Ask HN: How do you backup your linux system? - <AUTHOR> Describe your backup workflow <comment><USER3> It .... depends.

Given I worry about this sort of thing for a living and am a partner in the firm: I think in terms of backup, DR, BC, availability and more. I have access to rather a lot of gear but the same approach will work for anyone willing to sit down and have a think and perhaps spend a few quid or at least think laterally.

For starters you need to consider what could happen to your systems and your data. Scribble a few scenarios down and think about "what would happen if ...". Then decide what is an acceptable outage or loss for each scenario. For example:

* You delete a file - can you recover it - how long

* You delete a file four months ago - can ...

* You drop your laptop - can you use another device to function

* Your partner deletes their entire accounts (my wife did this tonight - 5 sec outage)

* House burns down whilst on holiday

You get the idea - there is rather more to backups than simply "backups". Now look at appropriate technologies and strategies. eg for wifey, I used the recycle bin (KDE in this case) and bit my tongue when told I must have done it. I have put all her files into our family Nextcloud instance that I run at home. NC/Owncloud also have a salvage bin thing and the server VM I have is also backed up and off sited (to my office) with 35 days online restore points and a GFS scheme - all with Veeam. I have access to rather a lot more stuff as well and that is only part of my data availability plan but the point remains: I've considered the whole thing.

So to answer your question, I use a lot of different technologies and strategies. I use replication via NextCloud to make my data highly available. I use waste/recycle bins for quick "restores". I use Veeam for back in time restores of centrally held managed file stores. I off site via VPN links to another location.

If your question was simply to find out what people use then that's me done. However if you would like some ideas that are rather more realistic for a generic home user that will cover all bases for a reasonable outlay in time, effort and a few quid (but not much) then I am all ears.

</comment><comment><USER4> I use rdiff-backup.[1]

 _" rdiff-backup backs up one directory to another, possibly over a network. The target directory ends up a copy of the source directory, but extra reverse diffs are stored in a special subdirectory of that target directory, so you can still recover files lost some time ago. The idea is to combine the best features of a mirror and an incremental backup. rdiff-backup also preserves subdirectories, hard links, dev files, permissions, uid/gid ownership (if it is running as root), modification times, acls, eas, resource forks, etc. Finally, rdiff-backup can operate in a bandwidth efficient manner over a pipe, like rsync. Thus you can use rdiff-backup and ssh to securely back a hard drive up to a remote location, and only the differences will be transmitted."_

[1] - [https://github.com/sol1/rdiff-backup](https://github.com/sol1/rdiff- backup)

<comment><USER5> Me too and I'm pretty happy with it. My retention period is 1Y for most systems.

</comment></comment><comment><USER6> Put all personal data on a zfs z2 RAID system (FreeNAS). Take regular snapshots.

Someday I'm going to get a second offsite system to do ZFS backups to, but so far the above has served well. Then again I've been lucky enough to never have a hard drive fail, so the fact that I can lose 2 without losing data is pretty good. I'm vulnerable to fire and theft, but the most likely data loss scenarios are covered.

<comment><USER7> Even in 2017 you still can't sneakernet sometimes. I have a ZFS file server similar to yours, and it acts as the backup destination for all my other devices. Then, I use two USB HDDs to back up the server, then bring one to work. If either is attached a nightly script bring it up to date. I just keep rotation the two between home & work.

</comment></comment><comment><USER8> With borg ([https://borgbackup.readthedocs.io/](https://borgbackup.readthedocs.io/)) and a custom script ([https://raw.githubusercontent.com/sanpii/deploy/master/src/b...](https://raw.githubusercontent.com/sanpii/deploy/master/src/backup)) to test pg backup and sync to another server.

</comment><comment><USER9> I use `btrbk` as a systemd service to snapshot my `/home` subvolume hourly & any other important subvolumes daily. `btrbk` manages the retention policy, which is roughly something like:

\- daily snapshots for 1 week

\- the first snapshot of every week for 4 weeks

\- the first snapshot of every month for 2 years

\- the first snapshot of every year for 5 years

Since I use entirely SSD storage I also have a script that mails me a usage report on those snapshots, and I manually prune ones that accidentally captured something huge. (Like a large coredump, download, etc. I do incremental sends, so I can never remove the most recent snapshot.)

Since snapshots are not backups I use `btrfs send/receive` to replicate the daily snapshots to a different btrfs filesystem on spinning rust, w/ the same retention policy. I do an `rsync` of the latest monthlies (once a month) to a rotating set of drives to cover the "datacenter burned down" scenario.

My restore process is very manual but it is essentially: `btrfs send` the desired subvolume(s) to a clean filesystem, re-snapshot them as read/write to enable writes again, and then install a bootloader, update /etc/fstab to use the new subvolid, etc.

\---

Some advantages to this setup:

* incremental sends are super fast

* the data is protected against bitrot

* both the live array & backup array can tolerate one disk failure respectively

Some disadvantages:

* no parity "RAID" (yet)

* defrag on btrfs unshares extents and thus in conjunction with snapshots this balloons the storage required.

* as with any CoW/snapshotting filesystem: figuring out disk usage becomes a non-trivial problem

</comment><comment><USER10> This comes up here quite a bit, lots of great answers in the past 2 discussions:

[https://news.ycombinator.com/item?id=12999934](https://news.ycombinator.com/item?id=12999934)

[https://news.ycombinator.com/item?id=13694079](https://news.ycombinator.com/item?id=13694079)

</comment><comment><USER11> I've long used rsnapshot for automated incremental backups, and manually run a script to do a full rsync backup with excludes for /tmp, /sys and the like to an external drive.

[http://rsnapshot.org/](http://rsnapshot.org/)

<comment><USER12> I use rsnapshot from cron to external USB drive encrypted with luks. I swap the drive with similar one weekly and store it offsite.

</comment></comment><comment><USER13> I don't back up the system. Drive failures are so rare nowadays that I will reinstall more often because of hardware changes.

The important stuff (projects, dotfiles) I keep on Tarsnap. I also rsync my entire home directory to an external drive every other week or so.

Similar for servers but I do back up /etc as well.

<comment><USER14> Why would you reinstall due to hardware changes? My Debian installation has survived the move from two laptops already without any glitches.

<comment><USER3> My Arch and Gentoo installs have gone somewhat further than that 8)

Admittedly I'm not sure that you can consider one of them that went from i386 to amd64 as the same install simply because /var/lib/portage/world and /etc/portage/ (plus a few other bits) are the same. I still use it and it's on its fifth or sixth incarnation as my current laptop.

Trigger's broom?

(OK [https://en.wikipedia.org/wiki/List_of_Ship_of_Theseus_exampl...](https://en.wikipedia.org/wiki/List_of_Ship_of_Theseus_examples))

</comment></comment></comment><comment><USER15> [http://www.snebu.com](http://www.snebu.com) \-- something I wrote because I wanted snapshot style backups, but without the link farm that rsync-based snapshot backups produce. Snebu does file-level deduplication, compression, multi-host support, files are stored in regular lzo-compressed files, and metadata is in a catalog stored in a sqlite database.

Only real things missing is encryption support (working on that), and backing up KVM virtual machines from the host (working on that too).

</comment><comment><USER16> For both windows/linux/macOS boxen we use burp. Replaced a propietary program used for over 15 years. [http://burp.grke.org/](http://burp.grke.org/) I highly recommend it.

</comment><comment><USER17> Mostly local network storage which is backedup multiple times automatically, for the laptop I do manual btrfs send/receives manly to get things restored _exactly_ the way they were.

#helps to see the fstab first

        UUID=<rootfsuuid>   /          btrfs   subvol=root 0 0
        UUID=<espuuid>      /boot/efi  vfat    umask=0077,shortname=winnt,x-systemd.automount,noauto 0 0

        cd /boot
        tar -acf boot-efi.tar efi/
        mount <rootfsdev> /mnt
        cd /mnt
        btrfs sub snap -r root root.20170707
        btrfs sub snap -r home home.20170707
        btrfs send -p root.20170706 root.20170707 | btrfs receive /run/media/c/backup/
        btrfs send -p home.20170706 home.20170707 | btrfs receive /run/media/c/backup/
        cd
        umount /mnt

So basically make ro snapshots of current root and home, and since they're separate subvolumes they can be done on separate schedules. And then send the incremental changes to the backup volume. While only incremental is sent, the receive side has each prior backup to the new subvolume points to all of those extents and is just updated with this backups changes. Meaning I do not have to restore the increments, I just restore the most recent subvolume on the backup. I only have to keep one dated read-only snapshot on each volume, there is no "initial" backup because each subvolume is complete.

Anyway, restores are easy and fast. I can also optionally just send/receive home and do a clean install of the OS.

Related, I've been meaning to look into this project in more detail which leverages btrfs snapshots and send/receive. [https://github.com/digint/btrbk](https://github.com/digint/btrbk)

</comment><comment><USER18> Main home "server" is an Ubuntu system with a couple 2TB HDDs. It runs various services for IoT type stuff, has a few samba shares, houses my private git repositories, backups from Raspberry Pi security cameras, etc. It is backed up to the cloud using a headless Crashplan install. I use git to store dotfiles, /etc/ config files, scripts, and such, in addition to normal programming projects.

We back up photos from our iOS devices to this server using an app called PhotoSync. I also have an instance of the Google Photos Desktop Uploader running in a docker container using x11vnc / wine to mirror the photos to Google Photos (c'mon Google, why isn't there an official Linux client???). I'm really paranoid about losing family photos. I even update an offsite backup every few weeks using a portable HDD I keep at the office.

<comment><USER3> "I'm really paranoid about losing family photos"

No you aren't paranoid. Sensible. However, you've only just started. Try and do a restore every now and then from the HDDs.

There is no such thing as paranoia when it comes to protecting your data.

<comment><USER18> >Try and do a restore every now and then from the HDDs.

Not only do I do that, but I also occasionally pull down some files from Crashplan just to make sure everything is backing up and working as expected.

<comment><USER3> Cover off longterm restores and you are pretty much good.

