Changing Lanes - <AUTHOR> https://99percentinvisible.org/article/changing-lanes-watch-median-movers-cone-collectors-rapidly-modify-roads/ <comment><USER2> One of those machines runs on the Auckland Harbour Bridge in New Zealand for peak traffic flows. [https://www.youtube.com/watch?v=976rvgbX6gw](https://www.youtube.com/watch?v=976rvgbX6gw)

It used to be just sign controller (the signs are still there) but people are bad at observation. Even now when they have a gradual lane closure people still get 'caught out'. There's about 2km notice of which lanes are open.

<comment><USER3> I don't know exactly why, but when I was a kid, seeing the lane-changing machine was always one of the highlights of going on a trip to Auckland.

</comment></comment><comment><USER4> I worked on a toll road construction project 10 years ago and the guys there subscribed to some sort of trade magazine. It had a barrier transfer machine on the cover that moved the concrete Jersey barriers across one lane as it drove along. Amazing stuff. The zipper format is even better.

<comment><USER5> I used to commute over one of the bridges between New Jersey and Philadelphia. The machine would be changing concrete barriers daily in the wee hours of the morning to allow one more lane for commuters going into the city, and later in the day for those returning home.

</comment></comment><comment><USER6> Pretty clever how they change the lanes with traffic(as opposed to against) so that their lane doesn't have a sudden, moving merge.

<comment><USER7> I wonder if this means they need two vehicles for changing more than one lane, or if they just drive it back like a normal car in between two lane-moving trips in the same direction.

<comment><USER8> The article said they have 2 vehicles that can do it quickly when they need to go from 4-2 to 2-4.

</comment></comment></comment><comment><USER9> Do the cone-handling machines strike anyone else as over-engineered?

<comment><USER10> Nope. Manual cone handling is incredibly dangerous. At best, someone has to hang out of the side of a vehicle; at worst, they're walking unprotected next to a live lane. This work is often carried out after dark and in poor weather conditions.

Automated cone handling machines are a massive advance in safety. From a purely cynical perspective, they usually pay for themselves in improved productivity and reduced insurance premiums.

<comment><USER11> You can't speak for everyone with that "nope". Many people can be indeed struck with the thought that these are over-engineered. Of course, your points are enough to convince most of us that the "over-engineered" thought is flat- out wrong, though. But we were still struck but this wrong thought initially.

<comment><USER11> Sorry to be pedantic here, surprised by the downvoting though.

> Do the cone-handling machines strike anyone else as over-engineered?

Taken literally, the answer is "yes" other people also get this wrong impression. So it's wrong to answer with "nope" just because you, as one person don't have the bad impression. Again, taken literally, the question isn't "are they over-engineered?" but "does anyone else get the impression I got?"

Consider: "anyone else grossed out by the idea of eating insects?" being answered with "Nope. They're fine, nutritious and delicious with nothing disgusting about it". I suppose the "nope" can mean "not me" but it literally is a claim that nobody else is grossed out.

I only clarify because I hope nobody missed that I wasn't disagreeing with the post I was replying to, I was just being pedantic. I should have marked it. There should be a pedantic-mark just like a sarcasm mark.

<comment><USER12> No, I don't think you're sorry to be pedantic. If you really were sorry, you would have made amends (e.g., deleting your comment) instead of doubling down.

Everyone understood just what you meant. (Every single person, literally.) Your pedantic observation was not new. People just thought it contributed nothing to the conversation. Around here you get downvoted for being off- topic, not just for being wrong.

There is a perfectly good pedantic-mark: it's called not replying in the first place.

<comment><USER11> By the time I noticed the downvoting and realized that I was a bit excessively pedantic, HN wouldn't let me edit or delete!! So I had no choice in making amends besides ignoring the whole thing or replying.

But I was indeed only partly sorry. Sometimes being pedantic is okay, what I meant was that I was sorry for being pedantic without explicitly acknowledging it.

To explain non-pedantically: I think it's interesting to note and acknowledge the tendency of people to have the wrong impression of over-engineered here. I think admitting that thought is appropriate, and I'd like to know how widespread it is. I also was certainly NOT clear that everyone was downvoting just because my comment was off-topic. I thought it might indeed be people misunderstanding me.

</comment></comment></comment></comment></comment></comment><comment><USER13> IN Germany there is a similar thing. Instead of having a barrier, they have lights to indicate which paths who can use and change them according to traffic.

<comment><USER14> > In Germany there is a similar thing. Instead of having a barrier, they have > lights to indicate which paths who can use and change them according to > traffic.

The article actually touches this:

> In theory, drivers could be directed to stay in particular lanes without > dividers, but in practice: there is a long history of head-on collisions on > the bridge.

I wouldn't be surprised if German drivers are more disciplined than the average. They sure are a lot better at keeping right on the freeway than us Danes.

<comment><USER15> > I wouldn't be surprised if German drivers are more disciplined than the > average. They sure are a lot better at keeping right on the freeway than us > Danes.

In Rio de Janeiro, there are lanes that change directions at certain times of day (e.g. after 5pm), and the only thing that indicates this is a static signboard. When I first saw this I was horrified, but I'm told that people are able to easily adapt to the traffic flow and that it somehow works. Also, Brazilian drivers are used to driving in much more chaos than in most western countries, so this doesn't really faze them.

Ironically I've noticed that the least resilient drivers are usually those from developed countries when the traffic patterns and signage are regular and predictable.

<comment><USER16> This sort of "chaotic-order" does indeed look impressive, and I've personally been mesmerised, just watching busy intersections in India or the Philippines.

But it's important to remember that despite all the skills these drivers exhibit every day, the number of traffic deaths under such circumstances is off the charts.

Meanwhile, those boring roads in western countries have gotten saver by a cool order of magnitude. See this chart: [https://commons.wikimedia.org/wiki/File:USA_annual_VMT_vs_de...](https://commons.wikimedia.org/wiki/File:USA_annual_VMT_vs_deaths_per_VMT.png#/media/File:USA_annual_VMT_vs_deaths_per_VMT.png)

It's actually quite a testament to the functioning of the American society over the last 50 years or so that they've been able to cut the number of traffic deaths by 90%, even though traffic has gotten a lot worse.

I quite like it as an example, because it didn't just require technological progress. It also included a political component (seatbelt laws, principles for save road construction etc), and cultural changes (drunk driving...).

<comment><USER15> I agree. It's a systems effect. I see this phenomenon manifest in other areas of life too.

Whenever you have a good system with average actors vs a bad system with some outstanding actors, the former usually wins in the long run. Good systems scale better and are more sustainable.

In the traffic case, the average skill of the drivers in Brazil is arguably higher than in America (they can maneuver into spots that Americans won't even try to, and drive at much shorter braking distances without getting into accidents), but the traffic fatality rate there is also a lot higher.

I've also noticed this in the corporate world. Big companies with good management but average employees tend to stick around for a long time (I won't name names, but a lot of people who work at big companies are decidedly mediocre).

Companies with bad management but better-than-average employees tend to get into a lot of trouble. (cf. Uber)

You want to have good systems and good actors, but when it is only possible to choose one, choosing the good system usually works well.

</comment></comment></comment></comment></comment><comment><USER17> 93 in the Boston area has had median movers in place for a long time. Back in 2009, they were 14 years old, and their value was being questioned at $1 million each to open and close an under-used HOV lane -

[http://archive.boston.com/news/local/massachusetts/articles/...](http://archive.boston.com/news/local/massachusetts/articles/2009/03/08/high_occupancy_low_usage/)

Not sure where the argument on this ended up, though I believe they are still in use.

</comment><comment><USER18> I like the contrast with the British cone collecting machine and how well that works in reality. If you watch the video of the TrafTech cone collecting machine to the very end you will see how it fails on the last cone with the machine jammed up.

</comment><comment><USER19> The only two places I've ever lived (Philadelphia are and San Francisco) both have this machine so I assumed it was extremely common. Only realized from these comments that it's not.

<comment><USER20> Chicago just has permanent "reversibles" (groups of a few lanes protected by barriers) down the middle of its expressways with remotely-operated signs and gates to control their direction. Must be a higher upfront cost, but less fuss than actually moving the entire barrier every time you want to switch directions.

</comment></comment><comment><USER21> Btw, 99pi is great podcast.

</comment><comment><USER22> Does increasing nr of files of the roads actally increase throughput noticeably? From my experience it's the intersections or traffic from exits that is the problem.

<comment><USER23> Often they're using these on bridges, which are narrower than the roads that feed into and out of them, and thus can act as bottlenecks. In that case, widening the direction that has more traffic can make a big difference.

</comment></comment><comment><USER24> My daily commute has me pass one of these most days (DC Roosevelt Bridge in the afternoons.) The amount of mass being moved right next to you can be unnerving.

</comment><comment><USER25> why not just have leds to indicate to change lane without a physical barrier?

<comment><USER26> Because this is very unreliable with human drivers.

</comment></comment><comment><USER27> The silly stuff we keep inventing to not confront the simple truth that single persons sitting in 2 ton metal boxes on highways leading to city centers is insane and will not scale.

<comment><USER28> Well, it has scaled pretty amazingly until now. It might quite possibly scale even further with the use of smaller self-driving vehicles.

<comment><USER27> Ah yes, the mythical self-driving car that solves Americas traffic problems despite being the exact size of a normal car (bigger, even).</comment></comment></comment>


Ask HN: Looking for JIRA alternative - <AUTHOR> I'm looking for JIRA alternative. I find JIRA overly complicated and need a simpler solution. <comment><USER2> Please check out Clubhouse ([https://clubhouse.io](https://clubhouse.io)). We've put a lot of time into putting together a tool that is thorough while also being simple to use. We welcome your feedback!

</comment><comment><USER3> Redmine and gitlab are usually where I reach when jira makes me sad. Redmine has more elaborate workflow possibilities, but gitlab is more light and simple. I actually use all 3 every day depending on what project I am working in.

