$36k Google App Engine RCE - louis-paul https://sites.google.com/site/testsitehacking/-36k-google-app-engine-rce <comment><AUTHOR> Those skills at 18, the integrity to not sell something like this on the black market (assuming here that an 18 year old in Uruguay isn't exactly swimming in money), and a bounty from Google under his belt - he won't have trouble finding work. If I was considering hiring him, the creative bit of guerilla marketing for The Expanse he threw in there wouldn't hurt his chances either.

<comment><USER2> Let's try a thought experiment. To make things easier, imagine you're 21 years old, not 18, and have made up those 3 years working in the industry. You found this vulnerability, and have decided not to submit it for a bounty, but rather to the black market.

Who do you sell it to? I assume your answer will involve putting it up on some darknet version of Craigslist. That's fine, but then tell me: who's paying for it? What price do they assign to it? For instance: if you think you can sell it for $50k, who's paying that, and for what purpose?

Finally, what are the steps you take to safely complete the transaction?

(This is intended only to clarify arguments about the market for vulnerabilities like these, and not to suggest that the finding and the writeup aren't excellent, which they sure appear to be.)

<comment><USER3> You don't have to think about it too hard, there's companies that will help you with the transaction. [https://www.zerodium.com/](https://www.zerodium.com/)

<comment><USER2> First, you can just go look at Zerodium's website and see what they'll buy. Notice that one-off vulnerabilities aren't there at all: there are no vulnerability types on their rate sheet that a single vendor can instantaneously fix worldwide with a single patch.

Notice also that with just a couple exceptions, RCEs in _extremely widespread_ serverside web components are valued at $10k (if you believe their price list; I'm skeptical of it). Those are vulnerabilities that all have half-lives after patches are issued --- that's a _ceiling_ for what anything like this could be worth.

Second, Zerodium isn't "the black market".

<comment><AUTHOR> I was in fact thinking of exploit brokers as well, so my wording was unclear. Let's call it the grey/black market.

In the scenario you described, without any other contacts and/or experience with transactions like this, I would approach an exploit broker. As for the payout - I assumed that any RCE vulnerability that qualifies for Google's highest bounty is likely to fetch a higher price elsewhere.

My experience with the field is limited and considering yours, if you are suggesting that this particular exploit would not fetch a significantly higher price, I shall stand corrected.

<comment><USER4> It actually turns out to be not that simple to approach organized crime for an one-off transaction. If that would be simple for you, then it would be exceedingly easy for LEO to get to these players as well.

<comment><AUTHOR> Clearly. As pointed out/clarified in another comment I was mostly thinking of the grey area companies who buy 0-days and sell them to governments, law enforcement and god knows who.

</comment></comment></comment></comment></comment></comment></comment><comment><USER5> > _I am 18-year-old student at the University of the Republic [Uruguay] > interested in computer security_

Someone could say that he could have gotten even more money by selling his findings in the black market, very difficult but doable. However, as someone who understands how studying computer science in a 3rd-world country is, getting USD +36k in a legal way and from a company that is considered one of the best in the industry, it must have felt very good to get that mail.

Congratulations, and keep the good work.

<comment><USER6> That's pretty advanced stuff for an 18y/o, even for most senior developers. No doubt Google will try to recruit him after he finishes university.

<comment><USER7> (Edit: I appear to be a broken record) I spent a spell on a bug bounty program. There are some beasts out there in the 16-20yo age range, it's pretty crazy.

<comment><USER8> Their minds probably haven't been numbed by years of fixing shoddy code and writing CRUD apps yet.

</comment></comment></comment></comment><comment><USER9> This report showcases a ton of tenacity and thoroughness. Not his first time as well: [https://sites.google.com/site/testsitehacking/10k-host- heade...](https://sites.google.com/site/testsitehacking/10k-host-header). Very impressive.

"Please stop exploring this further, as it seems you could easily break something" has got to be the best reply one can receive to a bug bounty report.

<comment><USER10> That's what struck me. From the well told story I feel like there were several points of "welp probably can't go further then this better move on to something else" but he kept going and going and sure enough he got somewhere. Hope to see more work published by him over the next few years!

</comment></comment><comment><USER11> "When issuing the reward, we'll take into account what you could have achieved with this access" makes me laugh.

How scary must that be for the Google team? You know you've messed up so badly and the person who is investigating is doing so blindly with no knowledge or accountability if he breaks something. Yikes.

Kudos to everyone for doing the right things. And great bounty- the average yearly income in Uruguay is $2000-$3000 USD per household. This guy just got awarded more than ten times that.

<comment><AUTHOR> Are you sure that's accurate? According to this [1] it's about 10 000 USD per capita.

[1] [https://www.ceicdata.com/en/indicator/uruguay/annual- househo...](https://www.ceicdata.com/en/indicator/uruguay/annual-household- income-per-capita)

<comment><USER11> Ah you may be right- I did a cursory Google search only. Still, multiple years of income in one bug isn't bad at all.

</comment></comment></comment><comment><USER12> I used to work support for GAE and recognize all of this. This is really impressive, congrats on the great work and huge bounty. Keep it up!

<comment><USER13> Same; I worked on GAE in 2013 and it's so funny to read the story of someone exploring, discovering, and being so close to breaking something you know really well. There's a few moments in here where I thought "oh man, you could have done XXXX and that would have been so bad!". Definitely understand why they gave them the big bucks for this one.

<comment><USER14> XXXX == what types of things?

I'm curious why there was no auth required for his calls.

<comment><USER15> * Grab nearly all of googles source code (no extra auth required for that, since so many libraries read config etc from the source code repo)

* Make the right requests to one endpoint he found and retrieve company financials, number of hits to every google service, the name of every application running in every datacenter, etc.

* With the above two things, you know the location of services and every RPC endpoint on them, and all access control configs. You can take your sweet time to audit the 10's of millions of lines of code to find vulnerabilities and get to attack as an authenticated (albeit low privilege) user. A lot of stuff is open to all authenticated internal users.

* For example, you could take down any google service by quitting all the application servers at the same time by calling the right debugging RPC. You'd be caught obviously tho.

<comment><USER14> Wow, that is quite significant.

36k is not a small bounty for an RCE, but I feel like this is more critical to Google than the highest Android payout, for which they pay up to 200k for: [https://www.google.com/about/appsecurity/android- rewards/](https://www.google.com/about/appsecurity/android-rewards/)

<comment><USER15> Android is wormable, and potentially not repairable by google.

For example, with a decent remote android exploit, I could distribute a patched Google Play Services to all vulnerable handsets which disables updates and then listens to my own command and control infrastructure for further actions.

I can now hold the phones hostage and extort google for money to regain control of them.

<comment><USER14> That would be pretty brutal and cause people to quit trusting android phones.

But I think the same could be accomplished with the access he had, or worse, but would have taken a lot more work. He also would have needed to avoid detection too. His access sounds more troubling than the Aroura attacks they had years ago.

</comment></comment></comment></comment></comment></comment></comment><comment><USER16> Another thing that is very admirable and bold is that he had no actual idea that he discovered a RCE vuln but went ahead and confidently contacted google.

How many would stop at "Eh I managed to fire requests to a hidden RPC service in google, but couldn't figure out how to make it do anything useful to qualify".

Put yourselves and your work/findings out there people!

<comment><USER17> Yes, if he had known more about Google infrastructure, he could have done some damage, both active and passive. He had access to a lot of internals. I was surprised by them at first, too, but they all make sense. On the other hand, he would have probably been caught fairly rapidly.

<comment><USER18> One thing to note is that Google, like any responsible organization should, has layered security and threat models that include insiders as a potential threat; _hopefully_ , while he could make RPC calls to internal services (which is itself a serious problem, hence the giant bounty) he _hopefully_ could not authenticate to do anything any serious damage or access any sensitive information.