Don't forget that families/friends can also effectively offsite each other's backups without invoking third parties. That does assume connectivity, storage etc. Also it does need managing 8)

</comment></comment></comment></comment><comment><USER19> CrashPlan for /home

Plain old btrfs snapshot + rsync to local usb drive and offsite host for /etc, /var, /root

</comment><comment><USER20> Just keeping my home folder safe, everything else is up and running in less than one hour if I had to start over. Daily backups with borg backup plus a couple of git repos for the dotfiles. All the important stuff is small enough for this, my backup is like 25 gb (a lot of random crap included), and all the photos and videos we used to worry about a few years ago is up in some unlimited sized google cloud for free. Times are pretty good :)

</comment><comment><USER21> Excellent rsync-time-backup for local machine, backing up etc and home to external disk: [https://github.com/laurent22/rsync-time- backup](https://github.com/laurent22/rsync-time-backup)

Duply for servers, keeping backups on S3: [http://duply.net/](http://duply.net/)

Cron does daily DB dumps so Duply stores everything needed to restore servers.

</comment><comment><USER22> \- Dirvish[0] for local backups (nightly)

\- Crashplan[1] for cloud backups (also nightly; crashplan can backup continuously but I don't do that)

Pretty happy with it, though dirvish takes a little bit of manual setup. Never had to resort to the cloud backups yet.

[0] [http://www.dirvish.org/](http://www.dirvish.org/)

[1] [https://www.crashplan.com/](https://www.crashplan.com/)

</comment><comment><USER23> Most of my projects fit in my laptop hardisk. I have a dropbox subscription which syncs everything interesting in my laptop to dropbox servers. This setup has saved my work once when my old laptop died - I just bought a new laptop and synced everything from dropbox.

</comment><comment><USER24> I use rsnapshot [1] for /home data and afio [2] for other stuff (offline databases, system, photos, ...)

With rsnapshot, I have hourly, daily, weekly and monthly backups that use hard links for the saving disk space. These backup dirs can be mounted read-only.

With afio, files above some defined size are compressed and then added to the archive, so that if some compression goes wrong, only that file may be lost, the archive is not corrupted. Can have incremental backups.

From the afio webpage: Afio makes cpio-format archives. It deals somewhat gracefully with input data corruption, supports multi-volume archives during interactive operation, and can make compressed archives that are much safer than compressed tar or cpio archives. Afio is best used as an `archive engine' in a backup script.

[1] [http://rsnapshot.org/](http://rsnapshot.org/) [2] [http://members.chello.nl/k.holtman/afio.html](http://members.chello.nl/k.holtman/afio.html)

</comment><comment><USER25> Backup to external hard drive with btrfs. Rsync is used to copy the full source file system, with short exception lists for stuff I don't want backupped. After the sync, a btrfs snapshot is taken to get history. These napshots are removed with an exponential strategy (many snapshots are recent, few are old, the oldest is always kept), keeping ~30 snapshots a year.

Backup takes ~10min for searching 1TB of disk space. The daily diff is typically 6..15 GB, mostly due to braindead mail storage format...

I want to keep it simple but still have full history and diff backup: no dedicated backup tool, but rsync + btrfs. A file-by-file copy is easy to check and access (and the history also looks that way).

If the source had btrfs, I would use btrfs send/receive to speed it up and make it atomic.

I have two such backup disks in different places. One uses an automatic backup trigger during my lunch break, the other is triggered manually (and thus not often enough).

The sources are diverse (servers, laptops, ...). The most valued one uses 2 x 1 TB SSDs in RAID1 for robustness.

All disks are fully encrypted.

<comment><USER7> > If the source had btrfs, I would use btrfs send/receive to speed it up and > make it atomic.

btrfs subvolume snapshot / send are _not_ atomic, for various definitions of atomic.

Unlike zfs, subvolume snapshots are not atomic recursively. That is, if you have subvol/subsubvol, there's no way to take an atomic snapshot of both. At least this one is obvious, since there's no command for taking recursive snapshots, so it tips you off that this is the case. Not having an easy way to take recursive snapshots, atomic or not, is a different pain point...

What's more insidious is that after taking the snapshot, you must sync(1)[0] before sending said snapshot, otherwise the stream would be incomplete! I'm invoking Cunningham's Law here and saying for the record that this is fucking retarded. I have lost files due to this...design choice.

Moreover, though is is probably a fixed bug, I used to have issues where subvolumes get wedged when I run multiple subvolume snapshot / send in quick succession. I'd get a random unreadable file, and it's not corruption (btrfs scrub doesn't flag it). Usually re-mounting the subvolume will fix it, and at worst re-mounting the while filesystem would fix it so far. I haven't had it happen for a while, but it's either due to my workaround -- good old sleep(60) mutex -- or because I'm running a newer kernel.

I can't wait until xfs reflink support is more mature: that'll get me 90% what I use btrfs for.

tl;dr: btrfs: here be dragons!

[0] [https://btrfs.wiki.kernel.org/index.php/Incremental_Backup](https://btrfs.wiki.kernel.org/index.php/Incremental_Backup)

</comment></comment><comment><USER26> I use _rsnapshot_ to create hourly/daily/weekly/monthly snapshots of configured systems. Backups are written to a dedicated drive (which just started showing SMART-errors at so I'll replace it ASAP). I regularly create PGP-encrypted archives of selected sets which get stored off-site, spread around the 'net on cloud hosting services. I'm also thinking about making an arrangement with some friends and family members who have a) good network connections and b) personal servers and c) a need to backup such to swap off- site backup copies - I'll store yours if you store mine. I currently have about 100 GB in 'critical' data which is stored off-site.

I also keep current copies of most configuration data for all systems, mainly by backing up their _/ etc_ directories. This is also done for network equipment and remote network configuration data (zone files, etc).

</comment><comment><USER27> No workflow, we just use BackupPC ([http://backuppc.sourceforge.net/](http://backuppc.sourceforge.net/)) - <USER2> recommend it enough. Restores are easy, monitoring and automation on different schedules is all built in. It's really great.

<comment><USER28> Love backuppc, especially 4.X where they replace the somewhat ugly hack of using hardlinks with checksums. Recommended if you have a collection of systems, if it's just a single system I'd use rdiff-backup (if you have remote storage) or duplicity if you want to pay for remote storage (amazon, rackspace, or similar).

</comment></comment><comment><USER29> I've gotten so used to Arq Backup (macOS/Windows) (and Time Machine (macOS)), neither of which are convenient to run against Linux, that I've actually come to avoid using Linux as something to be backed up except as a container or VM, wholesale.

</comment><comment><USER30> With rsync, using the --link-dest option to make a complete file tree using hard links to a remote server.

Cron runs it, on @reboot schedule. If the backup is successful, some (but not all) old backups are deleted. I delete some oldest preserved backups manually, if disk space runs low.

</comment><comment><USER31> After being partially dissatisfied with various existing solutions, I have written my own backup software: file4life ([http://www.file4life.org](http://www.file4life.org)). I've been using it for the last 3 years and am currently working on a new release.

Its main advantages with respect to other approaches, at least for my use cases, are:

\- metadata is stored in a single append-only file: no extra software (DB etc.) is needed;

\- partial backups can be performed to separate storages. In fact, source and backup directories are not conceptually different, so a duplicate of a directory counts as a backup.

</comment><comment><USER32> Perhaps someone could offer a related suggestion. At the moment, I use rsync to backup files to external hard drives. One of the difficulties that I run into is that some folders I want to mirror exactly between my computer and the backup. Other folders I want to only add files, but not delete, to the backup. Still others, like git repositories, I'd like to bundle rather than backup the directory itself. Finally, I make redundant backups to multiple external hard drives, so it would be nice to replay the same backup procedure to multiple devices. Does anyone have a workflow that accomplishes this or something similar?

<comment><USER3> No, that is not backup or DR or BC (Disaster Recovery and Business Continuity). What you are describing is personal data management mixed up with backup.

<comment><USER32> Interesting. I've not heard that term before. Can you suggest a personal data management tool that works well with one of the suggested backup solutions in this thread?

</comment></comment></comment><comment><USER33> I've used clonezilla ([http://clonezilla.org/](http://clonezilla.org/)). You create a bootable media (usb stick) then use that to clone to another drive/partition.

</comment><comment><USER34> I use a cloud based service to back up hand selected directories.

I run a weekly script to rsync one HD to another. The backup HD is exactly the same size and partitioned identically. I had a HD crash some years ago and it was fairly trivial to swap out the drives (probably needed to make some changes to the MBR). Unfortunately, I had an HD crash some months ago and it was _not_ as easy this time round. Apparently my rsync would fail in the middle and so a lot of files were stale. Unbootable. Fortunately, all the critical data was copied.

I should have a smarter backup script that will alert me on failure to rsync.

</comment><comment><USER35> For my backups, I use rclone with Backblaze B2 and Google Cloud Storage (Nearline) using Crypt (with the same password and password2 for both B2 and GCS). This gives me the benefit of file level encryption, with filename encryption too. In my case, I'd rather not use encrypted archives in case a bit got flipped and rendered my archive useless.

I have a systemd timer to run (incremental) backups every 3 hours, and I plan on setting up a mechanism to automatically verify all of my data that has been uploaded.

</comment><comment><USER36> I don't back up my systems. Everything important is in some cloud storage somewhere, and I have network boot into installers set up on my network. There's actually one machine where I ran out of space on the local disk and didn't feel like getting up to replace it, so I copied it into a bigger volume on one of my servers and it's been booting off of that ever since.

My customers and employers have all had these rube goldberg enterprisey backup systems, usually Symantec or Veritas talking to HP MSAs.

<comment><USER3> "Everything important is in some cloud storage somewhere"

Delete one of them and then get it restored by your supplier - I assume you've done that already. I did.

</comment></comment><comment><USER37> Home - I back up the data areas. Dump the databases then run Back In Time which covers the home folder and my web folder. From that I can get from 0 to fully running in a few hours if necessary. And with Back In Time I have a usable portable copy of my stuff to take along when I need to.

At work we do regular TAR backups to external drives and SSH-rsync data to our sister office via VPN nightly. Backups are good for system restore then rsync back from remote to get to most recent.

</comment><comment><USER38> Something similar to [0] but using restic. For machines that have enough uplink, restic does its thing to S3 as well.

Sidenote: I was using Time Machine on MacOS but since I upgraded to 10.13, APFS disks are mandatorily excluded by the OS (apparently as a workaround to to some bug), so restic it is too.

