER40> This meme came to my mind immediately after reading the title: [https://memegenerator.net/img/instances/68740589/i-dont- alwa...](https://memegenerator.net/img/instances/68740589/i-dont-always-test- my-code-but-when-i-do-i-do-it-in-production.jpg)

</comment><comment><USER30> If staging is broken, the CI should break too due to the impossibility to deploy. I don't get the "nobody will care to fix staging"; unless nobody cares of releasing in prod.

I suspect this DevOps is working in loneliness, without enough communication with devs. Devs ought to be educated, it's part of DevOps job.

</comment><comment><USER41> $100k for a staging environment is definitely worth it IMO. It sounds like this person hasn't setup a good one, but in my experience a good $100k staging environment will catch more than $100k worth of bugs and downtime over a year. One hour of downtime can be worth more than that.

</comment><comment><USER42> Have you ever worked for a company that doesn't have staging or feature flags? It sucks.

<comment><USER11> Staging is so important to me that I moved our startup from Paddle to Stripe as payment processor because Paddle did not (and I think still does not) offer any sort "dev" mode that I could use to test our payment integrations in dev/stag.

Literally their solution was "just make a product that costs $0 and test it against our production service".

To me, that was a very red flag.

<comment><USER42> The real kicker for me is when there's no staging environment and production is kittens-not-cattle, and yet there's no strong way to wonder how this situation came to be.

<comment><USER11> Wait, doesn't it make sense for there to be no stag in a kittens-not-cattle situation?

You lovingly hand-provisioned your infra rather than writing infra as code. This makes it non-trivial to set up a stag environment, so you just don't.

</comment></comment></comment></comment><comment><USER43> feels like moving problem from operations to developer.

with staging: keeping almost identical environment with production, syncing data if necessary to test load. can be considered as mostly Ops related work.

without staging: of course feature flags should be used when necessary, but if there is no staging environment we should create feature flag for almost every pull request, which in turn create a lot of legacy which should be deleted later. add nested feature flags into this and now you have problem of seeing which conditions are executed when multiple teams are working in parallel

</comment><comment><USER44> This is typical. There is no recipe for all. For those that this is essential, they accept the costs and do it anyway. Those who do this by fashion... I hope they earn enough ;)

</comment><comment><USER45> If userdata is whats failing you in staging there's simple ways to go about pulling in a sanitised version of prod data to making it more prod like.

We had some issues with Akamai WAF blocking things in PROD which only got caught when pushing to PROD so we added staging to Akamai now its closer to 1:1!

For example oracle e-business suite runs completely different with 900GB of prod data vs 100gb of staging data.

ASP.Net applications are slower talking to databases with 1600gb of MSSQL data in prod vs 40gb in staging vs 3gb in test etc.

DR performance different again because its scaled down version of PROD but has the same amount of data and traffic loads when it takes full production load.

Blog writer is taking the piss.

<comment><USER26> Due to privacy and GDPR laws, this is bad practice and outlawed in many parts of the world. We used to mirror from production, but you can't really do that with user data without exposing some personal information. Even a timestamp from a transaction can be enough to identify a real person.

</comment></comment><comment><USER46> I set up a staging instance for my previous startup, then never used it. I don't really understand what the value is unless you have dedicated QA staff that run some manual tests against staging. If the tests are automated, they should run in a dev environment. If you don't have QA, just test in prod. This seems to work well for the largest tech companies, who (in)famously don't really use branches and ship directly to prod with feature flags.

<comment><USER47> The answer obviously varies wildly for every product and company.

Not everything can be feature flagged. Not all tests can be automated. Not all features can be safely tested in production. You can't always roll-back code.

Scenarios where I've found staging environments to be invaluable:

\- Features that make wide-scale changes to the application

\- Changes that require user acceptance testing. Management/Customers might ask for Feature X, you have designers mock up what it'll look like, you might even build prototypes of it... but until they see it and play with it, they might not fully realise that what they actually asked for isn't what they actually intended.

\- Integrating changes from multiple developers and seeing how they play together

\- Testing that your feature flagging actually works

\- Testing how the system responds to dumping large amounts of data/requests at it - a half-day outage in production might easily exceed the cost of a whole year of running a staging environment.

\- Testing how the system behaves after data migrations/changes (things where there's no roll-back without losing data)

\- Testing integrations with external systems.

\- Detecting poor performance, memory leaks, deadlocks, and other stuff that isn't possible on a dev's machine

Testing code on your machine is fine as a smoke test, but your laptop probably has multiple times the capacity of a single node on production, for a single user. So your change that results in 1GB/sec of full table scans on the database might not even be noticed because hey, you have an NVME drive. Your tests also run for maybe a few minutes, but that staging instance might be up for days or hours, and deals with hundreds

I've picked up numerous issues because someone (I'm including myself here) committed some code that resulted in Staging going down or behaving poorly.

I've even overheard conversations that were along the lines of "Yeah, this feature isn't working right at the moment in testing, but that's because staging is running slow today It's fine, we can push this out to production and it'll be better there." if it wern't for me overhearing that, it'd have resulted in a multi-GB video file being sent for every visitor to the site, costing a fortune in CDN charges and still running like crap because it was a 30 second video.

</comment></comment><comment><USER48> Dear Development: We're done.

<comment><USER7> Why need a development code base when you can just directly edit and save to prod? I remember opening tomcat prod directories, edit the html and saving it live in prod years back. Maybe that's where we are headed.</comment></comment>


Boredom is but a window to a sunny day beyond the gloom - <AUTHOR> https://aeon.co/ideas/boredom-is-but-a-window-to-a-sunny-day-beyond-the-gloom <comment><USER2> Boredom is not having anything interesting to do.

As a kid most of my best discoveries and creativity were during boredom, when I went out of my way to try something new (or old, that I had not tried before) or occupied myself with whatever was at hand.

As an adult, during boredom I just try to find some kind of social interaction or go to sleep.

<comment><USER3> You need to be bored AND energetic (or at least lucid) to engage in creativity. Adults give most of their energy to their employers, hence it's no wonder that, in the downtime, little creativity happens. More than one famous author mentioned that during their periods of full-time employment they had no ideas or motivation, they were just barren.

<comment><USER2> It doesn't help that employment contracts in today's dystopia don't even allow one to be creative even in their spare time, as recently highlighted by popular cases.

</comment></comment></comment><comment><USER4> > But even if we are one of those rare people who feels fulfilled, it is worth > cultivating some degree of boredom, insofar as it provides us with the > preconditions to delve more deeply into ourselves, reconnect with the > rhythms of nature, and begin and complete highly focused, long and difficult > work

I dont know wheather it is fact or FUD, but I have heard that mankinds IQ is sinking? If true, I attribute this to a large extend to the fact that there are so many distractions today that we no longer need to get bored thus deprive us of moments of deep mental immersion.

<comment><USER5> IQ seems to be rising, actually.

[https://en.m.wikipedia.org/wiki/Flynn_effect](https://en.m.wikipedia.org/wiki/Flynn_effect)

<comment><USER6> I assume the "Possible End of Progress" section is what the OP is referring to.

<comment><USER5> Then "IQ" is the wrong word for it.

<comment><USER7> No it isn't, read the Wiki:

 _> Research suggests that there is an ongoing reversed Flynn effect, i.e. a decline in IQ scores, in Norway, Denmark, Australia, Britain, the Netherlands, Sweden, Finland, France and German-speaking countries,[4] a development which appears to have started in the 1990s.[5][6][7][8]_

[https://en.wikipedia.org/wiki/Flynn_effect#Possible_end_of_p...](https://en.wikipedia.org/wiki/Flynn_effect#Possible_end_of_progression)

</comment></comment></comment></comment></comment><comment> a-dub boredom is not a lack of interesting things, but rather a lack of interest in committing to take interest in a thing. not a dearth, but a wealth of potentially interesting things and a refusal or inability to choose.

