Apple plans to embed ads in operating system - <AUTHOR> http://business.rediff.com/report/2009/oct/26/tech-apple-plans-to-embed-ads-in-operating-system.htm <comment><USER2> This would make sense to me if it was Microsoft, I could absolutely see Windows 8 "Netbook Edition" (Maybe Windows 9 or 10 when there's more ubiquitous internet) to be given away for free and supported by advertising. However this is so "not apple", that it makes very little sense.

Also important to point out that the title is quite misleading, filing a patent is not equal to "plans".

Edit: formatting + grammar.

</comment><comment><USER3> Wake up people. Did you forget about the Apple TV? This is exactly the kind of thing that could open the flood gates in that area. It doesn't make sense for your personal computer, or your iPod Touch but it makes a lot of sense for a TV appliance.

<comment><USER4> How is that any different than what's being done today? Cable boxes?

</comment></comment><comment><USER4> I don't know much about the patent process in regard to "strategy" but maybe this is just to throw a wrench in Google's plan for an OS?

<comment><USER5> I had exactly the same thought. Google just might have to buy a license from Apple.

<comment><USER6> That would be patent trolling on the part of Apple. Patent trolling is a serious absurdity in how the patent system is used. If you think about it, why should _Apple_ have the right to demand money from Google because they predicted that Google is going to rely on advertising in it's OS? Why not Techcrunch, or an analyst off Wall Street, or some guy in Florida with an orange grove? The answer is because Apple hired a lawyer to write a piece of paper saying that they own the idea of including advertisements in an operating system, and all these random other people didn't.

Ads in an operating system would be an unimaginable low for Apple. So would patent trolling Google. I don't think either of these will happen. I think it's because patent law fosters habits in companies that most individual people have outgrown. It's where you don't believe that anyone will protect your stuff so you grab everything you can reach, irregardless of whether it is useful to you or not, make a big pile, and sit on it. If someone tries to come up to you and have a reasonable conversation, you scream "MINE! MINE!" and hug your pile closer to yourself. (If you're a patent troll, you also try to yank the guy's wallet out of their jeans.)

It's not much of a theory, but it's the only way I can explain how most technology corporations - Apple included - seem to preemptively patent everything, all the time, without actually planning to make use of their inventions.

</comment></comment></comment><comment><USER7> Just because they patented something does not mean they plan to use it.

The title here is extremely biased.

<comment><USER8> Do you honestly think this is some kind of defensive patent?

Short of a press release that states "Yes, we are doing this" I'm not sure how it gets clearer. That's just me though, can you describe the scenario you are imagining?

<comment><USER7> I am not going to opine on the specific reasoning behind Apple's patenting this because only they truly know until a product is released, but if I were in the business of creating operating systems and I came up with a concept that could apply to an OS that was patentable, I'd surely do so, regardless of whether or not I planned on using it. It could be defensive, it could be an attempt to capitalize on a system by a competitor, or a pre-emptive move to stop competitors from doing this. They may use it in a specific niche product or they may end up using it, but there is rarely a direct correlation between a patent and a plan as the OP seems to claim with his title. The legal profession, especially relating to patents and the interrelation of companies is a huge chess game, one that I don't claim to be an expert on.

The title is misleading and makes it sound as though the next version of Mac OS X will be loaded with ads.

This simply is not the case.

</comment></comment></comment><comment><USER9> Message: Even Jobs can come up with ideas that suck.

And the link to the patent: <http://www.freepatentsonline.com/y2009/0265214.html>

<comment><USER10> I hope they enforce strongly and never let anyone else do this ever.

<comment><USER9> Positive thinking!

</comment></comment></comment><comment><USER11> Or perhaps they plan on something else and ads are a natural extension. The patent is a device to prevent others from placing ads on the OS. This is my private hope anyway.

</comment><comment><USER12> Watching windows logo while your computer boots up is kind of waste. You already bought up this windows thingie and won't be buying another one for a couple of years, so why not present you with Big Star logo or Mc Donalds or something else.

Pausing your boot up process to show you the commercial is completely different (complete no no) thing.

Actually having apple logo on lid of your laptop is also a waste for the same reasons. Jobs should strike a deal and put Mc Donalds logo there.

</comment><comment><USER13> In case we needed more evidence that the current patent law is absurd.</comment>


EU-US Privacy Shield in big trouble, may not pass muster, suggests German leak - <AUTHOR> http://arstechnica.co.uk/tech-policy/2016/04/eu-us-privacy-shield-problems-article-29-german-leak/ <comment><USER2> Either the shield provides privacy or it doesn't.

What we shouldn't have in Europe is an illusion of privacy like the whole shame with cookie episode, where website owners are now forced to place silly cookie warnings instead of warning that Google is tracking their activities through Adsense javascript and other means.</comment>


No more free labor - <AUTHOR> http://money.cnn.com/2009/06/19/smallbusiness/no_more_free_labor.fsb/index.htm

<comment><USER2> The trick I learned in my freelance days came from a designer friend who'd picked this up the hard way and developed his own nuclear option for non- paying clients. Whether it works for a given contractor depends on what the contractor is doing, and so consulting with a lawyer (I am not one) is important. But in general it goes like this:

Step 1 is to ensure in advance that your standard agreement includes clauses indicating that creative work you do is not work for hire, that you will, at the start, retain copyright in that work, and will assign the copyright to the client on receipt of payment in full.

Step 2 is to go through the normal process; if they don't pay, you send invoices, attempt to negotiate, etc.; make a good-faith effort to resolve the problem.

Step 3, if the client still refuses to pay, is a DMCA takedown. You don't have to go to court, you don't have to get into legal wrangling about contract terms, you just get their site taken down until they pay up, which they often will.

Of course, they'll give you a bad reputation and you'll never get business from them again, but you'll have food on your table and they'll have learned an important lesson about trying to screw their contractors.

</comment><comment><USER3> Architects have a subtly different but related problem.

They bill at the end of the month, and the standard, as everywhere else, is to send Net 30 invoices. So it can be 30 days before the client is officially "late", by which time they've done 2 months of free work. In these uncertain economic times, a lot of clients are actually going bust without making a lot of noise, so architects end up exposed to losing 2 months' worth of fees.

There's an even bigger "free work" problem for them, though: a lot of their work is speculative - responses to "competitions" which other architects are applying for too. Whoever wins the competition does get the job, usually, but that still leaves out a bunch of people who worked for free to submit designs for that competition (and often elements of their submissions might make it into the final design, based on client requests, after the competition is lost).

Hard times to be an architect...

<comment><USER4> Writing a proposal isn't free work, it's marketing expense.

The other things you mention are just the things you have to put up with in a service business. Sure you can lose a bid and have someone else implement your idea.

It's the nature of a service business to have a customer into you for 2 months. I have found that the best way around this is insisting on different terms. If I know a customer may be having "issues", I have insisted on Net 7. They always object, but give in if they can handle it. If they won't give in, I figure that I've just sidestepped a big potential headache. You need to fire your bad customers as early as possible.

I sympathize with your industry. It sure is a tough time to be an architect. Best wishes.

<comment><USER3> I'm not an architect, actually, I just run a service/product for them (<http://www.woobius.com>), and I've learned a few things about their industry those last few years...

I agree with your point about competitions vs proposals, btw - that doesn't make it nice though!

<comment><USER5> I like your website. Clean with good use of whitespace. Something a lot of current web startups are lacking in. :)

</comment></comment></comment></comment><comment><USER6> oh man, hasn't everyone had this stunt tried on them at least once? I guess I'm kindof an impatient jerk about money, though, 'cause I'm pretty quick to say "Ok, well, I'm not working on your project until I see a cheque"

you need to be especially careful of this if you are using a third-party broker or body shop. I find that going direct means that you usually deal with people who are much less slimy.

The key to getting paid is the willingness to walk away. First, if you are doing work before getting paid, remember you are giving them a loan. Never loan someone more money than you are willing to walk away from. And cut your losses early. If they won't pay you after one month, they probably aren't going to pay you after two or three months. stop work. do something else. If they decide to pay you, great. you win. If they don't, well, you are only out one month rather than 3 or 6 months, so you don't lose quite as much.

</comment><comment><USER7> Can someone explain the "subjective contract" think that happened towards the end of this article? Also, assuming they never got paid by the client, I assume they packed up their marbles (and the site they built for the client) and went home.

<comment><USER8> I am not an expert in this domain. I guess they never formalized the requirement of the site in written document. So it is very hard to determine objectively by 3rd party. And at the same time. It is hard to put all requirement into text for software developers. But a formalized requirement is protection/insurance between customers and contractors.

I found there are similar problem in UAE that British building contractors has problem in getting paid because the UAE customers always demand updating in the building and never trying to give an objective criteria of the finishing decoration of the building. I guess they suffer the same problem in finish the web site.

<comment><USER9> I used to work for an architectural and landscape designer in the D.C. area in the 80s and 90s, his solution to constant changes was to only work cost plus, on a week to week basis. Every week he met with the clients, let them decide what was most important to them to get done over the coming week, and get a check for the previous week. It also helped the clients feel more involved in what they were paying for.

<comment><USER10> That works if you can get your clients to agree to it, but most clients won't.

Hell, cost-plus is almost always better for the contractor than firm-fixed work -- it shifts the risk to the client! -- but a lot of organizations just flatly refuse to go there for that reason. They want you on a firm fixed price schedule or not at all, at least for any sort of non-trivial work.

</comment></comment></comment></comment><comment><USER4> I have a simple rule.

