K3s – Lightweight Kubernetes - <AUTHOR> https://k3s.io <comment><USER2> This is extremely welcome. Kube needs to glom on to all available architectures to fulfill its destiny, to some extent, and the memory/cpu usage of kubeapi et al. can be prohibitive for small setups. Having to revert to ansible/systemd in "some cases" really weakens the story of a universal datacenter O/S.

My hope is for more competition for development k8s (or k3s!) - minikube and docker-for-desktop is plagued with high CPU usage problems, and OSX-wielding developers are still doubtful. It will require a lot of work and elbow grease to convince them. I've built a hosted platform that tries to address this, but it's a complex education problem, which I am not well suited to solve :(

<comment><USER3> Agreed. Kubernetes (installed via kubeadm) on 1 GB of RAM is a shaky proposition at best; I've been managing a cluster on Raspberry Pis and the master often hits swap managing three Nodes with a dozen or so Pods.

<comment> vhost- K8s doesn't support swap, you have to disable swap to even run kubelet.

<comment><USER4> There is an override flag.

It works, but it kind of invalidates all assumptions k8s makes about free memory on a node

</comment></comment></comment></comment><comment><USER5> Oh nice - this is by the Rancher guys. Would love to compare this not with k8s, but with Docker Swarm.

Docker Swarm on Raspberry Pi is a very common thing. So, from a performance perspective, these are on par.

Another question is around ingress and network plugin - is it a seamless "batteries included" experience ? Because these are two of the biggest pains in k8s to decide and setup .

<comment><USER6> Based on the README [0], quickly comparing to Swarm:

\- this has the same great K8S API, that Swarm lacks. (Deployment is a first class citizen in kube land, but you only have to make do with the service YMLs in the Swarm sphere.)

\- k3s lacks some in-tree plugins, that swarm might have (mount cloud provider managed block device), but there are out of tree addons

\- sqlite instead of etcd3 [but available], so out of the box k3s is not HA ready (if I interpret this[1] right, there's one APIserver, and it's something in development )

\- this seems more lightweight than a docker setup in some sense (it uses containerd, not full docker), but of course this needs a proper evaluation

\- ingress plugins: good question. it should work with traefik [2]

[0] [https://github.com/rancher/k3s/blob/master/README.md#what- is...](https://github.com/rancher/k3s/blob/master/README.md#what-is-this)

[1] [https://github.com/rancher/k3s/blob/master/README.md#server-...](https://github.com/rancher/k3s/blob/master/README.md#server- ha)

[2] [https://github.com/rancher/k3s/search?q=ingress&type=Commits](https://github.com/rancher/k3s/search?q=ingress&type=Commits)

<comment><USER7> > great K8S API, that Swarm lacks

Hmm... nothing against k8s, but it's deployment api is an abomination on par with aws cloudformation.

You need teams of yaml engineers to manage these things.

<comment><USER8> [https://twitter.com/kelseyhightower/status/93525292372179353...](https://twitter.com/kelseyhightower/status/935252923721793536)

That's the exact problem Rancher itself is trying to solve, and it does a pretty fantastic job at it.

Though suggesting its "on par" with CloudFormation suggests that you either know a ton about CloudFormation (anything becomes second nature if you're skilled in it) or you don't know much about either of them. Kubernetes isn't _that_ bad.

<comment><USER9> It's definitely bad when you have thousands of lines of YAML configuration to maintain.

On the other hand, a thought out declarative language like Hashicorp's HCL is much saner thanks to IDE code completion/refactoring and static typing.

<comment><USER6> K8s YMLs are the baseline, and there are projects to have a lot more ergonomic description interface. They are ugly because they are also static typed and very extensible.

YAML is 1-1 mappable to HCL - because both map to JSON, but the Hashicorp interface seems nicer because it's simpler.

</comment></comment></comment></comment></comment></comment><comment><USER10> I used k3s a while ago on my laptop to do some CI/CD with gitlab and arduino- cli to flash an ESP8266 device:

[https://fosdem.org/2019/schedule/event/hw_gitlab_ci_arduino/](https://fosdem.org/2019/schedule/event/hw_gitlab_ci_arduino/)

</comment><comment><USER11> "Any sufficiently complicated concurrent program in another language contains an ad hoc informally-specified bug-ridden slow implementation of half of Erlang." \- Virding's Law

<comment><USER12> Are you talking about Go, the language this is written in?

Go's concurrency features are formally specified, are not ad-hoc (they are a major feature of the language, and the product of multiple language design iterations) and are certainly not bug-ridden.

Or are you talking about using Kubernetes to manage workloads on machines?

How does Erlang solve running my python webapp or my SQL database on my ec2 nodes, or in the case of this project, on an IoT device.

<comment><USER11> I am not talking about Go. I dont care what your language is, the true underlying reasoning for your engineering choices is independent of language. It just so happens that these problems have been around for ~30 years, and there has been significant progress in developing tooling to face them, in the domains that the BEAM languages sphere of influence. Just like how Ecto, despite being a great tool, does not free us of knowing about Relational Databases. If you approach the tooling infependently though, as a true knowledge expert does, you will see the progress made by other giants in these fields who are not afraid of specialised tools.

<comment><USER13> When I came across Erlang last year at a new company, I thought it was interesting how many problems Erlang solved that were also in Kubernetes. Self registering named services, processes that crash and restart automatically, health checks, etc.

Unfortunately to use all those features the services needed to be written in Erlang of course, which isn't bad in itself, but unfortunately not the reality in todays multi-lingual atmosphere. Speaks to how highly Erlang was designed and written. It took a lot of real life operational concerns into account in it's design, a concept few other languages even attempt to address.

<comment><USER14> "Who cares that these problems are solved in Erlang/BEAM if hardly anyone is writing end user software in Erlang/BEAM/Elixir", basically.

My number one reason for not using Erlang is lack of static typing. Dynamic type systems are great for small teams, not so great for "enterprise-wide" development. (I know this horse has been beaten to death here, trust me, I have heard the arguments for/against millions of times, I remain unconvinced).

Also the answer to this question is interesting to me as well [http://erlang.org/pipermail/erlang- questions/2008-October/03...](http://erlang.org/pipermail/erlang- questions/2008-October/039261.html) \-- (granted this is from Oct 2008) apparently if you were to attempt to add static type checking in Erlang, it would have to fundamentally change some of these benefits erlang brings such as message passing and handling process death. Haven't been part of the erlang scene for a while, but would be interested to hear a rebuttal to that.

</comment></comment></comment></comment></comment><comment><USER15> I've been laughing myself of for some minutes, not because the project is uninteresting (I'll be testing it next week on ARM, probably), but because I've decided to call this "Kubernetres" (Being 'TRES' three in Spanish)

<comment><USER16> why isn't it called k7?

<comment><USER17> I believe it goes:

Kubernetes -> K8s -> "kates" -> k3s

<comment><USER18> This is correct we shortened it to "kates" -> k3s (Rancher employee)

</comment></comment></comment></comment><comment><USER19> > Only Uses only 512 MB of RAM.

One can literally run a full fledged Java EE server in 64mb of Ram. What?