</comment><comment><USER4> Love to hear your opinion on where JIRA is too complicated, and what size team you have. We'd appreciate your feedback. scott <at> atlassian.com

</comment><comment><USER5> You might check out Phabricator. It's got a similar approach to the but database without the bewildering sense that you have to configure EVERYTHING before you can do anything. Downsides are self-hosting and PHP.

</comment><comment><USER6> Trello or Wekan</comment>


Node.js security advisories - nodejs-news https://nodesecurity.io/advisories

<comment><AUTHOR> I like the idea of having a centralized repository of these advisories, but I need a better way of watching for changes for this to be effective. I was hoping that the Twitter feed would be that (I would just turn on SMS notification), but the Twitter feed is full of general low-value tweets like "Thanks @espreto for being our 1000th follower!". Perhaps a separate Twitter feed could be created (@nodesecurityadvisories?) that only tweets when new advisories are posted on the site?

<comment><USER2> I think the security checker from Sensio labs is the best approach to this. You can upload your composer file, which is really the list of packages you use and they'll check it against the known reports for various Symfony modules. It's got both the API and its own module with a CLI tool, so you can easily integrate it into monitoring. [https://security.sensiolabs.org/](https://security.sensiolabs.org/)

I really wish other projects had something like that (rubygems, pypi, etc.)

<comment><USER3> There actually does exist one for Ruby. Check out gemcanary [https://gemcanary.com/](https://gemcanary.com/)

<comment><USER4> and [https://gemnasium.com](https://gemnasium.com) (which supports npm as well)

</comment></comment></comment></comment><comment><USER5> Can't this be made simpler. Something like a cli call npm vulnerable This could take the package.json and list which of my packages need to be upgraded or downgraded to be secure as per the known issues database.

<comment><USER6> it could also be run automatically when cd-ing into a directory by overriding the default cd

        cd() {
          builtin cd $*
          if [ -f "package.json" ] ; then
            npm check-vulnerabilities
          fi
        }

I reckon you could also use this with david[0] to check if packages are up to date.

[0] [https://github.com/alanshaw/david](https://github.com/alanshaw/david)

<comment><USER5> I did not mean outdated. npm outdated can do that. See [https://npmjs.org/doc/cli/npm-outdated.html](https://npmjs.org/doc/cli/npm- outdated.html) I was looking insecure version of the same through a public repo.

</comment></comment></comment><comment> nodejs-news At least a RSS stream will be needed ?!

</comment><comment><USER7> That connect vulnerability is pretty significant. Makes me pay attention despite the fact there's no way to syndicate the feed.

</comment><comment><USER8> How does node.js have _security_ advisories? Isn't the fact that it's built on top of JavaScript kind of throw the idea of security out the window to start with? Shouldn't we start with _JavaScript security advisories_ first?

Honest question, have you ever seen a public Javascript security advisory?

<comment><USER9> >> Isn't the fact that it's built on top of JavaScript kind of throw the idea of security out the window to start with

No.

>> Shouldn't we start with JavaScript security advisories

Its a language, not a specific implementation of a language. Chromes javascript engine is what would have security vulnerabilities, no javascript itself.

This isn't security advisories for node itself, it is for node modules. the node security project is auditing all of the modules in npm for security issues, and posting about them there.

<comment><USER8> >> Its a language, not a specific implementation of a language.

It's not even that, it's a dialect of ECMAScript.</comment></comment></comment>


Ask HN: What tools do you use to monitor your servers? - <AUTHOR>

I recently ran into a problem where MySQL was running out of connections. For now I've upped the maximum_connections setting and I'm keeping a close eye on the server.
I'm sure there are lots of tools that could monitor this sort of thing for me, and alert me if any problems occur (or ideally before they occur).
I suspect there are also tools that would make it easier for me to diagnose the problem, and allow me to see what was happening on the server at the time.
So my question for HN is: What tools do you use to monitor your servers? <comment><USER2> Munin and Monit, mostly.

And it's a PITA to set up but Puppet is incredible, especially when combined with git. You can automatically redeploy your infrastructure pretty much at the drop of a hat.

</comment><comment><USER3> I made a tiny script on my server that get's all the numbers that I want (http connectios, mysql connections, cpu usage, etc) and put them on a txt file.

The only thing I got to do is check the file online whenever I want.

You could do this and also add email alerts easily.

</comment><comment><USER4> GetExceptional for rails apps & pingdom for everything else.

</comment><comment><USER5> Munin + some shell scripts that make sure the web server is rendering pages that look reasonable.

</comment><comment><USER6> Current employer uses WhatsUp. Previous employer used SiteScope.</comment>


To Pay for Health Care, Treat Aging - <AUTHOR> http://www.wired.com/wiredscience/2009/08/antiagingfunds/

<comment><USER2> The side effect of increasing longevity would be to make Social Security collapse that much faster.

<comment><USER3> This depends on whether you enable people to work longer. You could keep the pool of workers larger.

Ohh, and accelerating a social security collapse or reform is a good thing.</comment></comment>


Microsoft funds climate change denialists - <AUTHOR> http://www.guardian.co.uk/environment/2012/feb/15/leak-exposes-heartland-institute-climate

<comment><AUTHOR> You can listen to the reporting from the Skeptic's Guide to the Universe. In episode 345, at about ~20min into the podcast: [http://www.theskepticsguide.org/archive/podcastinfo.aspx?mid...](http://www.theskepticsguide.org/archive/podcastinfo.aspx?mid=1&pid=345)</comment>


NSA Brute-Force Keysearch Machine - <AUTHOR> https://www.schneier.com/blog/archives/2017/05/nsa_brute-force.html <comment><USER3> Schneier often has great insight but this blog post was pretty much the opposite of that. I _think_ I recall reading the original post from the guy who found that NYU info; and I def. read the Intercept piece.

Schneier's post quotes the original article and says unfortunately we don't know more. Literally over 50% of it is a quote from another article which he derides for it's lack of substance. Not sure what the point is.

<comment><USER4> For better or worse --- I think, often, it's for the worse ---- Schneier has an audience that wants his reaction on all the crypto news of the day. This is his reaction to the Intercept story. In this case, by the way, I think he's dead on.

We all need to resist the urge to judge pages linked from HN in the context of "worthy of the front page of Hacker News". Sometimes authors are writing explicitly to that kind of audience, but often, as in this case, they're not. In the context of the service Schneier is trying to provide, this is a solid and useful post.

</comment></comment><comment><USER5> I wonder how programmable it is... Assuming it's not programmable would be an argument not to use standard encryption algorithms.

<comment><USER6> ASICs are not reprogrammable. And they're expensive to build, but the NSA apparently has the resources to build new ones at semi-regular intervals, so I don't know if switching algorithms would really slow them down that much.

<comment><USER7> Considering that it takes 1-2 years to spin custom silicon I would say that it is a viable approach.

<comment><USER8> I think they could probably do significantly faster than that since these would presumably be a relatively low volume, single customer application, and wouldn't need the extensive testing cycle required for mass production ASICs. Which is to say it doesn't take a year from delivering a mask set to a fab to getting packaged parts.

</comment></comment></comment></comment><comment><USER9> > Whatever the details, this is exactly the sort of thing the NSA should be > spending their money. Breaking the cryptography used by other nations is > squarely in the NSA's mission.

I can't tell if it's sarcasm. (it's a serious question)

<comment><USER4> It's obviously not sarcasm.

</comment></comment><comment><USER10> "Unfortunately, the Intercept decided not to publish most of the document, so all of those people with "a Ph.D. in a related field" can't read and understand WindsorGreen's capabilities. What sorts of key lengths can the machine brute force? Is it optimized for symmetric or asymmetric cryptanalysis? Random brute force or dictionary attacks? We have no idea."

When I was reading the news article, I thought to myself, should they really be publishing classified information? The dumb leak was one thing, but publishing it more broadly is a whole different thing. If this was a government contract, I would assume these are classified documents (which they are). Obviously we tax payers should have the right to know, but logically, wouldn't that consider a crime just like leaking to Wiki Leaks?

<comment><USER11> > When I was reading the news article, I thought to myself, should they really > be publishing classified information?

are you not familiar with the intercept? it was initally created mainly to publish snowden documents

> wouldn't that consider a crime just like leaking to Wiki Leaks?

we have freedom of the press in america

<comment><USER10> Freedom of press does not mean you can just report on classified information without consequences. You can't just go into Google office and start leaking an NDA project. In this circumstances, sure, the document was available publicly. But since it has been hidden, wouldn't further distribution considered illegal?

<comment><USER12> _Freedom of press does not mean you can just report on classified information without consequences._

In the US, you effectively can, assuming you are actually the press and have the means of defending yourself. While there are laws on the books that supposedly limit this in various ways, they are generally not invoked - <USER2> the government typically _asks_ papers to delay publishing classified information they may have received.</comment></comment></comment></comment>


Ask HN: How do you decide which company is right for you? - <AUTHOR> When applying for a job, how do you decide which company is right for you? <comment><USER2> That's a loaded question that I can attempt to answer. The list below isn't by priority but it is the through process I go through.

1\. Compensation - Would you be comfortable with that salary and can you do the things you want to do with it (vacation, hobbies, etc.).

2\. Interest - Is the work that you will be doing at the company engaging to you? Are you interested in solving those problems? Would I be excited going into the office every day?

3\. People - While interviewing, did you enjoy the conversations you had with your potential coworkers? Do you think similarly but do you also challenge each other to be better versions of yourself?

4\. Size - Small companies don't have process and you'll have to wear many different hats. Large companies have more defined roles and your focus will be better planned by higher ups who set an overall strategy.

5\. Location - The best way I thought of this is the commute. Count the minutes (hours) it takes to get to your new company. Will you be "time poor" but "financially wealthy"? Would you be okay with that?

6\. Risk - Smaller companies naturally have more risk. I personally think we tend to over index on the risk (Prospect Theory) and forget about the lessons and professional development you learn at a start up.