As soon as any invoice is one day late, all work stops until the account is up to date. There is no excuse for not paying your bills.

I mean it.

<comment><USER11> This is a cumulative problem -- the more you let them slide, the less value they're going to give your work.

If you give something away for free, by definition, your work is worthless.

I have a clear contract and clear expectations, and every week I confirm, in writing, with the client that the work is meeting their expectations. Everything may still be "subjective", but when you have a written record of them saying you're doing a good job, and then still not paying? It's a different ballgame.

In general, what separates good consulting from bad consulting is the ability to say "no".

</comment></comment><comment><USER12> I know it's not always possible with websites but developing on your own server or locally can reduce this problem. I'm not sure about the circumstances in the article but the customer isn't going to be able to make these demands if they haven't got th product yet.

I'm assuming this may need to be done in conjunction with holding the copyright to the end.

</comment><comment><USER13> great job on the article, guys... (i met these guys a few years ago and they are very cool)

</comment><comment><USER14> There's about 10,000 little painful lessons like this, that you usually learn by making the mistake and cursing repeatedly and vowing never to let it happen again.

If you're lucky, you'll be able to pick up a few of the 10,000 painful mistake lessons from reading about them or being taught them. But most of us are rockheaded and insist on making the same mistakes as everyone else until it's happened to us. Better to learn from a close associate or someone else's story when possible, but people aren't so good at that. But life goes on, as it were. Making those mistakes is where a lot of your skill and lessons come from.

<comment> cunard-n I find that the corellary is that it's this pain and these lessons that give you such a leg up on the recent graduates just getting into the business. They don't know how close everyone always is to the line. This relates back to the old "don't spend money on office furniture" (in a startup) advice.</comment></comment>


Ask HN: Introduction to Ruby/Rails book(s)? - <AUTHOR>

Hello, I'm looking to purchase a book that introduces Rails (probably some Ruby too), and whatever else you think should be important for someone looking to get in to Rails. Thank you! Main criteria, is it's up-to-date, as many of the wrox and black titles seems to not be. <comment><USER2> Rails is such a fast moving target that keeping totally updated books on the shelves is probably just as frustrating for the book publishers as for those wanting up-to-date books.

That said, the Pragmatic Programmer's book Agile Development with Rails is a pretty good intro: [http://pragprog.com/titles/rails3/agile-web-development- with...](http://pragprog.com/titles/rails3/agile-web-development-with-rails- third-edition)

But, with Rails 3 (with many changes) coming in the next few months, books are going to become outdated yet again.

As for Ruby in general, the fairly recent The Ruby Programming Language ([http://www.amazon.com/Ruby-Programming-Language-David- Flanag...](http://www.amazon.com/Ruby-Programming-Language-David- Flanagan/dp/0596516177/)) is a pretty good intro. David Black's The Well- Grounded Rubyist ([http://www.amazon.com/Well-Grounded-Rubyist-David- Black/dp/1...](http://www.amazon.com/Well-Grounded-Rubyist-David- Black/dp/1933988657/)) is recent, and I'm sure a great book, as his previous (Ruby for Rails) was excellent.

</comment><comment><AUTHOR> Suggestions for any good JRuby books would be greatly appreciated too!</comment>


W-2 hacked, what are options? - <AUTHOR> Recently I received a letter in the mail informing me the 3rd party w-2 provider of a previous employer was hacked & all of my personal info was stolen, incl. ssn. They are offering 1 yr protection (is this a joke?). If anything, lifetime protection should be offered.
If the roles were reversed, I'm sure the company would sue me for stolen info. What are my options here, if any?
Knowns:
- I had no knowledge of this third party system and thus signed no authorization for it's use - accepting 1 yr "protection" will disqualify me from suing
Questions:
- do you have previous experience with this?
- what actions can I take to the full extent of the law? <comment><USER2> 99% of the time, such stolen information is never used so don't freak out. Here's some official advice: [https://www.irs.gov/identity-theft-fraud- scams/data-breach-i...](https://www.irs.gov/identity-theft-fraud-scams/data- breach-information-for-taxpayers)

</comment><comment><USER3> Some people appear to have been successful taking equifax to small claims court, so you might want to look at those cases.

[https://www.nytimes.com/2018/06/20/business/equifax-hack- sma...](https://www.nytimes.com/2018/06/20/business/equifax-hack-small-claims- court.html)</comment>


Ask HN: How does Twitter help your company? - <AUTHOR>

<comment><USER2> The real-time search makes it easy to find people to lay off.

<comment><USER3> I wonder if that's why twitter search is one of the few useful sites that my big-company IT department doesn't block.

</comment></comment><comment><USER4> My favorite of company twitter usage is from Kogi (<http://twitter.com/kogibbq>) - They use it to tell people where their Korean BBQ Taco trucks are around L.A.

<comment><USER5> I wish Alice (one of the people tweeting from that account) would stop capitalizing random letters in her sentences. Otherwise I agree, I love how they're using Twitter. It's really nice to see them update about delays and issues.

</comment></comment><comment><USER6> I work for the Austin American-Statesman news company in central Texas.

This is how our Internet Editor answered that question [http://thequig.wordpress.com/2008/09/23/op-ed-how-the- states...](http://thequig.wordpress.com/2008/09/23/op-ed-how-the-statesman- uses-twitter/)

Here are the many twitter accounts our reporters use to distribute and collect news and information <http://www.statesman.com/news/content/standing/twitter.html>

The team I work for wrote a tool to aggregate/retweet tweets from our staff and "widgets" to display them on various pages of our websites. This is mostly used during major events such as SXSW, elections, or Longhorn Football games as a fast way to collect and publish news and tidbits from our staff in the field. And also, of course, to engage/serve the Twitter community with news and information.

In general Twitter is a communications tool. If your business benefits from communicating with its customers (not all do) then it can benefit from Twitter.

But, like all things, it takes effort and can be done "wrong". It, like all things, is not a silver bullet.

</comment><comment><USER7> Not really a company, but an open source project I contribute to (there's also an App Store app, so it _might_ qualify as a company, I suppose) has a twitter account that we use. We mostly have a few twitter searches for anyone having problems with the app (Colloquy) or looking for an IRC client on a platform we support to recommend to them _. Occasionally we'll give out promo codes, either to bloggers or to anyone following us/twitter's public stream to use.

_ Note, for this, we don't use a bot — A. because traffic is low volume, only a few tweets every few days and B. (imo), bots that send send the same message to everyone regardless of what the query is, is obnoxious.

</comment><comment><USER8> We've started posting announcements, conversation starters and small contests on our company twitter account (I've been doing it on my personal account a little longer).

It's still early, but I think it's a promising way to get the word out on stuff and start conversations. When we release new site designs or app features, it's another way (besides our blog) to get the word out.

Also, another strategy is to use the search feature and find people looking for product recommendations (this happens more than you think).

Search is also good for finding people who are frustrated with your customer service–or your competitor's.

</comment><comment><USER9> I started to twitter a few weeks ago, and I was occasionaly posting links to promote my content, but when I check my google analytics, i hardly see any referal from twitter. So at the moment, i'm still unsure about how effective twitter is to my business.

<comment><USER10> A lot of people are using Twitter desktop or mobile clients which wouldn't pass a referrer. Have your direct accesses gone up?

Also, just posting links to promote your stuff is a really ineffective way to promote your stuff on Twitter. Twitter is about the conversations, not the broadcasts. Engage in some meaningful conversations related to what you're trying to promote and you'll see the benefits.

<comment><USER9> You made a good point, I saw increase in direct acesses but I need to find some ways to know that my effort spent on twitter produces that. Maybe url shortener like bit.ly can help in that regards.

</comment></comment></comment><comment><USER11> The search makes it easy to see when users are having issues with my webapp.

Of course that assumes Twitter is working itself at the time... which sometimes it's not.

</comment><comment><AUTHOR> So I found this post on a new community site, and I'm honestly curious. I hear that companies HAVE to use it, that it is a GREAT way to talk with your clients and customers. But I've tried...and I don't get it.

You guys are a pretty tech savvy bunch - how do you use Twitter?

<comment><USER12> "Found?" Aren't you the co-founder of this Trogger thing? I feel astroturfed.

<comment><AUTHOR> Eep, I am sorry for that. Yep, I am on of the founders of the site, but not the writer of the post. I was working on the site when we made an announcement about Trogger to some of our SFbeta attendees, and "found" that post from a few days ago and saw it hadn't gotten many informative responses. Was hoping people here could help me out - since I do twitter for our sfbeta event.

Sorry to leave you with some nasty scabs there. :(

<comment><USER12> I think what you really wanted was to get people from HN on your site as a way to get users and possibly buzz.

If all you wanted was to find out about how companies are using Twitter you could have posted an "Ask HN" asking just that question.

If you want feedback about your startup you can post an "Ask HN" about that, too, but don't go pretending that you weren't just playing for traffic.

<comment><AUTHOR> Actually, I didn't change the link (not sure how/who did, but that's fine) - and didn't know I could post "Ask HN" posts. Now that I know, I will in the future. (still not sure how to...but can figure it out now I know its possible)

Looking at most everything in the new section, they all link to outside links, so I thought that was required - like Digg. I restated the question here AND linked, so I could get responses here without the need for people to follow the link. Extra traffic to Trogger was a bonus, sure, but after SXSW and the hype of Twitter that continues there, I was curious.

<comment><USER12> Yeah, I didn't realize only admins could change links, so I apologize for that.

