1. 3

    Is there a comprehensive and/or up-to-date set of recommendations for simple, static HTTP servers anywhere?

    After years of trying to lock down Apache, PHP, CMSs, etc. and keep up to date on vulnerabilities and patches, I opted to switch to a static site and a simple HTTP server to reduce my attack surface and the possibility of misconfiguration.

    thttpd seems to be the classic option, but I’m a little wary of it due to past security issues apparent lack of maintainance (would be fine if it were “done”, but security issues make that less credible). I’m currently using darkhttpd after seeing it recommended on http://suckless.org/rocks

    Edit: I upvoted the third-party hosting suggestions (S3, CloudFlare, etc.) since that’s clearly the most practical; for personal stuff I still prefer self-hosted FOSS though :)

    1. 4

      If all you need is static http you don’t have to host it yourself. I host my blog in Amazon S3 (because I wanted to add SSL and GitHub didn’t support that last year) and for the last 13 months it’s costs me about $0.91 / month, and about two thirds of that is Route 53 :-)

      AWS gives you free SSL certificates, which was one of the main drivers for me to go with that approach.

      1. 3

        I use S3 / CloudFront for static HTTP content. It’s idiot proof (important for idiots like me!), highly reliable, and I spend less every year on it than I spend on a cup of coffee.

        The only real security risk I worried about was that someone could DDoS the site and run up my bill, but I deployed a CloudWatch alarm tied to a Lambda to monitor this. It’s never fired. I think at my worst month I used 3% of my outbound budget :)

        1. 1

          I’ve always wondered why AWS doesn’t provide a spending limit feature… it can’t be due to a technical reason, right? I know their service is supposed to be more complex, but even the cheapest VPS provider gives you this option, often enabled by default. I can only conclude they decided they don’t want that kind of customer.

          1. 1

            I also worried about the risk of “DDoS causing unexpexted cost” when I was looking for a place to host my private DNS zones. To me it appeared that the free Cloudflare plan (https://www.cloudflare.com/plans/) was the best fit (basically free unmetered service).

            Would using that same free plan be a safer choice than Cloudfront from a cost perspective?

          2. 3

            You’d be hard pressed to go wrong with httpd from the OpenBSD project. It’s quite stable, it’s been in OpenBSD base for a while now. It’s lack of features definitely keeps it in the simple category. :)

            There is also NGINX stable branch. it’s not as simple as OpenBSD’s option, but is stable, maintained and is well hardened by being very popular.

            1. 3

              In hurricane architecture, they used Nginx (dynamic caching) -> Varnish (static caching) -> HAProxy (crypto) -> optional Cloudfare for acceleration/DDOS. Looked like a nice default for something that needed a balance of flexibility, security, and performance. Depending on one’s needs, Nginx might get swapped for a simpler server but it gets lots of security review.

              I’ll also note for OP both this list of web servers.

            2. 1

              Check out this.

              1. 1

                Yeah, I also like this similar list, but neither provide value judgements about e.g. whether it’s sane to leave such things exposed to the Internet unattended for many years (except for OS security updates).

            1. 18

              “Static sites, on the other hand, are impossible to hack: there is no code running, and thus no vulnerabilities to exploit!”

              That’s overstating it. We were hacking static sites all the time before the invention of web applications. We did it via their web servers or other software running on the machine. Sometimes hit the boxes of people connecting to the machine with user or admin privileges. Vulnerabilities are still found in web servers. People still use buggy software in the trusted network. So, this claim should instead say they’re either more secure or harder to hack since they just depend on a web server without extra, bug-ridden code on top. Then, maybe a recommendation of using some specific ones that have good, track record both in number of vulnerabilities and how quickly they patch them. Maybe there should be a mention of Let’s Encrypt in that section, too. Kind of a combined recommendation.

              I like your additional sections on ownership and portability. Those were either not covered or barely discussed in some prior write-ups on static sites.

              1. 4

                That’s true – thanks for calling it out. What I typically do is deploy my static sites into an S3 bucket (with restricted permissions, obviously), then throw it behind Cloudfront for speed.

                Netlify is another awesome service that makes this stuff really easy/simple and mitigates a lot of the misconfigs for web servers/etc. that many people run into.

                1. 4

                  I like your additional sections on ownership and portability.

                  Funny enough, I have a problem with one of those sections.

                  Take a look at any outsourced products, and compare them to in-house products: with very few exceptions, in-house projects are almost always better.

                  I’m currently doing a POC of a competitor of Okta for enterprise authn/authz (ha!). The only metric favoring our in-house solution was cost.

                  I’ve found that outsourced products are often more reliable, secure, and maintainable than in-house solutions. Where in-house solutions typically win are around matching the solution to the very specific business problem they’re designed to solve. When that’s enough, it’s perfect; when it isn’t, though, the rough edges really start to be noticed.

                  1. 4

                    Heh. I think my argument there was that you shouldn’t outsource your core product code. So if you’re a web company and your website is a main driver of your business, being able to customize/control it is pretty important. Really depends on the business goals though =)

                    1. 3

                      I think that’s fair. FWIW: after going through the static site/CMS debate internally, I can also agree 100% with your conclusion.

                      I guess after further consideration what I’m arguing with here is your definition of “outsourcing”. To me, I’d rather toss dollars at SaaS to solve something that isn’t my core competency. If I can’t do that, I’d rather come up with an extremely narrowly tailored solution that addresses my very specific business needs. The least palatable option is a very general-purpose tool (like Drupal or Wordpress) that I still have to operationalize, as it tends to come with nasty headaches elsewhere.

                      It’s an odd one… I’d chose to pay someone for operational certainty around a general purpose tool over operationalizing the general purpose tool myself. I wonder what that says about me.

                      1. 2

                        I agree. For what it’s worth, you should totally check out Netlify. They make managing static sites so easy. I started using it recently and absolutely fell in love with it <3 I’m not at all affiliated with them but it is useful.

                1. 7

                  You have two different problems in your hands and I think they requires different solutions. Fast updates in case of events and faster (bulk) data upload. SMS and HAM radio are the cheapest possible form of fast update I can think of. It’s possible to do IP routing on radio equipment and I think you can establish a mesh service to provide internet to your user if they can bring some more equipment. Once they are online they can send you data but this leads to delays in update from a user. If your app can do peer to peer replicable data you can ameliorate this problem by sharing your data to others that will maybe come back online before you. Both problems can be solved using these kind of mesh services (hardware and software). A totally different approach is to become an ISP and negotiate peering with other providers, this can cut your bills and requires not that much infrastructure.