</comment><comment><USER8> "Boredom is the mask frustration wears"

</comment><comment><USER9> _But even if we are one of those rare people who feels fulfilled, it is worth cultivating some degree of boredom_

I dispute the bored vs fulfilled relationship, at least if it's supposed to be a universal (speaking as someone who very rarely feels either)

</comment><comment><USER10> True</comment>


Why do firemen not earn as much as movie stars? - <AUTHOR> http://forbesindia.com/blog/business-strategy/put-need-before-greed-flamboyance-can-wait/

<comment><USER2> Why do diamonds cost more than water?</comment>


Ask HN: Intel drawback of patches; Should I update (my Mac) or not? - <AUTHOR> Recently I read that Intel drew back their patches.
Having not caught up with the discussion of meltdown/spectre, I am left with a question meant for the "average user".
Could you highlight brief reasons - not to update now? - when to update?
I have a Mac.
Thanks :-) <comment><USER2> i have a raspberry pi</comment>


New Ways to Make Money Online - <AUTHOR> http://www.financialpost.com/story.html?id=2378309

<comment><USER2> Etsy, RentACoder, Mechanical Turk: there are plenty of opportunities to make up to $5/day online.

Hint: you still make a boat-load more handing out your business card at the pub during happy hour and talking to people.

</comment><comment><USER3> What I personally am learning is this: Closed marketplaces are good! I tried doing stuff for the internet - I had a BIG discovery problem. How do people find you? If you do stuff for a closed ecosystem like the app store, ebay, amazon, etsy, facebook - the discovery channel is already in place, all you need to do is optimize for it

I think it is easier for an engineer to make money in a closed ecosystem where there are already a lot of customers than if you just go wild in an unlimited place like the internets.

Think of it like a shoe store. They open their stores where other stores already are and where they know the customers are already there.

Opening a startup with no clear idea where your customers are is like opening a shoe store in a residential part of town where you are the only shoe store for miles. You then have to start getting really creative with marketing, which is hard.

<comment><USER4> > Closed marketplaces are good! I tried doing stuff for the internet - I had a > BIG discovery problem.

Yes, I am starting to meet iPhone app developers who target specific niches. In other words, people are searching for something like their app. Their app is not found via email/blog/twitter PR primarily. And it helps that the _title_ of their app has one or more of those keywords.

<comment><USER5> I've recommended a friend to implement similar marketing strategies. He has a small mac app (on HN previously), and he's already getting the good blog/twitter market, but I'm guessing he's missing lots of speculative queries. The kind where the user has a problem, and asks google in general terms.

I think it's a useful, and probably more sustainable (steady), marketing strategy in the long run.

</comment></comment></comment><comment><USER6> I really like the idea of etsy. I have a lot of friends in the town where I grew up who have valuable skills, but due to the recession nearly none can find jobs. The local economy is crushed, but sites like etsy open up possibilities to people who didn't have the technical skills to reach a global community previously.</comment>


Microsoft Support of PHP on Windows - <AUTHOR> https://news-web.php.net/php.internals/110907 <comment><USER2> Clarification from Sara Golemon here: [https://www.reddit.com/r/PHP/comments/ho9dgq/comment/fxgk1sc](https://www.reddit.com/r/PHP/comments/ho9dgq/comment/fxgk1sc)

Key takeaway:

>This message means Microsoft aren't going to produce official builds for PHP 8 onwards.

>This message does NOT mean that nobody will.

<comment><USER3> I didn't even know that Microsoft were the ones creating the official PHP builds, and now that I do, I have no idea why they were in the first place. Especially not when PHP is software that's _owned_ by a company that has had the resources to pay for normal CI/CD pretty much since PHP became big enough for Zend to hire staff.

<comment><USER4> PHP was part of the IIS packaging and was marketed as a seamless integration option. That's probably why they worked on builds themselves.

<comment><USER5> > seamless integration option

My experience with PHP on Windows has been continously terrible. Was there some trick I missed? I have never seen any options in a vanilla IIS to enable PHP.

<comment><USER6> I've been out of the PHP game for a decade or so but Windows, Apache, and PHP always worked no problem. Maybe Windows, IIS, and PHP is a more fickle stack?

<comment><USER7> I have a tough time believing Microsoft wasn't intending their special builds of Windows PHP for IIS.

</comment></comment></comment></comment></comment></comment><comment><USER8> This is about PHP For Windows [1], which build is currently supported by Microsoft. The original title "Microsoft Support of PHP on Windows" might be not sufficient but at least not inaccurate. (EDIT: The submission title has been updated since this post.)

[1] [https://windows.php.net/](https://windows.php.net/)

</comment><comment><USER9> Doesn't seem like a big deal. In this case I believe "MS support" is just compiling PHP for Windows and making them available at the PHP for Windows site.

I'm sure someone will pick this up. Or maybe it ends up being something like Apache where you have to find other places in the ecosystem which provide binaries for Windows. Or just compile the thing yourself.

[https://windows.php.net/download/](https://windows.php.net/download/)

There's vague Tweets here...

[https://twitter.com/dalehirt/status/1281300688102801408](https://twitter.com/dalehirt/status/1281300688102801408)

Seems Dale in moving on to different things and there's nobody to replace him?

You can see his Github activity here...

[https://github.com/dalehhirt](https://github.com/dalehhirt)

ETA: Looks like a lot of this info has already been located and posted in the mentioned Reddit thread.

</comment><comment><USER10> Title should be changed to "Microsoft ending PHP for Windows support from 8.0 onwards"

<comment><USER11> No it's actually. "Microsoft pulling devs from supporting PHP for Windows". The project itself will still live on and builds will still exist.

</comment></comment><comment><USER12> Do people really use Windows as a production server for PHP? Most people I know use Windows as a dev machine, which I guess will still be supported.

<comment><USER13> Yes. In my experience, it usually comes down to "Our Windows admins don't know Linux, so it'll be easier for them to manage a server if it's running Windows!"

Except they never do, because they don't know PHP on Windows either and are afraid of breaking things, and the customer ends up with a PHP/Wordpress installation that is 4 years out of date. Luckily, most of those are internal- only apps, but it still sucks.

<comment><USER14> This is very accurate.

Where I used to work, we developed and supported a SaaS app based on PHP with PostgreSQL and Apache. We had two self-hosting customers who ran on Windows Server with SQL Server for the exact reasons mentioned, and they were our most troublesome customers. Performance tuning (and hence regular complaints that 'our' app was horribly slow) was a particular issue - mostly due to their admins' lack of relevant experience on both the stack...and Windows Server(!). The whole setup was a pain because we got so much flak, despite the premise of 'self-hosting' being that the customer had sufficient smarts to support the infrastructure and stack and we'd just support the functional and development aspects of the app.

One customer also had the system so locked down that for remote admin we had to connect to a jump box via VPN + RDP and then jump from that to the server with another RDP connection. Fetching large log files through that setup was a challenge.

Partly for our sanity, we persuaded one customer to let us migrate them to a Linux server; that went very well and really cut down on angst all round even though we then took responsibility for platform support.

<comment><USER15> Perhaps this is where "appliance VMs " could be of use.

<comment><USER16> Or "containers".

</comment></comment></comment></comment></comment><comment><USER17> I'm most curious about what happens to the official SqlServer drivers for PHP.

At work, we have an on-premise customer support application that relies on PHP being installable on Windows, and requires the official SqlServer drivers for PHP (since they are the ones that...work).

We have many customers on Windows infrastructure; PHP on Windows Server is definitely a real use-case.

So lacking a PHP option would definitely be an issue for us!

But also: In all of Microsoft, is PHP on Windows really just relying on one person????????

<comment><USER18> The beautiful thing about php is it might just work even without updates. There are quite a few extensions which are not updated for almost 10 years and they still work on newest php versions

</comment></comment><comment><USER19> Who use Microsoft build of PHP ?