<comment><USER17> I agree that there are multiple layers of security in place, which is why I said he would have been caught fairly quickly. I'm not going to go into details, but, at the very least, he had access to quite a bit of proprietary information, i.e. private to Google, not necessarily user data. I talked to another former Googler and we agreed that this is at least as bad as a previous disclosure: [https://packetstormsecurity.com/files/129406/Google-App- Engi...](https://packetstormsecurity.com/files/129406/Google-App-Engine-Java- VM-Sandbox-Escape.html)

</comment></comment></comment></comment><comment><USER15> He was about 2 API calls from being able to grab nearly all of googles source code from Google3 there...

<comment><USER19> Source? Is there really no authentication around it?

<comment><USER20> He had read access to G3. Exfiltrating it all would have been hard, but he could have gotten a chunk of it for sure.

</comment></comment></comment><comment><USER21> Cute base amount, $31337... :)

<comment><USER22> For anyone not informed like me...

[https://www.urbandictionary.com/define.php?term=31337](https://www.urbandictionary.com/define.php?term=31337)

</comment></comment><comment><USER23> This is not an inconsequential amount of cash, for sure. Especially at 18! Congrats! And a great write-up to boot. Just awesome.

All that said an honest question: why would a company like Google not pay insane amounts of money for these kinds of bug finds? What would they pay their own people to find them? Seems like RCE on App Engine should be worth 100K+ and then some on top for giggles just because they can.

Obviously having a standard policy makes sense so that your community understands what to expect but as Google, what's your operational impact if you triple / quadruple vs. market value of the exploits?

<comment><USER24> They pay their own people a salary - having a dependable living (at a very, very nice rate) is a pretty awesome thing. Sometimes there are bonuses involved, but they're usually not on the order of magnitude of external bug bounties.

My understanding of the pricing is that it's designed to make ethical behavior profitable enough that fewer people are tempted to sell the exploits on the black market, not necessarily to out-compete the black market entirely. I think this person's find is a great example - it's a resume-booster, a great experience, a very nice cash infusion, and _helps_ , instead of hindering, their job prospects with future employers.

</comment></comment><comment><USER25> Looks like the "Hall of Fame" link in the bounty confirmation email is broken / not rendering:

[https://www.google.com/about/appsecurity/hall-of- fame/](https://www.google.com/about/appsecurity/hall-of-fame/)

<comment><USER26> It appears to be hosted at [https://bughunter.withgoogle.com/rank/hof](https://bughunter.withgoogle.com/rank/hof)

(From following this error: "Refused to display '[https://bughunter.withgoogle.com/0x0A?embed=1'](https://bughunter.withgoogle.com/0x0A?embed=1') in a frame because it set 'X-Frame-Options' to 'deny'.")

</comment></comment><comment><USER27> Google should send this guy a request to be hired. Clearly he's as good as their internal engineering team and his write up was great.

<comment><USER28> As has been discussed to death here, Google's hiring process doesn't care what you did last week, or last year (eg Max Howell).

This would not improve his odds.

<comment><USER29> Anecdotal, but I got my job at Google through participating in their bug bounty program. The first set of interviews you have that ask general CS questions might not care what you did last week or last year, but when you talk with the team who wants to hire you they certainly do care.

<comment><USER30> That's the thing, he might get rejected from the screening questions...

</comment></comment></comment></comment><comment><USER31> I sure as hell wasnt this competent at 18 let alone now. Kudos to him.

</comment><comment><USER32> Huh, so you can run binaries in GAE by downloading a statically linked app to /tmp, chmod'ing & executing it? And there would be no limits on how it's run? That's crazy & pretty cool!

<comment><USER33> GCP Developer Advocate here:

The Java 8, Node.js (just announced at I/O) and GCF environments use a new sandbox that should allow you to run any binary. Of course there are limits, and you have to pay to run things on App Engine past the free tier, but most things should run just fine.

The older GAE sandboxes didn't let you do this (and had a ton of other limitations as well)

</comment></comment><comment><USER34> It would be no skin of Google's back to multiply these bug bounties by 10, and they should.

<comment><USER35> But that's would be counter to their interests. They want to hire this kid when he graduates. If they paid 10x their current bounty rates they'd have paid over $400,000 to him in the last couple of years of his _free time_. That's a great way to never be able to hire him.

<comment><USER36> > That's a great way to never be able to hire him.

Why's that? It's not retirement money. 400k (salary+stock) is one year of compensation for some Google engineers.

<comment><USER35> Dude has cashed out a $10k and $30k bug bounty at the age of 18. Either he's lucky or he's very good. If he's the latter that $400k turns into an annual bounty.

And very, _very_ few Google engineers make that kind of money.

<comment><USER37> > And very, very few Google engineers make that kind of money.

You'd be surprised. In Mountain View, everyone level 6 or above makes at least that amount, and most level 5s probably do as well. I'd guess that probably 20% of engineers are T5 or above, which is a ton of people when you multiply by tens of thousands of engineers.

<comment><USER35> Very few as a ratio. There aren't that many T6's and I'm not sold on the idea that "most" T5's are making $400,000 when the average is around $350,000 according to levels.fyi.

</comment></comment></comment></comment></comment></comment><comment><USER38> I don't think it's so easy to sell a vulnerability on the black market. If you send the code first they will have no incentive to send the money, if you get the money, you might not send the code.

<comment><USER39> You don't have to send the quote, you can demonstrate it, e.g. on a dummy shared account where you bypass all quotas.

</comment></comment><comment><USER40> I have almost 15 years on the OP and aren't even half as talented. It looks like they've received almost $60k from Google across five bug bounties, very impressive.

</comment><comment><USER41> Any idea how such rewards get taxed ?

<comment><USER42> On the receiving end if you're non-US-based? You're supposed to figure it out yourself (ie. pay local applicable income tax), they just want a W8BEN.

Source: got a Google VRP reward.

<comment><USER41> so US government does not take an cut ?

<comment><USER39> The US govt doesn't take a cut if you pay an overseas contractor X for Y.</comment></comment></comment></comment>


XKCD "Hell" implemented in flash - <AUTHOR> http://www.swfme.com/view/1046212

<comment><USER2> Man can anyone have any fun these days without people coming in and saying the gravity is wrong, the arrow keys are broken, the lines don't disappear if you manage to get them all lined up, that its not that impressive this was put together because it's a mere physics simulation, and so on.

Does the high quality of posts on HN tilt us towards criticism instead of praise, even when it's not warranted? Clearly this was not posted for a code review.

<comment><USER3> _and saying the gravity is wrong, the arrow keys are broken, the lines don't disappear if you manage to get them all lined up_

I think those people simply forgot what the game is called. It's not a bug -- it's a feature!

</comment></comment><comment><USER4> Does Randall realize the power he has? If he wants something to be made or done, all he has to do is post a drawing of his idea, and someone brings it to life.

<comment><USER5> He should probably draw a liquid fluoride thorium reactor, then..

(If you don't know about the LFTR, check out this talk by Kirk Sorensen: <http://www.youtube.com/watch?v=AZR0UKxNPh8>)

<comment><USER6> It only take 48 hours to hack some flash together, might take longer for a liquid fluoride reactor...

<comment><USER7> It might also depend on how suicidal you're feeling. Check this out [http://pipeline.corante.com/archives/things_i_wont_work_with...](http://pipeline.corante.com/archives/things_i_wont_work_with/) and notice how many involve fluorine.

<comment><USER8> Notice also how many involve nitrogen - and you're breathing that right now!

Like nitrogen, the nastiness of flourine is _potential_. Most actual flourine composites, including those proposed to be used in reactors, are quite stable.

</comment></comment></comment></comment></comment><comment><USER9> Sadly, even if you can arrange for some blocks to line up in an approximate row, they don't disappear! Satan, you do not play fair, sir!