7\. Regret - This one helped me out the most. I ask myself "Would I regret not working at this company with its people and product X years from now?"

<comment><USER3> Good list. I would add growth opportunities, too.

</comment></comment><comment><USER4> I don't until I spend at least 6 months in a company. Is this company right for me? Where is the company going moving forward? Is the project I'm working on that exciting? Are people I've been working with great co-workers? Do I see myself rising within that organisation based on what I know now?

Your question should be, what would attract you to apply for a specific company? My answer to that question by order of preference - role, location, product, compensation, work life balance (that one is also hard to guess at that stage of the process).

<comment><USER5> What do you do after those 6 months if you decide the company isn't right for you? Look elsewhere?

<comment><USER4> I would do the exact same thing as if I thought it would have been right for me prior to joining... then realized it wasn't a great fit 6 months later. I would indeed look elsewhere.

</comment></comment></comment><comment><USER6> First thing, apply for companies you like even if there is no fitting job posting. Then search for job postings read them carefully and if you like it, have a look at the company website and some rating sites for employers (like kununu). If everything is fine and you could imagine working there, apply for the job. Get to know the team and everything else at the interview. Afterwards, you know if you want this job or not.

</comment><comment><USER7> Basically, who pays the most, but at this point of my career I'm 100% mercenary and building capital for my post-career life.

</comment><comment><USER8> 1\. Will they let me work remotely?

2\. Compensation: Who will pay the most, provide the best health insurance, most vacation days, etc

</comment><comment><USER9> I'm not shy, I'll take whatever.

Otherwise it's a very personal choice involving dozens of trade-offs. You'll never really know until you try.

How do you decide which romantic partner is right for you?

</comment><comment><USER10> 1\. Compensation 2\. Type of Work 3\. Flexibility in working remotely from time to time

</comment><comment><USER11> Small Company(Startup) or Large Company(Facebook)?

<comment><USER12> For that you have to get an offer from the large company first

:(</comment></comment>


Show HN: I made a minimalistic Helpdesk for small businesses - <AUTHOR> https://helpninja.com <comment><AUTHOR> Creator here. As we mentioned in the website HelpNinja was created for small businesses that need a simple helpdesk system with affordable pricing. Most of the current helpdesk software available out in the market started as simple but then it gets bloated along the way to serve bigger customers or they add too many features and increase the cost. We felt there was a need for a help desk that stays simple and has the same affordable pricing focussed on small businesses that don't have too much funding.

Our promise HelpNinja will stay as a simple helpdesk and with the same $15/user/month pricing for life.</comment>


Ask HN: What do you want from a personal finance web app? - <AUTHOR>

I've seen a number of comments from dissatisfied users of personal finance web apps. Some people are unhappy with Mint, some want to use Mint but can't, and others seem unhappy with the personal finance web apps as a whole.<p>My question to you: what do you want to be able to do with your personal finance solution that you currently can't accomplish? <comment><USER2> I was using Buxfer for a while and liked it, but it's been shut down for a while. I'm trying to use Mint.com -- but there always seems to be some bug or connection issue with one or more of my accounts. The thing I liked about Buxfer was the auto-category rule system. Basically, you could categorize or tag any transactions based on a set of rules (i.e., Tag all transactions equal to $52.36 as "Student Loan Repayment").

</comment><comment><USER3> Full support for UK banks. I hate having to go to the bank site, download the data in Quicken format, go to the finance app site, upload the data, demungify the data then classify the spending. At that stage it's offering me little more than can be achieved with a spreadsheet.</comment>


(O'Reilly) Free Ebook - 48 Hours Only - <AUTHOR> http://oreilly.com/store/paypal.csp

<comment><USER2> Since the title doesn't say, this is:

PayPal API's Up and Running.

by Michael Balderas

</comment><comment><USER3> The certificates used in the checkout flow process as legitimate but nonetheless look hinky to me. From GoDaddy, "domain control verified"? I don't seem to recall this, from prior use (it's been a while) of oreilly.com .

ADDENDUM: It's probably legitimate, but it still bothers me -- as have some other aspects of my online experiences with O'Reilly. For a site that supports purchases, I'd expect a bit more authentication with respect to the certificate(s).</comment>


Christmas drunk design. - <AUTHOR> http://udoaa.com Just before christmas I had an email referencing DUSA document. Nobody knew what it mean. I replied: try checking UDOAA (Ultimate Dictionary Of All Acronyms). I had few spare hours and decided to make it real. It contains explanations for any* acronym you can think of. <comment><USER2> I guess it's user generated content. But at least it has to have a few (or many) correct acronyms to be initially useful, for example:

[http://udoaa.com/a/USA](http://udoaa.com/a/USA)

[http://udoaa.com/a/HTTP](http://udoaa.com/a/HTTP)

Also is it possible to flag an explanation?</comment>


Serious security flaw in OAuth, OpenID discovered - <AUTHOR> http://www.cnet.com/news/serious-security-flaw-in-oauth-and-openid-discovered/

<comment><USER2> via an answer on stack Stack Exchange (link below)

"This isn't a vulnerability of/in OAuth 2.0 at all. The issue has been wildly overblown and misstated by CNET and the original finder.

Here it is in a nutshell: If your web site (example.com) implements an open redirect endpoint - that is, implements a URL that will redirect the browser to any URL given in the URL parameters - AND your redirect copies URL parameters from the incoming URL to the outgoing redirect URL, then it is possible for third parties to exploit this artifact of your web site in a wide variety of nasty ways."

[http://security.stackexchange.com/questions/57143/can- someon...](http://security.stackexchange.com/questions/57143/can-someone- explain-the-covert-redirect-vulnerability-in-oauth-and-openid)</comment>


Intel CEO Announces Collaboration with Arduino - <AUTHOR> http://online.wsj.com/article/PR-CO-20131003-904584.html

<comment><USER2> One major item of note that the news stories haven't picked up on: the Galileo board itself and all of its documentation, schematics, BOM, etc, are all Open Source under CC-by-sa. See, for instance, the schematic at [https://communities.intel.com/docs/DOC-21822](https://communities.intel.com/docs/DOC-21822) , the BOM at [https://communities.intel.com/docs/DOC-21823](https://communities.intel.com/docs/DOC-21823) , and the datasheet at [https://communities.intel.com/docs/DOC-21831](https://communities.intel.com/docs/DOC-21831) .

<comment><USER3> That is pretty awesome, I have a much better feel for Galileo now than I did, its basically a PC with an Arduino Sheld Slot :-). I really liked the switchable 5v/3.3v I/O option.

So way back in the day folks would do unholy things to the parallel port in DOS to get this kind of feature :-) And of course thinking that I realized there is probably an interesting market if you put FreeDOS on this thing for the 'UX', which makes me wonder if Microsoft is going to wake up here at some point and come out with an OS for this stuff. (Not that it's needed, but like Intel they were a big deal in the early experimenters world and they are being made irrelevant in that space by Linux (like Intel is being threatened by ARM) and so I expect them to react at some point)

</comment></comment><comment><USER4> Here's the overview page for the Galileo board: [http://www.intel.com/support/galileo/index.htm](http://www.intel.com/support/galileo/index.htm)

It has links for downloads, specs, tutorials, etc. Looks like they won't be available for sale until November, though.

</comment><comment><USER5> Whatever happened to StrongARM? I can't find any references on the Wiki page paget the 1990's?

[http://en.wikipedia.org/wiki/StrongARM](http://en.wikipedia.org/wiki/StrongARM)

edit: fixed typo

<comment><USER6> They sold it to Marvell.

</comment></comment><comment><USER7> A good step forward. But will be tough to match the likes of Raspberry pi. Beaglebone Black will be hard to replace too. Given it's raw power and number of pins and interfaces

<comment><USER8> Yeah that's true, but it sounds like this Intel SoC could be made into something substantially more powerful than an Arduino. I can't tell if it's the Galileo (which is the Arduino compatible board) or the Quark SoC dev board, but there's mention of PCI express, 10/100 ethernet, USB, UART and RS232.

The PCI express means you could rig up your own video card. Yeah it'd probably be PCI express x1 (not x16 like you'd like) but that would still give you the ability to run a card which can drive more than one monitor. That is something the BBB or RPi can't do.

<comment><USER2> The news articles aren't the best source for technical specs; Galileo does indeed have all of those ports. From the FAQ ([http://www.intel.com/support/galileo/faq.htm](http://www.intel.com/support/galileo/faq.htm)): Intel® Galileo includes native Ethernet, SD, USB Host support, USB Client support, RS-232 serial port, and 10 pin JTAG ports. It also includes Arduino* shield connectors compliant with the Arduino* Uno R3 connector definition. Finally it includes a native mini-PCIe connector for the addition of Wi-Fi (for example).</comment></comment></comment>


Facebook's Second-Generation Modular Open Switch: Backpack - <AUTHOR> https://code.facebook.com/posts/864213503715814/introducing-backpack-our-second-generation-modular-open-switch/ <comment><USER2> Does anyone know what switching ASICs this uses? I'd guess [https://www.broadcom.com/products/Switching/Data- Center/BCM5...](https://www.broadcom.com/products/Switching/Data- Center/BCM56960-Series) but I don't see anything for sure.

Edit: [https://code.facebook.com/posts/203733993317833/opening- desi...](https://code.facebook.com/posts/203733993317833/opening-designs- for-6-pack-and-wedge-100/) says the Wedge 100 does use the Tomahawk, so it'll be the same in Backpack.

The hardware looks a lot more sensible than 6-pack. The orthogonal connectors to vertical fabric cards is pretty similar an Arista 7324X or Cisco N9K. Good front-to-back airflow that way.

<comment><USER3> They'll be contributing the design to Open Compute so, we'll find out soon if it's not already there.

