Apple security blunder exposes Lion login passwords in clear text - <AUTHOR> http://www.zdnet.com/blog/security/apple-security-blunder-exposes-lion-login-passwords-in-clear-text/11963 <comment><USER2> I can't name a single person who ever used "Legacy Filevault"; that's the "encrypt your home directory" thing from Leopard. This issue doesn't impact Lion FDE at all. Lots of people use Lion FDE.

Even the subhed on this story is misleading, and the lede paragraph seems to go out of its way to bury the true article lede, which is "if you're using FileVault home directory encryption, this impacts you" --- instead, it says "in specific configurations".

More generally: can anyone name a single case where ZDNet has broken a story we cared about? Even in this case, ZDNet is rehashing stuff published elsewhere earlier.

<comment><USER3> I find it interesting how Apple is defended when they make security blunders, while Microsoft was heavily slammed back in the day.

It is simply inacceptable that a user basically reported the issue on their support forum and didn't even get an answer back.

<comment><USER2> Every single time the topic of Microsoft's security track record has come up on HN, I've waded in to point out what a great job Microsoft has done. Here's one of my highest rated comments from several years ago:

<http://news.ycombinator.com/item?id=577684>

Now, I don't disagree with your general point: Microsoft gets more scrutiny than Apple does on HN about security, and Apple enjoys an inflated perception of platform security here --- I attribute that to a general Unix bias, by the way, and not to Apple fandom.

But please be careful to note that _I'm not a part of that phenomenon_. You will, if you dig, find comments of mine that are critical of Apple security; you will probably not find comments critical of Microsoft's security practices.

(To be clear: securing a whole platform is an incredibly difficult job, and platform software security talent is some of the hardest to find in the whole industry; both Apple and Microsoft take this stuff seriously and, compared to 2002, both do a fantastic job. Also: the security of the iOS platform is a different story than of the OS X platform.)

<comment><USER4> I don't see how comment history makes a separate comment more truthful. If anything, it makes people less likely to have proper critical thinking because they know you.

Which is exactly what he points out about your comment, but related to Apple. You know Apple thus you're less likely to criticize them properly.

It doesn't mean what you wrote is entirely wrong, but I think he has a point. MS is very harshly criticized for any security issue, no matter how small, and hey, that's probably a good thing.

For Apple if there's any possibility we find them.. excuses.. really? (and the "I don't know anyone who used file vault before!" sounds terrible, to be honest)

<comment><USER5> tptacek has been the most prominent defender of Microsoft's security practices on HN for years. Everything you guys are saying about how Apple get off easy while MS get slammed, he has said repeatedly and more coherently. And out of direct experience to boot.

It just didn't happen to be - and still isn't - relevant here.

<comment><USER4> My point is that it doesn't matter. For example if you follow my thread of comments some are going to be rated way up and actually be pretty insightful.

You'll notice sometimes I'm also wrong and make errors. You could get a strong opinion of me either way (good, or bad) by reading that.

If we were to know pretty well each person (like they do in smaller forums or places where the nickname and history is highlighted), we'd always agree and disagree with the same persons in _general_ (there's always exceptions).

And the person's reply was made on a single post, which I think is the way to go.

I don't know if HN nicks are small and history not as easy to follow as in some other sites on purpose, but I like it.

Now, I've been way off topic, sorry :)

Slightly more on topic tho: MS ain't perfect security wise either, even thus they've made huge progress. Microsoft research also has very interesting attempts such as Singularity or Gazelle. I don't know any other company doing that. That's one place I'd want to work for MS.

</comment></comment></comment></comment></comment></comment><comment><USER6> While I agree that this is a security hole and it should be fixed, a headline like that is completely misleading and a scare tactic to drive eyeballs to the article. This flaw only would affect a very small subset of users, but the headline makes it sound like everyone just had their passwords compromised

<comment><USER7> What I got out of the article seems to be more important than the number of users this could impact.

1\. A vital piece of the operating system was compiled with debug flags intact. 2\. Apple's lack of response on the issue.

I think this goes hand-in-hand with recent Kaspersky statement about Apple's poor security considerations.

<comment><USER8> Those are definitely the two 'take-aways'. If there is a hole here... there may be other holes that might be REAL security threats.

Other people are correct as well, in that the headline is link bait. I was expecting to find a way to get clear text passwords from my test OSX Lion setup. I can't actually do that on my test system, and I'd wager the vast majority of hackers can't pull that off either. At least not without changing the setup.

Of course... probably my fault for believing you could.

<comment><USER9> > If there is a hole here... there may be other holes that might be REAL > security threats.

The presence or absence of a specific issue is not indicative of the presence or absence of any other issues.

<comment><USER10> the presence of issues indicates higher probability of more issues

</comment></comment></comment></comment></comment><comment><USER11> Note: only applies to people using the old "FileVault" on Lion, not the new "FileVault2" (the one with full-disk encryption).

</comment><comment><USER12> So are there literally security researchers that go and poke around of every release of everything major in the software industry to find things like this?

<comment><USER13> There are. It's the main reason why "security through obscurity" isn't a good idea. There are people who spend their working days searching for this kind of stuff. Log files are probably one of the first places they would look for clues.

<comment><USER14> `grep password` isn't the hardest thing to do either

</comment></comment></comment><comment><USER15> Only slightly related, but this thread bears a striking resemblance to another HN exploit discussion:

<http://news.ycombinator.com/item?id=3925452>

The exact same back and forth:

Wow! This is _really_ bad... but it only affects a small subset of users... but they knew about it for months and didn't fix it... come on, nobody real actually _uses_ such a setup... what about me... you're all fanboys, this is just another example of how your religion doesn't hold security as a core tenant among its faithful.

</comment><comment><USER16> Go on, let's hear about how _devoted_ Apple is to security again.

<comment><USER13> Seems more like a QA problem to me, there should be some tests in the QA of a final release build that makes sure all the debug flags are turned off.

<comment><USER16> That's my point. "Security" is a complete package, that includes good QA.

</comment></comment></comment><comment><USER4> Original link: (not zdnet)

<http://cryptome.org/2012/05/apple-filevault-hole.htm>

</comment><comment><USER17> Does anyone else thing that it is slimy for ZDNet interpret clicks to the site background as the user clicking the ad below the nav-bar?

As an advertiser I would feel defrauded. Not one person clicking on the background is doing so out of interest in the advertiser's product.

How common is this practice?

<comment><USER18> I'm definitely not seeing that behavior. There was a pop-over ad that I had to skip though. I guess if that were malfunctioning / transparent, you wouldn't realize there was an ad frame hovering over the text?

<comment><USER17> Perhaps I wasn't clear. It's not the white background, it's the patterned background to the right and left of the content area. To be more precise, they have two div's with class "skinClick" setup on the right and left of the "content" div. You click on either one of those and it's the same as having clicked on the ad just below the nav-bar.

I tested in Safari, Firefox, IE and Chrome, same behavior. There's also the "Wait, your page is loading" popup ad you mentioned.

<comment><USER18> Oh, I see. Sorry my browser window wasn't that wide, I didn't even notice that background.

</comment></comment></comment></comment><comment><USER19> Steve called, he said "Just don't use it that way".

On a serious note, this has happened before. This is just the first time anyone has caught it before a patch. The QA at Apple is pretty noteworthy.

</comment><comment><USER20> the Console Message Inspector is pretty useful, it shows a lot of stuff that is normally hidden.

</comment><comment><USER21> I thought FireWire was being phased out. (Doubtfully due to security considerations. If I recall, Intel has something faster that uses a USB port.)

I have some older hardware, which was state of the art when I bought it, that uses FW.

Is FW going to go the way of PCMCIA and CardBus?

<comment><USER22> "Target mode" also works with Thunderbolt. In fact it used to work with SCSI as well; it far predates OS/X as a feature on Macs. It doesn't work over USB though.

The stuff in the article about Firewire mode being involved is really a red herring. You would have the same problem if your stolen laptop were opened up and the harddrive removed. Firewire target mode is just a less-invasive way of doing the same thing.

<comment><USER23> BTW, another curious part of firewire (unrelated to target mode) is that a firewire device can read and write RAM from a running PC, without interaction. Even when you have "locked the workstation". Random google link: [http://www.hermann-uwe.de/blog/physical-memory-attacks- via-f...](http://www.hermann-uwe.de/blog/physical-memory-attacks-via-firewire- dma-part-1-overview-and-mitigation)

<comment><USER22> Yes, a firewire has the ability to do whatever DMA requests it wants. This is a thruput advantage (especially when processors were slower) since the host CPU only has to set up the data transfer and the rest can happen in hardware. Back in the day, FW400 would beat USB2 in most benchmarks even though the raw bandwidth of USB2 is 20% higher.

The solution to this is to use an IOMMU, which protects memory from DMA traffic just like the CPU's MMU protects it from userland processes. However, I don't know if any current Mac laptops do this.

Thunderbolt, ExpressCard, and PCMCIA ports have the same issue although it'd require some fancier hardware to exploit. I think SD cards as well, but I'm not 100% sure about that.

USB isn't vulnerable to this because the protocol is more like a network card: devices send you packets rather than initiating direct DMA.</comment></comment></comment></comment>


Paul Vixie Explains How Protect IP Will Break The Internet - <AUTHOR> http://www.techdirt.com/blog/?tag=protect+ip

<comment><USER2> Contrary to the lede of this article, it's not impossible to merely _question_ Vixie's credibility here†.

First, this is the same Paul Vixie who proposed and advocated for RPZ. RPZ is a distributed blacklisting scheme for the DNS. Unlike the the email spam RBL, RPZ works at the level of DNS, allowing "policy" to determine which lookups fail. So it seems that DNS filtering doesn't break the Internet when it's used to combat malware, but does break the Internet when it's used suppress piracy.