<comment><USER10> That's because you said an "approximate" row. If you get them exactly right it works out. All you have to do is get them jumbled together to fill in the round hole at the bottom and put the long straight piece horizontally across it. If you get if just right, then you can start balancing other pieces on top an come out with a perfect row. Then it disappears just like regular tetris. AWESOME!

Have fun!

<comment><USER9> Lies! or so I strongly suspect.

</comment></comment></comment><comment><USER11> Original comic: <http://www.xkcd.com/724/>

</comment><comment><USER12> Gravity needs to be just a little stronger.

<comment><USER13> I think the blocks need to be sticky, it might actually be playable if the blocks would stop bouncing around.

<comment><USER14> Maybe in Purgatory.

</comment></comment></comment><comment><USER15> I see Hell is located in a low-g environment

<comment><USER16> No, it's just slow motion. To make eternity seem longer.

</comment></comment><comment><USER17> My observations of the game mechanics.

0\. Once a piece touches another piece, you lose control of it.

1\. The weight of one piece can affect the balance of others.

2\. If you hold a piece against the side walls, it will stop descending.

3\. If you move a piece into the wall and then immediately away from it, you can put it into a slow spin while still being able to flip the piece.

4\. You can control the descent speed by tapping the down arrow. After each acceleration, the downward velocity resets when you stop accelerating. If you reduce the speed with which the pieces collide, the already stable pieces will not bounce as much.

5\. Getting something really close to a complete horizontal row does not cause the row to disappear. I have not yet achieved an arguably perfect horizontal row.

</comment><comment><USER18> It's a pretty fun little toy. More amazing though, is just how quickly this was hacked together. The comic was what, two days ago?

Incredible.

<comment><USER19> Not really...

<comment><USER20> Don't know why this is downvoted. The turnaround time for a functioning tetris game is very quick, within a day (even if you don't know the tools yet). This one isn't even a functioning tetris game, it's basically just a physics simulation (probably using an existing library) with very simple rules that are activated upon collision.

<comment><USER18> I'm not suggesting that this is The Technological Achievement of Our Age (TM), only that it's impressive that two days after the posting of a webcomic, that the comic's theme has been actualized. Tetris isn't a hard problem, and this almost certainly used a physics library, but it's impressive and amusing nonetheless.

Maybe I'm easily impressed, but _I_ think it's neat.

</comment></comment></comment></comment><comment><USER21> Alternative tetris hell: <http://qntm.org/files/hatetris/hatetris.html>

<comment><USER22> While not tetris hell <http://www.chroniclogic.com/triptych.htm> is a more polished "falling blocks with physics" game thats pretty fun (kinda old these days I guess)

</comment></comment><comment><USER23> Fun stuff. Has a fair number of bugs especially when the blocks are around the edges of the pit. And I think the edge of the bottom half circle always applies its reaction force upwards and not radially so it feels a bit unnatural (also the blocks cannot slide because of that). Still cool stuff though.

</comment><comment><USER24> now, all that's left is "sudo make me a sandwich"

</comment><comment><USER25> if you keep the right / left key pressed then the bricks dont move down! lol..

good job!

<comment><USER26> If you keep rotating a piece while holding left or right, the piece escapes hell.

</comment></comment><comment><USER27> This is genius.

<comment><USER28> Young people in Britain will call a tasty sandwich genius. That word will lose its meaning if we aren't careful!</comment></comment>


The scheme to bury Charles Dickens in Westminster Abbey, against his wishes - <AUTHOR> https://www.smithsonianmag.com/history/untold-story-charles-dickens-death-and-burial-180974126/ <comment><USER2> Trying to profit from someones death is unfortunately as old as mankind. From the company that orchestrated and managed the recent funeral of Muhammad Ali (against the best wishes of his family) to conspiring surrounding the death of Stalin. This dark comedy "The Death of Stalin" explains it best:

[https://www.imdb.com/title/tt4686844/](https://www.imdb.com/title/tt4686844/)

The company that controlled the funeral of Muhammad Ali:

[https://en.wikipedia.org/wiki/Authentic_Brands_Group](https://en.wikipedia.org/wiki/Authentic_Brands_Group)</comment>


An Analysis of the Transport Layer Security Protocol - <AUTHOR> https://pure.royalholloway.ac.uk/portal/en/publications/an-analysis-of-the-transport-layer-security-protocol(cccc276a-db90-48f1-ae88-07d0559f01cd).html <comment><AUTHOR> From the abstract - "In the development of the new version of the protocol, the IETF TLS Working Group has adopted an ``analysis-prior-to-deployment" design philosophy. This is in sharp contrast to all previous versions of the protocol. We present an account of the TLS standardisation narrative, commenting on the differences between the reactive development process for TLS 1.2 and below, and the more proactive design process for TLS 1.3. As part of this account, we present work that falls on both sides of this design transition. We contribute to the large body of work highlighting weaknesses in TLS 1.2 and below by presenting two classes of attacks against the RC4 stream cipher when used in TLS. Our attacks exploit statistical biases in the RC4 keystream to recover TLS-protected user passwords and cookies."

and,

"Next we present a symbolic analysis of the TLS 1.3 draft specification, using the Tamarin prover, to show that TLS 1.3 meets the desired goals of authenticated key exchange, thus contributing to a concerted effort by the TLS community to ensure the protocol's robustness prior to its official release."</comment>


Ask HN - How do we _effectively_ protest against web censorship in India? - <AUTHOR> India is becoming more repressive every passing year.
Semi-mainstream media term it "soft emergency" while the mainstream toes the Govt. line.
Now they take away the internet from us?
Damned we are if we allow this to continue.
How do we effectively counter this? <comment><USER2> We are very complex nation, this won't work. Here education politics won't work. Only Religion and Cast policy matters to them, and they know common man(mass) don't use internet, so their is no opposition from that side. They can legislate whatever to hide mistake. That is the reason they wasted parliament session on cartoon discussion. Many Educated class don't give damn about politics.

<comment><AUTHOR> How do we change that?

</comment></comment><comment><USER3> I ever dreamed of a p2p information system. you start and save a piece of message on your computer, and this information will spread out to connected peers.

from the government side, they can't tell who is the message starter, and there are so many redundancies. There is no single server to block.

of course, there are concerns about spamming. But spams may be filtered by voting.

but the gov can use this feature to censor information.

difficult problem.

</comment><comment><USER4> This website informs you how to file an RTI application about the blocked websites. They have a ready made template. They also have a template for a email to confront ISPs about the blocked websites.

[http://www.iltb.net/2012/05/why-a-rti-will-be-more- effective...](http://www.iltb.net/2012/05/why-a-rti-will-be-more-effective- than-taking-down-government-websites/)

</comment><comment><AUTHOR> We need to hurt them. They understand "vote-banks".

Let's form a vote bank that votes against the current incumbent for web censorship.

Please sign this petition: [http://www.ipetitions.com/petition/i-will-vote- against-the-c...](http://www.ipetitions.com/petition/i-will-vote-against-the- congress-party-for/)

</comment><comment><USER5> Vote. That is the most effective way to make your voice heard in a democracy.</comment>


New Star Trek Series Makes Massive Science Blunder - <AUTHOR> https://www.forbes.com/sites/stevensalzberg/2017/10/30/new-star-trek-series-makes-massive-science-blunder/#5372b7881b37 <comment><USER2> [https://news.ycombinator.com/item?id=15585924](https://news.ycombinator.com/item?id=15585924)

</comment><comment><USER3> We need to stop linking to sites that block ad blockers.</comment>


Best Practices for Online Forms to Increase Conversion Rate - <AUTHOR> http://www.tmcnet.com/topics/articles/2015/04/09/401260-best-practices-online-forms-increase-conversion-rate.htm

<comment><USER2> > Test and analyze your forms to continuously improve your results.