<comment><USER4> The site is currently down, but [http://www.opencompute.org/wiki/Networking/SpecsAndDesigns#F...](http://www.opencompute.org/wiki/Networking/SpecsAndDesigns#Facebook_Backpack_-_128x100G)</comment></comment></comment>


Building a high performance SSD SAN, part 1 - <AUTHOR> http://smcleod.net/building-a-high-performance-ssd-san/ <comment><USER3> I wrote a longer version of this, but I will summarize as not all the commercial flash systems are x86's driving SSDs. Disclaimer: I don't work for IBM, and have no commercial interest in what i'm about to say.

I had the pleasure (a rare statement for me) of recently having access to a TMS/IBM flash system 840 for a year. Frankly, if the goal is shared network accessible performance, nothing you can build with PC's and SSDs will come close. The on the wire latency and bandwidth that even a single 2U (60TB) unit provides is fairly shocking. And that performance doesn't degrade over time, even under extreme load. The official performance numbers on the IBM site are actually conservative, which is unusual itself. The units are all custom (in a way that is a negative, cause they aren't cheap) and built like tanks. Although from an end user perspective they are very simplistic. AKA they provide a RAIDed volume(s) on the SAN and nothing else. Your on your own for replication and the like, although I think they have a canned solution for that now.

Bottom line, they cost a mint, and are built like old school over engineered IBM hardware. But you won't be kicking yourself a few months down the line as you baby your custom storage solution. Normally i'm the guy building stuff like this, but sometimes I would rather just sleep at night than get called because the garbage collector kicked in on a SSD and it dropped out of the RAID in the middle of a big load. Plus, being IBM, you can probably get a unit with a POC agreement, just to see how it compares.

<comment><USER4> > you won't be kicking yourself a few months down the line as you baby your > custom storage solution. Normally i'm the guy building stuff like this, but > sometimes I would rather just sleep at night...

"Even Southwest doesn't build their own airplanes." I have this argument with myself all the time. If you don't have an IT pro who works on storage every day, then buy something from someone who does work on storage every day. Their time is worth the price. Your time is worth it too.

<comment><USER5> I've taken this from where I replied to a comment on my blog:

Support

4 hour on site response offered from vendors is not good enough for us and to improve on that is expensive. With using more standard components we are able to be on site at either our primary or secondary datacenter within 30 minutes with spare parts in hand if required.

Choosing one vendor as an example, the support we've received from HP has been atrocious - they've caused more outages than they've be able to fix. The engineers they send to smaller organisations are generally relatively incompetent and they have certainly shown that they don't care about your uptime.

Proprietary storage systems offered by HP, DELL and EMC are not only expensive to purchase and license but they're very time consuming to manage as they're essentially a 'snowflake' in your infrastructure. It's hard to make them integrate with modern automation tools such as Puppet and CI requirements and they all use their own management tools that are specific to the vendor or range of product - usually this involves having a Windows VM running Java or some equally frustrating technology to manage the system. Performing updates on proprietary systems can often be painful as hardware vendors generally are not very good at designing software.

It's very hard to outsource quality and it comes at a large cost.

<comment><USER3> You have hit the nail on the head for why most "enterprise" gear is basically overpriced junk. That doesn't mean there isn't quality hardware out there, just that you have to be more selective. AKA do your own research and don't be dazed by the feature lists. Some of those features shouldn't actually be used.

I personally tend to like the KISS arrays that don't have dedupe/replication/etc built in, and are web manageable. The extra bonus is that there are a metric boatload of tier 2 array vendors (imation's nexan for example) that provide rock solid hardware for a small fraction of the prices of EMC/etc. Its quite possible to get native capacity for less than a company like EMC charges for deduped capacity (aka 100TB from a tier two company can cost less than the 10TB deduped to 100TB from EMC). Raw RAID is pretty simple/understood in comparison to deduped solutions, and I think that has a significant affect on reliability. AKA more features, more latent bugs...

Finally, get a bunch of demo units, and if the configuration UI is a mess of esoteric proprietary command line junk, or it is only configurable with a 32-bit java app that won't run on a 64-bit windows (yah I've seen that) then send the unit back. Be clear about why it won't work for you. The only way to convince these companies to behave is to show them lost sales.

</comment></comment></comment></comment><comment><USER5> I'm the author (Sam Mcleod) of this post and just saw this was posted on HN.

I'm quite a bit further down the track now and should have a much better write up to post in the next week or so time providing.

I can say that I'm hitting over 1,000,000 IOP/s on 4k random reads and around 850,000 IOP/s random 4k writes per 1U unit without cutting any corners with data safety.

What I haven't finished yet is the cross-unit replication tuning and the load balancing / multipathing.

So far everything has gone to plan and is progressing well as a serious replacement for our 'traditional' storage.

Regardless, there's still quite a lot of testing to be done and once I have more of that completely I'll post an update with some serious numbers and observations.

<comment><USER6> _cross-unit replication tuning and the load balancing / multipathing._

That's going to be interesting. At those speeds (1.5GB/s, 850k IOPS) you must bump[1] into all kinds of DRBD bottlenecks?

Also I'm very curious about your approach to redundancy/multipath. Dual- primary or failover?

[1] [http://blog.gmane.org/gmane.comp.linux.drbd/page=41](http://blog.gmane.org/gmane.comp.linux.drbd/page=41)

<comment><USER5> I have no illusions that I'll be able to maintain such performance with DRBD replicating and iSCSI overheads.

My current feeling on load balancing is to keep it simple, have half the clients treat node A as their active storage and the other half using node B. If node A becomes unavailable failover will occur and node B will serve all clients.

As far as multipathing goes - my approach is that I honestly have no idea. That's something that's going to be learnt along the way and I'm in uncertain if it'll make it into the final build or not.

Edit: I can't get that link to load on my connection at present but I've bookmarked to look at tomorrow. If you have any experience / advice I'm always very open to assistance!

<comment><USER7> I was quite amused to see this posted as we just built nearly the exact same thing about 6 months ago (minus the NVMe drives which weren't available). We are using ZFSonLinux on top of DRBD instead of mdmadm, which has been surprisingly successful.

The biggest frustration that we met was using LACP in trying to get a better data rate out of DRBD. Regardless of the LACP mode, we were not able to get DRBD to scale to full bandwidth (20gbps) and had to settle for using it for redundancy only.

I imagine with your setup (read: much faster peak write capability), you might actually be able to bottleneck DRBD pretty well over a single 10GBE pipe if you were writing at peak capacity. I'll be interested to see if you happen upon a work-around.

Load balancing as you've suggested is an intriguing compromise. Have you tried doing a two-way heartbeat setup where each both boxes have their own active IP and can fail over to each other?

<comment><USER8> I wonder if the lack of help from LACP was because DRBD is using only 1 TCP session, which would only get hashed to one or the other member link?

<comment><USER9> Might be a case where MPTCP ([http://www.multipath- tcp.org/](http://www.multipath-tcp.org/)) would help with aggregating multiple links.

<comment><USER5> Correct me if I'm wrong but I'm not sure MPTCP would help as LACP is generally SRC/DST MAC based and shares a uses a single IP?

<comment><USER9> You are right in that LACP bonding methods cannot increase the throughput of a single flow to gt any single link in the group (the balancing method can utilise src/dst MAC, IP and sometime L4 ports).

MPTCP establishes multiple subflows across individual IP paths and can load balance or failover across all subflows. Applications do not need to be rewritten to take advantage of it. I'm not sure if that includes kernel modules like DRBD though. I suppose someone needs to find out :)

<comment><USER5> I could have a play and report back if I get time?

</comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER10> I understand his decision to skip the HW RAID controller (I like mdadm too). But a BBU is definitely critical to this op. NVMe has so many more queues that on a busy box it's going to hold way too much uncommitted data and metadata. Now the only other reasonable option is a UPS but it adds significant RUs/cost to the setup.

<comment><AUTHOR> I am no expert, but are you sure that uncommitted data on the ssd is an issue?

The Intel DC P3600 has a built in capacitor that should give it econoff backup power to commit the data. The SanDisk Extreme Pro disks don't have volatile cache, but instead uses SLC NAND flash for cashing, that will survive a power loss.

There is of course still the issue that data send to the server and stored in main memory will be lost if you loses power, but a HW RAID controller with battery backup would not have prevented that (but an UPS of course might).

<comment><USER11> It would definitely prevent an uncommitted data problem if fsync or O_DIRECT were used (which should always be used for critical writes).

UPSes defend against power outages, but they're only one rung on the data- integrity ladder. Controller BBUs, on the other hand, protect against both power outages AND kernel panics.

<comment><USER5> Indeed we have fsync enabled on our database servers (PostgreSQL)

<comment><USER5> (And just wanted to point out that that is only one part of the equation)

</comment></comment></comment></comment></comment><comment><USER5> It would be typical that this was posted just before I went to sleep last night!

I've been flooded with messages, comments and feedback overnight and am slowly catching up on most of them.

I wanted to say one thing: My blog post that was linked here was never intended to be much more than a brain dump at the start of a journey. It contains little-to-no useful information other than the idea itself and it doesn't have any technical information or nearly enough background as to why I'm exploring this option or why I think there is a valid use case for it.

Give me a week or two and I'll have an updated post with a proper background story and experience with traditional solutions, my observations so far, some real technical content and of course some serious numbers.

Thank you so much to all the people that have contacted me both from HN and directly to offered insight into their experiences.

</comment><comment><USER12> What is the reason to go with Raid1 for the intel SSDs? My guess would be that the rate of Raid1-catchable failures of these drives is not considerably higher than the rate of, say mainboard failures or other failures that render the whole unit out of operation.

<comment><USER5> The only reason is to protect against per-device failures - the technology is new and while it's meant to have astounding resiliency and a long lifetime - <USER2> don't want to take that chance. Down the track when they have proved themselves to us I'll certainly be reconsidering this however.

</comment></comment><comment><USER13> I'm always interested in the outcomes of these types of experiments.

One thing that I find interesting is no mention of what network card you are using? or switch setup, or ip config. I seem to remember in the dim and distant past that letting the storage layer handle the paths instead of LACP (which on some switches are active-passive) was better/faster/easier. (that could be bollocks though.)