<comment><USER20> > One can literally _ruin_ a full fledged Java EE server in 64mb of Ram. What?

Most definitely.

<comment><USER19> That was hilarious. Thanks

</comment></comment></comment><comment><USER21> The "Great for" section doesn't mentioned dev environment. Could this replace stuff like minikube or microk8s?

</comment><comment><USER22> Would love this or something similar for local development. Currently using the Docker for Mac k8s and it shreds my machine and end up with an hour of battery life. Had similar experience with minikube.

<comment><USER23> I would as well. Curious if anyone has tried this for local dev.

Also curious if this can run on osx.

<comment><USER24> I tried it on my mac with the docker-compose from master and works pretty well.

</comment></comment></comment><comment><USER25> Not trying to be snarky, just a sincere question - why would you use kubernetes for something like IoT?

<comment><USER26> I attended KubeCon China last year and there was a very good example of a K8s setup for IoT that scales pretty well. Check these links if you're curious:

\- [https://schd.ws/hosted_files/kccncchina2018english/18/ShengL...](https://schd.ws/hosted_files/kccncchina2018english/18/ShengLiang- En.pdf)

\- [https://thenewstack.io/rancher-takes-kubernetes- management-t...](https://thenewstack.io/rancher-takes-kubernetes-management- to-china/)

Disclaimer: not affiliated with any of the companies above. Edit: formatting.

<comment><USER27> Is there any link with the talk ?

</comment></comment></comment><comment><USER17> Here's the recording of the webinar announcement: [https://www.youtube.com/watch?v=5-5t672vFi4](https://www.youtube.com/watch?v=5-5t672vFi4)

</comment><comment><USER28> Technically speaking: cool

Practically speaking: I worry this will become a parallel but subtlety different implementation of Kubernetes with it's own quirks.

<comment><USER17> That's why CNCF is thrilled that Rancher passed our Certified Kubernetes conformance tests for k3s prior to the public announcement.

[https://landscape.cncf.io/category=certified-kubernetes- dist...](https://landscape.cncf.io/category=certified-kubernetes- distribution,certified-kubernetes-hosted,certified-kubernetes- installer&format=card-mode&grouping=category&selected=k3s)

<comment><USER28> Ah, interesting! Cool. Thanks.

</comment></comment></comment><comment><USER29> Looks quite interesting for small setups, curious to read more about the limitations (E.g. " _Added sqlite3 as the default storage mechanism. etcd3 is still available, but not the default._ " \- what availability promises can this make?)

<comment><USER30> In terms of etcd3 vs sqlite3, it is as reliable as most airplane systems that depend on it.

[https://www.sqlite.org/famous.html](https://www.sqlite.org/famous.html)

I think the "high availability by redundancy" story is oversold.

<comment><USER31> Alternatively the K3s authors could have embedded a single node etcd process into Kubernetes using the embed package instead of introducing sqlite.

[https://godoc.org/github.com/etcd- io/etcd/embed](https://godoc.org/github.com/etcd-io/etcd/embed)

This is something the Kubernetes community might consider as well.

<comment><USER32> Yeah, OpenShift did this from the very first version. It worked pretty well. Memory use was very reasonable from etcd 3.0 on.

</comment></comment></comment></comment><comment><USER33> I'm going to try this - I really hope its good. I've spent a lot of days trying to get k8s working with a cheap home server. With VMs and docker conflicting networks its a nightmare. Upgrading is worse.

<comment><USER3> I've tuned a Kubernetes setup to run pretty well on a Pi cluster with 1 GB RAM per node here: [http://www.pidramble.com](http://www.pidramble.com) — there's a configuration for testing in Vagrant/VirtualBox machines as well.

<comment><USER33> Hey that looks pretty cool. I bought an old Xeon workstation for $200 off ebay that I think is more flexible. My own rack of blades does sound awesome. :)

</comment></comment></comment><comment><USER13> "Added sqlite3 as the default storage mechanism. etcd3 is still available, but not the default."

I want to use and support this product for this reason alone. Etcd was always an un-necessary complexity added for god knows what reason. Later cluster management solutions have abstracted etcd creation and management away (thankfully), but it's always irksome that it is there. Thank you to the K3s development team for taking on that challenge!

<comment><USER34> AIUI it gets you away from a single point of failure, right? Unless you have a reliable NFS server (and non-SPOF NFS servers are rare and pricy), running k8s on SQLite sounds like you can only have one master.

Of course that's totally fine for many k8s deployments and might even _increase_ reliability for some use cases, but still, moving from a distributed system to a local one is a significant change.

<comment><USER13> meh. Practically speaking, we're talking about a single point of disk failure - which certainly happens but at a rate that is sufficiently low. Plus, the actual amount of data stored is tiny, you can replicate it in seconds. Amazon has solutions for this if it's truly of concern, I would guess google does as well. IMHO, the operation of etcd - and the fact the data became unreadable if you lost quorum - was a much higher risk factor than possible disk failure. It was impractical to backup as well, you either have quorum or you don't. Even without NFS, I could backup that sqlite db every 5 minutes via a cron job and have most of my cluster state perfectly preserved.

<comment><USER34> Disk failure happens quite frequently for me at scale, but so do other things like RAM going bad or network cards dying or entire mainboards just acting weird or top-of-rack switches silently dropping packets because of memory corruption (all of these have happened to machines I'm responsible for in the last six months). Again I think this is a matter of scale. If you've got enough machines that disk failure is a concern, you can also run a 9-node etcd cluster and have a big enough pager rotation that keeping 5 of them up 99.999% if not 100% of the time isn't a challenge. If you have less than a rack of machines and you're not at the point where you're worried about having a SPOF in your network switches or power supplies, running etcd a bunch of overhead for a problem you don't have and you are genuinely better served by a robust non-distributed system whose availability is the availability of your hardware.

</comment></comment></comment></comment><comment><USER35> This is very nicely done. It annoys me a bit to have to set up a registry and have a build cycle prior to actually deploying things, but gitkube might help there...

<comment><USER36> I hadn't heard of gitkube before. These blog posts helped me compare and contrast with similar solutions I had heard of (mainly skaffold and draft): [https://blog.hasura.io/draft-vs-gitkube-vs-helm-vs- ksonnet-v...](https://blog.hasura.io/draft-vs-gitkube-vs-helm-vs-ksonnet-vs- metaparticle-vs-skaffold-f5aa9561f948/) [https://kubernetes.io/blog/2018/05/01/developing-on- kubernet...](https://kubernetes.io/blog/2018/05/01/developing-on-kubernetes/)

</comment></comment><comment><USER37> If it is as easy to deploy, as they say, it is bound to become the most used implementation as Ubuntu became the most popular Linux distro for servers.

I am looking forward to this.

</comment><comment><USER38> Do you think kubernetes are necessary for small businesses?

<comment><USER39> Necessary, no. But with the hardware almost free, a 3 x Raspberry Pi cluster, switch, access pointer, and a small UPS would be a few $100 which allows for some interesting possibilities.