Always good advice in any sphere.</comment>


The Boy Scout Rule - <AUTHOR> https://dev.to/_arunsasi/the-boy-scout-rule <comment><USER2> This is extremely dangerous advice. Refactoring for the sake of cleaning up code invariably introduces bugs. Decent code coverage and automated tests can reduce the potential of this, but not guarantee it.

The boy scout rule is, do not leave it worse than you found. That includes breaking the software by performing an unnecessary rewrite.</comment>


World Scientists' Warning of a Climate Emergency - Jan 2020 - <AUTHOR> https://fermatslibrary.com/s/world-scientists-warning-of-a-climate-emergency <comment><USER2> There are many great scientists in this field and we should take heed of their warnings.

But this isn't an example of that happening. This is activism dressed up as science.

Their use of charts is a textbook example of how to mislead.

[https://twitter.com/SamuelPatt/status/1191787079820365830?s=...](https://twitter.com/SamuelPatt/status/1191787079820365830?s=19)

</comment><comment><USER3> Perhaps the most encouraging graph is "total institutional assets divested". Although I'm not sure "encouraging" is the right word at this point.

</comment><comment><USER4> Their letter refers to the first world climate conference of 1979. However, the letter which was written by the scientists back then to President Nixon (which led to the climate conference) said the opposite - that we were approaching an ice age:

[https://i.imgur.com/X0DSNU1.jpg](https://i.imgur.com/X0DSNU1.jpg)

So I find it disturbing that they don't mention that in this letter even though they claim they have been researching greenhouses gases causing warming since then.

<comment><USER5> CO2 research is much older than 1979 or even 1956.

[https://onlinelibrary.wiley.com/doi/abs/10.1111/j.2153-3490....](https://onlinelibrary.wiley.com/doi/abs/10.1111/j.2153-3490.1956.tb01206.x)

The first paragraph:

"CHAMBERLIN (1897, 1898, 1899) presented in detail the geological implications of the carbon dioxide theory. As a result of these early articles, during that eriod the carbon dioxide explanation of climatic change. In recent years the carbon dioxide theory has had relatively few adherents. Most authors have dismissed this theory with a remark similar to the following quotation from C. E. P. BROOKS (1951): the carbon dioxide theory was "abandoned when it was found that all the long-wave radiation absorbed by CO, is also absorbed by water vapor." This often quoted conclusion is based on early, approximate calculations of the radiation flux in the atmosphere. The results of more accurate calculations of the radiation flux have recently become available. Thus it seems worthwhile to reappraise the CO2, theory of climatic change."

Climate change is treated the same way it is today. People refuse to believe it, waste time doing nothing and then the pressure to ignore the problem grows with every single year fueling a vicious cycle.

<comment><USER6> _People refuse to believe it,_

The essence of the scientific method is testable predictions. When it keeps not happening, the perfectly rational - in fact _scientific_ \- response is to discount it. If you want to blame anyone blame the scientists who overegged the pudding once too often.

The ice age, acid rain, holes in the ozone layer etc etc were all presented by scientists as imminent existential threats, yet none of them materialised as such. Obviously "doom fatigue" has set in amongst the general population.

<comment><USER7> You are correct the essence of science is repeatable predictions. Sadly I don't think the majority demographic of HN was around to see all the other fear mongering that happened in decades past, so they just down-vote and move on, not thinking about what science actually entails. All of those real environmental issues where dealt with, in measured response and we survived. If we had listened to the extremists agendas we would have all started living in mud huts instead of taking lead out of gas and banning CFC's. There are real environmental disasters happening like the reef's dyeing near agricultural runoff and deforestation due to industrialization. These real issues get drowned out by this incessant fear mongering that cannot make an accurate prediction, because they try to conscript every disaster as being related to AGW, then the predictions go south when they try to support their claims. Fixing CO2 is not going to save the reefs, getting rid of nitrogen and phosphorus runoff from agricultural farming will. We know this for a fact, we have repeatable test that prove it conclusively. Fixing CO2 will not stop deforestation, the increase in CO2 has actually lead to a greener earth, controls on logging, returning to sane preventative burning policies and limiting growth into forest areas will.

<comment><USER6> _I don 't think the majority demographic of HN was around to see all the other fear mongering that happened in decades past_

I suspect you're correct. I remember when I was a child the children in my village were not allowed to play outside for a while because our parents had seen or read scare stories about acid rain and thought we would be burned by it! But I don't believe there was a single case in Wales of a child being dissolved... and it rains here every day!

<comment><USER7> This piece is far short of a scientific paper, it has all the tells from proclaiming a vegan diet as healthy to advocating for population controls. This is not science it is an agenda paper. I mean what in the world does full gender equality have to do with the climate. I have no idea but it's in the papers conclusion as a must do to contain climate change. And why is a scientific climate piece advocating for social and economic justice.

<comment><USER8> Because environmentalism is either in the process of, or has already been hijacked by leftist radicals. Why does the Green New Deal Bill spend so much ink talking about universal healthcare, housing security, and labor unions?

Environmentalism is not an inherently leftist concept. Basic economics recognizes that externalized costs like pollution can lead to market failure. But instead of trying to build a coalition to push things like carbon taxes, leftists have co-opted the movement to peddle socialism.

<comment><USER9> > Because environmentalism is either in the process of, or has already been > hijacked by leftist radicals.

Environmentalism has always been a cause of the (mostly, as now, center- rather than radical-) left.

> Why does the Green New Deal Bill spend so much ink talking about universal > healthcare, housing security, and labor unions?

Because, as the name suggests, it is intended as a New Deal that is also Green. Sure, it's a left-of-center proposal. But where, if environmentalism isn't inherently left, is the equally strongly advocated proposal from the right?

The left isn't hijacking environmentalism, they are just the only group showing up for it.

> Basic economics recognizes that externalized costs like pollution can lead > to market failure.

Basic conventional economics does recognize that, but that center-right isn't interested in much policy action based on that, and farther right factions reject conventional empirical economics for openly ideological schools that hold that markets can't fail they can only be failed.

> Environmentalism is not an inherently leftist concept

It's inherently inconsistent with the capitalist doctrine that is universal in the center-right to right. It's not fundamentally incompatible with some of the not-exactly-capitalist economic views of the far right, I guess, but it has other conflicts with most of them.

> But instead of trying to build a coalition to push things like carbon taxes

Left environmentalists would try harder to build a compromise coalition with other environmentalists around solutions that weren't specifically tied to other left-wing agenda items if, you know, any other environmentalists were showing up.

> leftists have co-opted the movement to peddle socialism.

Nah, it's using socialism to overcome the working classes natural resistance to policies whose broad outcomes they would prefer, but who know that without some guardrails the capitalist class is going to assure that the working class pays all the (gross) costs and more. That is, it's using socialism to peddle environmentalism, not the other way around.

<comment><USER6> _Environmentalism has always been a cause of the (mostly, as now, center- rather than radical-) left._

This absolutely is not true. Who is, by a massive margin, the top polluting nation right now? Communist China. The Soviets did plenty of environmental damage also. Meanwhile the Western capitalist countries are all on a downward trend for emissions.

The "rapid industrialisation at any cost" approach is an essential hallmark of socialism, always has been. Human lives are of no importance to it, let alone plants or animals.

<comment><USER9> > > Environmentalism has always been a cause of the (mostly, as now, center- > rather than radical-) left.

> This absolutely is not true.

Yes, it's true.

> Who is, by a massive margin, the top polluting nation right now?

Per capita? The top three (and they are very close to each other, with a decent gap to number 4) are Saudi Arabia, Australia, and the US.

> Communist China

Sure, the PRC is high in aggregate for the same reason that, say, Qatar is low in aggregate. (OTOH, Qatar is pretty high per capita.)

Also, even if the ROC was as bad as, say, the US, I don't think anyone has ever described the ROC as center-left.