Still, I'm not sure what your role at Trogger is, but if you're involved in marketing or promotional stuff you should understand why I and the other people who voted you down reacted the way we did.

Next time act in good faith. Ask the community directly and if you want to post a link to your own startup don't pretend that you "found it" on "some community site." Tell us up front that it's your startup and gosh HN is great and we'd love your feedback, etc.

<comment><AUTHOR> Point definitely taken, and I will. I'll also definitely use the Ask HN feature now that I know it exists, since that is what my goal with that one was. I do think there is a really knowledgeable community here, that I'm working to learn from as I start to get into this field.</comment></comment></comment></comment></comment></comment></comment>


Docker 1.11: The first OCI-compliant runtime, built on containerd - <AUTHOR> https://blog.docker.com/2016/04/docker-engine-1-11-runc/ <comment><USER2> You know, standardization is a great thing. But, fuck, another major release with huge changes... What ever happened to stable architectures with hardening burn in periods? What new bugs are going to creep in due to these huge changes? How is this going to break our work arounds for previous versions?

It's a great time to be in operations, containers are a huge step forward, but how are we supposed to be confident in a technology with so many major changes every other month? Even Node.js has LTS releases.

And yes. Get off my lawn, too.

<comment><USER3> If you want something stable I'd stay away from containers and use well-tested technologies like VMs and configuration management.

In my experience many of the tools in the container ecosystem are in the early adopter phase, promising a lot of convenience for some use cases, but too buggy and feature incomplete to really deliver yet. Not to mention the breaking changes and occasional migration to a new tool.

<comment><USER4> We were using docker up to about a year ago, and ripped it out for just this reason - we didn't have the time available to keep coding the workarounds. Great if you have the time, not so great if you don't.

<comment><USER5> We were too deep in already unfortunately, but 1.10 introduced a whole new barrage of bugs and regressions, wasting hours and days working around it. If they don't devote some time getting the basics right and getting the core stable, we need to really consider alternatives. I'm already scared what 1.11 will break.

<comment><USER6> Please make sure to report any issues so they can be fixed.

</comment></comment></comment></comment></comment><comment><USER7> This is a huge upgrade that is super welcome.

Recently (on 1.9) we have seen quite a few cases where we had "zombie" containers, these are container that can no longer be started or stopped due to cgroup misconfiguration or something along those lines.

The new architecture means that for weird cases like this all we need to do is kill off runc without forcing every container on the box to restart (by restarting the docker service which is what we do now).

It is also really nice that you can now launch apps on runc direct without needing a docker intermediary.

<comment><USER6> Sounds likely to be [https://github.com/docker/docker/issues/18180](https://github.com/docker/docker/issues/18180)

If so, it's a bug with a particular (newer) version of AUFS that has been fixed in most distros.

<comment><USER8> We hit 18180 in all our images with Java applications. Workaround was to upgrade the kernel.

</comment></comment></comment><comment><USER9> > DNS round robin load balancing: It's now possible to load balance between > containers with Docker's networking. If you give multiple containers the > same alias, Docker's service discovery will return the addresses of all of > the containers for round-robin DNS.

wait wait wait. I'm kind of new into docker world. And so far i've been struggling in understanding how to replicate a container in order to scale. For example i want to run the same Django project 3 time as web1, web2, web3. If i do so now i've to expose 3 different ports, one for each. Plus, to make it working, I need to have a load balancing, thus i've to use HAProxy and do a load balancing to point to each of the container. Anytime I add a new machine (e.g., web4) i've to change the conf of HAProxy and restart it. This brings down the system for a moment. (is this the right approach btw?)

Going back to the cite paragraph. Now i can create many containers and dockers automatically does the routing for me? Am I right? or I misunderstood the meaning of the cited point?

I just need to create all of them with a --alias web ?

<comment><USER10> > (is this the right approach btw?)

This is why I use hipache for load balancing / routing - it is the only solution I've found where you can change the routing or add new backends in a live system without any downtime. Here is the main problem though: Its load balancing isn't exactly smart, for example it won't keep the same client IP on the same replica, thus creating problems when a client writes something on one replica, then gets switched to another that didn't get the update yet.

I'd love a better solution for this btw. Is noone working on Hipache anymore? Other than this problem I find it very elegant.

<comment><USER11> you might want to take a look at fabio:

[https://github.com/eBay/fabio](https://github.com/eBay/fabio)

<comment><USER12> I love Fabio. The Consul stack in general is fantastic.

Been watching #consul IRC for a while now though, and the vast majority of the setup problems are due to Docker's weird networking and security. Fabio/Consul run like a charm but Docker throws a wrench in the machine.

</comment></comment></comment></comment><comment><USER13> The Open Container Initiative is an important step towards some form of standardization for the future of containers, and I think the Linux Foundation will steward the project well.

</comment><comment><USER14> Standardisation at the format level will help with portability across different platform implementations.

<comment><USER15> This "standardization" is pretty kludgey if you have to docker pull then docker export.

<comment><USER16> I think that's because OCI currently only has a specification for the runtime, not the distributable image. But it seems like as of a few weeks ago, work is underway to standardize the distributable image as well: [https://github.com/opencontainers/image- spec](https://github.com/opencontainers/image-spec)

<comment><USER17> I was almost excited! From the FAQ on the project you linked [0]:

> Q: Why doesn't this project mention distribution?

> A: Distribution, for example using HTTP as both Docker v2.2 and AppC do > today, is currently out of scope on the OCI Scope Table. There has been some > discussion on the TOB mailing list to make distribution an optional layer > but this topic is a work in progress.

I really hope CoreOS manage to get distribution into the scope for OCI. We need to move beyond Docker images. Standardizing on-disk layout in OCI is only mildly useful in my opinion.

[0] [https://github.com/opencontainers/image- spec#faq](https://github.com/opencontainers/image-spec#faq)

</comment></comment></comment></comment><comment><USER18> "As an example, 1.11 is a huge step toward allowing Engine restarts/upgrades without restarting the containers, improving the availability of containers."

This is great.

</comment><comment><USER19> ELI5 the OCI & why it's important? I follow Docker from a distance and find it fascinating.

<comment><USER20> Disclaimer: I work at Docker.

Docker has become a de facto standard for executing programs in a portable sandbox (aka "container"). There were increasing demands for making it a "proper" standard, so last year we donated a spec and reference implementation for a universal intermediary format - a "PDF of containers" if you will, and partnered with the Linux Foundation to manage it. The majority of the industry followed.

Now that the Docker container engine supports this intermediary format, and other providers will soon follow suit, it reduces the risk of depending on one provider. If you want to switch away from Docker, you can run your containers elsewhere.

Now everyone can focus on building better tools, instead of trying to make "their" format win. The result is better tools.

<comment><USER21> Disclaimer didn't say you are the CEO.

I hope this guy does this again here, [https://news.ycombinator.com/item?id=11379475](https://news.ycombinator.com/item?id=11379475)

<comment><USER22> Solomon's comment and disclaimer seemed perfectly reasonable to me. Why does it matter if he's the CTO or random employee?

</comment></comment></comment></comment><comment><USER23> Garbage collecting for the registry is a long overdue feature that is quite critical. I'm glad to see that it's now possible.

</comment><comment><USER24> I'm pretty happy about being able to add labels to `docker build` - now it should be possible to easily associate a git hash of the code that was used to build the container.

</comment><comment><USER25> > A few months ago we added the ability to sign images with hardware Yubikeys > in the experimental channel of Docker. This is now available in the stable > release.

I understand that you used to have to install a separate version of Docker to access this feature, but does the change in 1.11 also mean you no longer have to set the DOCKER_CONTENT_TRUST environment variable, or will that be made default at a later time?

<comment><USER6> Still need to either set the envvar or pass the equivalent flag.

</comment></comment><comment><USER8> Correct link to v11.0 change log: [https://github.com/docker/docker/blob/bump_v1.11.0/CHANGELOG...](https://github.com/docker/docker/blob/bump_v1.11.0/CHANGELOG.md). The article links to master changelog which is 1.10.

</comment><comment><USER26> Somewhat off topic, but docker-compose finally works on the old iMac I use at work:

[https://github.com/docker/compose/issues/271](https://github.com/docker/compose/issues/271)

</comment><comment><USER27> As someone who spent too much time with Oracle, this headline is quite confusing (OCI => Oracle Call Interface). Computing has a serious TLA issue.

<comment><USER28> ha, googling gives me OCI Open Catalog Interface, some SAP standard for SRP software, which makes no sense in docker context, at all :D

</comment></comment><comment><USER29> Does this mean we are now at a point where LXD/LXC & docker will play nicely with each other?

<comment><USER30> I don't see any movement towards the OCI spec by the LXC/LXD team. Canonical isn't shown on the list of members ([https://www.opencontainers.org/about/members](https://www.opencontainers.org/about/members)).

This answer from Mark Shuttleworth seems to sum up their position: [https://answers.launchpad.net/ubuntu/+question/268502](https://answers.launchpad.net/ubuntu/+question/268502)</comment></comment>


Could you pass a US citizenship test? - <AUTHOR> http://www.csmonitor.com/USA/2011/0104/Could-you-pass-a-US-citizenship-test/Who-signs-bills

<comment><USER2> No, I didn't pass the test. Mainly because I gave up 10 questions in because the CSM couldn't be bothered to put more than one question on a page, and the site's innumerable ads and Meebo bar made each pageload seem like an eternity.

