SQL Injection Galore - <AUTHOR> https://github.com/search?p=3&q=extension:php+mysql_query+%24_GET&ref=searchresults&type=Code <comment> grey-area I find it incredible that there are 86,453 results for this, and 58,123 results for execution of a parameter as a command!

Github should set up a little warning for people when they log in to their account if their repos match any of a set of obvious security anti-patterns, because this would be fertile ground for exploits. They could expand it later to some kind of code-review bot which does automatic code reviews looking for common antipatterns, off-by-one errors, and anything else that is easy to detect automatically. There are quite a few tools like this for analysis of desktop apps, but code for web apps are not checked as much in a systematic way.

Are there any external services which do this already for public github repos?

<comment><USER3> That would be great, but I would hope it could be turned off. I have plenty of code on GitHub that's clearly marked as just something I put up in a few hours for personal use only, where I don't care if there's vulnerabilities or exploits. The code was written in the true spirit of hacking, fast and dirty in order to solve an immediate need.

<comment><USER4> Maybe dirty, hackish code for personal use only shouldn't make it out into the public ;-)

<comment><USER3> I would expect any code marked "quick hack to solve [obscure problem], not for production!" to be pretty clear.

If someone is encountering the same problem, the code is there for them to use. If they happen to use it in production, that's hardly my fault.

<comment><USER5> Technically if the code doesn't have an open source license attached then it is still their copyright and isn't up for you to use even if on Github.

</comment></comment></comment></comment></comment><comment><USER6> For Ruby.. this is probably not as bad, and some of them are probably harmless, but still.

* Apartment.destroy(params[:id])

[https://github.com/search?q=extension%3Arb+path%3A%2Fapp%2Fc...](https://github.com/search?q=extension%3Arb+path%3A%2Fapp%2Fcontrollers%2F+.destroy&type=Code&ref=searchresults)

I've found stuff like this on startups who charges people money - scary.

Some of them require authentication but not authorization In other words, they require login, but not WHO you're logged in as.

<comment><USER7> Your example looks much like AR and AR will sanitize the given parameter at least in this case so that's a non-issue here. Same would be true if you'd call a prepared statement in PHP and hand it a GET parameter. The problem with the given PHP samples is that they do neither: The take the unsafe user- provided parameter and use string concatenation to build a query - <USER2> textbook example of an SQL injection vulnerability.

<comment><USER8> He's citing this as a potential cross-authorization vulnerability, not SQL injection.

The form he's demonstrating is a common misstep in Rails. Instead of writing something like:

      current_user.apartments.destroy(params[:id])

The programmer wrote:

      Apartment.destroy(params[:id])

Meaning that the apartment lookup is not being done within the context of the current user, it's global. This means an attacker can delete other users' apartments with crafted URLs.

When I'm testing Rails applications, I always grep the source for something like:

      /[A-Z][A-Za-z0-9_]\.(find|destroy|...)/

To find vulnerabilities of exactly this kind.

</comment></comment></comment><comment><USER9> Next time someone asks you "How do I find open source projects to contribute to?" this is a good place to start.

<comment><USER10> This is brilliant, and doesn't necessarily have to be exploits. You could just search for any anti-pattern and fix it.

I'm a little sad I hadn't thought to do this already...

</comment></comment><comment><USER11> Bear with me on this one -

All the code is already public on Github, so everyone can see these gaping security holes, right?

What if some honest, global actor could mass-commit a fix for all these repos in one fell swoop? For example, replace all references to:

        $_GET

with:

        some_safe_sanitizer($_GET)

All affected repos win a free fix, and the world becomes a better place due to having less security bugs. Essentially, what would the next abstraction layer, over all Github repository objects, look like? Ponder that.

<comment><USER12> To do it properly you'd want to use prepared statements[1] which requires a non-trivial, though not particularly complicated, syntax change. So your global actor would have to parse the PHP in a rather more intelligent way that just a string replace.

You could just use mysql_real_escape_string [2] but that's less secure than prepared statements, and may break some things (eg if the code is relying on certain things not being escaped, etc). Also that extension is deprecated in favour of prepared statements.

Also, some of the dodgy code is using $_GET vars for things other than values, like field and table names (!!!!) which would need a more significant refactoring in order to fix.

However it would be a great little problem to work on, and you could probably write a bot to fix 80% of the code pretty easily.

The other issue is how many people will understand and accept the pull requests...

[1] [http://php.net/manual/en/pdo.prepared- statements.php](http://php.net/manual/en/pdo.prepared-statements.php)

[2] [http://php.net/manual/en/function.mysql-real-escape- string.p...](http://php.net/manual/en/function.mysql-real-escape-string.php)

<comment><USER13> I know the PHP/PDO way to do it, is prepared statements.

I'm not able to see why the parent's suggestion to just escape the strings is not a valid solution from a security perspective.

<comment><USER14> because you also have integer based SQL injection. Escaping strings isn't a complete fix.

<comment><USER12> Yep. In fact the typical SQL injection example is " 0 OR 1=1 ".

</comment></comment></comment></comment></comment><comment><USER15> Instead of policing every line of code you can also mitigate SQL injection by restricting the access of the database handle the user-facing queries are using

* All read-only queries use a read-only (SELECT only) database account. Injecting; DROP TABLES or INSERT, UPDATE, etc (DML commands) just error out.

* User accounts and logins are stored in a different database, so only the code responsible for login and registration can access those tables/database.

* All queries should use prepared statements which effectively treats all injected text as just text rather than database commands.

<comment> qu4z-2 So instead of policing every line of code we should just use prepared statements everywhere?

</comment></comment><comment><USER16> I always preferred the remote code execution search myself personally...

[https://github.com/search?q=extension%3Aphp+exec+%24_GET&typ...](https://github.com/search?q=extension%3Aphp+exec+%24_GET&type=Code&ref=searchresults)

<comment><USER17> Holy shit! Look at this! This is hilarious! [https://github.com/bratliff/engconf/blob/0b8f003edc5f5d25fe1...](https://github.com/bratliff/engconf/blob/0b8f003edc5f5d25fe1feecd9f39d107958ddd11/staging/wp- content/plugins/ezpz-one-click-backup/functions/ezpz-archive-cmd.php)

<comment><USER18> Oh. And it's for wordpress. Isn't that just fucking wonderful. I would guess looking at the age of the account and the complete lack of documentation that it's a personal project he never really intended to get much scrutiny. I'm sure if someone looked at my github they could find some bad code too. Not that bad though.

Edit - made an issue.

</comment></comment></comment><comment><USER19> I have commit hooks on our repository that look for things like this and prevent the user committing it!

We've got 30 odd rules so far that have saved us from all sorts of pain from exception swallowing to adding test ignores as well.

<comment><USER20> Could you share some of these?

<comment><USER19> Not really at the moment. I've been slowly refactoring it into a publishable chunk of code but progress is slow. I will publish it on github when it is done.

</comment></comment></comment><comment><USER21> To be clear, this list is not all exploitable. It only shows php files that use both GET variables and the mysql_query function. Not all of these variable are being fed unescaped into a query, nor are they necessarily used in a query at all.

<comment><USER22> Agreed. I find posts like these disingenuous. What do learn from this list? I think we all know that SQL injection is a serious problem and a very common mistake already. What this list seems to do is just serve as a high horse we can all get on and proceed to shame and look down our nose at people who:

\- Use raw $_GET variables in their code \- Use $_GET in MySQL queries \- Use mysql_real_escape_string instead of prepared statements or otherwise properly sanitizing input \- Use PHP in general

We already know we should all be using prepared statements or combining data sanitizing methods with an ORM and to not trust raw user input and that its cool to hate on PHP. So I ask again, what are we learning here? That there's a ton of programmers who are doing sloppy incompetent work? Not news.

Furthermore, I think context is important. I'm not ashamed at all to say out loud that I've done these sorts of things knowingly and purposefully despite knowing it's not safe or correct. Why? Maybe I was creating simple examples to teach others the basics of getting user input and working with it in a database. Of course you'd warn people not to do things like that in a production environment but you show it that way anyway to get across some basic ideas without throwing too much at people. Or what if I were writing a simple series or scripts or small app that would only be used by myself or a select group of people? What if that application needed to be done in a hurry and was only for internal use and not accessible to the outside world? Lots of things can always go wrong but at a certain point you have to be able to trust someone and its not always better to be right than happy. I'm sure if anyone wants to be pedantic they can poke holes in my examples but the point is that these sorts of sins aren't always so awful depending on the context. I don't see any purpose in this other than to either look for open source applications to exploit in the wild or to just pick on a really easy target to make us all feel superior.

<comment><USER23> I totally get what you're saying, but this right here is kind of the problem:

> Maybe I was creating simple examples to teach others the basics of getting > user input and working with it in a database.