[0]: (warning: jwz) [https://www.jwz.org/doc/backups.html](https://www.jwz.org/doc/backups.html)

</comment><comment><USER39> If you want something GUI-driven, deja dup or Back in Time might work for you. You can take a look at the articles I wrote on them here: [https://github.com/kororaproject/kp- documentation/blob/maste...](https://github.com/kororaproject/kp- documentation/blob/master/UsingKorora/General/Backup-Intro.md)

</comment><comment> david-cako Not Linux, but same answer as it would be.

`rsync -av --files-from=".backup_directories"` on a daily cron job.

iMac and work hackintosh rsynced to local and remote backup machine daily. Windows machine (where all my music and pictures live) both rsynced to local and remote backup machine, and Cobian'd to a second drive daily. I also will run the same Cobian backup to a cold external drive every month or so.

Deathly afraid of data loss.

</comment><comment><USER40> Bacula manages our network backups to an Overland Storage tape library. While involved to setup, I found it worthwhile given the capabilities it offers and reliability. Bacula can also backup to file system volumes if you don't have tape libraries but would still like the other features (eg encryption, network-wide backup, file catalogues, retention and recycling rules etc).

</comment><comment><USER41> Crashplan for docs/media. As for the system, I've been meaning to set up proper automatic btrfs snapshots/rsync but haven't gotten around to it yet. Worst case scenario all the docs/media are on their own RAIDZ array, so if some weird system corruption ever happens I can just reformat/reinstall.

</comment><comment><USER14> I sync data using git-annex to a home server (atom with a couple of drives) and a hosted dedicated server. Technically not "backup" since I don't store old versions.

My work files are kept in git repos which I push to the same servers.

I use Ansible to configure my machine, so that I don't have to backup system files, just the playbooks.

</comment><comment><USER42> 1\. Place desired data to back up on a drive (which may be network attached).

2\. Clone said drive to an external drive. Detach and lock it in a water/fireproof box when not in use.

3\. Swap external drive with another that is stored off site every week or two.

4\. Swap with yet another off site external drive less often (a few months).

<comment><USER43> No test to ensure proper copy?

</comment></comment><comment><USER44> Hourly incremental backup with Deja Dup saved to Synology NAS. My wife's macbook also backs up via time machine to the nas.

Synology NAS backed up daily to Backblaze B2

Dead simple to set up and maintain, and in the event that I need to restore a file or files, it's relatively fast.

</comment><comment><USER45> I have:

\- A home NAS (4x5T + 7x4T = 48T, btrfs raid1)

\- A 2U server sitting in a local datacenter (8x8T + 2x4T = 72T, btrfs raid1)

\- An unlimited Google Drive plan

I run periodic snapshots on both servers and use simple rsync to sync from the home NAS to the colo. Irreplaceable personal stuff is sent from the colo to Google Drive using rclone.

</comment><comment><USER46> I have a script that checks which external drives are connected and when it finds the correct ones it backups to them using rsync. (Only /home is backed up but it varies depending on which external drive is connected)

</comment><comment><USER47> At hime, I keep my files in a local Git repo and back it up once in a while to another drive. If I accidentally delete a file, I can get it out of git. Plus I get the benefit of Version Control.

</comment><comment><USER48> rsync /home, /etc, and a text file of the currently installed package list to my homebuilt ZFS RAIDZ2 NAS running Arch Linux. This has been enough to recover when my laptop drive fails.

Each device gets its own ZFS filesystem and is snapshotted after rsync.

FolderSync on Android does this automatically when I'm on home wifi. AcroSync for Windows. Both FolderSync and AcroSync are worth the small purchase price. Cronjobs for nix machines. iPad syncs to Mac which has a cronjob.

Stuff I really don't want to lose (photos, music, other art) are on multiple machines + cloud.

</comment><comment><USER49> My laptop: rsnapshot to local USB disk, duplicity to remote server, git push for code.

My (two) servers: dump of db, rsync of dumps and files to another server.

It's ok only because I've got little data.

</comment><comment><USER47> At my last job I used BackupPC to automate backups. [http://backuppc.sourceforge.net](http://backuppc.sourceforge.net).

</comment><comment><USER50> I use blurays to store "archived" files that I don't actively edit: music, pictures, book reports from high school, etc.

Then the usual btrfs send/receive tricks.

<comment><USER3> Do you off site them?

</comment></comment><comment><USER51> Ubuntu comes with Deja Dup which backs up files. It works fine for me. For the installed packages I use aptoncd for backing them up as an iso image.

</comment><comment><USER52> Veeam Agent for Linux is a surprisingly nice and easy-to-use image-based backup for free. Backup my two home servers to my NAS, which syncs up to Backblaze B2.

</comment><comment><USER53> I use Borg to incrementally backup /home to a Kimsufi server with a 2TB hard drive which costs around 20€/month.

</comment><comment><USER54> \- Crashplan on NAS

\- 6 month archival image of NAS to external HDD, rotated every 2 years

\- 3 month differential rsync to nearline storage, kept for 5 years

</comment><comment><USER55> # apt install backupninja # ninjahelper

</comment><comment><USER56> I just use rsync and a weekly cronjob.

</comment><comment><USER57> rdup + rdedup + rclone + backblaze b2

</comment><comment><USER58> Tarsnap for documents (rotated with tarsnapper), S3 reduced redundancy for Pictures (JPG + RAW).

</comment><comment><USER59> Tarsnap

</comment><comment><USER60> rsync -aAXv --exclude-some-stuff / /media/usb

</comment><comment><USER61> ecryptfs-mount-private

Symlink ~/.private to Dropbox/private

Per file encryption, and I do not care if Dropbox will get hacked again

</comment><comment><USER62> I use rsync with external disks

</comment><comment><USER63> Spideroak One

</comment><comment><USER64> zfs snapshots + borg</comment>


uWSGI 1.9.11 released with PyPy support - <AUTHOR> http://uwsgi-docs.readthedocs.org/en/latest/PyPy.html

<comment><USER2> Every time uWSGI comes up they impress a little more with their documentation, feature set, and performance. It is the first time in a long time I read the docs cover to cover when I have downtime to learn what cool things I have been missing.

I am new to the web programming game, but when I bought a VPS research told me this was the premiere middleware stack if I was interested in Python, and it handles just about everything else, so I kept reading to find so much cool stuff.

<comment><USER3> I'm glad the docs (among other things) are to your liking. :D

<comment><USER2> Yo, if you are one of the uWSGI guys, I spotted a typo in the notes linked above. Check out my pull request on Github when you are free.

<comment><USER3> Roberto already merged that, I see :)

I just made a PR for a pile of changes on top of that.

And I'm just a docs guy really, not affiliated with Unbit (the project's main sponsor) at all.

</comment></comment></comment></comment><comment><USER4> Benchmarks: [http://uwsgi- docs.readthedocs.org/en/latest/PyPy_benchmarks....](http://uwsgi- docs.readthedocs.org/en/latest/PyPy_benchmarks.html)

Note that the benchmarks are _preliminary_ as in there is both a lot of improvement possibility and we're not 100% sure if those are reasonable numbers. Also, the memory footprint mostly shows the base-interpreter size, your mileage may vary a lot.

<comment><USER5> very intersting link. the article mentions the possibility of pypy removing the GIL. Could anyone explain what's so difficult with GIL removal in general, and how,come pypy theoritically has this possibility while cpython does not ?

<comment><USER4> GIL removal is easy. The hard part is that locking all the structures in order to avoid interpreter crashes (which are not acceptable in a language like python) is hard. It's not impossible though, jython did that. CPython additionally has a hard-to-remove refcounting GC strategy which makes it really hard to do any sort of GIL-less CPython without a major performance hit on locking every object at every refcount.</comment></comment></comment>


Samsung's 970 EVO SSDs Reviewed – 500GB and 1TB - <AUTHOR> https://www.anandtech.com/show/12670/the-samsung-970-evo-ssd-review <comment><USER2> On an only sort-of related note, has anyone found a USB (or anything else external) adapter that can read these yet?

I know why it's hard, and I know about the ones that read that form factor but not NVMe drives, and why that is. Just curious if my searches are coming up dry because they don't exist or because they're getting flooded by the results that match the search but don't work.

I enjoy the performance of the drive I have but it makes me nervous that the only thing in my house that can read it is the laptop it is in. If push came to shove I could create some options, but the best would be a stand-alone reader, like you can get for basically every other kind of storage tech.

<comment><USER3> As another user stated Startech makes one and I use it as a technician. It's not fast at all... it's mainly for recovery when you don't have a motherboard with an available M.2 slot you can still pull the data off it.

For that purpose it does the trick. The drive is capable of speeds 100x above USB 3.0 so there really isn't good to use that bus for anything other than emergency.

\- Here is an image of the circuit it uses (ASM1163E Controller) [https://i.imgur.com/ZmwppR4.jpg](https://i.imgur.com/ZmwppR4.jpg)

\- I can't find that IC anywhere but here's the closest thing: [http://images.100y.com.tw/pdf_file/35-Asmedia- ASM1042A.pdf](http://images.100y.com.tw/pdf_file/35-Asmedia-ASM1042A.pdf)

PCI-E to USB 3.0 host bridge. Hopefully that helps.

<comment><USER4> Do you have a product number for the Startech adapter? The reviews I can find for current products say they do not work with the PCIe based Evo SSDs.

> PCI-E to USB 3.0 host bridge

Close, but this is the other direction, from PCI to USB.

<comment><USER4> No cigar, it's a USB -> SATA interface, the newer drives would need a USB -> PCIe. [https://web.archive.org/web/20170706000700/http://www.asmedi...](https://web.archive.org/web/20170706000700/http://www.asmedia.com.tw/eng/e_show_products.php?cate_index%3D97%26item%3D133)

</comment></comment></comment></comment><comment><USER5> Do these drives feature power-loss capacitors? I'm still wondering why most manufacturers think it's okay to offer SSDs that lose data on power loss (!!)

<comment><USER6> I really wonder why a $10 capacitor add-on (a capacitor, a diode, two connectors) plugged in between main board power supply and a disk power receptacle is not a common item.

Or maybe it is, but I have no idea?

<comment><USER7> A common minimum voltage requirement for the nominal +5V supply is 4.5 V. Let's assume a voltage below that won't damage the drive, but it won't operate.

