1.  

    I am part of a group that does a private dinner-party version of “Papers We Love” rather than a public meetup format. Tonight I am presenting part two of a three-part sequence on various file system topics.

    Tonight’s part is one part ZFS evangelism, one part doomsaying. Doom, in that filesystems are hard, and corruption is possible at all levels of everything and not even ZFS can save you.

    1. 5

      I had requiters from FB/Uber/Google/etc contacting me but they will probably reference check, notice I got fired and pass.

      Why a recruiter should pass on you just because you got fired?

      Genuine question, I’ve never heard of such behavior from recruiters.

      1. 12

        There is no way a recruiter will pass on you. They work on commission. As a software developer recruiters can be very pushy and annoying when they are looking for candidates… The flip side of that is they are probably equally pushy with the employers. From my experience, they will do anything and everything to get you hired… After all, if you get hired, they get paid - My last recruiter even managed to get me a salary bump above what I was asking for. We’ve all worked in shitty companies like the one you were at. Everyone can relate. I’ve interviewed loads of people and when someone says they were fired, if the interview went well, the most thought you give it is “Oh. That went well. I wonder why they were fired? They seem like a good fit. It’s a ‘yes’ from me”… We hired someone who got fired from his last company because he insisted “you all code like retarded monkies” 😂 Now, that should raise some alarm bells, but he ended up being one of our best developers and an absolutely great guy to work with! 😂

        1. 4

          Also, looking at all the positive responses in here it should be clear to see that if you explain your situation, in the same way, it will probably be met with the same response by future employers… If not, then you probably don’t want to work for them. It would probably be the same kind of company

        2. 2

          No I mean, once the company gets to the reference check stage, realizes I got fired, I imagine they’d bin me. Too much of a liability right?

          1. 11

            Why would you think that? I’ve interviewed for jobs as a professional multiple times in different cities, and interviewed dozens of people for jobs at companies I’ve worked for. Nobody has ever cared about the circumstances of how you left your last job. It’s good to be prepared to explain it in a professional way (“We realized that I was not a good fit for the position because X”), but it shouldn’t be a big deal.

            1. 8

              Not at all.

              First, most hiring managers are human and mature enough to understand that people get fired for bullshit reasons all the time. I’m not going to claim it won’t weigh on their decision, but it absolutely won’t be a dealbreaker. (And ask yourself if you really want to work under someone with so little sympathy they can’t understand an unjustified termination.)

              Second, if they don’t find out until the end of the hiring decision, then as long as you haven’t been outright lying to them about the circumstances of your departure (“everything was great, I was just looking for something new”), they’ve already made a decision and invested a bunch of time and energy into you. They’re unlikely to drop you at that point just for having been fired from your last job.

              (You should feel free, by the way, not to talk about why you left in detail. Say something like “it was difficult and not amicable and I’d rather not discuss it”—all of which is clearly true—and recruiters and interviewers should have the tact to drop it.)

              As a final bit of advice, since you’re clearly very burnt on tech employment right now, you should take as much time as you can afford to recover and recenter. Pushing harder into burnout is counterproductive. Instead, travel; expand your hobbies; work on personal projects; whatever. People making hiring decisions will also be experienced enough to have dealt with burnout (and again: do you want to work under someone who doesn’t?). I think even just a few days will help you calm and get a more objective view of your circumstances.

              1. 5

                Bear in mind - you get to supply your references. It’s completely normal to provide, for instance, the address of a senior engineer who you had a good relationship with rather than the manager with whom you didn’t. It’s basically not done—to go around asking people for references if you didn’t offer them.

                1. 3

                  Absolutely not. I’ve interviewed (and hired!) lots of people. Someone getting fired from a shitty job is not a mark against them at all. In fact, I’d say that any company that would hold that against you is not a place you’d want to work anyway.

                  On another note, I think you did the right thing to be open and honest with your manager. That they fired you doesn’t mean you did anything wrong - it just means they are shitty employers and you are better off out of there. I hope, when you do return to work, you continue to be so mature and honest with your new employer.

                  1. 3

                    If a company will make a decision of not hiring you based only on your previous employer’s point of view, then I’d say it’s a shitty place to work in as well.

                    1. 3

                      Others have said it in more convincing prose, but I want to chime in with similar:
                      You lose at 100% of the opportunities you don’t pursue.

                      It is a pithy quip but has a kernel of truth.
                      Don’t defeat yourself before you’ve even begun.

                      An added anecdote: I have had to fire a solid engineer before, but due to the specifics of the circumstances, I would have been happy to provide a recommendation for a future position if he had requested it.

                      1. 2

                        You’re not a liability just because you got fired IMHO.

                        Even if you got fired because of some burned production server, I believe that if the team you’re interviewing with thinks you could be a good match for the job, they would hire you anyway.

                        1. 1

                          It’s very unlikely. A company can’t say they’ve fired you. In most US states, company can only tell people start/end dates and if they’d rehire. You’re previous company isn’t listed as a reference right (and if they are, remove references entirely from your resume. They shouldn’t be there at all).

                          Recruiters just call a ton of people, cast wide nets. It’s not uncommon for them not to call you back, or call you back three months later, or call you for jobs in cities and countries you no longer work in …. seriously fuck recruiters.

                          But again, seriously, just plough through recruiters. Give them your time, answer their questions, always request the name of the client, hang up on them if they don’t tell you , don’t give them references (I tell them I’ll give them to the client after and interview, and the client can share them with the recruiter if they want)… don’t let them get you down.

                      1. 6

                        tldr: everything is a DB entry.

                        I guess, compared to everything-is-a-file, a DB could be a regulated and formatted way of storing information. Instead of millions of file formats/types, you end up with millions of DB schema. I’m not sure if this is going to help.

                        1. 7

                          Didn’t BeOS already do this 20 years ago…?

                          1. 5

                            Note this article is from 1996 or earlier. The idea was definitely in the air.

                            1. 4

                              It really irks me when documents like this have no dates attached to them.

                              1. 2

                                I did not know that. Thanks!

                                edit: oh wow, that site’s a treasure trove

                                1. 1

                                  The year should be in the title, really.

                                2. 4

                                  Haiku has reimplimented it.

                                  It’s a cool idea. It means that many apps become easier. An mp3 player, for example, doesn’t have to keep a precompiled database of parsed mp3 tags, it can instead offload that work to the filesystem (once those tags have been turned into file attributes). It also means you can have it play “all mp3s on the disk”, rather than building lists of music directories, etc. It can be a remarkable toolset for an application developer.

                                  In fact, IIRC, the Haiku addressbook app uses files that have no content, only attributes. The file name is the contact name, and everything else is added through database operations.

                                  1. 1

                                    Even Microsoft took a crack at the idea in the early 00’s.

                                  2. 4

                                    Many mainframe operating systems have record-oriented filesystems. https://en.wikipedia.org/wiki/Record-oriented_filesystem

                                    1. 2

                                      ls providing a list of files means you don’t have to call with certain flags to get the information you want.

                                      It also means that you don’t have to make sure every tool includes a “parse input” and “format output” layer, since there’s already some structure (this doesn’t rule it out entirely but it means you can survive without it)

                                      I bet a lot more people would be OK doing ops work if you could operate with tools at the same level as most development work

                                    1. 11

                                      Now that they have shown that they will take down websites for moral reasons (or give in to public pressure), they will be forced to police more and more of their customers. This is one year after their first public take-down. I expect the rate to accelerate from here on.

                                      One day they will be taken to court and will try to argue that they are just a pipe and all those cases will be cited as an argument that they are not.

                                      1. 2

                                        I agree with all of that. I’d just add that if history is anything to go by then long before they lose in court their takedown procedures will be formalized and captured by the political right.

                                        1. 1

                                          My point was more that Cloudflare is signaling that they are part of the politician toolbox and so are going to lose control of who they can serve or not. Both sides are using the same tools. This is going to directly impact the trust and relationship they have with their customers.

                                          Anyways, alternatives will popup and the Internet will be fine. The real tragedy is really the families who are suffering right now and all the American people pointing fingers at each-other and trying to solve a crisis in 140 characters.

                                        2. 1

                                          This is the most likely, and most concrete, takeaway I have seen all day.

                                        1. 24

                                          News is the mindkiller, and I doubt discussion here will be worth the flames that we risk.

                                          That said…

                                          Among other things, that resulted in us cooperating around monitoring potential hate sites on our network and notifying law enforcement when there was content that contained an indication of potential violence. We will continue to work within the legal process to share information when we can to hopefully prevent horrific acts of violence. We believe this is our responsibility and, given Cloudflare’s scale and reach, we are hopeful we will continue to make progress toward solving the deeper problem.

                                          This is problematic in the extreme.

                                          1. 15

                                            News is the mindkiller, and I doubt discussion here will be worth the flames that we risk.

                                            Yaaaaawn.

                                            This is problematic in the extreme.

                                            I’m inclined to agree with you there, maybe not that strongly. A subthread that I see in the Shopify and Cloudflare statements of the last years is that they consider themselves basic, unreplacable, state-critical infrastructure like a phone provider, which just isn’t the case.

                                            1. 4

                                              While I agree that legally mandating such things would be problematic (it isn’t currently mandated, as far as I’m aware), I suspect you and I would come up with different reasoning for why it’s problematic.

                                              Meanwhile, Cloudflare mostly seems concerned with public perception, and wants to be seen to be doing something rather than actually do something. I’ve seen claims that this is probably also related to plans to IPO in the not-too-distant future, which often motivates a bit more curation of a company’s public image, at least for a little while.

                                              1. 1

                                                I’ve seen claims that this is probably also related to plans to IPO in the not-too-distant future

                                                Highly likely. They’re a big, growing company aiming to make a pile of money. Such companies often do PR work to boost sales and/or retain customers.

                                              2. 4

                                                This is problematic in the extreme.

                                                As this has been a potential legal requirement for a long time now [0], is the problematic part that they are doing this willingly (as I infer from the paragraph’s tone) rather than under threat of federal penalties [1]?

                                                Or is the problematic part something simpler, i.e. that they are saying this aloud? And in either case, is it any more problematic than it was last week or last month?

                                                [0] So-called “National Security Letters” have existed in something like their current form since 1986.
                                                [1] They initially had no penalties, technically, and got their teeth in 2006.

                                                (For anyone new to this topic, remember to support the EFF. They fight long and hard on the principles about exactly these sorts of things)

                                                1. 2

                                                  Yes, it is a legal requirement. The problematic part is using it as an argument why they should do it.

                                                  1. 1

                                                    Good clarifying questions!

                                                    In order: yes, sorta, again sorta.

                                                    Yes, it’s more problematic because they are saying that they view a personal moral requirement and that they will voluntarily exercise their (growing, vast) surveillance capabilities to do this. Again, quoting for emphasis:

                                                    We believe this is our responsibility and, given Cloudflare’s scale and reach, we are hopeful we will continue to make progress toward solving the deeper problem.

                                                    Like, references to “the deeper problem” looks a little spooky–especially when the deeper problem isn’t explained in terms of the social/political/economic conditions that make radicalization so attractive.

                                                    For the next bit, sorta. It’s not quite that they are saying this out loud–like, the problem was already there, they’re probably already doing it. Buuuut, it does give them the chance to get mainstream techie support for their behavior and capabilities because of leveraging an odious event. That’s always how these things happen, right. That’s also why my answer to your third question is sorta.

                                                    1. 2

                                                      get mainstream techie support for their behavior and capabilities

                                                      I feel the negative moral valence attached to the “behavior and capabilities” in question here, but I really struggled to put my finger on the specifics, and it led to some interesting thoughts.