                  1. 4

                    SMS is hard to get up and running quickly, primarily because of trying get sims in bulk from whoever the local telecom is. What I was thinking was if we can get away with getting 4-5 sims to provide sort of connection points where we could set up a basic tower or something that broadcasts wifi over an extended area running off a solar battery. We used to have these wires for sat phones that we’d toss up a tree to get a signal for instance. Even something like amplifying the tether signal from an android phone then sending the message over 3g or SMS to the countries application servers. At least we’re then down to procuring a smaller batch of sims and we can spend less time haggling with the local telecom.

                    Another thing we thought about sort of pie in the sky was drones, basically getting drones to do “rounds” where during the week they travel between locations, sending a notification to local mobile apps that they’ll have access to internet for the next 2 hours, or to plug in the drone and let it charge up so it can continue on it’s rounds, but drones open up a whole other can of worms in terms of regulations and also potentially getting shot down or just downright freaking people out. Even potentially setting up relay drones, where we drop drone “stations” on the way out to remote localities, then use drones to leapfrog to the location to provide syncing, lab sample pick up and leapfrog back to a central location. But they’re cost prohibitive for the complexity of the drone as well as in terms of dealing with local regulations and would only really be viable in a longer-term health surveillance context, would be too hard to get up and running in an emergency ramp-up.

                    The HAM radio looks really interesting actually. I’m just digging into it, they don’t really need wider internet access, we just need a way to get data from them and in some cases send back some minimal data (for instance, the wait time for a lab result for these guys can be weeks, we can’t do much about the time it takes for a sample to get to a lab, but we can speed up the return time by pushing the lab result down to them).

                    We’re also working on the peer to peer syncing of data on mobile and the desktop application. We’ve made some prototypes using the zyre c libs that are built on 0mq but it’s finicky so we can’t deploy it yet. The idea being that we eventually get data as users running our apps come into contact with each other and then eventually the wider internet or the ministry of healths or an NGOS installation of our systems.

                    We’re sort of trying to build as many avenues as possible for them to get data in/out of the locality so there’s almost always an option because the context is so critical.

                    The HAM radio packet data looks interesting, i’m definitely going to dig into that more and see if I can figure out prototype test for that for shifting data. Thanks for pointing me to that!

                    1. 2

                      The HAM radio looks really interesting actually. I’m just digging into it, they don’t really need wider internet access, we just need a way to get data from them and in some cases send back some minimal data (for instance, the wait time for a lab result for these guys can be weeks, we can’t do much about the time it takes for a sample to get to a lab, but we can speed up the return time by pushing the lab result down to them).

                      AMPRNet will definitely be your friend here. Much of the foundation exists for you to build on. I’d wager it’s mostly an “amateur vs. non-amateur” question then.

                  1. 6

                    The system first registered radar and LIDAR observations of the pedestrian about 6 seconds before impact, when the vehicle was traveling at 43 mph

                    % units
                    You have: 43 miles per hour
                    You want: feet per second
                    	* 63.066667
                    

                    Uber’s software couldn’t decide what to do with 126 yards of processing time.

                    1. 1

                      The claim of hundreds of billions of lines in COBOL sounds exaggerated.

                      1. 2

                        “Police, today, have apprehended a cartel of COBOL programmers with a shipment of COBOL code with an estimated street value of 300 billion lines…”

                        I think articles like this always inflate/exaggerate by some orders of magnitude and can’t be taken literally, like when you read about police arresting a dealer with a dimebag worth $1,000 “on the street.” Unless there is an actual measurement (vs. “some guy estimates …”), they could be wildly off in either direction, but will tend to round up for effect.

                        1. 1

                          It might be high, I’m not sure, but I’ve been told (no hard evidence to back this up) that a lot of COBOL code starts as copy&paste of old code. So the number of lines produced per year is large but they are not new lines.

                          1. 1

                            Has to be some, but still. Just was trying to ballpark it: a billion means a thousand of 1MLOC projects. This is a major institutional project size, even today. The article implies there were hundreds of thousands such projects in COBOL’s heyday, or untold millions of smaller projects. Given the installed mainframe base by late 1970s, it just doesn’t check out. The only explanation is it boomed in later years, which sounds contrary to common perception.

                            1. 4

                              COBOL is exceptionally verbose. A programmer I know who develops new features in it today estimates that a typical module developed years ago is likely around an order of magnitude larger than if it was written in a modern language.

                              After seeing the code for a legacy ERP system up close, I’d wager it’s closer to 15x larger.

                        1. 2

                          Nobody likes typing Float::INFINITY or 1.fdiv(0) over and over.

                          uhhhhhhhhhhhhhhhhhh

                          this seems dangerous

                          1. 4

                            .. does it?

                            1. 2

                              OHHHH, fdiv uses floating point semantics I guess. That’s less scary. (And also makes sense - guess I missed the F the first time :))

                              1. 2

                                :D Right!

                          1. 3

                            Seems like this would be trivial to detect, as fonts have a very well known and fixed representation that is present on… er, every computer in use. OCR the pages, overlay the letters, calculate deviance.

                            I’d personally rather get a printed photograph where color levels were monkeyed with or other classic steganographic techniques were used. At least that way I’ve got some level of plausible deniability when state security came knocking.

                            1. 3

                              What did your query plan look like? Did you consider a materialized view or any other technique that’d let you solve this in the database?

                              1. 2

                                I also was curious if they’d exhausted the SQL options. Appears from the brief Group Builder example, they could’ve generated raw SQL queries that hit all the right indexes, without doing the unions and group by.

                                As a query builder, this Group Builder looks pretty slick. The technical discussion about their history and solutions is also interesting and instructive. The Go language propaganda is kind of distracting from an other wise interesting article. Not saying that Go didn’t provide the benefits described, it just seems a little irrelavant.