Pretty much any business will want inventory tracking, tracking staff hours, monitoring cameras, sensors for detecting flooding/doors left open/freezers dying, running point of sales terminals, keeping the supply chain running smoothly, handling customer loyalty cards, handling returns, etc.

An on site cluster can help with much of that, even if there's a hardware failure or the network is out.

Question is how will these business find the apps they need that run turn key on some small k8s cluster?

<comment><USER40> Hardware was never the bottleneck there. The systems could cost a hundred times that and it would still be a rounding error on the capex of even the smallest "real" business.

The obstacle to using custom hardware and software in local biz is and has always been, the fact that by relying on it, the one guy who knows how to administer it all becomes the single point of failure for the whole business.

No amount of tooling can save them from that. So local biz will always be beholden to the Oracles of the world, because smart individuals just can't be relied on.

Businesses need to rely on other businesses. A business with a customer service departments and spare stock on hand. K3s or k8s _might_ be used in the technology product offered by such a business, but this by itself won't change the economics of that market.

<comment><USER39> Dunno. I've know several business owners that didn't take credit cards until recently, and even then only did so because the newer companies have significantly lowered the investment cost. Maybe you don't consider small family owned restaurants "real".

Seems like there's an opportunity for a cheap 3 node cluster, sold as a value add to businesses and supported a platform that application writers could target. They might well come with a support contract, some basic functionality, and then users could pay for inventory, staff scheduling, point of sales terminal support, integration with food delivery services, etc.

Much like how some home/small business NASs these days have support for 100s of integrations to various online services.

<comment><USER41> "Cluster" doesn't really square with "small business". Like, why have 3 nodes? HA? They're all probably plugged into the same power run and switch and breathing the same A/C. They're not actually redundant but they are more complicated. So it makes no sense unless you have strangely huge/complicated computational requirements.

<comment><USER39> Why not? Small business can lose significant money from a few hours of downtime and support that's onsite within an hour is quite expensive.

I'm not thinking cluster for performance, just for HA.

For small business why not 3 x Raspberry Pi to enable as much functionality as possible without network and/or power? A cheap UPS would likely run a few Pi for days. Chick-fil-a (3 NUC in a k8s cluster) seems pretty proud of their setup, why not something similar for any similar size restaurant? 3x Pi for smaller businesses seems like a good fit.

Oh, and a Pi cluster isn't going to need any more AC than a human, even if it's uncomfortable. I have one in my attic and it regularly gets above 110 in the summer, no problems so far.

If the network is out, have the Pi fall over to WAN, this is pretty common these days. Some consumer routers support this (insert a sim car), and it's fairly common for raspberry Pis used for home security to support similar. Handling credit card transactions over WAN is reasonably practical... even falling over to a modem+POTS could do for an emergency.

So between UPS (even UPS + solar + battery would be reasonable for a Pi) and fallover to WAN or modem a 3 way cluster could help keep business up during power outages, storms, earthquakes, fires, and of course node failures.

Question is can the right combination of hardware standardization, software standardization, support, and application store get together to enable chick- fil-a like functionality at a price point acceptable to small businesses?

<comment><USER41> It's still a bad idea.

First of all, do you know what k8s is for? Bin packing. Does your small business have a bin packing problem? (And I don't mean crates) Does your small business even need containers at all?

Second, 3 nodes is more than you need. You only need 2 nodes for HA. There is no universe in which two nodes in the closet of a coffee shop would go down, but three would not.

Third, it's too complicated. It takes teams of people loads of time and money to get it working properly, and then they have to keep supporting it, because release cycles and changing standards, etc. Distributed systems are the most complex and the most costly, unless you're at a huge scale, and then it _can_ be cheaper.

Four, it's unnecessarily expensive, because again, you don't need 3, and it's too complicated.

Five, you don't need 3 nodes to have redundant network paths. A DSL line and a cell modem are pretty easy to plug into one machine.

But six, the real reason this wouldn't work: small businesses do not buy HA.

> Question is can the right combination of hardware standardization, software > standardization, support, and application store get together to enable > chick-fil-a like functionality at a price point acceptable to small > businesses?

Yes, it's called Windows on a Dell.

</comment></comment></comment></comment></comment></comment></comment><comment><USER10> Welcome to 2019 where an "embedded" system has 1GB RAM.

The problem of GO is that all those unused libraries are loaded in RAM instead of staying on disk, and loaded when needed.

An helloworld in GO (around 1.6MB) is still too large for my openwrt router.

<comment><USER42> > Welcome to 2019 where an "embedded" system has 1GB RAM.

Thirty years ago someone could have said the same when seeing laptop computers and remembering when computer literally used to occupy whole large rooms.

Come on, let's stop doing this kind of jokes, they add nothing to the discussion.

<comment><USER43> The problem is that the bottom end of 1k RAM still exists. In fact, because the main change is that it gets cheaper every year, it's even more prevalent. Just because there aren't lots of blog posts, doesn't mean that isn't a large proportion of the industry.

The word 'embedded' is not well defined, but if you use it on things with 1GB of RAM, what do you call a PIC with 1K?

My personal definition of embedded (which is of course still flawed) is anything without an MMU. A Raspberry Pi isn't embedded for instance, it's just a small computer, just like a phone.

<comment><USER34> Then what do you call a server with a CPU+MMU for its remote management or an iPhone with a CPU+MMU for its secure enclave? A cluster?

There is certainly a lot of technical merit in calling the five-inch thing in my hand a distributed system of multiple computers, but in practice it's not the common definition.

</comment></comment></comment></comment><comment><USER44> Would it work on Android? That would be interesting.

<comment><USER45> Darren mentioned on the CNCF webinar that he has plans to test it on chromeOS, which is similar to android, but that it hasn't been done yet.

</comment></comment><comment><USER46> This looks great, playing around with it right now. They seem to have removed PersistentVolumes, too. I'd like to run a MySQL database on K3S, how would I go about making sure that my database's data survives when its pod dies?

</comment><comment><USER47> I mean, I've built a Kubernetes-y thing for my own needs, mostly "scheduling" LXC and FreeBSD Jails, and it needs hella less than 256MB of RAM and it's around 20MBs. Maybe I should clean the code and publish it.

<comment><USER48> That's literally not Kubernetes, though. Does it support custom resource definitions? Services? Deployments? ConfigMaps? Multiple containers on a single host, i.e. Pods?

Your project does sound very cool but I don't think provides a fair basis of comparison re: size and RAM usage.

<comment><USER47> very good question! source definition -> no. services -> yes. deployments -> yes. configmaps -> no. multiple containers on single host -> yes. I should add the most common features I think. I also haven't integrated it with any reverse-proxy service yet, but will try that too.

</comment></comment></comment><comment><USER49> It is nice to see people working on making software smaller!

It leaves me wondering though, what is Kubernetes doing with all of these resources? When I saw "lightweight" in the title I expected 5.12MB of RAM, not 512MB.

</comment><comment><USER50> @mods: This should be merged with [https://news.ycombinator.com/item?id=19257675](https://news.ycombinator.com/item?id=19257675)

</comment><comment><USER51> This looks great, we're planning to test with the intention of moving our CI/CD orchestration onto this.