                                                      First I considered this it in the context of Network Neutrality-esque discussions: maybe a CDN could legally be required to be a “dumb cache” similar to the Network Neutrality goal of requiring an ISP to be a “dumb pipe” (broadly and conceptually, not necessarily thinking about the former Title II implementation).

                                                      But then I realized the capability you referenced had a key phrase above: “growing, vast surveillance capabilities”. Even being a “dumb cache” doesn’t stop anyone from looking in said cache and performing services, for legal authorities or for customers.

                                                      It seems you take issue with Cloudflare being able to perform monitoring of any users of any site that has opted to be their customer? That seems like the responsibility of the site itself, no? Wouldn’t Cloudflare just be helping? Or is the issue that, because Cloudflare is in the US but a customer might not be, the customer is now subject to a form moderation beyond what is required in their jurisdiction? The Cloudflare blog post does mention that their are no shortage of competitors who are happy to step in, so there is a market alternative in that case.

                                                      On the other hand, if Cloudflare is helping a site enforce its existing content policies (e.g. 8chan supposedly has a policy against violent threats?), that seems like it might equally be a useful service offering. The only difference from the “but they’ve been doing that” status quo is the visibility.

                                                      Think of all of the recent hullabaloo about moderation (ala Facebook and Twitter), especially discussions of legal requirements to do so (to say nothing of Australia passing an actual law). For any site or community which relies on user-generated content, and which has policies they would like to enforce, but cannot afford the moderation workforce to do so (i.e. is not Facebook-scale), they could pay their CDN to help them do so for much cheaper. They are already paying the CDN to have the data, so it seems like the most efficient spot for that kind of moderation assistance? Especially if it comes with a CYA for the site operator from the oncoming dogpile of content liability legislation.

                                                      And if the site owner is making the choice, and paying for Cloudflare Cloudmod™ Content Reports a service, it would at least be more transparent in the website’s ToS, privacy policies or otherwise (hopefully?).

                                                      That is: people would not join huge online communities and still feel a false sense of flying-under-the-radar complacency? It’s not that people expect “privacy” in these situations, because they are making public posts, but I have always felt people have a sense along the lines of “Who am I, Stephan McUnimportant, to be banhammered for my threats?”

                                                      Anyway, pulling back from psychological analysis of forum posters, and having laid out my thinking on a content moderation service, I half-expect to see an applicable AWS CloudFront add-on spring up next week. After all, they are the #2 CDN after Cloudflare (iirc) and it might make for a compelling competitive offering.

                                                1. 2

                                                  $WORK:
                                                  After a few data-heavy, debugging-heavy, ops-heavy weeks, I am back to collaborating with my team on feature specs and designs. Also codifying what have been ad-hoc best practices around domain name management, and related settings like SPF and DKIM.

                                                  $HOME:
                                                  Last week I had to be very social, as various commitments aligned themselves poorly, and I am looking forward to less. After a multi-week hiatus my tabletop group is meeting again, so that will probably be the highlight.

                                                  1. 5

                                                    It always terrifies me that a few years back I was using these boards (albeit not for /pol/, and always opposing it’s brigading) and might have encountered these people in discussions. What’s sad is that even if such a site is taken down, it’s quite easy for them to move on, as long as this movement manages to be coordinated and they don’t fragment.

                                                    It took a while for infinity chan to take the place of the second western image board, next to 4chan, but honestly, if it would come to the site being taken down, I think the chances are higher than ever that they could set up a new host faster than before, or even start using a decentralized approach, which coupled with anonymity might become even more “dangerous” (only limited by the need for images to be stored).

                                                    It’s horrible what this kind of format has been associated with, and I sometimes wonder (but don’t hope) that it isn’t intrinsic to image boards per se.

                                                    1. 7

                                                      Yeah, I used to use 8chan a lot. Moved from 4chan in 2014 (the exodus) after the moderation started banning people for speaking out against the cultural zeitgeist, and never went back. The site never used to be like this. I think the political situation in the US radicalised the userbase of /pol/ to such an extent they just took over the entire site. It wasn’t always about antisemitism, white nationalism, and celebrating mass murder. /pol/‘s incessant spamming of every board drove most of the users who aren’t far right away to different platforms.

                                                      1. 6

                                                        /pol/‘s incessant spamming of every board drove most of the users who aren’t far right away to different platforms.

                                                        I am reminded of a quote from Scott Alexander’s The Eternal Struggle:

                                                        The moral of the story is: if you’re against witch-hunts, and you promise to found your own little utopian community where witch-hunts will never happen, your new society will end up consisting of approximately three principled civil libertarians and seven zillion witches. It will be a terrible place to live even if witch-hunts are genuinely wrong.

                                                    1. 9

                                                      So the only alternatives to cash are a no-privacy, government-controlled totalitarian system, or cryptocurrencies? It’s a totally reductionist point of view. There is a huge solution space in between.

                                                      In New Zealand, for example, we hardly use cash, but guess what: it’s not a dystopian nightmare! We simply make payments using our bank debit cards, or credit cards, or even Apple Pay. Seems to work fine.

                                                      1. 6

                                                        Bank debit cards, credit cards, and Apple pay are absolutely vulnerable to being cut off because “you said something someone with power doesn’t like”. Or just by virtue of overzealous (maybe selectively overzealous?) fraud detection measures, which have actually prevented me from making purchases with my own debit and credit cards.

                                                        1. 9

                                                          Given a sufficiently dystopian regime, neither cash nor cryptocurrencies would help you, because in the secret-police torture dungeon you won’t have access to them and there won’t be anything you’d want to buy anyway.

                                                          It’s also weird to me that people only ever raise this in the context of Wikileaks, when it’s been happening to say, adult content for years and years. I know someone who did tech stuff for a comic artist who does a fair bit of NSFW stuff, for example; lots of trouble there finding hosting services, payment processors (for merchandise), etc. – just for drawing comics that sometimes have naked people and sex jokes in them. And that’s without getting into how LGBT resources, abortion resources, and other similar things often get classified as “adult content” and hit with the same broad banhammer as porn does.

                                                          1. 0

                                                            Sounds like that comic artist was creating art that people with power don’t like (or a least art that was close enough that the financial system’s bureaucracy can’t distinguish it). It would be good if there was a way to for people to pay that artist without using channels that can be blocked because a bureaucracy decided not to allow it! ,

                                                            1. 13

                                                              You seem to be stuck on this narrative that it’s very specific “people with power” who are responsible for this. It’s not. It’s a reflection of a society-wide willingness to marginalize certain topics and groups. It happens when conservatives are in power, it happens when liberals are in power, it happens in democracies, it happens in dictatorships.

                                                              In general, the things that are truly fundamentally wrong in modern society are not due to decisions made in smoky back rooms by a sinister cabal of “people with power” twirling their mustaches and cackling. They’re due to decisions made every day by ordinary people. I’d suggest that if you want real, lasting change, a necessary first step is recognizing and accepting this.

                                                              1. 1

                                                                Uhm, no, not quiet. In most cases, it’s unwillingness to get yourself in trouble. The soviet union used lethal force against people peacefully protesting against food prices increase. Even in the 80’s, saying a wrong thing publicly could get you fired and forever locked out of any non-minimum wage jobs. A number of soviet rock musicians worked as janitors etc. for this reason, not because they lacked skills or education. They often had decent jobs until they lost them when their involvement in the underground music scene was discovered. Most ordinary people also thought the ban was ridiculous and their music was wildly popular. The ordinary people, however, had no power to do anything with the sinister people in the back rooms though.

                                                                1. 4

                                                                  The Soviet Union only lasted as long as it did because of the complicity of vast numbers of people. Even people who would – if offered the opportunity – have told you that they hated the system and wished it would end. But every day, they still did things and made choices which propped up and reinforced that system.

                                                                  This isn’t necessarily saying that ordinary Soviet citizens were wrong to make the choices they did. One of the perverse things about these situations is that something which seems like, or even is, the best and most rationally self-interested choice at the level of a specific individual can be a terrible, irrational, society-wrecking choice in aggregate.

                                                                  But it absolutely is the case that the “oh, you did something the people in power don’t like” style of narrative I was replying to is not useful. The things I was bringing up are not going to be fixed by replacing a handful of “people in power”. As Terry Pratchett pointed out a few times in his books, one problem with returning power to “The People” is you find out unpleasant truths about The People.

                                                                    1. 2

                                                                      I keep telling you the all-whites-are-privileged narrative is BS. That plenty exist in oppressive environments. In service sector (esp retail), many are even effectively slaves. The people they serve are in all kinds of groups. Most write-ups on it are rants by people deep in the shit with little potential for positive benefit. That’s one of the best articles I’ve seen on the subject. His background and writing skills made it much more interesting.

                                                                      Thanks for the article! I’m definitely going to put it to good use. I know some folks in service positions that might find some inspiration in it to get better jobs.

                                                            2. 4

                                                              The first scenario seems far-fetched. The second is possible, but you usually have recourse, like calling the bank and getting them to unfreeze the account, or I think my bank now allows me to do it via the mobile app. Besides, cash has its own failure modes! It’s vulnerable to being lost or stolen. I still see a large solution space with different tradeoffs for different solutions.

                                                              1. 6

                                                                The first scenario seems far-fetched.

                                                                You should look up how Wikileaks went down. It wasn’t a FBI, CIA, or SOCOM operation that many thought might be coming. They just pissed off powerful people who, on the banking side, decided to shut off their donations before they leaked on a powerful bank (BofA suspected). Those blocking donations were Visa, Mastercard, and Paypal that I recall. Then, Wikileaks withered and died.

                                                                No speculation required. It already happened. Under the Patriot Act, it could’ve happened repeatedly without you knowing why since the order would be classified with NDA. The U.S. is a quasi-police state. Suspect the worst until federal and secret government powers are reigned in via laws with teeth. Hell, GAO said Congress oversight didn’t even read their reports on NSA abuse. Congress also made some violators immune to what they did with later legislation. Assume the worst since there’s plenty reason to at this point.

                                                                1. 3

                                                                  …it could’ve happened repeatedly without you knowing why since the order would be classified with NDA.

                                                                  You probably mean NSL? National Security Letter?

                                                                  Much, much worse than any NDA.

                                                                  1. 1

                                                                    Well, any government sealing of what’s going on. It could be NDA, NSL, court order (esp FISA), etc.

                                                                  2. 3

                                                                    I knew this was going to come up :) But WikiLeaks is an exceptional example, and anyway the proximate cause of its issues was excess corporate power, so it’s tangential to what I was commenting on.

                                                                    Regardless, there is a multitude of solutions that would prevent this scenario, and jumping straight to cryptocurrencies is not required.

                                                                    1. 1

                                                                      That last part is true. The others are a maybe. For instance, people periodically run into Paypal freezes. For normal banks, I think people’s money is probably safer in them due to both muggers and civil forfeiture. Folks irreversibly lose cash more often than digital cash with higher damages. Unless we’re talking ACH but basic security mitigates that.

                                                                    2. 1

                                                                      Pretty scary that a handful of companies control commerce. If Mastercard, AMEX, Paypal and Visa decides to not work with you, your effectively cut off from a large portion of the market.

                                                                      1. 1

                                                                        True. I’ll add that online just Paypal will cause a big loss cuz folks trust its escrow. AMEX you can usually ditch since (a) many shops dont take it and (b) most AMEX users have MC/VISA backup for that reason. Whereas, losing MC or VISA is throwing your wallet out the window. Many people don’t even carry cash.