Second, however urgent the authors of this document want to make DNSSEC sound, the _entire Internet_ functions without DNSSEC today. I can go on and on about how broken I think DNSSEC is, but I don't think I need to bother, because there's an even stronger argument as to how unnecessary it is. Put simply, the "secure Internet" was designed to assume that the DNS was untrustworthy. We built an entire parallel directory alongside the DNS to resolve that. To a large extent, that secure directory (the X509 SSL/TLS PKI) works whether or not the DNS is unsafe. To the extent that the DNS threatens TLS, those are fixable flaws in the TLS infrastructure (and many of those flaws are policy issues in TLS, and the majority of the balance of those flaws are UX issues stemming from the fact that we haven't refined the UI for TLS since it was introduced by Netscape).

Breaking DNSSEC _does not_ break the Internet. Proof: go do a Google search for your bank, click through it, log in, and check your balance. Let me know if any DNSSEC happens along the way.

Tying this back to Paul Vixie: Vixie is the Internet's foremost advocate for DNSSEC. It's unfair but not _totally_ unreasonable to suggest that Vixie resisted the randomization fixes to BIND that Djbdns adopted because he preferred DNSSEC as the solution to that problem; as a result, BIND's DNS cache was vulnerable for almost a decade while Djbdns wasn't.††

Next, as smart as Danny McPhereson may be, I think it's far from proven that DNSSEC can't coexist with fiat third-party filtering. In the DNSSEC implementation originally envisaged by the working group's current iteration of the protocol, end systems don't even run DNSSEC; they run stub resolvers that talk to cache servers that run the whole protocol. Those cache servers could have lookaside rules for a policy zone without breaking the security model for DNSSEC.

Finally, because the reality is that virtually nobody speaks DNSSEC today, it may suffice for PROTECT IP's goals to filter only insecure DNS. The sponsors of PROTECT IP could just easily say, "uh, of course we don't mean DNSSEC is illegal; we'll deal with DNSSEC another day, but for now, we're suppressing websites, not trying to destroy them, and we're content to have our intervention only impact DNS users".

I'm not a believer in PROTECT IP, I just think this argument is fragile.

For whatever it's worth, I think all 5 of the authors of this report are advocating in good faith what they think is best for the Internet. And I do buy the argument that fiat third-party filtering is bad for the Internet. I just don't think "it breaks DNSSEC" is the most compelling or intellectually honest argument. I think the honest argument is, "because we don't think any one authority will be an adequate steward of the Internet".

† _I'm choosing my words carefully; the_ answer _to the question might still be "he's totally credible"._

†† _Again this is a drastically unfair summary of an issue that could possibly reworded in a way that would refute my point, which is that Vixie's going to tend to err on the side of whatever makes DNSSEC easier to deploy._

<comment><USER3> Even though you can circumvent technical barriers, this PROTECT IP is a bad idea. It would bring more trouble than benefits.

</comment></comment><comment><USER4> The single best part of this techdirt article is reading the pro-PROTECT IP- shills perform writing gymnastics to "prove" that Vixie doesn't know what he's talking about, that only pirates would circumvent a state-sponsored and censored DNS system, and that the state would bother censoring non-"rouge" web sites. Oh, and that administrative punishment, not transparent to the citizenry, won't allow abuse and use for other purposes.

I love the techdirt Shill Corps. They're the best!

<comment><USER2> Lawrence Lessig once wrote something to the effect of, on the Internet, we're bound less by the paper laws contrived by policymakers and more by the intrinsic policy decisions made by code. The point I take from that is, one way or another, people are making decisions for you. Unless you can _both_ build infrastructure _and_ secure adoption for it, someone else is making decisions that curtail your liberty.

In this case, one of the same people who says DNS filtering will break the Internet just one year ago advocated a whole new piece of infrastructure to allow people to filter the DNS.

When Vixie did it, it was to suppress malware sites. I agree that this is a more admirable use of fiat third-party filtering than anti-piracy (note though that unlike the rest of HN, I think anti-piracy is a fine goal). But fundamentally, what's happening in both cases is mostly the same; other people making decisions about what you can and can't see on the Internet. And my point is, maybe that's OK.

Note also that nobody can impeach the DNS administrators and standards group sherpas.

<comment><USER5> >In this case, one of the same people who says DNS filtering will break the Internet just one year ago advocated a whole new piece of infrastructure to allow people to filter the DNS.

Filtering infrastructure is one thing, this is an actual law you could break (accidentally even) and then get into real trouble.

</comment></comment></comment><comment><USER6> Just wanted to highlight this:

"In the last few months we've been hearing from more folks in the startup world who are really concerned about the excessive burdens PROTECT IP is going to put on them. If you're an entrepreneur who's worried about this, we'd like to hear about it. Please contact us."

<http://www.techdirt.com/contact.php>

</comment><comment><USER7> I think one of the reasons flawed legislation like "Protect IP" comes into the picture is because the "Internet" community does not have a technical ruling body like the AMA (American Medical Association). The Congress trying to legislated IP packets is a ridiculous idea. But their trying to legislate medical procedures is an equally ridiculous idea (well, except for the anti- abortion zealots), and for that we have the AMA to thank for. They step in and tell the politicians: stay away from our business; we know what we are doing.

So maybe an association like AMA (American Network Association?) would be beneficial here. Every practicing computer scientist/engineer can join in, and with their membership fees, they would make sure that asinine legislation doesn't see the light of the day.

Just thinking aloud here.

<comment><USER2> Why do computer scientists get to decide how intellectual property enforcement should work? Serious question.

<comment><USER8> I don't know if they "should get to decide", but as the group tasked sort of "de facto" with implementing the technical controls which result from enforcement, I think you could argue that they should be more involved than being told "hey, we just legislated this, now make the internet comply."

<comment><USER2> I generally have a bug up my ass about the idea that those capable of doing $X with technology should be the ones to decide when/how we do $X. We don't, by way of example, leave the rules about deploying deadly force up to the best marksmen in the police; or, more reasonably, we don't leave air traffic flight paths entirely up to the air traffic controllers.

But that is generally the attitude we seem to favor with regards to the Internet. It's a sort of "might makes right" setup; "Oh yeah? You want to stop people from violating centuries-old copyright laws? Why don't _you_ design and implement a scalable distributed directory system?" Whether you support copyright or don't (I do), this doesn't seem like a good process for determining policy.

Part of that is just 15+ years spent in software security. The notion seems to be "if it's hard to stop someone from doing $X with technology, we shouldn't make it illegal to do $X". Well, you'd be surprised what it's hard to stop people from doing.

<comment><USER8> I don't disagree. I think maybe it's partly just "nerd exceptionalism" (which seems to run rampant in discussions with technical people). I like the idea of policies/laws being created with advise from people actually knowledgeable in the effected area, but I don't think that's the same thing as saying that those policies/laws should be drafted by that same special interest.

I like the idea of financial people being advisors in policy-making regarding economics, but also cringe at the thought of them being the ones to draft the legislation.

I'm actually a pretty bad nerd, in that I don't get particularly riled up about issues like this. I also support copyright (self-serving as a working photographer, but also as someone who just doesn't see a problem with the arrangement of paying people who make things I enjoy, and not feeling entitled to disregard the way they want to make those things available).

I also think I'm a dinosaur, and that in another fifteen years, the entire makeup of content creation and distribution will have been gutted by a society that increasingly feels like it's their inalienable right to have access to whatever they want. I hope I'm wrong about that though.</comment></comment></comment></comment></comment>


Remote Cloud Execution – Critical Vulnerabilities in Azure Cloud Infrastructure - <AUTHOR> https://research.checkpoint.com/2020/remote-cloud-execution-critical-vulnerabilities-in-azure-cloud-infrastructure-part-ii/ <comment><USER2> Yikes, that's about as bad as a vulnerability gets for a public cloud provider.

Checkpoint has been having themselves a month with TikTok, Zoom, and now Azure (even if the actual disclosure happened in 2019).</comment>


Show HN : Migrate Posterous blog to Tumblr in few clicks - <AUTHOR> http://justmigrate.com Hopefully this will bring some smile to lot of folks out there to move their posterous blog to Tumblr.<p>Its a clean & safe way to migrate. Almost all post type is supported and posts are queued once Tumblr limit is reached. <comment><USER2> Seems like a much better solution than trusting the Posterous founders not to mistreat their users again. They recently posted their new site trying to get $5/month out of people losing their content on their old site, lol.

</comment><comment><USER3> Great timing. Images etc in the posts are moved too? Can I choose a theme during migration?

<comment><AUTHOR> If you have post with one Image its moved to Tumblr but for embedded images / media give us some time :)

Basically most of the users will have seamless move & for rest we are on it.

</comment></comment><comment><USER4> Great idea. Any similar services for wordpress?

<comment><AUTHOR> There is a plugin for this currently. If there is good demand we can get it ready in few days with full media migration.</comment></comment>


9 benefits of cloud based project management software - <AUTHOR> https://www.proofhub.com/articles/9-benefits-cloud-based-project-management-software <comment><USER2> With cloud-based Software, it´s easier to work with a remote team or share things with your customers. I know that in the future everything in business is moving into online storage with a backup somewhere. If your PC is damaged, the data and files are mostly gone forever but with a cloud-based memory, it´s not a problem anymore.</comment>


Zillow surprises investors by buying up homes - <AUTHOR> https://techcrunch.com/2018/04/14/zillow-surprises-investors-by-buying-up-homes/ <comment><USER2> Buying homes for subsequent resale is a capital-intensive, old-economy, bricks-and-mortar business.