I think I could have made it through the lines at Ellis Island faster.</comment>


UK government to monitor email and web use under new laws - <AUTHOR> http://www.bbc.co.uk/news/uk-politics-17576745

<comment><USER2> The only way I would find this acceptable was if the government applied this to themselves. I want to be able to hear all their conversations, to know where they are, who they meet and talk to, who pays them money, how many bank accounts and properties they own. I'd like that accepting a job as a politician involved full transparency. If they were an example themselves then it might be easier to convince people about approving a law like this one.

<comment><USER3> Personally I don't see how I could give up my privacy just because some/all politician(s) would.

A lot of people don't even mind the absence of privacy, the key point is that that is a decision they can make for themselves. Even if everybody would gladly give away everything on facebook the moment you force them to do so you cross the line.

</comment></comment><comment><USER4> Its a EU thing that is pushed from the commission to the individual countries. Germany implemented this a while ago but it was ruled unconstitutional by our constitutional court, so the law was repealed and all collected data was deleted (at least thats what they say). Now the government is facing fines from the EU for not implementing the law.

Its awful that an institution of questionable democratic legitimation (EU commission) is forcing a democratic government to implement laws, that are against their constitution. The worst thing is, that the big political parties dont see anything wrong in this.

<comment><USER5> _Its awful that an institution of questionable democratic legitimation (EU commission) is forcing a democratic government to implement laws, that are against their constitution._

You used the word "democratic" twice. But I don't see what democracy has to do with it. The whole point of a democracy is to allow the majority to bully the minority. The protections you need are Constitutional limitations.

<comment><USER6> The Commission is undemocratic because it holds great power, yet its members are unelected. Contrast with the EU Parliament, which is elected and therefore far more accountable to the electorate.

<comment><USER7> By that standard most governments are undemocratic. The UK is a particularly interesting case with a monarch that can dissolve parliament, appoint the prime minister, as well as hereditary and life peers in the upper house.

<comment><USER8> The key difference here is that while that is theoretically the case, the Queen does not in practice arbitrarily dissolve parliament, and her appointing the prime minister is basically a formality. The House of Lords, while it is fairly undemocratic, doesn't seem to be doing any worse a job of looking out for the rest of us than the Commons are. Contrast this to the various EU directives which frequently are interfering in local affairs, often not in a way that's in our best interests.

<comment><USER7> I think we need to seperate two issues here: One is whether or not a particular government does a good job and the other is how democratic it is.

The first question is too subjective in general to have a useful debate. I'll just say that complaints about interference in local affairs have been a mainstay of all political unions ever formed, including The United Kingdom of Great Britain and Northern Ireland. Just ask the Scottish. And it's completely natural because "interference" is just another word for "governing".

However, the parent post was about the democratic legitimacy of the EU commission. The commission is not directly elected just as most other governments are not directly elected. In most countries cabinet ministers are not even elected MPs. Parliaments are elected and sometimes heads of states but rarely governments. The closest thing to an elected government are probably the presidential systems in the US and France.

Most critics of the EU do not want an elected EU president or a directly elected EU commission as that would obviously take away more powers from the nation states. That's a legitimate position, but it's incompatible with criticising the EU for not being democratic enough.

</comment></comment></comment></comment></comment></comment><comment><USER9> I'm not one to wear a tinfoil hat but SOPA in the US, Bill C-30 in Canada, and the various laws in the EU can make one think there is some sort of conspiracy going on. It's simply intriguing how all these laws seem so similar.

<comment><USER10> to me all this stuff seems a bit overcoincidental, but i am tired of talking about. few months ago i joined the freedombox-project (<http://wiki.debian.org/FreedomBox>) - now i vote by coding.

<comment><USER11> _vote by coding_

I like that. I been saying to hippy mates of mine for a while that while they have been trying to change the world through the application of drum circles and yurt building classes, the geeks have quietly been building in the open source movement, the only successful communist (with a very small c) system to successfully compete with capital on its own terms, and many are now setting their sights on using it for actual manufacture.

If you don't like the world you see around you, at this point in history one of your best chances for empowerment is to learn some form of engineering and then apply it.

<comment><USER10> fully agreed. sorry to correct you, but it's the "free software movement" or "FOSS" and it's _not_ a communist system. not even with a small "c", because communist systems force you to share, FS allows you to share.

<comment><USER11> If you produce software within the framework of the free software movement then you are sharing it. What free software licence allows you not to share your source?

The word communism can also describe systems that are mutual with consent, and most of the states that claim to be communist appear to be run by totalitarians who use the word and associated dogma to seize and hold power under the promise of equity in the future, so I am not sure there has ever been an actual communist state, by the terms of the philosophy.

Personally, I'm a Groucho Marxist, so my main tenet is that I wouldn't want to join a club that would have someone like me as a member. ;)

<comment><USER10> no no, i will not enter this discussion, because time flies like an arrow and fruit flies like a banana;) (btw. you can always take a FS, modify it and keep it completly to yourself, so all FS licenses allow you not to share)

<comment><USER11> Yep, but then you would from then not be participating in the free software movement for that particular project. If you then later shared your modifications you would be again.

Look, a four year old child could understand this. Quick, someone fetch me a four year old child. I can't make head nor tail of any of it.

[edit] I wonder how it would go if I tried to work Groucho Marx quotes into all of my posts. Something tells me it might not go too well.

</comment></comment></comment></comment></comment></comment></comment><comment><USER3> Is this a joke?

I'm glad I don't live in the UK but pissed since they set an example others might be tempted to follow.

<comment><USER12> As far as I'm aware this is fairly common. If you read the article, you'll see that the new legislation "would not allow GCHQ to access the content of emails, calls or messages without a warrant".

Looking through your comments it looks like you're in Sweden: Sweden _already has_ similar legislation via the FRA law, which authorises the Swedish government to wiretap _all_ traffic entering the country. A lot of countries have similar arrangements: not all arrangements are backed by legislation.

In many ways it is _better_ to have this thing legislated: at least then it's out in the open. It's naive to think that large ISPs in countries without active legislation aren't linking intelligence agencies into their networks.

The legislation in the UK is presumably intended to speed up the time from getting a warrant to putting the tap in place: I would imagine most large ISPs (BT, Virgin, etc) are already plugged into GCHQ, in the same way the NSA intercepts all AT&T traffic.

<comment><USER3> Yes, I'm in Sweden and yes we have the FRA law. But there are huge differences between this and the FRA law. The FRA explicitly forbids FRA to intercept/process traffic that is meant to stay within the borders. Both laws are an insult to democracy but my take from this is that this is much worse and they have different intents.

Why is it better to have this thing legislated? The argument that it is better to have laws like this because otherwise they will just do it anyway (illegally) just blows my mind. There are many advantages to having stuff like this unlegislated, without support from the law they can't actively act on the data, something that is far better than having the FRA-law. Especially when the intent of the law isn't to act on it but rather to observe.

In other words that argument is of the lines that "since they already have the information (which they illegally intercepted), why wouldn't we want to give them the legal right to intercept that information so that they act on it as well?". How does that make any sense?

Even with a warrant the data collected by FRA wouldn't be legal to use in a court if both parties (sender and receiver of a message/whatever) was in Sweden (regardless of whether the traffic took a detour across the border or not (too/from gmails servers for instance)).

<comment><USER13> This is why it is critical to encrypt all communications using a trusted provider or doing it yourself with PGP, if you have the skills to do it.

Whether or not this interception is currently legal / illegal, this has been happening on a massive, global scale. The UK is just catching up to France / USA / Canada in this regard. The EU legislation on the books for Saas, ISPs to log all their traffic for an indeterminate time is also a huge cause for concern.

Shameless plug: Use PrivateSky.

<comment><USER14> The problem with encryption is that, as far as I'm aware, it doesn't hide the sender/recipient information. You might not be able to read the content, but intelligence agencies are just as interested in who is communicating with whom as they are in the content of the messages.

Oh, and we have a law in the UK which makes it a criminal offence, punishable by 2-5 years in prison, to refuse to hand over the private key so that your data can be decrypted. :(

</comment></comment></comment></comment></comment><comment><USER15> Is this an April Fool's?

<comment><USER16> That was my first reaction after reading the first lines of the article. But I'm afraid it's not a joke.

</comment></comment><comment><USER17> A warrant would still be needed to read emails, but this essentially will give the government access to your browser history.

<comment><USER18> The fact that two people have communicated is damaging enough, which is what this does. For the law under discussion in the UK, it seems that it's just formalizing practice.

In the US this is covered under the Pen Register Act: <https://en.wikipedia.org/wiki/Pen_register>. Essentially the fact that two people have communicated is not protected under our Constitution; only the content of that communication is protected. In that context, Congress passed the Pen Register Act, which requires law enforcement to get a warrant to monitor who calls who; the bar for these particular types of warrant is particularly low.

The Patriot Act extends the concept of pen register and their required warrants to internet communication. The government specifically is required to get a warrant before it can ask an ISP, for example, to reveal who someone emails or what web sites they visit. For now, they need a warrant to know that you visited Amazon or your library's site, but they need a harder to get different warrant to know what books you've bought or checked out, or what you thought about those books when you emailed your friend.

The fundamental problem with pen registers and the internet equivalents is that it brings people under government scrutiny that otherwise would have escaped notice. If person A is a person of interest, and the government is pen registering his communication, then that makes everyone on person A's communication list a person of interest. Now the government gets a warrant to pen register person B, someone who person A communicates with. That means that everyone that person B communicates with is now known to and watched by the government, even though they are not specifically the target of any investigation or warrant.