I'm one of the countless people who learned PHP off of examples that do just that, for clarity, and it was years before I learned that it was not meant to be a real-world example. Sites that offer such examples (I'm looking at you, w3schools) are probably responsible for 90% of all the bad code that shows up on lists like this, because the exchange amounts to:

Student: "How do I do XYZ?"

Teacher: "It's easy! Just do 123."

Student: "Thanks!" <leaves, closes door>

Teacher (to empty room): "Haha, just kidding. You should really forget that entirely and do 456 instead."

I don't think it's valuable to learn about mysql_query("delete from `tbl` where id = {$_GET['id']}") at all in the first place, if you just have to unlearn it and start doing it the right way later. It doesn't actually simplify anything.

</comment></comment></comment><comment><USER24> Seems like it would be possible to create a "linter" for PHP and Ruby that would detect at least basic SQL injection vulnerabilities?

</comment><comment><USER25> It's been posted. :) [https://news.ycombinator.com/item?id=5805025](https://news.ycombinator.com/item?id=5805025)

</comment><comment><USER26> Some 40.000 results with the eval() function: [https://github.com/search?q=extension%3Aphp+eval+%24_GET&typ...](https://github.com/search?q=extension%3Aphp+eval+%24_GET&type=Code&ref=searchresults)

</comment><comment><USER27> Yeah, the same for Classic ASP: [https://github.com/search?q=extension%3Aasp+execute+request&...](https://github.com/search?q=extension%3Aasp+execute+request&type=Code&ref=searchresults)

</comment><comment><USER28> GitHub Dorking: The successor to Google Dorking.

</comment><comment><USER29> In other news: it's 2013 and people are still not using query builders.

</comment><comment><USER30> We actually clean the GET and POST arrays in an include when the page gets requested, if you need anything unescaped you specifically have to request it from a different array.

The code looks something like this:

        $_GET = array_map ( 'strip_tags', $_GET );
        $_GET = array_map ( 'mysql_real_escape_string', $_GET );

Although there is a bit more to it than just this.

<comment><USER31> This is exactly what NOT to do.

The mysql_real_escape_string part is what PHP did with its "magic_quotes" feature. This feature has been removed for good reasons :

\- All your variables are cluttered with \' everywhere, so you have to unescape them before doing anything other than using the variable in a SQL query. And re-escape them after that. You will forget to do it.

\- It doesn't protect you if you expect the variable to be numeric, and use it in a query without enclosing it in quotes:

        // do not do this
        mysql_query("SELECT do_not_do_this WHERE x = $var");
        // $var could be `0 OR 1 = 1`, even after escaping

\- Also, you never know if a variable is actually escaped or not. e.g. in the following code, is "$var" escaped ?

        $var = get_data_from_db_or_other_source();
        // do not do this
        mysql_query("SELECT do_not_do_this WHERE x = '$var'");

\- You've "protected" yourself from sql injection and html injection (very wrongly, btw). What about shell injection, css injection, javascript injection, protocol injection ? Are you going to also apply escapeshellarg() on all $_GET variables ?

\---

Also, you shouldn't be using strip_tags at all:

\- It doesn't strips quote characters, so you would be vulnerable to html parameter injection, if you used a variable "sanitized" like this in a html parameter.

\- It alters the data is some non-reversible way. What if you genuinely want to display (not render or "execute") some html code in a blog post on your web site ?

You should be using htmlspecialchars() instead.

\---

What to do:

\- escape, do not "filter" or "sanitize"

\- escape data just in time, not ahead of time (e.g. escape your variable just before using it in a mysql query, or just before outputing it in a html document)

\- prefer prepared statements

\- use the right escape function depending for the context in which the variable is used: mysql_real_escape_string for mysql query, htmlspecialchars for html, escapeshellarg for command line arguments, etc.

<comment><USER32> > You should be using htmlspecialchars() instead.

Without trying to be too much of an arrogant arsehole, surely they should be using a proper language. That is the real core cause of the problem here isn't it?

<comment><USER33> You can be an idiot in any language, including PHP. Blaming the tool is exactly what gets you in to this mess in the first place.

The fault is with the programmer. No one else.

<comment><USER32> It's true that you can be an idiot in any language, but I have written production code in every 'high level' language of this type and only PHP seems to suffer from this problem. Take a random mail form, even has its own domain: [http://jemsmailform.com/](http://jemsmailform.com/)

Finding the obvious problems I leave as an exercise.

<comment><USER12> I kindly direct you to search for "formmail.pl".

</comment></comment></comment></comment></comment></comment><comment><USER34> This is a duplicate.

[https://news.ycombinator.com/item?id=5805025](https://news.ycombinator.com/item?id=5805025)

</comment><comment><USER35> What I find equally worrying and sad is the fact that mysql_* extension is so widely used although it has been deprecated 3 years ago.

</comment><comment><USER36> What's more concerning is the amount of people choosing not to use parameterized queries with mysqli: [https://github.com/search?q=extension%3Aphp+mysqli_query+%24...](https://github.com/search?q=extension%3Aphp+mysqli_query+%24_GET&type=Code&ref=searchresults)

<comment><USER4> This could be in part because the procedural interface of mysqli is deliberately designed to be vyer similar (if not identical) to the mysql one. So maybe they just continued writing their code that way but replaced mysql by mysqli because someone told them mysqli was better and supported (which it is, but probably for other reasons).

I wonder whether a similar search for the mysqli OO interface yields the same amount of unsanitised queries. (Assumption: People using the OO interface looked through the documentation more closely and maybe understand the ways in how mysqli is better than mysql. But that's just an unfounded assumption.)

</comment></comment><comment><USER37> Wow. This has just turned into a great example for one of my classes. I don't think there's a better way (other than hands-on examples) to show the severity and widespread of such security holes.

</comment><comment><USER38> my 2 cents: 1) At the first place, yes, it does look like these are sureshot SQL injections. 2) However, we are looking through just a tiny window. There could be filter chains executed long before this code that would sanitize the request parameters before they are consumed anywhere else in the codebase.

<comment><USER39> It is a small window, however, wouldn't it be better to filter the values into an easily identifiable 'clean' variable? The code is still using $_GET, and while it may have been filtered above me, I have no indication of that - versus - $foo->cleaned('var') - where I can reasonably assume it is clean.

<comment><USER38> True, I couldnt agree more

</comment></comment></comment><comment><USER40> Oh, God, why.

</comment><comment><USER41> poor, poor Bobby Tables...</comment>


Ask HN: Would a server written in a native language still need job schedulers? - <AUTHOR> I have a suspicion that things like Celery or RabbitMQ or whatever else people are using with Ruby/Python based servers are only needed because these languages are slow and don't really support threads. Even redis would probably be not needed.<p>Am I missing something important? <comment><USER2> Distribution. Redis, rabbitmq, and celary are all used to share state or messages across many servers. Unless you can run the entirety of an app like facebook on a single machine then you will, at some point, have to run several instances of the same application.

Micro services also utilize these databases and frameworks.

<comment><AUTHOR> But most people are not Facebook (and will never be).

If you have to have several hardware servers, I don't see why the application server itself cannot contain basic boilerplate code to coordinate communication between the different instances of itself that are running on different machines.

<comment> UK-AL Because you want your web servers to handle requests fast, and serve as many requests as possible.

You want offload your non-time dependent requests to other machines to handle without slowing down your request processing on the web servers.

Also most queues provide a mechanism distributing load and autoscaling.

</comment></comment></comment><comment> le-mark > Am I missing something important?

Asynchonous tasks like sending emails and processing credit card payments. Example, user signups, and your flow is to send a welcome email. You don't want the signup response to wait on sending the email for example. So you drop it on a queue to be processed "later".

<comment><AUTHOR> In python, yes. But if I was in Go, I'd just fire (and forget) a goroutine to do that.

<comment> le-mark That's a good counter example, but doesn't address the other advantages of third party solutions like message durability, atomicity, and guaranteed completion. If the email only ever exists in the memory of the executing process, it can be easily lost during server restart for example.

</comment></comment></comment><comment><USER3> RabbitMQ is written in Erlang which definitely supports threads (called processes) and are actually built into the BEAM. I think it is a strong candidate for what Erlang brings to the table and I think while you could do it in a native language for sure, it would take more time and most likely be more error prone (unless there was immutability in the language as well).</comment>


How Much a Dementia Patient Needs to Know - <AUTHOR> https://www.newyorker.com/magazine/2019/03/04/how-much-a-dementia-patient-needs-to-know <comment><USER2> Damn. I can barely read TFA. I mean, we'll all eventually face some sort of dementia. And death, of course. But when you're 70, it's much more immediate.