The diode is going to drop 0.6V, leaving you with only 4.4 V max for the drive. Then the capacitor is going to immediately start dropping in voltage as soon as you start pulling the stored energy out of it.

So, in practice, to do a quality job of this it will probably need a DC-DC converter. These aren't necessarily expensive, but definitely more complicated than the old diode trick.

<comment><USER6> This makes sense! OTOH low-drop diodes do exist [1], and the drive likely needs just a (small) fraction of a second to flush the caches; it's SSD, not need to wait for the disk to rotate to the right position or move heads. I suppose the power loss signal from the controller still propagates, even if the computer's PSU plug is just yanked out of socket.

[1]: [https://electronics.stackexchange.com/a/282471/9909](https://electronics.stackexchange.com/a/282471/9909)

<comment><USER8> The caches on some SSD's can be multiple gigabytes.

They also frequently cache data which can be difficult (slow) to write, for example a single modified 4kb page which is part of a large unmodified area. Completing that write would involve reading the original data, erasing the entire erase-block, and rewriting the new data.

SSD's with built in power loss prevention typically reserve an area on the SSD which is pre-erased ready to dump the contents of the cache into. Then on powerup, they reload the cache and properly flush the data to the actual place it's supposed to be.

</comment></comment></comment></comment></comment><comment><USER9> I really wish there was a little more effort put into this "article", the 970 PRO and EVO spec tables aren't very useful. They would be a lot more helpful if they included the 960 versions for direct comparison or even if they were side by side so the EVO and PRO could be directly compared.

</comment><comment><USER10> real benchmarks are here: [https://hothardware.com/reviews/samsung- ssd-970-evo-and-pro-...](https://hothardware.com/reviews/samsung-ssd-970-evo- and-pro-review)

</comment><comment><USER11> Hoping this reduces used 960 EVO/PRO prices. Not a whopping improvement.

<comment><USER12> I bought a 500GB 960 EVO on sale for $200 last week. Now I know why it was on sale.

</comment></comment><comment><USER13> I just changed my work video editing workstation order. I will have two 970 EVO NVMe for my OS and Project drives. There actually is a bottle next with raw 4K, 5K and 8K Video and playing it in an editor.

<comment><USER14> I'm curious about the specs required to edit raw 4K video. What's your workstation order like?

<comment><USER13> Here is a great article for Davinci Resolve (Industry standard for color grading) [https://www.pugetsystems.com/labs/articles/DaVinci- Resolve-1...](https://www.pugetsystems.com/labs/articles/DaVinci- Resolve-14-GPU-Scaling-Core-i9-vs-Xeon-W-vs-Dual-Xeon-SP-1121/#4KMedia- LivePlaybackFPS\(RAWDATA\))

The issue is after you have done a few processes on the video for color balance and grade things can just grind to a halt.

<comment><USER15> I searched through the article and didn't see much discussion at all on storage as a bottleneck. If it actually is a bottleneck, is color grading more of a sequential or random data access workload?

</comment></comment></comment></comment><comment><USER16> The PRO table doesn't specify any RAM in it. Does it mean that it's not going to lose data on power loss?

<comment><USER17> SLC caching, so hopefully not? But I think you'd have to test this.

<comment><USER18> I have no idea whether Samsung uses it, but the NVMe spec allows a device to request use of _host_ memory for caching. It's considered a low-end feature, since it's slow and inherently volatile. It's called "host memory buffer" for those who are curious.

<comment><USER19> Volatile is ok, as long as it honors barrier commands.

<comment><USER18> I think the bigger issues are bandwidth and power consumption. If software is doing heavy IO, it doesn't really want to have to contend with the HMB for PCIe and memory bandwidth.

Also, a DRAM chip is a DRAM chip. I'd rather pay a couple dollars for a local DRAM chip in the NVMe device than a couple dollars for extra host RAM that will be permanently reserved for the HMB.

<comment><USER16> The heavy IO case is addressed by write-back characteristic of block devices. In the end, the cache is in host RAM regardless of the underlying device type.

<comment><USER18> I think you may be misunderstanding the issue. A flash controller that tries to look like a block device needs to manage a mapping between logical and physical blocks along with various other pieces of metadata. The on-flash representation needs to be structured in a flash-friendly way, which often means that it's not efficient to find the metadata needed to process an IO request unless that metadata is cached in memory.

On an HMB device, the metadata will be cached in _host_ memory, which will likely adversely affect performance and power efficiency.

</comment></comment></comment></comment></comment></comment></comment><comment><USER20> White plastic on a controller microchip? Few month ago I saw an orange chips on Mediatek devkit.

A new trend it seems?

<comment><USER21> Well it is a 3D rendering, and that color might suggest the device has a metal heat spreader not a colored plastic molding.

<comment><USER22> The Anandtech review says it's nickel plated. The sticker is also a copper heat spreader:

"The Samsung Phoenix controller introduces a nickel-coated heatspreader, and the 970 EVO retains the copper foil layer in the label on the back of the drive that was introduced with the 960 generation, but there are no more serious cooling measures on the drive."

<comment><USER20> Oh, I'm such an inattentive reader.

</comment></comment></comment></comment><comment><USER23> For those looking, here's the full anandtech review that also came out today. [0]

@dang maybe change the link as the review is a superset of the announcement.

[0] [https://www.anandtech.com/show/12670/the-samsung-970-evo- ssd...](https://www.anandtech.com/show/12670/the-samsung-970-evo-ssd-review)

<comment><USER24> Sure, changed from [https://www.anandtech.com/show/12674/samsung- announces-970-p...](https://www.anandtech.com/show/12674/samsung- announces-970-pro-and-970-evo-nvme-ssds). Thanks!

(It's best to email firstname.lastname@example.com to tell us things, though — I only saw this by accident.)</comment></comment>


Ask HN: A Cloud Platform that will Revolutionize Healthcare and every other field - <AUTHOR> www.gyrcon.com Gyrcon is an IoT cloud platform that will revolutionize healthcare, agriculture, business and every other field you can think of.
The idea of Gyrcon is to allow people to connect their devices (including cars and home...) to a big community of Apps and Services that will allow you to add new abilities to your devices.
I'm looking for feedback from you: 1- When you read the headline, what are your first impressions of the startup? 2- After reading the whole page, do you feel encouraged to subscribe? if not what's the one thing that if existed will make you never hesitate to write your email 3- What's the one feature you think will make Gyrcon's platform different than any other platform 4- Any additional feedback/expectations?
Thanks for your time <comment><USER2> This should probably be under Show HN

<comment><USER3> I disagree because the post appears to be an email harvesting page with nothing to play with or try out. The questions the the OP asks are a survey about subscribing to email lists not the product.

<comment><AUTHOR> We're validating the product and trying to see if people are interested or not before we launch. But can you mention what you didn't like?

<comment><USER3> The web page was completely disrespectful of my time.

<comment><AUTHOR> can you tell me how to make it better?

<comment><USER3> Focus on creating value for other people.</comment></comment></comment></comment></comment></comment>


In weekend outage, Dexcom G6 diabetes monitors fail to send crucial alerts - <AUTHOR> https://www.nytimes.com/2019/12/02/well/live/Dexcom-G6-diabetes-monitor-outage.html <comment><USER2> This should be using the local network and/or Bluetooth instead of depending on the cloud. Curious as to how it got certified to begin with - surely this failure mode should've been known by anyone with even a basic understanding of technology.</comment>


Aquantia Launch AQtion 5G/2.5G/1G Multi-Gigabit Ethernet Cards for PCIe - <AUTHOR> http://www.anandtech.com/show/11368/aquantia-launch-aqtion-5g25g1g-nics <comment><USER2> Im really surprised that >gb ethernet has taken so long to make it into the consumer realm.

These NICs are a start, but there wont be wide adoption until >gb ethernet is integrated into mainstream southbridges.

<comment><USER3> Its kind of a chicken and egg problem. I'm not aware of any consumer 2.5/5G switches, and 10Gbase-T switches are still more than 10x as expensive as 1Gb/s switches.

There's also the lack of a compelling use case. Most consumer NAS boxes are still based on spinning drives, and 1Gb/s is still a reasonable match for a spinning drive.

I've had 10GbE equipment in my house for about 12 years (I worked remotely and did drivers for one of the first 10GbE NICS), but I've never had > 1 Gb/s equipment in anything but lab equipment. Eg, not in my home desktop / NAS server, etc.

<comment><USER4> There are some NASs with 2x1 GB ethernet connections, which suggests to me there's at least some demand.

<comment><USER5> I'd bet that's actually a part of what is restricting general demand for 1gbit+ NICs on consumer gear. How many consumer or prosumer applications actually exist where 1gbit/sec isn't sufficient, but a pair of bonded 1gbit/sec NICs _still_ isn't enough? Link aggregation is commonly enough supported and easy enough to configure for the kind of audience who needs it that I suspect this covers much of the demand which might otherwise be served by 5gbit or 10gbit NICs natively.

</comment></comment></comment></comment><comment><USER6> I'll wait until Realtek releases a 3 USD 5-Gbit ethernet NIC chip.

</comment><comment><USER7> So are there competing standards for 2.5, 5 and 10G over copper or are the copper standards flexible so you will be able to connecto to standard 10G switches with slower speeds?

And why is sub-5G interesting, isn't the performance end of ethernet at 40G/100G since years ago?

<comment><USER8> Because 2.5G works over 100 meters of cat5e and 5G works over 100 meters cat6, so this can be used on existing cabling that's currently limited to 1G.

This doesn't really matter in data centers and backbones (which is where you see 40G/100G), but it can be useful in access networks (offices, classrooms, etc.) where the business doesn't want to replace existing cable plant.

<comment><USER9> Also 2.5G is interesting for 802.11ac Wi-Fi APs that provides bandwidth >1G. No need for port aggregation.

<comment><USER10> Net bandwidth on 802.11ac is nowhere near real 1Gbps though. Most i got out of a good 802.11ac AP that claimed 1,3Gbps was ~500-600Mbps in the real world on very close distance and it falls off pretty fast. Even the ones claiming nearly 2Gbps can't reach real 1Gbps afaik. Still very nice, but Wifi has a lot of overhead.