                                                                        I still encourage everyone to keep cash on them in case cards go down at a store. Saved my butt and helped others many times.

                                                                      2. 1

                                                                        Suspect the worst until federal and secret government powers are reigned in via laws with teeth.

                                                                        Given many recent political events, I’m becoming suspicious that any number or combination of laws can reign in the mess we have now. Almost seems like the Government is just to darn big to ever really get under control.

                                                                        Though I’m also concerned that if we cut it back too hard, we may just give even more power to corporations, which aren’t that much better.

                                                                1. 7

                                                                  This is great! The fact that this ships with a UI to give a checklist and everything makes this super easy to adopt.

                                                                  The one thing that would be excellent would be if there was a way to offer runbook results. Like “I ran this checklist, here are my notes on each step for any weirdness, and here’s a text file that can be looked at later”. This would help with keeping track of what happened/any improvements that might be necessary later.

                                                                  1. 3

                                                                    That is exactly what was on my mind halfway through reading this. It comes very close to meeting an operational need, but I would need to bolt on something to generate an artifact that could be saved and reviewed, especially for exceptional cases.

                                                                    1. 2

                                                                      I definitely considered adding a solution for recording notes at each step. I wanted to keep Runbook’s footprint small so opted to not implement that feature. That being said, the functionality can be added pretty easily adding a runbook hook to prompt for inputing notes after each step, and a hook at the end of the book to store the notes. Not implementing this in Runbook allows for flexibility to save the notes to a file, email them to yourself, store them in a database, etc.

                                                                    1. 6

                                                                      Ports. The t480s has 2 USB-A ports and 2 USB-C ports. It also has a full size HDMI, SD card slot, and full-size Ethernet. Is 0.14” difference in thinness worth access to the ports, user upgrade-ability, and the longevity of the keyboard?

                                                                      Given that there are quite a few usb-c hubs[1], or single-use-case (eg. hdmi for presentations) dongles, out there that offer the ports in a breakout/hub/dongle format, I don’t desire a return of all the ports that I use so occasionally/seldom. Paying the size/thickness/weight tax all the time for something I use rarely isn’t a great tradeoff for me.

                                                                      Then again, I use a laptop to be mobile, not as a desktop replacement. I realize that not everyone does this, so ymmv.

                                                                      [1]: Kingston’s Nucleum has two USB 3.0 ports, an HDMI port, a SD and microSD card slot, one USB-C charging port and one regular USB-C port

                                                                      1. 13

                                                                        USB-C devices and hubs are pretty bad if you want to run more than one 4k60 display. Some can’t even do one. You can’t just plug in one hub and be done. I had to plug in three different USB-C dongles to get two 4k60 monitors, ethernet, keyboard, mouse, audio going on my 15” rMBP. Worse, USB-C slips and loses connectivity very easily.

                                                                        The whole situation is asinine. Yes they’re meant to be mobile but I’m not paying $3k for something functionally equivalent to a netbook on steroids.

                                                                        1. 6

                                                                          USB-C slips and loses connectivity very easily

                                                                          I missed this part earlier (or maybe you edited it in later). I very much agree with this one. I find usb-c a bit fiddlier than I would like, especially for power in comparison to the old apple magnetic (magsafe) power connectors. RIP magsafe.

                                                                          1. 2

                                                                            Multiple 4k60 displays seems a bit like a job for a desktop to me. That said, I agree that sucks. I wonder if it is a limitation of usb-c or just so few people with that use-case that nobody makes one that can do that yet.

                                                                            EDIT: hmm. looks like a displayport 1.2 limitation, based on some searching. DP 1.2 supports a single 4K 60 Hz monitor, two 1440p 60 monitors, and so on. DP 1.3 supports more (gfx card willing), but I think usb-c/thunderbolt3 is still DP1.2. bummer.

                                                                            1. 5

                                                                              It’s a MacBook Pro. I was running 2 displays off a 12” Thinkpad with the dock years and years ago.

                                                                              1. 4

                                                                                And you can still do so if those displays aren’t 4k. The terrible industry-wide state of getting pixels from ram to screen is not Apple’s doing and any attempt they make to fix it themselves will be met with endless pearl-clutching about “proprietary connections”

                                                                                1. 2

                                                                                  I don’t mind how they fix it, I would prefer more port types than just USB-C. I think the decision to only have USB-C is aesthetic not functionality.

                                                                                  1. 3

                                                                                    There are functional reasons to want only one port on your device. However, their decision to go about it in classic Apple fashion, making the change out of nowhere, was certainly a head-scratcher.

                                                                                2. 4

                                                                                  A MBP will absolutely run multiple 4K displays on a single port.

                                                                                  Fuck, a Mac mini with just Intel graphics will run 2 4K displays, also from a single port.

                                                                                  1. 2

                                                                                    I get that it has Pro in the name. Did you use docking at every location where you worked with multiple monitors? Monitors these days also just seem huge to me. I can’t imagine someone having two 30+ inch 4k monitors on their desk ( that’s a /lot/ of terminals! ;) ) and yet choosing to drive it with a laptop. The workflow comparison between that and running undocked seems significant.

                                                                                    I do wonder if some portion of people get laptops just because, or on the off chance that they might do something on the go, but then they end up using them docked 100% of the time anyway. Definitely not saying this was you though, as I have no clue how you worked or used your machines.

                                                                                    1. 5

                                                                                      Some people don’t buy laptops but their company only provides laptops. You have to be able to use the laptop as a desktop replacement if you need/want to. Heck, desktops are a vanishing breed, I imagine 90% of them are sold as gaming machines, these days.

                                                                                      1. 2

                                                                                        Chiming in with an anecdote, but I will emphasize this is my singular experience and preference.

                                                                                        I have a 2015-era Thinkpad X1 Carbon whose built-in display is 1440p. Most of my programming uses, I use it docked to an additional 1440p display, sometimes two and turn off the built-in screen in favor of two full-sized monitors. In both cases they are only 25” displays, but the additional pixels are very appreciated. I don’t really see myself upgrading those to 4K screens, but I can imagine others who might.

                                                                                        Some non-programming tasks also benefit greatly from the extra screen real-estate. I do will sometimes design in Figma (full screen on one monitor) with the second monitor hosting two windows: an editor window for referencing existing CSS in our projects, and a browser open to the Spec for the project whose design I am working on

                                                                                        I am very much in the “laptop for the off chance they might do something on the go” crowd, but those times are far from insignificant. A lot of it is on-the-go comms with my team, doing project management and product management tasks. I definitely would not be effective with only a desktop, i.e. only a phone for on-the-go productivity.

                                                                                  2. 0

                                                                                    Limiting yourself to a USB-C (protocol) dock/device when you have TB3 ports but clearly want a not-average-joe functionality makes no sense to me.

                                                                                  3. 3

                                                                                    For me, this (multiple do-almost-anything ports, vs several each do-1-specific-thing ports) is the killer thing, but it works specifically for Macs because those ports are all TB3 not “just” USB-C.

                                                                                    For basic things (i.e. the common complaint about the pre-TB3 MBP having “USB-A, HDMI and SD card” you can get a single USB-C ‘hub’ to provide all those ports, but whenever possible (and particularly for stuff relating to displays) I actually tend to get/suggest TB3 devices.

                                                                                    1. 2

                                                                                      My question — and the question of most people I know who have a newer MacBook Pro — why not both? Why not have USB-C ports and a HDMI? TB3 is awesome but it doesn’t have to be exclusive.

                                                                                      1. 4

                                                                                        It’s entirely possible Apples reasoning is aesthetic, but to me, a HDMI port is useless, and usually adding a HDMI port means you lose something else (see: the 2018 Mac mini that only supports 2x4k displays over TB3 because the third ‘supported’ display must be over HDMI).

                                                                                        HDMI is also one of the least-hard “problems” to solve: you already need a HDMI cable, so use a different HDMI cable, with USB-C on one end.

                                                                                        1. 2

                                                                                          You’re right. The Mac mini is a really good example of a combination of ports that folks really enjoy having access too.

                                                                                          This is all a tangent though, the reality is Apple is bent on making their laptops like their tablets and I wish they wouldn’t. In the end though it’s all preference.

                                                                                          1. 3

                                                                                            reality is Apple is bent on making their laptops like their tablets

                                                                                            Maybe the reality as you see it, but until they add touch screens to their laptops, I’m going to remain pretty dubious about that viewpoint.

                                                                                            1. 2

                                                                                              You missed my point. Not sure if that was deliberate or not.

                                                                                              The Mac mini has HDMI.. for some reason, but because it does, you can’t run 3 DisplayPort 4K displays from it. You can run two DP, and one has to be HDMI.

                                                                                              I would be happier if the mini had forgone HDMI for more TB3 ports (or even dedicated (mini) DisplayPort would be better than HDMI). I’d even give up the USB-A ports for more TB3 ports.

                                                                                              reality is Apple is bent on making their laptops like their tablets

                                                                                              I really cannot agree with that at all and I wonder if you somehow don’t understand that TB3 and USB-C are not the same thing.

                                                                                              1. 2

                                                                                                you can’t run 3 DisplayPort 4K displays […] I really cannot agree with that at all and I wonder if you somehow don’t understand that TB3 and USB-C are not the same thing.

                                                                                                Well, if we are going to be pedantic ;). If you use DisplayPort 4K displays, you are not using Thunderbolt 3, you are using the USB-C DisplayPort alternate mode. They are separate things, since there are also machines that have USB-C ports that support DisplayPort alt mode, but not Thunderbolt 3, such as the MacBook 12” [1].

                                                                                                So, why do you care about USB-C Thunderbolt 3 ports if you are going to hook up a DisplayPort display?

                                                                                                (BTW. it seems that Apple’s wording is intentionally muddy here for marketing purposes.)

                                                                                                [1] https://support.apple.com/en-us/HT206587

                                                                                                1. 1

                                                                                                  I use a TB3 to dual DisplayPort adapter, so it only takes one port. I can guarantee you it is not using USB-C alt-mode.

                                                                                                  1. 1

                                                                                                    Now you are adding new data points. The default (and much cheaper) thing to do is to hook up a DisplayPort display directly to a Mac Mini or MacBook. Which is done using a regular passive DisplayPort <-> USB-C cable.

                                                                                                    1. 1

                                                                                                      No, I’m not.

                                                                                                      You asked what’s wrong with a HDMI port. I told you: takes away video streams that would otherwise be available over DisplayPort.

                                                                                                      Whether they’re routed over 3 USB-C to DP cables using Alt Mode, or via a TB3 adapter is irrelevant.

                                                                                                      Go look at any tech forum with people having issues with displays: a decent chunk of them it’s because they’re using HDMI, because it was literally designed for TVs and receivers, being used for computer displays is an after thought, and it’s very apparent.

                                                                                                      1. 1

                                                                                                        HDMI doesn’t “take away” video streams, Apple does. If Apple really wanted, they could’ve added ability to use 3rd video stream using USB-C, but they didn’t. There is really nothing stopping them, except maybe the Intel chip that may not have a 3rd DP output.

                                                                                                        1. 1

                                                                                                          The UHD 630 supports 3 displays over dp hdmi or edp.

                                                                                                          Apple chose to include hdmi which means one of those outputs from the igpu is used or “taken away” from potential as a DP output over USB-c/TB3.