> The "rapid industrialisation at any cost" approach is an essential hallmark > of socialism

No, it's a hallmark of underdeveloped countries seeking to escape or protect against foreign domination, whether there governments are communist, right- wing nationalist, or anything else.

It's also a hallmark of unrestrained _capitalism_ ; the downward trend in Western mixed economies is a result of center-left environmentalist interest restraining capitalism.

</comment></comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER10> Yawn

<comment><USER11> imminent human suffering, isn't it so passé? when's the next javascript framework?

<comment><USER10> Keep telling yourself that

<comment><USER11> tell us the future, oh mighty oracle, whose sight is beyond the limits of science and reason, so that we may be enlightened.</comment></comment></comment></comment>


IPad Name Conjures Up More Than Intended - <AUTHOR> http://www.nytimes.com/2010/01/29/technology/29name.html?hp <comment><USER2> "A lot of women when they hear the word 'pad' are going to think about feminine hygiene."

Much like they do when they go in to a stationary shop and buy a "pad of paper"? I love how half the world have managed to transform themselves in to pubescent teenagers over this name.</comment>


Ask HN: Server under heavy load. Any downside to this hack? - <AUTHOR> The server hosting one of our live apps is under high loads and gets into a state where it stops responding to http requests several times a day. These outages last typically anywhere from a few minutes all the way up to half an hour or so.
The major culprit here is MySQL load and we've been working on optimizing this (those interested can refer to my previous thread on this: https://news.ycombinator.com/item?id=6348903).
For now we've found that restarting the httpd and mysqld services brings things back to normal almost immediately.
While we continue to work on a - more elegant - solution, we're thinking of writing a bash/shell script that runs on hourly cron, checks load average (via uptime or /proc/loadavg) and if found higher than a threshold, restarts the services.
Can anyone think of any downside to this (used at least as a temporary measure)? <comment><USER2> I've had load issues in Postgres, not MySQL before and it was due to autovacuum running on tables getting updated/inserted frequently. I'm not sure what the equivalent in MySQL is, but if you have a ton of insert/update queries, consider archiving your tables after a certain period of time, so that your main table doesn't have ton of rows. You can consider sharding of course, but also consider sharding the actual tables in the same database. An insert query on a table with 1000 rows will take much much less time than an insert query on a table with 100 million rows, all things considered.

Also, consider creating a buffer in the application layer that buffers inserts/updates and executes them once as a single transaction, if they don't need to be executed immediately. It puts less stress on the database. Of course, this would require a lot of rewriting in your app, so not sure if you want to go through this route.

Indices are another area. I'm sure plenty of people have told you to optimize your indices, but also consider REMOVING unnecessary indices. Do you have an index on a text column, or multiple varchar columns? Those can be killer after awhile because inserts will slow down. Consider changing indices on varchar columns to indices on an int column by hashing those strings.

A quick suggestion: Install NewRelic (it's free for a certain period), and check out the database transactions that are taking up the most CPU load. Sometimes there's that 1 query you overlooked that is table scanning and could be the main culprit.

Also, are you using Rails by any chance? If so, there are other areas I can suggest.

And please post your server specs. Maybe your VPS just does suck (no offense), and the easiest route is just to upgrade your server.

<comment><AUTHOR> Thanks for your in-depth reply and suggestions.

MySQL performance tuning and table structure/query optimization-wise, we've left few stones unturned (but I'm sure there still is a scope for further improvement - isn't there always?).

Not using Rails.

Server specs: 4 cores, 3.2GB RAM

>and the easiest route is just to upgrade your server.

Please refer to the other thread for more on this.

Thanks again.

<comment><USER2> I hope you're paying less than $10/month because you can get a dedicated server with 10 times more RAM here: [http://www.ovh.com/us/dedicated- servers/](http://www.ovh.com/us/dedicated-servers/)

And how many reads are there usually a min? writes?

<comment><AUTHOR> Paying way more than $10/mo for the VPS, close to 200 - and hey!! thanks for the ovh.com link - looks very interesting, will certainly try them out soon. Thanks.

</comment></comment></comment></comment><comment><USER3> Restarting the processes isn't really solving the problem. What is the actual bottleneck? It should be possible to figure this out.

I think your first problem is that you are using a VPS. You should never use a VPS in a high load situation like this - buy a dedicated server! They only cost about $70/month, which you should be able to afford if you have a successful site. Ideally you should get as much RAM as you can afford and/or an SSD drive.

I know you said you didn't want to throw hardware at the problem, but there are limits - you can't run a massive database on crappy hardware and expect it to work smoothly.

<comment><AUTHOR> >What is the actual bottleneck?

As mentioned in OP, it is MySQL.

>you can't run a massive database on crappy hardware and expect it to work smoothly.

Absolutely... but we do wish to milk the VPS for every cent of its worth and we're not sure we've got there yet.

Thanks for your input.

<comment><USER4> > As mentioned in OP, it is MySQL.

That's not specific enough.

Yes, the problem is manifesting itself via MySQL, but the bottleneck will be somewhere else; whether RAM, CPU, or I/O-wait.

<comment><USER3> Exactly. If the OP can post the output of top, vmstat and iostat both when the problem occurs and after restarting the processes, that would be a start. There might be some simple thing you can tweak to improve things.

<comment><AUTHOR> Will try and post within a few hours. Thanks.

</comment></comment></comment></comment></comment><comment><USER5> > For now we've found that restarting the httpd and mysqld services brings > things back to normal almost immediately.

You need to examine the restart process and analyze why it resolves the issue. If the reason is the abandonment of dead parasitic processes and memory leaks, you need to find out why and correct them. If the reason is that the restart unceremoniously drops all the current transactions, you need to increase capacity.

> Can anyone think of any downside to this (used at least as a temporary > measure)?

I certainly can -- a bunch of really irritated visitors, whose transactions are abandoned. But that's only true if that is actually what's going on. Make sure you don't have software issues that are preventing efficient operation. If that's not the issue, you need to grow with your customer base -- increase server capacity.

<comment><AUTHOR> >You need to examine the restart process and analyze

Like I said in OP, we've identified MySQL to be the primary bottleneck and are already working on resolving this.

>whose transactions are abandoned.

At least some saving grace here... we're not selling anything... it is purely a content site

Thanks for your input.

<comment><USER5> >Like I said in OP, we've identified MySQL to be the primary bottleneck and are already working on resolving this.

Ah, yes. I remember from your prior post that you have very large databases and table sizes and are considering (or have begun) partitioning the largest tables. It turns out there is an innate partitioning scheme built into the most recent MySQL versions, but it has to be compiled into the running binary by way of a compiler flag:

[http://dev.mysql.com/doc/refman/5.1/en/partitioning.html](http://dev.mysql.com/doc/refman/5.1/en/partitioning.html)

I apologize if you've already heard this, or if it's already in place as a partial solution.

<comment><AUTHOR> Yes, we did investigate MySQL's internal partitioning option briefly before deciding to roll our own scheme (which, after working quite well initially, is now beginning to create problems of its own).

Perhaps, it is time for us to revisit this. Thanks again Paul.

</comment></comment></comment></comment><comment><USER6> Crude check but since it's temporary, an hour seems far too long an interval, you check at 10GMT , by 10:05GMT your server is in trouble and has 55 minutes to crap out. I would check every */5 minutes at least.

<comment><AUTHOR> Good call - thanks :)

</comment></comment><comment><USER7> I would be really worried about losing requests in-flight or that take a long time to run.

Is it prohibitively expensive/time consuming to get (or borrow) a bigger machine (on EC2, or in your colo, or what have you) to run MySQL on until you've figured out how to shard / scale out your application?

<comment><AUTHOR> We are actually more than worried too, because we _know_ we're losing plenty of requests daily so trying to cut down the losses temporarily while we figure out a more long-term solution.