                                1. 2

                                  It looks to me as if they are just constructing boolean expressions in the web interface, e.g., the first screenshot corresponding to (as far is I understand it):

                                  ...
                                  WHERE gender != 'male' AND ( age > 50 OR censor_rating_r18 < 0.2 )
                                  

                                  (it’s not clear to me how they actually store/process the censor rating, so i’m just guessing here)

                                  So it’s a matter of translating from the interface to a boolean expression with “Subgroup”s mapped to parentheses and comparisons based on exclude/include specification.

                                  I don’t really see the necessity for unions, or am I missing something?

                              1. [Comment removed by author]

                                1. 9

                                  If the forum allows it, anyone who can link an image in their signature is “tracking” users and has access to this information.

                                  The 600MB file, I’d agree with, though.

                                  1. 0

                                    By the way, it was pushcx himself who replaced the big image with an humerous remark. Might not have been the brightest idea to put it there in the first place.

                                  2. 4

                                    The lack of response or action from @pushcx is sad to say the least.

                                    1. 3

                                      He was there when it happened. They saw the picture, people joked on it, pushcx removed it, put his own comment on it into my signature, i liked it, other people liked it, i kept it. Some people had a good laugh. At this point, i was still assuming that most lobste.rs users were on desktop.

                                      After compiling the statistics, i felt like, “Oh shit”. Mistakes were made. I can’t turn that back now.

                                      You should have been there when it happened, then maybe you would have an different perspective on it. I dont want that pushcx now gets shit from people missing context. Mistakes were made.

                                      1. 1

                                        Just because @pushcx was “there” when it happened doesn’t mean that it’s OK. You abused the trust we all have in this website and I’m starting to feel like @pushcx is abusing my trust in him as the sysop to act fairly across the board. Not only did you pry into the privacy of users you wasted their time, money and energy doing so.

                                        1. 2

                                          users weren’t required to download his tracking pixel. they chose to run software that would download it by default. i consider this a lesson about the state of our software ecosystem.

                                          1. 5

                                            This is a strawman. Every browser behaves this way. What is the lesson supposed to be? Do not trust lobste.rs and move to a better community?

                                            1. 2

                                              are you using the term strawman to refer to any argument you disagree with? or did i actually construct some sort of strawman?

                                              lynx doesn’t behave this way. firefox doesn’t behave this way, with 3rd party images disabled in matrix. the tor browser would not leak data this way. the lesson is that the web is a hostile environment because we allow it to be. if we all used more secure browsers, sites that are broken by the security features would lose traffic. but we allow it to happen.

                                              1. 0

                                                No, the lesson should be do not trust the browser.

                                                1. 3

                                                  so you have a whitelist of domains that you trust or how do you use the www?

                                                  1. 1

                                                    I try to use it as little as possible and when I use it, I consider it a hostile attacker that I don’t trust.

                                                    If at some point there will be a bitcoin miner on the site, I won’t consider myself betrayed by anyone, as nobody made any promise to me, nor I expected anything from anyone. I will simply move on with my life. If I am concerned about blowing through my data allowance, I won’t visit radom websites in the first place.

                                                    It seems that currently there aren’t any javascript bitcoin miners here on this site, but I have no expectations that there won’t be any tomorrow or some other day.

                                      2. 2

                                        Probably worth probation for a week or two.

                                        Hey, if we are doing the 2000s BB thing, let’s go all in! ;)

                                      1. 2

                                        Hells yes!

                                        I am still most comfortable by far doing my text manipulation scripting in ed. Why? Because I can sit there and interactively try things out and put the commands together. IMO that’s huge.

                                        1. 1

                                          I want to know more!

                                          Could you share an example of how you work with ed?

                                          1. 4

                                            OK, let’s say you have a simple text file you need to edit under script control:

                                            cpatti@dev-dsk-cpatti-1e-5d911563:03:02 PM:~
                                            $ cat test.txt
                                            How many cans can a canner can if a canner can can cans?  A canner can can as many cans as a canner can if a canner can can cans.
                                            cpatti@dev-dsk-cpatti-1e-5d911563:03:02 PM:~
                                            

                                            Let’s say you want to write a Limerick transmogrification script :)

                                            You can fire up ed, interactively twiddle until you find the right transformations (Note that ed uses the same basic commands as vi’s command mode, vi contains ex, which is a descendant of ed):

                                            Here’s my session for this example:

                                            cpatti@dev-dsk-cpatti-1e-5d911563:02:47 PM:~
                                            $ ed test.txt
                                            130
                                            s/many/much/g
                                            s/canner/woodchuck/g
                                            .
                                            How much cans can a woodchuck can if a woodchuck can can cans?  A woodchuck can can as much cans as a woodchuck can if a woodchuck can can cans.
                                            s/cans/wood/g
                                            .
                                            How much wood can a woodchuck can if a woodchuck can can wood?  A woodchuck can can as much wood as a woodchuck can if a woodchuck can can wood.
                                            s/woodchuck can/woodchuck chuck/g
                                            .
                                            How much wood can a woodchuck chuck if a woodchuck chuck can wood?  A woodchuck chuck can as much wood as a woodchuck chuck if a woodchuck chuck can wood.
                                            s/woodchuck chuck can/woodchuck could chuck/g
                                            .
                                            How much wood can a woodchuck chuck if a woodchuck could chuck wood?  A woodchuck could chuck as much wood as a woodchuck chuck if a woodchuck could chuck wood.
                                            

                                            Now that I have the commands I want to run, I can embed them in a here document in my script, or as I’m doing tin this case, put them into a file so I can do multiple invocations without violating DRY:

                                            cpatti@dev-dsk-cpatti-1e-5d911563:02:54 PM:~
                                            $ cat ed
                                            s/many/much/g
                                            s/canner/woodchuck/g
                                            s/cans/wood/g
                                            s/woodchuck can/woodchuck chuck/g
                                            s/woodchuck chuck can/woodchuck could chuck/g
                                            s/as a woodchuck chuck/as a woodchuck could/g
                                            

                                            Now let’s run our script and examine our output:

                                            cpatti@dev-dsk-cpatti-1e-5d911563:03:02 PM:~
                                            $ cat ed | ed -v test.txt
                                            130
                                            161
                                            cpatti@dev-dsk-cpatti-1e-5d911563:03:03 PM:~
                                            $ cat test.txt
                                            How much wood can a woodchuck chuck if a woodchuck could chuck wood?  A woodchuck could chuck as much wood as a woodchuck could if a woodchuck could chuck wood.
                                            

                                            Now, sure, you could do EXACTLY this with a sed invocation, or with awk, or myriad other ways, but being able to interactively build the edit is incredibly powerful and can lead to super simple development of some very powerful text transformations.