I used to work in VFX where performance and cost must be balanced. For the storage lumps we had a 1u dell with the fastest 10 core v3 processor in it, 384 gigs of ram (ram is a cheap and fast cache) tied to a dell 3060 (60 4tb disks in a 4u case, with up to 4 SAS connections out(well many other options it does iscsi too))

These topped out at about 2gigabytes/second (or about 1.3gigabytes with 100 concurrent fios from NFS clients). but there are 30+ of them so the aggregate was enough to dowse half the render farm in iops.

A couple of things that stuck out for me: o 24/7 support contracts are amazing. o auto phone home disk replacements are also life savers o multipath iscsi can be painful unless you have decent switching (with ospf) and OS support o in short distances, SAS > FC >> iscsi for block storage. pretty much plug and play (multipath is easy too). o Replication needs a different path separate from the client o melenox or intel nics are the only 10gig cards worth paying for. (the only thing going for broadcom is that they are supported out of the box by vmware) o File systems always fail o for random IO; RAM > SSD by a massive factor. especially if your active dataset is less than ram cache. o drdb will be as slow as your slowest link in the network. o ethernet packet size really matters. (and depends on your workload) o synthetic benchmarks are the chocolate teapots of the storage world. o paying for decent support saved the (me and by extension the company(s)) at least twice.

Yes, the dell/HP/whitebox route is more expensive in capital outlay. However you can if you so wish go the white box route. The dell raid enclosure is a rebadged netapp/lsi/enginio box. dothill do a similar one.

The important thing to note though is the opex & RnD is far, far cheaper with prebuilt systems. With a click of a button you get replication. If you are using VMware (I'm sure KVM has a similar system) it can do it as well. The performance is predicatble, and the configuration and tuning has been done more or less for you (excluding the raid layout, FS tuning and network setup. but then you're a sysadmin who knows how to do all that right?)

There is nothing worse than having to debug a storage system so unusual or highly configured that googling won't help. You feel terribly alone. Even more if you don't have decent backups.

If you don't have those expertise, it'll cost you either time, or budget for a storage guy. (so just do some testing and buy the fastest prebuilt system for your budget.) For a previous place, I tested 7 different systems to get the best fit. (that included home rolled) A lot of the time was modelling the sotrage workload, and devising tests that would proxy that kind of load on the test systems.

END_OF_RAMBLE

<comment><USER5> I actually have to shoot off but wanted to say that I enjoyed your comment and I'll have a chance to reply tomorrow morning - this post of mine was sort of a quick brain dump and massively lacking in almost any useful detail other than the idea itself. Anyway, as I said I'll reply tomorrow and hopefully shed some light on where I'm coming from and get your thoughts on that.

</comment></comment><comment><USER14> Enterprise storage systems made more sense back in the spinning disk era when the need to minimize latency caused by physical motion was acute. They're definitely struggling now to produce products that really add value to SSDs.

<comment><USER13> for Direct attached storage, possibly.

But its simply not the case to say they are struggling. IBM yes.

Netapp and EMC are still growing, just.

Contrary to popular belief, spinning disks are here for the next few years at least.

Especially when you compare disk performance with EBS "SSD" performance.

128gigs of "SSD" EBS storage gives you ~380 iops. The same performance as two 15k disks. We are very much in the era of spinning disk performance if Amazon can charge a premium for that kind of storage.

<comment><USER15> What's the derivative of that growth look like, though? It could be that they just have enough customers who are either locked-in or on the back-half of the adoption curve, allowing them to limp in with some growth for a few more years before it's over.

Amazon charges a premium for convenience and for the fact that there's 0-startup cost to get going with them. Why would someone every shell out the money for an enterprise 15k disk when they can buy an SSD instead?

<comment><USER16> The 15k HDDs will likely be replaced by SSDs, the 7200 ones are likely to stay for a long while yet. Their capacity is yet unmatched, the SSDs are trying to catch up with higher densities but currently the HDDs are ahead of them on the curve of size and definitely ahead on the cost per Gb.

I just recently switched my laptop to an SSD and the change is amazing but I'm not going to replace even the 1TB HDDs on my nas with equivalently sized SSDs. Both from a needs view and from a cost view.

</comment></comment></comment></comment><comment><USER17> _if you've got lots of money and you don't care about how you spend it or translating those savings onto your customers_

This is a baseless, prejudiced claim, contrasting buying with some idealized scenario where your in-house crew can only possibly build better solutions cheaper. That there are no other outcomes.

But they might also cost far _more_ in manpower costs than any premium. They might give you an unreliable solution that costs you your entire business. Such an effort might distract from the core competencies of the organization. Operating that storage might end up dwarfing the up-front cost (it's easy to hire admins knowledgeable of EMC. Quite a different matter when it's your own home-brew solution).

I understand the draw, but the "all upside" claim undermines the entire piece. There are enormous downsides, not least the reliability of your data. Companies like EMC and Nimble -- despite "great" editorial quotes added by some random person on Wikipedia -- base their entire existence on reliably serving your data, and things like multipathing and replication are the absolute minimum cost of entry in the market. Now add automatic tiering, thin provisioning, disk-deduplication and streaming hardware compression, etc, and the value starts to become evident.

EDIT: The moderation through this is an abomination. HN shouldn't be overly critical, but nor should it pander patronizingly to some tripe because the author happened by.

<comment><USER13> EMC _are_ expensive and nimble are ok for light VM performance.

However they provide a service. As the OP says its a bit broad to claim that they are a pointless cost. Having dealt with both, I can tell you that its very rare that own brand storage is cheaper in the long term. Unless: o you run at significant scale o have enough data to warrant a team of skill storage admins

bear in mind that decent storage admins cost the same as a medium sized array, per year, per person. Opex can quickly over take capex.

<comment><USER5> Actually we've found quite the opposite, because proprietary vendor management tools are generally hard to automate and integrate with existing frameworks such as puppet - the time it takes to administer them is far greater than any of our more standard systems. I just replied to a similar observation from someone else here: [http://smcleod.net/building-a-high-performance-ssd- san/#comm...](http://smcleod.net/building-a-high-performance-ssd- san/#comment-1949813997)</comment></comment></comment>


Power and the Internet (Schneier on Security) - <AUTHOR> https://www.schneier.com/blog/archives/2013/01/power_and_the_i.html <comment><USER2> This is worth talking about, but this post is a description of the problem and nothing more.

Where do we go from here?

Just "get involved in protecting/fixing the internet", generally?

At the moment my involvement in practice seems to be mostly "sign e-petitions here and there" and "occasionally read articles about how it's important that we not let corporate interests, governments, etc. take over control of the net".

It does feel a bit fake; but I'm not sure what else to do (and I admittedly don't have vast reserves of spare time).</comment>


Large Scale Deep Neural Net visualizing top level features - <AUTHOR> http://317070.github.io/LSD/

<comment><USER2> One of the co-authors here, we are planning to release the source code on GitHub in a few days.

<comment><USER3> A side-note, usually the creators @31707 and @benanne will answer any questions you have when they're chatting. Really cool people.

</comment></comment><comment><USER4> You can follow the resulting video stream and ask it what to create here: [http://www.twitch.tv/317070](http://www.twitch.tv/317070)

</comment><comment><USER5> So where are the results? There is a video but it shows only a smiley face. Can we see some still pictures?

<comment><USER6> There is a live session:

[http://www.twitch.tv/317070](http://www.twitch.tv/317070)

<comment><USER5> It just displays "twitch". Can has low-tech jpg?

<comment><USER6> Shure, if you find a nice person who takes a screenshot.

<comment><USER5> Are you that nice person?

<comment><USER6> [http://imgur.com/LyBeaxw](http://imgur.com/LyBeaxw)

<comment><USER7> It would be great if the machine would render out full-res pngs of each image, right before it changes topic, and store them somewhere. Screenshots are always slightly compressed.</comment></comment></comment></comment></comment></comment></comment>


Don't Say Startup - <AUTHOR> http://clayallsopp.com/posts/dont-say-startup/

<comment><USER2> Oh get the hell off that horse.

> _"So I've made a new rule: unless you've raised money, are bringing in > substantial revenue, or have a sizable active user base, don't call whatever > you're building a startup."_

So... bootstrapped companies can't be startups? What about a funded, B2B service that is bringing in millions in revenue, but only has two clients signed up?

> _"Every time you introduce your product to someone as a startup, you set an > expectation for where the conversation is going next: your funding, revenue, > user base, that sort of talk."_

No it doesn't. It only does if you interact solely with people in a _very specific_ subset of entrepreneurs. You know the type - the people who are _always_ at "startup parties" and hanging out in incubators and coworking spaces all day. There is a large, large world out there where the word "startup" doesn't automatically lead a conversation someplace.

And even _within_ that scene, I have rarely run into situations where "startup" automatically steers the conversation towards funding, userbase, and revenue. Methinks the author hangs out with the wrong people.

> _"someone tells you they're doing a startup, you ask for details, and it > turns out to be pretty nascent. Kind of a let down, right?"_

No, because I haven't pigeonholed the word "startup" into something incredibly, and to be blunt, absurdly specific.

> _"The more we throw around the word "startup", the less of an impact it has > when we actually want it to matter."_

Because _it doesn't matter_. The word "startup" is a general descriptor for the nature and state of your business. If you are throwing that word around for "impact", you are no better than these _other_ people you complain about.

<comment><AUTHOR> > So... bootstrapped companies can't be startups? What about a funded, B2B > service that is bringing in millions in revenue, but only has two clients > signed up?

I think the missed the "or" in "raised money, are bringing in substantial revenue, /or/ have a sizable active user base". Your B2B example is perfectly fine. And I think some of your other points are based on this misunderstanding, too.

<comment><USER2> So, I quit my job and decide to bootstrap a company. I've launched my product and it's in its very early stages of gaining traction.

I'm not allowed to say "I'm working on a startup?" - even though my cofounder(s) and I have poured tens of thousands of our own money into it and have been full-timing it for months?