There were times in my life when I didn't do much except drift, play with drugs, seek sex, put my life at risk, etc, etc. All the serious stuff could wait. And WTF, there'd be global nuclear war any day now. So why bother?

Now I'm retired. There's no need to work, so all I do is putter. And my likely future is so short that there's no point in long-term planning. Also, and it's quite amusing, I don't need drugs to space out. I need them to stay focused. And to keep various physiological stuff from killing me.

So maybe I'm a lot like that patient in TFA. But there's a key difference: I've never been diagnosed and institutionalized. And dog willing, I'll die before I am.

<comment><USER3> > And my likely future is so short that there's no point in long-term > planning.

I've enjoyed your hn posts so thank you for that. I hope you can make the most of the time you have left.

<comment><USER2> Hey :)

By "short", I mean (dog willing) 10-20 years. So there plenty of time for y'all to get very tired of me.

I have noticed, over the last decade or so, that I'm becoming increasingly adamant about doing whatever it is I'm committed to in the moment. And not spending time doing stuff that doesn't interest me, to make others happy. I've always been somewhat like that. But now I'm much more upfront about it.

<comment><USER4> This reminds me of the famous Dylan quote that Steve Jobs used to describe his time left with Bill Gates: "You and I have memories longer than the road that stretches out ahead."

<comment><USER5> Beatles, "Two of Us", _Let It Be_

</comment></comment></comment></comment></comment><comment><USER6> Related: entire self-contained 'villages' for dementia patients: [https://gizmodo.com/inside-an-amazing-village-designed- just-...](https://gizmodo.com/inside-an-amazing-village-designed-just-for- people-with-1526062373)

</comment><comment><USER7> Is it surprising that people are happier and better able to deal with their illness when they believe they are doing meaningful work and are useful to the people that surround them?

<comment><USER8> > Is it surprising that people are happier and better able to deal with their > illness when they believe they are doing meaningful work and are useful to > the people that surround them?

This is one of the many reasons that thinking that "poor people" are just lazy. To feel useful is a very basic human need. To the extend that even very rich people that does not need to work still does it.

> The sisters who ran the home, though perceiving his confusion and delusion, > respected and even reinforced the identity of this somewhat demented > resident, who, they felt, might fall apart if it were taken away.

Maybe a definition of sanity is the ability to deal with the lack of purpose. Most people is going to feel stressed and try to find a way to be useful again. Only when you are sick - whenever is dementia or depression - you stop being able to find your place in the world by yourself.

<comment><USER2> For dementia, "deal with their illness" is the obvious way to frame it. But, on the other hand, many with physical limitations don't like being labeled as "disabled".

Given how our minds work, self-reinforcement is a major factor. Negative commentary (and self-commentary) is hugely disempowering. I suspect that, in many cases, dementia is iatrogenic. In a way, it's like bullying someone in order to keep them irrational, defensive, and self-defeating.

And yes, "lack of purpose" is a huge issue. Or rather, lack of a future worth living into. That's also a huge part of dementia.

</comment></comment></comment><comment><USER9> Dementia patients will forget that many of their loved ones are dead, and will ask to visit them, or why they don't come to visit. Reminding them that they're dead is a terrible thing, as I found out the hard way. Just say they're out of town for the time being. They've lost their ability to cope with reality, it's best to just go with the flow instead of upsetting them.

<comment><USER2> I don't think that lying to people is a good strategy.

I mean, if I'd forgotten that my whatever was dead, I'd like to be reminded. Not humored. Because that's so dehumanizing.

And if I'm so far gone that I can't handle it, I'll probably forget about it all, fairly quickly.

Or if you can't deal with the upset, just distract them.

<comment><USER10> You say you'd forget, but that's the point. You forget you've asked, you forget the person is dead, you ask about them, you're told they're dead, you're shocked and you start grieving for them, and now you're in a loop of continuously asking about the person, and being told they're dead, and grief.

Keeping someone trapped in this grief-loop is cruel. It's far better to just lie.

<comment><USER11> I had a grandfather dementia. Whenever we had to leave from visiting him, he would remark that we "just got here!". His short term memory was less than 5 minutes, so he would start the "but you just got here" bit by the time we had finished saying goodbye and were headed toward the car. This loop would happen several times with sincere emotion in his face, until we would just say something like, "we'll be right back" and just leave.

<comment><USER2> Was he perhaps in a nursing home? If so, maybe he was just terrified of being left alone.

Many years ago, I turned a girlfriend on to LSD. She loved it, and wanted more the next day. I told her that she ought to wait a few days, for the tolerance to fade. But she was adamant.

So we did maybe 2-3 doses, and she was still unsatisfied with the peak. And -- dumbass that I was -- I suggested that we smoke some marijuana.

That was a serious mistake. Because our short-term memory dropped to 30 seconds or so. I was cool with that, staring at the patterns in everything. But she was not. So I spent perhaps 3-4 hours reminding her that she was just wasted on acid and dope, and that she'd be fine tomorrow.

And she was. Except that she was no longer my girlfriend.

But whatever. Maybe you could have just reminded your grandfather that his short-term memory was hosed. And then assured him that you'd be back next week.

<comment><USER12> Part of the dementia is that you lose the metacognition to understand that your short-term memory is hosed. We don't just become forgetful. We lose cognitive capacity. We're not ourselves minus the ability to remember things. We slowly become a different person.

<comment><USER2> Maybe so. I guess that I'll find out.

<comment><USER12> My point is that you will not.

<comment><USER2> Well, I already know that my short-term memory is somewhat hosed. So for stuff that matters to me, I leave myself notes. And for stuff that doesn't matter to me, I just forget. And that's actually better, in a way, because I'm more focused. And less distracted by guilt or whatever.

</comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER13> This is another good (and very long) article from The New Yorker on the topic, from last October: [https://www.newyorker.com/magazine/2018/10/08/the- comforting...](https://www.newyorker.com/magazine/2018/10/08/the-comforting- fictions-of-dementia-care)

</comment><comment><USER14> Do not be too quick to believe diagnosis of dementia. Doctors will diagnose it while patients are on medication like opiods. Then incompetence can be declared and the looting begun.

There is evil afoot you would not believe.

Dont argue. I am merely informing you, not convincing you.

</comment><comment><USER15> Read all the way to the end thinking that it was remarkably well written, like an Oliver Sacks essay. And then I read the byline... Sacks was a treasure. What a gifted man.

</comment><comment> black-tea It worries me to think that people would lie to me about my condition and I might not actually understand what's going on. I would like to die before this stage, but if somehow I reached this stage first they'd keep me alive and I'd no longer be able to kill myself.

</comment><comment><USER16> Sometimes he calls out, "I want to die. . . . Let me die."

I personally will try to end it.

The stigma and no real options makes it more difficult than it needs to be.

Having control over your life should not stop when it is about your dead.

</comment><comment><USER17> Humans are complex, and being humane is too. But it's worth a try!</comment>


Elon Musk's Twitter Account: 'Am Considering Taking Tesla Private at $420' - <AUTHOR> https://www.wsj.com/articles/elon-musks-twitter-account-am-considering-taking-tesla-private-at-420-1533661152 <comment><USER2> How is this legal to just say anything to pump up the stock price?

<comment><USER3> Sure, so long as he isn't misleading shareholders - and that generally requires fraudulent filings. I'd say that he is much safer pumping the stock than he was, almost exactly a year ago, when he very publicly stated that he thought the stock was overvalued.

</comment></comment><comment><USER4> Can anyone explain to me why having a predetermined higher price would be a trigger to make the company private? Surely the lower the better as you are essentially getting the same asset, "Tesla", for the capital used to make it private.

<comment><USER5> To buy an entire company, you always need to pay a premium over the current market cap. The market price is lower than any existing shareholder is willing to sell for because if they were willing to sell for less than that price, they would have already sold it. For some of the shareholders, the lowest price they would be willing to sell for would be much higher than the market price.

</comment></comment><comment><USER6> is this a 420 joke?

</comment><comment><USER7> Previous discussion: [https://news.ycombinator.com/item?id=17709068](https://news.ycombinator.com/item?id=17709068)

</comment><comment><USER8> Anyone has a link to a non-paywall version?

<comment><USER9> Here you go: [http://archive.is/kY2pl](http://archive.is/kY2pl)</comment></comment>


The Web Design Business is Dead - <AUTHOR> http://blog.emastudios.com/

<comment><USER2> Web Design Business is Dead

Right, the web design business died right along with the webmaster business.Seems this article is written by someone still stuck in ten years ago. Sure there is always more competition and that puts pressure on prices, but not as bad as mentioned in this article.

Going niche seems to be a good way to go also.