Back when I was still coding PHP on Windows, I just used the XAMPP bundle to get the entire web stack up and running in minutes. Granted, that was 10 years ago, I'm neither coding PHP nor coding on Windows now, so I'm a bit out of the loop.

<comment><USER20> In my company some small internal web sites and simple apps run PHP on Windows; we always got the PHP zip from php.net and manually configured about 15 parameters to suit our needs, this was once per minor release, so about once a year (monthly updates did not need any config change). I am using PHP for scripting anything that does not require an exe, but more complex than a batch file, it is the default scripting solution (I connect to SQL server a lot from these scripts).

<comment><USER21> I built an internal web app a few jobs ago around 2015.

Windows server vm, IIS, PHP 7, and sql server. This replaced an asp app.

My only major issues were SQL driver or coding. I did struggling with session timeouts for a while.

I really wish I had known about nginx back then. Even if it were just to show a "down for maintenance" screen while doing a release.

Edit: I upgraded to php 7 in early 2016 before the app officially launched

<comment><USER20> SQL driver works just fine, and "down for maintenance" takes seconds to put in IIS, no PHP needed. Not perfect, but working.

<comment><USER21> I had trouble years ago when the php 7 version first came out. It was fine after a few months.

</comment></comment></comment></comment></comment><comment><USER22> Well, now that you can embed a Debian (or other) very easily, I guess it doesn't make a lot of sense to continue compiling PHP for Windows ?

And there were always some traps (mostly because of the lack of case sensitive file names), so I feel it's better to not use it anymore at all (the edge cases must be very low)

</comment><comment><USER23> Originally Microsoft managed PHP offering on Azure (Azure App Service) was running only on Windows.

Nowadays Azure App Service also supports Linux, so there's no so big need for PHP on this side.

<comment><USER24> And most likely most Azure customers are already clicking the Linux option. So they can start wrapping support down. And a major version like PHP 8.0 is likely just the perfect moment.

</comment></comment><comment><USER25> If there was only one programming language to directly support, I guess this would not happen. But the landscape has changed (personally, I switched from php to python like 15 years ago). If you read the next to mails, it seems they will still help, just not work directly to support it from Microsofts end.

</comment><comment><USER26> Why does PHP need support from within Microsoft to be supported on Windows anyway? What I grasp from that email is that they support the development and build process in some way. Sure enough that could be done by someone else within the community. What's the fuss about?

<comment><USER23> Being an open source project most of the work is likely sponsored by companies who have some kind of interest in supporting the project.

I don't think Microsoft is doing anything that could not be technically done by somebody else.

<comment><USER27> > I don't think Microsoft is doing anything that could not be technically done > by somebody else.

This is generally true. PHP had Windows support early on and builds provided by community.

Having Microsoft backing it meant there were people with more time for it and some Windows-specific optimisation could be done, by people with access to true Windows experts. This gave a boost in the early days of their involvement.

</comment></comment></comment><comment><USER28> It makes sense to me. You can use WSL, and run PHP on Linux.

</comment><comment><USER29> What does this actually mean? The PHP release engineer who replied didn't make it sound like it was a major deal (of course, if it is a major deal, this may just have been an initial ACK statement).

<comment><USER30> Technologically it's not a big deal for developers who want to run PHP on Windows because WSL can do that. It might affect people who have, say, a .NET app running on Windows in Azure who wanted to put a Wordpress marketing site on the same server. As of PHP8 they'll have to either use an 'unofficial' PHP build for Windows or move the PHP site to a second server.

Politically though, it _might_ be a big deal. Microsoft don't think supporting a native Windows build of PHP is worthwhile. That could say something about the server-side scripting language landscape changing. On the other hand, it might just say that it costs a few hundred thousand dollars of engineering time every year and they believe that could be allocated better. There's no way to know from a single post.

<comment><USER31> I guess the just have to make to many modifications to run 8.0 on Windows. Maybe the JIT does nor work properly/easily on windows?

Nevertheless nowadays there is WSL and Docker so you don't really need a windows native executable.

<comment><USER32> There already PHP8 build on Windows: [https://windows.php.net/qa/](https://windows.php.net/qa/)

</comment></comment></comment></comment><comment><USER33> Sorry if this is a dumb question, I don't really use Windows any more... so i'm not super familiar with how things work today.

With the new Linux subsystem, does Windows even need separate support for PHP anymore?

<comment><USER34> > With the new Linux subsystem, does Windows even need separate support for > PHP anymore?

For Windows client, maybe not.

But some people run PHP on Windows Server in actual production scenarios (using either Apache or IIS) and those people absolutely need a native solution: WSL[2] has too much overhead.

SHOULD you be using PHP on Windows Server? Likely not, but it is more common than you'd think, I've personally worked at multiple companies that had a Wordpress based site running on IIS for example. This was pre-Cloud though so YMMV.

<comment><USER35> There's the UniServer [https://www.uniformserver.com/](https://www.uniformserver.com/) \- a complete WAMP stack with quite a bit more, plus it is pre-hardened for use on the public web, ready for deployment and production. It's humorous how many WAMP developers work in public with their development hooks open, allowing outsiders to peer in and they are unaware. UniServer does not allow that.

<comment><USER36> The fact they haven't really updated their front page in years would make me nervous about using such a thing (PHP 5.6 came out 6 years ago and it reached EOL December 31st, 2018) and it took a closer look to see the project was still being updated with a new release just a couple months ago. I'm not trying to crap on the entire project, far from that! A more secure by default alternative to XAMPP/WampServer for Windows is great! But first impressions do matter.

</comment></comment></comment></comment><comment><USER37> Besides alternatives like WSL 2, someone can also produce a winget[1] package.

[1] [https://devblogs.microsoft.com/commandline/windows- package-m...](https://devblogs.microsoft.com/commandline/windows-package- manager-preview/)

</comment><comment><USER38> Must be the fact that they can not make money from it. Kind regards [https://www.good2manage.com](https://www.good2manage.com)

</comment><comment><USER39> At least they warned.

</comment><comment><USER40> What does this mean for PHP on Azure App Service plans? Are they just going to use a different version?

<comment><USER41> php on azure probably runs on linux, so it means nothing for it.

<comment><USER42> This is incorrect. When creating an Azure App Service with PHP, you can choose either Linux or Windows. You would likely choose Windows if you needed to do things like execute Windows binaries as WebJobs.

</comment></comment></comment><comment><USER43> I guess with WSL maturing, most people will use that instead to run PHP on Windows

<comment><USER44> Is WSL maturing? It seems like it has abandoned its original goal for WSL in WSL2 [https://en.wikipedia.org/wiki/Windows_Subsystem_for_Linux#WS...](https://en.wikipedia.org/wiki/Windows_Subsystem_for_Linux#WSL_2)

</comment></comment><comment><USER45> Windows is not a server OS. It's a desktop OS you can use to talk to Linux servers. That's why they gave us WSL and that nice terminal I'm looking at.

<comment><USER46> Maybe not for hosting but I think the Active directory server at the heart of just about every company would disagree with your statement.

<comment><USER47> SQLServer and Hyper-V are also not to be underestimated.

<comment><USER48> PostgreSQL and KVM neither.

</comment></comment></comment></comment><comment><USER49> why?

</comment><comment><USER50> What they did for PHP supporting Windows?

</comment><comment><USER51> Microsoft and PHP has never been a good combination, it's like .NET on Linux

<comment><USER26> 2010 called and wants its opinion back.

No, seriously. Haven't you heard about ASP.NET Core and the like? Even Azure is actively pushing Linux + .NET Core these days.

<comment><USER52> They are recommending a managed k8s cluster, although that k8s cluster can run "windows containers", but if the goal is "don't use aws" then they have to be pushing this way.

</comment></comment></comment><comment><USER53> Microsoft will, in all likeliness, be shifting from the NT kernel to a unix- like kernel in the near-ish future. I wouldn't be too concerned.