Forgive me for being blunt: but this reads like whining. You want the _your_ use of the word "startup" to automatically grant you some credibility, and are complaining about people who are trying to do the same.

You will find this in any community. You're not a real painter unless you [blank], you're not a real photographer unless you [blank], you're not a real writer unless you [blank], you're not a real programmer unless you [blank]. And now, you're not a real startup unless you [blank].

</comment></comment></comment><comment><USER3> When I talk with somebody who is working on a real business, they usually are most excited to talk about "what they do" rather than spitting out labels. I see so many people (especially on HN) say "startup(s)", when they are just referring to a 1/4 done side project with no users.

I feel the word "startup" has been dragged through the mud by wantrepreneurs. I have mostly removed it from my vocabulary.

I'm building a company.

<comment><USER4> ^ Completely agreed.

</comment></comment><comment><USER5> I tell everyone that I'm working on "a web page". Seriously. It's funny, and it starts the conversation off with a good, playful tone that makes it clear that I don't take myself too seriously.

</comment><comment><USER6> I don't think this is a particularly good standard. If anything, I find startups at the very early stages (well before serious funding) the _most_ interesting ones to consider. What am I to call a company like this? The whole point is that it's a _start_ \--that's why it's a _start_ up!

I think the term should move in the opposite direction: consider even the most nascent of companies "startups", but stop calling large, well-funded and well- staffed companies like Twitter startups. There is far more difference between Twitter and a funded 10-person company than there is between that same 10-person company and a brand new two-person venture.

Maybe it's a function of whom you talk to, but I've found the conversation about a startup does _not_ proceed to "your funding, revenue, user base, that sort of talk". It proceeds to talking about your product, your idea and your technology. Sure, after that, people might ask about users and revenue, but they understand if that's in the future. On the other hand, if your idea or technology is sufficiently interesting, the topic often just stays on that.

Now, if you're just writing an iPhone app with no real plans to grow it into a company, or you just started a project for fun, maybe you shouldn't call it a startup. But if you plan to grow and get significant funding or revenue, you _are_ a startup--just maybe a temporarily inconvenienced one :).

<comment><USER7> I think the key question is really "are you basically ready to turn this into a registered company?" If you aren't, then it's not a startup.

More importantly, you don't "work on a startup". You work on a project, a product, a service, an idea. If you're working on a startup, you're hopefully a consultant of some kind: legal, HR, whatnot.

It's okay to say "I work at a startup." But that's really less than useful information for both you and the person you're talking to. It's about the same value as "I'm an Asian-American." Congrats, you qualify for a scholarship. Cookie? At least say "I'm an engineering major." or "I'm doing mobile."

</comment></comment><comment><USER8> Calling your little side project a startup makes you look naive. That's why I prefer using "project" in most of these cases. When the OP says _I'm working on my own thing right now_ , I'd replace _thing_ with _project_.

</comment><comment><USER9> Sounds like someone doesn't want others in his cool club.

</comment><comment><USER4> "unless you've raised money, are bringing in substantial revenue, or have a sizable active user base"

Those are not startups, those are businesses. Startups are pre-revenue and pre-launch - i.e. just starting!

</comment><comment><USER10> Pure semantics and hair splitting.

</comment><comment><USER11> Now that this rule has been made what happens next?

</comment><comment><USER12> He already said it. So i didn't click the link.

</comment><comment><USER13> A startup, legally, is a business that is starting up. There is no requirement to actually incorporate or form a company as long as the intent to start a business is present. The startup period is generally defined as a business's first year (possibly first two years) during which it is still engaged in the processing of beginning its business operations. Once it has begun its normal business operations, it is no longer a startup.

A business with substantial revenue, traction, activities, __or__ funding, is _legally by definition not a startup_. It is simply a company. Twitter and Facebook are not startups, and they haven't been for years. Stripe is not a startup. Kickstarter is not a startup. BingoCardCreator is not a startup.

 _But note_ that it is possible to have startups within an existing company. Tax-wise, at least, a business is distinct from a company. A business is a money-generating venture (or a venture intended to generate money); a company is a legal vehicle for housing one or more businesses. So long as the business activity is new, it may be a startup.</comment>


How to look for Hacker news old post?
 - <AUTHOR>

The last day I want to look for comments that a link I saw like one week ago.<p>Is there any way to look for a old post? <comment><USER2> if you upvoted the link, it's under <http://news.ycombinator.com/saved?id=your_id>

if you posted a comment you can find under <http://news.ycombinator.com/threads?id=your_id>

Otherwise you have to try using the search box which is at the end of every page (which uses <http://www.hnsearch.com/>)

</comment><comment><USER3> One side-project I made: <http://hnarchive.in>

You can search based on users who commented.

</comment><comment><USER4> Site search on Google?</comment>


GDPR Reading Notes - <AUTHOR> https://outofthecomfortzone.frantzmiccoli.com/tips/2018/04/08/gdpr-reading-notes.html <comment><USER2> "Global Data Protection Regulation" this is "General Data Protection Regulation"

<comment><AUTHOR> Thanks for that!</comment></comment>


Ask HN: How to keep up with public Facebook page without having an account? - <AUTHOR> <comment><USER2> There are online tools to convert FB page to RSS feed.</comment>


Debian will ship ZFS as a source-only DKMS module - <AUTHOR> http://blog.halon.org.uk/2016/01/on-zfs-in-debian/ <comment><USER2> This goes to the debates that have been had about GPLd libraries. where the dynamic linking happens on the user's machine. Might relate to Oracle v. Google and copyrighting interfaces.

</comment><comment><USER3> I hope that FTP-master agrees. They've been okay with the ATI and nVidia drivers being shipped this way for a rather long time so there is hope.</comment>


Portrait of Shakespeare Unveiled, 399 Years Late - <AUTHOR> http://thelede.blogs.nytimes.com/2009/03/09/portrait-of-shakespeare-unveiled-399-years-late/?hp

<comment><USER3> This is terribly exciting. I recently read Bill Bryson's short work "Shakespeare" and was amazed to find out how little is known about Shakespeare, & indeed most playwrights from that time.

Turns out one of the 2 images (prior to this) that show Shakespeare's appearance, the bust, was practically destroyed when it was erroneously whitewashed which removed most of the detail. (The caretaker believed the colors were not meant to be part of the bust.)

It's practically miraculous that something new was unearthed now, after people have been hunting for a couple hundred years.

Mysterious. Tragic. Historical. What more could you want?

</comment><comment><USER4> Shakespeare is perhaps the most over-rated play write ever. Sure he wrote a few good plays - 'Hamlet', 'Othello', a few other tragedies of note. But most of his stuff was pretty mediocre - 'Measure for Measure' for instance - <USER2> outright sucked - 'Romeo and Juliet' perhaps being one of the worst plays ever conceived.

Compared to say, Sophocles of old, or, in our time, people like Harold Pinter or Edward Albee, Shakespeare was a hack pulp fiction paperback play write who wrote a small number of adequate plays and a large number of really poor plays. Even his best, 'Hamlet', was itself meandering and hard to decipher - Hamlet is crazy, but one thinks he is just pretending to be crazy, however, after a few viewings (or readings) one figures out he is actually in point of fact crazy (insane). But this point could have been made with more clarity and brevity which is why although the play is a great play, we cannot call its author a particularly great writer - good, to be sure, but not great, again, not compared to the really great ones of our day like Pinter.

The real tragedy is that high school students are forced to suffer through this hack's tortuous and obfuscated attempts at drama and pathos. Now _that_ is a tragedy.

<comment><USER5> "Shakespeare is perhaps the most over-rated _play write_ ever"

If you want your criticism of master craftsmen of the English language to be taken seriously, perhaps you should start by learning basic English spelling, grammar and punctuation.

<comment><USER6> Yes, every one-off comment on a social news site should be proofread and edited at least 15 times before actually posting it.

Anyway, this sort of comment seems to be the bulk of most replies to comments that do a lot of criticizing here. It is pretty annoying. Perhaps it would be better for everyone if we just kept this sort of thing to ourselves, realizing that nobody is going to use perfect English for a quick post to HN.

<comment><USER7> > _Yes, every one-off comment on a social news site should be proofread and > edited at least 15 times before actually posting it._

Actually, yes, every comment should be proofread. Writing that contains typos, or is just inelegantly written, is harder to read and understand. When I write something on HN, it's likely to be read by a hundred or more people. So if I take 100 seconds to get my post right, and that saves each reader 1 second, it's a win overall.

To to otherwise is to proclaim that one is sloppy and careless, and that one's time is more important than others' time.

<comment><USER6> _and that one's time is more important than others' time_

I do think this, though.

And anyway, if it costs you one second of time because someone added a space inside the word "playwright", perhaps you need to work on tuning your error correction algorithm. I knew exactly what the OP meant.</comment></comment></comment></comment></comment>


Ask HN: What's the best email-based customer support system - <AUTHOR> We use a combination of Slack and email to track customer issues for our small software company, but it's not working well.
We're looking for something (which must be quite common) which would allow us to track issues in conjunction with the original emails and with Slack discussions. It'd be OK to replace the Slack discussions, but not the email threads. And we don't use gmail, so solutions extending gmail wouldn't help.
Surely, this must be a common need here on HN. Anyone have any recommendations? <comment><USER2> Hi,

I haven't tested it but I stumbled accross this the other day and it seemed interesting : [https://frontapp.com/for-customer- support](https://frontapp.com/for-customer-support)

It does have slack integration and basically any text based medium integration. Might be a good fit for you.</comment>


Fixing critical vulnerabilities in Apache's remote desktop - <AUTHOR> https://blog.checkpoint.com/2020/07/02/hole-y-guacamole-fixing-critical-vulnerabilities-in-apaches-popular-remote-desktop-gateway/ <comment><USER2> I wonder how many other 5000+ employee companies that develop their own remote access software have an entire separate redundant system..