Person A may be a drug dealer, person B may buy from person A, and I, person XYZ, may be a friend of person B, don't buy or use drugs, and don't know a thing about the relationship between person A and B. But now the Eye of the government has swung its gaze over to me. I could become collateral damage in, for example, a plea bargain negotiation. My house might be violently raided by law enforcement, merely because Person B visits me a lot; my child might have a gun pointed at his head, and my dog might be routinely killed merely for getting in the face of one of the law enforcement home invaders.

This (the pen register) is a violation of my desire to not be scrutinized by the government, whether I've done nothing wrong or not, whether I have anything to hide or not. I in fact have done nothing wrong and have nothing to hide, and I _still_ do not want the scrutiny of the government to fall on me. The government is in theory my servant, not my master. That relationship naturally gives me the right to expect the government to leave me alone.

</comment></comment><comment><USER19> _"... But it would enable intelligence officers to identify who an individual or group is in contact with, how often and for how long. ..."_

Cynical enough to think GCHQ do this already & the legislation allows for more favourable results.

<comment><USER20> The legislation would permit information obtained in this way being used in legal processes. Currently if GCHQ were doing intercepts in this way it would be unlawful, and as such evidence obtained through such potential intercepts would be inadmissible in a court terrorism case for example.

<comment><USER19> _"... Currently if GCHQ were doing intercepts in this way it would be unlawful, and as such evidence obtained through such potential intercepts would be inadmissible in a court ..."_

True, but wouldn't the sources be covered under OSA and hence not disclosed?

<comment><USER20> Not if you're going to court. There's a whole secret inquest thing that's been going on, occasionally popping up in the news. The problem with relying upon intelligence for evidential purposes is that you can often expose the handlers, assets or sources involved in a public trial.

<comment><USER19> _"... The problem with relying upon intelligence for evidential purposes is that you can often expose the handlers, assets or sources involved in a public trial. ..."_

Excellent point.

</comment></comment></comment></comment></comment><comment><USER21> This government keeps shooting itself in the foot. If only I was young enough to flee.

<comment><USER22> Where to?

<comment><USER21> Where the grass is greener of course!

</comment></comment></comment><comment><USER23> I hope we'll be getting rid of these april fools stories tomorrow?

</comment><comment><USER24> Reading the headline, I instantly thought of George Orwell's 1984.

</comment><comment><USER25> I have no problem with this if it's just GCHQ and they need a warrant to do it. The police shouldn't be able to do it, though I don't have a problem if they can request GCHQ to do it for them! They don't think they have time to go beyond terrorism.

</comment><comment><USER26> As a UK citizen, I now do not regret in the slightest forcing every single user of my website to use HTTPS. It costs maybe 10 or 20 dollars a year, your site runs no slower, and all your users get real privacy.

<comment><USER27> Sorry to spoil it for you, but HTTPS provides no protection against MITM when the MITM is a nation state which can legitimately buy root keys from CAs (or become a CA themselves, if they are not already).

For more info about the security theater revolving around SSL in the context of HTTP see this great talk: <http://www.youtube.com/watch?v=Z7Wl2FW2TcA>

<comment><USER28> Well, you can verify the certificate is the same when accessing the page via your connection and via tor. If they have different chains you stop trusting the root authority.

This can be spoofed only if the nation state buys _the_ master root keys (i.e. not just a key allowed to sign any domain, but the root key the provider uses to sign everything, so that the chain is exactly the same) from every certificate provider... At which point you're screwed whatever you do.

</comment></comment></comment><comment><USER29> I think this will turn out alright. The article mentions a law prohibiting such surveillance without a warrant, and the fact that this is being covered by main stream media to start.

</comment><comment><USER30> Doesn't this violate secrecy of correspondence and their own data protection act of '98? Terrorism seems to be the godwin for privacy debates regarding national security.

<comment><USER12> The Data Protection Act gives the security services opt-outs on the basis of national security. This is to prevent you, for example, requesting all files that MI5 might have on you.

</comment></comment><comment><USER31> Watch these two videos and tell me whether you think this is already happening in with US data ... most-likely transferred outside the country for the purpose of analysis beyond the nation's legal jurisdiction.

<http://www.youtube.com/watch?v=_ae0yED6gRA>

<http://www.youtube.com/watch?v=oYNXVgYhPOc>

</comment><comment> adam-_- Wait, I had assumed this was an April Fools?

</comment><comment><USER32> blah blah blah use PGP for emails blah blah in fact encrypt all the things blah blah "no it's too hard for Joe Public" blah then Joe gets what he deserves.

<comment><USER33> PGP protects your from the state knowing who you are communicating _with_? I think not. And that's the main aim of this legislation. Tracking who you are talking to, and which Web sites your are visiting.

<comment><USER32> I confess ignorance on the particular details of whether a PGP-encrypted message leaks who the sender/receiver are, though supposing it does it only leaks a single token--a username-email pair. If the state can read everything you as an individual send, they can only know who you're communicating with if the PGP-encrypted message itself leaks a name that maps to another offline individual. You could argue that a PGP-encrypted email leaks the name by default--i.e., the recipient of the email. You tell me how useful it is to know that I sent a message to email@example.com without knowing what the message says. (More information can of course be found by coercing the particular email provider, if you can, to give up an IP address of the user, but we all know how reliable IP addresses are at pinpointing a single offline individual and there are many other options...)

Of course, we can go further down the rabbit hole of schemes, we don't have to stick with just PGP. As one of your sibling-comments noticed, anyone who wants to get around any State Spying can do so as long as the State leaves room for some reasonable assumptions. (As for outlawing encryption, that's a problem on its own, both in enforcement and in definition. You'd likely just get particular encryption software outlawed rather than the concept. (I'm aware of the US classifying certain algorithms as munitions.) Funnily enough, telegraph operators tried to outlaw simple ciphers and encodings (like 'u' for 'you' and even anagrams) used back in the day because they were losing money, since they charged a fee for a message length.)

I like the '89 paper entitled _The Dining Cryptographers in the Disco: Unconditional Sender and Recipient Untraceability with Computationally Secure Serviceability_. Here's part of the abstract:

We present a protocol which guarantees _unconditional untraceability_ , the original goal of the DC-net, on the _inseparability assumption_ (i.e. the attacker must be unable to prevent honest participants from communicating, which is considerably less than reliable broadcast), and _computationally secure serviceability_ : Computationally restricted disrupters can be identified and removed from the DC-net.

<comment><USER34> > _I confess ignorance on the particular details of whether a PGP-encrypted > message leaks who the sender/receiver are_

An important part of public key cryptography is the "web of trust" - you must know that you're sending stuff to the right person. A person's identity is tied to their PGP key.

> _You tell me how useful it is to know that I sent a message to > firstname.lastname@example.com without knowing what the message > says._

They build up big databases and then mine that for information. Most people are not disciplined enough to use cryptographic technology properly; and that holds for "not doing stuff that leaks data". Associating email@example.com with a set of data is an important step in getting the identities of both username and the people username is communicating with. Don't forget that even if username is careful the people that username emails might be idiots.

<comment><USER32> Both good points. From what I've been reading, "pattern finding" databases instead of "hash finding" databases are starting to be the new thing that allows huge and useful data analysis, and you can find patterns among a collection of lies or even just otherwise random data that wouldn't be associated without the pattern matching.

Fundamentally, it only takes one matching join on your citizen-data against any other collected assortment of data to implicate you. Human stupidity will continue being the weakest link. But there's still a lot that can be done to guard against it.

Even if the government manages to figure out that user@example is an Al-Qaeda member, and they know I sent them an email, they have no idea what I sent without resorting to, depending on how secure I was, torture, bargaining, private key compromises of the receiver, further insecure communications from the receiver's end, or hard drive sniffing for the original message from my computer. Increased carefulness can guarantee the message only exists within the minds of the sender/receiver, but with the advent of the "forgetting pill" even that vulnerability can be accounted for when plotting world domination. Of course as you note, human stupidity can undo it, but that's no reason to give up adding more layers of security.

</comment></comment></comment></comment></comment><comment><USER35> No politician in the US would even dare suggest this never mind try to get it passed as law. I really don't understand the politics. What constituency supports this?

<comment><USER36> Really? Does the patriot act not allow things such as this?

<comment><USER35> Read_wharf explains it well.

<http://news.ycombinator.com/item?id=3783906></comment></comment></comment>


U.K. Lawmakers Call for Ban on Traditional Cars in 14 Years - <AUTHOR> https://www.bloomberg.com/news/articles/2018-10-18/u-k-lawmakers-call-for-ban-on-traditional-cars-in-14-years?srnd=technology-vp <comment><USER2> Legitimately sickening. Now that cars are just barely affordable to most consumers, it's time to completely ban them from the streets so we can sell them our new electric cars.

So say the car companies.

I am extremely concerned about the environment, but I am of the opinion that carbon can be removed from the atmosphere as the first approach. Besides, cows are a massive producer of greenhouse gases, comparable to manufacturing and personal transport.

It's funny how none of the car companies cared about environmental sustainability until people started buying low-margin vehicles???