<comment><USER54> Why would they want to do that? Why adopt something that is on its way to the museum?

<comment><USER55> > Why would they want to do that? Why adopt something that is on its way to > the museum?

The Unix kernel is one of the most widely deployed in the world. I don't think it's going anywhere in the next 100 years.

<comment><USER56> > The Unix kernel

Which one? Linux?

By that logic Windows NT kernel won't go anywhere in 100 years either, since it runs on nearly a billion devices.

<comment><USER57> Neither is MVS going anywhere, even though it has evolved into z/OS.

I'm pretty sure there will be a workloads running on NonStop well into the 21st century too.

So, there's no reason to think we will be free of Windows anytime soon either.</comment></comment></comment></comment></comment>


Early Stage Hiring - <AUTHOR> http://fbfund.com/early-stage-hiring/ <comment><USER2> JobScore is a pretty awesome product, which I can now say (publicly) since I no longer work for a competitor. Dan seems like a sharp guy, and it all seems like good advice.

</comment><comment><USER3> the most important part of early stage hiring is to be patient and not rush into hiring people who are not 100% fit both personality and skill wise. be extremely picky because early hires are going to interview and hire other people.

<comment><USER4> this is described as "the law of crappy people" succinctly in this very old post: <http://www.wired.com/wired/archive/8.08/loudcloud_pr.html>

</comment></comment><comment><USER5> Spend 80% on developing a story is so true. Daniel Pink's Whole New Mind discusses how today's world is making more use of their right-brains; the creative/intuitive half.</comment>


Oreo Separator Machine [video] - <AUTHOR> http://devour.com/video/oreo-separator-machine/

<comment><USER2> Heh, funny. If this is an advertisement I don't mind at all.

</comment><comment><USER3> Socializer milking HN for Kraft foods ?</comment>


What makes mobile retention so difficult - <AUTHOR> http://thetechblock.com/what-makes-mobile-retention-difficult/

<comment><USER2> The first two points of this write-up are largely invalid.

1\. Mobile devs. don't know where their downloads come from

Every single large/popular ad network that I've dealt with has a conversion and download tracking system in place. A user clicks on a banner or some other media link to the App Store/Google Play, passing one of many unique identifiers (udid, device id, idfa, device finger printing). If that same user downloads and opens the app, the app makes an API call to the ad network with the same device identifier and BOOM, you've tracked a download. This is mobile marketing 101. It's a little trickier recently because of the move from UDID to IDFA on iOS, but still quite effective at tracking the acquisition process and value of mobile campaigns, and nothing has change on Android. Does she think companies are just throwing money at ad campaigns without tracking their success??

In addition to the aforementioned standard ad-network practices, Google Play and Android allow you to specify a referrer in a URL to Google Play, which is then passed to your application if it ends up getting downloaded, which the Google Analytics SDK will then pass to Google Analytics. Funny, she shows the referral section as something that isn't available on mobile - this is the exact screen that gets populated with Google Play referral data.

2\. Mobile developers don't know when their apps are deleted

The Google Play developer console tells you how many uninstalls you get per day, along with how many active installs you have. It's quite useful in tracking overall trends in engagement and retention of users.

For iOS or if you want something more precise for Android, the respective push notification services (APNS and GCM) both allow (and in fact, encourage), you to use their APIs that expose exactly which push token/devices have your application installed.

If neither of the above work for your app, plenty of analytics toolkits (Google Analytics, Localytics, Flurry) are there to give you engagement data. Hell, on Android you can have your app start on boot and ping your server if you really wanted to see if it's still installed.

"Reasons far out of any developer's control"? Hardly!

</comment><comment><USER3> Are there any companies offering solutions to this problem?

<comment><USER4> Unfortunately, the solution can only be offered by Apple and Google, since they are the only ones with the data. This is one of the big problems with a walled garden approach - neither you nor your users really control your software. Another big problem is discoverability - Apple and Google basically control who is and is not discoverable on their platforms. There is no doubt that apps/developers in their favor (genuinely or otherwise...) have a far higher chance to be featured than others, creating an unfortunate effect.

For example, if Microsoft released an Android app, there is no way Google would ever place it in their featured apps list.

</comment></comment><comment><USER5> this article brings a great point that is beginning to be noticeable by many users, and unfortunately, it's not addressed as much as it needs to be.

Great article.</comment>


Undercover restorers fix Paris landmark's clock (2007) - <AUTHOR> https://www.theguardian.com/world/2007/nov/26/france.artnews <comment><USER2> The people who restored the clock were sued but eventually cleared of all charges.

The clock has never been used or wound up since...

[http://urban-resources.net/untergunther.html](http://urban- resources.net/untergunther.html) [https://ugwk.org/Untergunther_Presse.html](https://ugwk.org/Untergunther_Presse.html)</comment>


Ghostery - Attention all NoScript users - <AUTHOR> http://news.ghostery.com/post/103180001/attention-all-noscript-users <comment><USER3> Is this a joke, or did he actually mess with yet _another_ add on? If this is true, and wasn't fixed in the latest version, it seems like a death knell for No Script. The Adblock business was bad enough, but apologizing for one and doing nothing about the other is wrong. He obviously knows that messing with a users addons pisses them off, and has ignored that.

However, that's only if this isn't just a joke in poor taste.

<comment><USER4> It seems to me that this has nothing to do with the plugin itself. From the articles and the responses, it seems that it is only _his website_ that blocks the CSS popups of Ghostely.

The plugin does not do any harm to ghostery. He just uses a CSS rule on his _website_ to disable some of ghostery's functionality.

</comment></comment><comment><AUTHOR> A user's perspective: [http://yardley.ca/2009/05/04/when-blockers-block-the- blocker...](http://yardley.ca/2009/05/04/when-blockers-block-the-blockers/)

"Finally, NoScript is still blocking Ghostery through a Ghostery-specific CSS rule. This is especially vile, since Ghostery doesn't affect NoScript's revenue model in the slightest - it's just the tool I use to be informed about the analytics and advertising technologies in use from site to site. The site owners' claim that he doesn't like the look of the CSS overlay is completely unacceptable - my browser, my computer, my ability to view the content in the manner of my choosing."

<comment><USER5> So, wait, let me get this straight: someone who is using a plugin to circumvent the intended operation of something is complaining that it is circumventing the intended operation of something?

How do people come to the conclusion that it is their browser/computer/whatever when they intentionally install plugins and third- party code to both change the operation of said browser/computer and change how stuff is displayed on the page? Is it "mine" until I notice something I don't want to be missing is missing, at which point it switches to being "stolen" from me?

Where's the rationale? I just don't see it.

<comment><USER6> > when they intentionally install plugins and third-party code to both change > the operation of said browser/computer

Computers don't do anything until you install software. By installing/running software, you tell them what to do.

<comment><USER5> You missed the point entirely.

 _The site owners' claim that he doesn't like the look of the CSS overlay is completely unacceptable - my browser, my computer, my ability to view the content in the manner of my choosing._

How is it unacceptable? First off, you give up the ability to view the content in the manner of your choosing as soon as you install a plugin that _filters the content for you_. It would be like complaining about SPAM filtering because it decides an important e-mail is SPAM; for _every other email_ it was perfectly fine, but when it gets one wrong, suddenly it's stealing my email? Please.

Secondly, it is completely the plugin developer's prerogative! If Mr. NoScript doesn't like the look of the Ghostery CSS overlay and blocks it, that's his choice! Nobody is asking him why NoScript blocks pop-ups or full-page overlays or even text ads. And guess what, if people don't like it, they can _remove the plugin_. And maybe everybody will. But I doubt it.

<comment><USER7> I think everyone is missing the point.

If you install and enable the Ghostery extension, it is because you want the extension to do its thing.

