Open-sourcing gVisor, a sandboxed container runtime - <AUTHOR> https://cloudplatform.googleblog.com/2018/05/Open-sourcing-gVisor-a-sandboxed-container-runtime.html <comment><USER2> There is an interesting tool on their github repo called go_generics[0]. It looks like it transforms a Go source file and writes out a new file, by doing name replacement, prefixing/suffixing for variable, method, and class names.

[0] [https://github.com/google/gvisor/blob/master/tools/go_generi...](https://github.com/google/gvisor/blob/master/tools/go_generics/generics.go)

<comment><USER3> There are several open source Go projects out there that implement generics by templating.

[https://awesome-go.com/#generation-and-generics](https://awesome- go.com/#generation-and-generics)

</comment></comment><comment><USER4> Since I see that some of the developers are in this thread, I'll post my question to them here.

What are your plans to deal with the overhead and nastiness of ptrace? Beyond the performance losses, there's also the annoyance that you can't ptrace a single task twice, so no debuggers.

Are you familiar with the FlexSC paper? Have you considered using a FlexSC- like RPC interface (a secure one, of course) to achieve your syscall interception, instead of ptrace? That would allow you to not just match the performance of native system calls, but even theoretically exceed their performance, while still having the same level of control. (I have been working on such an approach, so I was excited to see this gvisor project posted - I hoped you might have already done this and saved me some work :))

Not sure how far this project can go if it sticks with ptrace...

<comment><USER5> (As requested, I work on this project.)

To correct one misconception, the project is not bound to ptrace. There is a generic platform interface, and the repository also includes a KVM-based platform (wherein the Sentry acts as guest kernel and host VMM simultaneously) described in the README. The default platform is ptrace so that it works out of the box everywhere.

> What are your plans to deal with the overhead and nastiness of ptrace? > Beyond the performance losses, there's also the annoyance that you can't > ptrace a single task twice, so no debuggers.

It's true that you can't trace the sandbox itself, and that's annoying, but you can still use ptrace inside the sandbox (ptrace is implemented by the Sentry). Just wanted to make sure that was clear.

> Are you familiar with the FlexSC paper? Have you considered using a FlexSC- > like RPC interface (a secure one, of course) to achieve your syscall > interception, instead of ptrace? That would allow you to not just match the > performance of native system calls, but even theoretically exceed their > performance, while still having the same level of control. (I have been > working on such an approach, so I was excited to see this gvisor project > posted - I hoped you might have already done this and saved me some work :))

I am familiar with FlexSC. There are certainly opportunities for improvement, including kernel-hooks, shared regions for async system calls, etc. Given the pace that this space is evolving, our priority was to share these pieces so that we can discuss things in the open. While I don't think we'll be able to save you work (sorry!), we're aiming for collaboration and cross- fertilization.

<comment><USER6> Good to have a gVisor developer on here. At Dropbox one way we use secure containers is to run machine learning models. Do you know if TensorFlow works in a gVisor container? How is GPU support in the container? If running on a CPU, are BLAS libraries supported to speed up matrix math in the container? Finally, do you know if OpenCV currently runs in gVisor containers?

<comment><USER7> nvidia-docker[1] maintainer here.

Curious to know, are you using docker today? If yes, is there anything missing to satisfy your security requirements?

[1] [https://github.com/NVIDIA/nvidia- docker](https://github.com/NVIDIA/nvidia-docker)

<comment><USER6> We aren't using Docker today; we have jailing infrastructure using linux cgroups, namespaces, seclist, etc.

</comment></comment></comment></comment></comment><comment><USER8> Money quote from [https://github.com/google/gvisor](https://github.com/google/gvisor) for Linux folks who have been around for a while:

"gVisor's approach is similar to User Mode Linux (UML), although UML virtualizes hardware internally and thus provides a fixed resource footprint."

<comment><USER9> as a non linux folk, can you explain?

<comment><USER10> User Mode Linux was a very old library for running virtual machine guests: [https://en.m.wikipedia.org/wiki/User- mode_Linux](https://en.m.wikipedia.org/wiki/User-mode_Linux)

</comment></comment></comment><comment><USER11> This seems neat, but every time I read about something of this sort, I am left wondering: what's wrong with the pledge/seccomp model? According to TFA:

> Kernel features like seccomp filters can provide better isolation between > the application and host kernel, but they require the user to create a > predefined whitelist of system calls.

Isn't that something you'd effectively have to do anyway if you want a sandbox? Like, a sandbox isn't worth that much if you don't define what it can and can't do, no?

I'm far from an expert in this area. It's an honest question, not a veiled criticism.

<comment><USER12> It also ignores that seccomp-bpf allows for far more fine-grained rules for syscalls (like specifying that certain bits be cleared or certain arguments be equal to a value). And they're adding more and more features over time to it. I don't get why you would use ptrace (and if you don't use ptrace then you don't need another layer -- just play with the exising OCI support for seccomp and use runc directly).

<comment><USER13> seccomp-bpf doesn't let you follow pointers, so you can't even implement most pledge() restrictions in it. For instance, pledge() always permits open("/etc/localtime"), but at the point seccomp is run, all you know is open(some pointer to userspace).

You could imagine combining seccomp-bpf with some other system that reads the arguments after they've been copied to kernelspace, which is basically Landlock's approach [https://lwn.net/Articles/698226/](https://lwn.net/Articles/698226/). But I've been personally waiting for something like this since 2011 or so when people were saying seccomp mode 2 should use ftrace, and Landlock itself has been in review (slash argument) for two years. An approach like gVisor works today.

<comment><USER12> > seccomp-bpf doesn't let you follow pointers, so you can't even implement > most pledge() restrictions in it. For instance, pledge() always permits > open("/etc/localtime"), but at the point seccomp is run, all you know is > open(some pointer to userspace).

This is something that is being worked on (separately but similar to Landlock) in the form of seccomp syscall emulation (I don't remember the actual name of the patchset at the moment but it was proposed a month ago I think). However after talking to some seccomp folks I was told that in theory eBPF maps could be used for this purpose (though I'm not really convinced to be honest).

The real downside of ptrace is that you cannot filter which syscalls you're interested in -- so you pay the price of tracing for every syscall. seccomp doesn't have this problem.

<comment><USER13> You can use SECCOMP_RET_TRACE to kick complicated cases back to the ptracer but handle the easy cases without the slowdown. So you can write a seccomp policy that does something like this pseudocode:

        if syscall == SYS_open:
            if flags == O_RDONLY:
                return (SECCOMP_RET_TRACE, 0)
            else:
                return (SECCOMP_RET_ERRNO, EPERM)
        else if syscall in (SYS_read, SYS_write, ...):
            return (SECCOMP_RET_ALLOW, 0)
        else:
            return (SECCOMP_RET_ERRNO, ENOSYS)

and it would be much much faster than tracing every system call, since most programs call open() rarely and read() and write() very often.

That said, the ptracer's job here is kind of hard, because the kernel _still_ gets an untrusted userspace pointer, and another thread, another process, etc. can modify that memory in between the ptracer okaying it and the kernel getting to it. (See "Argument races" in Tal Garfinkel's 2003 "Traps and Pitfalls" paper.) So you either want the filtering to happen in the kernel after it's been copied to kernelspace (which is Landlock's approach), or do the open from a trusted process and send the fd over (which is I think gVisor's approach).

</comment></comment></comment></comment></comment><comment><USER14> I hate to rain on this interesting project's parade, but if you need full sandbox isolation then you should probably look to full VM isolation (ala Kata containers, formerly Clear containers). User namespace-ing, SecComp, and Selinux/apparmor buy you about as much of a sandbox as you'll need, with the one caveat that a kernel exploit could still take you down (all other exoits are rendered sandboxed).

If you need that final kernel sandboxing, then a full VM is your only guarantee. UML still sits on top of an exploitable kernel, and presumably this project itself can be hacked. While it certainly is better than nothing the only thing it seems to be buying you above Kata containers is a faster spin up time and the ability to dynamically resize the container. Maybe that trade off is worth it to someone, but the added performance overhead and the demi-kernel isolation seem like a high price to for those features.

<comment><USER5> Hi! I work on this project.

Nothing wrong with a full VM, but I don't think it's a panacea (and you probably shouldn't guarantee security). You may have taken the UML comparison to heart: did you look at the KVM platform? I'm not clear on the distinctions you're making in that case -- a kernel escape would look a lot like a user- space VMM code execution vulnerability (which also sits on top an exploitable kernel).

<comment><USER14> Well, I wasn't arguing for a VM being a panacea, but in the context of not being satisfied with the Linux primitives for sandboxing, I think it is the next logical step up in security.

From my perspective this project seems like an intermediate jump from Linux containerization primitives and a full blown VM, and I was wondering out loud who fits that use case?

Finally, I didn't mention KVM, but my understanding of KVM is that it's isolation primitive was the hardware virtualization instructions (or at least could be, I'm not sure if it has a PV mode or not).

I guess my question for you would be:

In what context would I want to use this over something like Kata containers?

<comment><USER5> KVM is the kernel interface for virtualization features, but the model created (i.e. the emulated hardware or lack thereof) is up to the user space component (normally QEMU). I think your understanding of KVM is tied with a specific implementation.

FWIW, I don't disagree that it's an intermediate step in some regards. The use cases follow (also from trade-offs discussed in the README). I can't speculate on a stranger's needs, it's great if Kata works for yours. I also think that approach is valuable (as an aside, I authored an experimental project with a similar approach years ago [1]).

[1] [https://github.com/google/novm](https://github.com/google/novm)

<comment><USER15> Is there a comparison of Kata and gVisor based on how they act functionally rather than how they are implemented under-the-hood? Like the OP, I'm curious when you'd use this over Kata.

<comment><USER16> Not a direct comparison of these projects specifically but here is the write- up that was presented in the context of the Kubernetes SIG Node discussions about this topic:

[https://docs.google.com/document/d/1QQ5u1RBDLXWvC8K3pscTtTRT...](https://docs.google.com/document/d/1QQ5u1RBDLXWvC8K3pscTtTRThsOeBSts_imYEoRyw8A/edit#)

</comment></comment></comment></comment></comment></comment><comment><USER17> Sounds like it should be straightforward porting it to run on BSD or Windows, as it implements everything rather than just pass through syscalls.