</comment><comment><USER3> I still think it would be impossible to totally eradicate the banning of traditional cars even in 2050 as it is still the main point of commerce of most part of Britain. I'm sure most fortune 500 automotive company will try to hinder this kind of law as they are still relevant in country's profit and they are developing new model of combustible cars.I believe a much cooperation with fuel powered automotive is the key and let them consider developing electric car should be an agenda first, before banning fuel cars.</comment>


M3DB, a distributed timeseries database - <AUTHOR> https://www.m3db.io/ <comment><USER2> Thanks for the interest, I just did a talk at FOSDEM a few weeks ago on the subject of querying over large datasets that M3DB can warehouse and query in real-time here:

Slides [https://fosdem.org/2020/schedule/event/m3db/attachments/audi...](https://fosdem.org/2020/schedule/event/m3db/attachments/audio/4032/export/events/attachments/m3db/audio/4032/FOSDEM_2020_Querying_millions_to_billions_of_metrics_with_M3DBs_inverted_index.pdf)

Video [https://video.fosdem.org/2020/UD2.120/m3db.mp4](https://video.fosdem.org/2020/UD2.120/m3db.mp4)

</comment><comment><USER3> Uber has started many projects that ended up getting open sourced. And many of them are now either abandoned or on life support. H3 comes to mind as something we almost ended up using but luckily avoided.

These open-sourcings seem a bit like PR pieces with no guarantees of any support or evolution after being published.

<comment><USER4> It's opensource. Why should Uber give any guarantees? They are not in the business of selling software.

Unless Uber is actively blocking contributions, it's not Uber's fault if no community formed around something they opensourced.

As for this being a PR piece, they could have achieved the same with just a detailed blog post and no code. It looks like a expensive PR piece if they have to opensource work that took probably hundreds of development hours.

<comment><USER3> I agree with everything you say.

But without any certainty around the roadmap, support, and longterm commitment by Uber to maintain these projects, they're nothing more than interesting repos amongst a sea of interesting repos.

The way Uber brands them suggests that they're suitable for use in production environments, but so far that hasn't been the case with anything they open sourced outside a narrow envelope that resembles their own operating model. Maybe this project will set a new trend, but so far nothing they put out gained any traction or became suitable for general purpose production use. In that regard, H3 and their other projects have remained at the level of decent 'show HN' pieces rather than something you'd ever use professionally. In other words, marketing.

Based on previous news coming out e.g. [https://news.ycombinator.com/item?id=20931644](https://news.ycombinator.com/item?id=20931644)

It seems like Uber had too big of an engineering department with too little work to do, so they started reinventing wheels. Which is cool if they're willing to support them in the long term, but so far that hasn't proven to be the case.

<comment><USER5> >It seems like Uber had too big of an engineering department with too little work to do, so they started reinventing wheels. Which is cool if they're willing to support them in the long term, but so far that hasn't proven to be the case.

Former Uber engineer here. I can assure you that while our engineering team was massive, there was anything but too little work. If anything most engineers were massively overtaxed. Whether or not the work we were undertaking was meritious and valuable is an entire branch of philosophy I'm pretty sure.

Part of the struggle at big companies is that a lot of existing solutions just don't work. Let me use an example with chat. A few years ago Slack was evaluated as a replacement for HipChat, since Atlassian's outages had finally started affecting us during our own outages.

Everybody wanted to go to Slack, but the cost of Slack was tremendously prohibitive and the state of the service then (as I was told) was such that it could not support a company of Uber's size. Tremendous effort would have been undertaken by Slack to support Uber and they didn't want to expend that effort for a single customer. This was late 2015 early 2016.

There were tons of options, but ultimately an in-house chat software was created. At the time it seemed required to make our own highly reliable chat, considering how distributed engineering teams were. I think if you talk to anybody without the background of how chat evolved at Uber they would think the in-house chat project would have been a boondoggle.

Not all over-scoped engineering projects are actually so noble. There was certainly a ton of "reinventing wheels" going on. There was significantly more "these problems are really hard and I only have bad solutions."

Though if the result is ultimately, "nothing more than interesting repos amongst a sea of interesting repos" sign me up.

<comment><USER6> There seems to be a pervasive misconception by the very employees at Uber, that they built their own chat platform. When in reality, and someone please correct me if I am wrong, uChat was a white labeled Mattermost.

I have heard that the team that put it together actually tried to hide that fact from the company (for the glory, I guess). But that could be apocryphal.

<comment><USER5> That's entirely not true. The team was always forthcoming about the fact it was Mattermost, at least to other engineers.

Mattermost didn't work out of the box, and certainly not the way and at the scale Uber needed it to. I'm not overly familiar with the technical details, but one thing in particular stands out as an example. There was a Town Hall channel that every user had to be a member of. This unfortunately did not scale, and not enough ACLs were available to limit all the ways users could use this universal room. Eventually they really fixed the problem, but it was a tremendous pain point for a long time. There were a lot of fundamentally "less than great" things about Mattermost that had to get updated to work for Uber.

There was the amusing time employees found out anybody could change the topic in the room, even if our chat permissions had been disabled. It was absolute chaos for at least an hour, I can't remember if it actually negatively impacted the deployment though it sounds vaguely familiar.

It's pretty telling of employees that badmouth the uChat team. That team ultimately was trying to do what they thought was best for the company, even if at the time it seemed like they bit off more than they could chew. There was no other engineering team so directly visible and exposed to the entire company internally like they were. People dismissive of their efforts are generally not used to the difficulty of making so many very vocal customers happy all at the same time, and could be more sympathetic.

<comment><USER6> I dug up the comment I saw that mentioned this. They also claim to be an Uber employee.

[https://news.ycombinator.com/item?id=19101617](https://news.ycombinator.com/item?id=19101617)

The fact that uChat is commonly mentioned by Uber employees as being the "custom chat solution we built in-house". It leads me to believe that comment that the team tried to hide that it was built on open source.

I don't doubt for a second that scaling Mattermost for a huge organization like Uber was a big undertaking. But it seems disingenuous for people to always mention that Uber built uChat when it should be more like "Uber put a lot of work into Mattermost to scale it up."

</comment></comment></comment></comment></comment></comment></comment><comment><USER7> On a related note, one of their engineers wrote a POC that uses FoundationDB instead of their custom storage engine.

[https://github.com/richardartoul/tsdb- layer](https://github.com/richardartoul/tsdb-layer)

The README does a really good job explaining the internals and motivation.

</comment><comment><USER8> I get Uber is huge. But honestly, there was nothing out there that could fulfill there use case? Cassandra, ElasticSearch, Influx, etc.? I might be completely wrong, but I just highly doubt that.

<comment><USER9> It's a database for a metric platform.

Think of OpenTSDB and Prometheus. Or for a better comparison think of Thanos [https://thanos.io/](https://thanos.io/)

As to whether they could fulfil Uber's needs, the thing about scale (real massive scale - I work at Cloudflare) is that everything breaks in weird ways according to your specific uses of a technology. The things listed above work for companies, until they don't. There's few things that seem to truly work at every scale, Kafka and ClickHouse come to mind for wholly different use cases than a time series database.

<comment><USER10> We run OpenTSDB (which stores its data in Apache HBase) at scale.

150m-200m events/minute and about 20-30 trillion (10^12) events stored. Doubling about every 12-18 months or so.

While it's true that things start to creak at scale, this has worked remarkably well for us so far. I doubt M3DB is somehow magical in this regard.

<comment><USER2> M3DB ingested 30 million datapoints per second (so 1.8 billion per minute) with each node writing hundreds of thousands of writes per second. The dataset was in the petabytes.

For us the cost savings vs OpenTSDB (millions of dollars of hardware), the faster query time and the reduction in oncall overhead was worthwhile.

<comment><USER11> Hundreds of thousands per second isn't very high when you compare that to clickhouse or kdb+.

</comment></comment></comment></comment></comment><comment><USER12> I setup a lot of Uber's early metrics infrastructure, so I can speak to how they got to the place where building a custom solution was the right answer.

In the beginning, we didn't really have metrics, we had logs. Lots of logs. We tried to use Splunk to get some insight from those. It kinda worked and their sales team initially quoted a high-but-reasonable price for licensing. When we were ready to move forward, the price of the license doubled because they had missed the deadline for their end of quarter sales quota. So we kicked Splunk to the curb.

Having seen that the bulk of our log volume was noise and that we really only cared about a few small numbers, I looked for a metrics solution at this point, not a logs solution. I'd operated RRDtool based systems at previous companies, and that worked okay, but I didn't love the idea of doing that again. I had seen Etsy's blog about statsd and setup a statsd+carbon+graphite instance on a single server just to try out and get feedback from the rest of the engineering team. The team very quickly took to Graphite and started instrumenting various codebases and systems to feed metrics into statsd.

statsd hit capacity problems first, as it was a single threaded nodejs process and used UDP for ingest, so once it approached 100% CPU utilization, events got dropped. We switched to statsite, which is pretty much a drop-in replacement written in C.

The next issue was disk I/O. This was not a surprise. Carbon (Graphite's storage daemon) stores each metric in a separate file in the whisper format, which is similar to RRDtool's files, but implemented in pure Python and generally a bit easier to interact with. We'd expected that a large volume of random write ops on a spinning disk would eventually be a problem. We ordered some SSDs. This worked okay for a while.

At this point, the dispatch system was instrumented to store metrics under keys with a lot of dimensions, so that we could generate per-city, per- process, per-handler charts for debugging and performance optimization. While very useful for drilling down to the cause of an issue, this led to an almost exponential growth in the number of unique metrics we were ingesting. I setup carbon-relay to shard the storage across a few servers- I think there were three, but it was a long time ago. We never really got carbon-relay working well. It didn't handle backend outages and network interruptions very well, and would sometimes start leaking memory and crash, seemingly without reason. It limped along for a while, but wasn't going to be a long-term solution.