                                                                                            2. 1

                                                                                              It’s entirely possible Apples reasoning is aesthetic, but to me, a HDMI port is useless, and usually adding a HDMI port means you lose something else (see: the 2018 Mac mini that only supports 2x4k displays over TB3 because the third ‘supported’ display must be over HDMI).

                                                                                              HDMI 2.0 supports 4k displays. The Mac Mini specs explicitly state that you can drive three 4k screens:

                                                                                              Up to three displays: Two displays with 4096-by-2304 resolution at 60Hz connected via Thunderbolt 3 plus one display with 4096-by-2160 resolution at 60Hz connected via HDMI 2.0

                                                                                              https://www.apple.com/mac-mini/specs/

                                                                                              1. 1

                                                                                                That’s what I said. It forces one display of the three to be hdmi, which IMO is garbage compared to DP. I’d rather have no HDMI and be able to drive 3 displays over TB3/DP

                                                                                                1. 1

                                                                                                  Your comment was vague, it seemed to suggest that you cannot drive three 4k displays, but the point is that one of them has to be driven through HDMI. Fair enough.

                                                                                                  Apple’s rationale is very logical. Quite some people use Mac Mini’s as media centers. They’ll have a TV with HDMI connectors and HDMI cables. So, it lowers the friction for a significant chunk of the audience for a tiny subset that insists on driving three 4k displays through DP. I am not saying that it is not a legitimate use case, but a niche. Apple will probably tell you to buy a Mac Pro or something.

                                                                                                  1. 1

                                                                                                    What is vague about this:

                                                                                                    the 2018 Mac mini that only supports 2x4k displays over TB3 because the third ‘supported’ display must be over HDMI

                                                                                                    I would bet money Apple do not include HDMI on a Mac mini for those few people who still try to run a media centre on one. Apple’s “solution” (in terms of what they support feature wise and expect people would use) is AppleTV.

                                                                                                    They provide HDMI because it’s designed as a “bring your own display” device and a bunch of cheap shit displays have HDMI input rather than DP.

                                                                                            3. 2

                                                                                              Another reason is that the HDMI connector is bigger than the side of the MacBook Pro. Mini and micro HDMI connectors could fit but hey, even if it’s HDMI you need not-so-common adapters or special cables so USB-C/TB3 is not a bad alternative.

                                                                                          2. 2

                                                                                            The t480s does have 2 USB-C ports for breaking out to more exotic ports but having a nice selection of ports is great.

                                                                                          1. 4

                                                                                            $WORK

                                                                                            Probably more code than usual this week. Lots of tiny changes to a big marketing engine, lots of tests for data transforms before they get deployed. Lots of coordinating with the team who uses the system.

                                                                                            $FUN

                                                                                            Have two large pots newly empty (lost plants to fungus) and didn’t want them taking up two pots worth of balcony space anymore. Over the weekend I cobbled together a two-tiered planter with some wood, but to rest it lower pot, in the soil, and I am concerned about rot (and more importantly a fungus growing in said rot). Buying some liquid rubber to waterproof the supports.

                                                                                            Goal is for the upper pot to hold succulents and the bottom to hold vines that will grow up the supports toward the second pot and then dangle back down.

                                                                                            $OTHER

                                                                                            Going to attempt recovery of an Intel RST-based drive mirror for a family member’s computer that had a failure. I have never attempted recovery of one of those from Linux, so we’ll see how it goes. I know that dmraid used to exist for this purpose, but haven’t checked in on it in at least 7 years.

                                                                                            1. 14

                                                                                              “Congressman, I don’t have all the answers to your very technical questions…”

                                                                                              That’s not something you hear everyday. Who is this Riggleman guy?

                                                                                              1. 7
                                                                                                1. 2

                                                                                                  It’s interesting because he sounds decently familiar with GitHub. I wonder how many Congresspersons have GitHub accounts, if any?

                                                                                                  1. 5

                                                                                                    Perhaps your expectations of congressman is so low that the ability and initiative to use a website to do research is the more surprising part, because it doesn’t take a lot of familiarity with Github to perform a search. He did sound familiar with programming on more than a surface level, however.

                                                                                                    1. 7

                                                                                                      He was able to talk confidently about nightly toolchain builds though, which takes a fair amount of technical understanding.

                                                                                                      1. 12

                                                                                                        His mention of DoD practice leads me to think he picked this up as an intelligence officer. You don’t have to be an experienced developer to recognize high-level risks. Extrapolating from a single point of experience working for a former I.O. for several years, they have a keen skill for picking through details.

                                                                                                        1. 1

                                                                                                          He was also an NSA contractor.

                                                                                                          1. 1

                                                                                                            I think he did indeed mention he had a background in intelligence.

                                                                                                        2. 4

                                                                                                          What jgb said. He talked like a programmer or project manager, not someone vaguely familiar with it.

                                                                                                          1. -5

                                                                                                            It’s not so much low expectations it’s just the average age of a congressperson is 57, so it’s kind of new to see folks who would be familiar with something like Git.

                                                                                                            1. 29

                                                                                                              About half my computer science lecturers at university were older than that, and they were all familiar with git. My dad’s about that age, and he’s familiar with git.

                                                                                                              57 isn’t actually particularly old. Many of the pioneers of computer science have died of old age at this point. We’re well past the point where programming or computer science is a ‘young man’s game’ in any reasonable sense.

                                                                                                              1. 5

                                                                                                                The number of programmers doubled roughly every 5 years for a long period of time. Possibly from the beginning up until recently. This suggests that there are 64 times more 25 years old programmers than there are 55 years old programmers. Yes, all the pioneers are now old. But they were exactly that: few pioneers.

                                                                                                                Programming has never been a young man’s game, but this exponential growth skews the numbers like crazy, and make it appear like a young man’s game. After all, if the only thing you know about someone is their age, the older they are, the less likely they are to have learned programming.

                                                                                                                1. 2

                                                                                                                  there was definitely a dip in the rate of CS enrollment after the dotcom bust in 2000, but then numbers of both major and nonmajor CS exposure has seen a massive surge since 2005

                                                                                                                  1. 1

                                                                                                                    Very well explained, thank you!

                                                                                                                  2. 8

                                                                                                                    Linus Torvalds himself turns 50 this year.

                                                                                                                    1. 4

                                                                                                                      57 and working in computer science is different from the average 57 year old who may not have an in-depth exposure to computer science.

                                                                                                                      1. 20

                                                                                                                        I wouldn’t expect that the average 57 year old has a better or worse idea of git than the average 21 year old. People often claim that young people are better with technology. In my experience, they tend to not be at all.

                                                                                                                        1. 4

                                                                                                                          In my experience, they tend to not be at all.

                                                                                                                          Young people work for cheap and are more easily taken advantage of.

                                                                                                                          Why do you think so much of advertising is aimed at people in their twenties? Some disposable income and not as much life experience.

                                                                                                                          1. 3

                                                                                                                            Yeah, the average 21 year old also has no exposure to computer science either. I agree it’s a pointless comparison.

                                                                                                                        2. 2

                                                                                                                          Good point! My bias is showing (growing up where I did, the only people I knew who knew about computers were my age). This makes me hopeful that I can still be programming well into retirement age :)

                                                                                                                  3. -1

                                                                                                                    Yuck

                                                                                                                    1. 1

                                                                                                                      I agree that his tie isn’t the most flattering, but I wouldn’t necessarily say “Yuck”.

                                                                                                                      Care to elaborate?

                                                                                                                      1. 1

                                                                                                                        Lol I didn’t notice the tie. Purely a political yuck. He’s proud of bombing Afghanistan, pro-trump tax cuts, pro-deregulation, and anti-gun control. ¯_(ツ)_/¯ to whether his staffer gave him talking points on rust and javascript.

                                                                                                                1. 6

                                                                                                                  Maybe I am mis-remembering my C, but isn’t this more like ++i pre-increment? In that the expression evaluates to the incremented value? I am basing this off of the psuedocode presented of:

                                                                                                                  class Integer
                                                                                                                    define_method '++' do
                                                                                                                      self = self + 1
                                                                                                                    end
                                                                                                                  end
                                                                                                                  

                                                                                                                  For which the result of the assignment is returned from this ++ method (if it worked).

                                                                                                                  Now that I think about it, true i++ post-increment feels like very awkward Ruby, both at its object-oriented core, and in its functional flourishes. On the other hand, pre-increment fits easily as “just another method”, akin to i+=1 though possibly without the gotchas of assignment precedence.

                                                                                                                  Post-increment has to concern itself with manipulating which immutable value object that is assigned to a variable, more than a mutation internal to an object itself. A true i++ would need to:

                                                                                                                  1. Store the original value.
                                                                                                                  2. Change the value assigned to the variable name, ala Binding#local_variable_set.
                                                                                                                  3. Return the original value.

                                                                                                                  This still likely require an MRI patch, though I haven’t though too deeply about it.

                                                                                                                  1. 4

                                                                                                                    Good observation, your memories of C are right. What I implemented is a weird the pre-increment operator working as postfix. I’ll update the post to acknowledge this, thanks!

                                                                                                                    I initially implemented the pre-increment operator (++some_var) and that’d be correct because the expression evaluates to the new value of some_var. However I only changed it to be postfix for a stupid reason: it looked better to me.

                                                                                                                    I could have gone further and implement the post-increment & post-decrement the proper way but decided to leave it there for now, doing so was a bit tricker as the expression evaluates to something different from the assigned value (as you pointed out).

                                                                                                                    My only goal was to mess around with Ruby and challenge myself to make changes in it, there’re tons of experiments you could do for fun. For example enforcing all method calls to have parenthesis so that @ngoldbaum would like Ruby more 😜.

                                                                                                                    1. 3

                                                                                                                      I fully endorse your JRI fork of the ruby interpreter

                                                                                                                  1. 4

                                                                                                                    A good overview, with a solid explanation of why the shortcomings are shortcomings. I will lead with that before I have to be “that poster” for a moment, and complain about something more meta to the article, than to the content.

                                                                                                                    Technical blog posts that lack dates are difficult (if not impossible) to trust, especially regarding newer/recent features of a tool, service or library (relative to its age).

                                                                                                                    While the article says that Action Cable was “recently introduced”, Rails 5.0 and Action Cable were released in June 2016: Three years ago. A lot may have changed since then, maybe some of it was an improvement, maybe some of it remains unchanged?

                                                                                                                    It is hard to know whether to trust the caveats and analysis put forth in the article, without knowing how far this perspective might have drifted from the current state of Action Cable.

                                                                                                                    1. 1

                                                                                                                      I did view-source and found a date in the code(this is a big bugaboo for me too):

                                                                                                                        https://ik.imagekit.io/ably/ghost/prod/2019/06/Screenshot-2019-06-11-at-12.16.38.png?tr=w-350 350w,
                                                                                                                      

                                                                                                                      Hoping it’s not something that gets updated automatically somehow?

                                                                                                                    1. 14

                                                                                                                      Thanks, I feel like a dick, now.

                                                                                                                      On a serious note, that hit me right in the feels. I wouldn’t go as far as saying that I am overconfident, but I’m definitely a loudmouth, and tend to argue to exhaustion when I think I’m right.

                                                                                                                      I’ve been working for a while in recognizing that I might be wrong and try to clearly communicate that I am open (and in fact, often hoping) to be proven wrong, but it’s a process, and I can’t help but wonder how often have I just been a massive dick and prevented other people from even throwing an idea =(

                                                                                                                      1. 8

                                                                                                                        I’m almost exactly the opposite. I realize that usually my preferences boil down to: “I like this way because I’m used to it”, or “I don’t think it matters”. I used to be the most experienced C# programmer on my team. My teammates used to ask me questions like “Should I assign a type explicitly or just use ‘var’?” any I would say that that’s a personal preference and it doesn’t really matter. Another programmer with a much more pronounced opinion joined the team, and I noticed that people liked his answers a lot more. Sometimes people just like to be told what to do, especially when the consequences of the choices aren’t so clear.