Zillow will borrow money to buy the homes, which means that (a) the clock will start ticking the instant each new home is purchased, and (b) this endeavor can be profitable only if proceeds from resales/rentals are sufficiently high to cover cumulative debt service costs -- in addition to all property taxes and ongoing maintenance expenditures associated with home ownership.

Why would a heretofore capital-light SaaS business like Zillow want to do this?

The only sensible explanation I can think of is that Zillow's current business is no longer growing quickly, i.e., Zillow is now a boring, mature company.

The stock dropped 7% on the news last Friday.

<comment><USER3> Or Zillow has access or insight to data that general property investors do not, thus driving abnormal returns.

<comment><USER4> That's my guess also. If they have details on the specific aspects in the specific markets that drives prices, being able to "jump on a deal" could work out well.

The question becomes if there are enough opportunities like that to move the needle for them.

If I had to guess, I would have guessed moving into Lending Tree's matchmaking area would be easier and have a better ROI.

<comment><USER5> What specific details would they have that other's don't. I don't know how prevalent FSBO is on Zillow in some markets, but in mine it's extremely limited. I'd be shocked if it made up 5% of the residential market, probably closer to 1%.

The rest of the listings are from MLS systems and they pull housing data from county systems. For that, I'd assume there is a data broker and Zillow isn't integrating with thousands of counties. If that's the case, then both the MLS and county data can be had by anyone. With that information, you'd get lot details, house details, listing history, county tax valuations and sales history.

What other data do you need?

A lot of house flippers are agents because they get the MLS listings ahead of the public and can move faster on them. I don't know when Zillow gets their MLS data, but listings almost always hit Realtor.com a day before they hit Zillow, so I don't see that as an advantage either.

<comment><USER6> What's FSOB? Was it just a typo of FSBO (as in for sale by owner)?

<comment><USER5> Yes, corrected.

</comment></comment></comment></comment></comment></comment><comment><USER7> How can zestimate be trusted if zillow is in the business of buying and selling homes? There's a reason why banks separate advisory business from the trading business.

<comment><USER8> It's already pretty inaccurate today (overestimates by about 10%[0]), so there's not much change there. ;-)

[0]: Very rough estimate, may be market-specific.

<comment><USER9> Really it's only inaccurate because the price of housing isn't static and certainly isn't objective. Zillow works based on how similar houses near yours have sold, which could be low because the seller wasn't driving a hard price and the buyer was a good negotiator. It could be higher because the seller was firm on the price and the buyer didn't know any better. Not to mention, Zillow doesn't know if you recently renovated your kitchen. They don't know if you have unrepaired water damage. It's all a guess.

That being said, I wouldn't say 10% is a super high overestimation. On my street are two identical houses and one sold for $150k while the other sold for $180k, even though they're literally identical other than the color of the siding.

The number that really matters is the appraised value. Zillow had my house at $110k when I bought it and the buyers were asking $140k. It was a surprise when the appraisal came back at $145k. If Zillow was right, the bank would never have given a loan for $30k over the value of the house. But there was no way for Zillow to know the amount of work the previous owners put into the interior of the house.

<comment><USER8> > Really it's only inaccurate because the price of housing isn't static and > certainly isn't objective.

If it was static, an estimation tool wouldn't be useful.

And it's not just "the price of housing isn't static and certainly isn't objective." After all, Redfin faces exactly the same difficulties. Somehow Redfin uses more or less the same data and comes up with estimates that are much closer to the prices houses actually sell for (in this area).

The median house sold in my area cost ~$660k last year (zip code 98117). 10% overestimation is a (much) larger absolute error than $15-30k.

And there is plenty of sale volume in this area of similar houses -- the average/median of which are far below Zillow's estimates.

I wouldn't say appraised value is what matters. What matters at the end of the day is what buyers are willing and able to pay. Appraised value is both a factor in that as well as a result of that.

</comment></comment></comment></comment><comment><USER10> I get the feeling a company like this would only make this kind of leap because they have the data to show it will pay off. I.e. they can formulate algorithms to make the best purchases and the most profit. I foresee big gains from this

<comment><USER11> It's rarely a good idea to compete against your customers

<comment><USER12> Isn't Amazon's marketplace similar in that regard? They compete with other sellers using Amazon's platform all the time.

Ethically, it seems a bit fuzzy for me given that one of Zillow's big features is there zEstimate. How can they demonstrably prove they aren't tweaking that somehow for their own gain?

<comment><USER13> I'd argue that Amazon's customers are the buyers of the products, not the sellers using Amazon's platform.

<comment><USER14> I'd argue that Amazon has many different groups of customers.

</comment></comment></comment></comment></comment><comment><USER15> Zillow has such reach that they can low-ball every offer so that 99% of people won't take it - but as long as 1% of people do, and Zillow can avoid terrible houses, then Zillow will be buying properties at a huge discount from the market, plus collecting a substantial fee. Thus, they can sell at market rates and make a big profit per house.

The key advantage here is that they can make these low offers to a much bigger audience than anyone else can do. This should allow them to be either be more profitable per house than anyone else, do more volume than anyone else, or hit any mix of these two better than anyone else.

Of course, they can shoot themselves in the foot pretty well if they:

\- Try to go for volume over profitability, and then catch a downturn. \- Do a bad job of running repairs. \- Don't do a good job of catching houses that are much worse than they appear.

However, there's no physical reason this can't be extremely profitable. They have the data to see their current home investors making money. If they feel they can identify the most profitable attributes of these flips, then they can route all the extra profitable ones to themselves. The only losers here are the existing people in Zillows home flipping program. They are almost guaranteed to now be getting the second best homes, once Zillow has skimmed off the profitable ones.

<comment><USER16> > Zillow has such reach that they can low-ball every offer so that 99% of > people won't take it - but as long as 1% of people do

It'd be pretty inconsistent to put in a lowball offer when your company publishes an estimated value for every home in the market.

<comment><USER15> And yet Zillow has been already been doing these low offers successfully, but with only third parties making the lowball offers.

Sometimes people just want sell now.

</comment></comment></comment><comment><USER17> So what does it mean for me if I buy a home straight from Zillow? Better price?

<comment><USER18> Likely you'd get the same deal as any other real estate developer in the flipping business would give you. They'd be looking for undervalued properties that can be fixed up and resold at a profit. Which means they're on the open market and you're bidding against other purchasers, like normal.

<comment><USER19> The problem seems to be that any homeowner getting an offer from Zillow would immediately know they had mispriced their listing and not accept.

Unless Zillow has some new efficiency that no one else has (super contractors that can fix up cheaper than other investors, low cost capital) I don't know how they will be able to outbid the market consistently as there aren't enough dumb sellers with dumb agents out there.

But maybe I'm missing a way how they could use analysis to identify "bargains" without the seller getting clued in and upping their price.

<comment><USER20> I mentioned this elsewhere, but 'closing certainty' is a real concern in the real estate market, to the point where many sellers will take a lower offer price in favor of a cash buyer.

<comment><USER17> I never understood why though, in the worst case doesn't their house just take a bit longer to sell if a deal falls through? Aren't there backup offers in play? Is taking a lower offer really better than just waiting a bit more for the higher offer?

<comment><USER21> Here's an example reason why someone might take an earlier offer: A new job starts July Nth. It's now mid-April. The family needs to be moved before July. They don't have a lot of months left to close a deal.

<comment><USER17> But how often is a seller so motivated?

Could Zillow use some combination of data from data brokers to find out how motivated a seller really is and then take them for as low as they can go?

For instance you're selling a home and I see your job has changed on LinkedIn and your home hasn't sold yet.

</comment></comment></comment></comment></comment></comment></comment><comment><USER22> If you read the Redfin 10k, they were doing this already as a service called "Redfin Now." I think it is interesting that two large data-driven pricing services are both pursuing this strategy. If you have better data, it might be possible to make money just on your pricing edge.

</comment><comment><USER23> Discussed a few days ago: [https://news.ycombinator.com/item?id=16825539](https://news.ycombinator.com/item?id=16825539).

</comment><comment><USER24> Isn't this announcement to mess with Opendoor's current fundraise? Similar to Microsoft announcing vaporware back in the day or Uber trying to interfere with Lyft's fundraises?

</comment><comment><USER25> Nobody wants to tackle the elephant in the room in real estate: we need to build a lot more. that's really hard.

</comment><comment><USER26> Competition with its own customers too. Isn't this a conflict of interest?

<comment> gm-conspiracy As long as this is disclosed, it should be okay.

[https://www.trulia.com/blog/what-is-dual- agency/](https://www.trulia.com/blog/what-is-dual-agency/)

</comment></comment><comment><USER27> This move is very interesting.

I have been studying this part of the business quite a lot lately. A few considerations:

1) It seems to me that Opendoor, Unison, etc, and now Zillow, are trying to capture "pre-foreclosure" opportunities before they hit the market. Think about this: why would you want to sell your house quickly, and leaving money on the table, if not because you're short on cash and you know you will soon lose your house?

2) Secondarily, especially in the case of Opendoor, some homeowners might want to simply avoid the complex and time-consuming task of "changing homes" (fixing small details, picking the agent and listing it, staging it, handling the delicate balance between selling the current one and securing the next one, etc). Opendoor promises to vastly simplify this part, which I think is good.

3) I believe that some of these assumptions are specific of the current market situation, where in most "hot" real estate areas (SF, LA, Seattle, NY, Honolulu) prices are wild, the appetite for real estate has never been stronger, and at the same time there's still many opportunities to make a quick buck by flipping, accessing certain information earlier, etc.