I wonder how the performance of such a port would compare to WSL.

</comment><comment><USER18> Does anybody know how this is related with chromeos project Crostini? It seems they are all related (GCP, Crostini,...) But they are not linked yet?

<comment><USER19> I do not believe so. Have a PB and have been playing with the new Linux capabilities and they are using a VM with LXC/LXD containers on top.

We did get an update today and have a Linux apps option in setting menu. Which when enable opens a linux shell.

</comment></comment><comment><USER20> Is it possible to hook a custom filesystem implementation to this? So an app won't touch filesystem at all but still will be able to use some sort of virtual files.

<comment><USER17> This has been possible and quite easy with FUSE (and overlayfs / mergerfs / mhdfs / aufs if you don't want to implement all the functionality yourself) for the last 8 years at least -- I've used mhddfs and fuse for exactly this on Ubuntu 10.04

<comment><USER20> I'm not interested in fuse here. Gvisor has fsgofer, which is a proxy of some kind to a filesystem, there is even ReadAt [1]. But it is light on details, I was curious how and to what extent it proxies filesystem API.

[1] [https://github.com/google/gvisor/blob/0c7d73b31ae5e7ba506866...](https://github.com/google/gvisor/blob/0c7d73b31ae5e7ba5068669306aefe5a7b559f92/runsc/fsgofer/fsgofer.go#L720)

</comment></comment></comment><comment><USER21> What ever happened to user-mode-linux (UML)? It seems like gVisor takes a similar approach, a "kernel" in userspace handling syscalls. I was playing with UML the other day, a UML kernel is still in Debian's repo and appears roughly up to date[1], but all the documentation I could find on it was many years old and seemed out of date.

[1]: [https://packages.debian.org/buster/user-mode- linux](https://packages.debian.org/buster/user-mode-linux)

<comment><USER22> My experience with UML is very old, but I think that it had a significant impact on performance. About a 50% loss in certain cases, vs running the same applications on the host directly.

</comment></comment><comment><USER23> Amazing work guys! I'm only wondering, is this ready for production environments?

<comment><USER24> [https://twitter.com/tallclair/status/991621542265180161](https://twitter.com/tallclair/status/991621542265180161) \-- "Google has been relying on gVisor to sandbox production workloads for years. I'm super excited that we've open sourced! Now we can talk about #Kubernetes integrations :)"

</comment></comment><comment><USER25> The Github page mentions that postgres, nginx and elasticsearch aren't currently supported by the gVisor kernel (or pseudo-kernel?). Those are significant, but they shouldn't be showstoppers for a lot of deployments. They list each of these shortcomings as bugs, so hopefully there's a real effort to support the capabilities required by those applications.

Also, I'd like to see what the performance impact is like. What types of applications would suffer the worst performance running on gVisor? What applications will be the least affected?

<comment><USER14> It's likely that web apps and servers will be least affected, I cannot imagine the performance on databases being good.

<comment><USER25> You're right, the Github page says as much:

> gVisor may provide poor performance for system call heavy workloads.

Incidentally, I find the description on Github much more interesting than the one on the Google Blog: [https://github.com/google/gvisor](https://github.com/google/gvisor)

</comment></comment></comment><comment><USER26> So with security in mind, when I run this:

        docker run --runtime=runsc hello-world

Is there any way to remove default runc docker runtime, or to make sure that it is actually running gVisior?

<comment><USER27> At the daemon level set "\--default-runtime"

</comment></comment><comment><USER28> Well that looks very nice.

For the security experts among us, would containers using root as their user be safe running on gVisor?

That would save a lot of pain because of some super annoying bugs like this:

[https://github.com/moby/moby/issues/6119](https://github.com/moby/moby/issues/6119)

[https://github.com/moby/moby/issues/5505](https://github.com/moby/moby/issues/5505)

<comment><USER29> If it's not safe then it wouldn't be a proper sandbox I'm the first place. The goal is to intercept all system calls and reimplement them in a lightweight kernel that talks with the host kernel only via a minimal 9p based protocol.

I.e. there is never a direct syscall being served by the host kernel on behalf of a process running inside the container.

From what I can read in their design docs, the user id running inside the container seems completely irrelevant.

</comment></comment><comment><USER30> Proponents of Illumos zones and FreeBSD jails claim that these solutions offer better security than Linux containers while maintaining the performance of running directly on a shared kernel. And now, both Illumos and FreeBSD have Linux emulation for x86-64. Has Google tried these solutions and found them wanting? Has anyone done research on whether Illumos zones or FreeBSD jails really provide better security than Linux containers?

<comment><USER31> > Has anyone done research on whether Illumos zones or FreeBSD jails really > provide better security than Linux containers?

This is an ever changing property of both systems, and a little bit subjective, so a study is both difficult and outdated as soon as it's done.

What we can do is look at the number of published vulnerabilities over a timeframe, and compare the overall system designs and development philosophies. I don't know of a comparison of the numbers of vulnerabilities, but for a bit of history and why I would personally trust zones over containers I previously wrote this comment.

[https://news.ycombinator.com/item?id=15179858](https://news.ycombinator.com/item?id=15179858)

<comment><USER32> Your comment really speaks to the different philosophy of Linux vs FreeBSD.

FreeBSD is very much a single system - the kernel and userland are designed and built together. Linux, on the other hand, is a kernel which has multiple different userlands made up of different pieces that distributions pick and choose. Ubuntu, for example, is quite different from OpenSUSE, which is quite different from CentOS, but they're all still Linux.

<comment><USER19> Linux only being a kernel versus BSD a OS makes it easier to leverage with Android, ChromeOS, etc. Google uses the Linux kernel everywhere. From CC to Google home and wifi, etc. But then also their cloud

</comment></comment></comment></comment><comment><USER33> Is it related with the sandbox of Google App Engine?

<comment><USER34> There are commonalities...

[https://github.com/GoogleCloudPlatform/appengine-java-vm- run...](https://github.com/GoogleCloudPlatform/appengine-java-vm- runtime/blob/master/testwebapp/src/main/java/com/google/apphosting/tests/usercode/testservlets/TestInetAddressServlet.java#L167)

<comment><USER33> The appengine-java-vm-runtime is for Flexible Environment. I want to know the sandbox of Standard Environment. Java 8 Runtime seems that it use new sandbox mechanism.

</comment></comment></comment><comment><USER35> I'm really curious to see actual performance benchmarks, and to understand where the majority of performance is lost.

</comment><comment><USER36> Is this the same actual codebase that is running in production on Google's core infrastructure? Or is it more like Kubernetes, that is to say: an distinct open reimplementation based on the experience of running the in-house system?

<comment><USER37> It's been used in production to sandbox specific workloads for years.

<comment><USER36> That makes this announcement even more exciting. Thanks.

</comment></comment></comment><comment><USER38> From a security perspective, I don't think there is a big difference between process isolation and kernel isolation. Oh, you think you made some really secure software? That's great, here is how I will use a side-channel to work around it.

If it weren't for the fact that the vanilla Linux kernel is the security equivalent of swiss cheese, process isolation should be good enough for basic "sandboxing". Add SELinux and some patches and it's good enough for the NSA.

So rather than waste time on piling on another layer of abstraction for what is, in practical terms, no significant security advantage, just make userland containers (don't run your container manager as root) and secure the OS and stop reinventing the wheel with added complexity.

<comment><USER39> "Add SELinux and some patches and it's good enough for the NSA."

Exactly. They didn't accept that, though, since the underlying TCB was too insecure. I'll elaborate for other readers.

SELinux was a prototype to add a tiny amount of functionality from "Trusted Operating Systems" to Linux to see if its security could be improved. Those assessing security at NSA rated the confidence of systems like that at C2/EAL4+. Here's what that means as described by Shapiro when Windows 2000 got the rating:

[https://www.rigacci.org/comp/freesoftware/trust- comp/win_eal...](https://www.rigacci.org/comp/freesoftware/trust- comp/win_eal4/NT-EAL4.html)

Highly-assured software they accept as close to secure is rated EAL6/7 (new criteria) or B3/A1 (older criteria). One of my favorite papers illustrating the kind of rigor that goes into that was VAX VMM Security Kernel for secure virtualization back in early 1990's. It was designed for A1/EAL7. Look at layering and Assurance sections for examples of techniques high-assurance security still uses today albeit with different tooling.

[http://research.cs.wisc.edu/areas/os/Qual/papers/vmm- securit...](http://research.cs.wisc.edu/areas/os/Qual/papers/vmm-security- kernel.pdf)

One of the newer ones at EAL6+ is INTEGRITY-178B whose page nicely illustrates the kinds of features and evidence packages they had to use to assure the separation kernel. There's more politics in the process these days, though, where they try to play down any weaknesses. The features and analyses are still good examples, though, of what would be in an openly-developed alternative.

[https://www.ghs.com/products/safety_critical/integrity- do-17...](https://www.ghs.com/products/safety_critical/integrity-do-178b.html)

SELinux and common virtualization solutions don't begin to compare in confidence that attackers will find minimal hacks. Instead, the endless complexity demanded by the features people add assures there will be plenty vulnerabilities to come even in things that used to be safe. That's the default of proprietary and FOSS. Stuff making sacrifices for maximum security is rare. SELinux isn't one of latter. Its predecessor, LOCK, was though. Compare and contrast them, too, esp on where UNIX functionality set and what/why of the modifications.

[https://www.acsac.org/2002/papers/classic- lock.pdf](https://www.acsac.org/2002/papers/classic-lock.pdf)

</comment></comment><comment><USER40> This sounds like it will be dramatically slower than a VM on most workloads.

<comment><USER41> Why do you think so? For compute (non syscall bound) it should be native speed (just like a VM). For syscall-heavy operations it will depend on the syscall and how it's implemented and the backend processing.

For example, if you call lots of syscalls that are fully implemented in gVisor (does not rely o an external backend/service for completing them) that happen to be implemented inefficiently in gVisor (because they aren't top priority right now/not a lot of users rely on them being fast) vs the same syscall being already optimized in Linux then obviously there will be a lot of difference. But if calling syscalls which need an external service (ex. network/storage) to complete the request, then depending on the latency of the external service the processing speed difference of gVisor vs guest Linux kernel may not matter.