<comment><USER11> The problem is that a lot of access points advertise n Gbps but that refers to full system bandwidth on multiple channels and such so you got somewhere close to what they were really expecting you to get. Heck, my Ubiquiti Unifi AC Pro can get me a bit over 800 Mbps without a problem in bursts (and it advertises well over 2 Gbps) but the nature of wifi networks is that I won't get that sustained for very long. For home server uses that most people don't have, I absolutely won't be able to work off a pure wireless network for many reasons.

</comment></comment></comment></comment></comment><comment><USER12> Cheaper to get an Intel copy direct from China: [http://m.ebay.com.au/itm/NEW- Intel-X540-T1-OEM-10G-RJ45-1-Po...](http://m.ebay.com.au/itm/NEW- Intel-X540-T1-OEM-10G-RJ45-1-Port-S-Ethernet-Converged-Network- Adapter-/292072461278?hash=item4400e013de%3Ag%3A1LoAAOSwCU1Y3mAj&_trkparms=pageci%253A461441e3-39f6-11e7-98af-74dbd1804a97%257Cparentrq%253A0fac18e815c0a88b091063a2fffecae6%257Ciid%253A4)

(Obviously you don't get the adavantage of long range at lower speeds, but the vast majority of people just want faster data transfer in the same room).

<comment><USER3> There seem to be genuine, but used, 10G NICs from many vendors under $40 (Myricom, Mellanox, Chelsio) which might be a cheaper option for a home lab setup. Even 10Gbase-SR SFP+ modules are cheap used, but for a 2 card setup, I'd go CX4 or SFP-DA / Twinax. Most of the failures we see at work in the field around 10GbE or 40GbE hardware is the SFP+ / QSFP modules.

</comment></comment><comment><USER13> The fun thing is that the 802.3bz standard don't refer to Cat5e or Cat6 but describe the requirements in the standard itself. I wonder if this is due to marketing, for example see Kamal Dalmia's comment in: [http://www.anandtech.com/comments/10908/aquantia-launches- ne...](http://www.anandtech.com/comments/10908/aquantia-launches- new-2g-5g-multi-gigabit-network-controllers-for-pcs)

</comment><comment><USER14> Hmm. I thought that 2.5Gbit was going to be a single channel. It appears the final 802.3bz spec is 4 channels, basically a 10Gbit at lower clocks. I didn't expect this.

Would be interesting to know more on the tradeoffs between the two approaches. How much silicon does four channels going 1/4 take, and using how much power, versus a single higher speed channel?

<comment><USER15> Running at lower frequency is how 2.5G can get longer range on cheap cables.

</comment></comment><comment><USER3> Does anybody know what the power draw is for 10Gb/s mode? The early 10Gbase-T phys pulled ~10w. I know things have gotten considerably better, as I'm finding press releases from 2013 talking about ~1.5w. Has that improved any?

<comment><USER3> Found their datasheet too late to edit the above: "6 W at 10 Gbps, 4W at 5 Gbps" from [http://www.aquantia.com/wp- content/uploads/AQN-107%20Brief%2...](http://www.aquantia.com/wp- content/uploads/AQN-107%20Brief%20051117.pdf)

</comment></comment><comment><USER16> What's that supposed to mean? Binary only, closed source kernel module?

>>> Drivers for both cards will be available ... as well as varieties of Linux (3.10, 3.12, 3.2, 4.2 and 4.4).

<comment><USER15> The Linux driver is upstream although they may also provide backports.

</comment></comment><comment><USER17> >>> Today's announcement cements Aquantia's lead in the multi-gigabit Ethernet space, despite already having an apparent 2 year lead over other rivals in this space.

Going into a market that everyone avoided on purpose is not a lead.

The cards are worthless without the adequate switches, that will never happen because the effort is on 10 gb.</comment>


Django 1.8.2 security release patches unusually dangerous bug – update ASAP - <AUTHOR> https://www.djangoproject.com/weblog/2015/may/20/security-release/

<comment><AUTHOR> This is an unusually dangerous security bug. Definitely agree with the Django team that all users of Django 1.8 should upgrade as soon as possible.

</comment><comment><USER2> Adding to my list of security vulnerabilities that static typing would have prevented.

<comment><USER3> Isn't an empty string still a string?

<comment><USER2> Right, the issue here is just using null or "". You could use an Optional or Maybe type here. Even better you could define:

        data SessionKey = ValidSessionKey | InvalidSessionKey

Then the developer making the modification code would have been much less likely to type "InvalidSessionKey" whereas the None/"" behavior is just an idiom. The problem here is that the domain knowledge of: "" is a valid session

wasn't communicated by the code.

</comment></comment></comment><comment><USER4> still stuck on Django 1.6.x; also stuck with Python 2.7.x; fear is the order of the day when it comes to upgrades.</comment>


Web Hosting Dilemmas: Who To Avoid - <AUTHOR> http://www.sofamoolah.com/blogging/web-hosting-dilemmas-who-to-avoid/

<comment><USER2> A couple of things:

If you follow tech news, you'll notice that every major cloud based service has experienced some level of down time, so while you should "avoid" shared hosts like HostGator (I think this goes without saying), you shouldn't expect that just because you go with a cloud service like MediaTemple, Amazon, Heroku, etc, you don't need to plan for possible outages. MT also had their fair share of issues back when they were getting started. Amazon has had some well publicized issues. Both of these wouldn't be an issue for those who engineer their systems properly.

It's hard to beat simplicity when it comes to reliability. We don't need the scaling capabilities of cloud services, so we go with simple VPSs. Our primary hosting is straight forward VPS systems hosted with a provider colocated at Colo4 in Dallas. I've had systems with them for 5 years now and I've never experienced a failure. We still maintain redundant services in a Freemont data center just in case.

</comment><comment><USER3> HostGator does random license/identity checks on customers? What kind of idiocy is that?

If you sell an service with 'instant' in the name, it had better be. Let them get started instantly. If you want to do random checks on content, go for it. But don't piss off your customers before they've even started. Especially if they've got any weight in the industry.

<comment><USER4> HostGator is also one of the largest consumer-facing web hosts for small sites. They don't require these checks from everyone, just orders flagged as high risk.

I'd imagine they're flagging these orders using a third party risk verification/fraud detection service. Sofa Moolah is registered in Australia, and International orders are a high indication of risk - especially as Australia's region of the world includes Malaysia (huge hotbed of credit card fraud).

Given the very large amount of fraud in web hosting (people ordering using fraudulent credit cards, that can result in $20-50 chargeback fees for that $8 account), it's not unreasonable to ask for verification. Annoying, but not unreasonable.

<comment><USER3> They specifically told him he was randomly selected. Yes, he picked the 'high risk' web hosting choice, but that's no reason to give him lousy service.

They could have come to the same end as far as service checks go without pissing him off and losing him as a customer. Not to mention everyone he tells.

If all they are worried about is the chargeback, they should have enabled his account immediately, then started running the checks. If he fails the checks, THEN you disable the account. What would it cost them? Like $.20? Instead, this way cost them at least 1 serious customer.

</comment></comment></comment><comment><USER5> OR you could get a VPS slice at linode and set it up for yourself, one day of work, but if you're serious about your product, it's well worth it!</comment>


Libcurl remote code execution - <AUTHOR> http://blog.volema.com/curl-rce.html <comment><USER2> This is nasty but fortunately it only affects fairly recent versions of curl, specifically curl 7.26.0 up to and including 7.28.1. That means Debian Stable and Ubuntu 12.04 aren't affected.

As a general rule, if you use libcurl in an application and follow redirects you should probably restrict CURLOPT_REDIR_PROTOCOLS to just HTTP and HTTPS (and maybe FTP). Otherwise a nefarious site could redirect curl to, for example, a IMAP, POP, or SMTP URL, which is potentially undesirable even without this vulnerability. If you're just using curl to talk HTTP(S) you really don't need any of these other protocols.

<comment><USER3> Why does curl even allow that?

</comment></comment><comment><USER4> Regarding version numbers, I'll mention something here that I used to have to tell customers in the web hosting biz all the time: stuff sometimes gets backported and version numbers don't tell the whole story. For instance, RHEL 5 has "curl-7.15.5-15.el5" right now, and that would suggest it doesn't support either of the CURLOPTS required to disable this.

However, the actual build loops in a patch called curl-7.15.5-CVE-2009-0037.patch, and that adds in all of the CURLPROTO_* magic required to lock down an application. I discovered this tonight when updating my client-side code to restrict redirects and found that it would build fine on RHEL 5 even though I expected it to die. A little digging around in the source RPM explained it.

So, if you're on an OS like RHEL and you think you might not be able to use this feature, try looking in your curl.h file. You might actually have support courtesy of some backported patch from your distributor.

</comment><comment><USER5> Somebody wrote new code which uses strcat() in 2012 (the commit which introduced that bug was written in June 2012)? That's.. wow.. unbelievable.

<comment><USER6> Is this kind of stuff not code reviewed?

<comment><USER7> It's an open source project, you are free to do so if you have the time or the need, and contribute back any corrections.

<comment><USER6> I guess I'm just idealistic, but I would think for something this security sensitive or important (see "Fixing" TWO in glibc), they would have code reviews before anything could be committed.

In this case, a automated system rejecting anything that uses the non "n"(strcat vs strncat, etc.) version of the string functions in C would have worked.

<comment><USER8> If you expect code reviews and automated tests for an open-source product that's developed in spare time for no money, you can go to this page (<http://curl.haxx.se/donation.html>), click the PayPal button, and be very very generous.

</comment></comment></comment></comment></comment><comment><USER9> If there's anyone using my Requests for PHP library [0], just an FYI that it is not vulnerable to this as it handles redirection outside of cURL and double-checks all URLs. That said, I'll be pushing some commits momentarily to ensure that this is also forced via CURLOPT_PROTOCOLS inside the cURL transport.

[0]: <http://requests.ryanmccue.info/>

</comment><comment><USER10> I've been reading more about security lately, and one thing I don't understand is how buffer overflows allow for true RCE these days. I believe all modern processors support having non-executable pages; why is any program-writeable page executable? Especially in C, where there's no JIT. It also seems like address space randomization would make RCE pretty hard.

Obviously they can still arbitrarily write the instruction pointer, which is very bad and possibly bootstrappable into fully RCE, but I still see more conventional RCE described in recent books and wonder if and why it's still doable.