                                                                                                                        1. 5

                                                                                                                          Sometimes people just like to be told what to do, especially when the consequences of the choices aren’t so clear.

                                                                                                                          This, and also cases where the consequences on either side of a tradeoff are so minor, that the energy spent deliberating them out is costlier than just making a call and moving on. I spent far longer learning this, and fixing my behavior, than I wish I had.

                                                                                                                          On so many of these low-impact-low-cost details, where I did not strongly care, where I could expect another senior to reasonably disagree (even just for reasons of “this is what I am used to instead”), I would give teammates a full-depth, longwinded explanation, only to end in an equivocation and let them decide. Maybe one out of a dozen times they learned something, but often I was wasting people’s time when they just wanted a boolean result from the ask_swifthand function.

                                                                                                                          The first step in fixing this was realizing why I always led with longwinded explanations. It turned out to be misapplied empathy (which I assume-by-default that I lack, hence it took a while to realize).

                                                                                                                          I personally value knowing the detailed ins-and-outs wherever possible, and so I saw extending a full explanation to another person as a sign of respect: share all the learning, and help them make their own decision. But when that comes by wasting their time (on a low-impact-low-cost choice), was not being perceived that way.

                                                                                                                          Change was slow. I first changed my explanations to lead with the decision before launching into the explanation, giving a TL;DR to frame their expectation. After some time doing this, I began leading with the decision and then asking “There are reasons I could dive into, but they are subtle and inconsequential. So I’ll leave it there, unless you are curious?” followed by a long, awkward pause while I wait for an answer.

                                                                                                                          Due to some personality quirks that pause is the hardest part for me, but it gets the job done. It balances respecting their time by giving them the option to walk away with my desire to extend a courtesy that I would (personally) value of learning more.

                                                                                                                          Ironically, I do not always extend this sort of preemptive empathy to the rest of my life’s conversations. The last paragraph in the article really hit home, as I know friends and family often feel my SOLH is overconfidence layered with stubbornness.

                                                                                                                          1. 3

                                                                                                                            Sometimes people just like to be told what to do, especially when the consequences of the choices aren’t so clear.

                                                                                                                            Newbies need to be fed opinions because they don’t have enough experience to have any of their own, and the ones they might have at the moment are more likely to be wrong than right. Like, yes, you can write thousand-line subroutines in Python, that’s certainly something the language allows, but more mature opinion will state that writing smaller subroutines is better for reasons of ease of modification a neophyte hasn’t run into yet.

                                                                                                                            Gnomonic pronouncements make things go faster, but once the learner has some experience of their own, pushback is to be expected and should be encouraged. Except with things like styleguides. Those are completely arbitrary and set in stone for precisely that reason.

                                                                                                                            So teachers need to have strong opinions because they can’t go over every single thing when they answer a single question, but those opinions must be held loosely enough that students can successfully challenge them as they gain enough knowledge to exercise their own agency.

                                                                                                                            1. 2

                                                                                                                              This is one thing that’s true: people like to be told what to do. People should be encouraged to think for themselves. The best of both worlds is perhaps by explaining the difference and explaining why you lean the way you do. That way you teach thought and give a straight answer.

                                                                                                                            2. 5

                                                                                                                              tend to argue to exhaustion

                                                                                                                              that doesn’t sound “loosely held” :)

                                                                                                                              1. 1

                                                                                                                                I recently had an argument that went on for an hour until I conceded from frustration. Once we switched from the what to the how they immediately took to my original argument. Loosely held seems like it can be in the eye of the beholder.

                                                                                                                                1. 1

                                                                                                                                  Well, for some definition of loosely =P

                                                                                                                                2. 3

                                                                                                                                  I am open (and in fact, often hoping) to be proven wrong

                                                                                                                                  Say that clearly and directly. Tell the other person that you are not feeling personally attacked and hope to be proven wrong.

                                                                                                                                1. 65

                                                                                                                                  In the Mastodon universe, technically-minded users are encouraged to run their own node. Sounds good. To install a Mastodon node, I am instructed to install recent versions of

                                                                                                                                  • Ruby
                                                                                                                                  • Node.JS
                                                                                                                                  • Redis
                                                                                                                                  • PostgreSQL
                                                                                                                                  • nginx

                                                                                                                                  This does not seem like a reasonable set of dependencies to me. In particular, using two interpreted languages, two databases, and a separate web server presumably acting as a frontend, all seems like overkill. I look forward to when the Mastodon devs are able to tame this complexity, and reduce the codebase to a something like single (ideally non-interpreted) language and a single database. Or, even better, a single binary that manages its own data on disk, using e.g. embedded SQLite. Until then, I’ll pass.

                                                                                                                                  1. 22

                                                                                                                                    Totally agree. I heard Pleroma has less dependencies though it looks like it depends a bit on which OS you’re running.

                                                                                                                                    1. 11

                                                                                                                                      Compared to Mastodon, Pleroma is a piece of cake to install; I followed their tutorial and had an instance set up and running in about twenty minutes on a fresh server.

                                                                                                                                      From memory all I needed install was Nginx, Elixir and Postgres, two of which were already set up and configured for other projects.

                                                                                                                                      My server is a quad core ARMv7 with 2GB RAM and averages maybe 0.5 load when I hit heavy usage… it does transit a lot of traffic though, since the 1st January my server has pushed out 530GB of traffic.

                                                                                                                                      1. 2

                                                                                                                                        doesnt Elixir require Erlang to run?

                                                                                                                                        1. 2

                                                                                                                                          It does. Some linux distributions will require adding the Erlang repo before installing elixir but most seem to have it already included: https://elixir-lang.org/install.html#unix-and-unix-like meaning its a simple one line command to install e.g pkg install elixir

                                                                                                                                      2. 7

                                                                                                                                        I’m not a huge social person, but I had only heard of Pleroma without investigating it. After looking a bit more, I don’t really understand why someone would choose Mastodon over Pleroma. They do basically the same thing, but Pleroma takes less resources. Anyone who chose Mastodon over Pleroma have a reason why?

                                                                                                                                        1. 6

                                                                                                                                          Mastodon has more features right now. That’s about it.

                                                                                                                                          1. 4

                                                                                                                                            Pleroma didn’t have releases for a looong time. They finally started down that route. They also don’t have official Docker containers and config changes require recompiling (just due to the way they have Elixir and builds setup). It was a pain to write my Docker container for it.

                                                                                                                                            Pleroma also lacks moderation tools (you need to add blocked domains to the config), it doesn’t allow remote follow/interactions (if you see a status elsewhere on Mastodon, you can click remote-reply, it will ask your server name, redirect you to your server and then you can reply to someone you don’t follow) and a couple of other features.

                                                                                                                                            Misskey is another alternative that looks promising.

                                                                                                                                            1. 2

                                                                                                                                              it doesn’t allow remote follow/interactions (if you see a status elsewhere on Mastodon, you can click remote-reply, it will ask your server name, redirect you to your server and then you can reply to someone you don’t follow)

                                                                                                                                              I think that might just be the Pleroma FA - if I’m using the Mastodon FE, I get the same interaction on my Pleroma instance replying to someone on a different instance as when I’m using octodon.social (unless I’m radically misunderstanding your sentence)

                                                                                                                                              1. 1

                                                                                                                                                Thanks, this is a really great response. I actually took a quick look at their docs and saw they didn’t have any FreeBSD guide set up, so I stopped looking. I use Vultr’s $2.50 FreeBSD vps and I didn’t feel like fiddling with anything that particular night. I wish they did have an official docker container for it.

                                                                                                                                              2. 3

                                                                                                                                                Pleroma has a bunch of fiddly issues - it doesn’t do streaming properly (bitlbee-mastodon won’t work), the UI doesn’t have any “compose DM” functionality that I can find, I had huge problems with a long password, etc. But they’re mostly minor annoyances than show stoppers for now.

                                                                                                                                              3. 7

                                                                                                                                                It doesn’t depend - they’ve just gone further to define what to do for each OS!

                                                                                                                                                1. 4

                                                                                                                                                  I guess it’s mainly the ImageMagick dependency for OpenBSD that got me thinking otherwise.

                                                                                                                                                  OpenBSD

                                                                                                                                                  • elixir
                                                                                                                                                  • gmake
                                                                                                                                                  • ImageMagick
                                                                                                                                                  • git
                                                                                                                                                  • postgresql-server
                                                                                                                                                  • postgresql-contrib

                                                                                                                                                  Debian Based Distributions

                                                                                                                                                  • postgresql
                                                                                                                                                  • postgresql-contrib
                                                                                                                                                  • elixir
                                                                                                                                                  • erlang-dev
                                                                                                                                                  • erlang-tools
                                                                                                                                                  • erlang-parsetools
                                                                                                                                                  • erlang-xmerl
                                                                                                                                                  • git
                                                                                                                                                  • build-essential
                                                                                                                                                  1. 3

                                                                                                                                                    imagemagick is purely optional. The only hard dependencies are postgresql and elixir (and some reverse proxy like nginx)

                                                                                                                                                    1. 4

                                                                                                                                                      imagemagick is strongly recommended though so you can enable the Mogrify filter on uploads and actually strip exif data

                                                                                                                                                2. 3

                                                                                                                                                  Specifically, quoting from their readme:

                                                                                                                                                  Pleroma is written in Elixir, high-performance and can run on small devices like a Raspberry Pi.

                                                                                                                                                  As to the DB, they seem to use Postgres.

                                                                                                                                                  The author of the app posted his list of differences, but I’m not sure if it’s complete and what it really means. I haven’t found a better comparison yet, however.

                                                                                                                                                3. 16

                                                                                                                                                  Unfortunately I have to agree. I self-host 99% of my online services, and sysadmin for a living. I tried mastodon for a few months, but its installation and management process was far more complicated than anything I’m used to. (I run everything on OpenBSD, so the docker image isn’t an option for me.)

                                                                                                                                                  In addition to getting NodeJS, Ruby, and all the other dependencies installed, I had to write 3 separate rc files to run 3 separate daemons to keep the thing running. Compared to something like Gitea, which just requires running a single Go executable and a Postgres DB, it was a massive amount of toil.

                                                                                                                                                  The mastodon culture really wasn’t a fit for me either. Even in technical spaces, there was a huge amount of politics/soapboxing. I realized I hadn’t even logged in for a few weeks so I just canned my instance.

                                                                                                                                                  Over the past year I’ve given up on the whole social network thing and stick to Matrix/IRC/XMPP/email. I’ve been much happier as a result and there’s a plethora of quality native clients (many are text-based). I’m especially happy on Matrix now that I’ve discovered weechat-matrix.

                                                                                                                                                  I don’t mean to discourage federated projects like Mastodon though - I’m always a fan of anything involving well-known URLs or SRV records!

                                                                                                                                                  1. 11

                                                                                                                                                    Fortunately the “fediverse” is glued by a standard protocol (ActivityPub) that is quite simple so if one implementation (e.g. Mastodon) doesn’t suit someone’s needs it’s not a big problem - just searching for a better one and it still interconnects with the rest of the world.

                                                                                                                                                    (I’ve written a small proof-of-concept ActivityPub clients and servers, it works and federates, see also this).