There is no valid reason why another extension should deliberately and specifically disable this behaviour, breaking Ghostery, when it is clearly behaviour that the end user intended.

<comment><USER8> > There is no valid reason why another extension should deliberately and > specifically disable this behaviour

It's not - as far as I could tell - this style is deployed on his websites, not through his plugin.

It's a nifty trick, I've just added it to my own site.

</comment></comment></comment></comment></comment></comment><comment><USER9> The comments on the original user article seem to indicate that this is, in fact, not true.

"You're wrong. You've taken an emotionally charged statement from some random bystander and turned it into a conspiracy where there is in fact none. The NoScript _extension_ is NOT blocking Ghostery behaviour.

It is in fact the noscript website, along with Giorgio Maone's other websites, that are blocking the Ghostery box, through the stylesheets. (As are mine - <USER2> website, I can style it how I like.)

Now that you've added fuel to the fire based on nothing but rumour, how are you going to fix it?"

\</comment><comment></comment><comment>----- And another </comment><comment></comment><comment>-- "Just to clarify, the NoScript _program_ NEVER blocked Ghostery: this would have been unacceptable as much as the ABP workaround.

But the CSS is in the _website_ , and it doesn't prevent Ghostery from working (the status bar info is still there).

Ghostery should use a notification bar like NoScript does: trying to delivery notifications overlaying the content is never a good idea, especially if it's security or privacy related, because it's entirely in the site's rights and powers to tamper with it (hide, relocate, or even worse maliciously modifying its content to mislead users).

 _BTW, it was done not to hide any info from the user, but because the box covered the donation button. Any web site can do the same, and will do it if you cover important parts of the page._

Now could we backpedal with the FUD?"</comment>


Ruby fad going out? - <AUTHOR> http://www.codecommit.com/blog/ruby/the-end-of-the-ruby-fad

<comment><USER2> Yeah, it's terrible. I started an app in Ruby last year, had to switch to Erlang, and now Scala...</comment>


Facebook now 60% off all time high of $45, at new low of $17.58 - <AUTHOR> https://www.google.com/finance?client=ob&q=NASDAQ:FB

<comment><USER2> To place in context, worth referring to this:

<http://www.businessinsider.com/what-is-facebook-worth-2012-5></comment>


Researchers invent low-energy alternative to Blockchain using sampling - <AUTHOR> https://techxplore.com/news/2019-09-low-cost-alternative-bitcoin.html <comment><USER2> Interesting. Here is the actual paper, maybe resubmit? [https://arxiv.org/pdf/1908.01738.pdf](https://arxiv.org/pdf/1908.01738.pdf)

<comment><USER2> Looking at it further, it does a random sampling of nodes. Specifically it depends on [https://people.csail.mit.edu/idish/ftp/Brahms-Comnet- Mar09.p...](https://people.csail.mit.edu/idish/ftp/Brahms-Comnet-Mar09.pdf) which in turn depends on: [https://www.slideserve.com/tara/sybilguard- defending-against...](https://www.slideserve.com/tara/sybilguard-defending- against-sybil-attacks-via-social-networks)

which means it does not work against sybil attacks. This is a hard problem, and it's sort of disappointing that it's not mentioned in the techxplore.com article you posted. Bitcoin solves this problem, but this paper does not.

<comment><AUTHOR> Too bad... I was so happy to believe there was some progress.

So, why is it a problem here and not for bitcoin? Is it because in bitcoin to own a node is costly, and not here? (it seems like the new system runs on normal signatures, thus quite cheap)

<comment><USER2> In this system, a node would poll a bunch of other nodes to find out whether a transaction occurred or not. If a sybil attacker created 10,000 nodes to link up to the network, who all said the transaction didn't occur, and overwhelmed a victim node, then it could fool that node. So imagine an exchange that was trying to find out if a transaction occurred or not, and a sybil attacker wanted to prevent the exchange from finding out. The sybil attacker might own a bot network with millions of nodes, so that it held 99% of the exchange's connections to the outside world. Any polling of other nodes would always show false, because the sybil attacker drowned out the honest nodes.

In Bitcoin, running a node is not costly. The miner, however, has to solve the next hash in order to write a block. This, as most people know, takes a huge amount of processing power to have a reasonable chance of doing so. The block produced then contains this information, ie proof the hash was solved.

So, again if a sybil attacker held 99.9% of nodes and the exchange node held only one other connection to a node was honest, if that honest node transmitted the block, the exchange's node would see the block had a huge amount of processing power spent on it, and hence must be valid, even if all the sybil attackers nodes said it didn't exist.

<comment><AUTHOR> But then, if the nodes are backed by things "costly to create", or better "that everybody owns at most once" that seems fine.

For example it could be backed by some verified social network accounts, or even mobile phone numbers, and if they are in the form of hashes even the anonymity would be preserved.

PS: I understood well from your explanation that for Bitcoin the "cost of nodes" is irrelevant, but even so I think it could help for the new protocol proposed here.

PPS: the real cost of a Bitcoin node could also be considered the cost to operate it, that is to write a block, and that in turn is costly, which presents the problem and its solution in an elegant unified way.

<comment><USER2> > But then, it the nodes are backed by things "costly to create", or better > "that everybody owns at most once" that seems fine. > For example it could > be backed by some verified social network accounts, or even mobile phone > numbers, and if they are in the form of hashes even the anonymity would be > preserved.

If you using some central authority to say who is a valid node and who isn't, which you would need for mobile phone numbers, then why bother with trying to decentralize at all? That same central authority can verify transaction are valid. No need for any of this peer validation stuff.

A central authority like that is possible, but I think it would be very hard to get something like that off the ground, in that the government would eventually shutdown whoever was processing mobile phone numbers. Even Facebook is having trouble getting their (centralized) Libra coin signed off by the various governments, and that is a half a trillion dollar company.

The inner-inner paper (the one referenced by the paper referenced by the paper) gets around this problem using a social network, where you have a neighbor Fred that you met in person, who has a Butcher Dave, and so on. This doesn't seem easy as well. PGP email encryption had the same sort of web of trust idea. There are even "signing" parties where a bunch of people get together to verify each others identity. But still, not many people have a PGP key, much less have it verified by the PGP web of trust: [https://en.wikipedia.org/wiki/Key_signing_party](https://en.wikipedia.org/wiki/Key_signing_party)

> PPS: the real cost of a Bitcoin node could also be considered the cost to > operate it, that is to write a block, and that in turn is costly, which > presents the problem and its solution in an elegant unified way.

Well, a node isn't necessarily a miner, and most aren't, actually. One purpose of a node that isn't a miner is to send out transactions on behalf of an individual owner of bitcoin onto the network. Also, a block explorer website would have one to query the blockchain and extract the information to be displayed on its site, and of course an exchange would need a node to perform deposits and withdrawals. Nodes don't have to write blocks, only receive and validate them, and a sybil attacker just needs to create nodes that _pretend_ to validate, it doesn't have to care about having an accurate view of the blockchain. This is very cheap.

<comment><AUTHOR> Right. Very well explained, thanks :)

We could use a darknet, Freenet-like version of a social network, but how resistant would that be. I think that the same threats apply.

Then, all around us, things that make a link between our physical selves and our digital existence, are all either centralized, governmental or corporate, and they get in touch with the physical person. Or else that is done by computationally intensive tasks -- that's a different way to get a grasp on the real world.

Which other ways could be used to make a strong link with reality?... quantum internet and quantum states as personal IDs? :)</comment></comment></comment></comment></comment></comment></comment>


You may not need Axios - <AUTHOR> https://danlevy.net/you-may-not-need-axios/ <comment><AUTHOR> Fetch API examples included.</comment>


Black Holes: The Other Side of Infinity - <AUTHOR> http://www.hulu.com/watch/14906/black-holes-the-other-side-of-infinity

<comment><USER2> USA only.

<comment><USER3> For non-US residents you could use Anchorfree's Hotspot Shield.