<comment><USER11> Here you can read about defeating the protections you mentioned: [http://www.blackhat.com/presentations/bh- europe-09/Fritsch/B...](http://www.blackhat.com/presentations/bh- europe-09/Fritsch/Blackhat-Europe-2009-Fritsch-Buffer-Overflows-Linux- whitepaper.pdf)

</comment></comment><comment><USER12> So apparently cURL speaks POP3. I had no idea until seeing this. This might be useful to know for future projects.

<comment><USER13> FYI, `curl --version` shows all the protocols it supports

<comment><USER11> On my Debian Squeeze I get the following:

        $ curl --version
        curl 7.21.0 (x86_64-pc-linux-gnu) libcurl/7.21.0 OpenSSL/0.9.8o zlib/126.96.36.199 libidn/1.15 libssh2/1.2.6
        Protocols: dict file ftp ftps http https imap imaps ldap ldaps pop3 pop3s rtsp scp sftp smtp smtps telnet tftp
        Features: GSS-Negotiate IDN IPv6 Largefile NTLM SSL libz

Looks pretty impressive.

</comment></comment></comment><comment><USER14> Thus illustrating, once again, that the C programming language is unfit for network-facing software and that using it in that role is irresponsible.

<comment><USER13> What is a suitable alternative?

<comment><USER15> C++. I hate it, it has its own host of problems, and memory corruption is certainly still an issue there, but the most common issues that plague C apps won't plague properly written C++ apps/libraries. C's string handling (or lack thereof) has cost the world an immeasurable amount of time and money.

The biggest advantage that C++ has over just about everything else, is that you can use it to write libraries usable from everything else, and you can do it very easily. You can expose a C-style API trivially, and bind it to everything you want; that advantage can't be overstated.

While I'd love for everything to be written in pure safe, managed code, that's not viable right now. C++ is the best alternative we have, when safe languages aren't usable for the task.

<comment><USER16> > the most common issues that plague C apps won't plague _properly written_ > C++

or properly written C, either. :-)

</comment></comment></comment></comment><comment><USER17> I hate the fact that most of the C standard library needs to be ignored due to buffer overflow/security issues. I nearly always use the cross platform "Safe C Library" anytime I do something in C: <http://sourceforge.net/projects/safeclib/> <http://www.drdobbs.com/cpp/the- safe-c-library/214502214>

</comment><comment><USER18> I guess I'm just a dumbass, but does the linked PoC do more than just overwrite EIP with 'A'? Is the payload left as an exercise for the reader or is this a working example and am I missing something clever?

<comment><USER19> The stack was overwritten with 'A's, and thus upon returning from a function the return address consisted entirely of 'A's, which is why EIP is now filled with it.

A clever hacker would use this to jump into some malicious code instead; that's how stack overflow exploits usually work.

So, yes, the actual payload is left as an exercise for the reader, but this shows that there's already everything there to make it possible.

<comment><USER18> Oh OK, then I did see correctly after all. But still, on many modern systems (e.g. with non-executable stack) it would require fairly sophisticated trickery in the payload to make this do anything. I mean, getting control over EIP is a very good first step, but this isn't 1995.

<comment><USER20> Control over the program counter allows return-into-libc or other ROP attacks.

</comment></comment></comment></comment><comment><USER21> Seems OS X 10.8.2 is unaffected.

        curl --version

Gives me 7.24 or so.

</comment><comment><USER22> Mitigation: wget.

<comment> X-Istence Not having wget installed stops about 60% of the PHP shell scripts I've seen dropped on servers.

<comment><USER23> Not having PHP installed stops 100% of them.

<comment><USER24> Less snarky and more portable option: avoid webserver-writeable directories.</comment></comment></comment></comment>


Quote Selected Text lab has disappeared in Gmail - <AUTHOR> https://productforums.google.com/forum/?utm_medium=email&utm_source=footer#!msg/gmail/2VzFN09XHgs/QsCUYMvVBAAJ <comment><AUTHOR> High level of dissatisfaction on Google Groups, and yet, Google does not respond. WTF?

We should request a lot of people here on HackerNews to go to "Settings" -> "Send Feedback" and let Google know what a ridiculously stupid thing this is.</comment>


Why Your Health Insurer Doesn't Care About Your Big Bills - <AUTHOR> https://www.propublica.org/article/why-your-health-insurer-does-not-care-about-your-big-bills <comment><USER2> This is messed up on so many levels.</comment>


Some advice from Jeff Bezos - <AUTHOR> http://37signals.com/svn/posts/3289-some-advice-from-jeff-bezos <comment><USER2> _If someone can't climb out of the details, and see the bigger picture from multiple angles, they're often wrong most of the time._

This works both ways. If someone can't get more than one level below the surface and understand the details that form the whole, they're also often wrong much of the time. Just ask any boss I've ever had.

<comment><USER3> Couldn't agree more. This is one of those reasons why I desist have lawyers, media gurus, MBA (just business) as bosses of "Tech" companies.

They just don't have it in them to jump in and out of situations to think through the most trivial of problems from multiple angles. They don't know in "5 seconds" if something can be done or if it's complicated. It's often a rush to tackle competition or cutting out the oxygen and "do whatever it takes". Ordering subordinates to "deliver" in 3 weeks.

This is precisely the reason why I love someone like Larry Page or Sergey running Google. They just knew that recruiting Urs Holzle to build world class infrastructure early on was worth it.

A lifetime of learning to take noise in & conclude on the one signal that's worth it.

<comment><USER4> I started as a programmer and got an MBA from an ok school (top 20). The combination is very valuable (at least to me) for exactly the reason you cite: the best decisions require wading around in the mucky details.

The MBA gives you a few tools that are helpful, but mainly it's a way to brand yourself and have people give you the benefit of the doubt that you can do things other than strictly build stuff.

I personally think the anti-patterns you describe-- the "do whatever it takes" without having the first idea what that is-- are intellectually dishonest and a sort of management-by-roulette. Sometimes you get lucky and it works out, but I don't know how you'd sleep running things that way.

<comment><USER5> Oh really, what did the MBA teach you? What tools are useful in your arsenal of building a great business and product?

<comment><USER6> I also got my MBA after getting my BS in Computer Science and while I think I could have learned most everything we talked about by reading books, I _did_ learn:

\- public speaking because we had to do a presentation just about every other week

\- how business people with little or no technology experience think and their perceptions about technology

\- how to talk to the people in the above bullet about technology

\- firing people because one of my groups had a member that was not pulling her own weight, and we were told to fire her from the group

I also agree that the branding aspect is also (somehow) helpful. I recently moved from Florida to SF and when I was looking for jobs you wouldn't believe how many people were _really_ excited/impressed/whatever that I had an MBA in addition to being able to answer the tough software questions.

If I had a choice to go back and either spend $50k on an MBA or spend it traveling the world, I would definitely choose the latter, though.

<comment><USER7> I almost got an MBA in my twenties but decided to start a company instead. My reasoning was that it would cost me $40-50k to acquire, at which point I would need to take a job for 3-4 years to pay it off. I always knew I wanted to start a company so I figured I'd use those 5-6 years educating myself.

I don't regret the choice, but I think an MBA from a top school can expose you to more complex and big $$$ business environments than you're likely to discover on your own as an outsider without much experience.

</comment></comment></comment></comment></comment></comment><comment><USER8> I would argue that this is _the_ defining factor in what makes someone intelligent or not. If you're always revising your ways of thinking about a problem, your probability of converging on a solution is vastly greater than someone with a narrow, one-track focus. In fact, another article on the HN homepage ([http://blogs.scientificamerican.com/streams-of- consciousness...](http://blogs.scientificamerican.com/streams-of- consciousness/2012/10/18/how-do-you-spot-a-genius/)) elaborates on this point of trying multiple "solution paths" to arrive at an answer to a problem.

Unfortunately, the vast majority of people get it in their head that they've discovered the "right way" and dismiss every other idea. This problem is particularly notorious in subjects like quantum mechanics. The field is so confusing that people find some kind of local comprehension maximum that they get stuck in and refuse to budge from that sort of ideology (which is often the _wrong_ ideology by the way since QM is such a deep subject. Throw some quantum field theory or standard model physics at a quantum chemistry professor or TA and they won't know what to make of it).

To give a more concrete example: did you know that a spinning ball weighs more than the same ball when it is stationary? Tell this to someone decently knowledgable in physics and there's a good chance they'll argue vehemently against you based on their misunderstanding (or misinformation) of what they've learned in the past. Sometimes the effort to convince someone of an idea like this isn't worth the time; these people are locked into one way of thinking and take it as an affront to their ego. There's limited intelligence here. Don't want to be like this? Don't get angry when someone challenges you. That's the best way to start. I've never understood why so many people get upset if you try to point out a flaw in their reasoning. I've noticed this sort of anger much less frequently on HN (on the other hand, there's significantly more "you're wrong" posts than a normal discussion board).

In fact, do a little experiment if you wish. Look through HN stories and find places where people challenge each other in the comments. If you notice someone who says "you know what -- you're correct" or "yeah, that makes more sense", there's a good chance they make a lot of intelligent posts on here. If you find someone that _never_ concedes to anyone else, it's likely they are locked into one and only one way of thinking and are unlikely to ever do anything considered "genius".

<comment><USER9> Great comment. I appreciate the principle you're working towards, and largely agree with it. But I wonder if the analogy with Physics works well as a broad metaphor for "intelligence." The gaps between Newtonian, Quantum and Relativity model physics are singular instances of a peculiar, nearly paradoxical set of apparent contradictions that of course have yet to be fully resolved. Each is correct within its own domain, and the full realization of the implications of each requires complete commitment to the rules within the domain to the exclusion of the other models.

So the analogy can also turn around and bite you here. If a researcher in Quantum theory were to get hung up on the apparent contradictions between her own research and the implications within one of the other models, she'd risk being distracted and lose the fruitful path of research within her given domain. In this case, a certain level of myopia is helpful.

Did Einstein's tremendous resistance to Heisenberg and Bohr impugn his accomplishments in any way? Of course not. I don't think anyone would use that as an example of diminished intelligence on Einstein's part.

Your broader point is valid: be open to other viewpoints. But at another level, taking up a position and defending it has its practical advantages, when the position/opinion shows fruitful results.