                                                                                                                                                    For me the more important problems are not implementation issues with one server but rather design issues within the protocol. For example established standards such as e-mail or XMPP have a way to delegate responsibility of running a server of a particular protocol but still use bare domain for user identifies. In e-mail that is MX records in XMPP it’s DNS SRV records. ActivityPub doesn’t demand anything like it and even though Mastodon tries to provide something that would fix that issue - WebFinger, other implementations are not interested in that (e.g. Pleroma). And then one is left with instances such as “social.company.com”.

                                                                                                                                                    For example - Pleroma’s developer’s id is lain@pleroma.soykaf.com.

                                                                                                                                                    1. 16

                                                                                                                                                      This is a completely reasonable and uncontroversial set of dependencies for a web app. Some of the largest web apps on the Internet run this stack. That is a good thing, because when Fediverse nodes need to scale there are well-understood ways of doing it.

                                                                                                                                                      Success in social networking is entirely about network effects and that means low barrier to entry is table stakes. Yeah, it’d be cool if someone built the type of node you’re talking about, but it would be a curiosity pursued only by the most technical users. If that were the barrier to entry for the network, there would be no network.

                                                                                                                                                      1. 39

                                                                                                                                                        This is a completely reasonable and uncontroversial set of dependencies for a web app. Some of the largest web apps on the Internet run this stack.

                                                                                                                                                        Yes, but not for a web app I’m expected to run on my own time, for fun.

                                                                                                                                                        1. 6

                                                                                                                                                          I’m not sure that’s the exact expectation, that we all should run our single-user Mastodon instances. I feel like the expectation is that sysadmin with enough knowledge will maintain an instance for many users. This seems to be the norm.

                                                                                                                                                          That, or you go to Mastohost and pay someone else for your own single-user instance.

                                                                                                                                                          1. 2

                                                                                                                                                            You’re not expected to do that is my point.

                                                                                                                                                          2. 16

                                                                                                                                                            completely reasonable and uncontroversial

                                                                                                                                                            Not true. Many people are complaining about the unmanaged proliferation of dependencies and tools. Most projects of this size and complexity don’t need more than one language, bulky javascript frameworks, caching and database services.

                                                                                                                                                            This is making difficult to package Mastodon and Pleroma in Debian and Ubuntu and making it more difficult for people to make the service really decentralized.

                                                                                                                                                            1. 1

                                                                                                                                                              I’m not going to defend the reality of what NPM packaging looks like right now because it sucks but that’s the ecosystem we’re stuck with for the time being until something better comes along. As with social networks, packaging systems are also about network effects.

                                                                                                                                                              But you can’t deny that this is the norm today. Well, you can, but you would be wrong.

                                                                                                                                                              This is making difficult to package Mastodon and Pleroma in Debian and Ubuntu

                                                                                                                                                              I’m sure it is, because dpkg is a wholly unsuitable tool for this use-case. You shouldn’t even try. Anyone who doesn’t know how to set these things up themselves should use the Docker container.

                                                                                                                                                              1. 1

                                                                                                                                                                I think the most difficult part of the Debian packaging would be the js deps, correct?

                                                                                                                                                                1. 3

                                                                                                                                                                  Yes and no. Unvendorizing dependencies is done mostly for security and requires a lot of work depending on the amount of dependencies. Sometimes js libraries don’t create serious security concerns because they are only run client-side and can be left in vendorized form.

                                                                                                                                                                  The Ruby libraries can be also difficult to unvendorize because many upstream developers introduce breaking changes often. They care little about backward compatibility, packaging and security.

                                                                                                                                                                  Yet server-side code is more security-critical and that becomes a problem. And it’s getting even worse with new languages that strongly encourage static linking and vendorization.

                                                                                                                                                                  1. 1

                                                                                                                                                                    I can’t believe even Debian adopted the Googlism of “vendor” instead of “bundle”.

                                                                                                                                                                    That aside, Rust? In Mastodon? I guess the Ruby gems it requires would be the bigger problem?

                                                                                                                                                                    1. 2

                                                                                                                                                                      The use of the word is mine: I just heard people using “vendor” often. It’s not “adopted by Debian”.

                                                                                                                                                                      I don’t understand the second part: maybe you misread Ruby for Rust in my text?

                                                                                                                                                                      1. 1

                                                                                                                                                                        No, I really just don’t know what Rust has to do with Mastodon. There’s Rust in there somewhere? I just didn’t notice.

                                                                                                                                                                        1. 2

                                                                                                                                                                          AFAICT there is no Rust in the repo (at least at the moment).

                                                                                                                                                                          1. 1

                                                                                                                                                                            Wow, I’m so dumb, I keep seeing Rust where there is none and misunderstanding you, so sorry!

                                                                                                                                                              2. 7

                                                                                                                                                                Great. Then have two implementations, one for users with large footprints, and another for casual users with five friends.

                                                                                                                                                                It is a reasonable stack if you will devote 1+ servers to the task. Not for something you might want to run on your RPI next to your irc server (a single piece of software in those stacks too)

                                                                                                                                                                1. 4

                                                                                                                                                                  Having more than one implementation is healthy.

                                                                                                                                                                  1. 2

                                                                                                                                                                    Of course it is. Which is why it’s a reasonable solution to the large stack required by the current primary implementation.

                                                                                                                                                              3. 6

                                                                                                                                                                There’s really one database and one cache there. I mean, I guess technically Redis is a database, but it’s almost always used for caching and not as a DB layer like PSQL.

                                                                                                                                                                You can always write your own server if you want in whatever language you choose if you feel like Ruby/Node is too much. Or, like that other guy said, you can just use Docker.

                                                                                                                                                                1. 4

                                                                                                                                                                  There’s really one database and one cache there. I mean, I guess technically Redis is a database, but it’s almost always used for caching . . .

                                                                                                                                                                  A project that can run on a single instance of the application binary absolutely does not need a cache. Nor does it need a pub/sub or messaging system outside of its process space.

                                                                                                                                                                  1. 2

                                                                                                                                                                    It’s more likely that Redis is being used for pub/sub messaging and job queuing.

                                                                                                                                                                  2. 11

                                                                                                                                                                    This does not seem like a reasonable set of dependencies to me

                                                                                                                                                                    Huh. I must be just used to this, then. At work I need to use or at least somewhat understand,

                                                                                                                                                                    • Postgres
                                                                                                                                                                    • Python 2
                                                                                                                                                                    • Python 3
                                                                                                                                                                    • Django
                                                                                                                                                                    • Ansible
                                                                                                                                                                    • AWS
                                                                                                                                                                    • Git (actually, Mercurial, but this is my choice to avoid using git)
                                                                                                                                                                    • Redis
                                                                                                                                                                    • Concourse
                                                                                                                                                                    • Docker
                                                                                                                                                                    • Emacs (My choice, but I could pick anything else)
                                                                                                                                                                    • Node
                                                                                                                                                                    • nginx
                                                                                                                                                                    • Flask
                                                                                                                                                                    • cron
                                                                                                                                                                    • Linux
                                                                                                                                                                    • RabbitMQ
                                                                                                                                                                    • Celery
                                                                                                                                                                    • Vagrant (well, optional, I actually do a little extra work to have everything native and avoid a VM)
                                                                                                                                                                    • The occasional bit of C code

                                                                                                                                                                    and so on and so forth.

                                                                                                                                                                    Do I just work at a terrible place or is this a reasonable amount of things to have to deal with in this business? I honestly don’t know.

                                                                                                                                                                    To me Mastodon’s requirements seem like a pretty standard Rails application. I’m not even sure why Redis is considered another db – it seems like an in-memory cache with optional disk persistence is a different thing than a persistent-only RDBMS. Nor do I even see much of a problem with two interpreted languages – the alternative would be to have js everywhere, since you can’t have Python or Ruby in a web browser, and js just isn’t a pleasant language for certain tasks.

                                                                                                                                                                    1. 38

                                                                                                                                                                      I can work with all that and more if you pay me. For stuff I’m running at home on my own time, fuck no. When I shut my laptop to leave the office, it stays shut until I’m back again in the morning, or I get paged.

                                                                                                                                                                      1. 2

                                                                                                                                                                        So is Mastodon unusual for a Rails program? I wonder if it’s simply unreasonable to ask people to run their own Rails installation. I honestly don’t know.

                                                                                                                                                                        Given the amount of Mastodon instances out there, though, it seems that most people manage. How?

                                                                                                                                                                        1. 4

                                                                                                                                                                          That looks like a bog-standard, very minimal rails stack with a JS frontend. I’m honestly not sure how one could simplify it below that without dropping the JS on the web frontend and any caching, both of which seem like a bad idea.

                                                                                                                                                                          1. 7

                                                                                                                                                                            There’s no need to require node. The compilation should happen at release time, and the release download tarball should contain all the JS you need.

                                                                                                                                                                            1. -3

                                                                                                                                                                              lol “download tarball”, you’re old, dude.

                                                                                                                                                                              1. 7

                                                                                                                                                                                Just you wait another twenty years, and you too will be screaming at the kids to get off your lawn.

                                                                                                                                                                            2. 2

                                                                                                                                                                              You could remove Rails and use something Node-based for the backend. I’m not claiming that’s a good idea (in fact it’s probably not very reasonable), but it’d remove that dependency?

                                                                                                                                                                              1. 1

                                                                                                                                                                                it could just have been a go or rust binary or something along those lines, with an embedded db like bolt or sqlite

                                                                                                                                                                                edit: though the reason i ignore mastodon is the same as cullum, culture doesn’t seem interesting, at least on mastodon.social

                                                                                                                                                                              2. 4

                                                                                                                                                                                If security or privacy focused, I’d try a combo like this:

                                                                                                                                                                                1. Safe language with minimal runtime that compiles to native code and Javascript. Web framework in that language for dynamic stuff.

                                                                                                                                                                                2. Lwan web server for static content.

                                                                                                                                                                                3. SQLite for database.

                                                                                                                                                                                4. Whatever is needed to combine them.

                                                                                                                                                                                Combo will be smaller, faster, more reliable, and more secure.

                                                                                                                                                                                1. 2

                                                                                                                                                                                  I don’t think this is unusual for a Rails app. I just don’t want to set up or manage a Rails app in my free time. Other people may want to, but I don’t.

                                                                                                                                                                              3. 7

                                                                                                                                                                                I don’t think it’s reasonable to compare professional requirements and personal requirements.

                                                                                                                                                                                1. 4

                                                                                                                                                                                  The thing is, Mastodon is meant to be used on-premise. If you’re building a service you host, knock yourself out! Use 40 programming languages and 40 DBs at the same time. But if you want me to install it, keep it simple :)

                                                                                                                                                                                  1. 4

                                                                                                                                                                                    Personally, setting up all that seems like too much work for a home server, but maybe I’m just lazy. I had a similar issue when setting up Matrix and ran into an error message that I just didn’t have the heart to debug, given the amount of moving parts which I had to install.

                                                                                                                                                                                    1. 3

                                                                                                                                                                                      If you can use debian, try installing synapse via their repository, it works really nice for me so far: https://matrix.org/packages/debian/

                                                                                                                                                                                      1. 1

                                                                                                                                                                                        Reading other comments about the horror that is Docker, it is a wonder that you dare propose to install an entire OS only to run a Matrix server. ;)

                                                                                                                                                                                        1. 3

                                                                                                                                                                                          i’m not completely sure which parts of you comment are sarcasm :)

                                                                                                                                                                                    2. 0

                                                                                                                                                                                      Your list there has lots of tools with overlapping functionality, seems like pointless redundancy. Just pick flask OR django. Just pick python3 or node, just pick docker or vagrant, make a choice, remove useless and redundant things.