Outsourcing gets lower prices for only so long, then prices start edging back up as those markets mature (much the same as manufacturing in China.) These days you can get low end U.S.developers for the same rates as what dev shops in third world countries are charging.

Also, a bit of trivia for you. Third world countries aren't cheaper to live in. Standards and expectations are just lower. Your ~$5 / hour developer is probably living in a hut with three generations of family or living right on the poverty line. As your life gets more westernized in a third world country, your living expenses start looking westernized as well. In large metro hubs such as Bangkok or Shanghai, your cost of living can skyrocket as you start moving away from living like the locals.

You just need to hit the right market. A web property can be very little or very big. It can be a 5 minute Wordpress installation or it can be a billion+ dollar thing with thousands of employees and multiple data centers. To get paid, you need to be working on things which will create enough value to (or at least have the potential to) return that investment. Few people will see that return on a $10 web site.

</comment><comment><USER3> I really don't like blogs like this. I'm not staying around for a part two.</comment>


History Quotes for iOS - s-stude http://historyquotes.sstude.com

<comment> s-stude What do you think about this app?</comment>


Ask HN: Where to go for short term expertise? - <AUTHOR> generally while learning something new i catch hold of my colleagues who have prior experience with what i am trying to learn. I ask lot of stupid questions initially but get upto speed relatively quickly. Unfortunately this technique does not work if i don't find the expert i get blocked by my stupid questions and endless search for answers in stackoverflow/irc/slack without making much progress. Any idea/suggestions/pointers on where to go to find expertise?<p>PS: I don't mind paying for the expertise either. <comment><USER2> Are you talking languages, frameworks, domain knowledge, etc...?

For many languages or frameworks, for me, a weekend with a Udemy/Pluralsight course is a good jumpstart and gets me to about 60% of where I need to be (most of the rest coming from writing production code of course)

</comment><comment><USER3> Many of the very brightest people in my field are on Twitter, and most are usually happy to engage briefly.

</comment><comment><USER4> Have you tried Clarity.fm?</comment>


Show HN: anonymous, ephemeral picture-sharing site built at Rackspace's HackDay - <AUTHOR> http://pictr.io

<comment><USER2> I think this is a cool idea. I'm curious how you will sort the photos in the grid once there are lots of submissions. The location of a photo will eventually be a pretty important factor in determining its life span, as it will affect the number of views and thus votes that it gets.

<comment><AUTHOR> Thanks! Right now, the photos are sorted in reverse chronological order, so older ones drop off (the index page only shows the 40 most recent). Of course, if "younger" ones expire, then its possible that older ones would show up again.

</comment></comment><comment><USER3> Shock of all shocks, the first thing I see when opening a link to an anonymous picture sharing site is two severed penises with a knife cutting through them.

</comment><comment><USER4> Warning: I got a very NSFW image right away.

<comment><AUTHOR> _sigh_ bunch of sick folks out there. If you hit Hate enough times, eventually the image goes away.

</comment></comment><comment><USER5> I'm going to enjoy it now, before 4chan gets a hold of it... :D

</comment><comment><USER6> Reminds me of the old mobog.com

</comment><comment><USER7> Nice!

<comment><AUTHOR> Thank you! I've still got a to-do list, but I thought it was stable enough to let HN play with.

</comment></comment><comment><USER8> you know where this will end up right? Anytime you offer anonymous photo sharing it will quickly turn into illegal porn distribution.

<comment><AUTHOR> One reason for the "Hate" button; it cuts the expiration time remaining in half.

<comment><USER9> People will simply link to the picture and tell their viewers to like it to counter act that effect.

You should have a 'report' button or better yet, ask people if the picture is NSFW and segregate.</comment></comment></comment>


Ben Klemens about his '21st Century C' book - <AUTHOR> http://modelingwithdata.org/arch/00000137.htm <comment><USER2> Great to see a book about C that includes insights and best practices the community at large has found since the more traditional textbooks were published. I may pick up the ebook version for a rainy weekend.

The title makes me cringe though. It inevitably evokes a picture of a poor sod writing a book on "20th century warfare" in 1912.

<comment><USER3> > It inevitably evokes a picture of a poor sod writing a book on "20th century > warfare" in 1912.

No kidding. The back of the book has a prominent blurb about Autotools. That's about as retrogressive as it gets.

</comment></comment><comment><AUTHOR> Submitted for the mock-up cover alone.

Previous discussion here: <http://news.ycombinator.com/item?id=4794171>

His other book, Modeling with data, is also freely available as a pdf: <http://modelingwithdata.org/about_the_book.html>

</comment><comment><USER4> Of course they didn't use your mock up.

Everyone knows Javascript is the true cookie monster.</comment>


The Typography of 2001: A Space Odyssey - <AUTHOR> http://typesetinthefuture.com/2001-a-space-odyssey/

<comment><USER2> I greatly admire Kubrick's use of typography in his films, and share his love for Futura, the only typeface on the moon. This is an excellent article, thank you for sharing.

</comment><comment><USER3> I really lived this. True font nerdism. I hope he does Alien next.</comment>


Daum Kakao Will Acquire the Path and Path Talk Apps - <AUTHOR> https://medium.com/the-road/a-new-chapter-for-path-c521e039f261 <comment><USER2> The company has not been acquired, just the Path and Path Talk apps. I actually do not understand that part - what exactly does the company hope to do with Kong? How is the company supporting 40+ headcount now?

<comment><USER3> Well they just got a cash injection from selling Path & Path Talk so I can imagine that should help support 40+ headcount for a little while. Along with the $25m they raised a year ago.

</comment></comment><comment><USER4> Anyone know what Daum Kakao does?

<comment><USER5> I'm Korean so let me explain about the company. Daum KaKao is combined company of Daum communications & KaKao. Daum Communications is an internet company, mainly focused on internet portal service like Yahoo!. (It is second largest portal in Korea, the first is Naver) KaKao made a KaKaoTalk, which is dominant messaging app in South Korea. Naver, which is the number one internet company in Korea has both of internet portal and messaging app (LINE, which is dominant messaging app in Japan and Taiwan) so Daum and KaKao are merged in 2014. Daum KaKao now focusing on mobile service since it has dominant messaging app in Korea. The reason why they acquired Path is they want to enter Southeast Asia market, which Naver and Tencent WeChat already have largest portion. (Daum KaKao said that they acquired Path because of Indonesian market. Path has many users in Indonesia)

<comment><USER6> LINE is also the main app in Thailand.

How come KaKaoTalk is dominant in Korea when Naver (LINE) is the bigger company? If you know.

<comment><USER5> Yes, LINE already has many users in Spain and other Southeast Asia countries. KakaoTalk is launched at 2010, before the smartphone market is matured. At the first time KaKaoTalk was made, Samsung and LG (both of them are Korean tech giant) dramatically produce many Android device, but there's no wonderful messaging app. (WhatsApp is not an free model, and other messaging app's quality it not that good) After KaKaotalk have gained lots of popularity, Naver made two messaging app named NaverTalk and LINE. NaverTalk based on Korean market and they failed since KakaoTalk already occupy all the smartphone. But LINE is based on Japan and they succeed, so Naver threw out NaverTalk and focused on LINE. At this time, Daum (before merged with KaKao) made messaging app named MyPeople. They have many users in Korea, but didn't make a profit because of KaKaoTalk. And MyPeople also removed from the market after Daum merged with Kakao.

<comment><USER6> I see, thanks.

</comment></comment></comment></comment></comment><comment><USER7> S Korea had some surprising early social network services before myspace ( est 2003) or facebook (2004). Cyworld (est 1999) was very popular social network service until it stagnated to the point where it now has about 40 or so employees only. Afaik, pretty much anyone with a computer in S Korea had an account at one point. Btw, I'm not suggesting myspace or facebook were copycats at all.

I'm sure there's some other social network service that was launched before all of the above but just never got lucky enough to grow.

</comment><comment><USER8> So the board/investors approved this and since it does nothing for them Path, Inc. has to have a better plan going forward. Their investors have been on a roller coaster ride for a while. I wonder if they recouped what they paid for TalkTo in the deal?

</comment><comment><USER9> Path also made the same post on their official blog: [http://blog.path.com/post/120147299377/a-new-chapter-for- pat...](http://blog.path.com/post/120147299377/a-new-chapter-for-path)

</comment><comment><USER10> From this acquisition, I just hope that Path won't turn into Kakao/LINE-like application, where they offer useless stickers, and try to look 'cute'.

<comment><USER11> I hope I don't ruin the joke by asking, is this a joke?

</comment></comment><comment><USER12> It's good to know people still use Path. It sounded like a good app before mail/call spammed the shit out of almost everyone I knew.