We use Calico internally, is there a plan in the future to allow other SDNs?

<comment><USER52> [https://github.com/rancher/k3s#flannel](https://github.com/rancher/k3s#flannel)

</comment></comment><comment><USER53> Anyone know if this will run on a Pixelbook? (inside the Crostini linux virtual machine in ChromeOS). Thanks

<comment><USER54> Got excited about this too, but unfortunately no, it doesn't run on Crostini. Fails with querying netfilter.

Also tried through docker-compose from the GH repository. It starts the k3s server fine but fails on starting the nodes as they require privileged container mode, which doesn't work on Crostini at the moment.

<comment><USER45> Mentioned this elsewhere, but if you create an issue, Darren mentioned on the CNCF webinar that they would be looking into ChromeOS soon.

<comment><USER54> There's also a feature request in ChromeOS bugtracker about adding the missing bits for minikube, part of which seem to be similar to what k3s is using: [https://bugs.chromium.org/p/chromium/issues/detail?id=878034](https://bugs.chromium.org/p/chromium/issues/detail?id=878034)

</comment></comment></comment></comment><comment><USER55> I find it humorous how many people in this thread seem so willing to use this in production.

If you can't make Vanilla upstream Kubernetes work, it is very ill advised to think you will be met with success using a heavily modified fork that has a fraction of the support of K8S.

<comment><USER56> In an environment where only a fraction of support is needed, it doesn't make sense to run a fat distro with features that you'll never use. K3s is designed for low-power, low-resource environments that don't need things like EBS or NFS volume support or alpha/beta API features. Imagine edge environments like traffic management networks, wind farms, telco substations, or other places where environmental constraints make it more reliable to run something fanless with flash storage and 1GB of RAM. Stock Kubernetes will choke under those circumstances, but does that mean that those environments are forbidden from using the benefits of Kubernetes?

</comment></comment><comment><USER57> A bit off topic, but has anyone used K8s along with Proxmox?

<comment><USER58> Not a k8s user, but no reason it shouldn't work from what I read about it. Spawn a few CoreOS or RancherOS VMs and off you go.

Some people even used it with LXC, though it seems a bit of a work. e.g. [https://medium.com/@kvaps/run-kubernetes-in-lxc- container-f0...](https://medium.com/@kvaps/run-kubernetes-in-lxc- container-f04aa94b6c9c)

<comment><USER57> Gonna check this out, thank you! I tried installing CoreOS a couple years ago and I recall encountering some issues using LXC, but maybe it'll work now :)

</comment></comment></comment><comment><USER59> And we have done it! Solutions for the solutions!

</comment><comment><USER60> kubes</comment>


Cloudflare is turning off the internet for me - <AUTHOR> https://blog.dijit.sh/cloudflare-is-turning-off-the-internet-for-me <comment><USER2> It appears that you may have made some modifications to your user agent string. If you revert your user agent to the one provided by default by your browser vendor everything will be fine.

<comment><USER3> Why is it that something as malleable as a user-agent string trips these kinds of sensors?

If I were to write a bot, copying current browsers' user-agents is literally the _first_ thing I'd do

<comment><USER4> It really hits home the point of how shitty the web has become. Ad companies and malware distributors come up with bad and worse ways to interfere with my browsing, and the "good guys" need to match with increasingly invasive and fragile anti measures.

Sort of like having to take of your shoes when you board a plane. If that's what it takes, isn't it just better to stay home?

<comment><USER5> > Sort of like having to take of your shoes when you board a plane. If that's > what it takes, isn't it just better to stay home?

Removal of shoes, 'naked' full body scanners, these are all terrible, and I tell myself every time it isn't worth the hassle.

The reality is that as much as I hate it, I'm still flying every other week.

I'm also on the Internet daily. I don't see that changing.

<comment><USER3> Honestly what is the point of user-agent at all if it needs to be set to some changing, magical incantation in order for a browser (or any other agent) to be functional?

I hate the direction the internet and tech is going, and I hate even more that I'm seemingly powerless to do anything about it

</comment></comment></comment></comment></comment><comment><USER6> The problem presented by services like ReCaptcha and Cloudflare is a tough nut to crack.

They're silently embedded in a huge portion of modern websites, and the average user will never even know about them.

But it seems to be way too easy for them to blanket-ban or serve an absurd amount of captchas to powerusers, linux gurus, privacy geeks, or anyone with the wrong combination of browser+addons. And the failures (as in this case) are often silent, cryptic, un-fixable from the user end, and can prevent us from accessing massive swaths of the internet. Any thoughts surrounding this conundrum?

Solutions:

1\. Everyone stops using ReCaptcha/Cloudflare.

\- Never going to happen. They dominate the market because they are useful, well-made services.

2\. Launch a competing product that accomplishes the same thing.

\- Good luck competing with these giants. Also, how would your implementation differ to solve this issue?

3\. Powerusers and tech nerds must conform to 'normal' browser configurations and disable privacy addons in order to enjoy the internet with 'normal' users.

\- Two steps backwards in every conceivable way. The giants gain more invisible power and powerusers suffer decreased productivity/privacy. Not going to happen.

<comment><USER7> Yeah, you can't really talk about downsides of Recaptcha/Cloudflare without also acknowledging the extreme amount of malicious actors and abuse on the internet.

We're in a "this is why we can't have nice things" predicament and you have malicious actors to thank for that, yet most people on HN only seem capable of attacking the few affordable solutions to that problem.

I'm even down with the theory that Cloudflare is a US government outfit, that's the only way I can wrap my head around such a generous free tier. But at what point does it worry you that the internet has so many fundamental issues that people willingly centralize behind such a large behemoth? How many options do I have when a kid is holding my forum hostage with a $5 booter service?

It's easy to shit on everything. Let's hear some real solutions.

<comment><USER8> > Let's hear some real solutions.

It's by no means a full solution (there likely is no single full solution), and it may even be a bad solution -- but lately I've been trying to think about what the Internet would look like if we didn't have a massive arbitrage potential around server requests.

Part of the reason why everyone is trying to detect bots is because bots will very, very rapidly eat up your bandwidth and CPU time. We're used to offering our bandwidth/CPU for free to humans and either swallowing the cost if we're running a free service, or making up the cost in an adjacent way (ads, subscriptions, etc...). It's not bots that are the problem. It's that when someone asks our servers to do something, we do it for free. Bots are just a big category we can ban to make that problem smaller.

In many (but not all) cases, we shouldn't care about bots, and the only reason we do is because our systems aren't scalable to that level.

So I've been wondering lately what a server-defined per-pageload, or even per- request fee would look like on the Internet, maybe one that scaled as traffic got heavier or lighter and that was backed by a payment system that wasn't a complete rubbish privacy-disrespecting dumpster fire.

My immediate thought is, "well, everything would be expensive and inaccessible." But, the costs don't change. You still have to pay server costs today. Businesses today still need to make that money somehow. There are almost certainly downsides (all our current payment systems are horrible), but I wonder if it's more or less efficient overall to just be upfront about costs.