I am not completely sure what will happen when/if the market corrects (might also depend on the size of the correction).

4) In the US the whole process of buying homes, financing them, and potentially use LLCs/Trusts/etc to handle various real estate properties as investment is still very fragmented, and still very dependent on which State you live in and in which State the property resides. There are essentially thousands of different combinations and configurations, and the optimal answer to each can also vary over the years, following updates to the legal code or to tax rules.

All in all, I think that Zillow is trying to carve out another piece of the market, and not necessarily because their current market is showing signs of slowing down (even if that has discussed just recently [0]). Heck, it might even be that Opendoor's outstanding fundraising results might have triggered the decision to go against them.

5) Long term, I think most real estate assets will become fully digital, and handled exactly like a small piece of software - that is, for everything that pertains property and ownership, taxation, transactions, etc. Of course, fixing a leaking pipe will still require a physical intervention :)

For background: I'm co-founder/CEO of a startup which will provide a software platform to digitize real estate assets, and legally transact on properties using APIs. We leverage the Ethereum Blockchain as a global land registry where these transactions are recorded. (I don't intend to use this comment to publicize it, hence no link).

[0]: [https://mailchi.mp/12c664b1b53c/realtorcom](https://mailchi.mp/12c664b1b53c/realtorcom)

</comment><comment><USER28> Zillow is not to be trusted they have power to manipulate the market prices with their zestimate. Not only that but they're ridiculous leads pricing they charge the agents ($250 for every time you fill out the contact me).

<comment><USER9> I'm not sure Zestimate actually manipulates the market. Banks don't care about Zestimates when they're handing out loans, they care about appraised value. Zestimates don't recoup the losses on a foreclosure.

</comment></comment><comment><USER29> Next week: Yelp to open chain of restaurant, citing vast knowledge of what makes for a satisfying dining experience. Spokespeople ensure their users that the impartiality of their algorithms will continue. This story brought to you from Google News Reporting.

</comment><comment><USER30> Definitely not another housing bubble. No way.

<comment><USER31> The real question is who will be holding the bag after midterm elections.</comment></comment>


Chatroom.horse - <AUTHOR> http://chatroom.horse/ <comment><USER2> If you are as confused as I was and, like me, you came to the comments first instead of reading the page, I got you fam: [http://www.deathandtaxesmag.com/265340/horsechat- horsechat-h...](http://www.deathandtaxesmag.com/265340/horsechat-horsechat- horsechat-horsechat/)

<comment><USER3> I'm guessing it's deliberate but if there were any page to push the ardent anti-adblocker over the edge to installing an adblocker.. that's it.

</comment></comment><comment><USER4> The active spam happening there right now is if anything a fabulous demonstration of just how terrible anonymous people on the internet tend to be, and how quickly potentially fun things can go to crap as a result.

<comment><USER5> Same thing happened to an anonymous forum recently - [https://twitter.com/lpushx](https://twitter.com/lpushx)

</comment></comment><comment><USER6> Okay. So this is a chat application surrounded by a 'not so' elaborate hoax concerning floppy drives someone supposedly found in a vacant lot. It's made pretty obvious though; a screenshot of an Instagram photo with over nine- thousand likes and comments shop't.

<comment><USER7> I don't understand how this is getting so many votes... It's all clearly fake and the website isn't any good. Solid spam.

<comment><USER8> Domain names under the tld .horse are inherently funny.

<comment><USER9> [http://goodlooking.horse](http://goodlooking.horse)

</comment></comment></comment></comment><comment><USER10> [http://www.deathandtaxesmag.com/265340/horsechat- horsechat-h...](http://www.deathandtaxesmag.com/265340/horsechat-horsechat- horsechat-horsechat/) gives background.

<comment><USER11> I hope nobody read that and still thought it might be real.

Some of the tagging they did was funny at least:

keyvalues: "tag=do-horses-dream-of-electric-oats"

keyvalues: "tag=90s-horses-will-remember-this"

<comment><USER10> Mea culpa—I thought it might be real, but didn't have time to look at it.

Are .horse jokes a thing now?

<comment><USER11> Apparently! I was fooled at first but then started thinking how odd it is that the OP knew their whole company history and downfall.

</comment></comment></comment></comment><comment><USER12> I'm never certain what to make of 'Found footage' type art projects like this. There's certainly value in building with a retro style, and I see the fun in pretending it's an artifact of the retro time it comes from. I'm just not certain what to do with it. Perhaps that's the point; It's a toy that excites some and bores others, and like-minded people can collaborate and chat about the toy that has excited them.

I'm also sort of expecting a flood of bronies on said chat soon. I'm not certain if that will create more or less shitposting than HN.

</comment><comment><USER13> I coded this, didn't think it would be so popular! Just added more robust spam blocking to reign it in during the stampede!

<comment><USER14> it doesn't appear to be working, according to all the neighs I'm seeing

</comment></comment><comment><USER15> Fun app but RIP your server, there are about 100 ppl in there right now pasting books of text.

<comment><USER16> It's getting heavily spammed currently, yeah. All i'm seeing is "TREE SUCE DES BITES". I don't even know what that means

<comment><USER17> afaik it means 'trees suck dicks' from french.

</comment></comment></comment><comment><USER18> neigh

</comment><comment><USER19> well done

</comment><comment><USER20> traceroute bad.horse

<comment><USER21> bad.horse

bad.horse

bad.horse

bad.horse

he.rides.across.the.nation

the.thoroughbred.of.sin

he.got.the.application

that.you.just.sent.in

it.needs.evaluation

so.let.the.games.begin

a.heinous.crime

a.show.of.force

a.murder.would.be.nice.of.course

<comment><USER22> if you increase the ttl it goes on much further (27 hops in 220.127.116.11/22)

</comment></comment></comment><comment><USER17> Code to spam:

      var $ci = $('.chat-input');
      var str = "spammy string";
      setInterval(function() {
        $ci.value = str;
        document.horse.whinny();
      }, 50);

<comment><USER23> Their broadcast method rate limits you to 1 message every 500ms. It also looks like they're actively changing it to cut every message to 500 chars now too.

Some kind of infinite backoff based on how quickly you're trying to send messages would probably slow the spam down and make room for human pace messaging to occur.

<comment><USER24> ha, i took it down with: setInterval(function() {io.connect().emit('join') }, 10)

but it looks like they hot patched the messages out within a few mins : ) well played</comment></comment></comment>


Ask HN: Is it a good idea to sell my startup? - <AUTHOR>

I have been running my startup for a while, no seed funding and still was able get around ~$500 (ish) monthly profits.
Yet I was thinking that if I could sell it I would have more money to start something new plus to help me with my college.
I would like an advice from someone with more experience, should I sell my startup and attempt to create something else or focus more on my product?
Url: http://skyul.com <comment><USER2> I actually would be in the market for your product. It's not so much the web design turning me off, it's that a 1 day trial costs me twice as much as it would to sign up for the service.

$2/day = $60/month.

I would suggest a way to get a free trial, for at least a week that's linked to a credit card or paypal account or something to keep people from just signing up for tons of free trials. Kind of like how Netflix or Hulu does it.

</comment><comment><USER3> How many hours a month would it take to run if you weren't focused on improving the product, just keeping the site running?

If the answer to that is a decent hourly rate, do that and then just start doing something else.

If it's not, and you aren't able to figure out growth, you may want to shut the doors, as I think it's not likely that you'll see a lot of buyers looking for $6K annual revenue, even at high margins.

I'm not that good at marketing either, but I'm having to figure it out. We programmer types think that "if you build it, they will come", and that a better mousetrap will trump any need for a sales and marketing strategy beyond a good checkout page. The truth is, if you don't figure out some of the marketing basics for yourself, at least enough to know what type of marketing experts to use, you'll be likely to have the same problems with your next venture. You might get lucky and stumble into a hot market, but if you don't, marketing will be the difference between being in the top tier making a double digit percentage of the available revenue in the market and being an also-ran making a pittance.

<comment><AUTHOR> Thank you, this really put me on thinking. The good part is that I always like to work hard and automate most of my products even if it takes me more time, and in this case it's ~97% automated. The problem with marketing is that I couldn't find my buyers when I tested, most of the success was with forums but at a low volume. So I assumed that I picked the wrong niche where to do business :)

</comment></comment><comment><USER4> What have or are you doing to grow that revenue?

If you've done your best and you can't get past that $500 barrier then move on. But getting from $500 to $5000 should be a shorter path than starting a new product from nothing.

<comment><AUTHOR> I tried different approaches but I'm not that good when it comes to marketing. From what I saw the proxy industry is pretty big with over 1 mil searches monthly, just that I don't know how to get to my customers. Recently I tried to get more exposure and it has a slowly growth, but yet I don't feel that I can get much out of it.

<comment><USER5> You could probably secure more customers with a better landing page. It's too wordy, gramatically awkward, and there are several spelling errors ('ressource' -> 'resource'; 'recieve' -> 'receive'; 'paypal' -> 'PayPal'). The crucial 'Subscribe' button is semi-transparent, overlaid on a busy background. The menu is not 'balanced' vertically. Also, I don't particularly like the name, either; but that's just a random point-of-view.

Basically, considering that you mention the proxy industry is pretty big, your offering is just not competitive! Yet with a few simple cosmetic changes, the look (and thus the impact on first-time visitors) could be improved hugely. It might make all the difference...

</comment></comment></comment><comment><USER6> FYI, I'm in the target market for your product and after reading the sales page, I'm not entirely sure what your product does.

So there may well be some potential improvements to be made there!