It really depends on the workload, there is indeed potential that some workloads will be significantly slower with gVisor, all other things being equal, but it doesn't seem to me to be a general thing.

</comment></comment><comment><USER42> How is this different from Intel Clear Containers?

<comment><USER27> This implements system calls in user space, intercepting those calls via ptrace (though there is a KVM backend as well).

Honestly I don't see an advantage to this over a stricter seccomp policy, and most definitely slower.

<comment><USER27> I retract the statement that I don't see the advantage.

See [https://twitter.com/rauchg/status/991850924057350144](https://twitter.com/rauchg/status/991850924057350144) for why.

Basically run `mount` in a gvisor container and run `mount` in a runc container and see the major differences there. Just one example, but as you can see, linux mount namespaces tend to leak lots of mount information. _some_ of it could be cleaned up with additional unmounts after setting up the new root for the container, but knowing what to unmount is not so simple (plus it's just janky AF).

</comment></comment></comment><comment><USER43> > "Since gVisor is itself a user-space application, it will make some host > system calls to support its operation, but much like a VMM, it will not > allow the application to directly control the system calls it makes." > [[https://github.com/google/gvisor](https://github.com/google/gvisor)]

TLDR; This is a user-space process that hooks syscalls/ioctls made by your "containerised" applications.

(1) This is hardly a strong security model. Proper security cannot be guaranteed by simply hooking API calls in user-space alone.

(2) With this framework in mind, developers now need to worry about yet another layer of indirection. Assume <application> was tested to work on Ubuntu, that fact alone is not sufficient to assume it will keep running under gVisor.

(3) I would personally like to see more documentation/benchmarks regarding the performance impacts that come with using this.

(4) This is strongly coupled with internal Kernel implementations. It will not be easy to port and maintain this across different Kernels.

> "but much like a VMM, it will not allow the application to directly control > the system calls it makes."

From user-space? hold my beer.

<comment><USER13> > _(1) This is hardly a strong security model. Proper security cannot be > guaranteed by simply hooking API calls in user-space alone._

The thing you're talking about is not a security model, it is a (reliable) mechanism that can be used in the implementation of security models.

> _(2) With this framework in mind, developers now need to worry about yet > another layer of indirection. Assume <application> was tested to work on > Ubuntu, that fact alone is not sufficient to assume it will keep running > under gVisor._

This is true of existing container technologies. An application running under Ubuntu on bare hardware will potentially not run in an Ubuntu Docker image. You'll need to test it extensively.

> _(4) This is strongly coupled with internal Kernel implementations. It will > not be easy to port and maintain this across different Kernels._

I don't understand this—gVisor is a userspace application and is not itself tied to kernel implementations the way a kernel module would be. The interface gVisor exposes is the Linux syscall ABI, which is the thing Linux tries very hard to hold stable. There are multiple production reimplementations of this ABI (Windows Subsystem for Linux, FreeBSD's Linuxulator, Solaris's branded zones). You'll need to add new features if you want them, of course, but holding at a specific emulated kernel version is totally fine.

> _From user-space? hold my beer._

ptrace (with PTRACE_O_EXITKILL from kernel 3.8+) is designed to be reliable for this.

Also, if you don't trust it, just set everything to SECCOMP_RET_TRACE, which kills the process if there is no ptracer.

<comment><USER44> _Also, if you don 't trust it, just set everything to SECCOMP_RET_TRACE, which kills the process if there is no ptracer_

A small correction, it causes for the syscall not to be executed, and return with errno==ENOSYS

<comment><USER13> Oh, thanks. (It's still safe, because the inability to execute system calls basically translates into an inability to do anything the process was not previously authorized to do via... mmapped memory, and I think that's it.)

</comment></comment></comment></comment><comment><USER45> I wonder how this is similar or different to FreeBSD jail; which has existed for the past 13+ years.

[https://www.freebsd.org/cgi/man.cgi?query=jail&apropos=0&sek...](https://www.freebsd.org/cgi/man.cgi?query=jail&apropos=0&sektion=0&manpath=FreeBSD+6.0-RELEASE+and+Ports&format=html)

<comment><USER12> Very different. It's also very different to Solaris Zones. The design of Linux containers is namespace-based while Jails and Zones are (basically) ID-based.

In addition gVisor is basically a ptrace wrapper around your process that applies restrictions and other things on top of containers. I don't really understand what the benefit is over seccomp-bpf (which is slowly becoming as powerful as ptrace but without the overhead and without the security flaw of your sandbox rules being entirely in userspace without any protections like seccomp). They call it a kernel, likely because it is based on the idea of USL (User-Space Linux), but there's a reason that USL never took of as a virtualisation tool -- its entire security was predicated on ptrace to trick processes spawned in the "guest os" into not being able to see the host. In this configuration it looks like gVisor is using both namespaces and ptrace -- but then you have to worry about the massive overhead of ptrace (it affects every syscall and signal event involving the process, and requires four context switches and signal delivery to the tracing process in addition to the normal syscall costs).

gAdvisor appears to be working on a KVM shim, but I'm not quite sure how you can use KVM and still differentiate yourself from Kata Containers (the project that came from Clear Containers and HyperHQ). Seems like duplicated effort to me.

EDIT: I just re-read the article and it looks like they don't actually use containers at all. Unless I'm mistaken this means that they are not taking advantage of any of the sophisticated security primitives in the kernel that ordinary containers use, and thus have the same (bad) security model as UML.

<comment><USER46> I recommend reading the GitHub README[1].

> I don't really understand what the benefit is over seccomp-bpf

With seccomp-bpf you are filtering what syscalls can be made, but those syscall still happen in the host kernel. If that kernel syscall has a vulnerability it could allow exploitation of the host and other containers in a multi-tenancy environment. The gVisor kernel actually implements the syscalls, it doesn't just pass them on.

> Advisor appears to be working on a KVM shim, but I'm not quite sure how you > can use KVM and still differentiate yourself from Kata Containers

Kata Containers virtualize hardware and run a regular Linux kernel on the virtual hardware. gVisor doesn't virtualize hardware, it is a kernel running in userspace, implementing syscalls.

> I just re-read the article and it looks like they don't actually use > containers at all. Unless I'm mistaken this means that they are not taking > advantage of any of the sophisticated security primitives in the kernel that > ordinary containers use, and thus have the same (bad) security model as UML.

The gVisor kernel (Sentry) runs in an empty user namespace with seccomp filters applied.

[1] [https://github.com/google/gvisor](https://github.com/google/gvisor)

<comment><USER12> > With seccomp-bpf you are filtering what syscalls can be made, but those > syscall still happen in the host kernel.

I'm not sure what the distinction you're making is. By the same token, because PTRACE_SYSCALL/PTRACE_SYSEMU only signals the calling process _after_ the syscall boundary has been crossed, then ptrace also doesn't help with the problem you are describing (though I also don't really agree that it's a problem in the first place -- user-kernel context switches are not security vulnerabilities). In fact, the seccomp restrictions are applied _immediately_ after PTRACE_SYSCALL/PTRACE_SYSEMU -- there is only a few lines of code separating the two cases in the syscall entry path[1]. _And_ in the case of PTRACE_SYSEMU, seccomp rules are still executed even though the syscall is never going to be executed.

> gVisor doesn't virtualize hardware, it is a kernel running in userspace, > implementing syscalls.

I understand that, but that's the ptrace helper (which I spent the rest of my comment talking about). In the README (which I did read before commenting) they mention an experimental KVM driver, which is what my VM comments were referring to.

Is there an explanation somewhere about how gVisor uses KVM to virtualize syscalls? I'm not sure I understand how you could use KVM to do that. That's why I mentioned Kata, because it's the only point of reference I have for using KVM to "emulate syscalls" (though of course it emulates more than that).

> The gVisor kernel (Sentry) runs in an empty user namespace with seccomp > filters applied.

Good to know, but I didn't see that mentioned anywhere? If you're affiliated with the project it'd be great if you could add it somewhere in the README or the blog post.

[1]: [https://elixir.bootlin.com/linux/v4.16.6/source/arch/x86/ent...](https://elixir.bootlin.com/linux/v4.16.6/source/arch/x86/entry/common.c#L81)

<comment><USER29> I started by reading here [https://github.com/google/gvisor/blob/master/pkg/sentry/plat...](https://github.com/google/gvisor/blob/master/pkg/sentry/platform/kvm/kvm.go)

Basically the Sentry binary works as both the VMM and the guest kernel. It uses the KVM API to setup page an address space and installs fault handlers through which it regains control when the guest payload faults (on memory access or soft interrupts/sysenter).

What I couldn't find on a quick skin is how much of that logic works on which "side" of the wall, i.e. how much logic can the Sentry evaluate without crossing the VM boundary.

I can imagine this can depend quite a lot on Go runtime internals. How do you setup the environment inside the "guest" so that it can run the Go code?</comment></comment></comment></comment></comment>


Auto-Loan Delinquencies Spike to Q3 2009 Level, Despite Strong Labor Market - <AUTHOR> https://wolfstreet.com/2019/05/15/subprime-bites-serious-auto-loan-delinquencies-spike-to-q3-2009-level-despite-strongest-labor-market-in-years/ <comment><USER2> This is bad for lenders and delinquent borrowers, but I think the financial system as a whole is much more resilient than it was a decade ago, so we shouldn't have to worry about something like Lehman-brothers dragging down the economy when it collapses.

</comment><comment><USER3> I feel like the data here should have some way of corrections for both growth in driving population as well as prices of vehicles. Without that, it's difficult to tell if this absolute growth in number is of concern, or it's more like movie blockbuster numbers, which keep growing in absolute terms but don't necessarily indicate a higher percentage of people have seen that movie in its theater run.

</comment><comment><USER4> Could this be the next big sub-prime bubble?

The amount of people I see in the UK with two luxury cars (BMW, Audi, Merc) that are on hire-purchase or PCP is high.</comment>


Choosing the Right EC2 Instance Type for Your Application - <AUTHOR> http://aws.typepad.com/aws/2013/05/choosing-the-right-ec2-instance-type-for-your-application.html <comment><USER2> Having _just_ finished benchmarking a new project I'm writing on nearly all EC2 instance types I have to say nothing beats benchmarking.