Imagine if I could put up a blog on a cloud service anywhere with scalable infrastructure. Then a post goes temporarily viral. Imagine if my server could detect it was under heavy load, detect that it was getting hit by bad actors, automatically increase the prices of requests by a fraction of a cent to compensate, and then automatically ask my provider to scale up my resources without costing me any extra money?

For a static site, suddenly I don't need to care if people or bots are hammering it, I don't need to care about anything except whether each visitor/bot is paying for the tiny amount of hosting costs they're hoisting on me. If bad actors start pushing traffic my way, I don't need to ban them. I just force them to pay for themselves.

<comment><USER9> > automatically increase the prices of requests by a fraction of a cent to > compensate

Great concept.

CPU, bandwidth, electricity, it's all just energy. And to a significant degree, money is just energy stored. I generate energy with my own work, store it in the form of money, and then transfer that energy to someone else, maybe to heat my home or cook me a meal.

Before money, I had to barter for those things. Maybe conceptually the internet is in a similar state at the moment. It doesn't have 'money'. Why can't I put CPUs in my wallet and then spend them? And why can't I charge visitors to my site by the CPUs they are costing me?

Instead, I have to, in a way, barter. For example, maybe I use ad revenue to earn my income, so I generate all this content, I barter that to the search engines, which barter with the advertisers, which barter with me, and I barter back to security guards to protect me from 'bad' actor bots. I'd really just like to receive CPU and bandwidth payments from them.

<comment><USER10> Isn't the reason we are freed from barter in daily life is because the government is intimately involved in the financial/banking system, and regulates it and issues money and so on? Maybe we continue to struggle with the internet because it started out unregulated and has never really transcended that because people insist on thinking freedom is best for commerce without appreciating the nuances.

<comment><USER11> There are alternatives to that. For all of the hype and vaporware of the cryptocurrency movement, the idea of digital-native programmable internet money is a powerful one. I'm personally excited by the idea of involving currency at the protocol level and having it interact naturally over tcp/ip and http. There is an alternative to ads if we can make it work.

</comment></comment></comment></comment></comment></comment><comment><USER12> Because the author using a niche browser (QT wrapped in an app), this might be Browser Integrity Check. It's purpose is to block non-browser like behaviour common for spammers/malware.

That would also explain switching to Chrome fixes the issue.

[https://support.cloudflare.com/hc/en- us/articles/200170086-U...](https://support.cloudflare.com/hc/en- us/articles/200170086-Understanding-the-Cloudflare-Browser-Integrity-Check)

<comment><USER13> So if your browser agent is not firefox, chrome, safari internet can stop working. What a great side feature.

<comment><USER14> Yeah, because most custom browsers are malicious. They have the data to prove it. This isn't a side feature, it's a direct feature that is 100% intentional. They maintain a backend whitelist of known "good" user-agents. Curl is on that list and there are a few others outside of the big players.

Most people building custom browsers are doing it to do something Chrome would disallow. One instance would only supporting one, weak-ish cipher forcing TLS to use a predictable cipher instead of choosing the best available encryption for transit. While I agree some people have cool browser projects that would be nice to use, it's a side effect of bad actors abusing the system. Most of the annoying parts of Cloudflare exist because bad actors have abused the system.

<comment><USER15> Any sufficiently bad actor will already modify their user agent. Who is this really stopping?

<comment><USER16> Bad actors who are bad at being bad actors, which is actually the bulk of bad actors.

It's maddening, but it's true. I've seen tale of people having to modify resource auto-generators that created URLs with hexadecimal identifiers in them because the sequence "ad" in a URL would trip ad-blocking browser plugins. You might ask yourself "how many ad companies worth their salt have 'ad' in the URL path?" and the answer is "The ones who are worth their salt might not, but the ones who are terrible do, and they're probably terrible at other things too, like letting malware on their network."

<comment><USER17> There's somebody who can build a custom browser but can't figure out how to change the user agent string?

<comment><USER16> They're called "script kiddies" and the trick is: they don't build the browser, they download a kit someone else built that has a user agent in it and use it for whatever purpose they intend to.

I went to school at a place that had a policy of soft-blocking network access for any machine that a portscan detected had TCP or UDP 12345 opened, because Back Orifice defaults to that port and people who built trojan horses to allow remote access didn't change the default. It caught a reasonable number of owned machines every year.

Don't overestimate criminals; if most were good at being criminals, they could be successful in society without having to break the law. ;)

</comment></comment></comment></comment></comment></comment></comment><comment><USER18> There is another side effect of visiting sites served by CloudFlare with disabled JavaScript: Email addresses (or any other words separated by an @) appear as "[email protected]" instead. Take this blog post from CloudFlare themselves for example: [https://blog.cloudflare.com/serverless-performance- compariso...](https://blog.cloudflare.com/serverless-performance-comparison- workers-lambda/) That's just ridiculous.

<comment><USER19> How is it ridiculous? It's called email obfuscation (it can be disabled within Cloudflare) it's to stop spam bots from ripping email addresses from websites and adding them to mailing lists.

<comment><USER20> Because their regex is crap and if you have @twitterHandle or something with a legitimate "@" you just see the obfuscated version.

It's laughably adorable to think it's actually solving a problem or helping in any way, the 'bad actors' it's trying to prevent probably have a work around anyway.

<comment><USER15> > It's laughably adorable to think it's actually solving a problem or helping > in any way, the 'bad actors' it's trying to prevent probably have a work > around anyway.

They do—changing your user agent is trivial.

<comment><USER21> Why would I want to send an incorrect user agent? There's no point having one if it's just going to lie anyway.

<comment><USER22> I agree. I wish browsers would just stop sending a user agent string entirely. I don't think that I've sent an honest one in over a decade.

<comment><USER21> [https://news.ycombinator.com/item?id=22044057](https://news.ycombinator.com/item?id=22044057)

</comment></comment></comment></comment></comment></comment></comment><comment><USER23> I don't see anyone here mentioning this, so I will. CloudFlare supports PrivacyPass, a third-party, privacy-preserving way to do proof-of-work for websites. Basically, you do some small amount of CPU work and get 30 tickets your browser can transparently redeem for access to a site.

That's a pretty clever way to both deter bad actors and ensure legitimate users get uninterrupted access to websites.

<comment><USER24> AFAIK the Privacy Pass protocol has nothing to do with proof-of-work. It's just a way to allow users to solve a CAPTCHA once and re-use that single solution across multiple sites without jeopardizing privacy. Reduces the number of CAPTCHAs you see, but doesn't eliminate them entirely.

What you're talking about is more like what Hashcash does, where it essentially replaces CAPTCHAs with a cryptocurrency miner, such that bots become more expensive to run due to the amount of energy they consume. The downside is it's not great for battery life for regular users either.

<comment><USER25> Captcha is also a kind of proof-of-work, and a very nasty one, where users are made to do the work instead of computers.