<comment><USER7> this :)

</comment></comment><comment><AUTHOR> Thank you guys for the great feedback, I never considered that my dirt looking design could be the source of my problems, plus the embarrassing typo errors.

<comment><USER4> I think you're making a mistake writing this off as an issue you can solve by working more on your website and perhaps most importantly using only your existing skills that you are comfortable with.

Your design and the improvements and optimizations don't mean anything until _after_ you find a way to reach your market. If you can't reach your customers nothing else matters. You have some paying customers so apart from typos your website is good enough at least for now.

</comment></comment><comment><USER8> Web apps generally sell for about a year's worth of profits. So you'd probably get around $6000 if you sold it. Is that worth it to you?

If you are serious about selling, I'm currently looking at acquiring products in your profit range. Please email me if you'd like to discuss.

</comment><comment><USER9> I took a look at your site and you could probably double signups if you bought a $20 theme (or even just used default Bootstrap) and fixed the typos.

<comment><AUTHOR> Thank you, I prepared a new design for my newest product [http://seo.skyul.com](http://seo.skyul.com) and I will implement that in the main domain as well and see how people are reacting to it.

<comment><USER10> Marketing guy here, once cleaned up that will be a massive 'trust' improvement. Though I'm a little confused, you seem to have a proxy scanner on one page and a kw tool on the new site... what are you doing? If your focusing on search volume and KW cost, Google have a very good tool for this so not sure why I would use you? I cant see a USP.

In general, the new website will help but probably less than most people think. The most important thing for a product is distribution channels until they build their own brand. For a product like yours (either) you need to get a view on what your expected customer life value is, what margin you expect to retain and then look at distribution channels you can fit. An obvious one is Adwords. Test using social as a knowledge point. Also look to resell your product via other seo 'experts' as you might get fast recognition through this.

I'm not kidding about the distribution focus. As a young marketer I was so concerned about a perfect website and content. Experience has taught me I will take a weak product & sale point coupled with good distribution over a great product/website with weak distribution any-day.

</comment></comment></comment><comment><USER11> How much would you consider selling it for?</comment>


The Data Liberation Front - Getting Your data from google services  - <AUTHOR> http://www.dataliberation.org/ <comment><USER2> This is a great start. I'm glad Google has the wisdom to devote a team to just this goal. I look forward to end-user tools they may develop to further accelerate this progress.

<comment><USER3> I agree, mildweed. Especially about the end-user tools.

It looks good to do this, and it is good. It's all win, and clearly it sets them apart.

That being said, in many cases, their answer is "There's an API for that." Why can't it be exported into a file format that will work in (at least some) other programs right off the bat? Surely there exists at least some suitable existing file format for the kind of data stored in Calendar, for instance.

I don't know why anyone would leave google apps for MS Office, but if they wanted to get their info out of Google Calendar, reading "There's the iCal API" doesn't actually _sound_ that liberated to an end user.

Someone could make a tool that uses the api to convert the data, but it'd be nice if they provided data export into an existing format whenever one exists.

( see the disclaimer above; yes, they're the only ones doing this, it's awesome, etc. )

</comment></comment><comment><USER4> There are inherent privacy issues with any cloud service, and even more with a company as big as Google.

Still, I'm VERY impressed with how easy they make it to take your data and leave. Can you imagine Facebook helping you migrate to another social network?

</comment><comment><USER5> Liberate - sure; Delete - maybe later (if ever).

<comment><USER6> If this worries you, assume nothing you type can be ever deleted.

I own a very, VERY small web application. It takes input from users and, potentially, saves it to the database, then performs operations on it.

Suppose a user types "foobar" into my application, waits a while, and then tells me "Hey, I want you to totally erase any evidence that I ever typed "foobar". Well, um, I don't think it is physically possible for me to do so.

Minimally, "foobar" is now present in my database. I can zap that fairly easily. Foobar might also be present at a few places in memcached, which are difficult to me to calculate but theoretically accessible to me. I suppose if they're theoretically accessible I could, with significant effort, call them up again, which means that with significant effort I can delete them. OK, zap.

Then I have backups of my database. And here's where delete starts to become a matter of "Uh oh, now we're talking hard." I can't just blow away information in a database backup -- I'd have to unpack it, load it into a database (binary dumps = do not work on me with ad hoc tools!), blow away the record, then save. This would have to be done very carefully to avoid nasty effects if two or more people wanted to blow away data at the same time, since maintaining ACID guarantees is pretty difficult when you've got multiple independent copies of the same database running around. At this point, I'm already strongly inclined to say "If it ever hits the database backups, it potentially stays until doomsday."

Then we have server backups. My server is a VPS. If you were in the database backup saved on disk at T1, when a server backup happened (which freezes an image of the VPS in time so that I can return to exactly the same state as T1), then _even if I blow away the backup_ there is ANOTHER opaque backup in an even more opaque data structure. So I'd have to spin up another VPS from the image (for each image I have), deal with the pains of moving that to the present day/time, load each backup on the VPS, blow away your record, refreeze the database, then refreeze the VPS.

All of this unfreezing and refreezing presents many, many opportunities for me to corrupt other users' data, which is the reason I have the backups in the first place. Corrupting data is unacceptable.

Except, wait, I'm not the only one who has copies of my images! Slicehost also has redundant backups of the images because I can't lose an image if they lose the box the image is on! So I'd need to somehow gain access of their backups (which I have _no control over_ ) to spin up the VPS to spin up the backup to nuke the record to backup the DB to snapshot the VPS to remake the backup of the hard drive containing hundreds of images from people who are not me.

EXCEPT WAIT! It is conceivable that, without notice to me, Slicehost has moved from owning their own backup media into a cloud storage solution. Which, for reliability, would duplicate the backup machine multiple times! So now we need to access each of the the copies of the backup machine to spin up each of the images to spin up the database so we can nuke the record to save the database to snapshot the image to back up the snapshot to replicate the backup machine which persists the backups of the snapshots containing the backups of the database which holds your record.

So, yep, that's where I am. You probably did not read my privacy policy, but I'm pretty sure it says something to the effect of "I make no guarantees about being able to delete your data." That is as much as I am going to say of the matter. As soon as you give me the data to hold for a _nanosecond_ it could very well be out of my control to ever delete again.

<comment><USER5> Liberation is good - Google is good - so are privacy agreements.

A better name for the site could be "Grab a Copy of Your Data!" - much more accurate. Liberate implies that you are actually getting your data back - which you're not...you're getting...a.....copy.

</comment></comment></comment><comment><USER7> I can't help but think there's something ironic or cynical about the site's branding...

EDIT: from the FAQ (<http://www.dataliberation.org/home/faq>)

Quote: "What's with the logo?

It grew out of the fact that we see ourselves fighting for the freedom of the users. So basically, it's another joke. Har har har. :-)"

<comment><USER8> Absolutely. Reminds me of this:

[http://www.theregister.co.uk/2007/05/29/william_davies_ask_v...](http://www.theregister.co.uk/2007/05/29/william_davies_ask_vs_google/)

Ask.com's terribly misguided advertising campaign.

<comment><USER7> Ha! Exactly.

</comment></comment></comment><comment><USER9> Excel really took off when they allowed you to _SAVE_ in Lotus format.

<comment><USER10> I thought it was because it was the first real Windows based spreadsheet. Didn't Lotus take ages to port to Windows?

</comment></comment><comment><USER11> Very cool move. Especially coming form a big company like this, and indeed it was a smart move to "design" this part of Google as a stand-alone team instead to delegate every other team to take care about data IO.

</comment><comment><USER12> The name sounds scary though. Reminds me of Whackos belonging to the "Earth Liberation Front" who toppled several AM radio towers in Washington a few weeks ago. Reason; "AM radio waves cause adverse health effects including a higher rate of cancer, harm to wildlife, and that the signals have been interfering with home phone and intercom lines."

<comment><USER13> Looks to me like its an intentional play on Earth/Animal Liberation Front (aka ELF and ALF).

<comment><USER6> Which are themselves references to any number of leftist revolutionary movements, because remember kids, Communism is cool.

Like Che T-shirts, I severely doubt anybody ever thought through "Hey, I wonder what an all-red color scheme and the words 'Liberation Front' say about our values here". Hint: it isn't "Do no evil."

<comment><USER14> Lighten up.

</comment></comment></comment></comment><comment><USER8> I can export. Can I erase?</comment>


Rider, a Crossplatform .Net IDE by Jetbrains Now in Public EAP - <AUTHOR> https://blog.jetbrains.com/dotnet/2016/11/21/jetbrains-rider-public-preview/ <comment><USER2> I've been using Rider on OSX for a while now, it's good but it's still fairly laggy for me and it's still not a program i can leave running for long periods without instability.

Still beats VSCode for me for its refactoring though (with its Resharper roots and all)</comment>


GitHub's game jam returns next month - <AUTHOR> https://blog.github.com/2018-10-15-game-off-returns-november-2018/ <comment><USER2> For anyone looking to build a game but not yet settled on an engine I highly suggest giving Phaser a shot. I spent a few hours with the latest version and was pleasantly surprised how far it has come.

Most importantly the documentation and example code are now so robust that most common game components like 2d physics, collision, projectiles, multiplayer can be found here: [https://www.phaser.io/examples](https://www.phaser.io/examples)

<comment><USER3> I went from knowing nothing about Phaser to a working game in about two weeks for a game jam earlier this year. Really enjoyed working with it.

[http://www.lmnopc.com/air-sea-golf/](http://www.lmnopc.com/air-sea-golf/)

The jam was "genre shift", where participants were supposed to take an existing game and shift it to another genre. I chose the Atari 2600 classic Air Sea Battle and turned it into a simple golfing game.