</comment><comment><USER13> Path's failure is a fitting reminder of the likely outcome of making your key metrics friendships and moments rather than revenue. No doubt this is just one of many overfunded social apps that will fall into the abyss this year.

<comment><USER14> This is about as empty as criticism could get. If a company is solely focus on revenue then it's "short sighted and make bad product". Otherwise they're "over funded without business plan". You can't win anyway huh?

I have no idea on why any of those social/ mobile apps is useful and I have never used Path either. But please keep the no substance criticism to a minimum please.

</comment></comment><comment><USER15> The title needs to be changed to be more clear, Path and Path talk the apps were acquired, the company is going to produce other apps and support an app they already have in the market called "Kong".

<comment><USER16> Ok, we changed the title.

<comment><USER15> Thanks!

</comment></comment></comment><comment><USER17> Signals the official end of web 2.0 to me. A whimper instead of a bang.

Path is so web 2.0 and the worst look to have this year is to be old when we're at the beginning of a third wave full of youngsters that wouldn't be caught dead trying to update their path timeline.

Path Talk would have been an expensive land war that required a big sales army to win over one small shop at a time.

So if Path is to Facebook then Kong is to Snapchat.

If Marky Mark can't buy Snapchat then buying a second-run owned by a former insider ain't too bad either.

That's the end game.

Or, just rely on that Martha Stewart of Silicon Valley money to finally roll in.</comment>


The Top 1 million URLs in the world [warning: 44MB text file] - <AUTHOR> https://twitter.com/mikko/status/348029544952897536 <comment><USER2> From what I understand the list is part of the ChromeBot Tool, a sub-project of Chromium.

       ChromeBot is a distributed crash detection system.

       Chrome is run on a list of URLs to check for crashes.  A
       pool of machines is used to distribute the workload,
       each machine might potentially launch several instances
       of Chrome. Crashes detected are symbolicated and saved
       in database.

[http://src.chromium.org/svn/trunk/tools/chromebot/README.txt](http://src.chromium.org/svn/trunk/tools/chromebot/README.txt)

</comment><comment><USER3> Hard for me to believe Orkut is so high on the list.

<comment><USER2> The tweet said only "The Top 1 million URLs in the world", not that the list is ordered in any particular way. I doubt the list is sorted.

For example, the first URL with a German domain (.de) -and if we ignore google - is

[http://suchen.mobile.de/fahrzeuge/showDetails.html](http://suchen.mobile.de/fahrzeuge/showDetails.html)

Never heard of that one, spiegel.de and amazon.de should be much more popular. The reason that google in the first entries might be that about 2.3% of all URLs in the list are google or facebook domains.</comment></comment>


Prove: Phone verification for developers - <AUTHOR> https://getprove.com/ <comment><USER2> This is one of the biggest headaches I have as a developer of two mobile apps that require number verification. But the headache isn't because the twilio/nexmo/clickatell/etc APIs are too complex, or because I don't want to deal with adding a single verification code column to a user record in the DB schema, but because the delivery success rates for the SMS gateways I've been using are quite bad.

Most of my time is spent trying to figure out which mobile networks which SMS gateways will deliver best to, and then directing the correct verification traffic through those gateways accordingly. Which is a nightmare, in part because the successful delivery rates for different areas and networks constantly changes.

If this is the problem that Prove is solving, I think emphasizing that (or at least mentioning it somewhere) on the website is important. I would be an eager customer.

<comment><USER3> Why don't you just use Twilio or something? It doesn't deliver to all mobile phones on US carriers?

<comment><USER4> we're powered by Twilio right now

</comment></comment></comment><comment><USER5> I think you can charge a lot more than 5c for this service. I think developers tend to think about margins as it relates to the service that the app is built on (this case twilio). Even though they charge 1c per text, you need to base your pricing on what a verified phone number is worth to someone using the service. If a verified number is worth 10$, you can probably charge more like 20-30% of that (maybe more).

I'm just regurgitating: [http://www.kalzumeus.com/2011/12/19/productizing- twilio-appl...](http://www.kalzumeus.com/2011/12/19/productizing-twilio- applications/)

<comment><USER2> But the target customers are developers. If this is simply a productized Twilio API, then it's not a huge time savings for a developer. If you need to verify users, it means your app is structured such that there's already a back end, and you already need to store a user record. Generating a random number, putting it in the user record, and calling a Twilio API isn't really a huge drag.

<comment><USER6> "Developers don't pay for stuff!"

(they do)

<comment><USER7> But do they pay 5x for a relatively thin layer on top of Twilio (or similar service)?

</comment></comment></comment></comment><comment><USER8> I built something thing like this using Twillio for my Caller ID test tool. Visiting the site creates a unique pin number and you have to call in and enter it.

<http://www.calleridtest.com>

Twillio makes the development of things like this a breeze.

</comment><comment><USER9> This is a bit off topic, but I don't own a cellphone and the verify via SMS trend is starting to worry me. It would be better if it had an option where it called and used text to speech for the autogenerated pin, but I probably would not give my phone number to the vast majority of sites anyway.

<comment><USER10> You might want to look into getting a prepaid phone of some kind, even if it's not a smart phone. Having a portable emergency communication device seems like a good idea even if you're opposed (for whatever reason) to cellphone use in general, and a prepaid phone won't give you monthly bills or contracts to worry about.

If that's no good, then how about Google Voice? In addition to its other useful phone-related features, it allows sending and receiving of text messages.

<comment><USER9> My wife and I used to have tracfones. I just went and pulled mine out of the box here. It only says motorola on it, no model number or anything other than that. I really liked that phone, it was simple, great battery life, and got reception where others did not. What I did not like is that I paid more than $200 for them and about a year later tracphone said they would no longer work on the phone networks here. What a colossal waste of money that was. I'll keep spending my money on tools in case of emergencies. My wife does have an iphone with a contract now though.

Maybe I should do the google voice thing though, good suggestion, thanks.

</comment></comment></comment><comment><USER11> Doesn't Duo Security do this really well already?

<https://www.duosecurity.com/docs/duoweb>

Once I can load the webpage will be interested to see if there are any differentiating features that make it easier to get started as a developer.

<comment><USER2> Duo is for two factor authentication, where my impression is that this is for signup verification.

Consider mobile apps like WhatsApp, which use your existing mobile number as your identifier. This makes a lot of sense for a bunch of reasons, but it requires the app to somehow verify that the number you enter is actually your number. This is commonly done by having the service send a verification code in an SMS, which you then enter back into the app.

<comment><USER12> Duo's "Verify API" does just that:

<https://www.duosecurity.com/docs/duoverify>

</comment></comment></comment><comment><USER13> This looks like a cool service, and I am starting on a new project that might benefit from something like this. But the page failed to load 3 times, and the 4th time it took about 10 minutes to load. Maybe you are just getting overloaded from HN visitors, but still, that's a problem.

Do you also offer this as a service that can be implemented natively from another application? In other words, I'd rather not go to your homepage to do this, I'd prefer the customer add his/her information on my website, and have the processes automated with the results sent to me.

<comment><USER4> edit: EC2 was slow at first, but problem was redistogo

<comment><USER14> As someone about to use EC2 for some heavy servers, I would appreciate if you could tell me:

a) How huge an EC2 instance do you have?

b) What tech are you serving from? Express, ASP, JSP, etc...

<comment><USER4> a) large instance b) express/node

the core problem was redistogo, not primarily ec2, though someone else takes up a lot of CPU on my shared instance

</comment></comment></comment></comment><comment><USER15> I use Google Voice where possible, and especially for SMS. Regular SMS to/from my phone costs 20c per message (usual US carrier nonsense). I've found that most places that claim to send SMS fail to send to Google Voice, and provide no diagnostics that they failed. Given SMS supports receipt notification that is a strange.

<comment><USER16> I have the same headache with Google Voice not receiving most confirmation SMS and was delighted to see that the test SMS I just sent using this service came through. Well done!

</comment></comment><comment><USER17> FYI, one of the examples we wrote for Webscript does simple mobile phone verification: <https://www.webscript.io/examples/mobileverification>

We thought about building something like this as a paid service, but we didn't think it could be very profitable.

</comment><comment><USER4> Okay, the problem wasn't EC2. The problem was Redistogo. Everything fixed.

 __

<https://getprove.com>

 __

<comment><USER18> SSL error

<comment><USER4> should be up now, maybe your DNS is taking a bit, try again in a few minutes

i migrated assets to CDN, but still transferring some now, so fonts might now show up yet :)

</comment></comment></comment><comment><USER19> FYI, your lock icon is not showing up for me, you may want to check your encoding.

<comment><USER20> Nor for me on OSX / Chrome 28.0.1500.20.

<comment><USER4> icons work now.