                                            I feel a blog post coming on :)

                                            1. 1

                                              Oops. One error in that ed script I fixed but wasn’t there when I ‘cat’ted the file - You have to have a ‘w’ at the end or A) the changes won’t write and B) ed will whine with its ever helpful ‘?’ error :)

                                        1. 10

                                          My main editor is acme(1), sometimes I fire up sam(1) when I either do batch edits, or when I need to do more than quick edits on remote computers. However, for general system administration of remote computers, I use ed(1), the standard editor. Its main feature compared to vi(1) is that it doesn’t take over the screen, so I don’t lose context of all the history. I find that valuable.

                                          While I don’t think anybody should switch to ed(1), I think that knowing how to use it is essential, and the value of not losing context while editing text should be more appreciated.

                                          1. 4

                                            Wow, I’ve never seen anyone actually using acme outside of the plan9 team and maybe the cat-v crowd. What do you use it for? Why do you use it?

                                            I have it installed via the plan9ports on my laptop, and sometimes play with it, but since I’m so used to either vi (specifically nvi or vis) or emacs keybindings, I can’t really be productive in it. And I can’t even start using sam, although I do have experience with writing scripts with ed, and have used it over slow ssh connections.In fact I belive that it might have been exactly the linked article that pushed me to bother learning anything about ed. Would you know of any resources like that for acme or sam?

                                            1. 10

                                              I use acme for everything that involves text files, source code or otherwise. It’s the single most important program that I use. If acme were to somehow disappear from the face of the Earth tomorrow, I would re-write it. All my friends who use acme say that they would do the same. Fortunately, because acme is so small and so simple, that wouldn’t take very long.

                                              I use it because it’s by far the best text editor. As for why it is the best text editor, that is rather difficult to explain. I could enumerate a list of features, but realistically that wouldn’t be very enlightening. It’s not any single feature, it’s the whole package, and you have to experience it.

                                              The most important things to me though are the mouse-based interface, the fact that text is executable, and the fact that it doesn’t have any configuration options. I suggest watching the linked Russ Cox video, it does a good job demoing acme.

                                              As for sam, I don’t know of any other resource rather than the sam paper. I don’t like the sam user interface, I’d much rather use acme, but some people disagree about that and prefer sam. However, sam has some features that acme lacks. The way the program is split into multiple processes means it works extremely well for editing remote files. Even better than ed. The user interface always runs on the local terminal, while the server side does the actual edits. The protocol is extremely efficient, not just in throughput, but in latency too. Editing files over satellite connections with seconds-long pings is doable.

                                              However, what sam really excels at is editing multiple files at once. I routinely edit thousands of files at once in sam, e.g. when doing large scale refactoring. I know of no better tool for that than sam.

                                              1. 1

                                                What OS(s) do you use acme and Sam on?

                                                1. 2

                                                  I use sam on everything that I use, macOS, Solaris, Linux, FreeBSD, OpenBSD and Plan 9.

                                                  I use acme on my workstation systems, macOS and Plan 9. Exceedingly rarely I get to use a Linux desktop system. Then I use acme there too.

                                                  1. 2

                                                    Sounds like you use Sam like I use vi keybinds: Everywhere it can possibly fit.

                                                    I think that for me, the lack of syntax highlighting is probably one thing that will keep me from using Sam/Acme for the indefinite future, as fascinating as they are.

                                                    1. 3

                                                      syntax highlighting

                                                      Try dropping it for a while. You might not miss it as much as you’d think!

                                                      I personally thought I’d never live without it, but nowadays the only time I notice its absence is when I forget to close a string literal. Otherwise, I’m far happier without it.

                                                      1. 3

                                                        I’ve dropped it on and off when I was experimenting with using greyscale on my screens. But there are places (like HTML templates with Angular), that really suffer if you don’t have syntax highlighting, at least they did for me.

                                                        1. 3

                                                          Greyscale screens!? Trip report needed!

                                                            1. 1

                                                              Basically using color space simulation to get a monochromatic screens. It doesn’t get rid of syntax highlighting entirely, but reduces it by a lot, and can be pleasant when code is well structured. HTML templates aren’t given to being structured well

                                              2. 3

                                                Have you checked out vis? It is a bare-bones vim w/ sam commands. Plus it be used as an interactive filter when piping commands.

                                                1. 3

                                                  I know about vis, but I never had any interest in trying it out. In general, I stay away from curses programs if I can help it, and I also avoid installing software if I can help it, even though it might be useful. I’d rather use a real GUI program, or some command line program (non-curses). Preferably something that already comes with the system (acme fails the last requirement, sadly on some Linux distributions ed fails too). I use irssi regularly and it bothers me greatly that that is the state of the art.

                                                  1. 1

                                                    I use irssi regularly and it bothers me greatly that that is the state of the art.

                                                    irssi was state of the art in…. 1999? It’s certainly not in a world where WeeChat exists, let alone protocols that claim to obsolete IRC.

                                                    1. 2

                                                      I looked at weechat, and it was a curses program, exactly like irssi. To me, there’s no real difference. Except that it also had a web frontend, which made it worse (!). Plus weechat, in its default configuration used more screen estate than irssi, which to me again made it worse. But thanks for the suggestion, I am very interested in alternative IRC clients.

                                                      Other protocols have no value to me because of network effects.

                                                      1. 1

                                                        If you’re some kind of purist, ii works.

                                                        1. 1

                                                          Yeah, I need to try out ii and ircII.

                                                          1. 1

                                                            Isn’t there an IRC client (or however one would want to call it) for Acme?

                                                            1. 1

                                                              There is, but in my opinion it is not very good, and I don’t really like programs that use acme as their interface. I prefer to use acme for editing text only.

                                                              1. 1

                                                                IIRC (lol), ii exposes all kinds of magic files for interacting with channels. I think that’d integrate nicely with Acme by default

                                                      2. 1

                                                        Something I do fairly often is SSH to a remote server to take a look at its logs. I could cat(1) the log file to read it, but if it is long (most are) then it will wipe out my terminal’s history (or at least force me to scroll back for miles) so I lose my context. less(1) is really handy for interactively taking a peek inside a log file, scrolling around, searching for the next occurrence of something I’ve found, etc. But it is a curses program. Do you ever do this sort of thing? What do you use?