I liked the idea of using the 2600 as a starting point so I could worry less about the graphics and more about the physics and gameplay.

It's simple but it works. It's almost much more fun on a phone - the touch screen is more fun than a mouse for this one. :)

<comment><USER4> It seems like it's just limited on desktop? After dragging a certain amount on a desktop, I can't pull the swing back any further.

<comment><USER3> Watch the demo at the beginning of the game — you don't want to click on the ball as your pivot point for the swing — use the upper right part of the window. That's part of the reason I made the demo — to show the best place to start your swings. :)

</comment></comment></comment></comment><comment><USER5> I want to second LÖVE [1] as an easy way to build games! Some user "adn" has documented almost the whole process using the framework to build his own game (which he released on Steam) on Github [2], so it's _fantastic_ starting point..

I hope this year I'll have some time to participate!

[1] [https://love2d.org/](https://love2d.org/)

[2] [https://github.com/adnzzzzZ/blog/issues/30](https://github.com/adnzzzzZ/blog/issues/30)

</comment><comment><USER6> I've never attended, but a co-worker of mine attended and made a hex based equivalent of a Sokoban game [https://en.wikipedia.org/wiki/Sokoban](https://en.wikipedia.org/wiki/Sokoban). It was pretty fun to play, I'd probably recommend the game jam based on that alone.

On a somewhat related note, the games from DigiPen's senior projects are often pretty enjoyable: [https://games.digipen.edu/](https://games.digipen.edu/). I'd especially recommend Narbacular Drop (predecessor of Portal, the game got the students hired at Valve), and Empyreal Nocturne (a sort of aerial combat game).

</comment><comment><USER7> I did some work at my previous job building a slot machine game in Phaser 2. I'd never done game dev prior to this but found it really simple to pick up.

From the knowledge I gained in this, I was able to make a simple infinite scrolling game, package it up with cocoon and release it into the iOS and Android stores all within a day from my bed on a Sunday. It wasn't the best game ever but amazing to be able to get something out there so fast (I am a JS dev)

I've not done any game dev since but may use this jam as an excuse to take a stab at Phaser 3

</comment><comment><USER8> I've used LÖVE a bunch in the past and it's great. Recently, I've been playing with Godot, and it's also wonderful. If you're interested in learning Godot, Ben Tristam's course on Udemy[1] is a great tutorial series. The Godot community is very friendly and helpful on Discord.

[1] [https://www.udemy.com/godot/](https://www.udemy.com/godot/)

</comment><comment><USER9> Do they offer swag or anything like that?

<comment><USER10> They do a roundup of the most interesting games on the GitHub blog, but no swag to speak of.

Previous years:

\- 2017: [https://blog.github.com/2017-12-22-game- off-2017-winners/](https://blog.github.com/2017-12-22-game-off-2017-winners/)

\- 2016: [https://blog.github.com/2016-12-13-game-off-iv- highlights/](https://blog.github.com/2016-12-13-game-off-iv-highlights/)

\- 2015: [https://blog.github.com/2015-04-21-game-off-iii-everyone- s-a...](https://blog.github.com/2015-04-21-game-off-iii-everyone-s-a-winner/)

\- 2013: [https://blog.github.com/2013-10-30-github-game-off- ii/](https://blog.github.com/2013-10-30-github-game-off-ii/)</comment></comment>


Show HN: The Bear minimum – Building a super simple blog with Bear.app - <AUTHOR> https://saul.at/building-a-simple-blog-with-bear.html <comment><USER2> Pretty cool. Props for the creative use of Bear. It's not something I would have thought to use but I might start as a backup for some websites that I want to keep alive.

<comment><AUTHOR> Thank you! It's surprisingly simple, but if you'd like any help, you're welcome to reach out via Twitter (linked in post).</comment></comment>


The tel URI for telephone numbers - <AUTHOR> http://www.rfc-editor.org/rfc/rfc3966.txt <comment><USER2> A random RFC with no commentary? I wonder if this is the hacker community equivalent of tossing peanuts to squirrels.

<comment><USER3> RFC 1149 is one of my personal favourites...

<http://www.rfc-editor.org/rfc/rfc1149.txt></comment></comment>


SQL Buddy - Attractive, in-progress, just-released PHPMyAdmin alternative - <AUTHOR> http://www.sqlbuddy.com/

<comment><AUTHOR> I'm not affiliated with this project, just caught my eye.

It's not a full-fledged PHPMyAdmin alternative (yet). Interface seems non- intimidating and immediately usable, so for that it might be handy for basic MySQL needs.

Not open source. But free for non-commercial use, $25 otherwise. If it inspires an open source MySQL GUI to think critically about UX then that would be just great.

<comment><USER2> Yep, looks promising. Really like that you don't have to configure anything. Just upload, enter user/pass and works.

</comment></comment><comment><USER3> Webmin includes a very competent MySQL administrative module (likewise PostgreSQL), though until we release the new UI, it seems a little clunky (better than phpMyAdmin, IMNSHO, but still old school web 1.0 style).

Extensive documentation, including screenshots:

<http://doxfer.com/Webmin/MySQLDatabaseServer>

And, for the folks running PostgreSQL, and don't like being in the ghetto without good GUI tools:

<http://doxfer.com/Webmin/PostgreSQLDatabaseServer>

</comment><comment><USER4> I've done a little SQL console with syntax highlighting fro my own needs.

<http://github.com/slim/bazdig/tree/master>

you need PHP5 and PDO_SQLITE though

</comment><comment><USER5> phpminadmin is another alternative. one file, many functions, open-source. <http://phpminadmin.sourceforge.net/phpMinAdmin.php>

<comment><USER6> good find.</comment></comment>


80legs is looking for interns or contract workers - <AUTHOR> http://www.80legs.com/intern.html

<comment><USER2> What is "remote intern / contract work" ? Anything you hire a contractor to do is typically going to be inappropriate work for an intern.

This smells like one of those gigs where they hope to pay slave wages for work in their primary line-of-business, and call it an "internship" to excuse their behaviour.

<comment><AUTHOR> Anyone we hire will be compensated properly.

The descriptions on the pages are fairly specific about the difference in responsibility for local vs remote.

The remote work is admittedly more straightforward, cut-and-dry programming. It's suitable for a student or freelancer looking for some entry-level experience or extra work.

Anyone that works locally will be exposed to some of the more complicated tasks we have and take on more responsibility.

We would really prefer to have someone local, but we have to be realistic about our potential candidate pool in Houston.

</comment></comment><comment><USER3> I noticed that proficiency in Java is required. Is there a technical reason or unique feature that makes Java the best choice for 80legs, as opposed to some other language?

<comment><AUTHOR> Java is the only language we can use on the JVMs that run on the nodes in our grid computing system.

Other languages (Jython, JRuby) require techniques that break the security sandbox used by the JVMs.

<comment><USER3> I get it. Thanks for responding!

</comment></comment></comment><comment><USER4> full time or part time contract work? I've got a good amount of experience working on web crawlers/ data aggregation for SaaS based architectures.

<comment><AUTHOR> A local intern would be full time.

Remote work would depend on the ability of the programmer. We have a few dozen 80apps that need to be produced for various crawl packages right now (more coming). I expect each one would take 1-3 days of programming.</comment></comment>


Simple Word Evaluation in Oil Shell - <AUTHOR> http://www.oilshell.org/preview/doc/simple-word-eval.html <comment><USER2> Oil shell is fascinating to me. I haven't had a chance to _really_ use it other than for toying with it given my primary work is all done on Windows, but the development effort and the very well explained reasoning behind every little thing I find amazing.

</comment><comment><USER3> This is the latest version of the doc, please use this instead:

[http://www.oilshell.org/release/latest/doc/simple-word- eval....](http://www.oilshell.org/release/latest/doc/simple-word-eval.html)</comment>


First SpaceX Starlink satellites loaded into Falcon fairing - <AUTHOR> https://twitter.com/elonmusk/status/1127388838362378241 <comment><USER2> Teslarati is reporting that these satellites will not yet have the laser interlinks. I guess that means they can't route traffic from satellite to satellite; they can only bounce data traffic back down to a base station.

[https://www.teslarati.com/spacex-starlink-satellites- tease-r...](https://www.teslarati.com/spacex-starlink-satellites-tease- revolutionary-design/)

<comment><USER3> I saw an unsourced comment on reddit that claimed they would have a microwave interlink instead of the laser interlinks, which would give several orders of magnitude lower bandwidth (although still better than nothing).

Either way, I think that these are mostly being put up to serve two important purposes: testing various technologies with enough test vehicles to get strong(ish) statistics, and working their way to the thousands of deployed satellites the FCC will require them to have deployed if they don't want to lose their frequency allocation.

<comment><USER4> I have also heard that they are having some trouble with the laser interlinks and alignment as well as the cost of them at this point, so they are starting with the microwave interlinks. They still plan on doing the laser interlinks eventually, but they weren't reliable or cheap enough by the time they wanted to begin launching, so they are being left off this first batch.

All of that is completely unsourced and heard through anonymous sources that have posted on various forums, so take it with as much salt as you need.

<comment><USER5> Oh, microwave links effectively nothing compared to the laser ones. Terrible news. So I guess marketed bandwidth will never be delivered within the first generation of the network.

</comment></comment></comment></comment><comment><USER6> Just a reminder of the key things related to Starlink (since I had to go look them up - [https://en.wikipedia.org/wiki/Starlink_(satellite_constellat...](https://en.wikipedia.org/wiki/Starlink_\(satellite_constellation\))):

* Total deployed size will be ~12K satellites and take a decade or so. Will be operational in a reduced capacity as early as next year.