In software, I think of DHH's 'opinionated' approach to Rails and how that has informed and guided the whole Ruby community. For many programmers Rails' implicit, "magical" approach to coding is not as good as, for instance Django/Python's more explicit philosophy. Both points of view are valid, but the strengths of each would be diluted if they tried to do both. I also think of the Torvalds/Tanenbaum debate over Kernel architectures. Deciding which is correct is way above my pay grade, but it seems clear to me that Linus had to take up a position here and commit to it in order for Linux to thrive the way it has.

I also think of the common criticism of JavaScript's OO structures, that it's a confusing hybrid of Prototypical and Classical OOP, leading to inconsistent or confusing structures. Perhaps a thorough commitment to one or the other would have been better?

So, on the one hand a certain openness and teachability is necessary, but then at strategic points in the development of an idea, a certain stubbornness and myopia seems to be equally important to the ultimate execution of a vision.

<comment><USER10> A quote from Zen and the Art of Motorcycle Maintenance comes to mind:

> You are never dedicated to something you have complete confidence in. No one > is fanatically shouting that the sun is going to rise tomorrow. They know > it's going to rise tomorrow. When people are fanatically dedicated to > political or religious faiths or any other kinds of dogmas or goals, it's > always because these dogmas or goals are in doubt.

<comment><USER11> ..or, you are seem fanatically dedicated to something because you are trying to defend the fact that the sun is going to rise tomorrow. :) I read recently that a great way to test a persons understanding of a problem, is to ask them to argue for the opposing point of view.

</comment></comment></comment></comment><comment><USER12> "A foolish consistency is the hobgoblin of little minds" - Emerson.

When I first read that quote in early High School I didn't understand it. It was the kind of thing that ate at me, I could not get what he was trying to say. To me, consistency was an important part of life; the old adage that you stick to your word. However, that quote transcends the idea of being consistent, because when you often make decisions without all of the information (especially in startups). As new information becomes available, you have to incorporate it into your decision. Sometimes it makes you look like a dick, or someone that doesn't know what direction they want to go to, but that's where different skills (leadership and sales) come in to be able to hold people together.

<comment><USER13> To be inconsistent is the easiest thing in the world: just refuse to think about the meaning of what you believe or do. I don't think the point of Bezos's remark was that we should aspire to be inconsistent, but rather, we should be open to considering that our ideas might be wrong.

A better quote for this idea: "Contradictions do not exist. Whenever you think you are facing a contradiction, check your premises. You will find that one of them is wrong."--Ayn Rand

<comment><USER14> 'Contradictions do not exist' is nonsense. Contradictions exist all over the place. Any time you get two people together you'll have contradictions due to viewpoint, experience, perspectives. Denying that contradictions exist is a child-like view of the world. Working with the contradictions of life, now that's the fun and the challenge, isn't it?

<comment><USER13> "Anyone who denies the law of non-contradiction should be beaten and burned until he admits that to be beaten is not the same as not to be beaten, and to be burned is not the same as not to be burned."--Avicenna

<comment><USER15> A human brain is but a finite machine, therefore there are only finitely many propositions which you believe. Let us label these propositions p1, p2, ..., pn, where n is the number of propositions you believe. So you believe each of the propositions p1, p2, ..., pn. Yet, unless you are conceited, you know that you sometimes make mistakes, hence not everything you believe is true. Therefore, if you are not conceited, you know that at least one of the propositions, p1, p2, ..., pn is false. Yet you believe each of the propositions p1, p2, ..., pn.

<comment><USER13> Humor?

</comment></comment></comment></comment></comment></comment><comment><USER16> Keeping an open mind is a great philosophy, so long as your mind doesn't change so quickly that no one can coordinate actions with you. But I'm having a difficult time inferring the significance of this post.

On the one hand, if I'm constantly changing my mind, and my mind tends to change toward a stable, slow-changing correct solution, by definition, I'll be "right a lot", so long as I've had sufficient time to converge. In any case, I'll be right a lot more than either a person whose mind does not tend to change toward the correct solution, or someone whose mind does not change. This seems true by definition.

On the other hand, if the correct solution changes rapidly and dramatically, and my mind does not change as quickly, I will trivially be wrong a lot.

Likewise, focusing too much on "details that only support one point of view" seems wrong by construction, unless you magically pick the right point of view to begin with.

I'm not trying to be snarky here, seriously. I just feel like I must be missing the significance. I've reread the post several times, but I don't see it. Perhaps someone could enlighten me?

<comment><USER17> As Keynes said, "When my information changes, I alter my conclusions. What do you do, sir?"

When I was younger, I didn't know what confirmation bias was. I had to be introduced to the concept. After being introduced, I was able to make better decisions. Although it may seem trivially true to you (now?), it's not to everyone.

You may be reading more into "change their minds a lot" than is intended. A lot in this context means "more than most people". There's a reason phrases like "strong opinions, weakly held" become popular in rationalist circles. It's an emphasis on better decision making.

I think the first time I heard about this idea was in Marilyn vos Savant's Brain Building. She argued that societal infatuation with "having the courage of your convictions" is not the redeeming quality it's made out to be. She mentioned that she could always give her opinion on an issue, but she was also always prepared to change her opinion upon new information.

I'm pretty sure Bezos does not mean you should change your mind 180 degrees at each new contradictory piece of information. Like a Bayesian spam filter, if you've had lots of pieces of evidence for one position, it should take lots or very significant new evidence to change that position.

Decision making biases of various sorts are my chief pet peeve in modern life. It's almost impossible to discuss public policy with people, even in the smartest online forums I know. I think it's banned at Less Wrong. When I listen to the media, I spend most of my time ticking of the biases I hear.

<comment><USER18> >When I was younger, I didn't know what confirmation bias was. I had to be introduced to the concept. After being introduced, I was able to make better decisions.

Hah! You only think that because you're not counting the bad decisions.

>Decision making biases of various sorts are my chief pet peeve in modern life. It's almost impossible to discuss public policy with people, even in the smartest online forums I know. I think it's banned at Less Wrong. When I listen to the media, I spend most of my time ticking of the biases I hear.

But biases are like stereotypes in that they're shortcuts your mind has developed based on past experience. That's what people used to call "wisdom".

<comment><USER19> Not to be snarky or pedantic, but you're describing a Heuristic, not a bias. On the other hand, Wisdom is in large part knowing what _not_ to do as a starting point. It may be wrong, which would be in error, but a true bias probably not.

___________

<http://en.wikipedia.org/wiki/Heuristic> <http://en.wikipedia.org/wiki/Statistical_bias> Sherlock holmes: eliminate the impossible, and what is left, however improbable is the truth. &tc.

<comment><USER20> You're right about heuristics, but the relevant wiki page for bias is really "Cognitive Bias"[1] rather than "Statistical Bias".

Also Holmes is not a good example of a rationalist; his main ability comes from being a fictional protagonist. Holmes cannot be a much better source of rationality advice than Conan Doyle, who quite literally _believed in fairies_.

[1]: <http://en.wikipedia.org/wiki/Cognitive_Bias>

<comment><USER19> This is actually a very good comment. Some of these ideas are nested, logically. A Heuristic is not _per-se_ biased, although a subset of heuristics is in fact associated with the origin of the term 'cognitive bias'. Viz,

 _Although much of the work of discovering heuristics in human decision-makers was done by Amos Tversky and Daniel Kahneman,[4] the concept was originally introduced by Nobel laureate Herbert A. Simon. Gerd Gigerenzer focuses on how heuristics can be used to make judgments that are in principle accurate, rather than producing cognitive biases_

</comment></comment></comment></comment></comment></comment><comment><USER21> Good advice but I'm curious about:

 _"Jason Fried is the fastest white man you'll ever meet."_

Is Jason actually really fast and/or was he an athlete at a prior time?

<comment><USER22> Yeah, it was really weird hitting the bottom of the article only to find a vaguely racist nonsensical byline.

<comment><USER23> I'm not going to defend the byline (because it's cheap and inappropriate for the context) but there is a distinction between _racial_ humor and _racist_ humor. Not everything that addresses the concept of race is automatically racist, especially when it's not mean-spirited or demeaning.

It's a line that I'm not clever enough to tread, but other people seem to pull it off. Look at Robert Downey Jr. in Tropic Thunder. Very racial, not really racist.

<comment><USER24> > especially when it's not mean-spirited or demeaning.

This is a common misunderstanding about the nature of racism. Read about Asian Americans and the model minority.

<comment><USER23> I don't see how you get from "model minority" to "absolutely any discussion related to race is racist".

Sure, some things that aren't mean-spirited or demeaning are also racist, but that doesn't mean that _everything_ is. Am I missing something? Serious question.

</comment></comment></comment></comment></comment><comment><USER25> I never understood why consistent opinions are considered a good thing, it doesn't make any sense. If I realize I'm wrong, why should I stick to the wrong opinion?

<comment><USER26> The hypothetical cleverest, most correct person possible would be right 100% of the time and therefore would never change their opinion because changing it would go from right to wrong.

Therefore a simplistic view is that the closer to that person you are, the better. Some people may even think they are that person.

Realising that you are not going to be correct 100% of the time is the first step. The second step is working out when you are wrong, so you know when to change your opinion. Nobody manages both these steps all the time, some people rarely manage either.

<comment><USER27> _The hypothetical cleverest, most correct person possible would be right 100% of the time and therefore would never change their opinion because changing it would go from right to wrong._

A subtly different view: The hypothetical cleverest, most correct person possible would be right close to 100% of the time because they would change any wrong opinion almost immediately.

And with this view, the closer you are to that person, the better you really are.

<comment><USER26> That's a much more realistic cleverest person, but in terms of hypotheticals it is clearly better to be right 100% of the time than to almost immediately change your opinion the 1% of the time you start off wrong.

<comment><USER28> I believe that's an error in perception that has lead us to religion and other "I'm always right" worldviews.

Actually, no, it is not better.

</comment></comment></comment></comment></comment><comment><USER29> Sure, that's his advice today, but what will it be tomorrow?

<comment><USER30> Even if the advice changes tomorrow, the current one hold true nevertheless!

</comment></comment><comment><USER31> Hey, guess what, Jeff Bezos stopped by our office today. I just wanted everyone to know that, so I posted about something platitudinous he said.