</comment></comment></comment><comment><USER26> I've been noticing a larger and larger portion of sites in google results have been taken over by _something_. They all act the same way, and act similar to cloudfares checks. You get a big green dot on the screen first and then a bunch of redirects. I've not read anything about it, but probably 1/15 of my google result clicks end up there. How does google not know these sites have been taken over and keep them on the first page of search results? It's getting tiring because they also hijack your history, so you can't just hit "back" and you lose everything you've been searching through. You can't just click "back" to the results page and go to next result...you have to start search over and remember exact terms you used "that last search"

<comment><USER27> I have a little tip for you; right-click your back arrow, and choose your search page from the list.

<comment><USER28> At least on iOS Safari there's this bug (feels like it's always been there, maybe content blocker related?) where sometimes a search simply gets eaten. The browser somehow thinks you went from nowhere straight to the page you're on, even though you went past a Google results page.

I assume it's somehow redirect-related and that's why these sites tend to trigger it.

<comment> why-oh-why I'm thinking of two situations:

\- you tapped the "Siri suggestion" result which completely skips the SERP. I hate that "back" doesn't bring you back to what I typed in the search/URL bar

\- I regularly visit The Verge, open a story and then the back button doesn't take me to the homepage but to the page before it. I blame their crappy JavaScript but maybe we're experiencing the same thing.

<comment><USER28> Nope. It's as if that happens, though going past a regular Google search results page, which is dropped (hence along with the search itself) from history.

<comment> why-oh-why Nope what? I described that same thing on The Verge.

</comment></comment></comment></comment></comment></comment><comment><USER29> I really wish you could just directly pay for services. A hundredth of a cent per visit would make most abuse un-profitable while still allowing very affordable procrastination.

<comment><USER30> This would make search engines impossible, sadly.

<comment><USER31> Why do you think that?

</comment></comment></comment><comment><USER32> FYI, the new/current version Qutebrowser just added a built in list of websites that require a "Chrome/chromium" UA - it also added logic so that parts of the UA can be auto updated.

Shameless shill: Qutebrowser is by far the best browser I've every used. The half measure of using addons (even powerful ones like Pentadactyl) cannot be compared to having a browser that is power user friendly in every aspect, from config to UI. If a site doesn't work well with it then I'm probably not going to use that site. If I can move away from Google then I can find your article/post somewhere else.

<comment><AUTHOR> This mirrors my experience and opinions. However I miss certain powerful adblock features and I would prefer more/easy control over javascript that gets rendered since JS use is by far the largest consumer of energy on my laptop.

</comment></comment><comment><USER33> Cloudflare is also making TOR quite useless.

<comment><USER34> I don't know the specifics on this, could you elaborate?

<comment><USER33> Half the websites I visit give me the CloudFlare screen like

        One more step
        Please complete the security check to access <whatever>.

Followed by either endless stream of ReCaptchas or one completely impossible.

<comment><USER14> if captcha loops are still an issue, you should write in. JGC takes that stuff seriously. You're more likely to see a IP block, because most site owners do not whitelist TOR endpoints or specifically block them because it's mostly abuse.

<comment><USER35> I'm guessing JGC is some dude that works at CF, but where should one write in? You're literally looking at a Google CAPTCHA, you can't go to the contact page because that's behind this proxy that won't let you pass.

<comment><USER14> JGC is fairly popular on here and is CTO at Cloudflare. You can simply write into email@example.com, those tickets are forwarded to engineering teams.

<comment><USER35> Support options would be good info to put on that CAPTCHA page instead of having to find that somewhere deep down in an HN thread.

Wasn't HN also behind CloudFlare? Looks like that changed, but maybe it will be again in the future.

<comment><USER14> I do believe that there was a point where HN was using CF, but that hasn't been true for a while if memory serves.

As for the support@ not being on those error page; decent feature request. I image the reason they want to avoid that is many of these errors are delivered at request of the site owner or related to the site not working (404s, 503s, IP firewall blocks, etc) so they do not want to funnel people into Cloudflare support for issues that are not specific to Cloudflare.

Determining which errors are the site owners responsibility and which errors are Cloudflares responsibility can be quite tough.

<comment><USER35> It's not rocket science, they just don't _want_ to solve the problem.

"many of these errors are delivered at request of the site owner" For those, put the site owner's contact method there. Even a physical mailing address, fine by me, I'll send a letter (something a spammer would not do) if it's important enough to me to do so.

"or related to the site not working (404s, 503s" those pages don't deliver a Google CAPTCHA or don't say "You have been blocked". If they can determine whether a page should have a captcha and/or that text, then that if statement can also include showing contact info.

<comment><USER14> I think the truth is somewhere in the middle here. Yes, Cloudflare could do a bit more to predict this, but I don't think it's as trivial as you make it. The routing between you to a site through Cloudflare includes a lot of complex interactions.

The captcha page, sure, maybe. I can't think off the top of my head what would happen on that page that _wouldn 't_ be related to Cloudflare/reCaptcha. I yielded that is a decent feature request. But plenty of actual interstitial pages served by Cloudflare aren't necessarily caused by Cloudflare. Like the fact you get a Captcha at all isn't Cloudflares choice most of the time, it's the site owners. And having firstname.lastname@example.com on that page would 100% cause people to write in saying they don't want to see captchas. That's not the appropriate party to reach out to requesting to stop seeing captchas for a specific site. Now, SOMETIMES it's an automated incident because of your IP, so then you DO want to reach out to Cloudflare.

Same with 500 series errors. Sometimes it's the website not responding, but sometimes it's Cloudflare not interacting properly.

So yeah, I think the truth of the matter is in the middle here. In terms of priorities, I have no doubt this is pretty low on their list. Why would it be any higher when they serve the technical purpose they were created for? The rest of that is QoL with minimal impact on customers compared to many other issues that go wrong with the network that have considerable impact on customers and visitors.

</comment></comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER36> Cloudflare blocks an enormous number of bad actors for me, so I quite like it.

<comment><USER35> I'm curious about the specifics because through my and my colleagues' simulation of "bad actors" (ethical hacking) I've never once gotten stopped by CF.

I thought the point was anti-DDoS by just proxying your traffic through someone with bigger pipes. That they do TLS offloading to filter n-days like Heartbleed helps as well of course, but those are super rare events and it sounds like what you mean is ongoing.

What kind of bad actors do you mean, and what kind of sites? Don't have to mention the domain or anything, just that it makes a difference whether it's a web shop (financial risk I guess), more like a forum (spammer / hater risk), or something else.

<comment><USER37> Generally, the DDOS protection even at layers 3 and 4 is a blessing. For a layer 3/4 attack, all a malicious actor really needs is a bunch of average internet connections anywhere; and depending on your server hardware, it might be inexpensive to keep it down since those IPs are cheap. CF just drops all packets from these "literally 99% of traffic is malware" IPs on the network layer.

But a layer 7 DDOS attack, when going through Cloudflare, means the malicious actor needs to have IP addresses that are at least not complete trash in terms of IP reputation. Getting access to a botnet and access to these IP addresses isn't exactly prohibitively expensive, but it's a much larger barrier to entry.

It's even harder to get taken down by a layer 7 DDOS attack on Cloudflare if you use "im under attack" mode, assuming your attacker isn't paying even more for the botnet to run something like Chromium or node to hit your website.