* Since they're in low earth orbit, latency could be in the 35ms range.

<comment><USER7> I believe the 35 ms latency number is on top of any required routing latency, either on the ground or in space. I'm curious how much each satellite hop will add.

<comment><USER8> this guy made an excellent youtube video modeling and visualizing the satellite orbits, the network routing paths across them, and the resulting latencies: [https://www.youtube.com/watch?v=QEIUdMiColU&t=4m](https://www.youtube.com/watch?v=QEIUdMiColU&t=4m)

NYC to London on the current internet is 76ms, he shows it across starlink's updated plans as working out to around 46ms.

Later in the description he points out a mistake in his own math and says that starlink paths should be 8.7% faster than the video shows, so really jfk<->lhr ~ 42ms.

</comment></comment></comment><comment><USER9> I can't get over how they designed the packaging of 60 satellites into the fairing.

Elon said there's no separate dispenser to deploy them. I really hope we can see them deploy, that would be an incredible sight.

Best of luck. They are expecting a lot will go wrong, but let's hope they're wrong about that!

</comment><comment><USER10> Starlink will make camping, cruises and air travel over oceans and non civilized land a lot more tolerable. You could even setup a small city of boats in the middle of the ocean. The market for remote internet will be a lot bigger than it is now as it removes our inhibition in traveling to disconnected areas.

<comment><USER11> I'm waiting for one of these projects to succeed so I can move out of the city. I'm 90% remote and the only thing stopping me from moving back to a rural area is reliable high speed internet.

</comment></comment><comment><USER12> I long for much more detail about the engineering of this project, in particular the traffic engineering and routing aspects. Theres so many interesting possibilities there.

<comment><USER13> The FCC filing has a lot of good technical details on the deployment and frequency usage. Additionally, Mark Handley has a good primer on it. It may kill actual east-west terrestrial traffic due to latency improvements: [https://www.youtube.com/watch?v=QEIUdMiColU](https://www.youtube.com/watch?v=QEIUdMiColU)

North-South will still be terrestrial.

</comment></comment><comment><USER14> One satelite only seem to be able to handle 20Gbit meanwhile a single fiber can handle 20Tbit and you get a lot of fiber cables for $10 billion. One advantage with satellites thoug are that there's nothing for warlord or censoring states cut off. Time to re-watch the movie "enemy of the state" ...

<comment><USER15> This isn't meant to replace fibre (except maybe for some high speed intercontinental trading purposes). This is high speed Internet for people in rural areas, where they'll pay for the bandwidth and latency improvements.

This isn't going to let them jump past national regulatory agencies. It will help them avoid local regulations and right-of-way issues that helped kill Google fiber.

Where did you get the $10 billion number from?

<comment><USER16> I believe $10 billion is approximately the cost of the whole satellite network, definitely not a single satellite.

<comment><USER15> I just want to know where that estimate comes from - as far as I know, any estimate of cost is a WAG. For example, my WAG with today's new info:

\- 167k per sat construction cost

\- 20 mill per launch (at-cost WAG)

\- 333k launch costs per sat

\- 500k per sat total cost

these numbers give a final 12000 sat constellation cost of 6 billion. The initial 1600 sat constellation comes to 800million

But if my assumptions are off, it could be way less or more. If they make the satellites even cheaper, or at cost launches are less, or they end up being able to launch on Starship, it's significantly less. If sats cost more, or launches are more, then the cost goes through the roof.

<comment><USER9> Even $10 billion for global high speed low latency network coverage at the aggregate bandwidth they are planning is extremely cheap.

Comcast spends ~$8 billion on CapEx annually.

<comment><USER9> I searched for a while to try to find stats on Comcast's aggregate network capacity, either in amount of data transmitted or the peak/average bandwidth utilization. I'd be curious to compare this to theoretical capacity of the SpaceX network.

</comment></comment></comment></comment></comment></comment><comment><USER17> I'm a bit worried about how we're throwing stuff at space as fast as we can afford it without any legitimate way to clean it up after it becomes garbage. This project intends to have interlink based on 7k+ satellites and they will undoubtedly become outdated in about 20 years and will have to be replaced by next generation. This is tons and tons of useless metal and silicon orbiting Earth colliding with other useless silicon forming a layer of very high-energy fragments that will destroy everything they come in contact with. And we currently don't know how deal with it.

It feels uneasy especially when you recognize parallels with climate change in how we're creating a problem for future generations chasing shorter-term goals.

<comment><USER18> From a bit of research on Internet, the satellites will re-enter into atmosphere after end of operation, because they are sent to relatively low orbits. There is no garbage involved here.

</comment></comment><comment><USER7> With more fiber being laid every day, increasing wireless deployments, and technologies like AirGig in the horizon, is Starlink launching into a shrinking market?

Further, as SpaceX is having trouble raising the needed funds, is this launch simply a fundraising exercise?

<comment><USER19> Rural areas should still be a viable market. Also ships and aircraft. Current airborne internet access is pretty expensive, slow, and high latency.

<comment><USER20> If all the constellation + GEO systems proposals end up being launched, there will be an oversupply of capacity from space.

Rural areas are a viable market only in the US and Canada, where people can afford to pay $50+/month for connectivity. Elsewhere in the world, they are not going to sell to any end-users.

The 4,425 and the 7,500 satellite constellations proposed by SpaceX are way oversized and simply put, a waste of money and efforts.

<comment><USER21> At $10 billion to deploy and lets assume 5 years satellite lifetime and $1 billion a year to operate, this is $3 billion a year or $250 million / month. You would only need 5 million subscribers at $50 / month to break even.

<comment><USER9> Seriously. I'll switch just so I don't have to pay Comcast.

Now I just need some Tesla solar panels and a couple powerwalls, and betweeen that, a well, my septic system, I can cut every cable coming into my house.

Well, I do use natural gas for heating and I love my gas stove, but nearly there!

If only the receiver and the power requirements were small enough to fit in my cell phone!

</comment></comment></comment></comment></comment><comment><USER22> how will they eject these suckers from the payload module?

Maybe put it in a spin and just let them go? (in a controlled release)

<comment><USER4> I'm really hoping they will show it during the livestream!

</comment></comment><comment><USER23> Are they going to use Falcon Heavy for this launch?

<comment><USER24> Nope, regular falcon 9. However, this is predicted to be one of they heaviest loads they have ever done (15-16 tons) considering how far down range the drone ship is going.</comment></comment>


[Paper] 3D Printing of Free Standing Liquid Metal Microstructures - <AUTHOR> http://onlinelibrary.wiley.com/doi/10.1002/adma.201301400/abstract

<comment><AUTHOR> Found via Reddit. Video of 3d Liquid metal printing: [https://www.youtube.com/watch?v=ql3pXn8-sHA](https://www.youtube.com/watch?v=ql3pXn8-sHA). Also more info from the creator (via Reddit): [http://www.reddit.com/r/videos/comments/1hx18t/i_spent_four_...](http://www.reddit.com/r/videos/comments/1hx18t/i_spent_four_freaking_years_not_being_able_to/cayrftl)</comment>


Immutable Enumeration in Swift - <AUTHOR> http://tel.github.io/2014/07/30/immutable_enumeration_in_swift/

<comment><USER2> Very interesting. I'm surprised that Swift is already expressive enough to support constructs like this.

Swift is young enough that it hasn't landed on a particular philosophy yet, and I wonder if it will bend toward ML or more in the direction of Go. For example, protocols and functions currently seem somewhat contradictory; getting the Unicode-compliant length of a string is a function, countElements, not a method, for example.

The fact that Swift is both OO and functional (with generics to boot) means there is an inherent conflict in the language that could lead to multiple styles of using it becoming popular. Witness Ruby's stylistic transformation as it became popular and started trends that now make the old standard library seem antiquated by comparison. Or C++'s transformation through the STL. Or Python's engagement with functional programming (which never really was able to transform it away from its OO origins).

By comparison, Go is simple and inexpressive, so that it's practically impossible to break style; indeed that seems to be core to Go's philosophy.

<comment><AUTHOR> I really would like to practice merging FP and OO together meaningfully in a language. So far, I've been enjoying this in Haskell and I think Swift provides another opportunity.

I'm a firm believer that OO and FP are more like two sides of the same coin than real competing interests (in particular, initial v final data types).

Unfortunately, I think the strong association of mutability and OO is a detriment and Swift follows it (probably for ObjC compatibility).

<comment><USER2> Agreed. I also wish their OO approach would be more like Go or even Ceylon; as it stands, it looks like they took a reasonable base language and merely bolted ObjC's class model onto it, with no unifying philosophy about the language as a whole.

<comment><AUTHOR> Yeah, it feels complete but unintegrated. I know a lot of the outstanding Swift tickets are around better integration, but there's a wide gulf.

</comment></comment></comment></comment><comment><USER3> I ran screaming from this article. I understood virtually nothing about it.

<comment><USER2> The article plays with the idea of introducing "uncons" to the language, which corresponds to a Haskell expression (simplified; also possible in other ML languages as well as Erlang) such as this:

        x:xs = someList

This means: Assign the head (ie. the first element) of someList to the variable x, and the remaining elements to the variable xs.

In Haskell, ": "is the list concatenation operator. (So if you think about it, the left hand side and the right hand side are in fact together an equation.) The ":" operator is often called "cons", and it's really a function which takes a head and a tail and returns a new list; hence, "uncons" is the reverse, breaking apart a list into an element and a new list.

This is useful because when processing sequences of stuff, you often want to look at the first element, do something, and the process the rest. A linked list is per definition a head and a tail, whereas other structures such as arrays and even files can be adapted into this abstraction. Even a virtual sequence such as a random generator can adopt this protocol: The head of the random generator is the next random number; the tail is the new state of the generator.