<comment><USER3> Their unique risk is "our remote access product broke (globally, or widespread) but we can't fix it because we don't have access anymore... because we use it too and it's broken".

You can cut off your own arms pretty easily even if you're not the vendor, but it would look particularly bad for them.

Yeah in theory disciplined updates and testing should resolve the risk, but sensible to have a fallback.

</comment></comment><comment><USER4> Here is the link to the full technical paper: [https://research.checkpoint.com/2020/apache-guacamole- rce/](https://research.checkpoint.com/2020/apache-guacamole-rce/)

<comment><USER5> I didn't realize the tool was called "guacamole". Now the headline makes more sense.

</comment></comment><comment><USER6> I applaud them for using open source software, and contributing back their findings, but my first thought reading this was "isn't it a little odd a security appliance vendor who actively markets a "Remote Secure Access" system doesn't rely on there own systems?" Their website has a whitepaper link on every page on how your business should use them for remote access.

<comment><USER7> 'We chose two different remote access solutions, so in the event of one failing, we would have redundancy and an alternative to enable work to continue," says Fischbein, "One of the solutions was based on open-source Apache Guacamole'

I suspect you are right that it's just a story telling prop, but they did address why it might be practical for them to have such a solution in place.

</comment></comment><comment><USER8> "We don't trust open source, and for good reason. Now buy our own closed source product, it's far better - honest"</comment>


Ask HN: Location Poll - <AUTHOR>

I remember that we did a "where are you living?" poll a while back, but I cannot find. Trying to meet-up with Paris based hackers. Can someone point me in the right direction please. <comment><USER2> Valley Forge, PA. Our Philly meetup group: <http://www.groupomatic.com/haqsm3vj>

<comment><USER3> Lancaster here. I just did. Thanks!

</comment></comment><comment><USER4> <http://news.ycombinator.com/item?id=752262>

<comment><AUTHOR> Thanks!

</comment></comment><comment><USER5> By the way, I'm parisian. Maybe we should create a meet-up thread ?

</comment><comment><USER6> About an hour and half outside of New Orleans, LA.</comment>


The RasterInfo Font - <AUTHOR> http://freetype.org/freetype2/docs/rasterinfo/rasterinfo.html <comment><AUTHOR> I'm particularly impressed with the line "The current PPEM value used in this paragraph", which shows the font size, and changes with Ctrl-plus and Ctrl- minus.</comment>


Show HN: TipperCoin - Send Bitcoins over Twitter - <AUTHOR> http://www.tippercoin.com/ <comment><USER2> Request: dogecoin support. (seriously) It's better for tipping due to the fact that to tip someone a nickel right now with BTC I have to type out a long decimal.

<comment><USER3> I am getting tired of all this dogecoin hype. This altcoin is not innovative, does not solve a problem that bitcoin has and was in fact created to mock all the altcoins. Yes it's funny (for the first 5 minutes) but tell me the added value? You think it's good for tipping because it's almost worthless?

The beauty of bitcoin is that you CAN type out long decimals. The beauty is that you can USE bitcoin to pay for goods and services. Bitcoin was like Dogecoin 5 years ago, why are you trying to repeat this proces?

If you look at the site of Tippercoin, you see that it is also possible to send for example a beer ($4) in bitcoin. Seems pretty easy to type, not?

The way I see it is that most of the altcoins are created by and for people who think they have missed the Bitcoin-boat and are stuck with their old mining hardware. Hoping that their altcoin will take off, by pumping and hyping it everywhere including Hacker News, so they can make some easy money.

<comment><USER4> Dogecoin is the small man's answer to banks to shove it, think about it.

<comment><USER3> And Bitcoin isn't? And what stops banks from entering, like some (say that they) are planning to do with bitcoin?

<comment><USER4> Yeah, but Bitcoin is the seasoned second-time founder taking on the banks, Dogecoin is the young 21y old kid giving them the middle finger.

</comment></comment></comment></comment></comment><comment><USER5> Cryptocurrency tipping culture is really interesting to me. I can't think of another culture or system that encourages people giving away small amounts of money because they like something you said or just because they feel like it. I can see tipping becoming huge on Facebook and Twitter. And possibly even as a pseudo payments system for services like Pinterest.

<comment><AUTHOR> The beautiful thing is that tipping real money kind of doesn't feel right. Like, "hey ryan bates, good job on the railscast, here is a dollar"

But, personally, when it is in cryptocurrency it feels very different.

<comment><USER6> Can you elaborate?

</comment></comment></comment><comment><USER7> Tipping is a really interesting aspect of cryptocurrency. I've never made a cent from blogging, but I added Dogecoin and Bitcoin links at the bottom of my last post, and actually got some tips.

Tipping is also one of the reasons that Dogecoin is seeing such large growth, at least within Reddit.

<comment><USER8> Is Dogecoin tipping real? I assumed it was just a parody of Bitcoin tipping.

<comment><USER7> Nope, it is 100% real. Source: [https://github.com/mohland/dogetipbot](https://github.com/mohland/dogetipbot)

<comment><AUTHOR> I am so surprised that dogecoin took off! haha

</comment></comment></comment></comment><comment><USER3> I'm afraid your logo is not allowed by Twitter: "Do not modify or alter the marks or use them in a confusing way, including suggesting sponsorship or endorsement by Twitter, or in a way that confuses Twitter with another brand." See [https://about.twitter.com/press/brand- assets](https://about.twitter.com/press/brand-assets)

I'd change it if I were you! Otherwise, very simple and usable service. [https://www.pikapay.com/](https://www.pikapay.com/) would be a competitor.

<comment><USER9> Ahhhhh, but it worked so perfectly!

Oh well, thanks for the heads up :)

</comment></comment><comment><USER2> I thought about how I'd add a tip action on HN via a Chrome plugin, but it's hard since HN users don't usually disclose contact info, so you can't onboard them when they receive a tip. Many HN users use their twitter handles, so that's something, but it would be nice if there were some simple OAuth API to get a user's e-mail. Or, pg could implement bit/dogecoin tipping :)

<comment><USER10> Reddit's tip not does it without an email address

\-----

You could let a username claim tips by making a comment like:

CLAIM: email@example.com

To start managing their tips on your app / site

<comment><AUTHOR> If only HN had a comment streaming API!

PG, time to add some more features to hacker news

<comment><USER11> Or contact someone else who has already rolled their own:

[http://hnnotify.com/](http://hnnotify.com/)

</comment></comment></comment></comment><comment><USER12> is there an email equivalent service?

<comment><AUTHOR> Yeah, as locksley said you can use coinbase for over the email BTC transfers.

The original intend for building TipperCoin is for tipping and supporting open sourced projects. To send a tip / act of gratitude to people that built cool stuff and that you don't personally know (as opposed to email, which you tend to know them).

A few weeks ago, we built an open sourced browser wallet (www.sparecoins.io) and we posted it on reddit and got a bunch of tips with reddit tip bot. That was very encouraging for me. (The fact that people liked it enough to send us a tip!!) And so we decided to build this tipping service (open sourced, ofc!) to encourage supporting other projects.</comment></comment>


MasterCard-Branded National eID Card Launched in Nigeria - <AUTHOR> http://www.zdnet.com/nigeria-launches-new-biometric-id-card-brought-to-you-by-mastercard-7000033133/ <comment><USER2> This is a big thing. Mastercard is a global company. In Nigeria, a country that has nothing to loose and some small advantages to gain this may seem like a no brainer. However, if this new tech proves itself reliable enough I expect it to be pushed to many more countries. Think about it. A BANK will OWN your biometric data (10 fingerprints, iris signature, facial signature). Everything. And this is not a governmental entity. Nigeria, as a poor country, cannot challenge the tech brough by Mastercard.

An then what would be the next step? No more cash payments? If you pay by cash the whole system would flag you as potential threat?

Plus, is there any prove that access to credit for really poor people is actually creating wealth ? This is the modern slavery and anyone who has credit in west either for education or commercial purpose has felt on its own skin what means to work for paying up the debt.

God help us all!

<comment><USER3> Don't confuse consumer credit – which is taking out loans in order to buy goods like toasters that will _decrease_ in value – from a business loan – which is a bet that you can _add value_ to what you buy with the loan, and thus earn enough to pay it back (and more, hopefully).

Having a quick look around, I found this blog post from Kiva who helped pioneer microlending in the developing world. The answer seems to be "yes, but credit isn't enough to turn anyone into an entrepreneur": [http://fellowsblog.kiva.org/fellowsblog/2013/03/22/how- effec...](http://fellowsblog.kiva.org/fellowsblog/2013/03/22/how-effective-is- microcredit-really)

As a bit of a rant: the West is generally overburdened with consumer credit. People panic when the value of their house goes below that of their mortgage, which is called negative equity. But (almost) every consumer credit agreement leads to this negative equity. It's mad.

<comment><USER4> What a useful way of putting it.

Can you think of an institutional or cultural way to get people in the West out of some of their consumer credit traps? I don't think the lenders are going to help!

<comment><USER4> I wonder if this got downvoted because someone read it as sarcastic. It wasn't meant to be so; I thought the parent comment was useful and I was wondering how to change the culture around consumer lending, which I agree has got a lot of people trapped (or at least burning a lot of their income on interest payments and fees).

</comment></comment></comment></comment><comment><USER5> While this is a bit strange when issued as a government ID, the cards seem familiar to me: In Norway, pretty much all debit cards - including ones with VISA and Mastercard - have picture ids on the back that are valid in most instances a formal government id would be, and it's the primary id document for a substantial percentage of people.

It caused a few amusing episodes when I first moved to the UK and still had my Norwegian accounts, when shop clerks would look at me with a puzzled look, wondering why in the world I tried paying with an id card - until I pointed out the VISA logo.

</comment><comment><USER6> So MasterCard have in one swoop pretty much monopolised the entire payments industry of an entire country? Helping the unbanked is probably a good thing (probably) but I wonder how expensive these cards will be, or will become.

I personally would hate the idea of having a "Mastercard" branded ID card or passport here in the UK. Maybe in Nigeria it's the lesser of two evils, perhaps not.