</comment></comment></comment><comment><USER3> This is definitely cool, but it's just one thing that any "social framework" would do. Verifying emails or verifying mobile phones is a basic step in any user signup.

</comment><comment><USER19> Signup is broken.

When I try to sign up for an account I get an error "User already exists". This is the case for any email address I enter.

<comment><USER4> thanks for letting me know, hang on.

EDIT: SIGN UP WORKING

</comment></comment><comment><USER21> The css isn't loading. Seems HN has broken yet another website. Congratulations!

<comment><USER4> yea thats EC2 for you, should have had assets on s3/cloudfront like always... wasn't expecting this

<comment><USER22> No one expects the Hacker News inquisition!

Always always always host the static bits in S3/Cloudfront or some other piece of machinery that can spit them out quick when you show your work off.

<comment><USER4> they are on S3/Cloudfront now. migrating the last of the assets such as fonts currently.

</comment></comment></comment></comment><comment><USER23> Getting this: Error 107 (net::ERR_SSL_PROTOCOL_ERROR): SSL protocol error.

<comment><USER4> edit: see above comment, problem was redistogo

<comment><USER24> Suggestion: use varnish. That way you can easily absorb massive spikes in logged-out GET traffic (such as that caused by being on Hacker News).

</comment></comment></comment><comment><USER25> 10 years later, and this is still a challenge. My biggest regret is not taking this technology and putting an API behind it and offering it up. Oh well.

<comment><USER26> > Oh well.

Why "oh well?" Not to be pedantic, but if it's your _biggest_ regret, what's stopping you?

</comment></comment><comment><USER27> Saving this to try it out later.</comment>


Ask HN: How to improve skills on unit testing - <AUTHOR> Hi everyone,
I'm trying to become better at unit testing (especially in python) but I'm struggling to write effective tests or even just writing tests on functions that return nothing or need to be mocked. I read articles on the subject, watched conferences and read the documentation of py.test and I still have difficulties because usually test cases shown are really simple. Would you have interesting resources to share on the matter?
Thanks a lot <comment><USER2> It is unclear to me what do 'better at unit testing' means for you.

<comment><AUTHOR> I mean, I a real beginner on that part and I have difficult to write efficient an relevant tests when it comes to test functions or methods that returns nothing, when it comes to mock a database, test a socket connection to give you some ideas where I'm struggling.

<comment><USER2> One of the benefits of writing tests is that helps a programmer avoid writing code that is hard to test (and by implication hard to measure correctness). And one of the goals...or maybe the only goal is to use tests to improve the code. Based on your description, a first order approach might be to write (and/or refactor) your code into a testable form. And by 'testable' I mean what your current skill set allows you to test.

If you've listened to 'uncle' Bob Martin, you've probably seen him advocate writing tests _first_ (if you haven't listened to him and you're interested in testing, he has an experienced view whether or not you wind up agreeing with him). Writing tests before the code means that the code will either be testable or it will be wrong (it might be testable and still wrong but there's a chance that the tests will show that).

Anyway, I suppose my point is that if I don't know how to test my code, the problem is probably the quality of my code not my knowledge of testing. Perhaps complex testing techniques are a code smell for complicated programs. Or not.

<comment><AUTHOR> Thanks a lot for your overview, much appreciated. I will have a closer look to Bob Martin.</comment></comment></comment></comment>


Docker closes $40M Series C led by Sequoia - <AUTHOR> https://blog.docker.com/2014/09/docker-closes-40m-series-c-led-by-sequoia/ <comment><USER2> This means Sequoia expects Docker to either go public or to be acquired for at least (10 * $40M / sequoia_ownership) in order to be considered a "win," right? (A "win" in the sense of being worth the VC's investment, not in the sense of being valuable to the world.)

The reason I say this is because a VC who merely breaks even on investments will eventually go out of business, so it would be a mistake to invest unless the expectation is that Docker might be a win for them.

Assuming Sequoia owns, say, 35%, then that comes to an expected acquisition price of about $1.15B for Sequoia to earn 10x their money back.

What are some hypothetical scenarios which end with Docker going public? What are some scenarios where a company would acquire Docker for north of $1B?

I'm not trying to imply anything about Docker with these questions. Personally, I love Docker. It's just fun to theorycraft.

<comment><USER3> Generally the multiple expected is lower for later stage rounds as there's less risk. Also Sequoia wouldn't have got anywhere near 35%.

That said the investors would certainly be looking for >$1bn exit.

<comment><USER4> > Also Sequoia wouldn't have got anywhere near 35%.

Bingo!

I don't think anyone would be interested in taking a round that would dilute us this much, especially when the need for money is not pressing.

<comment><USER2> The smaller the percentage, the higher the expected acquisition price. For a 10% ownership stake from a $40M investment, the acquisition would need to be $4B just to earn 10x their money back.

I was just wondering about some scenarios where Docker could achieve that kind of price.

<comment><USER4> You haven't taken in to consideration an important variable - how much of the 40M is invested by Sequoia vs. pro rata by existing investors.

<comment><USER5> Why does that matter, the other investors are hoping for returns too?

<comment><USER6> preferred vs common, participating preferred vs common (i.e. liquidation preference), possible pro-rata rights (thought at this stage further financings are probably unlikely)

disclaimer: I work at greylock, who was an earlier investor, though have _zero_ inside knowledge of the deal as I work on unrelated stuff.

</comment></comment></comment></comment></comment></comment></comment><comment><USER7> How are Docker monetizing their product? Is it just in hosting and support? By open sourcing Docker they have opened up the door to hundreds of competitors offering the same thing, often for a much lower cost? Is their only competitive advantage the fact that they own the project and thus understand it better and can dictate its course?

I'm sure they would make for a very interesting case study on how to do open source right.

<comment><USER4> I'll paraphrase the questions and provide answers best I can

> How are Docker monetizing their product?

We offer commercial support for Docker and also offer paid features on Docker Hub.

> Competition?

Docker is Apache 2 licensed. Anyone can fork Docker and start monetizing it tomorrow in a completely different way than we had anticipated.

This is actually a good thing. There's a separation of Docker between the project and the company, and there's a virtuous cycle of the company aligning to the objectives of the project and the project benefiting by all of the business-y things you can do.

> Competitive Advantage

We don't own the project, the community does. We fundamentally believe the value of a platform or ecosystem is proportional to the amount of competition it brings to everyone. As per above, we have no interest in locking in a competitive advantage on the Docker project that only we can benefit from.

> Doing Open Source Right

We have a long ways to go! We're certainly trying something new - but we've gathered a lot of momentum and our focus is just to continue working with the community, our great partners, and work diligently to deliver great product and support to our users.

<comment><USER8> That is one way of putting it. Another way is that you're creating a new de facto standard and making sure everyone needs to use it. The partnerships you make build your product into other products, making it the default option for anything someone might need to do with containers. Then you increase the visibility of the product (and thus the company) by getting lots of PR and making sure VCs and potential customers read it.

But competition has nothing to do with open source. Source code is not a competitive advantage, even if you get minor quality improvements like increased code visibility and test coverage. No open source company has ever forked code from an existing product, started a competing business, and stolen business away from the originator. Companies that provide services on top of other people's code, however, often fall victim to a better sales pitch, customized tailored services or a shift in direction.

And honestly, the idea that 'the community' owns the Docker project is a joke. Is the community getting 40 million dollars? Is the community making the design decisions for the product? Is the community pushing the integration of your tool with other companies and services? As far as I can see, you have a company based on a product, and you give that product away because it costs you nothing to do so. Open Source is a marketing tool, and a great one at that.

<comment><USER4> I'm glad you bring up partners! They're what I personally focus on 24x7, so have a lot to say on the topic.

> The partnerships you make build your product into other products, making it > the default option for anything someone might need to do with containers.

I think you can view some partnerships through that lens, but as a whole I do not believe this statement holds at all.

My #1 partnering goal is to make sure that the interest that exists in Docker can be realized on the services and products that people are using today. You'll never see us form a partnership that has any conclusion, whether direct or indirect, that the only proper way to use docker is in combination with partner technology X.

I think you could also view projects like libcontainer, which is written by some of the maintainers of Docker, and understand that it's being used by other projects not related to Docker at all. In some cases, even by _perceived_ competition (like Pivotal.)

> Then you increase the visibility of the product (and thus the company) by > getting lots of PR and making sure VCs and potential customers read it.

It is important to highlight the reasons we make these partnerships - I can assure you, it's not to get VC attention. That's completely short-sighted and unsustainable.

To the best we can, we deflect the visibility on the project on to others, big or small, doing great things with Docker.

> And honestly, the idea that 'the community' owns the Docker project is a > joke.