For the rest, this thread might give you some more info on the issue: [https://news.ycombinator.com/item?id=6348903](https://news.ycombinator.com/item?id=6348903)

</comment></comment><comment><USER8> If you haven't already done this, when the mysql server is having trouble make sure you connect through the terminal and try:

> SHOW PROCESSLIST

This will show all active queries and the time they have taken to execute. The fact that the server seems to churn to a halt and then work its way through the problem suggests the issues are related to specific queries you can catch this way. Then use the EXPLAIN command on the slow queries to figure out why they are hanging your server and add indexes or tweak that part of your code (avoid joins on large tables, etc.) as necessary.

<comment><AUTHOR> Yes, as mentioned in the other thread, we're way ahead of this - but thanks for your input all the same.

<comment><USER8> k, good luck!

</comment></comment></comment><comment><USER9> It seems pretty clear that you don't have enough experience on your own to resolve this properly, so call in some help. It may be possible to make an architectural change that significantly reduces the resources you need, or perhaps you'll find that you unavoidably need more resources to do what you want. Someone who knows how to diagnose and analyze this properly can tell you that.

<comment><AUTHOR> >so call in some help.

As is being discussed in the other thread.

</comment></comment><comment><USER10> while the root cause should be fixed ( sound like you're working on it ). consider using monit for the restarts instead of cron :

[http://mmonit.com/monit/](http://mmonit.com/monit/)

<comment><AUTHOR> Wow!!! Didn't know about this - took a quick look and found it very interesting. Thanks.</comment></comment>


Partisan Bias Diminishes When Partisans Pay - <AUTHOR> http://marginalrevolution.com/marginalrevolution/2013/06/55494.html?utm_source=dlvr.it&utm_medium=twitter&utm_campaign=Feed%3A+marginalrevolution%2FhCQh+%28Marginal+Revolution%29 <comment><USER2> Imagine you honestly believe in intelligent design. You probably know most people believe the opposite, so when you encounter poll designed by people you don't know you assume they believe evolution theory is true, so if you want to win money you say whatever it takes, no matter what you believe.

So IMHO this experiment measured how well people predict what experimenter thinks is correct, and not how people beliefs change when incentivized.

To control for this divide the group that gets money into 2, and say to one subgroup you're republican think-tank, and to the other you're democrat think- tank, and compare the results :)

<comment><USER3> _Imagine you honestly believe in intelligent design. You probably know most people believe the opposite, so when you encounter poll designed by people you don't know you assume they believe evolution theory is true..._

That's a poor example that demonstrates your own ignorance about the USA as a whole.

In the USA more people believe in creationism (God created everything 6000 years ago) than intelligent design. And far more people believe in intelligent design than evolution.

See [http://www.gallup.com/poll/155003/hold-creationist-view- huma...](http://www.gallup.com/poll/155003/hold-creationist-view-human- origins.aspx) for the numbers. It is worth noting that belief in evolution is within a factor of two of belief that Obama is a Muslim (about 20%) and belief that Elvis is still alive (around 7%).

<comment><USER4> You are missing the forest for his tree example.

He was using creationism as a means to illustrate a point: that the responders probably tilted their responses towards _what they thought the researchers believed_ instead of what they themselves believed.

<comment><USER3> Obviously I understood his point.

My point remains that the USA is much less accepting of science than most educated people in a bubble of similarly educated people will realize.

</comment></comment></comment></comment><comment><USER5> But is there any way to exploit this effect? I am a big believer in federalism and even further devolution of power to smaller polities. It's a good tradeoff of liberty vs. society: If you don't like the way your city is run, it's a lot easier to move to the next town over than it is to leave the country. As a result, despite being a pretty _laissez faire_ guy, I'm much more tolerant of, say, San Francisco banning plastic shopping bags than if the EPA were to do so.

It also has the pleasant result of giving voters much more direct control over the way the government that affects them most is run. Their vote really does matter; it is, in many ways, a "bet" on which policies will provide the best outcomes for them.

<comment><USER6> The problem of federalism is that a lot of polities will be shitty and the rest of the country won't stand for it. Segregation would still probably be legal in many parts of the country if the federal government hadn't put the states in their place in the 1960's and 1970's.

Also, how do you reconcile glorification of federalism with the fact that the level of corruption and general terribleness in the big state governments is far worse than that of the federal government, despite the federal government being much larger and more extensive? Would you really rather devolve power from the federal government to California, Illinois, New York, Texas, or Florida? Ohio, Georgia, Massachusetts? Sure, as you say you can move, and that's a fair point, but the only states that are arguably well-run are the ones that are also insignificant in terms of population and GDP (or have economies based on unsustainable things like federal spending (Virginia), oil resources (the Dakotas), etc).

<comment><USER7> _Segregation would still probably be legal in many parts of the country if the federal government hadn't put the states in their place_

Segregation would still probably exist without the feds stepping in therefore let's spend trillions of dollars a year driving our economy into the dirt.

Then on the other side, you have the Dred Scott Decision, the Fugitive Slave Act and many other Federal moves that prolonged slavery in this country. Would it not have been for the northern states and churches, the Federal Government would have been able to keep slavery itself in place.

Bottom line is that we want to maximize freedom for individuals and small group decision making wherever possible. Larger entities should only step in when individuals or small groups can't work it out for themselves.

<comment><USER8> The federal government decisions that prolonged slavery were animated by the interests of states that would without a strong central government still have slavery, and impacted mostly those states, so I'm not sure that helps your argument much.

<comment><USER9> You actually think that these states would still have slavery? To this day, thirty years after the last country in the world (Mauritania) abolished it?

<comment><USER8> Segregation would still be de-jure lawful in Alabama, in the same way that sodomy laws were still technically enforceable in Texas until struck down by SCOTUS.

</comment></comment></comment></comment></comment></comment><comment><USER10> Getting people to make decisions that directly impact them is a good way of figuring out which beliefs they actually use to predict the behavior of the world and which beliefs they only profess but in some way know are false.

Consider someone who claims "I have a dragon in my garage.". When someone asks to test that claim by looking, you say it's an invisible dragon. When they then say they'll listen to the dragon breathing, you say the dragon doesn't need to breathe. If they offer to throw a bag of flour over it and see the shape of the flour-covered dragon, you say the dragon is permeable to flour. Despite saying you have a dragon in your garage, all your predictions are based on not having a dragon in your garage. If you _actually_ thought you had a dragon in your garage, you'd say "sure, let's see"; you should be perfectly willing to test that claim and accept the result. (Credit to <http://lesswrong.com/lw/i4/belief_in_belief/> for the dragon example.)

The same lines of experimental questioning can generally distinguish between "I truly believe this and use it as a model to predict how the world works" and "I profess this but when it comes time to predict how the world works I do so using a model that actually _works_.".

On the other hand, if you build a system that rewards people for how strongly they profess their beliefs, and how much confirmation and support they get from others professing the same beliefs, you can give strong positive reinforcement to beliefs that do not model the world.

<comment><USER11> There is a problem with the invisible dragon.

If your believer is aware that the strongest alternative to their belief that there is a dragon in the garage is that there is no dragon, they will tailor their explanations to your perspective. That doesn't prove they share your perspective deep down if they could just admit it to themselves, it just means they understand you.

<comment><USER10> It doesn't matter whether they understand the other person's beliefs or not; the question is, what do they actually believe experiments will show about the world, before performing the experiments? If they truly _expect_ that there's a dragon in their garage, they'll expect results consistent with having a dragon in their garage; if they don't actually believe that, they'll make predictions consistent with not having a dragon in their garage.

<comment><USER11> They believe that you will see X because you believe Y, while they will see P because they believe Q. They believe that Y-ers' worldviews cause them to interpret P as X, and blind them to seeing X as P. They don't believe that there is a neutral substrate of observation that everyone can agree on beforehand.

I don't completely disagree with what you're saying, I am just trying to point out that the game goes many levels deep. A strategy that leads to victory on level 1, "tell me more about this dragon", is not going to work on level 2.