We started looking for alternatives to carbon, as we wanted to get away from whisper files... SSDs were still fairly expensive, and we believed that we should be able to store an append-only dataset on spinning disks and do batch sequential writes. The infrastructure team was still fairly small and we didn't have the resources to properly maintain a HBase cluster for OpenTSDB or a Cassandra cluster, which would've required adapting carbon- I understand that Cassandra is a supported backend these days, but it was just an idea on a mailing list at that point.

InfluxDB looked like exactly what we wanted, but it was still in a very early state, as the company had just been formed weeks earlier. I submitted some bug reports but was eventually told by one of the maintainers that it wasn't ready yet and I should quit bugging them so they could get to MVP.

Right around this time, we started having serious availability issues with metrics, both on the storage side- I estimated we were dropping about 60% of incoming statsd events, and on the query side- Graphite would take seconds-to- minutes to render some charts and occasionally would just time out. We had also built an ad-hoc system for generating Nagios checks that would poll Graphite every minute to trigger threshold-based alerts, which would make noise if Graphite was down and the monitored system was not. This led to on- call fatigue, which made everybody unhappy.

We started running an instance of statsite on every server which would aggregate the individual events for that server into 10 second buckets with the server's hostname as a key prefix, then pushed those to carbon-relay. This solved the dropped packets issue, but carbon-relay was still unreliable.

We were pretty entrenched in the statsd+graphite way of doing things at this point, so switching to OpenTSDB wasn't really an option and we'd exhausted all of the existing carbon alternatives, so we started thinking about modifying carbon to use another datastore. The scope of this project was large enough that it wasn't going to get built in a matter of days or weeks, so we needed a stopgap solution to buy time and keep the metrics flowing while we engineered a long term solution.

I hacked together statsrelay, which is basically a re-implementation of carbon-relay in C, using libev. At this point, I was burned out and handed off the metrics infrastructure to a few teammates that ran with statsrelay and turned it into a production quality piece of code. Right around the same time, we'd begun hiring for an engineering team in NYC that would take over responsibility for metrics infrastructure. These are the people that eventually designed and built M3DB.

<comment><USER13> Really interesting read for me. I am currently not so far from your SSD point but our setup still works fine most of the time. It's just 100k/m though. I am trying to use more of the Go implementations of the graphite stack which did improve load. I will consider m3db probably to get some benchmarks. All the other ones would require some more people as you said.

</comment></comment><comment><USER14> How does it compare to TimescaleDB [1] ?

[1] [https://www.timescale.com](https://www.timescale.com)

<comment><USER15> TimescaleDB co-founder here.

TimescaleDB is a more versatile time-series database. It supports a variety of datatypes (text, ints, floats, arrays, json), allows for out-of-order writes and backfilling of old data, supports full SQL, JOINs between tables (eg for metadata), flexible continuous aggregates, native compression, and is backed by the reliability of Postgres. [0]

M3DB seems much more limited in scope [1]:

"Current Limitations

Due to the nature of the requirements for the project, which are primarily to reduce the cost of ingesting and storing billions of timeseries and providing fast scalable reads, there are a few limitations currently that make M3DB not suitable for use as a general purpose time series database.

The project has aimed to avoid compactions when at all possible, currently the only compactions M3DB performs are in-memory for the mutable compressed time series window (default configured at 2 hours). As such out of order writes are limited to the size of a single compressed time series window. Consequently backfilling large amounts of data is not currently possible.

The project has also optimized the storage and retrieval of float64 values, as such there is no way to use it as a general time series database of arbitrary data structures just yet."

[0] [https://www.timescale.com/](https://www.timescale.com/)

[1] [https://m3db.github.io/m3/m3db/#current- limitations](https://m3db.github.io/m3/m3db/#current-limitations)

</comment></comment><comment><USER16> So how does this compare to e.g. Clickhouse?

<comment><USER17> Clickhouse is an analytic column-based RDBMS. It's not a timeseries database. Each class of product is used to solve different problems.

<comment><USER18> Clickhouse works exceptionally well as a TSDB.

<comment><USER2> While this is true, for a metrics workload it does not work great I have both seen and heard from others, mainly due to the fact it does not have an inverted index - so finding a small subset of metrics in a dataset of billions of metrics ends up taking significant time due to the scan required to find the timeseries matching the arbitrary number of dimensions specified to find the timeseries you're looking for.

If you're building it with a specific application and a concrete schema you can create which will result in fast queries and don't have requirements for arbitrary dimensions being specified for lookup, then yes it's great as a TSDB.

Prometheus, M3DB, etc all use an inverted index alongside the column store TSDB to help with metrics workloads.

<comment><USER19> Most practical applications using Clickhouse for metrics data store the metric index separately. What index you want really depends on the metric system, e.g. with graphite data you don't want an inverted index, you want a trie.

<comment><USER2> Yes I've seen that also work, it's a lot of stitching together things yourself and we had to put a lot of caching in front of the inverted index we were using, however definitely plausible. ClickHouse doesn't do any streaming of data between nodes as you scale up and down which was a big thing for us since we had large datasets and needed to rebalance when cluster expanded/shrunk.

With regards to trie vs inverted index for Graphite data, I'd actually still be inclined to say inverted index is better based on the amount of queries I saw at Uber with Graphite where people did `servers.*.disk.bytes-used` type queries which is way faster to do using an inverted index since you have a postings list for each part of the dot-separated metric name, rather than traversing a trie with thousands to tens of thousands of entries in index 1 host part of the Graphite name. This is what M3DB does[0].

[0]: [https://github.com/m3db/m3/blob/b2f5b55e8313eb48f023e08f6d53...](https://github.com/m3db/m3/blob/b2f5b55e8313eb48f023e08f6d53350fabf09338/src/cmd/services/m3coordinator/ingest/carbon/ingest.go#L318-L330)

<comment><USER20> Just to point out that there is inverted index implementation of graphite data working on clickhouse.

Regarding the auto-rebalance feature, I cannot much more agree with you. It's something that clickhouse definitely need to handle internally.

<comment><USER2> That's interesting, I had not heard of ClickHouse as a backend for Graphite with an inverted index. Let me know if you have any links to that.

I'm assuming this is an out of process inverted index used alongside ClickHouse? Or is it more of a secondary table contained by ClickHouse which can be searched to find the metrics, then the data is looked up?

The latter scales not as well with billions of unique metrics since it's always a scan across the unique metrics stored in the time window your query searches for (since any arbitrary dimensions can be specified, all must be evaluated). This is the drawback of PromHouse which is an implementation of Prometheus remote storage on top of ClickHouse - and the major reason why PromHouse was only ever a proof of concept rather than a production offering.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER21> Ok everything open source was not good enough. Please make a simple benchmark. Without it, it is so hard to make decisions

<comment><USER22> I'm aware of only one public benchmark including some competitors - [https://promcon.io/2019-munich/talks/remote-write-storage- wa...](https://promcon.io/2019-munich/talks/remote-write-storage-wars/) Would like to see more of this.

</comment></comment><comment><USER23> Nice... patiently waits for AWS to create a managed version of it...

<comment><USER24> [https://aws.amazon.com/timestream/](https://aws.amazon.com/timestream/)

<comment><USER23> Yep, I registered for the "preview" ages ago, so I figured it was vaporware at this point

</comment></comment></comment><comment><USER25> admins/mods: this needs an apostrophe to turn it into "Uber's M3DB".

For anyone who's never heard of M3DB, and lives in a place where Uber doesn't operatore or is even banned (and so isn't part of daily life or conversation) "Ubers" might just as easily be some db researcher affiliated with the university of who knows where showing off something they came up with last summer and got a grant for.

<comment><USER26> Fixed, thanks

</comment></comment><comment><USER27> When the Android app is broken in so many easy-to-fix ways that blatantly interfere with usability, how does a company allow its developers to spend time on making custom internal tools or even spend time open-sourcing them? The company has so much money and yet seems so utterly mismanaged.

<comment><USER28> Sounds like off-the-shelf tooling just didn't work. What's your solution for that?

<comment><USER27> In the grander scheme that I'm discussing, the solution you're asking about is to gather no more metrics than the off-the-shelf tools allow and spend the engineering effort on fixing the simple bugs that prevent customers from getting cars. Why do they need a perfect ton of metrics while they can't fix simple things such as:

\- the car icon doesn't move as location updates come in (as evidenced by the route line getting shorter)

\- the on-screen keyboard does not allow me to type anything after the first message (no other app on my phone has this problem)

\- after I rate a driver, the app shows a map and none of the UI. I have to kill the app and restart it in order for it to be usable again. Picture this: I'm trying to get a ride, I open the app, I get nagged to rate the last driver. I agree just to be nice to the driver. (I should skip instead and get back to my task of getting a ride). After putting up with the nagware, the app fails 100% and I cannot complete the original task!

Alternatively, if they demand the collection of so many metrics, why don't they collect the metrics that would show them just how pathetically broken their Android app is?

</comment></comment></comment><comment><USER29> Does "Time Series Database" mean anything technical, or is this just some Uber marketing? In statistics, time series has a technical meaning.

<comment><USER30> A time series database is specialized for use cases where the data and query patterns are solely temporal in nature and must show the latest data in real- time (performance metrics/monitoring and stock prices come to mind). Relational and NoSQL databases tend to degrade rapidly with these query patterns at scale (think of the complexity of SQL queries to bucket rows by timestamp).