I'm not laughing. Maybe you're not familiar with how the Apache 2 license works. I'd get familiar with that. Link: [http://en.wikipedia.org/wiki/Apache_License](http://en.wikipedia.org/wiki/Apache_License)

> Is the community making the design decisions for the product?

Yes. The projects design is open. There is no privileged discussion about the Docker project - it happens all in the open on GitHub and IRC. If there's a specific area of conversation that requires in-depth collaboration, we sponsor people to meet in person. This happens regularly.

> Is the community pushing the integration of your tool with other companies > and services?

Yes. Red Hat is a perfect example. Pre-0.7, any Red Hat customer could not use Docker because of 1) AUFS not being available on the platform, 2) Docker not being supported on Red Hat. So anyone using Docker on Red Hat at that time was breaking their agreement. That's a problem.

> As far as I can see, you have a company based on a product, and you give > that product away because it costs you nothing to do so. Open Source is a > marketing tool, and a great one at that.

We can argue the relative advantages and disadvantages of free vs. commercially licensed software all day. You can write Docker off as a sheer marketing ploy, but, I'd say that's a pretty disingenuous statement to make at an individual level of the company.

I'll also say, the trade-off does not come without cost. It's not even close to free.

</comment></comment></comment></comment><comment><USER9> How do people actually use Docker?

In my world of bootstrapped, smaller apps looking for market traction, even if things go well, a few Linodes should be enough to handle most of the traffic I'll ever need to deal with, so this kind of thing is kind of foreign to me. I'm curious how people utilize it in practice.

<comment><USER10> I (or rather, jenkins) builds all my software in it, I don't actually use it for containerizing final applications.

In a nutshell, for me the value is in trivial repeatability. I can reproduce the entire build toolchain, test environment and produce artifacts all from a few KiB git repo which centres around the Dockerfile and submodules to dependencies.

Some of my ARM stuff takes hours to cross-compile and involves enormous amounts of fiddly babysitting normally. Dockerfiles have RUN statements (think lines a shell script) which are cached. My adjustments toward the end of a Dockerfile take only seconds to test and produces the exact same result as if it had really run each statement from the start, which doesn't sound like much but turns out (for me) to be pretty liberating compared to constantly trying to fight other automation where you have to dance around short-circuiting stuff to re-use bits of a past build to save time and get only a handful of "pristine" iterations in a day (that might differ to the iterations you rolled by hand).

<comment><USER11> I'd be super interested if you could share any of your ARM cross-compilation Dockerfiles.

<comment><USER10> They've got a lot of idiosyncrasies at the moment, some of it working around the fact ADD some/directory/ could never be cached (so my build scripts maintain some.directory.tar.gz and those are ADDed instead), but I really should. I guess I'd put it under my github profile (I'm also csirac2 there).

There's two types of ARM builds, ones which can cross-compile and those that can't. The ones which can't cross-compile are done with qemu-binfmts and we chroot into an ARM filesystem and run the build there.

Perhaps the only useful contribution would be the fact that I persist the ccache up to the docker host with a shared ccache volume, and that helps enormously especially for the qemu-binfmts builds which can be quite slow.

<comment><USER11> Where does your original (non-qemu) toolchain come from? Is that built inside or outside of a container?

<comment><USER10> (em)debian provides nearly enough of what I need most of the time. The trigger for going to a ARM chroot is when I can't get build dependencies installed properly on an amd64 host. Either that or the thing I'm compiling just isn't developed to be cross-compiler friendly and it's too much work to hotwire it to be so.

For example, say I need libfoo, I have an amd64 host (being the docker container). Sometimes I just can't get the libfoo:armhf or libfoo-dev:armhf package installed because it would break/conflict with the amd64 host's version of it in some way. xapt often helps but then sometimes screws up by re-packaging something that has an "all" arch (non-arch-specific) to something armhf specific (eg. foo-data). This ultimately either conflicts with the host or fails to be named properly in such a way that it meets the build-deps of the project.

Sometimes I know it would be easier in some cases to avoid the debian packaging ecosystem, but for my workflow and distribution requirements it brings a lot of benefits.

Edit: see here [https://wiki.debian.org/EmdebianToolchain](https://wiki.debian.org/EmdebianToolchain)

</comment></comment></comment></comment></comment></comment><comment><USER12> Went to read this blog when I found out blog.docker.com doesn't support TLS 1.2. And only has one available cypher suite

          TLS_RSA_WITH_RC4_128_SHA

Which is cool because RC4 is broken.

docker.com actually does support TLS1.2, but their blog subdomain doesn't :\

<comment><USER13> Thank you. The blog is on different infrastructure than our website and the DockerHub. We'll look at this pronto! If you discover any other security issues or concerns, please send them to email@example.com.

<comment><USER12> Yes and thank you for responding quickly to my email.

</comment></comment></comment><comment><USER14> Can someone explain Docker in layman's terms and juxtapose it against something I already understand (aws perhaps)?

<comment><USER15> In the naughts, virtualization developed as a software layer to abstract physical hardware and provide so-called "virtual machines" that, instead of working exclusively with hardware, function as a group and share resources as a pool.

Docker provides one more layer of abstraction and grouping where a machine (or, commonly, a virtual machine) abstracts its resources in order to provide them to thread-like "containers." These containers share their resources with other containers running on a given host.

A docker container, written like a spec into a `Dockerfile`, is a way to package your application as if there was a `run.sh` that would install your OS, any dependencies and your application itself -- and, importantly, run that application after everything is installed. The host can choose to surface to the world any ports on the running container, or keep them private to itself. The container draws from the host's pool of resources so long as your application continues to run inside the "thread" managed by docker.

</comment></comment><comment><USER16> Docker's blog post on this [https://blog.docker.com/2014/09/docker- closes-40m-series-c-l...](https://blog.docker.com/2014/09/docker- closes-40m-series-c-led-by-sequoia/)

</comment><comment><USER17> I tried Docker for a little while, just to see what it is. It seems like the authors never used UNIX before. Nonstandard argument format, some strange formatting in the manual page. And the idea of downloading random software from strangers from the internet and running it on your machine creeps me out as well.

<comment><USER18> Of course nobody is running random images from the internet in production. You build your own. Building custom images is not rocket science.

But to get started with docker it's incredibely easy to download an image and have something running within minutes.

<comment><USER13> I run "random" images. However, I do so by only running automated builds with source code I can (and do) first audit. Some of those images, by the way, are official and provided by the application developer / org.

</comment></comment></comment><comment><USER19> Congrats to all the team!

<comment><USER4> Thank you for being a big part in the community, specifically around boot2docker. You rock!

</comment></comment><comment><USER20> It's very interesting to see that Docker is getting so much recognition, money and success -- while the real core of this thing, lxc is rarely mentioned and also the authors are not part of this huge success.

<comment><USER21> Docker doesn't use lxc by default anymore (although you can still run the docker daemon with it if you want). It uses libcontainer, which they wrote: [https://github.com/docker/libcontainer](https://github.com/docker/libcontainer)

<comment><USER20> Good to know, thanks.

</comment></comment></comment><comment><USER22> Docker is one of those FOSS that I always want to actively contribute to, but I don't lest they seem to be doing great without any help.

<comment><USER4> Someone made a contribution earlier today as small as adding a carriage return in an RST file. That is extremely appreciated by everyone.

I'd encourage you to jump in. The IRC channel is fairly active and there's a ton of places to get started at all experience levels. Let me know if you need help.

<comment><USER23> The stewardship of community contributions seems particularly poor in Docker. One of the more frustrating projects I have tried to help, and is really the only red flag. The promise of docker is awesome.

See this thread (and previous discussions around the issue) begging for docker core to participate and getting nowhere for ~1 year: [https://github.com/docker/docker/issues/7284](https://github.com/docker/docker/issues/7284)

Is there an outline somewhere on your plan for governance and stewardship for community contributions, how proposals move through the pipeline, and whether anyone outside of Docker, Inc has the commit bit?

<comment><USER4> I'm sorry to hear you've had a frustrating experience. The governance model should be outlined in the CONTRIBUTING.md file located in the repository which should address the concerns.

There are project maintainers that are not on the Docker, Inc. payroll, and getting anything committed requires the approval of at least 2. We actually consider this a litmus test for our involvement with the ecosystem, and it's fundamentally a great thing.

As for the issue at hand, I personally understand desire on both sides. I have been frustrated multiple times by the lack of being able to have multiple Dockerfiles per repo as a simple example. On the other, providing strict guarantees about context ensures true portability of Dockerfiles.

What I will say, is that this is a topic we talk about a lot, whether it be on the issues themselves or in IRC. It's tough to get the right balance.

<comment><USER23> Docker, Inc employees have popped in to make an offhand comment at various points, similar to the one you made "On the other, providing strict guarantees about context ensures true portability of Dockerfiles." but actual participation is nonexistent.