</comment></comment></comment></comment><comment><USER12> A major problem with this experimental setting, and the proposal that bets signal belief, is that they ignore the system the bets are placed in.

As students observe, "the right answer" depends on who's doing the judging. Most students have learned to answer not what they believe, but what they believe the examiner wants to hear. This is a fairly important skill, as many examiners are incapable of asking even unambiguous questions.

On the other side of the equation, information signalled in a bet is tainted by the signaller. The answer they give is not necessarily their "honest belief", but rather what they wish to signal as such. Much of high-stakes information, such as in politics, commerce, and warfare, is valued opaquely, for the purpose of enticing onlookers to act on the bets that they do see, which can be counter to the interests of the bettor.

</comment><comment><USER13> This effect doesn't go away entirely though (as was admittedly stated in the article).

In political betting markets, you can almost always find a +EV bet by betting on the most likely candidate to win because those who are on the side of the underdog always overprice their candidate's chances, some of this can be attributed to buying into the neck-and-neck rhetoric.

<http://en.wikipedia.org/wiki/Favourite-longshot_bias>

</comment><comment><USER14> Another commmenter hit this, but it deserves underlining.

You can't ask the question of whether certain statements, to the people giving them, are matters of fact or political opinion, and then have "correct" answers which are provided by others. If you have correct answers, you already know that certain opinions are based on error. The only thing you can do with such an experiment is measure how well people can guess what the judges think to be true. As it turns out, they did fairly well.

I could care less about this example, but let's take the WMD question. Old WMD was found in Iraq. [http://en.wikipedia.org/wiki/Iraq_and_weapons_of_mass_destru...](http://en.wikipedia.org/wiki/Iraq_and_weapons_of_mass_destruction#Chemical_Weapons_Recovered)

A partisan wouldn't argue the facts. He'd simply point out that, depending on how you phrase the question, the answer could be interpreted either way. The questioner has to rephrase "After the second Gulf War, were WMD found that were created in between the two wars?"

This easily goes to extremes, and questions end up being extremely detailed in order to resolve matters of "fact" This is why the role of fact-checker is a waste of time. Most all of the time, politicians aren't lying, they're simply phrasing things in enough ambiguity to create the desired impression. (This actually works for me as "bullshit", but it's not lying, and it's not giving out factual errors)

<comment><USER15> I find this line of argument very unconvincing. Would you apply it to the question of whether inflation and/or unemployment went down during Regan's term? Do you really think this has anything to do with the precise definition of those quantities?

<comment><USER16> I think you picked a poor example, because inflation is hard to measure and hard to define.

I know lots of people who argue with our current definition of inflation using reasonable-sounding arguments.

<comment><USER17> Inflation is only hard to define for those who want there to be something called "inflation" that predicts recessions and is caused by the government. Naturally it's hard to find anything to nail down within those parameters.

In the rest of the world inflation equals price increases and there are standard metrics that have been used for decades. Most economists would probably agree that those metrics have several well-known flaws. But we can agree that inflation according to the definitions and metrics that 99% of the world uses did or did not change by X or Y in a given time period.

<comment><USER16> The fact that the existing metrics are flawed mean that it's perfectly reasonable for a person to both:

(a) Believe one thing (b) Understand that the "accepted fact" contradicts their belief

If no money is on the line, this reasonable person will state their belief. If money is on the line, they are more likely to state whatever they think the "accepted fact" is, regardless of their true belief.

In politics, there are many things for which minor differences in interpretation can cause a "fact" to change between true, false, and unknown. Inflation is certainly one of those things.

</comment></comment></comment></comment></comment><comment><USER18> Too bad there isn't anymore a great prediction market. This could be a nice opportunity for bitcoin.</comment>


Ask HN: Any good Photoshop tutorials for front end developers? - <AUTHOR>

<comment><USER2> I recommend searching <http://webdesign.tutsplus.com/> and <http://net.tutsplus.com/>

</comment><comment><USER3> Can you be a bit more specific about what you want to learn?</comment>


Parse Launches Web Apps with the Express Web Framework - <AUTHOR> http://blog.parse.com/2013/06/04/building-parse-web-apps-with-the-express-web-framework/

<comment><USER2> I believe that within a few years most of the JavaScript programmers out there who are afraid of VMs are going to realize that it really isn't that hard to deploy Node (or anything else for that matter) to Linode, Rackspace, Digital Ocean or AWS.

Until then, they will continue to pay crazy markups to Heroku or live with limitations like with the new Parse service that doesn't let you install any Node packages (there are 31000 and counting now in the npm registry <https://npmjs.org/>).

Linode even has a StackScript that sets up Node for you. And AWS has something similar with a Node AMI (in the marketplace at least). Or you could just copy paste like 10 lines of code from the Node.js wiki. Or find a script online to do it.

I would honestly like to know what is it that, say for example Parse, has done with their VM configuration that is so much more sophisticated than what people could get from following a few wiki pages on the web, or just getting a good bash script. Because I doubt that there are a lot of extra security or performance features or anything like that.

Configuring and running an Ubuntu server is not that hard.

But maybe it is. Maybe I am just really ignorant and there is some kind of complex configuration or tuning or firewall or daily task that Parse or some other Node.js hosting company is running on their servers that is completely beyond me or that I would never be able to find out about from the web. But I think that for 95% of people nothing complicated is really required.

I really appreciate any hints about Linux server management to clue me in if there are a lot of commands that I should be running on my servers that I am not aware of.

What I know is that my Ubuntu Node servers get running and stay up without me entering a lot of commands or doing a lot of monitoring or anything else.

If you go with AWS, they have a built in interface for the firewall in the browser. You don't even have to use a command line. Although honestly in Ubuntu how hard is sudo ufw enable; sudo ufw allow [port]

<comment><USER3> It's not hard to install nodejs, and then you need forever or w/e to keep it running, you need that to start on boot, you need pingdom or whatever to monitor it, you need your haproxy or nginx for load balancing, you need to decide what to log and how to store those files beyond megabytes, maybe you need ssl, you need a way to get the next version running, and you need to be able to fix it when stuff goes wrong.

All of those things are just distractions from whatever your project really is. Are you building software or are you dicking around with servers?

<comment><USER2> 99% of Node applications do not need any load balancing. 1% are Twitter or something. And even a lot of the 1% would do it at the application layer using multiple VMs.

And I bet that most of the Heroku apps on Node that use multiple dynos really only need multiple dynos because Heroku's dyno isn't giving them realistic resources on the dynos, i.e. less than one small AWS or Linode or whatever.

Forever will not keep your Node application running. If you Node application crashes, forever will let it crash, and then run it again, and if it crashes again, it will run it again, and it will crash again.

There used to be basic gotchas in HTTP/Express that made it really easy to have an exception thrown that would take down a Node web server. I am not sure those are already there, but anyway I do what every Node expert advises against and include and uncaughtException handler in my Node web servers. That keeps them running. If I take it out, the effect is that they go down briefly, and forever restarts them. So honestly I see no benefit in most cases to using forever except to make it a little bit harder to figure out how launch your application.

And the thing with automatically restarting when a server reboots, honestly my servers very rarely reboot. If they are going to reboot then the VM (VPS) provider gives me warning and lets me control it. So for 99% of applications out there, an upstart or whatever to restart your Node application really isn't that important.

Contrary to popular belief, you do not need to install nginx in front of every Node application.

I will give you the SSL one, that could easily take a good UI developer 2 or 3 days to find the right instructions on Google.

<comment><USER3> You are correct, with enough experience it will suck a smaller amount of time and attention away from your actual project.

Unrelated to the core argument, I think much of what you just posted is bad advice - forever will restart your app above and beyond uncaughtException, nginx or haproxy let you add redundancy on independent processes if not machines, and restarting your site manually on reboot is ludicrous.