                                                        1. 1

                                                          I use less (or more). It’s not ideal, but I use it.

                                                          1. 1

                                                            Damn, I was hoping you had a different solution that would work with 9term :)

                                                    2. 2

                                                      Which version of Sam do you use?

                                                      1. 1

                                                        The one in plan9port, or the one in 9front.

                                                      2. 1

                                                        That’s an interesting way to preserve history! Never thought about it.

                                                        Any tmux users? I usually use it, so I split horizontally to preserve history. A bit of a newschool solution ;)

                                                        The -4d and -2,5t. stuff is imo the most valuable take-away. I use it in vimlikes, but I would appreciate it in any other editor as well!

                                                      1. 10

                                                        I work in the info sec field and honestly I’d repremand an employee for not investigating an annomoly on the network. Unless the cluster is for testing purposes and the employee’s title contains the word “scientist” they shouldn’t be running their own ad-hoc tests. The fact that they believe their biggest mistake was telling their boss makes me cringe too. IMHO this is one whiny worker and I’d recommend getting rid of them.

                                                        1. 14

                                                          IMHO this is one whiny worker and I’d recommend getting rid of them.

                                                          And you’d lose a great deal of expertise, if you were familiar with the author’s work and past writing. :)

                                                          People stuck working under bozos develop certain pathologies, and it takes solid leadership to build trust and correct those pathologies.

                                                          1. 6

                                                            I have read a bit of the author’s other work and it’s largely filled with the same “everyone doesn’t work as hard as me!” rhetoric. Just because someone writes about how they’re the only one who does anything doesn’t mean it’s true.

                                                            1. 9

                                                              Sure, but it doesn’t also mean it’s false either.

                                                              It’s entirely possible (given their employment history) that they actually ended up in dysfunctional orgs and units.

                                                              1. 2

                                                                That’s a good point, but there is also the flip side: they’re a dysfunctional problem worker.

                                                              2. 9

                                                                Some people are competent but grind up against incompetent orgs. Some people are incompetent and eventually flushed out of competent orgs. They tell similar stories. I was right and everyone was wrong. There’s usually a tell or two that reveals which it is though.

                                                                1. 7

                                                                  I seriously don’t understand why there’s a question about this. I too have concerns about this post, but reading past posts it seems blindingly obvious that Rachel Kroll is competent and knowledgeable. Regardless of what you think of her personality.

                                                                  /cc @friendlysock and @tedu. Yes, in general it can be this or it can be that. But in this instance is there really any doubt?

                                                                2. 2

                                                                  I think this post is more illustrative of her poor leadership skills than of her good technical skills. Furtheremore, she doesn’t seem to be aware of that aspect of it at all. She seems genuinely surprised that her bahaviour was not welcome by everyone in management.

                                                                3. 7

                                                                  What about all the other people who didn’t even spot the anomaly because they weren’t trying?

                                                                  1. 22

                                                                    It’s the author’s opinion that others weren’t working as hard so I will take that assessment with a grain of salt. I don’t think it’s an individual’s prerogative to make work traps for other employees so they can be shown as “not working that hard”. If you’re really concerned about the performance of others then have an honest discussion with your manager about it, don’t try to measure others with a metric of your choosing.

                                                                    1. 5

                                                                      If the anomaly persists for two months without anyone seeming to notice, is it really a problem? If it is causing a problem, that suggests that key metrics aren’t being observed - a problem exists but nobody knows - in which case you’ve got a bigger problem!

                                                                      1. 4

                                                                        What about them? Were they even supposed to be trying? If the author always fixes the problem, like she claims, it seems possible that other people on the team may have thought it was her responsibility.

                                                                        In any case, when she saw the problem she should have told her boss and said something like, “I see there’s a cluster with an extra node, but I don’t have time to fix it myself right now, can you have somebody else investigate?”

                                                                        1. 5

                                                                          Yeah, they’re supposed to be trying.

                                                                          There was no division of duties on the team. Everyone was responsible for the system as a whole.

                                                                          If I leave my trash next to your desk every day, and you always throw it out for me, are you the one littering when a soda can doesn’t get picked up? Am I even supposed to be trying, once I become dependent on you doing my job for me?

                                                                    1. 4

                                                                      Can you really be “a fixer” without the support of management?

                                                                      It seems to me that this type of engagement would only be workable if every party - the employee “parachuting in”, the team they’re assigned to & its leader, management up the chain - has a very clear understanding around the engagement.

                                                                      Otherwise it just sounds like you’re a technical employee assigned to an underperforming team with the vague hope that you’ll be able to influence them. I’ve never had the misfortune of trying that, but I can’t imagine it’d end well unless you are very adept at playing politics.

                                                                      1. 12

                                                                        The Go project is absolutely fascinating to me.

                                                                        How they managed to not solve many hard problems of a language, it’s tooling or production workflow, but also solve a set to get a huge amount of developer mindshare is something I think we should get historians to look into.

                                                                        I used Go professionally for ~2+ years, and so much of it was frustrating to me, but large swaths of our team found it largely pleasant.

                                                                        1. 12

                                                                          I’d guess there is a factor depending on what you want from a language. Sure, it doesn’t have generics and it’s versioning system leaves a lot to be wished for. But personally, if I have to write anything with networking and concurrency, usualy my first choice is Go, because of it’s very nice standard library and a certain sense of being thought-thorugh when it comes to concurrency/parallelism - at least so it appears to be when comparing it to other imperative Java, C or Python. Another popular point is how the language, as compared to C-ish languages doesn’t give you too much freedom when it comes to formatting – there isn’t a constant drive to use as few characters as possible (something I’m very prone to doing), or any debates like tabs vs. spaces, where to place the opening braces, etc. There’s really something reliving about this to me, that makes the language, as you put it, “pleasant” to use (even if you might not agree with it)

                                                                          And regarding the standard library, one thing I always find interesting is how far you can get by just using what’s already packaged in Go itself. Now I haven’t really worked on anything with more that 1500+ LOC (which really isn’t much for Go), and most of the external packages I used were for the sake of convince. Maybe this totally changes when you work in big teams or on big projects, but it is something I could understand people liking. Especially considered that the Go team has this Go 1.x compatibility promise, so that you don’t have to worry that much about versioning when it comes to the standard lib packages.