                                                                                                                                                                                      1. 3

                                                                                                                                                                                        We have some Django applications and we have some Flask applications. They have different lineages. One we forked and one we made ourselves.

                                                                                                                                                                                    3. 6

                                                                                                                                                                                      Alternatively you install it using the Docker as described here.

                                                                                                                                                                                      1. 31

                                                                                                                                                                                        I think it’s kinda sad that the solution to “control your own toots” is “give up control of your computer and install this giant blob of software”.

                                                                                                                                                                                        1. 9

                                                                                                                                                                                          Piling another forty years of hexadecimal Unix sludge on top of forty years of slightly different hexadecimal Unix sludge to improve our ability to ship software artifacts … it’s an aesthetic nightmare. But I don’t fully understand what our alternatives are.

                                                                                                                                                                                          I’ve never been happier to be out of the business of having to think about this in anything but the most cursory detail.

                                                                                                                                                                                          1. 11

                                                                                                                                                                                            I mean how is that different from running any binary at the end of the day. Unless you’re compiling everything from scratch on the machine starting from the kernel. Running Mastodon from Docker is really no different. And it’s not like anybody is stopping you from either making your own Dockerfile, or just setting up directly on your machine by hand. The original complaint was that it’s too much work, and if that’s a case you have a simple packaged solution. If you don’t like it then roll up the sleeves and do it by hand. I really don’t see the problem here I’m afraid.

                                                                                                                                                                                            1. 11

                                                                                                                                                                                              “It’s too much work” is a problem.

                                                                                                                                                                                              1. 5

                                                                                                                                                                                                Unless you’re compiling everything from scratch on the machine starting from the kernel

                                                                                                                                                                                                I use NixOS. I have a set of keys that I set as trusted for signature verification of binaries. The binaries are a cache of the build derivation, so I could theoretically build the software from scratch, if I wanted to, or to verify that the binaries are the same as the cached versions.

                                                                                                                                                                                                1. 2

                                                                                                                                                                                                  Right, but if you feel strongly about that then you can make your own Dockerfile from source. The discussion is regarding whether there’s a simple way to get an instance up and running, and there is.

                                                                                                                                                                                                  1. 3

                                                                                                                                                                                                    Docker containers raise a lot of questions though, even if you use a Dockerfile:

                                                                                                                                                                                                    • What am I running?
                                                                                                                                                                                                    • Which versions am I running?
                                                                                                                                                                                                    • Do the versions have security vulnerabilities?
                                                                                                                                                                                                    • Will I be able to build the exact same version in 24 months?

                                                                                                                                                                                                    Nix answers these pretty will and fairly accurately.

                                                                                                                                                                                                2. 2

                                                                                                                                                                                                  Unless you’re compiling everything from scratch on the machine starting from the kernel.

                                                                                                                                                                                                  You mean starting with writing a bootstrapping compiler in assembly, then writing your own full featured compiler and compiling it in the bootstrapping compiler. Then moving on to compiling the kernel.

                                                                                                                                                                                                  1. 1

                                                                                                                                                                                                    No no, your assembler could be compromised ;)

                                                                                                                                                                                                    Better write raw machine code directly onto the disk. Using, perhaps, a magnetized needle and a steady hand, or maybe a butterfly.

                                                                                                                                                                                                    1. 2

                                                                                                                                                                                                      My bootstrapping concept was having the device boot a program from ROM that takes in the user-supplied, initial program via I/O into RAM. Then passes execution to it. You enter the binary through one of those Morse code things with four buttons: 0, 1, backspace, and enter. Begins executing on enter.

                                                                                                                                                                                                      Gotta input the keyboard driver next in binary to use a keyboard. Then the display driver blind using the keyboard. Then storage driver to save things. Then, the OS and other components. ;)

                                                                                                                                                                                                    2. 1

                                                                                                                                                                                                      If I deploy three Go apps on top of a bare OS (picked Go since it has static binaries), and the Nginx server in front of all 3 of them uses OpenSSL, then I have one OpenSSL to patch whenever the inevitable CVE rolls around. If I deploy three Docker container apps on top of a bare OS, now I have four OpenSSLs to patch - three in the containers and one in my base OS. This complexity balloons very quickly which is terrible for user control. Hell, I have so little control over my one operating system that I had to carefully write a custom tool just to make sure I didn’t miss logfile lines in batch summaries created by cron. How am I supposed to manage four? And three with radically different tooling and methodology to boot.

                                                                                                                                                                                                      And Docker upstream, AFAIK, has provided nothing to help with the security problem which is probably why known security vulnerabilities in Docker images are rampant. If they have I would like to know because if it’s decent I would switch to it immediately. See this blog post for more about this problem (especially including links) and how we “solved” it in pump.io (spoiler: it’s a giant hack).

                                                                                                                                                                                                      1. 3

                                                                                                                                                                                                        That’s not how any of this works. You package the bare minimum needed to run the app in the Docker container, then you front all your containers with a single Nginx server that handles SSL. Meanwhile, there are plenty of great tools, like Dokku for managing Docker based infrastructure. Here’s how you provision a server using Let’s Encrypt with Dokku:

                                                                                                                                                                                                        sudo dokku plugin:install https://github.com/dokku/dokku-letsencrypt.git
                                                                                                                                                                                                        okku letsencrypt:auto-renew
                                                                                                                                                                                                        

                                                                                                                                                                                                        viewing logs isn’t rocker science either:

                                                                                                                                                                                                        dokku logs myapp
                                                                                                                                                                                                        
                                                                                                                                                                                                        1. 1

                                                                                                                                                                                                          OK, so OpenSSL was a bad example. Fair enough. But I think my point still stands - you’ll tend to have at least some duplicate libraries across Docker containers. There’s tooling around managing security vulnerabilities in language-level dependencies; see for example Snyk. But Docker imports the entire native package manager into the “static binary” and I don’t know of any tooling that can track problems in Docker images like that. I guess I could use Clair through Quay but… I don’t know. This doesn’t feel like as nice of a solution or as polished somehow. As an image maintainer I’ve added a big manual burden keeping up with native security updates in addition to those my application actually directly needs, when normally I could rely on admins to do that, probably with lots of automation.

                                                                                                                                                                                                          1. 3

                                                                                                                                                                                                            you’ll tend to have at least some duplicate libraries across Docker containers

                                                                                                                                                                                                            That is literally the entire point. Application dependencies must be separate from one another, because even on a tight-knit team keeping n applications in perfect lockstep is impossible.

                                                                                                                                                                                                            1. 1

                                                                                                                                                                                                              OS dependencies are different than application dependencies. I can apply a libc patch on my Debian server with no worry because I know Debian works hard to create a stable base server environment. That’s different than application dependencies, where two applications are much more likely to require conflicting versions of libraries.

                                                                                                                                                                                                              Now, I run most of my stuff on a single server so I’m very used to a heterogeneous environment. Maybe that’s biasing me against Docker. But isn’t that the usecase we’re discussing here anyway? How someone with just a hobbyist server can run Mastodon?

                                                                                                                                                                                                              Thinking about this more I feel like a big part of what bothers me about Docker, and therefore about Clair, is that there’s no package manifest. Dockerfile does not count, because that’s not actually a package manifest, it’s just a list of commands. I can’t e.g. build a lockfile format on top of that, which is what tools like Snyk analyze. Clair is the equivalent of having to run npm install and then go trawling through node_modules looking for known vulnerable code instead of just looking at the lockfile. More broadly, because Docker lacks any notion of a package manifest, it seems to me that while Docker images are immutable once built, the build process that leads you there cannot be made deterministic. This is what makes it hard to keep track of the stuff inside them. I will have to think about this more - as I write this comment I’m wondering if my complaints about duplicated libraries and tracking security there is an instance of the XY problem or if they really are separate things in my mind.

                                                                                                                                                                                                              Maybe I am looking for something like Nix or Guix inside a Docker container. Guix at least can export Docker containers; I suppose I should look into that.

                                                                                                                                                                                                              1. 2

                                                                                                                                                                                                                OS dependencies are different than application dependencies.

                                                                                                                                                                                                                Yes, agreed.

                                                                                                                                                                                                                Thinking about this more I feel like a big part of what bothers me about Docker, and therefore about Clair, is that there’s no package manifest. Dockerfile does not count, because that’s not actually a package manifest, it’s just a list of commands. I can’t e.g. build a lockfile format on top of that, which is what tools like Snyk analyze.

                                                                                                                                                                                                                You don’t need a container to tell you these things. Application dependencies can be checked for exploits straight from the code repo, i.e. brakeman. Both the Gemfile.lock and yarn.lock are available from the root of the repo.

                                                                                                                                                                                                                The container artifacts are most like built automatically for every merge to master, and that entails doing a full system update from the apt repository. So in reality, while not as deterministic as the lockfiles, the system deps in a container are likely to be significantly fresher than a regular server environment.

                                                                                                                                                                                                            2. 1

                                                                                                                                                                                                              You’d want to track security vulnerabilities outside your images though. You’d do it at dev time, and update your Dockerfile with updated dependencies when you publish the application. Think of Docker as just a packaging mechanism. It’s same as making an uberjar on the JVM. You package all your code into a container, and run the container. When you want to make updates, you blow the old one away and run a new one.

                                                                                                                                                                                                      2. 4

                                                                                                                                                                                                        I have only rarely used Docker, and am certainly no booster, so keep that in mind as I ask this.

                                                                                                                                                                                                        From the perspective of “install this giant blob of software”, do you see a docker deployment being that different from a single large binary? Particularly the notion of the control that you “give up”, how does that differ between Docker and $ALTERNATIVE?

                                                                                                                                                                                                        1. 14

                                                                                                                                                                                                          Ideally one would choose door number three, something not so large and inauditable. The complaint is not literally about Docker, but the circumstances which have resulted in docker being the most viable deployment option.

                                                                                                                                                                                                        2. 2

                                                                                                                                                                                                          You have the dockerfile and can reconstruct. You haven’t given up control.

                                                                                                                                                                                                          1. 5

                                                                                                                                                                                                            Is there a youtube video I can watch of somebody building a mastodon docker image from scratch?

                                                                                                                                                                                                            1. 1

                                                                                                                                                                                                              I do not know of one.

                                                                                                                                                                                                      3. 3

                                                                                                                                                                                                        I totally agree as well, and I wish authors would s/Mastodon/Fediverse/ in their articles. As others have noted, Pieroma is another good choice and others are getting into the game - NextCloud added fediverse node support in their most recent release as a for-instance.

                                                                                                                                                                                                        I tried running my own instance for several months, and it eventually blew up. In addition to the large set of dependencies, the system is overall quite complex. I had several devs from the project look at my instance, and the only thing they could say is it was a “back-end problem” (My instance had stopped getting new posts).

                                                                                                                                                                                                        I gave up and am now using somebody else’s :) I love the fediverse though, it’s a fascinating place.

                                                                                                                                                                                                        1. 4

                                                                                                                                                                                                          I just use the official Docker containers. The tootsuite/mastodon container can be used to launch web, streaming, sidekiq and even database migrations. Then you just need an nginx container, a redis container, a postgres container and an optional elastic search container. I run it all on a 2GB/1vCPU Vultr node (with the NJ data center block store because you will need a lot of space) and it works fairly well (I only have ~10 users; small private server).