Create a spreadsheet, write some benchmarking tools, make sure you aren't actually benchmarking another service the instance depends on (db, API, etc) and go to town. Vary # of request/sec, # of parallel requests, # of app workers/threads/etc.

Write down all your results and then compute amount of 'work' (reqs/sec, computations, db inserts/updates, etc) vs hourly or RI pricing. That should get you some good numbers on what instance type is most cost effective for your workload.

<comment><USER3> Or just the machine you landed on. EC2 hosts vary wildy in terms of performance.

<comment><USER4> Per CloudWatch stats, it varies for machine and region. We have a 6 machines array in three regions receiving round robin traffic from ELB's. It is network bound. However, the CPU graphs say otherwise. Here's the output of three machines in three regions: <http://i.imgur.com/nadGmDH.png> while their siblings follow the same trend. The working set resides in RAM. The disk and network follow the same path. These are instance store machines sharing as little as possible. Failing over a multi-AZ RDS for maintenance reasons did not change the graphs.

</comment></comment></comment><comment><USER5> This is the first time I've heard about AMI's - I was under the impression that Amazon just sold you the hardware and it was up to you to handle the rest.

If I wanted to buy a small instance to start which AMI should I choose to have a run of the mill Rails stack?

Also some AMI's have a cost? How does that work?

<comment><USER6> For a simple Rails app any of the Debian-based systems would suffice, and Ubuntu 12.04 LTS is particularly high-quality.

As for cost, there are licensing and support fees. By using such AMIs you are allocated support resources, eg: opening tickets, receiving support via personal QA assistance.

</comment></comment><comment><USER7> This is the first time I've seen that reddit case study. I'm sad that they didn't use the part where they interviewed me 3 years ago and actually got the history part right. :)

(no offense to Keith -- he wasn't there after all)

</comment><comment><USER8> I use this really great comparison table for all EC2 instance types: <http://www.ec2instances.info/>

Summarizes things pretty well.

<comment><USER9> Like so many such tools, it assumes you will only ever be using US East. :/

<comment><USER10> Check out <http://www.awsnow.info/>.

</comment></comment></comment><comment><USER11> Considering the fact that a ami can ( and does ) shutdown at any time, loosing everything you've got on disk, i've always been reluctant to use those for databases ( and ebs volumes mounting / unmounting while a vm properly relaunch seems too slow and cumbersome to me and not reliable). Am i right not to trust those for that task ?

<comment><USER12> AMIs definitely aren't for storing highly variable data. I use AMIs in two ways:

1) I create a base AMI for each group of my servers that have similar environments. For example, I may have a base image v1.3 for general wordpress sites, or v1.1 for rails + redis. By doing this, I greatly reduce the amount of manual setup when I want to load a new server, and I know that when my server is up, it has all the tools and configurations that I need in order to just start deploying my code. 2) I create nightly snapshots of all of my attached volumes and also create a backup AMI of all of my current servers. These are ONLY for recovering servers that are not changing minute-by-minute, or for easily rolling back if something terrible happens and I just need to start fresh.

You can use an Ec2 + an AMI + an EBS volume for whatever you'd like, including a database. If the server goes down, you will not lose a thing, since your EBS persists. You also don't have to manually mount/unmount - that's all taken care of for you automatically. There _have_ been some rare issues in the past with EBS volumes dying, so for critical data, I would definitely consider some sort of replication.</comment></comment>


Does Safely Ejecting from a USB Port Actually Do Anything? - <AUTHOR> http://gizmodo.com/does-safely-ejecting-from-a-usb-port-actually-do-anythi-1715969743

<comment><USER2> I usually know if I have any programs reading from or writing to my USB sticks. As a rule of thumb, I only unplug devices when no program is (or should be) using it. I never had any issues with that.

Although I sometimes had a terminal session open with the cwd on that device (or a GUI file explorer), but other than 'no such file or directory', I didn't ever run into any problems with this at all.</comment>


Richard Stallman is Not the Bad Guy - <AUTHOR> http://boycottnovell.com/2009/09/26/richard-stallman-smeared-for-truth/ <comment><USER2> I think reading about the early history of the MIT AI labs and the history of LISP machines really helps to put RMS in context. Before reading about how that all played out, I was one of the ones who respected RMS's broad goals, but decried his almost radical attitude.

I don't think like that any longer. Instead, I now see RMS as a sort of holocaust survivor warning against complacency when dealing with dictators. If RMS seems overly concerned with corporations co-opting free software, it's only because he's been there!

(P.S. Sorry for not providing links to the LISP machine history. <http://en.wikipedia.org/wiki/Lisp_machine> and <http://funcall.blogspot.com> are probably a good jumping-off points. The tl;dr of it is: MIT AI labs developed LISP, Symbolics took MIT's work and commercialized it without giving back, the MIT AI lab guys responded by going off and forming their own LISP machine company, and that left RMS all alone at MIT and hating commercial software)

</comment><comment><USER3> One big problem I have with Mono is that it seems terminally buggy. A Mono application I was thinking of getting involved with had untraceable memory leaks to it that seemed to doom an otherwise excellent app to second-rate- ness.

Further, the whole '.NET' architecture seems to be structurally so elaborate that any open source implementation would _have_ to be buggy and incomplete since no one person would have the time to really finish or even understand all of it.

So I think that even without the thread of patents, .NET is a bad thing for open source because it gives folks a continual impetus to go to the working, closed-source MS implementation.

<comment><USER4> So, then here is a question: If .NET is so big, the spec is unmanageable and so on, why even attempt this ?

There was a time when DEC shops were turning out projects between two and five times the speed of a comparable IBM shop. The advantage was that the defaults were sane and you could actually know the system. It was stable and a breeze to develop for.

By bringing 'mono' or something like it into the open source community we are attempting to match microsoft at its own game, which is imho completely stupid.

If open source is to succeed it should not attempt to copy the kind of architecture that you can only build and maintain with an army of programmers that will slog away at it simply because they get paid to do so.

</comment></comment><comment><USER5> Stallman isn't a bad guy but he's a zealot and like in every other aspect of life following a zealot generally isn't a good idea.

Don't get me wrong, I'm not against him speaking his mind or his supporters speaking theirs. The difference here is between "Mono and de Icaza are evil" and "I think Mono is the wrong approach and here's why"

Stallman always jumps to "people who disagree with me are evil" and that's why even his supporters are starting to wonder if he's doing more damage than good.

<comment><USER6> Read this and tell me whether it says "Mono and de Icaza are evil" or "I think Mono is the wrong approach and here's why":

 _Why free software shouldn't depend on Mono or C#_ by Richard Stallman

<http://www.fsf.org/news/dont-depend-on-mono>

Some quotes:

 _"This is not to say that implementing C# is a bad thing. Free C# implementations permit users to run their C# programs on free platforms, which is good."_

 _"The problem is not in the C# implementations, but rather in Tomboy and other applications written in C#. If we lose the use of C#, we will lose them too. That doesn't make them unethical, but it means that writing them and using them is taking a gratuitous risk.

We should systematically arrange to depend on the free C# implementations as little as possible."_

Also related, the next news article:

<http://www.fsf.org/news/2009-07-mscp-mono>

<comment><USER7> Read this and notice that rms calls de Icaza a traitor:

[http://www.osnews.com/story/22225/RMS_De_Icaza_Traitor_to_Fr...](http://www.osnews.com/story/22225/RMS_De_Icaza_Traitor_to_Free_Software_Community)

Looks more like the former (evil) to me.

<comment><USER6> Traitor doesn't mean "evil".

If you understand (not necessarily agree with) the reasons Stallman gives for being cautious about Mono/C# then you'd understand why someone who'd done so much for Free Software in the past, who is now driving Mono, could be described as _"basically a traitor to the Free Software community"_ i.e. someone who used to promote their ideals, but now threatens them.

It seems strange that Stallman, widely regarded as some kind of maniac, regularly gets grief for single word choices or off-hand comments. Would this be a discussion if he'd said "his actions no longer align with the best interests of our community"? If he's really that crazy why didn't he go on some venomous tirade and character assassination like some political shock- jock?

<comment><USER4> Stallman is a 'polarizing figure', it's the if you're not with us you're against us mentality that gets a lot of people up in arms all over the world.

I'm a great fan of free software. I think all software should be free, and in the long run I hope that that will be the case, but I doubt that that will actually happen.

There will always be niches so obscure or unpleasant that the only way to get someone to code that stuff is to pay them for their work.

And that's good, it certainly does not brand them as 'traitors', unless you want to consider open source software versus closed software as a war. I think that is not the right way to approach the problem.

I think it is more along the lines of two competing business models that duke it out in the market, with market share being the yard stick by which you can measure the success of both methods for software development.

So far, open source software has done pretty good, but calling ex open source contributors 'traitors' is actually helping closed source, and hurting open source.

<comment><USER6> There's a few misconceptions here, first, though kind of off-topic but you _can_ pay people to produce Free Software, lots of people do.

Two other misconceptions: He didn't call anyone a "traitor" for producing proprietary software, nor did he call anyone a "traitor" for stopping producing free software. That's kind of the point of using that specific word as it wouldn't apply in those circumstances though some people seem to be taking it as just a general insult.

He did use the word to describe someone who used to be a leading light of the Free Software movement. Remember de Icaza is the guy who started Gnome because the QT licence meant that KDE wasn't "free" enough, even though it was open source i.e. what most folks round here would call a Free Software zealot.

He's now, amongst other things that the FSF find dubious, advising a project specifically set up to create open source software which _isn't_ copyleft with the clearly stated aim that it can be used in proprietary software. This is promoting Open Source (though only as a subordinate of proprietary software) but not Free Software which, for some people, is a very important difference.

If you don't understand that you could dedicate your life to the business success of _open source_ and not impress Richard Stallman then you might want to read this:

[http://www.gnu.org/philosophy/open-source-misses-the- point.h...](http://www.gnu.org/philosophy/open-source-misses-the-point.html)

<comment><USER4> > but you can pay people to produce Free Software, lots of people do.