                                                                          I guess the worst mistake one can make is wanting to treat it like Haskell or Python, forcing a different padigram onto it. Just like one might miss macros when one changes from C to Java, or currying when one switches from Haskell to Python, but learns to accept these things, and think differently, so I belive, one should approach Go, using it’s strengths, which it has, instead of lamenting it’s weaknesses (which undoubtedly exist too).

                                                                          1. 7

                                                                            I think their driving philosophy is that if you’re uncertain of something, always make the simpler choice. You sometimes go to wrong paths following this, but I’d say that in general this is a winning strategy. Complexity can always be bolted on later, but removing it is much more difficult.

                                                                            The whole IT industry would be a happier place if it followed this, but seems to me that we usually do the exact opposite.

                                                                            1. 1

                                                                              I think their driving philosophy is that if you’re uncertain of something, always make the simpler choice.

                                                                              Nah - versioning & dependency management is not some new thing they couldn’t possibly understand until they waited 8 years. Same with generics.

                                                                              Where generics I can understand a complexity argument for sure, versioning and dependency management are complexities everyone needed to deal with either way.

                                                                              1. 3

                                                                                If you understand the complexity argument for generics, then I think you could accept it for dependency management too. For example, Python, Ruby and JavaScript have a chaotic history in terms of the solution they adopted for dependency management, and even nowadays, the ecosystem it not fully stabilized. For example, in the JavaScript community, Facebook released yarn in October 2016, because the existing tooling was not adequate, and more and more developers are adopting it since then. I would not say that dependency management is a fully solved problem.

                                                                                1. 1

                                                                                  I would not say that dependency management is a fully solved problem.

                                                                                  Yes it is, the answer is pinning all dependencies, including transitive dependencies. All this other stuff is just heuristics that end up failing later on and people end up pinning anyways.

                                                                                  1. 1

                                                                                    I agree about pinning. By the way, this is what vgo does. But what about the resolution algorithm used to add/upgrade/downgrade dependencies? Pinning doesn’t help with this. This is what makes Minimal Version Selection, the strategy adopted by vgo, original and interesting.

                                                                                    1. 1

                                                                                      I’m not sure I understand what the selection algorithm is doing then. From my experience: you change the pin, run your tests, if it passes, you’re good, if not, you fix code or decide not to change the version. What is MVS doing for this process?

                                                                                      1. 1

                                                                                        When you upgrade a dependency that has transitive dependencies, then changing the pin of the upgraded dependency is not enough. Quite often, you also have to update the pin of the transitive dependencies, which can have an impact on the whole program. When your project is large, it can be difficult to do manually. The Minimal Version Selection algorithm offers a new solution to this problem. The algorithm selects the oldest allowed version, which eliminates the redundancy of having two different files (manifest and lock) that both specify which modules versions to use.

                                                                                        1. 1

                                                                                          Unless it wasn’t clear in my original comment, when I say pin dependencies I am referring to pinning all dependencies, including transitive dependencies. So is MVS applied during build or is it a curation tool to help discover the correct pin?

                                                                                          1. 1

                                                                                            I’m not sure I understand your question. MVS is an algorithm that selects a version for each dependency in a project, according to a given set of constraints. The vgo tool runs the MVS algorithm before a build, when a dependency has been added/upgraded/downgraded/removed. If you have the time, I suggest you read Russ Cox article because it’s difficult to summarize in a comment ;-)

                                                                                            1. 1

                                                                                              I am saying that with pinned dependencies, no algorithm is needed during build time, as there is nothing to compute for every dependency version is known apriori.

                                                                                              1. 1

                                                                                                I agree with this.

                                                                            2. 4

                                                                              I had a similar experience with Elm. In my case, it seemed like some people weren’t in the habit of questioning the language or thinking critically about their experience. For example, debugging in Elm is very limited. Some people I worked with came to like the language less for this reason. Others simply discounted their need for better debugging. I guess this made the reality easier to accept. It seemed easiest for people whose identities were tied to the language, who identified as elm programmers or elm community members. Denying personal needs was an act of loyalty.

                                                                              1. 2

                                                                                How they managed to not solve many hard problems of a language, it’s tooling or production workflow, but also solve a set to get a huge amount of developer mindshare is something I think we should get historians to look into.

                                                                                I think you’ll find they already have!

                                                                              1. 4

                                                                                Those strike me as fine points - but maybe a bit limited.

                                                                                If I had one piece of advice I’d want to learn as a junior developer, it’d be “focus on people and business problems, not technology”.

                                                                                Learning that I wasn’t paid to write code but to deliver business value took me a (embarrassingly long) while, but when I got it I went from “a good programmer” to a recognized expert in my company.

                                                                                And I’m just starting to learn that I can deliver even more value by focusing on mentoring and training my coworkers.

                                                                                1. [Comment from banned user removed]

                                                                                  1. 3

                                                                                    The last two comments I’ve seen from this user seem like the inverse of the friendlysock experiment. If this isn’t intentional, I’d highly recommend reading the blog post and reconsidering your posting style.

                                                                                    1. 2

                                                                                      I would like to know, why are you people down-voting stefantalpalaru for that comment?

                                                                                      I am not a native speaker nor in the US, that remark was insightful for me - am I missing something except it (the comment) being slightly snarky?

                                                                                      1. 32

                                                                                        I’m sort of used to people making fun of my writing style (people complain about my use of exclamation marks on the internet every month or so, complaining about question marks is a new one :) ) but in general I find technical comments on my posts much more interesting.

                                                                                        I’m honestly a bit disappointed by this comment – i tend to think of lobste.rs as a place where people try to have more substantive technical discussions about posts, as opposed to hacker news where comment threads frequently get derailed by conversations about irrelevant things and I end up not learning anything by reading the comments. To me the point of tech discussion sites like this is to discuss the technology! (for example: how could a kernel bug like this happen? have you run into other similar bugs on Mac/Linux? How did you debug them? Can you use dtrace to discover more about what’s going on inside the kernel?).