The article then tries to formulate this uncons operation as a Swift protocol, and talks about ways to leverage it for different types and functional constructs. Those constructs (such as fold) are the basic tools of functional programming, but will admittedly be completely unfamiliar to someone who hasn't touched the topic before.

<comment><AUTHOR> Well said!</comment></comment></comment>


Ex-NSA man Edward Snowden meets German MP - <AUTHOR> http://www.bbc.co.uk/news/world-europe-24770430 <comment><USER2> This would be a major point forward both for Germany as well as Snowden.</comment>


The SQL layer in CockroachDB - <AUTHOR> https://github.com/cockroachdb/cockroach/blob/master/docs/tech-notes/sql.md <comment><USER2> A lot of that looks quite familiar from working on postgres. Partially that's because it's "just the right way" to do some things, but I also wonder if there's some more looking at pg than just reusing the wire protocol?

PS: Should any cockroach contributors have opinions on limitations & evolution of the protocol: I'd be interested.

<comment><USER3> I work at CockroachDB on the implementation of the Postgres protocol, and I'm a maintainer of lib/pq, a Go client implementation of the protocol.

Overall I think it is a very good protocol. I can't come up with any gripes I have with it, nor do I remember any "it would be nice if" moments when adding support for some of the various parts of it. There's certainly some difficulty in some of the more complicated parts, like managing all of the type hinting back and forth for prepared statements. But in general I found the documentation to be complete and well done.

The one thing that we did have trouble with was figuring out the exact formats for all types when using the binary encoding format. We wrote some code to sniff real Postgres servers so we could figure out what was going on. It would have been easier, obviously, if it was documented, but this wasn't a huge deal since it is likely a rarely needed thing.

<comment><USER2> > I work at CockroachDB on the implementation of the Postgres protocol, and > I'm a maintainer of lib/pq, a Go client implementation of the protocol.

Thanks for replying!

> Overall I think it is a very good protocol. I can't come up with any gripes > I have with it, nor do I remember any "it would be nice if" moments when > adding support for some of the various parts of it. There's certainly some > difficulty in some of the more complicated parts, like managing all of the > type hinting back and forth for prepared statements. But in general I found > the documentation to be complete and well done.

Cool. I've more complaints than you in that case :) Although drivers, especially libpq (no pipelining, no mixed binary/text results), are more frequently an issue.

One thing I was wondering whether you might also be interested is something like 'commit identifiers' (WAL LSNs in pg's case) for slightly relaxed consistency models. That allows things like committing on one node, and when later doing queries on replicas specify that data needs to have replicated at least up to that identifier.

> The one thing that we did have trouble with was figuring out the exact > formats for all types when using the binary encoding format. We wrote some > code to sniff real Postgres servers so we could figure out what was going > on. It would have been easier, obviously, if it was documented, but this > wasn't a huge deal since it is likely a rarely needed thing.

Yea, I think that's a fair complaint. I wasn't around yet when the current binary format was devised (2003ish IIRC?), I don't know how we ended up deciding that code was the documentation for that.

<comment><USER3> > Although drivers, especially libpq (no pipelining, no mixed binary/text > results), are more frequently an issue.

The Go lib/pq driver is some pretty old Go code and has numerous similar problems. We try to keep it moving along but it's got some stuff that makes it hard to work on.

> One thing I was wondering whether you might also be interested is something > like 'commit identifiers' (WAL LSNs in pg's case) for slightly relaxed > consistency models. That allows things like committing on one node, and when > later doing queries on replicas specify that data needs to have replicated > at least up to that identifier.

CockroachDB is always serializable. It is linerizable on individual keys. We've discussed having a causality token before that could be passed to other transactions or connections that I think would allow for more linerizable guarantees. If I'm understanding your question correctly then yes, I think these would be very useful to us. (I've asked someone more familiar with our consistency model to address this more because I'm not confident in the accuracy of my reply.)

<comment><USER4> (Cockroach Labs CTO) Yes, the commit identifiers sound like something we could use, as long as they're not tied too closely to pg's WAL LSNs. For us, the token would be a 96-bit hybrid logical timestamp, and we'd want semantics roughly similar to HTTP cookies (the server sends it back with the response, and then that client will include it on any future requests. With our current implementation the client would only need to send the token on new connections, but including room for it on a per-request basis seems like a good idea).

Also on the subject of the protocol, we've run into a need for a (server- initiated) ping message ([https://github.com/cockroachdb/cockroach/pull/10188](https://github.com/cockroachdb/cockroach/pull/10188)).

<comment><USER2> > (Cockroach Labs CTO) Yes, the commit identifiers sound like something we > could use, as long as they're not tied too closely to pg's WAL LSNs.

There was some discussion around this before, and the idea was basically to just include some text-payload after COMMIT. PG would produce something like "COMMIT 343/3f0037a0", but the spec for would just be text. Some drivers might do something with the knowledge that it looks like an LSN, but that's hard to avoid.

> Also on the subject of the protocol, we've run into a need for a (server- > initiated) ping message > ([https://github.com/cockroachdb/cockroach/pull/10188](https://github.com/cockroachdb/cockroach/pull/10188)).

Maybe I'm missing something here (I admittedly only skimmed ticket and things it references), but shouldn't server triggered tcp keepalives be sufficient for this case? In postgres that's configured using tcp_keepalives_idle/tcp_keepalives_interval/tcp_keepalives_count. Several drivers (including at least libpq and pgjdbc) can do the same to protect against vanishing servers.

Doing keepalives on the pg wire protocol level has some disadvantages, but also some issues. Namely you've to be ready to send ping/pongs forth/back in almost any protocol state. Not necessarily easy if there's partial writes and such.

<comment><USER4> Ah, right. We did turn on TCP keepalives so we probably don't need a protocol- level ping (although we often deploy behind haproxy, so tcp keepalives need to be configured at each hop)

<comment><USER2> Similarly, tcp level keepalive not necessarily sufficient, if there's intermediate "pgwire" protocol level connection poolers like pgbouncer. Nor do they protect against applications that are effectively hung somewhere.

So I do think "pgwrite" level pings make some sense, it's just not exactly straightforward to add them :/

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER5> This is awesome.

I was looking at using/extracting their pgwire implementation to provide an SQL-like interface to the in-memory state of a particular application we use, this document will make it way way easier.

<comment><USER6> You can also use Calcite if you're on the JVM:

[https://calcite.apache.org](https://calcite.apache.org)

<comment><USER5> That's much nicer than hacking stuff out, unfortunately/fortunately (not sure anymore) I am not a java programmer, this particular app is in go.

</comment></comment></comment><comment><USER7> I always find that when building architecture documentation after the fact, you want to re-factor or at least re-engineer a lot of the code base to account for areas where lines are crossed or decisions were made that might be performant and functional but lead to poor maintainability or opacity to all but the most involved project participants.

It would be great to see this document evolve into a guideline rather than a "this is how most of the code works today" document.

</comment><comment><USER8> The name isn't a problem, it's smart and memorable.

<comment><USER9> I strongly disagree. It conjures up thoughts that are unpleasant. That isn't a good marketing strategy.

<comment><USER10> Most of the bad things I can think up of about cockroaches are good in the context of databases. Replication, being hard to kill, being around for ages, collective decision-making..

As someone downthread said, it's not a consumer product and doesn't need to be marketed like one.

</comment></comment></comment><comment><USER11> I've got a little transactional KV store in the wings and have been thinking about writing a Go frontend for it. I'd love full SQL support, but there's no way I'm going to implement my own query optimizer. How hard would it be to repurpose this layer to back onto a generic sorted KV store?

It this deeply tied in to the rest of cockroachdb's architecture, or does it talk through a simple generic KV store interface?

<comment><USER12> while there is an explicit delineation between the internal `kv` package[1] and the overarching `sql` one[2], your specific concern regarding a query optimizer is not strictly an isolated component at this moment in time. query optimizations, last I checked, was not an explicit pre-processing stage but rather done so when constructing the AST representation of the query with each node being an `iterator` as described in the Volcano Evaluation System paper[3]. there was some work underway to move towards an intermediate representation[4] to go through the standard query optimizations, no context into how far along this effort is.

[1]: [https://github.com/cockroachdb/cockroach/tree/master/pkg/kv](https://github.com/cockroachdb/cockroach/tree/master/pkg/kv)

[2]: [https://github.com/cockroachdb/cockroach/tree/master/pkg/sql](https://github.com/cockroachdb/cockroach/tree/master/pkg/sql)

[3]: [https://paperhub.s3.amazonaws.com/dace52a42c07f7f8348b08dc2b...](https://paperhub.s3.amazonaws.com/dace52a42c07f7f8348b08dc2b186061.pdf)

[4]: [https://github.com/cockroachdb/cockroach/pull/10055](https://github.com/cockroachdb/cockroach/pull/10055)

<comment><USER13> I wrote the rfc for this "effort": there will be an IR in CockroachDB, just not right now. It's a lot of work and we're not going to do this in one go.

</comment></comment></comment><comment><USER14> Distributed DBs are hard; bringing new contributors up to speed is really hard. They'll be able to hire some, but finding random OSS contributors is HARD. Very hard.

</comment><comment><USER15> Their number 1 problem is the name.

<comment><USER16> they should have named it after a fruit ... like mangodb or something

<comment><USER17> Mango IS tasty. Much more tasty than cockroach IMHO. Still though, I doubt the name is much of an issue.

<comment><USER18> I just had a horrible vision of mango and cockroach together :(

You guys are ruining my lunch time.</comment></comment></comment></comment>