I dont believe it's secure privacy/personal data -wise but it's an easy way to get a US ip address and gain access to sites like hulu. Be warned though, it is pretty slower than your usual unencrypted/untunneled connection.

If anyone else knows about a similar service please let us know about it.

<comment><USER4> Hi - This is Art from Anchorfree. I just wanted to point out that Hotspot Shield does encrypt users data using SSL. And we don't keep logs of any of users' data (IP address, website visits, MAC addresses etc). You can read more about it - www.hotspotshield.com.

Best, Art art at anchorfree.com

</comment></comment></comment><comment><USER5> Link is a broken page with an unplayable Flash movie. Mirror?

</comment><comment><USER6> Can someone summarize it. Only plays in USA.

<comment><USER7> Can someone summarize it. Only plays with Flash.

</comment></comment><comment><USER8> Liam Neeson + Black Holes = Awesome</comment>


Ask HN: DIY quadcopter tutorial? - <AUTHOR>

I am searching for a good and up-to-date DIY quadcopter tutorial incl. shopping list (up to 2000$). I would favor a project based around an Arduino Mega/Due for the flight logic and motor controller.<p>Something like this: https://www.youtube.com/watch?v=qNrovqSp3CU (but with more details in english) <comment><USER2> Whoa… 2 grand? That's really a lot! If this is your First build, I guarantee you will crash it at some point. You will break stuff. I'd much, much rather crash my 150-bucks quad than a 2000-bucks video drone.

You can build a nice entry-level quadcopter for around $250,-: You actually don't need that much: \- Frame (F330 clone $8.90) \- Motors x4 (Turnigy 1000kv, $18.20) \- ESC's x4 (Turnigy 30A, $9.99, flash them with SimonK) \- Flight Controller (KK2.1, € 29.99) \- Transmitter + receiver (Turnigy 9x, € 59.99) \- Props (2CW, 2CCW, $2.46 per 2. Do get extras!) \- Battery (2200Mah 3S 25C, $10.57) \- Charger (Turnigy Balance charger, $22.95) Total cost: a couple cents over $250. You can do even cheaper when shopping around Chinese webshops, but this should give you a pretty good idea. All of these parts are from Hobbyking, by the way. (Edit: formatting)

Having built and flown a couple of them, I highly recommend the APM flight controller. It's highly configurable, but flies very well from the start. As opposed to (my experience) the MultiWii, for instance.

I order everything from Chinese webshops (dx.com and banggood.com) and they are faultless. Quality is okay, prices are rock bottom and customer service is surprisingly good.

This was a great article when I started out: [http://fpvcentral.net/2013/03/high-performance-quadcopter- fo...](http://fpvcentral.net/2013/03/high-performance-quadcopter- for-120-step-1-the-shopping-list/)

</comment><comment><USER3> Below sites have really good info on DIY drones --

[http://wiki.paparazziuav.org/wiki/Main_Page](http://wiki.paparazziuav.org/wiki/Main_Page) \-- Open source -- Hardware n software for DRONES

[http://1bitsquared.com/](http://1bitsquared.com/) \-- really tiny miny hardware for drones

[http://www.airspayce.com/mikem/arduino/](http://www.airspayce.com/mikem/arduino/) \--- Useful libraries for RF on Arduino

[http://story.glass/uav](http://story.glass/uav) \-- Good explanation of buiding your own drones -- more material on [https://news.ycombinator.com/item?id=8566641](https://news.ycombinator.com/item?id=8566641)

[http://www.exmaps.com/](http://www.exmaps.com/) \-- Share your drone data

[http://ardupilot.com/](http://ardupilot.com/) \-- Auto pilot stuff

[http://diydrones.com/](http://diydrones.com/) \-- good drones material for starters

</comment><comment><USER4> That's a pretty good info for starting the project. I have promised my 8 year old to build one for him. I will surely start checking out all these websites and visit the store (dx.com & bangood.com).

So we should be able to get all these different components from these 2 stores or there are some other online stores anyone is willing to share.

</comment><comment><USER5> I know a group of cool guys building a quad copter. It seems like a few of these projects are popping up.

DIY quadcopter tutorial, sorry I don't know of one, but you could try going to the closest University to your house and chat to the mechanical engineering department.</comment>


2020 Salon on New Ideas in Programming - <AUTHOR> http://2020salon.blogspot.com <comment><AUTHOR> Next meeting is in Palo Alto on December 10th. There will be two presentations.</comment>


Perch: a really little CMS - <AUTHOR> https://grabaperch.com/ <comment><USER3> There's a ton of these little php CMSs but it feels like inheritating the entire attack surface of LAMP or even just an apache + php stack is insane these days.

Use a static site generator. Maybe have a nice UI around it. Publish the whole thing to S3 or whatever CDN fronted storage solution you like. Almost no attack surface, mindlessly easy, very cheap.

<comment><AUTHOR> > Maybe have a nice UI around it.

I only know about Lektor and MovableType. Arte there more SSGs with some kind of web interface to write and edit posts?

<comment><USER4> Use Stackbit to create your combo of SSG, Theme and CMS. [https://www.stackbit.com/](https://www.stackbit.com/)

<comment><USER5> Stackbit really is a great product! I was able to throw up a marketing site for my family's rental property in a few hours for some non-technical people to manage.

</comment></comment></comment></comment><comment><USER6> "It's all about the comments". All these static site generators are fine but they can't deal with comments. Then you have to add a commenting system from a 3rd party, at which point you may well wish you'd just gone with a PHP/DB solution from the beginning

<comment><USER7> Well I just launched fastcomments.com which you could use :p

<comment><USER8> [https://fastcomments.com/](https://fastcomments.com/)

I appreciate the pricing~

<comment><USER9> It isn't clear to me what the individual tier allows, except for the pageview restriction. There is no FAQ or Support link on the homepage. Is it one domain where all sub domains can have comments enabled? Or is it one subdomain in a domain? Or is it all (disparate) domains owned by an individual?

<comment><USER7> Yeah right now you have to have an account, then you have direct access to customer support via the UI.

A FAQ page I should put together, that's correct.

Your questions:

1\. The tiers differ in pageview restrictions and developer support access. The highest tier provides migration support for the platforms that don't have automated migrations today (you can import from Disqus, Commento, and a couple others).

2\. Right now domains are unlimited and validated at TLD. When you sign up just enter the sites you want to use like.com, this.org. For example, I dog- feed it on my blog at blog.winricklabs.com, but I only have winricklabs.com on my account.

<comment><USER10> Are there any plans to add a free tier without support or migration for say, less than 100k views a month? The pricing seems pretty neat if you're closer to the limit of the pricing ie one million page views but if you're at the other end of the spectrum then it's significantly better to go with a free solution

<comment><USER7> Don't want to support a bunch of free customers at the moment. Maybe later.

<comment><USER8> I think it's a good call.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER11> I used to use Perch regularly for the small sites I was building 8-10 years ago. It fit perfectly into my workflow when I was running a one person shop: 1. Design in Photoshop 2. Build the static HTML and CSS 3. Integrate the CMS and deploy. Perch always made the final step so easy and clients liked it, so I was very grateful for it.

</comment><comment><USER12> This looks like it's based around the "page" paradigm, which is fine for some sites, but for many types of sites I've found that you often want to manage entities with a set of custom fields instead of full pages, then compose the pages from combinations of these entities.

I've been pretty pleased with Cockpit CMS (getcockpit.com) for these kinds of sites. It's a headless CMS similar to something like Prismic or Contentful, but it's self-hosted and open source. It uses PHP and SQLite (which means it's easy to host wherever) and the code is fairly easy to understand if you do want to make changes.