                                                                                        There are so many interesting questions to talk about, and I think it’s kind of a shame to waste time making nitpicky comments about the use of a question mark in the title :)

                                                                                        1. 11

                                                                                          As a linguist who’s read enough language written without punctuation (Latin and Greek), I’d like to thank you for your use of punctuation, and to encourage it.

                                                                                          Latin, fun fact, has two words to introduce questions, one that introduces questions where you expect an affirmative answer (“nonne”), and one that introduces questions where you expect a negative answer (“num”), and the interrobang was only invented millennia later. It’s always useful to have a metachannel conveying subtext, and punctuation is compact.

                                                                                          “I think I found a Mac kernel bug.” sounds definitive, and immediately puts a team of kernel hackers on the defensive. “I think I found a Mac kernel bug?” sounds rather surprised at oneself, and emphasizes the incredulity that you’d posted on Twitter, that it was 4 days from kernel hacking to finding a bug, that you’d expected that people would have found it, and generally is the spirit of humility and exploration that has made your writings so interesting to read!

                                                                                          Thank you for exploring syscalls :)

                                                                                          1. 2

                                                                                            So, however insignificant, this issue has, believe it or not, been (low-key) bugging me since this (sub)thread happened. I’m purely concerned with the linguistic question taken at face value, since I vaguely concur with the annoyance at the question mark (in the sense that I would feel odd to write in that style that myself, though I don’t care to tell anyone else what they should prefer). The reason it’s been bugging me is that it’s obvious that “just drop the question mark” can’t work, precisely because it significantly alters the quality of what is being expressed – as you stated. So how would I say that?

                                                                                            And I think I just realised the answer: the way to correctly express that sentiment in a more formal register is simply “Have I really found a Mac kernel bug?” D’uh, I guess.

                                                                                            1. 1

                                                                                              Absolutely. And there’s “I think I might have found a Mac kernel bug” in slightly more formal colloquial registers, “Discovery of potential Mac kernel bug” for a title of some Technical Letter to a journal 50 years ago. More formal titles have fewer questions.

                                                                                              And we’ve been repurposing punctuation to convey pitch of a sentence when spoken, useful to convey one’s meaning when writing. Sometimes it’s a question mark to convey High Rising Terminal, sometimes it’s comma splices and lack of terminal period to convey a fading train of thought, it’s a fun writing constraint, you should try it

                                                                                          2. 8

                                                                                            Thanks for taking the time to reply. I was asking because I felt I might be missing some language slang/common use that was pointed out here.

                                                                                            Regarding your blog posts: I love reading them, your technical content is sound, delivered in a fun way and a dive into things I rarely look at myself - I’m following all your ruby profiler posts. Keep up what you are doing, the silent majority appreciates it ;)

                                                                                          3. 11

                                                                                            the high rising terminal - often associated with “valleyspeak” - is stereotypically associated with shallow, unintelligent women, especially in american pop culture.

                                                                                            If anyone else on the site had asked about this, I’d wager we would see far less common contentious voting patterns. But hell, let’s call a spade a spade: I’ve seen enough of OPs previous comments to have a pretty good guess at what he’s doing when he made that comment - and I wager the downvoters did too.

                                                                                            1. 7

                                                                                              As a meta-discourse thing, I don’t really like this kind of comment even from people whose good faith I’m confident of. It’s really easy for a forum to fall into a pattern where 90% of the discussion is about pretty superficial aspects of the posts, especially in a dismissive way. I wouldn’t say that kind of thing is always off-topic, but I guess I try to think: is this observation novel and non-obvious enough that someone reading the comment learns something? Usually when I’ve been tempted to post a comment complaining about superficial aspects of a post (and there are definitely things I dislike and am tempted to comment on!) it’s hard for me to argue with a straight face that the answer is “yes”.

                                                                                        1. 2

                                                                                          Any security minded people have thoughts on this?

                                                                                          1. 13

                                                                                            Debian’s security record regarding CAs is atrocious. By this I mean default configuration and things like the ca-certificates package.

                                                                                            Debian used to include non-standard junk CAs like CACert and also refuse to consider CA removal a security update, so it’s hugely hypocritical of this page to talk about many insecure CAs out of 400+.

                                                                                            Signing packages is a good idea, as that is bound to the data and not to the transport like https so in principle I agree that using https for debian repositories doesn’t gain much in terms of extra security. However these days the baseline expectation should be that everything defaults to https, as in no more port 80 unauthenticated http traffic.

                                                                                            Yes, moving over to https for debian repositories breaks local caching like apt-cacher (degrades it to a tcp proxy) and requires some engineering work to figure out how to structure a global mirror network, but this will have to be done sooner or later. I would also not neglect the privacy implications, with https people deploying passive network snooping have to apply heuristics and put in more effort than simply monitoring http.

                                                                                            Consider the case where someone sitting passively on a network just monitors package downloads that contains a fix for a vulnerability that is exploitable remotely. That passive attacker can just try to race the host and exploit the vulnerability before the update can be installed.

                                                                                            Package signing in debian suffers from problems with the underlying gpg level, gpg is so 90s in that it’s really hard to sustainably use it long-term: key rotation, key strength are problem areas.

                                                                                            1. 4

                                                                                              Package signing in debian suffers from problems with the underlying gpg level, gpg is so 90s in that it’s really hard to sustainably use it long-term: key rotation, key strength are problem areas.

                                                                                              What do you consider a better alternative to gpg?

                                                                                              1. 10

                                                                                                signify is a pretty amazing solution here - @tedu wrote it and this paper detailing how OpenBSD has implemented it.

                                                                                              2. 4

                                                                                                non-standard junk CAs like CACert

                                                                                                imho CACert feels more trustworthy than 90% of the commercial cas. i really would like to see cacert paired with the level of automation of letsencrypt. edit: and being included in ca packages.

                                                                                                1. 2

                                                                                                  With the dawn of Let’s Encrypt, is there still really a use case for CACert?

                                                                                                  1. 4

                                                                                                    i think alternatives are always good. the only thing where they really differ is that letsencrypt certificates are cross signed by a ca already included in browsers, and that letsencrypt has automation tooling. the level of verification is about the same. i’d go as fas as to say that cacert is more secure because web of trust, but that may be just subjective.

                                                                                            1. [Comment removed by author]

                                                                                              1. 8

                                                                                                So you think that there’s no moral difference between “quick and painless”, “slow and horrible”, and “clumsy bludgeoning”? Sounds like a pretty extreme position to me.