Finally, while Cloudflare doesn't actively do this for small-scale DDOS attacks (since it might just be a spike of users), they do have Gatebot for the larger scale ones [https://blog.cloudflare.com/meet-gatebot-a-bot-that- allows-u...](https://blog.cloudflare.com/meet-gatebot-a-bot-that-allows-us-to- sleep/).

</comment></comment></comment><comment><USER38> There is a stage where "good" companies get so big that they can't really be "good" (For all)...

Cloudfare has passed that point a while back. They have so many policies, departments, shareholders and government departments to please that it is now impossible for them to be a truly good force the open internet.

</comment><comment><USER39> We need a website which tracks Cloudflare's captcha and blocking behaviour! I live in Cyprus (EU part!) and I witnessed more and more sites need now this stupid Captchas and I installed actually "Privacy Pass" which is also not working 100%. Why is this (EVIL!) company destroying my internet experience? This is a relatively new and recent experience for me... something has changed on Cloudflare's captcha requirements. Before that I've only witnessed this behaviour in countries like e.g. Philippines.

</comment><comment><USER40> I suspect Cloudflare is doing some form of 'fingerprinting' to flag potential attacks. Fingerprinting is probably based on things like IP, user agent, js being enabled, etc. In this case it seems that Cloudflare only banned a specific user agent with js_enabled=no.

Obviously this is all just an educated guess, since I've worked on building scrapers for cloudflare-protected websites.

<comment><USER41> Came to say the same thing.... Try changing the user-agent the browser sends to match the user agent that Chrome sends.

</comment></comment><comment> open-source-ux Also related: depending on where in the world you reside, you may be more likely to encounter Cloudflare blocking sites or simply slowing the retrieval of websites (as it scrutinises traffic to those sites). This may be more likely to occur to you if you access the web outside of North America and Western Europe.

 _CloudFlare is ruining the internet for me (2016)_

[https://www.slashgeek.net/2016/05/17/cloudflare-is- ruining-t...](https://www.slashgeek.net/2016/05/17/cloudflare-is-ruining-the- internet-for-me/)

And the ensuing Hacker News discussion a few months ago:

[https://news.ycombinator.com/item?id=21169798](https://news.ycombinator.com/item?id=21169798)

</comment><comment><USER42> To be fair, site owners are in control of those settings.

<comment><USER43> What are the defaults of those settings? What percentage of site owners change the defaults?

It's kind of like saying "it's your own fault you didn't de-select the "track everything I do" checkbox on our privacy page".

</comment></comment><comment><USER44> Somewhat to my surprise, my SiteTruth system is allowed to read "bakadesuyo.com", the site with which the article author had a problem. Sitetruth uses a user-agent like "Sitetruth rating system", and makes no attempt to pretend to be a browser. Cloudflare let it through. No capcha. No error messages.

Can't conclude much from this; Sitetruth has been reading sites openly for years in a well defined way from a well known IP address, examining them for ownership info about once a month. Although it looks at millions of sites, it never hits any one site very often. From Cloudflare's perspective, that's harmless.

</comment><comment><USER45> I also refuse to complete captchas because I'm not interested in giving a trillion dollar company my free labor to help train their models.

I'm really close to just defaulting JavaScript off entirely, the web is becoming so much worse by the day.

<comment><USER46> I've had js turned off by default for many years now, and don't feel like I'm missing out on anything important. Your mileage, of course, may vary.

<comment><AUTHOR> You're a stronger person than me.

I keep trying to live without JS but so little of the internet works.

* Gitlab/Github (obviously)

* Google maps (obviously)

* Linkedin... (uh... less obviously)

* Outlook

* Infoq.com

* Rust docs

* Google Cloud Docs

etc;

A lot of the internet is butchered without JS.

I really want a way of just blocking third-party JS (IE; the site can deliver JS, but not anything it tries to import unless whitelisted). But that seems to be hard with qutebrowser.

FWIW uMatrix apparently has a method doing this.

<comment><USER46> Perhaps I did not express it clearly, but I do not browse WITHOUT ANY JAVASCRIPT EVER. I browse with js disabled by default, but enable it (using excellent uMatrix Firefox addon) for certain sites that I trust. Although even then I try to find the least possible amount of uMatrix permissions that enables the functionality I need from a site.

That said, I do not use many of the obvious mainstream sites - e.g. I ditched Github like dirty socks the moment Microsoft grabbed them.

But yes, modern web (not the Internet, mind you) is very damaged, and I fear it will take decades to fix the damage, once (I hope) smarter people take the reins after high-visibility security and privacy incidents become more and more frequent, and, well, more visible to general public.

</comment></comment></comment></comment><comment><USER47> CF appears to be looking at the UA-agent and deciding to block based on that.

I'm guessing it's very basic checking because deep browser-fingerprinting is supposed to against the law in some countries (I stand to correction on this statement).

I'm not personally a fan of CF because of the amount of data they can potentially obtain(or do), but there's a lot of crap out there and their firewall is robust enough to protect Johns Cowboy store from contributing to some dudes Monero mining botnet.

</comment><comment><USER48> I think the site went down. Here's the archive: [http://archive.is/dVfYE](http://archive.is/dVfYE)

<comment><AUTHOR> Ironically; Cloudflare would be quite useful for me right now. :)

</comment></comment><comment><USER49> ReCaptcha is a necessary evil, but there's something that needs to change: the internet-wide rate limit. If I try to scrape a site and start getting captchas, when I go back and try to browse a completely different site, I'm suddenly trying to drag the points to outline a plane for ten minutes. Keep track of reputation on a site-specific basis.

</comment><comment><USER50> Random web hosts also have sloppy antibot 'AI's'. Siteground's is the most annoying because it for some reason thinks my work's network is a bot, and it doesn't identify itself unless you reverse image search their little anti-bot picture.

</comment><comment><USER51> So basically the point of the article is this: there are no perfect tools. Not sure why this article got so much traction.

It's like complaining that airport security checks your bags when you have gun-shaped objects inside it.

<comment><USER52> More like asking why you are being kicked out of the airport when you have a bob hairstyle.

</comment></comment><comment><USER53> Google's Recaptcha is a much bigger problem then Cloudflare's service for me currently, but it could change at any time.

</comment><comment><USER54> This is the death of alternative browsers it's only a matter of time before Firefox and friends gets blocked from major websites for "security" reasons and you will only be able to browse the internet in a browser that enforces full tracking and ads only. The MPAA and similar organizations is probably working on this already.

</comment><comment><USER34> Is he using a headless browser? Interesting that he won't give specifics..

Edit - Whoops, read too fast.

<comment><AUTHOR> I link the exact browser I use.

It's called qutebrowser, it's powered by QtWebEngine, which is chromium underneath.

Basically Chromium wrapped in python with vim-keybindings.

<comment><USER2> We're currently investigating. Should have more info soon.

</comment></comment></comment><comment><USER55> Cloudflare is the new big brother.

</comment><comment><USER56> The root cause is hammering the site(s) with lots of traffic in a short period of time.

Reloading the tabs looks like an attack.