The way I've been working with it is using Cockpit to manage the content, which is then consumed by a React site via Cockpit's API. In order to decouple the CMS and the actual site (and to provide security, versioning and fast page loads), I use react-static (also highly recommended!) to create a static HTML/JS site - so the workflow is: edit content in Cockpit, then trigger a build (I use Netlify for this) which generates a static version of the site which you can then preview and publish easily - it's just HTML and JS files.

You could use e.g. Drupal or Wordpress to do this with the right plugins, but I've found the level of complexity there (both from a developer point of view, and for end users especially in the case of Drupal) too high for simple freelance projects. Cockpit strikes a good balance of flexible yet easy to understand and customise for me - I did also investigate some options such as Netlify CMS, but at the time it didn't seem flexible enough to meet my requirements, this may have changed!

<comment><USER13> hi there, thanks for sharing. How is the workflow for a preview feature ? Meaning, i'm editing content, i kinda want to see what it will look like IF published. Should i wait for an entire build of (assume 30 to 100) pages just to see this new/updated one ?

<comment><USER12> Ah, yes unfortunately you do need to wait for a build in the way it's currently set up. The largest site I've done is probably in the 50-100 page region and that does take 2-3 mins to preview. One option might be to run react-static in dev server mode on a server to generate the preview, this will generate the site on the fly rather than in advance (as it's intended for development use with hot reloading etc) - I'm thinking of trying this on my current project.

<comment><USER13> contentfull and gatsby are kinda tacking this exact preview issue. But telling a non tech editor to wait for several minute for a preview is a big NONO from my side.

Sadly contentful is not free in a nice free tier

(0): [https://www.contentful.com/blog/2019/04/24/content- preview-f...](https://www.contentful.com/blog/2019/04/24/content-preview-for- your-contentful-gatsby-site-with-nextjs/)

<comment><USER12> Yeah, it does depend on your requirements of course, the sites I've used it for are freelance sites for small companies for whom waiting a minute or two isn't a big problem. Should also note that I don't think Cockpit has versioning or draft states so probably not suitable for a "big" site with lots of editors etc.

Like I say, the dev server route may be a way to make this more dynamic. Another possibility is that it seems like react-static can now do incremental builds for only a subset of routes, so you could just republish a given route I'd it's easy to map from CMS entity to affected route(s).

One other thing to keep in mind is that for some categories of site, moving away from the "managing pages" CMS model to the "managing content models" often makes the site much easier to manage (e.g. you can't break the layout by editing the wrong thing in a wysiwyg editor) so there may be less need for frequent previewing.

But I agree, not a solved problem yet. Running the preview on the dev server is the best I can think of for now. You can imagine some kind of site-aware CMS that understood how entities mapped to components and could show inline previews in a React Storybook kind of style, that could be neat!

<comment><USER12> For the record, I did go with the route of running react-static in dev mode on the server for preview (using Phusion Passenger to run it, as this was set up on the server, which required an app.js file to start the server: [https://gist.github.com/tomduncalf/00070fecb68a6cf35c0102c75...](https://gist.github.com/tomduncalf/00070fecb68a6cf35c0102c75f166a8a)). Seems to work really well.

I've got another simple server at "/restart" running which touches "tmp/restart.txt" when hit which forces Phusion Passenger to restart the dev server, which forces it load the content again. Takes like 10-15 seconds to be ready to preview, client is very happy compared to the old setup which required a few mins of building to preview!

</comment></comment></comment></comment></comment></comment><comment><USER14> I used Perch for freelance web development back in '10 and it was great - <USER2> the features I needed, and simple enough to share with clients. Well worth the price.

</comment><comment><USER15> The "elephant in the room" I couldn't find answered on the site: if I'm going to use a PHP CMS, why would I not use WordPress or Drupal? They both have an enormous community of developers, plugins, documentation, and users. At the moment, this feels like yet another PHP CMS that will become abandonware within months.

<comment><USER16> Perch has been around for a decade. You never know when or if something will become abandonware, but Perch isn't something new.

<comment><USER17> Just a shoutout to Rachel Andrew, the co-founder of Perch, member of the CSSWG and imo the Champion of CSS Grid.

[https://rachelandrew.co.uk/](https://rachelandrew.co.uk/)

</comment></comment></comment><comment><USER18> Seems great, but gating the demo behind an email signup seems like it would bounce a lot of potential customers. It certainly killed my interest in looking at the demo.

</comment><comment><USER19> I love it. Use it for client work to this day.

</comment><comment><USER20> considering how long it took to load the site its something I would never use

</comment><comment><USER21> It's cool, but I believe this has been posted a few times?

[https://imgur.com/a/xHNzuvA](https://imgur.com/a/xHNzuvA)

<comment><USER22> HN doesn't operate on a one-submission-per-topic-forever policy. There are different people online every day who might not have seen the submissions from 2009 or half a year ago, each with a whopping 2 points.

If people think it's an interesting submission, they'll upvote it.</comment></comment>


Karl Berry: Texlive 2011 pretest available - hopefully final rc - <AUTHOR> http://www.advogato.org/person/karlberry/diary.html?start=223

<comment><USER2> Being excited for this has raised me to a new level of geekdom.

<comment><AUTHOR> The big deal is that TL 2011 will have tlcontrib. If you into Context, it is planned to host context-minimals on tlcontrib.

<http://tlcontrib.metatex.org/></comment></comment>


GitHub GPG and Keybase PGP - <AUTHOR> https://www.ahmadnassri.com/blog/github-gpg-keybase-pgp/ <comment><USER2> I don't understand what "unverified" means, then. If you can just edit an unverified key into including the right email address, what's unverified about it?

Are they trying to say that the @keybase.io email address has not passed email verification as associated with the account? What's the point of that?

If I compromise someone's git repo (e.g., I trick them into pushing commits they shouldn't have pushed), I shouldn't be able to cause my own key to show up as "verified" as the victim's email address. If the victim needs to approve that key in GitHub's web UI, then what additional benefit does "verified" bring?</comment>


Is Google Evil? - <AUTHOR> http://www.oreillynet.com/windows/blog/2005/08/is_google_evil.html

<comment><USER2> Watch any good movie with the devil, he always presents himself as a really nice guy with just a really great deal for the world. Not that I'm going to stop using gmail or anything.

</comment><comment><USER3> It is only a matter of time before they become like any other large company, AKA evil.

The turning point was their IPO, after this they had had at least some responsibility to public shareholders. Public shareholders in general want the stock to rise. Not in a year, not in six months, but now. This means shortsighted decisions, that can hurt their image. But you don't see this on the quarterly report, since longterm benefits in form of image get sacrificed for short term benefits.

Also like any other growing tech company, the suits come in and take control. And all they care about is quarterly earnings and bonuses.

</comment><comment><USER4> You can't judge a big company's soul based on small granular events unless they form a pattern.

Blackballing CNet was a bad move, as was agreeing to work with the Chinese government to censor search results, but if you're in a judging mood you have to look for the bigger picture, in which they do more good than evil. You'd also want to find articles like this: [http://blog.domaintools.com/2008/01/google-to-kill-domain- ta...](http://blog.domaintools.com/2008/01/google-to-kill-domain-tasting/)

</comment><comment><USER5> It's all about image. When Google came on to the scene, everybody loved them (including myself) for supplying innovative technology that brought more order to something that was growing ever more disordered, and they were sticking-it to Microsoft as an under-dog as well. However, recently, I feel more and more people (including myself) are concerned over privacy (not just Google, but Facebook, etc.), hence, the ever rising rate of suspicion towards Google. I even find myself liking Microsoft because they appear to be the under-dog now in terms of internet technologies, and particularly after that Bill Gates video about his retirement - he seems like an alright guy! If Google did a video like that, then I am sure people would warm to them (even more). Doing good deeds every now and then just makes Google seem as if they are doing it for the sake of keeping face, whilst the Gates Foundations loud publicisings puts Microsoft in an increasingly positive light.</comment>


Ask HN: How to relax after coding for too many hours? - <AUTHOR> Hi, what do you do to relax and sleep after coding for many hours straight? I tend to get very agitated and can't sleep well. <comment><USER2> Coding for too many hours straight isn't actually very productive. Take more breaks while coding, and stop working after a decent number of hours: you'll do better at coding and you won't be as exhausted at the end.