                                                                                                                                                                                                          In the past I would agree with out (and it’s the reason I didn’t try out Diaspora years ago when it came out), but containers have made it easier. I do realize they both solve and cause problems and by no means think they’re the end all of tech, but they do make running stuff like this a lot easier.

                                                                                                                                                                                                          If anyone wants to find me, I’m @djsumdog@hitchhiker.social

                                                                                                                                                                                                          1. 2

                                                                                                                                                                                                            Given that there’s a space for your Twitter handle, i wish Lobste.rs had a Mastodon slot as well :)

                                                                                                                                                                                                          2. 2

                                                                                                                                                                                                            Wait, you’re also forgetting systemd to keep all those process humming… :)

                                                                                                                                                                                                            You’re right that this is clearly too much: I have run such systems for work (Rails’ pretty common), but would probably not do that for fun. I am amazed, and thankful, for the people who volunteer the effort to run all this on their week-ends.

                                                                                                                                                                                                            Pleroma does look simpler… If I really wanted to run my own instance, I’d look in that direction. ¯_(ツ)_/¯

                                                                                                                                                                                                            1. 0

                                                                                                                                                                                                              I’m waiting for urbit.org to reach useability. Which I expect for my arbitrary feeling of useability to come about late this year. Then the issue is coming up to speed on a new language and integrated network, OS, build system.

                                                                                                                                                                                                              1. 2

                                                                                                                                                                                                                Urbit is apparently creating a feudal society. (Should note that I haven’t really dug into that thread for several years and am mostly taking @pushcx at his word.)

                                                                                                                                                                                                                1. 1

                                                                                                                                                                                                                  The feudal society meme is just not true, and, BTW, Yarvin is no longer associated with Urbit. https://urbit.org/primer/

                                                                                                                                                                                                              2. 1

                                                                                                                                                                                                                I would love to have(make) a solution that could be used locally with sqlite and in aws with lambda, api gateway and dynamodb. That would allow scaling cost and privacy/controll.

                                                                                                                                                                                                                1. 3

                                                                                                                                                                                                                  https://github.com/deoxxa/don is sort of in that direction (single binary, single file sqlite database).

                                                                                                                                                                                                              1. 2

                                                                                                                                                                                                                Throwing a few pounds of copper onto a decade-old motherboard.

                                                                                                                                                                                                                My desktop is still an old system from 2010 with a Westmere Xeon in it. I am finally going to overclock it to help catch up with a few years’ worth of increased bloat performance needs in various applications.

                                                                                                                                                                                                                The northbridge (yes, it’s so old that it still has a northbridge) runs dangerously hot. Not a huge deal normally because I’m not trying to overclock the memory, but the motherboard connects the (rather weak) heatsinks on the power delivery to the heatsink on the northbridge with a heatpipe. So overclocking it is going to add a lot of heat to the NB via that heatpipe, and as they are physically connected, I cannot upgrade the cooling of just one of them.

                                                                                                                                                                                                                Hence removing the cooling and throwing a few pounds of fresh copper onto it.

                                                                                                                                                                                                                Inviting a younger friend over who has only ever owned laptops, and going to narrate my teardown and rebuild, as he wanted to learn about building a desktop.

                                                                                                                                                                                                                1. 2

                                                                                                                                                                                                                  This is brilliant.

                                                                                                                                                                                                                  Having developed a sixth-sense or intuition for a lot of this, whether from curiosity or battle scars, I often struggle to succinctly impart that knowledge to more junior teammates. Going to be linking to this a lot and emphasizing details.

                                                                                                                                                                                                                  Thank you!

                                                                                                                                                                                                                  1. 6

                                                                                                                                                                                                                    I’ve seen and even tried many XP themes and such over the years, especially during the mid-00’s era of the smarmy Linux ideologues tempting people to switch from Windows (which I will shamefully admit to being part of, occasionally).

                                                                                                                                                                                                                    I am in awe at how much further this goes beyond that, and at the attention put into faithfully recreating some parts of these.

                                                                                                                                                                                                                    That screenshot of “Windows 95/98/2000/ME” just brought on a type of comfy nostalgia that I didn’t realize I was capable of feeling. But there is at least one person for whom Windows Vista offers that type of comfy nostalgia, and this project has them covered too.

                                                                                                                                                                                                                    Edit: It looks like the creator has a whole suite of well-made historical desktop OS themes, from older MacOS, to Solaris and even BeOS!

                                                                                                                                                                                                                    1. 5

                                                                                                                                                                                                                      I’d be interested to see a side-by-side comparison of kitty to alacritty. In particular, I’ve been using alacritty at work for a while and while it’s barebones at the moment, it’s exceptionally fast (which is probably my core feature for terminal emulators). That said, kitty looks like a fine emulator.

                                                                                                                                                                                                                      1. 6

                                                                                                                                                                                                                        Honest question: what need do you have for a fast terminal emulator?

                                                                                                                                                                                                                        1. 7

                                                                                                                                                                                                                          I have a minor obsession with input latency and scroll jank. It seems to creep up everywhere and is hard to stamp out (Sublime Text is a shining counterexample). I noticed a bit of weird input latency issues when using Terminal.app (purely anecdotal), and haven’t seen the same thing since using alacritty. So that’s the need I have for a fast emulator, it enables a smooth input and output experience.

                                                                                                                                                                                                                          1. 3

                                                                                                                                                                                                                            I am sensitive to the same.

                                                                                                                                                                                                                            This is what kept me on Sublime Text for years, despite open source alternatives (Atom, VS Code and friends). I gave them all at least a week, but in the end the minor latency hiccups were a major distraction. A friend with similar sensitivity has told me that VS Code has gotten better lately, I would give it another go if I weren’t transitioning to Emacs instead.

                                                                                                                                                                                                                            I sometimes use the Gmail web client and, for some period of time, I would experience an odd buffering of my keystrokes and it would sometimes completely derail my train of thought. It’s the digital equivalent of a painful muscle spasm. Sometimes you ignore it and move on, but sometimes you stop and think “Did I do something wrong here? Is there something more generally broken, and I should fear or investigate it?”

                                                                                                                                                                                                                            1. 1

                                                                                                                                                                                                                              Web-based applications are particularly bad, because often they don’t just buffer, but completely reorder my keystrokes. So I can’t just keep typing and wait for the page to catch up; I have to stop, otherwise I’m going to have to do an edit anyway.

                                                                                                                                                                                                                          2. 3

                                                                                                                                                                                                                            I have to admit, I thought for certain this was going to be Yet Another JavaScript Terminal but it turns out it’s written in Python. Interesting.

                                                                                                                                                                                                                            Anyway I would have a hard time believing it’s faster than xfce4-terminal, xterm, or rxvt. It’s been a long time since I last benchmarked terminal emulators, maybe I smell a weekend project coming on.

                                                                                                                                                                                                                            1. 6

                                                                                                                                                                                                                              kitty is written is about half C, half Python, Alacritty is written in Rust.

                                                                                                                                                                                                                              There were some benchmarks done for the recent Alacritty release that added scrollback, which include kitty, urxvt, termite, and st. https://jwilm.io/blog/alacritty-lands-scrollback/#benchmarks

                                                                                                                                                                                                                              1. 2

                                                                                                                                                                                                                                I just did a few rough-and-ready benchmarks on my system. Compared to my daily driver (xfce4-terminal), kitty is a little under twice as fast, alacritty and rxvt are about three times as fast. If raw speed was my only concern, I would probably reach for rxvt-unicode since it’s a more mature project.

                                                                                                                                                                                                                                Alacritty is too bare-bones for me but I could be sold on kitty if I took the time to make it work/behave like xfce4-terminal.

                                                                                                                                                                                                                                1. 1

                                                                                                                                                                                                                                  I like xfce4-terminal, but it renders fonts completely wrong for me. It’s most noticeable when I run tmux and the solid lines are drawn with dashes. If I pick a font where the lines are solid, then certain letters look off. It’s a shame, because other vte-based terminals (e.g. gnome-terminal) tend to be much slower.

                                                                                                                                                                                                                            2. 2

                                                                                                                                                                                                                              For me it’s the simple stuff that gets annoying when it’s slow. Tailing high-volume logs. less-ing/cat-ing large files. Long scrollbacks. Makes a difference to my day by just not being slow.

                                                                                                                                                                                                                              1. 2

                                                                                                                                                                                                                                I don’t care that much about the speed it takes to cat a big file, but low latency is very nice and kitty is quite good at that. I cannot use libvte terminals anymore, they just seem so sluggish.

                                                                                                                                                                                                                                1. 2

                                                                                                                                                                                                                                  For one thing, my workflow involves cutting and pasting large blocks of text. If the terminal emulator can’t keep up, blocks of text can come through out of order etc, which can be a bad time for everyone involved.

                                                                                                                                                                                                                                2. 3

                                                                                                                                                                                                                                  I’m on macOS.

                                                                                                                                                                                                                                  I used alacritty for a while, then switched to kitty as I’d get these long page redraws when switching tmux windows—so kitty is at least better for me in that regard. Both have similar ease of configuration. I use tmux within both, so I don’t use kitty’s scrolling or tabs. The way I was using them, they were more or less the same.

                                                                                                                                                                                                                                  I’m going to try alacritty again to see if it’s improved. I’d honestly use the default Terminal app if I could easily provide custom shortcuts (I bind keys to switching tmux panes, etc).

                                                                                                                                                                                                                                  1. 4

                                                                                                                                                                                                                                    I came back to Alacritty on MacOS just the other day after trying it last maybe 6 months ago and finding it “not ready” in my head. It’s been significantly updated, there’s a DMG installer (and it’s in brew), a lot more polished overall and it works really well and really fast. No redraws in tmux switches. Weirded redraw artifiact while resizing main window, but snaps to fixed immediately you stop, and doesn’t bother me much. Using it as a full-time Terminal replacement right now, liking it so far, will see how it goes!

                                                                                                                                                                                                                                    1. 1

                                                                                                                                                                                                                                      Good to know! I’ve installed it via brew now and double-checked my old config. My font (as in, not the default Menlo. I’m using a patched Roboto Mono) looks a bit too bold, so just gotta figure out what’s wrong there.

                                                                                                                                                                                                                                      1. 2

                                                                                                                                                                                                                                        They’ve updated config files with additional info about aliasing and rendering fonts on Mac. So take a look at that if you are using your old config. It’s not a bad idea to start from scratch.

                                                                                                                                                                                                                                        1. 1

                                                                                                                                                                                                                                          Thanks for the tip! I did start from scratch and moved over changes bit by bit, but I’ll have to check the new macOS specific lines.

                                                                                                                                                                                                                                    2. 3

                                                                                                                                                                                                                                      Cool, thanks for your input! I also use tmux, and I haven’t seen anything like what you described (I also don’t really use tmux panes, only tabs). I know there has been a longstanding vim + tmux + osx bug as well, but I haven’t used vim proper in a while.

                                                                                                                                                                                                                                      1. 2

                                                                                                                                                                                                                                        I think that’s my exact problem (turns out I’m even subscribed to the issue haha). I use neovim so I think it is/was applicable to both

                                                                                                                                                                                                                                    3. 1

                                                                                                                                                                                                                                      do any of those really measure up when benchmarked.

                                                                                                                                                                                                                                      I remember doing some writing to stdout and it alacritty turned out to be slower than say gnome-terminal or whatever.

                                                                                                                                                                                                                                      Might’ve been that there was a bug with my intel graphics card though, don’t remember to well.