[https://en.m.wikipedia.org/wiki/Time_series_database](https://en.m.wikipedia.org/wiki/Time_series_database)

<comment><USER31> Note that temporal databases are also a thing, so it's probably wise to avoid using the word "temporal" when discussing time series databases. As far as I know kdb+ is the only technology that has a foot in both camps.

[https://en.m.wikipedia.org/wiki/Temporal_database](https://en.m.wikipedia.org/wiki/Temporal_database)

<comment><USER32> > _As far as I know kdb+ is the only technology that has a foot in both > camps._

Teradata Vantage also supports both. And you're absolutely right, it's important not to conflate "temporal" and "time series" support.</comment></comment></comment></comment>


Using HTML5 geolocation API to get the distance of the visitor from me - <AUTHOR> http://breakthebit.org/post/10512237123/using-html5-geolocation-api-to-get-the-distance-of-the

<comment><USER2> The author is incorrect about that being html5 - it's javascript.

I did this over two years ago with the same js call - I work for a company with multiple buildings. Go to a web page and you'll see a list of conference rooms in the buildings you are closest to and their availability. Found a web page to batch convert addresses to lat/long - made it pretty easy.

Here's something I wrote at the same time that shows your proximity to a city zip code.

<http://www.linquist.net/geo.php>

<comment><USER3> No, he is right. It is html5 (or commonly referred to as such). html5 is used to describe more than just the markup, it is also used to describe, location services, localStorage, etc.

</comment></comment><comment><USER4> You can see that on the map. Visiting <http://wayn.linkstore.ru> (on phones with Javascript support) will open the phone's email app with a canned message titled "Where are you now?" and a link to GeoMail in the email body. If the recipient is using a phone that supports the HTML5 location provider API, such as an Android or Samsung Bada device or an iPhone, when they click the link it will launch GeoMail webapp which lets them reply with a link to a Google Map showing their location.

</comment><comment><USER5> Since JavaScript has 64-bit floating points you could use simpler Spherical law of Cosines (cos c = cos a cos b + sin a sin b cos C) instead of Haversine to calculate distance.

</comment><comment><USER6> Geolocation is not a part of the HTML5 specification!

</comment><comment><USER7> But please don't do this. "X.com wants to know your location - Ok - Cancel". Meh.

<comment><USER8> What do you mean? That dialog can not be affected by the developer, afaik. It is hardcoded in the browser.

<comment><AUTHOR> Yeah it's hardcoded, more, the OS X Lion takes it to the system level, by showing a location services activity in the menu bar when you do this.</comment></comment></comment>


Claims secret Nato email docs leave phone hacking for dead - <AUTHOR> http://www.scmagazine.com.au/News/264426,claims-secret-nato-email-docs-leave-phone-hacking-for-dead.aspx

<comment><USER2> My internal parser threw multiple exceptions on that headline.</comment>


Ask HN: Someplace cheap to live and study - <AUTHOR>

I'm considering moving somewhere very cheap to spend some time studying. I'd like to be someplace relatively safe with good internet access. Also, a place that's culturally interesting would be nice. I'm only thinking about this for the first time, so I'm not sure what duration I'd be doing this (probably driven by the cost). Probably somewhere on the order of a few months to a year. Does anyone have any similar experience or advice? <comment><USER2> India <period>. For me the reasons are too obvious. Stay in Mumbai or Bangalore. Its safe, cheap, good internet, english is one of the national language and if not most, one of the most culturally interesting and diverse place in the world. <http://en.wikipedia.org/wiki/India>.

P.S:- Steve Jobs took a break in India, if you are looking for precedence.

<comment><AUTHOR> Any recommendations on how to start?

</comment></comment><comment><USER3> It depends on the length somewhat. The shorter you intend it to be, the closer to where you currently are it should probably be. For example, moving abroad wouldn't be worth it for 3 months, because the cost of the plane ticket would likely overwhelm any cost-of-living savings. But it might be worth it for a year.

Within the US, basically anywhere that isn't one of the stereotypically expensive cities is cheap. In California, it's dirt-cheap to live anywhere that isn't in the SD, LA or SF areas; San Luis Obispo and Eureka are decent coastal options. Anywhere in Oregon outside Portland is also cheap. Among cities, the midwest rust-belt cities are cheapest, e.g. Pittsburgh, and pretty interesting.

<comment><USER4> I recommend reading this: <http://www.paulgraham.com/cities.html>

And then I'll say if you are considering Eureka, CA (or Arcata, CA, ten miles away), I will heavily recommend Corvallis, OR instead. I've lived in these places, and the difference in the attitudes I get from people is amazing.

Oddly enough, after I moved to Corvallis (from the east coast) is when I read that essay, which led me to reading all his other essays, and to reading Hacker News!

Back to topic, most small towns feel stifling to me; you may be fine with what entails but I need some socialization, and what PG says about how cities (and towns) can influence the inhabitants seems to hold true, or at least it seems to hold true for me.

Best of luck to OP where ever your travels take you!

</comment></comment><comment><USER5> It's really cheap here in Alabama, and taxes are quite low too. You may not think much of the culture, but I assure you that it exists and is quite interesting, sometimes hilarious. Huntsville is a nice area with lots of engineers, artists, entrepreneurs etc, but I would recommend Madison which is a suburb.

</comment><comment><USER6> Where are you now?

Does it have to be an urban area? Almost any rural area should be relatively cheap, and if it's not too far from a major city, you could make a trip there once in a while for the "culturally interesting" part.

</comment><comment><USER7> Hồ Chí Minh City, Việt Nam

Awesome Internet access, amazing food, great culture, the nicest people. "Backpacker" cost of living is under $500/mo, and "Expat" cost of living is under $4000/mo. (For those who may not be familiar with the expat lifestyle, it includes niceties like a driver and a cook.)

My wife and I lived in Southeast Asia (several cities) from 2002-2004. In the interim, the infrastructure has gotten even better and the prices have remained flat.

</comment><comment><USER8> Reykjavík Iceland is getting cheaper and very english-friendly.

</comment><comment><USER7> Buenos Aires, Argentina.

I know several Facebook app developers who have moved down there and are living like royalty for $2500 / month.

</comment><comment><USER9> Banaras Hindu University, India.</comment>


Are Americans Enamored with the Wrong Kinds of Entrepreneurs? - <AUTHOR> https://hbr.org/2016/11/are-americans-enamored-with-the-wrong-kinds-of-entrepreneurs <comment><USER2> Yes. I have found (when I was looking for a co-founder) that many people like the idea of running a company, but do not really want to sacrifice the time and money it takes to make it succeed.

Lots of people are also not self-starters. They need a boss telling them what to do or they will do nothing or surf HN/Reddit all day.

One partnership I attempted had this result. It ended up being a boss/employee role where I had to dole out the assignments and 9 times out of 10, if I didn't push my partner, the projects wouldn't actually get done at all.

We actually did end up finishing the project (which is the only reason I stayed), but ran into more roadblocks. My ex-partner then ended up telling me that he just wanted to get a job and that he didn't want to work on the company anymore.

It's been a year and he is still unemployed and living on savings in his parent's basement (before working on our project, he was an engineer at a large company for over a decade).

When choosing a co-founder, the person needs to be a self-starter and have skin in the game (lots of time or money). If they don't, they will not feel compelled to stay and will most likely leave during the bad times.</comment>


Everybody Calm Down. A Government Hand In the Economy Is as Old as the Republic. - <AUTHOR> http://www.washingtonpost.com/wp-dyn/content/article/2008/09/26/AR2008092602838.html?hpid=opinionsbox1

<comment><USER2> This government hand is plundering the taxpayers' wallet.

I heard Rick Edelman crying for the bailout this weekend. He listed at least 50 associations that supported the bailout, not one that wouldn't benefit from it. His "appeal to authority" fell on deaf ears.

Edelman said Congress inadvertently offered Wall Street a lollipop and, now that the lollipop might be taken away, we _must_ give it to Wall Street. Otherwise they'll throw a tantrum and send the Dow crashing. I say let them commit suicide if they wish.I don't think they're crybabies and they're certainly not suicidal.

I'd agree to a bailout if

1) all companies involved are declared bankrupt and their assets liquidated. No zombies allowed afterward.

2) every person working for the companies bailed out is fired with 2 weeks' severance pay & no golden parachutes,

3) Stockholders and bondholders aren't paid anything and

4) every cent that goes into the bailout is paid back from the proceeds of the liquidation within 7 years.

Item (4) is unenforceable but at least a target.</comment>


Ask PG: Why did you disable iframe viewing of comments? - <AUTHOR>

Hi PG,
I use the excellent Hacker News reader by Josh Huckabee every day - http://hn_reader.joshhuckabee.com and a few days ago it stopped displaying comments of HN stories.  After getting in touch with him he says there is now a new HTTP header preventing HN pages being displayed in an iframe.
Can I ask why this is and whether it would be possible to reconsider that decision?  Part of the beauty of HN is that even if someone doesn't like the format/design, there are a myriad of other ways of accessing it.  Especially only being displayed in an iframe, it wouldn't be placing any extra load on your servers right?
I would really appreciate it being looked at.
Thanks! <comment><USER2> From <http://ycombinator.com/newsguidelines.html>

        In Submissions

        ...

        Please don't post on HN to ask or tell us something
        (e.g. to ask us questions about Y Combinator, or to
        ask or complain about moderation). If you want to say
        something to us, please send it to email@example.com.</comment>