Yes, of course. But the subject here is not whether or not it is possible to pay people to develop free software, the subject is whether or not paying people to develop closed software or software under a different license than the GPL is somehow morally repugnant. I think it isn't and it shouldn't be, and any person that pretends to say this with high standing in the open source community is not helping open source but hurting it.

It is insulting to large numbers of programmers that do both.

If de Icaza has decided that you can't change microsoft from the outside but that he stands a better chance of effecting change from within - and he seems to be successful in that - then that's fine with me and it should be completely his freedom to do so without being spoken of in derogatory terms by RMS.

> This is promoting Open Source (though only as a subordinate of proprietary > software) but not Free Software which, for some people, is a very important > difference.

So what ? Let the marketplace decide which is better. If 'real' (as in gpl'd) open source is better then that should stand by itself. Personally I will not touch any of microsofts code with a 10 foot pole because I suspect a catch, but I'm not going around calling people names.

It's the worst way to handle this sort of thing. The best would be to judge the offering on its merits and if there ever is fall-out from the licensing issues to use that as the reason to brand the code 'unusable', not to resort to personal attacks.

It's petty, mean, childish and a whole bunch of other things beside, _and_ it hurts the open source movement as a whole.

This is not a war, and to resort to words like 'traitor' attempts to divide and hurts all of us.

</comment></comment></comment></comment></comment></comment></comment><comment><USER8> I'm sure he's not a bad person but he is clearly intolerant of other peoples opinions when they are in conflict with his own. He also has a bad habit of going overboard in the way he vilifies people and technologies sometimes.

</comment><comment><USER9> Regardless of RMS's position and community's reaction, that was just a poorly written, rambling paean to RMS.

I'll concede that there are some valid points to be fished out of that article and ruminated upon but the rampant amount of RMS adulation practically drowned it out.

(Full disclosure: I _do_ indeed think that this is paranoid "they're all making fun of me" tripe. But that has no bearing on the above.)

</comment><comment><USER10> I liked this article, especially for the last known picture of RMS when he was shaved, and (more seriously) Stallman's quote at the end. This sums it all up quite well in my opinion.

</comment><comment><USER11> As old as the net.

1) Some guy says something obnoxious.

2) Bystanders observe, "What a dick-move."

3) Guy complains that people are trying to censor him because they dare say that they disapprove of or disagree with him.

The main innovation in modern days is that for some folks, fanboys will take care of step 3 on behalf of the guy who's "under attack".

<comment><USER12> _Some guy says something obnoxious._

In this case we basically only have one source for the statement. I don't remember seeing _anyone_ else aside from the OSNews guy mentioning that statement.

Some other blogger tried to get a transcript of the Q&A that Stallman was giving but the FSF apparently doesn't keep transcripts of Q&As (they probably didn't record video :/)

<comment><USER11> Please.

If it's so dubious, why do the fanboys _not question_ that remark, but immediately leap to defend it and either try to redefine "traitor" as meaning something else or declare that they agree about the supposed "treason"?

Now, to be terribly fair, it's probably true that even if he didn't say it, everybody would be acting the same way. _Nobody_ , even his fans, really doubts _that_ he would say it. It's his style, and it's the exact sort of obnoxious remark his fanboys are used to defending and supporting.

EDIT: Ultimately, my complaint is about the fanboys. Someone made a dickmove. That someone is an icon to the fanboys, but he hasn't actually _done_ anything in years besides be an icon to them, so it's barely even a story before the fans get involved.

</comment></comment></comment><comment><USER13> Sometimes I want to retain my freedom not to have freedom in certain cases.

</comment><comment><USER14> If I remember correctly, Stallman also launched a war against Tcl some time ago. But I never really understood why he did it.

Any hint ?

<comment><USER15> <http://web.cecs.pdx.edu/~trent/gnu/tcl-not>

<comment><USER14> thanks tjr!

</comment></comment></comment><comment><USER16> RMS sees everything in Black and White. Hence he is very Sensitive.

</comment><comment><USER17> I looked at the link and couldn't understand a thing what exactly is RMS or author's problem again. The "article" is more of a collection of links and quotes joined together by some rant. Domain name is quite telling as well.

I have seen RMS in person, I have heard his inspirational speech (that was in the days we battled EU software patents directive), I respect him as an activist and as a Hacker. I also donate to FSF.

But I'm way too tired of all those internal OSS scuffles that RMS seems always to take part of.

<comment><USER18> Oh, not just the domain.

The actual path of the article is:

/2009/09/26/richard-stallman-smeared-for-truth/

Which makes me think he rethought his headline after originally writing it.

Again, reiterating my earlier statement... If you want to boycott Novell, start with digging out every piece of code they have touched directly or indirectly to Linux, starting with Gnome, Mono, and a whole ton of other stuff that will reduce Linux back to 1996-level functionality.

</comment></comment><comment><USER19> Sure he's not... He just has a tendency of taking things a wee tiny bit overboard, such as accusing the Bill and Melinda Gates Foundation of not giving a damn about helping the millions in Africa: [http://neosmart.net/blog/2008/richard-stallman-expert-in- the...](http://neosmart.net/blog/2008/richard-stallman-expert-in-the-art-of- fud/)

<comment><USER20> The icing on the cake: You are actually the same guy! Check out ComputerGuru's profile:

      about: Founder and director of NeoSmart Technologies (http://neosmart.net/)
      a non-profit software development and research organization.
      Specialization in high-performance webapps and OS kernel design.

The "art of fud", indeed.

<comment><USER11> So, you noted that the guy linked to his own blog?

That's some detective work.

<comment><USER20> Fair and funny.

<comment><USER11> Well, you're a good sport about it.</comment></comment></comment></comment></comment>


The Creative Monopoly (David Brooks) - <AUTHOR> http://www.nytimes.com/2012/04/24/opinion/brooks-the-creative-monopoly.html

<comment><AUTHOR> Pretty impressive reach for class notes. They were excellent though.

</comment><comment><USER2> But creativity would involve being some kind of artists, or scientists, or other things that modern neoliberal capitalism has no desire to support.</comment>


Redux Commander – Simple, declarative side effect bindings for Redux - <AUTHOR> https://github.com/colbydehart/redux-commander <comment><USER2> Correct me if I'm wrong, but wouldn't the example in the readme create a circular dependency?

<comment><AUTHOR> Where at?</comment></comment>


Key Findings from 37GB of Dot-Cm Typosquatting Scheme Logs - <AUTHOR> https://www.spectx.com/articles/key-findings-from-the-dot-cm-typosquatting-scheme-logs <comment><AUTHOR> Earlier this year Brian Krebs (KrebsOnSecurity) published an article about a large typosquatting scheme ([https://www.krebsonsecurity.com/2018/04/dot-cm- typosquatting...](https://www.krebsonsecurity.com/2018/04/dot-cm- typosquatting-sites-visited-12m-times-so-far-in-2018)). The story is based on 5 years of typosquatting operations' logs with quite many details on the scheme setup and persons behind it. However, when getting hold of these logs, we were intrigued to dig deeper into the figures to get a more comprehensive overview of the operation.</comment>


ChangeTip must die - <AUTHOR> http://hackingdistributed.com/2014/12/17/changetip-must-die/ <comment><USER2> This article fails on two basic points:

1\. The fees can be collected on transfers which occur between two members of the network without funds leaving the wallet. That's clearly the long-term goal of any network -- to grow to the point where everybody is on it.

2\. The stated goal of ChangeTip, as seen in their videos and materials, is to replace advertising and other indirect ways of monetizing content with a way to directly express support for creators.

Advertising is a model whereby content creators get vanishingly small amounts of money for views, while having to place their content next to third-party claims and pitches which they do not endorse. Historically this has been because the rates on payment processing have dwarfed the actual value that a single article or video view delivers to a single consumer, so asking for half a penny was not feasible. You can express that level of support with BTC however.

<comment><USER3> > 2\. The stated goal of ChangeTip, as seen in their videos and materials, is > to replace advertising and other indirect ways of monetizing content with a > way to directly express support for creators.

Then they will run into the same fundamental problem everyone else who has tried this did: the current Bitcoin implementation cannot handle the transaction volumes required to make this viable. This is the elephant in the room with decentralized currencies, and nobody's come up with a good solution yet.

Advertising rates for content will eventually stabilize. If the ad rates for content don't make it worth producing, people would stop producing it. Consumer content microtransactions simply aren't going to happen at any scale: it doesn't matter how low the cost is, any time you attach a marginal cost to an activity, you make them aware of the value proposition and the fact that there's a transaction happening. Mere awareness of a transaction is too much friction when you're talking about fractions of a cent. Counting half-pennies is just not worth my time (ironically, half a penny is in the same ballpark of current advertising rates).

<comment><USER4> > Mere awareness of a transaction is too much friction when you're talking > about fractions of a cent. Counting half-pennies is just not worth my time > (ironically, half a penny is in the same ballpark of current advertising > rates).

Couldn't this be solved with some kind of automation? It would take some standardization but what if clicking the ubiquitous "like" button on a piece of content sent a configurable amount of btc to the content creator?

<comment><USER5> It's what Flattr does - they've been around for much longer, and they have an embeddable button that you can use to tip pages.

</comment></comment></comment></comment><comment><USER6> Oh, it's that guy that hates everything.

ChangeTip is _cool_. It is a Bitcoin killer app. Like it or not, _giving_ tips, even to people who don't need them, is fun. And for every person who is tipped who may not want or need it, I've seen some kid who is quite happy as they realise they've just been gifted something worth a few dollars. And then their journey into Bitcoin begins as they try to figure out how to actually spend it.

<comment> emin-gun-sirer It's critical to not conflate Bitcoin with ChangeTip. The two are, in effect, separate currencies. One is decentralized and backed by the blockchain, the other is centralized and backed by a company.

A litmus test for centralized currencies is to ask the question "can they create wealth out of the thin air by manipulating a database entry?" The answer is affirmative for ChangeTip. To their credit, they maintain proof-of- reserves online, so while we do not know the amounts held by their users, we have an idea of how much they can pay out. I applaud the transparency they have shown.

I won't respond to the drive-by ad hominem.

<comment><USER6> > I won't respond to the drive-by ad hominem.