This has been the case on other issues I have seen as well, either things languish, or they get magically swept into the project, with the decision happening elsewhere.

Stewardship would mean actually explaining the position above, and discussing with the community how the issue affects them in order to gain an understanding of what we are talking about.

Yelling "repeatability" with no context and then disappearing is pretty frustrating.

<comment><USER24> Jake, you're being disingenuous. Back in April I gave a detailed explanation [1] as to why I hesitated to make the proposed change. When comments kept rolling in I followed up in June with a possible solution and a conclusion that "if somebody contributed this, we would love to merge it" [2] To my knowledge nobody has.

I know for a fact that you are aware of this since my comment was in direct response to you.

And since comments are _still_ rolling in (even though there is already an open call for contribution, with a pre-approved design), I am focusing on it again this week [3].

There are definitely lots of growing pains in how we run the project, and having any participation at all from you is super appreciated. But the picture you pain here is unfair and inaccurate.

[1] [https://github.com/docker/docker/issues/2112#issuecomment-39...](https://github.com/docker/docker/issues/2112#issuecomment-39763037)

[2] [https://github.com/docker/docker/issues/2112#issuecomment-47...](https://github.com/docker/docker/issues/2112#issuecomment-47448194)

[3] [https://github.com/docker/docker/issues/7284#issuecomment-55...](https://github.com/docker/docker/issues/7284#issuecomment-55849748)

</comment></comment></comment></comment></comment></comment><comment><USER25> I wonder how much of this was just a way to rearrange who owns how much, ahead of the inevitable acquisition.

</comment><comment><USER26> "the money helps show the market that the company has stability"

Free money from some dudes unrelated to the company's business really shouldn't indicate "stability", should it?

</comment><comment><USER27> This will help them much with big customers who decide if they should use Docker - because they have now longer-term stability and support.

</comment><comment><USER28> 'Hot' here should be interpreted as a new, fresh, popular meme and buzzword - 'a cool stuff for a cloud - orchestration, you know'.

Well, in this way it is hot indeed.

<comment><USER29> Docker doesn't do orchestration and doesn't provide a PaaS.

I imagine they'll try to grow in that direction because their customers will hanker for it, but (and I'm biased here because I work for a PaaS developer) they'll find that building automagical distributed platforms is hard. _Very_ hard.

Edit: from the blog post -- it looks like moving up into PaaS is their intention.

<comment><USER30> Why would Docker sell their dotCloud platform if they wanted to stay in the PaaS business?

<comment><USER29> God I hate it when people make excellent points directly underneath my remarks.

</comment></comment></comment></comment><comment><USER31> yep they are hot as in overhyped

</comment><comment><USER32> Here's a copy of the blog post for anyone having trouble reading.

Today is a great day for the Docker team and the whole Docker ecosystem.

We are pleased to announce that Docker has closed a $40M Series C funding round led by Sequoia Capital. In addition to giving us significant financial resources, Docker now has the insights and support of a board that includes Benchmark, Greylock, Sequoia, Trinity, and Jerry Yang.

This puts us in a great position to invest aggressively in the future of distributed applications. We'll be able to significantly expand and build the Docker platform and our ecosystem of developers, contributors, and partners, while developing a broader set of solutions for enterprise users. We are also very fortunate that we'll be gaining the counsel of Bill Coughran, who was the SVP of Engineering at Google for eight years prior to joining Sequoia, and who helped spearhead the extensive adoption of container-based technologies in Google's infrastructure.

While the size, composition, and valuation of the round are great, they are really a lagging indicator of the amazing work done by the Docker team and community. They demonstrate the amazing impact our open source project is having. Our user community has grown exponentially into the millions and we have a constantly expanding network of contributors, partners, and adopters. Search on GitHub, and you'll now find over 13,000 projects with "Docker" in the title.

Docker's 600 open source contributors can be proud that the Docker platform's imprint has been so profound, so quickly. Before Docker, containers were viewed as an infrastructure-centric technology that was difficult to implement and remained largely in the purview of web-scale companies. Today, the Docker community has built that low-level technology into the basis of a whole new way to build, ship, and run applications.

Looking forward over the next 18 months, we'll see another Docker-led transformation, this one aimed at the heart of application architecture. This transformation will be a shift from slow-to-evolve, monolithic applications to dynamic, distributed ones.

SHIFT IN APPLICATIONS

As we see it, apps will increasingly be composed of multiple Dockerized components, capable of being deployed as a logical, Docker unit across any combination of servers, clusters, or data-centers.

DISTRIBUTED, DOCKERIZED APPS

We've already seen large-scale web companies (such as GILT, eBay, Spotify, Yandex, and Baidu) weaving this new flexibility into the fabric of their application teams. At Gilt, for example, Docker functions as a tool of organizational empowerment, allowing small teams to own discrete services which they use to create innovations they can build into production over 100 times a day. Similar initiatives are also underway in more traditional enterprise environments, including many of the largest financial institutions and government agencies.

This movement towards distributed applications is evident when we look at the activity within Docker Hub Registry, where developers can actively share and collaborate on Dockerized components. In the three months since its launch, the registry has grown beyond 35,000 Dockerized applications, forming the basis for rapid and flexible composition of distributed applications leveraging a large library of stable, pre-built base images.

Future of Distributed Apps: 5 Easy Steps

The past 18 months have been largely about creating an interoperable, consistent format around containers, and building an ecosystem of users, tools, platforms, and applications to support that format. Over the next year, you'll see that effort continue, as we put the proceeds of this round to use in driving advances in multiple areas to fully support multi-Docker container applications. (Look for significant advances in orchestration, clustering, scheduling, storage, and networking.) You'll also see continued advances in the overall Docker platform–both Docker Hub and Docker Engine.

The work and feedback we've gotten from our customers as they evolve through these Docker-led transformations has profoundly influenced how Docker itself has evolved. We are deeply grateful for those contributions.

The journey we've undertaken with our community over the past 18 months has been humbling and thrilling. We are excited and energized for what's coming next.

</comment><comment><USER33> It's nice to see the folks building the building blocks getting some - financial - attention.

Now to yield a nice return on that they just have to turn docker into a ephemeral social photo sharing app for blind vegan Bulldogs and say they want to change the world ;)

<comment><USER4> That's hilarious. :)

I think containers as a concept have the chance to really fundamentally change the way applications are developed, delivered, and managed in data centers going forward - whether it's my own little rack sitting in a corner office, or a large scale, multi dc deployment.

We're betting on that being Docker, but, the worst thing that could happen is to become complacent and not recognize there's a tremendous amount of work left to do.

<comment><USER34> Trying not to be a curmudgeon - but I really don't see what the big fuss is about, or how docker is fundamentally changing anything.

Not to take anything away from docker being a decent tool in some circumstances - but really this methodology has been around in one implementation for ages on Unix platforms.

<comment><USER35> That's sorta where I've been coming up, too. Great, hard working group but docker strikes me as a very small component of the deployment stack, the entirety of which doesn't even have much enterprise value.

What would be a good comparison for a component company like this getting to 100s of millions or $1b?

<comment><USER36> LOL. The massive and obvious enterprise value is in having a standard way to deploy and interface isolated Linux applications along with their dependencies, along with a convenient hub for distributing and exchanging them.

No, its not the first time any technologies with _some_ these types of capabilities have been available, but it is the first time this powerful combination of those capabilities have come together in a way that has so much momentum.</comment></comment></comment></comment></comment>


A Silicon Valley CEO Response to Talia Jane's Letter - <AUTHOR> https://medium.com/work-reimagined/a-silicon-valley-ceo-response-to-talia-jane-s-letter-6b1f4540d3df#.b719hv1es <comment><USER2> " Most solutions have been attempts to move people to work, but I'm proposing an alternate solution: moving the work to the workers."

Holy crap! That's revolutionary! Letting people work from home! How groundbreaking!!!

Seriously, it's great to see another CEO encourage this trend, but the way it's presented in this post as a brand new thing he just invented over the weekend is a bit ridiculous.

<comment><USER3> Looking at the actual Careers page at her company site, however, none refers to working from home except on Wednesdays.</comment></comment>


Slender Stack Development - <AUTHOR> https://medium.com/@christophergdavis/slender-stack-development-d1a4ac729ffa <comment><USER2> I've been thinking a lot about this myself my choice is knex migrations with auth via express/passport but then the backend is mostly postgres, graphql, hasura. Frontend I use quasar to get cross platform on Vue.

<comment><AUTHOR> Quasar is new to me, I'll have to check it out.

Of course, my preferred method is not writing any front end js if I can avoid it, but I do prefer Vue to React.</comment></comment>