                                                                                                http://futurama.wikia.com/wiki/Suicide_booth

                                                                                                1. 9

                                                                                                  I think this is a useful attempt to elucidate a somewhat confusing position on dz’s part, but that reducing a choice like this to the apparent fundamental principles rarely advances a conversation. People weigh far more things than they are even aware of, and are often not able to explain their real reasons. That’s especially true with a concern like animal suffering which is difficult to think about without having an urge to dismiss it out-of-hand to avoid having to imagine horrifying implications in detail.

                                                                                                  Personally, I think that both killing animals and causing them to suffer are wrong. Unfortunately, they’re on the list of wrong things that all humans are complicit in to some extent, although certainly we can individually adjust the degree to which we are, through our lifestyle choices. Political slogans are simplistic because they must be, but it’s important to remember the nuance when actually talking through something controversial like this.

                                                                                                  I see the point of a device to kill lobsters faster. But let’s not name anything on the site after it. I expect that this thread has already gotten more political, and with less relevance to the site’s core mission, than many lobste.rs users are comfortable with.

                                                                                                  1. 3

                                                                                                    Yes I agree not to name anything on this site after it. It would be uncool and uncrustaceanly.

                                                                                                    1. 2

                                                                                                      Thank you. I very much agree that there’s a lot of subtlety to these kinds of issues, and that they are worth considerate discussion in depth, but that this is probably not the right venue.

                                                                                                      I’m still learning how to write comments that are simultaneously relevant, provocative, and concise without being glib or mean… or encouraging others to. It’s hard! Sometimes it might be impossible. I think it’s still worth practicing.

                                                                                                      1. 2

                                                                                                        but that this is probably not the right venue

                                                                                                        I dunno about everyone else but I find this sentiment common and deeply disappointing.

                                                                                                        Programmers, like it or not, must learn to tackle ethical questions. We’ve automated jobs away, built software to cheat on emission standards, designed UIs with the intent to deceive users — and any attempt to discuss these issues where programmers dwell is invariably shut down with claims of “improper venue!”

                                                                                                        How can we expect to advance our profession if we keep proclaiming that our spaces are strictly for tech chat only?

                                                                                                        1. 7

                                                                                                          I agree! But let’s spend those limited resources discussing ethical questions that relate to systems we, as programmers, might be asked to build someday. I can promise you that it’s possible to make an entire career simply out of thinking about those questions, and still barely scratch the surface.

                                                                                                    2. [Comment removed by author]

                                                                                                      1. 5

                                                                                                        If the immoral act isn’t the suffering then you shouldn’t eat plants, either.

                                                                                                        1. 2

                                                                                                          While I don’t share @dz’s moral position, I don’t see this as a gotcha! that shows it is inconsistent.

                                                                                                        2. 1

                                                                                                          So as long as I don’t kill you I can make you suffer as much as I want and it wouldn’t be immoral. I certainly see the appeal of the philosophy.

                                                                                                          1. [Comment removed by author]

                                                                                                            1. 1

                                                                                                              What if both things are immoral?

                                                                                                              1. 5

                                                                                                                There are certainly a large segment of people who think that killing and causing suffering are immoral, however this is the first time I’d ever seen that killing was immoral but suffering was not. Given that humans probably would go extinct without killing anything (plants included) usually people make the caveat “Killing is okay as long as you’re killing the beings that suffer the least”. Some go the whole fruits and nuts route, causing no harm at all, but I don’t think this is large scale sustainable. Plants only is a decent argument, but you’re still totally killing, so if suffering isn’t a moral criteria you might as well go eat whatever because I mean you’ve gotta kill you might as well kill the thing that reduces your suffering and I would have to kill like 400,000 clovers to equal one cow because biodensity.

                                                                                                                Something tells me this isn’t the philosophy DZ has and I’m going to take a generous interpretation that they really meant that reducing suffering doesn’t mean there is NO suffering. The animal was still ripped from its habitat, deprived of a normal life, separated from any family it might have had, etc. I’m going to also suspect that DZ also feels that killing is unilaterally wrong, which is I think not a bad moral basis to aspire to. I think there is some wisdom in having that goal.

                                                                                                                Being said, don’t make perfect the enemy of the good. If someone is going to kill and eat me, I should hope they don’t boil me alive. I would be a lot more upset about being tortured to death than I would about just being killed.

                                                                                                      2. 3

                                                                                                        Something tells me if you were in the position of being boiled alive vs a painless death you would have more of an opinion on the matter.

                                                                                                      1. 2

                                                                                                        This could be a disappointingly cynical view, but I’m guessing I’ll get a few who agree :)

                                                                                                        I work in meetings constanty because a vast majority of the time I spend in meetings are wasted.

                                                                                                        Many are called to solve an issue that a simple email could solve. As soon as a request goes out, hangers on who don’t want to miss the chance to appear important or are interested in looking busy ask for a CC.

                                                                                                        When the meeting actually happens, the participants include:

                                                                                                        • the filibustering tech pedant
                                                                                                        • the junior dev who aggressively focuses on self promotion
                                                                                                        • the PM who doesn’t fully understand the project
                                                                                                        • two people who forget to mute their phone
                                                                                                        • and you / the person that needed a simple question answered

                                                                                                        and it invariably stretches to an hour with the potential of a follow up.

                                                                                                        “Not going” isn’t an option either: the PM is going to make decisions about the project based on their limited knowledge, the tech pedant is going to discuss a tangential project that links in to yours and the junior dev is going to sign you up for tasks. And when it’s time for performance appraisals, cross team managers will use how many meetings they saw you in as a proxy for your performance.

                                                                                                        (And this doesn’t even touch on how business lines are aggressively split up so making a decision about the company web page requires five teams from three different branches of the company to be present…)

                                                                                                        Corporate culture is broken; working during meetings is a symptom.

                                                                                                          1. 4

                                                                                                            While small on the surface, it can’t stand alone — it includes bsd.prog.mk has some, ahem, complexity.

                                                                                                            (I couldn’t tell if your comment implies BSD makefiles are hairballs or if it implies they’re simple ;))

                                                                                                            1. 3

                                                                                                              bsd.prog.mk is quite the library, but CMake is much larger; I think it was meant positively.