One solution might be to close tabs when you're done with them. (Althought I've been surprised to find that some people routinely keep many many many tabs open virtually forever)

</comment><comment> core-questions It's okay, don't worry. Cloudflare would never use this incredible power for political purposes...

...oh wait, yes, they have and they will again. We've given them the power to censor and with the power increasingly comes the onus to do so, to satisfy the political whims of an elite that doesn't like anything counter to their narrative.

<comment><USER57> > ...yes, they have and they will again.

I don't doubt this, but do you have more info on what you're referring to on "they have"? I'm a bit out of the loop on that.

<comment><USER58> There's been a few occurrences of them terminating service for the sites promoting extremist views, eg: [https://blog.cloudflare.com/terminating- service-for-8chan/](https://blog.cloudflare.com/terminating-service- for-8chan/)

I don't entirely disagree with it but it's censorship nonetheless.

<comment><USER59> It's not censorship. The Internet is a vast space, someone will host your stuff.

<comment> kube-system Universality is not a defining characteristic of censorship. Most censors have very limited scope.</comment></comment></comment></comment></comment>


Show HN: Build web based SQLite apps and compile to a single HTML file - <AUTHOR> http://appshare.co <comment><AUTHOR> I am building a Visual basic 6 style app builder lets you build an app and then email it to someone as a HTML file. They get a fully working SQL app which they can can comment on. Ideal for small prototypes!

<comment><AUTHOR> Why the downvote by the way?

<comment><AUTHOR> Please downvote more, I deserve it. Oh, and I guess this helped me figure out who has been mailing excrement to me now. I'll leave it in the hands of the police now.</comment></comment></comment>


Twitter CEO Jack Dorsey: I Suck and the Problem Is the Whole Site - <AUTHOR> https://gizmodo.com/twitter-ceo-jack-dorsey-i-suck-and-the-problem-is-the-1832578727 <comment><USER2> I don't get it. I am not a big user of social media, but how is twitter responsible for user's comments? If it tried to regulate them (I can't imagine how it would do that), then critics will be coming about its censorship. And all those user comments about how its the platform's fault for enabling toxic comments- To me that sounds like blaming the assembly language just because computer viruses have been written in it.

<comment><USER3> > how is twitter responsible for user's comments

I don't claim that they necessarily are, but you could argue that the design of their platform leads to users behaving in the way they do behave, i.e. if you only give them the option to "like" something or reply to it, dislikes will be expressed in replies.</comment></comment>


Is Dropbox better at managing memory than Google Drive? - <AUTHOR> http://i.imgur.com/C7hnD.png

<comment><AUTHOR> Could Dropbox really have better engineers than the Google Drive team?

Or could this be one of those examples of specialization - i.e. because the entire company at Dropbox is focused on just this one problem - so they are better at it, whereas the Google Drive team is just a small team within Google.

As a result Dropbox has more resources at their disposal to make a better product?

If that is the case, this could be the quintessential case study on why startups shouldn't fear large incumbents. Not only are large companies bureacratic, but more often than not they will have institutionalized inertia that prevents them from dedicating the resources to take you on - until it's too late.

</comment><comment><USER2> Seems like an issue many seem to have:

A critic that goes a little bit further:

<https://news.ycombinator.com/item?id=4710366>

</comment><comment><USER3> Heh, never stopped to even consider this. A quick look at the activity monitor on my MBP:

Dropbox: 38.5MB

Google Drive: 68.0MB</comment>


Startup environment in India. What we can do to improve it?  - <AUTHOR>

As a hacker, especially if you are from India, what problems and issues you see while starting up in India? How is the environment different from Silicon Valley? Why our society is lacking in entreprenurial spirit? Why there isn't any major prodcut innovations like google, facebook in India? what social and practical problems a startup face in India? Why there isn't a ycombinator like funding system in place?<p>What we can do to improve it? proto.in is one such nice initiative but what else can be done? <comment><USER2> There are few Ycombinator like funding systems in India. Lookup Startup Saturday and <http://www.thestartupcentre.com></comment>


How Pixar Solves Problems from the Inside Out - <AUTHOR> http://techcrunch.com/2015/04/12/how-pixar-solves-problems-from-the-inside-out/ <comment><USER2> Pixar is still battling with lots of legacy cruft. They went through a phase of hiring the best and brightest directly from MIT and the like.

This resulted in an explosion of tools written in odd ways with obscures languages each with their own odd DSL to interact with. (Something that most VFX houses that survived the late 90s/early 00s suffer from.)

Part of the reason that Rhythm and Hues went bankrupt is that they were the last bastion of "we make all our own tools"

The battle Pixar had to rebuild/replace marionette cost millions and took years. It got so bad they were seriously considering Maya instead. (I thought they had actually bitten the bullet and bought a sight license, however it appears that they wrote presto instead.)

So Pixar isn't the chocolate factory of awesome it used to be. The long hours and the rampant wage fixing somewhat tarnishes the image.

<comment><USER3> _The battle Pixar had to rebuild /replace marionette cost millions and took years. It got so bad they were seriously considering Maya instead. (I thought they had actually bitten the bullet and bought a sight license, however it appears that they wrote presto instead.)_

I'm curious about the details of this. What made marionette so bad that they couldn't fix it to do what they needed it to do? From my completely naive perspective, it seems like having custom tools should be a competitive advantage -- you can tune your tools to the needs of your artists.

<comment><USER2> Please bear in mind this is second hand information (I worked at several VFX places, and by the nature of the short term contracts people move around internationally a lot. I also worked at a software vendor (not autodesk, so no direct interest in replacing marionette))

There were/are two big things that are against you if you develop in house animation software(or any software for that matter):

1) The training gap. People are most efficient with the software they are used to. Maya has been the defacto standard in animation for pretty much 7 years (if not more).

2) the R&D cost. VFX is constantly moving. (Possibly much more than normal web software) With the increase in CPU/GPU power you are able to do much more. Take hair for example, In monsters inc, Sulley has something like a million hairs. (monsters U its 5million +) You need to control that hair system some how. There are people that groom digital hairs for a living. Its a constant battle between cheating, simulation and feedback.

The hair system alone could swallow a team of Five for a year, but then you'll be negleting the other systems that need bug fixes, improvements and R&D magic.

Having an outside company, who has the resources to have many teams work on each individual part, along with a UX designer to either make it work more fluidly(or just put annoying transitions in the way.) and most importantly of all, a team of QA, bugfixers and Tech support.

You're right, custom tools give you an edge, Take katana from sony: it allowed an artist to work on an entire city scape (Billions of objects) on a single computer, in 2006 (it was developed for one of the spiderman films) Something no other system could do.

Another example is of course renderman.

But these are only the successful ones. Many custom tools are built, atrophy and die. Sometimes taking the company with them.

But like the rest of IT the march of commoditisation is in VFX as well. Most software can be bought off the shelf (maya, modo, nuke, Premier, renderman, arnold) Its also almost possible to render in the cloud (although its crushingly expensive, and slower.)

</comment></comment></comment><comment><USER4> Turning arbitrary geometry into light sources is now bleeding edge technology?

<comment><USER5> My thought exactly. The open source Blender Cycles had had this for years.</comment></comment>