For the record, I appreciate your technical critiques! But you seem to take a perverse delight in being the critic.

<comment> emin-gun-sirer >For the record, I appreciate your technical critiques! But you seem to take a perverse delight in being the critic.

Ok, so you enjoy the technical content but disagree with the tone [1]? I can understand that. I genuinely feel sorry I don't have the time to build rapport. Many other bloggers regurgitate things we all agree on and make everyone feel warm and fuzzy inside. I figure that enough people already do this that I only need to chime in when the group-think is headed south.

[1] [https://commons.wikimedia.org/wiki/File:Graham's_Hierarchy_o...](https://commons.wikimedia.org/wiki/File:Graham's_Hierarchy_of_Disagreement.svg)

</comment></comment></comment></comment><comment><USER7> It's hard to argue against tip bots if you look at Dogecoin. Everything charitable, everything unique, everything that got them in the news was because they nailed tipping.

</comment><comment><USER8> Most tips I see are not "fractions of a penny" but rather the standard seems to be 1000 bits which is like 32 cents. I often see people tip a dollar or more.

Secondly, I can never understand why some people get so offended by someone giving them a small amount of money. When you go to the coffee shop to buy a $2.40 coffee and are given $0.60 in change are you insulted by the cashier for thinking you needed that 60 cents?

<comment><USER9> If you just got a $200 haircut would you tip $0.60?

Throwing $0.0001 at someone for their commit on a project is insulting. I'd rather have a unicode thumb or a +1.

</comment></comment><comment><USER10> > last month's craze in the Bitcoin world, a new service for tipping people > online, called ChangeTip.

It's not new. I's been around for a while.

<comment><USER11> They've suddenly grown a ton, and they recently raised a round.

EDIT: My point being, most people are just now hearing about them :)</comment></comment>


What CRM do you use for your startup/new business? - <AUTHOR> I started a communication/pr firm. I feel like we can benefit from a CRM tool that is lightweight but don't know where to start. We use gmail for email. <comment><USER2> Hello there, what I have been using is Airtable.

Not exactly a CRM but it's quite perfect. You could use the templates ([https://airtable.com/templates](https://airtable.com/templates)) or copy some of the Airtables made public: [https://airtable.com/universe](https://airtable.com/universe)

You can create forms as well, so it makes it easy to keep all the data in one place. (We use it for our contact form, feedback, bugs etc).

</comment><comment><USER3> Bitrix24 just went free.... I used in about a year ago.

</comment><comment><USER4> We use self-hosted SugarCRM.

<comment><USER3> This is not free anymore? Looks like EOL?

[https://community.sugarcrm.com/community/news/blog/2018/04/0...](https://community.sugarcrm.com/community/news/blog/2018/04/06/sugar- community-edition-open-source-project-ends)

<comment><USER4> Oh wow, I had not even heard about that. Damn. :-(</comment></comment></comment>


Falling in love will cost you two close friends - <AUTHOR> http://www.bbc.co.uk/news/science-environment-11321282

<comment><USER2> I wonder how many close friends does a startup cost too?

I am guessing If you are a founder, your time for social life will be very very limited, and a startup will cost 2 or more close friends.

One thing I found out, is that in general (for guys at least) is very easy to catch up and reconnect even after a long period of time of disconnect, as long as they are in the same stage lifes (eg. both being single, or not having kids, or both having a domestic life and kids, etc.). The disconnect becomes more permament when one enters a completely different stage of the life (having kids, will the major one), than the other friend.

<comment><USER3> I think this is one of the biggest perks of YC: I have _more_ friends because I did it, not fewer. I met some of my closest friends there (and even got introduced to my girlfriend through one of them).

Seems like a net gain to me ;-).

<comment><USER4> Even without something like YC it gives you to opportunity to connect with others doing startups, as long as your city has a startup/ coworking ecosystem. Probably met more people and had way more interesting conversations since getting involved.

</comment></comment></comment><comment><USER5> When I went to orientation when I entered college, they were very explicit not to start intimate relationships until a month or two in (after the first chem test). One reason was we would find out how hard college really was and could judge whether we could afford that commitment, but another reason they gave was that you wouldn't develop friendships with other people nearly as much, and you needed that broader support group to help you in college. Plus heaven forbid you break up, and find yourself with no social circle at all.

</comment><comment><USER6> Working as intended.

Of course, the fun part is when you break up after a long relationship where your social circles are very mixed. You run the risk of losing _all_ your friends. Which sucks.

<comment><USER7> I had a relationship in which I attempted to maintain separate social circles as much as possible for this very reason - we had overlapping friends, but I encouraged her to keep a separate group of "her friends" with whom I would not go hang out, mostly girls. She'd invite me frequently, and this became a major bone of contention... This was a contributing factor to the downfall of that relationship.

On the upside, _I_ didn't lose any friends. On the downside, she lost many.

<comment><USER8> Sounds like if you had just not tried this little experiment you'd still be with her and have double the friends.

<comment><USER7> I do not disagree.

<comment><USER9> This thread reads like an 'A Softer World' comic. :(

</comment></comment></comment></comment></comment><comment><USER10> Corollary: them falling in love will cost you a close friend, 40% of the time.

<comment><USER11> Not if you're the most awesome friend they have though... So if your friend starts falling in love, step up your friend game ASAP. Getting in good w/ the new significant other is probably also a good move.

</comment></comment><comment><USER12> Working on a startup will cost you the rest :)

And probably the love relationship too!

</comment><comment><USER13> This is a classic case of statistics being useless. Are we actually supposed to avoid falling in love because of this negative effect?

It's like knowing that 50% of marriages end up in divorce. True, and damn irrelevant when trying to decide if _you_ should propose or not. Individual marriages have either a 100% or 0% chance of success, and calculating the probability of those outcomes is not greatly informed by the "national average."

<comment><USER14> _It's like knowing that 50% of marriages end up in divorce. True, and damn irrelevant when trying to decide if you should propose or not. Individual marriages have either a 100% or 0% chance of success, and calculating the probability of those outcomes is not greatly informed by the "national average."_

Not true at all.

The subjective probability (which is all you have to make a decision from) is reflected by incomplete information, but is never 100%.

But even the objective probability (as far as such a concept is even coherent) isn't either 0 or 100. It's somewhere in between. Maybe under one set of circumstances the marriage will work out perfectly, but under another set of circumstances it won't. That's random. In one possible world the husband could arrive home at 5:12 and find his wife with another man, in another possible world he arrives home at 5:17 to find his wife freshly showered. That's random, or at least stochastic enough. In one possible world a stray gamma ray gives their child leukemia and the couple grow closer by going through the experience together, in another possible world no such thing happens, the husband goes back to work shortly after the child is born and slowly becomes alienated from his wife until divorce happens. Think you have a good enough marriage that adultery or alienation aren't going to become problems? Well throw in the multitude of circumstances which can cause people to change over time, and you'll find random factors there, too.

</comment></comment><comment><USER15> Close friends will be there for you even if you don't see them as frequently as before.

<comment><USER16> No true scotsman...

<comment><USER15> Sorry, I meant TRUE close friends. Done.

</comment></comment></comment><comment><USER17> I call bullshit. The very definition of close friends is that they are close, whether you spend less time with them or not. I've got friends across the country and we're very close even though we meet a only few times a year.

</comment><comment><USER18> the title of the post make me wonder what happens when you have only one close friend, you can't fall in love because you can't afford the exchange?

<comment><USER19> The content of the article gives me hope that starting a relationship will cause me to gain a close friend. :-D

<comment><USER20> What you have written brings a tear to my eye.</comment></comment></comment>


A Language Without Conditionals - <AUTHOR> http://www.hypirion.com/musings/without-conditionals <comment><USER2> The author is not complying with their own requirements:

> Pattern matching and polymorphism is not allowed

Using dynamic dispatch on different functions of type Int -> Int is, precisely, polymorphism. Doesn't look much like the OO polymorphism that some people are used to, but FP folks use this kind of functional polymorphism all the time.

That being said, the main premise of the article is quite valuable: yes, you can program with no conditionals. And i think it's quite useful to know that polymorphism can be used like that without suffering too much of an unfriendly syntax (see lmm's comment on Smalltalk: <http://news.ycombinator.com/item?id=5198419>).

Finally, although pattern matching can be seen as an overpowered if-statement, the relation can be also turned around: the if-statement is a special case of pattern matching. I won't say that pattern matching is not conditional statements, but i think it's also quite valuable to notice that you can use pattern matching as a new programming primitive instead of the if-statement. For example, the if-statement implemented in Haskell:

      if :: Bool -> a -> a -> a
      if True  x _ = x
      if False _ y = y

Relying only on pattern matching instead of conditional if-statements can make quite the difference on how one reasons about programming problems (e.g. Prolog and declarative programming in general).

</comment><comment><USER3> So you just end up using function pointers and arrays to fake polymorphism. If you have the requirement that every part of a function has to be evaluated, you just end up branching between function calls rather than eliminating branching. This is vaguely reminiscent of how some functional languages use tail-recursion instead of loops--they don't eliminate iteration, they just express it a different way.

Where I disagree with the author is in pointing out that there is no real difference between declaring "fib(1) -> 1" in a pattern matching function definition and inserting a pointer to a function that returns 1 into an array of function pointers. Pattern matching and subtype polymorphism can even still get all the gains the author is looking for--namely, being able to debug branching by inspecting the call stack. For that matter, so would pushing a dummy stack frame every time you come to a branch, or even building a separate branch stack.

<comment><USER4> This is sad. If only people would take the Expression Problem[1] more seriously and realise that there is a good time to use ifs/pattern matching and a good time to use polymorphism/function arguments

[1] <http://c2.com/cgi/wiki?ExpressionProblem>

<comment><USER5> I think CLOS doesn't suffer from the expression problem. Both alterations to the data model can be implemented as a "patch" to the program without editing any of the original code.

<comment><USER4> Gah, do you know if there is a better name for this "pattern matching vs polymorphism" duality then? I think its still important in its own right since multimethods and other solutions to the expression problem usually apply to a more global-ish scope, unlike pattern matching and functions since those are primitive constructs and naturally nested as deep as you want.