See [https://codewithoutrules.com/2016/08/18/productive- programme...](https://codewithoutrules.com/2016/08/18/productive-programmer/) for more.

</comment><comment><USER3> You probably haven't had enough physical exertion in your day to drain off your energy, and your brain interprets mental focus as a sign that there's something to be anxious about. Sure recipe for tons of nervous energy.

The suggestion to exercise to physical exhaustion is a good one. I usually don't have to go that far, though. Even walking a couple miles usually takes the edge off and gives the brain a chance to wander into other paths.

Doing something else that's almost entirely physically oriented can also help - a craft project, cooking, etc.

</comment><comment><USER4> Strenuous exercise. Forces your brain to shift out of the coding context.

</comment><comment><USER5> Read easy genre fiction until you start nodding off into the book.

</comment><comment><USER6> Take a walk, work out, or read fiction.</comment>


How Clara Labs (YC S14) Is Using Humans to Build AI: Part 2 - <AUTHOR> https://blog.claralabs.com/cooperative-intelligence-ii-the-humans-behind-clara-eb2b4d9112a9 <comment><USER2> Part 1 can be found here: [https://news.ycombinator.com/item?id=12039000](https://news.ycombinator.com/item?id=12039000)</comment>


The Biggest Financial Fraud of All Time - $300 Trillion Rigging of Libor - <AUTHOR> http://news.slashdot.org/story/13/01/29/2326242/the-biggest-financial-fraud-of-all-time <comment><USER2> This is something to be concerned with, it ruins the global economy and might even lead some nations to an economic collapse. $300 trillion USD stolen in this way really hurts. The money could have been used for good and helping people instead of making the wealthy even more wealthy.

<comment><USER3> It's only a small fraction of $300 trillion USD stolen. $300T of contracts and loans were affected but the banks were only skimming a small part of the loans.

$300T would be 30 times US's _total production output_ for a year, or over 4 times total production of output _for the entire world_. Basically that means 4 times anyone has ever made over the past year. No way banks can steal that much.

</comment></comment><comment><USER4> I've been meaning to comment on this for a while, e.g. on Slashdot, but the thought of arguing this with some of those guys sends shivers down my spine. I've been impressed by some the discussions on HN so I'll share this with you, let's see what you think.

First of all, this is cleary fraud and those responsible should punished harshly. The whole concept of Libor is also flawed, mainly because it's not based on actual transactions and so is sensitive to manipulations like these.

Now having said that, let's make a couple of things clear:

1\. $300 trillion is not the amount of money that has been 'stolen'. If the total amount by which the rate was skewed from what it would otherwise have been was 0.01% (which probably isn't wide of the mark) then it's $30 billion per year. A lot of money still, for sure.

2\. $300 trillion doesn't mean what you thin it means. This assumes that one group of people 'loaned' another distinct group of people $300 trillion. But this isn't what happens, the number doesn't take into account that vast majority of these 'loans' are netted against each other. So at any given time the total amount 'lent' is a relatively small proportion of that, say $1 trillion (I think this is roughly true). So I think a better estimate of what was 'stolen' was about $100 million per year, within an order of magnitude.

3\. It's not clear who stole this from whom. There are two main types of manipulation that have been reported:

a) Individual traders or desks manipulated submissions for personal gain. It's not clear that this actually skewed the rates in any particular direction over time, they might have increased one week and decreased the next (and so traders were perhaps paid higher bonuses for one year). In this case one trading desk or trader 'stole' from another trader or trading desk, perhaps even within the same firm.

b) During the recent crisis, the industry as a whole submitted Libor rates that were lower than the otherwise should have been, because they didn't want to look weak (and we know what happened to those who looked weak). This would have benefitted borrowers at the expense of lenders.</comment>


Elroy Air's autonomous hybrid aircraft can pick up cargo containers on its own - <AUTHOR> https://techcrunch.com/2019/12/18/elroy-airs-autonomous-hybrid-aircraft-can-now-pick-up-cargo-containers-on-its-own/ <comment><USER2> I was expecting the attached video to actually demonstrate VTOL with self- attached cargo. It does not. It doesn't really demonstrate anything other than (unstable looking) low altitude cargoless flight, and a cargo self-loading mechanism. In the previous TC article, it states that the drone is actually manually piloted as well. How far along is this project really?

</comment><comment><USER3> It seems pretty disingenuous to show two totally different models in the same video like this, the model that gets airborne doesn't have a back prop/shaft nor is it carrying a cargo container.

No one expects a prototype to carry the full load, but it looks like it can't even get itself airborne at this stage...

</comment><comment><USER4> Not intermodal containers.

<comment><USER5> Right. Only their special 300lb pods.

It takes off vertically on electric props and transitions to horizontal winged flight driven by a fuel-powered prop. That's how they get reasonable range. Several other big drones use that approach, and it seems to work.

We may see full-sized aircraft which work like that. NASA has been fooling around with electric VTOL takeoff and transition to winged horizontal flight. Most aircraft which do that transition are mechanical nightmares, like the Osprey. It's starting to look like having a separate VTOL electrical propulsion system can compete with mechanical transition VTOL. It's certainly simpler.

<comment><USER6> If I was offered a free ride on an Osprey, I'd laugh, then run away as fast as I could.

<comment><USER7> In the most reasonable civilian use, you couldn't run away. It wouldn't be free either, but it might be covered by health insurance.

The V-22 Osprey is ideal for getting you to a trauma center. It could pick you up from the highway, just like a helicopter, but then it has the speed and range to get you where you need to be before it is too late.</comment></comment></comment></comment>


Barman 2.0 Released - <AUTHOR> https://www.postgresql.org/about/news/1702/ <comment><USER2> does anyone know how this compares to wal-e ?

<comment><USER3> I don't have any experience with wal-e, but based on what I learned during my research (went with barman), there is no need to to install barman on the primary or the standby server, just a separate instance with proper user/permissions.

This separate instance is then called from primary's "archive_command", which usually looks like: archive_command = 'rsync -a %p email@example.com:/var/lib/barman/main-db-server/incoming/%f' and once rsync'd barman does it's own magic on it (thru cron). Based on my observations, wal-e is more powerful if you want to store archives remotely (and is primarily an archiving solution), and barman is kinda the official backup solution (2ndQuadrant is a big contributor in the community) plus it offers point-in- time recovery.

Barman + Repmgr (which can do an automatic failover or a manual switchover) is a powerful combo. If only there were reliable tools to determine the master and slave (like Redis Sentinels)

<comment><USER4> Recent versions of Barman allow you to do WAL archiving without using an rsync/ssh-based archive_command. Instead, the backup server uses streaming replication via the standard pg_receivexlog command to build up a WAL archive. The big new feature in Barman 2.0 is that it can take base backups using pg_basebackup, rather than rsync. This means that it can be used without SSH access between servers (only replication connections to Postgres on port 5432).</comment></comment></comment>


Time to move travel into 21st century only one decade late. - <AUTHOR> http://blog.flightcaster.com/american-airlines-is-right-time-to-move-trave

<comment><USER2> I don't now much about the flight industry. What do GDS and TMC stand for?

I'm assuming that OTA is the Open Travel Alliance.

<comment><USER3> I _think_ OTA is actually Online Travel Agent. GDS seems to be Global Distribution System, and TMC might be Traffic Message Channel.

In any case, just knowing what these stand for, does not really help me. This article seems to be saying something interesting, but it assumes a fair amount of background knowledge that I do not have and, frankly, do not really know how to obtain.

So: can anyone provide a summary, without the jargon, of this guy's main point(s)?</comment></comment>