</comment><comment><USER32> Being right a lot is a core value of that Amazon requires in it's leaders. The rest of the list is available here:

[http://www.amazon.com/Values-Careers- Homepage/b?ie=UTF8&...](http://www.amazon.com/Values-Careers- Homepage/b?ie=UTF8&node=239365011)

<comment><USER33> I hadn't seen this. Great list. I especially like "As we do new things, we accept that we may be misunderstood for long periods of time."

</comment></comment><comment><USER34> Bezos's observation reminds me of Philip Tetlock's conclusions in "Expert Political Judgement" (<http://press.princeton.edu/titles/7959.html>). Tetlock studied it pretty rigorously and came to a number of conclusions, but the central thesis was that people who got things right the most were people who thought by building up lots of competing models and evaluating all of them (ie, having lots of little ideas) rather than guiding all their decisions by a single ideology.

</comment><comment><USER35> Can't believe it. You had Bezos for 2 hours and this is all you bother to share with us?

<comment><USER36> The rest of his insights might give them some competitive advantage; perhaps, however, he spent two hours extolling the virtues of assembling your own desks and this bit was the only thing worthwhile to happen. I'll trust that they curated the talk in the way most likely to drive page views, not in the way most likely to enlighten the reader.

</comment></comment><comment><USER37> And the sad thing is that society often punishes people who change their minds or "flip-flop". See politics.

<comment><USER38> Flip-flopping in politics is often an insincere change of position for the purpose of chasing votes.

<comment><USER39> That's true, except the definition is elastic in politics. A candidate who thought a certain way at 18 years old is expected to still think the same way - on all opinions - at 45, which is absolutely ludicrous.

<comment><USER40> That's a strawman though, nobody actually says that. People complain about "flip flopping" when they see a politician campaigning and he or she says one thing on tuesday, something contradictory on wednesday, and then is back to the previous position again on thursday.

<comment><USER41> Usually when I see it, it is people complaining that a candidate endorsed different viewpoints than they did during past elections (in other words, they think something different than they did years ago). Kerry and Romney both come to mind _(though to be clear, both (or at least Romney) have been accused of the type you are talking about as well)_. Specifically I have heard some people claim that Romney has flip-flopped because they perceive a difference between his positions as a presidential candidate and as a governor.

<comment><USER40> I think a lot of that is just that if the person in question clearly does just say whatever they think people want to hear, then a dramatic change in position appears more likely to just be more of the same. Romney suddenly being against "obamacare" is a good example. It doesn't appear that he changed his mind because of new information, since he still claims his version of the same thing is great, but Obama's is terrible.

<comment><USER23> Similarly, Romney has recently said "I have never said I was pro-choice" but he did, multiple times, say that he "supports a woman's right to choose".

So, the verb form is OK but the noun form is absolutely not.

</comment></comment></comment></comment></comment></comment></comment><comment><USER42> "Strong opinions, weakly held"

</comment><comment><USER43> I too am frequently right, after being wrong a bunch of times.

<comment><USER44> Right, the point is to not stay wrong.

</comment></comment><comment><USER45> "A professor's job is to _profess_ \- often wrong, but never in doubt."

</comment><comment><USER46> Nothing to see here, but, of course, straight from the horse's mouth..)

This particular trait is of a much bigger idea - an active, aware, never satisfied beginners's mind, popularized in US by <http://en.wikipedia.org/wiki/Shunryu_Suzuki>

A settled, stale, stagnant mind is a worst possible mental decease from a Buddhist perspective, and, ironically, the most desired state of the mind for a member of a totalitarian country or organization.)

</comment><comment><USER47> I work with someone who spends way too much time (IMO) making sure that he's not wrong. Typically this involves not taking a stand until the results are in and then claiming the position all along. Or simply lying about his position. After witnessing this repeatedly I basically lost all respect for this person and really dread any interaction.

Personally I don't care if someone (including myself) is right or wrong. I often have to make technology recommendations that may turn out to be wrong years down the line and end up costing the organization time and money. So far I've been pretty lucky. I find it helpful to always include caveats in my proposals and explain reasoning behind my recommendations. Of course putting in the time to understand the issue, the market and the history is key.

I don't have a problem taking a stand and be proven wrong or adjusting my position when new information becomes available. However, I wonder if this attitude is hurting my standing with the organization compared with this other guy who never seems to be wrong.

</comment><comment><USER48> Sounds like a modest twist on the Hedgehog and the Fox, star of a thousand pop-science essays in the last few years:

<http://en.wikipedia.org/wiki/The_Hedgehog_and_the_Fox>

Note that (1) I agree and (2) there is nothing silly about the comments or the link.

</comment><comment><USER49> Just the other day during a design discussion I was arguing for X instead of Y and was reminded that I was the one who introduced Y earlier in the discussion. I was finally able to bring out Walt Whitman during a technical discussion and responded "I contain multitudes". :)

</comment><comment><USER50> Makes a lot of sense to be honest. If ideas aren't held too dearly you'll be able to weed out the bad ones. A lot of people (myself included) have a certain irrational loss aversion when it comes to ideas. I'm sure one could find plenty of articles on this on LessWrong.

</comment><comment><USER51> In other words, _be a scientist._ Consider the truth as a distant target, and our understanding only as an approximation based on the evidence we have right now.

Scientists have known this for years. They have made it their whole way of life—because it works, and it's true.

Smart people in all walks of life most certainly follow those same kinds of scientific principles. Bezos is spot on, there's just an entire branch of knowledge that's been spot on way before he was.

</comment><comment><USER52> _He's observed that the smartest people are constantly revising their understanding, reconsidering a problem they thought they'd already solved._

I think he's spot on, and this has been the basis for my manifesto (<http://jamesthornton.com/manifesto>) -- I like to think of it as continually _refining your perspective_.

</comment><comment><USER53> Their angel investor.

</comment><comment><USER54> This is kind ironic given that 37signals' is vehemently stubborn about many of their points of view.

</comment><comment><USER55> Thank you for a great quality post. And, folks, please do not fear being called a "flip-flopper"!

</comment><comment><USER56> When my information changes, I alter my conclusions. What do you do, sir? - John Maynard Keynes

</comment><comment><USER57> In other words: breadth-first search is better when dealing with hard problems

</comment><comment><USER58> Steve Jobs was also well known for his strong, but changing, opinions.

</comment><comment><USER59> Off-topic: how do they get typography so right?! If I just throw those fonts on my site they will look crappy, but their articles are always great looking.

</comment><comment><USER60> Should we all vote for Mitt Romney then? jk :)

</comment><comment><USER61> Basically, people are stupid because they don't realize how stupid they are.

</comment><comment><USER62> Curious as to what Bezos thinks of the current state of politics. "He said people who were right a lot of the time were people who often changed their minds." Maybe he's voting for Mitt Romney.</comment>


Ask HN: Any non-techies have advice for a good cover letter? - <AUTHOR>

My little brother is graduating from college soon and sent me his resume and cover letter to review. He wants to be a lawyer. I'm a web developer and haven't written a cover letter since... well, since I wasn't a web developer.
I've searched for best practices, tips, etc. on writing good cover letters, but the information on the Internet wasn't very helpful. Most articles repeat the same dull tidbits and leave me wanting to tell my brother not to submit one at all (which I won't do). A couple (newer, edgier) articles suggest being completely different and making a splash with a creative and arguably unprofessional letter. I'll take it all into consideration, of course.
But if anyone here who actually writes/reads cover letters could share a couple high-level criteria for an effective cover letter, I'd appreciate it. <comment><USER2> My father always told me (and it's worked for me):

\- The cover letter gets you an interview. From a huge pile of applications, it makes you somehow memorable to a hiring manager who would just like to make the right decision quickly. So don't bother with flowery nonsense and don't worry about being off-putting (unless you're only applying to one job...), just say something bold.

\- Some people have a hard time selling themselves. Other people have a hard time not lying and overselling themselves. Be honest but explain the value proposition of how hiring you will make a difference to the company.

\- Because you have to stand out, and because the hiring manager has a lot of context for what the position is which the applicants lack, researching the company, the opening, the culture, etc. will let you write a letter that stands out as a good fit for what they want.

\- One page only, one font only, print it out on nice paper, don't misspell anything.

<comment><AUTHOR> Thanks for response.

Although it will be an uncommon situation, is there any alternative set of guidelines for writing a cover letter when you know it will be read by your boss (instead of a hiring manager)?

</comment></comment><comment><USER3> If you haven't seen the article below, it is a great resource to forward on to your brother. To quote it:

For the background part, I like to see what someone has done.

Not been involved in, or been part of, or watched happen, or was hanging around when it happened.

I look for something you've done, either in a job or (often better yet) outside of a job.

[http://pmarca-archive.posterous.com/how-to-hire-the-best- peo...](http://pmarca-archive.posterous.com/how-to-hire-the-best-people-youve- ever-worked)

<comment><AUTHOR> Interesting article. I'll forward it to him and discuss it with him. Thanks.</comment></comment>


Ask HN: Anyone here have schizophrenia? - <AUTHOR>

Do you have schizophrenia? Do you know of a programmer who does? <comment><USER2> My brother has schizophrenia or is bipolar. He was a programmer. I have posted here very rarely, to provide links to the evidence of the causal link between canabis and schizophrenia, and to point out the devistation that may result.

Can I help?

<comment><AUTHOR> Could you perhaps repost those links? I don't see them anywhere on your profile.

<comment><USER2> Dear Xantide, I previously posted as schizoBrother which you can find as I just did. I have not posted before on any other subject and created a new profile for privacy.

I am just trying to avoid others having the problems my family. Is it for yourself, or another you are asking?

</comment></comment></comment><comment><USER3> The first person I think of is the author of LoseThos, especially as he frequently posts on HN. I suppose it's been renamed to SparrowOS now though.

<http://news.ycombinator.com/user?id=losethos>.

</comment><comment><USER4> Well, I have a lot of _experience_ here, shall we call it. E-Mail in profile if you want to chat about it. I love HN, but some information way personal. That being said, I'd love to chat.

</comment><comment><USER5> I'm a student programmer with schizophrenia. Not sure what you want or if I can help but if you want you can throw me an email to my hotmail address: illustroofserenus and we can have a chat.

<comment><USER2> "Who steals my purse, steals trash, twas mine, tis his, It has been a servant to thousands of others. Who steals my name, takes that which enricheth him not, but makes me poor indeed."</comment></comment>