</comment></comment></comment></comment><comment><USER6> I love the Erlang example, I've been curious about Erlang and that's a powerful demonstration of conditional-free programming, contrary to the author's intent.

Sorry, but "n < 2" is a conditional, whether you're using an if statement, the "?" operator, or to reference an array of function pointers (at least from this old-school C/assembler programmer's perspective). Whereas that Erlang code looks elegantly conditional-free. Clearly branching will appear behind the scenes, but the Erlang code has no conditionals.

<comment><USER7> Pedantic: "n>2" is a comparison operator, and doesn't incur a branch. if statements, ternary operators, etc are conditionals. The effect in the article is the same though, without the potential for a mispredict penalty.

Whether that's actually faster is debatable though. If you're writing in C, you're probably concerned about performance, and the function pointer invocation is going to be a lot slower than a branch mispredict. A sufficiently complex array dereference will slow it down too, but I wouldn't be surprised if the compiler can turn simple cases like this into an equivalent switch/jumptable.

Thus conditional-free programming (as presented here, in C) is mostly academic. Debug tracing is an interesting application, but readability and performance both suffer.

If a language could internalize conditional-free constructs natively, however, it could be an interesting study.

<comment><USER8> `n > 2` could be a comparison operator in some architectures. For example, in dcpu16 (fictional, but I'm sure this was inspired from somewhere), `a = b > 2` would be written as:

        set A, 0
        ifg B, 2
          set A, 1

It conditionally evaluates a machine instruction, which is, indeed, branching.

</comment></comment></comment><comment><USER9>
        int res = (*fn[(n < 2)])(n);

As stated by others, "n < 2" is a conditional or comparison or whatever (let's just say it's cheating :P) let's call it "m".

So we choose our function pointer with:

        int res = (*fn[m])(n);

where

        uint32_t m = n < 2?1:0;

and let's assume n is non-negative...

        uint32_t top_bits = n & 0xFFFFFFFEu;
        uint32_t p = 0;
        for (int i = 0; i < 32; i++){
            p |= (top_bits & (1u << i)) >> i;
        }
        uint32_t m = 1 - p;

Edit:

You can do the for loop to check if any bits are set in logarithmic time. For general comparisons see [http://stackoverflow.com/questions/10096599/bitwise- operatio...](http://stackoverflow.com/questions/10096599/bitwise-operations- equivalent-of-greater-than-operator)

Oh and the "i < 32" doesn't count as you could just unroll it...

</comment><comment><USER10> If you are interested in ideas that can arise from putting some hard restrictions in the same vein, see "programming with nothing"[1]. SICP also explores this topic slightly in the exercise about Church numerals and thought experiments on how you could try to reimplement special forms using functions.

[1] <http://codon.com/programming-with-nothing>

</comment><comment><USER11> In this post, we don't use conditionals but instead constructs that compilers use to compile conditionals.

</comment><comment><USER12> Makes me think of the smalltalk approach to branching, where it's there, but just another method call (on a boolean) - rather than

        if(a > b) {...code...}

you do something like

        (a > b).ifTrue({...code...})

I think it's an approach more languages should use - it means there are fewer special cases in the syntax, and you can compose conditionals or use them in higher-order functions more easily.

</comment><comment><USER13> Reminds me of this approach to conditionals:

[https://en.wikipedia.org/wiki/SKI_combinator_calculus#Boolea...](https://en.wikipedia.org/wiki/SKI_combinator_calculus#Boolean_logic)

<comment><USER14> That was my first thought as well, replacing conditional evaluation with "choice."

</comment></comment><comment><USER15> Here's a real implementation of prettyprint without conditional jumps (this assumes signed right shifts are implemented as arithmetic shifts by your compiler, but everyone does that anyway):

      #include <stdio.h>
      #include <stdint.h>

      void prettyprint(int a, int b)
      {
          int lt_mask = (a-b) >> (sizeof(int) * 8 - 1);
          intptr_t lt = (intptr_t)"%d is < %d\n";
          intptr_t ge = (intptr_t)"%d is >= %d\n";
          char *text = (char*) (lt & lt_mask) + (ge & ~lt_mask);
          printf(text, a, b);
      }

      int main(int argc, char **argv)
      {
          prettyprint(atoi(argv[1]), atoi(argv[2]));
          return 0;
      }

The point is that the CPU doesn't have to guess what to execute next, so <https://en.wikipedia.org/wiki/Branch_misprediction> cannot happen.

And if what you're interested in is using the call stack to keep track of executed code, a more effective approach would be to convert the program to CPS, see <https://en.wikipedia.org/wiki/Continuation-passing_style> and <http://matt.might.net/articles/cps-conversion/> .

</comment><comment><USER16> I'm not sure I understand the purpose of this really. If it was just a thought experiment then cool, I guess.

<comment><USER17> I can't speak for anyone else, but I can think of one reason to do things like this. If I can use a minimal subset of language features and verify their correctness, and also verify the correctness of the ways in which I combine them, then it would follow that my entire program is much, much easier to prove correct.

This is perhaps more useful in lisps or Haskell but it's still cool to think about. And, hell, maybe someone implementing a language in C could do something like this for the debugging properties.

And while yes you could take this to the extreme and implement everything on top of SKI combinators, perhaps one wants to start a touch higher up than that. Anyway, maybe that's a useful answer?

<comment><USER16> Maybe :)

I guess I was just puzzled as to why the author felt that avoiding conditionals was a useful exercise in the first place. I realise that I'm probably wedded to a conditional-heavy way of thinking, I guess what threw me was that the author seemed to assume that eliminating conditionals stands as an aim on its own, regardless of minimising use of language features. At the same time he has a test in his array de-reference that seems to me to be effectively a conditional without using the explicit if(){} else{} construction.

TBH I would have thought verifying the implicit conditional and function- pointer jump was no easier than the explicit...

</comment></comment></comment><comment><USER18> I'd of like to seen the lambda calculus way of defining conditionals.

Let True = (λ x y => x) Let False = (λ x y => y)

Then to do an if, you just apply the conditional ((λ x y => x) 1 2) ---> 1 ((λ x y => y) 1 2) ---> 2

It's funny, really. Pure lambda calculus can feel a lot like a object oriented message passing style.

<comment><USER4> And Smalltalk does just that, by the way. Booleans have an `ifTrue: ifFalse:` method that receives two callbacks as parameters.

</comment></comment><comment><USER19> From the article: _"If the compiler/debugger is able to create this "evaluate every piece of line" format for functions (generating new ones when needed), then we can use the stack to check which branches we've taken — they're on the stack, after all!"_

No, they are not. Having called functions instead of evaluating conditional statements doesn't change anything to the state of the [non-stale part of the] stack at the time you reach the breakpoint.

To achieve this one would need to execute the code following the branching (and containing the breakpoint) as callback of any of the "conditional" functions, so the followed branch would indeed appear in the stack. But that would just be impractical as you would reach stack overflow extremely quickly - not to mention the hit on performances.

</comment><comment><USER20> I think it is more instructive to realize that certain (most?) problems rely on conditionals conceptually. You could then work around them by effectively implementing conditionals anew and spreading code over smaller functions, but the algorithm is still conditional in nature. I am also curious about the relation of conditionals to other constructs. Is the for loop disallowed because it checks for the end of the loop? But it could be implemented with a map over a range, which does no such check (assuming range is a primitive operation). In this way conditionals can be eliminated by recruiting a variety of possible constructs, but it all depends on the rules you're setting.

</comment><comment><USER21> This is a way prettyprint could have been written without branching:

        def prettyprint(a, b):
            fmt_string = {True:'%d is less than %d',False:'%d is higher than %d'}[a < b]
            return fmt_string % (a, b)

Or even (and this is cheating by using the int constructor):

        def prettyprint(a, b):
            fmt_string = '%d ' + ['is higher than', 'is less than'][int(a < b)] ' %d'
            return fmt_string % (a, b)

I think a good way to get acquainted with FP is to replace conditionals with lookup tables and lambda functions. But it is easy to overdo it, sometimes plain old if-statements are the most readable alternative.

<comment><USER22> True and False are 1 and 0 in Python too, so no int constructor needed. (Try 3 + True == 4)

<comment><USER23> True and False are not 1 and 0 in Python.

         >>> (1 is True) or (True is 1)
        False
        >>> (0 is False) or (False is 0)
        False

        >>> isinstance(0, bool) or isinstance(1, bool)
        False
        >>> isinstance(False, bool) and isinstance(True, bool)
        True

Indexing with boolean expressions is bad style to begin with, but if you are going to do it then a bool cast shows explicitly what you are trying to do.

<comment> peter-fogg You'll find that they are integers, though:

>>> isinstance(True, int)

True

>>> bool.__mro__

(<type 'bool'>, <type 'int'>, <type 'object'>)

Although they aren't literally the same object, 1 == True does evaluate to True.

<comment><USER23> Downvoting notwithstanding, the statement that 1 and 0 ARE True and False is flat false. It's not even kind of true: True is not 1 and False is not 0, the type of True and False is not int, and the established convention for comparing to these values is to use 'is' if you are not using the vaguer 'if cond' or 'if not cond'.

<comment><USER22> You are missing the point. The original code was making detours instead of using True as the list index (which you can do).

</comment></comment></comment></comment></comment></comment><comment><USER24> I can honestly say that the best thing to have come out of this article was the link to Bret Victors talk on inventing on pricple - <http://vimeo.com/36579366#t=1004>. Thank you.

<comment><USER25> Thanks for singling that out. The specific demos of interactive coding/visualization were cool, but the end where he really gets into the general topic of finding a guiding principle and using that to change the world - was very, very well worth the time to listen to.

</comment></comment><comment><USER26> That a _terrible_ C implementation.

It uses recursion, while a simple loop will suffice. Your fib(10000000000) will blow your RAM limit with growing stack (and will be slow) while implementation with loop would consume zero RAM and would run several times faster.

"And as if by magic, there's no need for conditionals" : also incorrect. You have a conditional in int res = ( _fn[(n < 2)])(n); specifically the (n < 2) part. All you have done after the hard work is moving conditional from one line to another.

"But we're still not sure of which branch we took." \- So why don't you put the breakpoint _before* the condition occurs, and step through it in the debugger??