</comment></comment></comment></comment><comment><USER4> Sometimes, companies like Parse make me think having quality backend engineers is unnecessary for a startup. AWS made it cheaper to run scalable applications, Heroku made dev ops ridiculously easy, and Parse may eliminate the need for backend engineers. The outcry against Parse amongst some of friends who are backend developers is reminiscent of factory workers who feared the advent of machines.

<comment><USER5> Wait what? I think your going a bit far there.

I mean for prototypes, proof of concepts, and maybe 2 man fly by night 'startups' trying to get initially backing to hire backend engineers, great idea. I can even see certain 'startups' may be profitable and sustainable and just never need to invest in 'custom' backend code.

But as a general rule of thumb, in no way should software startups that base their existence on client server software possibly think its a good idea to have no one in house who actually knows how to do server software.

<comment><USER4> Obviously, startups need to scale at some point, and to do that they need experienced backend engineers. However, when a startup is still searching for product-market fit and doesn't have an influx of users, it doesn't make sense to spend a lot of time and effort attempting to build a scalable backend that probably won't scale anyways. With cloud code and now integration with Express, there are almost no performance tradeoffs to using Parse for most early stage startups.

<comment><USER5> In certain situations yes, in general no.

Its just not that hard to do a 'serviceable' back-end behind a simple rest API. I mean how many hours is that really going to take you, especially when you consider in the case of parse users they already know what data entities their application uses? A REST API for a dozen or so already defined entities, maybe a weeks worth of work? And then look at what it buys you, actual control over your data, ability to move from parse and pursue cost cutting alternatives, ability to do in depth analysis of your data...

I absolutely think Parse has great value, but when the statement is made that in general it might replace back end engineering for startups... its just wow man. This is precisely why a person who understands the server side of a client server application should in general always be involved if the business is based around client server applications.

<comment><USER4> 1 week is eternity for a startup. A custom backend not only adds time to the initial build of the product, but it makes iteration increasigly complex. What happens if you restructure the product and kill half your features? Rebuild the backend yet again?

The only thing that matters for a young startup is finding product-market. Parse makes that process more efficient than ever.

A person who understands backend engineering would understand the value that Parse provides.

<comment><USER6> Even a mediocre developer should be able to put together a workable prototype of a simple web app and/or API well within a single week, including setting up web servers, databases, and other basic infrastructure.

Experienced developers are often much faster and more efficient. This is especially true if they're using a language like Python that is quite suited to prototyping, and already offers so much pre-made functionality in the form of libraries and frameworks.

Many of us have learned to be very skeptical of these services that claim to allow software systems to be build rapidly. This often only holds true in a very, very small set of cases. Otherwise, the moment you try to do something unique or unusual, you'll hit one roadblock after another. It doesn't take long before the supposed "time-saving" or "effort-saving" service has wasted more time and effort than it would have taken to develop everything from scratch.

<comment><USER7> I just had this discussion with my friend today. While it is true that building a simple simple api from scratch is pretty quick, the hack-it-super- quickly api gets really hairy really quickly. Later you have to spend a lot of time refactoring to make the API scalable and easy to add endpoints and functionality. And usually you realize you have to refactor when the poop starts hitting the fan and the hacked together solution isn't holding its weight anymore.

</comment></comment></comment></comment></comment></comment></comment><comment><USER8> It seems that, one by one, the MBaaS players are realizing that in order to be "complete" solutions they need to offer the ability to execute arbitrary code on the server. You can see examples of this for Kinvey [1], Azure Mobile Services [2] and Cloudmine [3].

Of course, they all do is slightly differently, and there is generally more sandboxing than what you would expect from a traditional PaaS like Heroku. The danger is that by being more complete, they lose focus on their original mission: to bring powerful app-centric functionality to traditional client- side developers.

[1]:<http://devcenter.kinvey.com/nodejs/guides/business-logic>

[2]:[http://msdn.microsoft.com/en- us/library/windowsazure/jj55422...](http://msdn.microsoft.com/en- us/library/windowsazure/jj554226.aspx)

[3]:<https://cloudmine.me/docs/servercode/javascript>

<comment><USER2> I have a solution: drop the normal VM-based servers and instead use WebRTC or some other peer technology so the client (browsers or whatever) talk to eachother directly.

Unworkable because of security you say? Add encryption.

I actually think that not too many years down the line this type of thing will be common.

</comment></comment><comment><USER9> So, it's nodejs hosting with the only dependency available being expressjs. Seems very restrictive.

<comment><USER10> The idea of course is that you'll use Parse for your datastore, authentication, etc. For a number of use cases Express + Parse API is fully adequate.

</comment></comment><comment><USER11> So many 'new' technologies to play with, so little time :(. These are awesome web dev times we are living in.

</comment><comment><USER12> We just blogged about how you can build a Parse web app with the Express web framework within the browser.

[http://blog.nitrous.io/2013/06/04/build-parse-web-apps-in- th...](http://blog.nitrous.io/2013/06/04/build-parse-web-apps-in-the-browser- with-nitrous-io-and-express-framework.html)

We're still in private beta, but we will be moving to public beta very soon. If you want an invite sooner, ping us on Twitter at @NitrousIO.

</comment><comment><USER13> Can someone translate this for me? I'm not sure what it would mean to have 'Parse Hosting', 'Cloud Code', etc... I've only recently started to learn nodejs and didn't have any trouble pushing my tutorial made app to Heroku. Is this just an alternative to Heroku that hosts your app?

<comment><USER14> It think it's just an easier way for Parse users to do server-side rendering of their single-pag apps. To be honest, I don't even think that's right.

They're coming out with all these interested disparate services, they need to provide a coherent story for how developers can use them together. Maybe a sample app or two.

<comment><USER15> They posted two sample apps on the article:

AnyBlog: <http://www.anyblog.co>

Source: <https://github.com/ParsePlatform/AnyBlog>

AnyMeme: <http://www.anymeme.org>

Source: <https://github.com/ParsePlatform/AnyMeme>

</comment></comment></comment><comment><USER15> Seeing as I've used Heroku mostly for Express apps this sounds appealing to me.

There does not seem to be support for anything like Procfile or package.json / npm, though.

<comment><USER16> Parse doesn't provide a node.js environment. It's a custom V8 runtime environment, with commonjs and node-like modules. It's really neat, but it will be interesting to see how they maintain/extend a "node like" environment that's not really node. They run the risk of confusing developers who expect to do anything they can do in node.

</comment></comment><comment> hidden-markov Could someone please explain me, how they are different from any other cloud PaaS?

<comment><USER17> More expensive and less features.

</comment></comment><comment><USER18> Foreseeable roadmap for Web Sockets?

</comment><comment><USER19> Wow, it's interesting to see how these data in the cloud services are backing into custom code, instead of starting with custom code hosting and backing into more of a PAAS approach.</comment>


An Instagram bug showed 'camera on' indicator for iOS 14 without taking pictures - <AUTHOR> https://www.theverge.com/2020/7/25/21338151/instagram-bug-camera-privacy-ios14-apple <comment><USER2> dupe: [https://news.ycombinator.com/item?id=23950892](https://news.ycombinator.com/item?id=23950892)

</comment><comment><USER3> Editorialized title. Article confirms its a bug in iOS and not Instagram's fault

<comment><USER2> No it isn't (outside shortening to fit to HN title length I assume), and no it doesn't? It clearly quotes an _Instagram spokesperson_ saying it's a bug and that _Instagram_ is fixing their app?

<comment><USER4> The full wording:

"We found and are fixing a bug in iOS 14 Beta that mistakenly indicates that some people are using the camera when they aren't,"

makes it sound like the bug is in iOS, which is exactly how they want it to sound. and they want people like above to confuse make it seem like facebook did nothing wrong. facebook never does anything wrong.</comment></comment></comment>