<comment><USER7> Why do you think its a monopoly?

<comment><USER8> it may not be one currently, but if an entire population is forced to use an ID from a private company, and then that company provides incentive for other services formed around the ID (which was forced), it begins rapidly approaching monopoly status.

<comment><USER9> The first step is itself a monopoly, leveraging it to other products is one of the dangers that an existing monopoly opens up.

</comment></comment></comment></comment><comment><USER10> Here's an excerpt from the Mastercard press release with a few more details:

"MasterCard has pioneered large scale card schemes that combine biometric functionality with electronic payments and we want to capitalize on their experience... enrollment process involves the recording of an individual's demographic data and biometric data (capture of 10 fingerprints, facial picture and digital signature)..." [http://newsroom.mastercard.com/press- releases/mastercard-to-...](http://newsroom.mastercard.com/press- releases/mastercard-to-power-nigerian-identity-card-program/)

I wonder how Americans would feel if the U.S. government teamed up with Mastercard, devised a similar biometric ID card -- and required all U.S. citizens to obtain one to drive, pay taxes, get government benefits, vote, etc.? (I also wonder what "demographic data" referred to above means, and whether it means everyone's religion will be encoded on the ID...)

<comment><USER8> > I wonder how Americans would feel if the U.S. government teamed up with > Mastercard, devised a similar biometric ID card -- and required all U.S. > citizens to obtain one to drive, pay taxes, get government benefits, vote, > etc.? (I also wonder what "demographic data" referred to above means, and > whether it means everyone's religion will be encoded on the ID...)

hopefully nauseous. a national ID is bad enough; a national ID ran by a private conglomerate is worse. The privacy implications are harrowing either way, from a personal standpoint.

</comment></comment><comment><USER11> Back in the nineties, when Java was still the next big thing, manufacturers promised that we would carry a single Java smartcard for all applications: identification, credit cards, electronic wallets, etc.

As we now know this never happened. The biggest reason is marketing: every company wants to have their own logo on the card, which is impossible to do with a generic card.

Reference from 1998: ftp://service.boulder.ibm.com/software/pervasive/info/javacard.pdf

<comment><USER12> On a related note, I recently found out that all SIM cards run JavaCard applications. Apparently SIM applications are not uncommon in countries where smartphones still aren't common.

Check out [https://simhacks.github.io/defcon-21/](https://simhacks.github.io/defcon-21/)

<comment><USER11> Indeed, SIM cards in third-world countries seem to be the only place where installing applets on a third-party smartcard (i.e. the telco's SIM card) is commonplace.

Smartphones are only recently catching up through the addition of secure elements in the device. Without them, the SIM card is the only place to securely store secrets.

</comment></comment></comment><comment><USER13> A bunch of college campuses (including where my ex went, pace university school of law) had College ID cards that were also mastercards.

They also forced you to activate them (she asked repeatedly if she could avoid them), so you could not just disable the credit card functionality.

What mastercard has done here seems the logical next step.

At pace, this was called the "pace onecard".

</comment><comment><USER14> Sounds like a data protection nightmare. Is there any information about the chip design and whether both purposes are strictly separated? Who is maintaining the ID information, MasterCard? Is a POS allowed to read ID data?

<comment><USER15> What kind of ID data are you referring to? If when I swiped my credit card the point of sale could see my name, year of birth, and picture I would consider that a good thing.

With my drivers license for example anyone I hand the card to can read name, date of birth address, picture, because those things are printed on the outside of the card.

<comment><USER14> To the Personal ID data.

That card contains biometric data and certainly more information that is not necessary for a transaction. If that card gets cloned, you will lose more than just money. So the probability of identity theft is much higher - each POS can be an attacker.

Also, if MasterCard is maintaining both data sets and is losing it, will they be held liable for the Personal ID data too?

<comment><USER5> While that is problematic: This is Nigeria. Given that Nigerians themselves tend to vote Nigeria as one of the most corrupt countries in the world, I suspect many Nigerians may prefer Mastercard to be the one holding the data over the Nigerian government...

</comment></comment></comment></comment><comment><AUTHOR> More info:

"The new cards carry two photographs of the holder, and a chip storing an individual's biometric information including 10 fingerprints and an iris scan using a system developed by Cryptovision." [0]

[0] [http://www.zdnet.com/nigeria-launches-new-biometric-id- card-...](http://www.zdnet.com/nigeria-launches-new-biometric-id-card-brought- to-you-by-mastercard-7000033133/)

<comment><USER16> Thanks. We changed the url to that from [http://newsroom.mastercard.com/press- releases/mastercard-bra...](http://newsroom.mastercard.com/press- releases/mastercard-branded-national-eid-card-launched-nigeria/).

<comment><AUTHOR> No worries. ZDNet offers more info.

</comment></comment></comment><comment><USER17> Another commenter notes "a bunch of college campuses have College ID cards that were also mastercards." I would just add to this that Chicago launched public transit cards this year that are also Mastercards. [http://www.ventrachicago.com](http://www.ventrachicago.com)

</comment><comment><USER18> Well, I for one can't see any issues with an entire country of poorly educated people being given a card that with a flip of a switch, introduce them to the crippling force of 25.5% compound interest.

I wish I had no morals, making money would be so easy.

<comment><USER19> It's not a credit card.

<comment><AUTHOR> It will function as a debit card.

<comment><USER6> For now.

</comment></comment></comment></comment><comment><USER20> I was born in Nigeria and grew up there until I was 17 and from what I know about everyday life in Nigeria, the implementation of this system could be astoundingly complex. In the foreseeable future, I think that only about 20% of the population will end up using this system because for most of Nigeria, life is primarily focused around a cash economy.

Nigerian life is rife with many daily issues that foster a large distrust of institutions and the government. Master Card and their POS machines, cash and voting machines would have to build that trust. Life in Nigeria also involves a lot of wary informal trading between many half-educated people (elementary school) who do not use banks, do not use any services that are provided by the government/any large institution, and do not use any automated services at all.

That trust is already lost with Mastercard's association with the Nigerian government because the relationship between the people and the government is quite sour. The government, the leadership of the country (and a good chunk of the people) are daily involved in corruption.

There are many things in Nigeria that you just can't actually do except you bribe, or know someone on the inside who will protect you from having to spend money to bribe. Nepotism tends to be the only alternative to bribery. This sort of thing is widespread, from purchasing a car, to passing an exam (yes, sometimes) to just using a roadside mechanic, to driving from point A to point B (you will have to bribe the police to pass a check point, even if you have no fault). Adopting a checks-and-balances master card system in this kind of a society will be ridiculous at best. The everyday institutions, and millions of people (yes millions!) who thrive on these corrupt systems simply do not want such a system. Neither does the government. The government is the most corrupt of all organizations in Nigeria.

Because the problems are so entrenched, it would take a long time for a large portion of the population to start using this. (BTW The voting part of it is a joke, or maybe a dream).

Master card is probably only seeking to gain with the growing upper middle class that work in a mostly formal economy and mostly live in Lagos. If this section of society adopts their system, they can seek to gain with time. However, they would need to maintain a good wall between themselves and the federal government if they want to gain trust and make not reduce this thing to a joke.

</comment><comment><USER21> What could go wrong?

Also, could we soon see a blockchain backed implementation of this? i imagine a wallet w/ pointers to biometricChain and facialImageChain could be strung together easily enough and deployed to any national network.

</comment><comment><USER22> A corporate branded national ID card sounds like something out of a William Gibson novel.

<comment> guard-of-terra They're rolling same thing in Russia, but the adoption in 0s currently. Not with MasterCard mind you.

</comment></comment><comment><USER23> Order amongst chaos.

</comment><comment><USER24> aside: interesting to me the subhead is direct guidelines of how/what to tweet for this story.</comment>


Don't Start With a Monolith - When your goal is microservices architecture - <AUTHOR> https://martinfowler.com/articles/dont-start-monolith.html <comment><AUTHOR> Yesterday's discussion for further context;

[https://news.ycombinator.com/item?id=14778685](https://news.ycombinator.com/item?id=14778685)

</comment><comment><USER2> Its all about architecture and requirements. A well designed monolith is way easier to setup then microservices. Been there, done that several times.

</comment><comment><USER3> "If you are actually able to build a well-structured monolith, you probably don't need microservices in the first place. Which is OK! I definitely agree with Martin: You shouldn't introduce the complexity of additional distribution into your system if you don't have a very good reason for doing so.

So what would be a good reason? There are many, but to me the most important one is to allow for fast, independent delivery of individual parts within a larger system. Microservices' main benefit, in my view, is enabling parallel development by establishing a hard-to-cross boundary between different parts of your system. By doing this, you make it hard – or at least harder – to do the wrong thing: Namely, connecting parts that shouldn't be connected, and coupling those that need to be connected too tightly. In theory, you don't need microservices for this if you simply have the discipline to follow clear rules and establish clear boundaries within your monolithic application; in practice, I've found this to be the case only very rarely.)"

In theory, you know before building a system whether you'll need the things you deem important on deciding whether you're better off with microservices.

In practice you very rarely do.

So we're back at square one.</comment>


Young blood to be used in rejuvenation trial - <AUTHOR> http://www.newscientist.com/article/mg22329831.400-young-blood-to-be-used-in-ultimate-rejuvenation-trial.html

<comment><USER2> Nothing is new. [http://www.exilpen.net/neuigkeiten/texte/vampire.html](http://www.exilpen.net/neuigkeiten/texte/vampire.html)

</comment><comment><USER3> I cringe at the thought this will work.

My first thought when I first heard about this a few months ago was comment in bad taste I had made to a Libyan about why Italy would never get rid of Berlusconi he'll never die; he'll just start harvesting organs from young N. Africans (Italy invaded and traditionally had a colonial relationship with Libya).

At the time I meant it tongue in cheek. Now we've found out that injecting ourselves with baby smoothies reverses ageing. Great.</comment>