</comment><comment><USER27> It's true that first class functions can remove the need for conditionals. Isn't this simply functional programming? He starts with an Erlang example then doesn't talk about FP. I must be missing something.

</comment><comment><USER28> The most useful thing is the coloring of the branching. Neat.

<comment><USER16> Have you seen gcov/lcov?

They're coverage tools rather than debuggers, but they can give you an html- browseable version of your source code coloured like that to show you which lines have been hit and how many times.

</comment></comment><comment><USER29> Thank you to the author for this article.

After reading it, there's a chance I will use some of the insight I've gained in my Conception project.

</comment><comment><USER30> Reminds me of Prolog

<comment><USER20> A clause in Prolog is a predicate that is true when its conditions are met, i.e., can be seen as a single conditional in itself. Furthermore, there is pattern matching (unification, even), which was declared cheating in the post. Fibonacci examples would use this, just as the Erlang example in the post. There are also if-then rules (the -> operator), which I find makes code clearer. The same trick described in the post could be implemented in Prolog I suppose.</comment></comment>


Scientists were close to a coronavirus vaccine years ago.Then the money dried up - <AUTHOR> https://www.nbcnews.com/health/health-care/scientists-were-close-coronavirus-vaccine-years-ago-then-money-dried-n1150091 <comment><USER2> Anyone know how they would have tested a SARS vaccine without any SARS cases to try and protect against, especially if antibody-dependent enhancement was a risk so just measuring a neutralizing antibody response might not give you the full picture?</comment>


Startups and H-1Bs - <AUTHOR> http://www.visalawyerblog.com/2008/12/h1b_visa_lawyer_about_new_comp.html

<comment><USER2> I thought from the first paragraph the article was going to talk about how H1-Bs can start their own company but really it was about how startups can hire H1-Bs. Well, I'm already in that situation so it's not of much use to me.

I think most H1-Bs think that they have to stick with the same company for years until their green cards get approved. Well, that's not really true. It didn't seem too risky to transfer my H1-B to my second company when I had to. And when I needed to move to my current company, I could even transfer my green card application because the AC21 rules state that if my I-485 has been in processed for 6 months (or something like that), I could transfer that too. What all this means is that I don't think H1-Bs are beholden to the companies they are currently at. They can switch if their new companies are willing to process the legal documents for them. And even if they can't pay the fees, it shouldn't amount to too much (~$1k).

<comment><USER3> I too am on an H1-B, and as far as I know, what you say is true. Once your I-485 has been approved for a period of 6 months or longer, you can move companies, though from what I hear, it raises a few questions when it comes for the INS to finally approve your petition.

</comment></comment><comment><USER4> I've heard of a couple of interesting things lately suggesting that despite the "downturn" there's been some positive changes in US immigration policy. Well, one substantive one,really. TN visas (huge for Canadians) are now good for 3 years instead of 1.

<comment><USER5> A longer TN visa is only nice if, in fact, your goal is _temporary_ work in the U.S. If you actually expect a green card some day, this change is a curse.

When your 2nd H-1B expires, you _must_ have started the green card process (or equivalent) to stay in the U.S. For most people, this is within 6 years of arriving in the U.S. But for TN visa holders, they stay in the U.S. for the duration of all their TN visas, and _add_ the roughly 6 years for H-1B after that. So now, this could be 10 years or more.

And the companies I've seen are in _no rush_ to start your green card any sooner than they have to, as it costs them money (and you may just quit).

What's worse, there is some risk and complexity in switching jobs while on a visa; technically there is a chance you could lose all rights to stay in the U.S. when you quit your job.

So most people will work for a single company for many, many years, just to get their green cards. If you aren't completely in love with your job, this would suck.

</comment></comment><comment><USER6> In my experience, startups simply cannot focus on the onerous paperwork and the twists and turns of the legal process. Sometimes circumstances change even from month to month; new interpretations of the law come down, and so on.

I've been through the visa merry-go-round three times. Once with a startup, once with an ultra-cool company growing at light speed, and once with a relatively uncool company that just has lots of experience with this. The third one wins hands down. This is one of the few advantages, in my opinion, to working for an established company.

</comment><comment><USER7> "loosing their ... jobs" ? Ouch.

</comment><comment><USER8> If you're doing really innovative things, look into an H3 visa (training) as well. They're cheaper for the employer, are issued more than one time of the year, and there isn't a lottery. There is more paperwork required, and you need to be doing something that the person can't learn in their native land. If you're doing something like game design, that'd be an easy one. There's other requirements, but check in with an immigration lawyer if you're an innovative company and hiring. I went through 80% of this process with an international hire.</comment>


Tales of App Store failure - <AUTHOR> http://deadpanic.com/failure

<comment><USER2> This all feels really familiar. The PC application market used to have the same "get rich quick" carnival vibe, as did dot-coms.

Eventually the craziness will die down, and only the more serious developers will stick around. There's bound to be some big consolidation. It's inevitable as the market matures, and we've seen this pattern over and over and over and over.

The real question though, is whether the pricing model and consumer expectations have been so degraded that the situation is unredeemable. At 70 cents per sale, the revenue isn't enough to support many players.

At current prices, the TAM of iPhone apps looks like around a billion dollars, with Apple skimming around 300 million right off the top. So, that leaves us with around $700 million in revenue per year.

That's enough to support a handful of small-to-midsize development shops, with nobody capturing more than a few million a year. However, the money certainly isn't enough to support multiple large software businesses. Adobe alone did $700 million in sales last _quarter_.

I don't think that this is a healthy state of affairs. Hopefully, things will improve after the shakeout.

<comment><USER3> The name of the game for the app store is shifting. People really need to start understanding marketing their apps beyond the app store.

There are tools out there that are being designed to help you as a developer do this, <http://appsto.re> , is one example. Apps need better metrics and feedback to improve sales.

</comment></comment><comment><USER4> > _Is The Party Over?_

No, but the gold rush might be. The iPhone is still a very viable platform for making money selling software. Mobile apps can be incredibly useful, and the App Store makes it easy for people to spend money.

It's hard to get noticed right now because there has been an absolute flood of apps. As people start to figure out that not all app developers get rich, that flood will slow to a more reasonable stream.

There does seem to be a market inefficiency in the huge disparity in sales between apps that are featured by Apple and apps that aren't. Picking up that slack in the market has to be an opportunity for a startup. If Apple isn't providing a good way for great apps to be found in the App Store, someone else should.

<comment><USER3> Check out <http://appsto.re/> as a free tool to promote iPhone apps. <http://blogs.appsto.re/> explains a bit more about the service.

<comment><USER5> The blog's at <http://blog.appsto.re/> .

</comment></comment></comment><comment><USER6> "At two updates a month, I can make $2000 a month - just enough to pay my rent and groceries, but no extra to cover the sunk production costs."

I don't quite follow that logic. The expectation seems to be to write one successful App store game and then live off the revenue happily forever after?

Seems to me that if the game cost, say 20000$ to make, and you make 2000$/month for 10 months, you have hit break even. During those months, you can create more App store games that will add to the revenue.

Instead of one game making 2000$/month, you could also have 10 games making 200$/month, and so on...

If it continues to sell and sell for years, ultimately it won't have been a failure. It was just a couple of months work but brings in money forever (I know, it probably won't sell forever, but that is another issue).

<comment><USER2> He's just running the numbers. In a _best case scenario_ , he can pay rent and food with cashflow, but there's no money left over to pay for extra development cost. Art assets, music, and such cost money.

Two updates a month is probably full-time work, so there isn't any time left over to build new apps, and no surplus capital either. Plus, that's assuming that each and every update spikes sales like the launch did.

According to the OP, daily sales are currently holding steady at around 11 sales a day. That's a little bit over $200 a month in persistent revenue. At that rate, it would take almost a decade for the game to break even, given a cost of $20,000 to develop.

Special note: This is for a game that cost only $20,000 to make. Building a solid AAA title can cost hundreds of thousands, or even millions of dollars.

</comment></comment><comment><USER7> It's interesting to see app makers rediscover the lessons learned by mobile gaming developers years ago. Handheld games have been a brutal business going back to the Gameboy. The keys to success seem to be: 1) licensed properties and 2) amortizing development costs by reusing the same technology over several titles. You need a lot of discipline to succeed.

</comment><comment><USER8> Well, for what it's worth, I just bought a copy. It doesn't look that amazing, but it might be fun.

Lesson: Putting stuff in the app store won't do anything for you unless you market it outside the app store. Not sure that's a very original lesson. Surely that's obvious?

</comment><comment><USER9> This just reinforces that normal application marketing can't be thrown under the bus. There may be a slight bump for 'being there', but you still need to find your customers and tell them about your app.

</comment><comment><USER10> Apple probably intentionally makes it seem like a gold mine. Probably why they keep the top apps list fresh and new, so that more people can share their stories of sudden fame and fortune. Then more people release their mediocre apps, sell a couple, and Apple makes more money.

</comment><comment><USER11> Zombie killing on the iPhone!? I bought a copy.</comment>


Best companies for CS / software research career? - <AUTHOR> I am from India. Here education system isn't so good. I have some genuine interest in cs (OS, PL etc..), & want to work at a well paying software R&D position after 4 years of B.E / B.Tech in CSE.
Here not many good companies come for college placements. I would like a career in R&D, and willing to do additional work for that as well. Also would ideally expect good salaries that translate to INR 60 lpa or so*..
What are companies that we can consider?
My preference is to systems level things but please feel free to put any suggestions because there are few students actually interested / talented in CS in India, but rote oriented education system is hindering them. <comment><USER2> Hi, Great that you are here even before you graduated.

Education system in India may not so good but not the worst, it may depend on the university, however you can always learn more outside of class or internet than in the classroom. It doesn't mean university graduation is not necessary, they will help you how to get started, I don't think this ks the right time to talk about good companies, bad companies as there are many international organisations resides here. First, you should master yourself at things that you are keen. What I would suggest you is keep an eye on technologies. Learn as much as you can. Master a programming language before you come out of the university, because that's how you can get into any company. Read more articles here, medium elsewhere. Be motivated. About your salary expectations, you may can't get 60LPA at your initial career, I don't think if it's even possible in abroad but I would suggest you gain skills first, hope it helps, good luck</comment>