HNHacker News
TopNewBestAskShowJobs

St-Clock

721 karma · joined October 9, 2010

Creator of Py4J, pylinkvalidator, and Partial Program Analysis for Java. CTO at Resulto http://www.infobart.com https://github.com/bartdag/ http://www.resulto.ca/
submissionscomments
St-Clock··on The Joy of Linux Desktop Environments
My understanding is that LXDE does not support HiDPI very well because not everything is ported to gtk3. Do you have any experience to share with retina/3K/4K displays and LXDE?
St-Clock··on Montreal Police Monitored iPhone of La Presse Journalist Patrick Lagacé
"A tracking warrant also allowed the SPVM to activate the GPS chip in the iPhone to know exactly where Lagacé was, admitted two investigators in charge of the file."

How is this possible? You carrier can activate your GPS chip? And then the GPS sends its coordinates to your carrier?

St-Clock··on Police got multiple warrants to spy Canadian journalist's iphone – GPS included
I couldn't find an English version yet. Basically, during an internal affair inquiry, detectives found that a police officer had contacted a journalist. They asked a judge to issue several warrants to be able to get DNR (dial number recorder) from the journalist's iPhone and, according to this article, they were able to activate the iPhone's GPS to follow the journalist.

About the GPS: I didn't know it was possible to do this (is the signal transmitted to the carrier?).

St-Clock··on Giteveryday – A useful minimum set of commands for Everyday Git
I'm sorry, how is it different than the linux example?

They both describe all the parameters in the first sentence of the description.

St-Clock··on Massive Dyn DNS outage
How does that work in practice? Even if I set NS records pointing to two different DNS providers, I don't think a DNS client would automatically switch and retry if one is too slow to respond/times out.
St-Clock··on Ask HN: Alternatives to AWS?
If you are located in North America, I would suggest looking at Storm On Demand [1] (the unmanaged offering of LiquidWeb).

They offer more bare services than AWS but they provide:

- Virtual Machines with many configurations available (on shared host or dedicated host)

- Private Cloud

- Private LAN with close to sub-millisecond latency

- Automated backup, snapshots

- API

- Load Balancer

- CDN (backed by Akamai)

- Block Storage (but I found it too slow for our needs)

- Different levels of managed hosting

LiquidWeb has even more options, but you usually need to pay for managed hosting (they throw in tons of free bandwidth though).

Support is really good: of course you sometimes end up speaking with someone who is clueless or overworked, but it is extremely rare and most support people are knowledgeable, helpful, and quick. We migrated a legacy VM with old cpanel and drupal sites and even though Drupal is not in their main expertise, they optimized the heck out of the configs and the sites are running twice as fast as before on weaker hardware.

Uptime is excellent: as opposed to Google or Amazon, they do everything in their power to keep the physical host and the VMs up and connected. In other words, they have a single host SLA (Amazon and Google's SLA only applies for multi-AZ outages if I remember correctly). They also built their own datacenters and are not collocating or renting someone else's datacenter.

Performance of their SSD VMs is better than Linode's and DO's VMs in our internal benchmarks.

If you need more than a few VMs, contacting Sales is a really good idea because they can make you some interesting offers.

The main downside for us is that they are located in central US so latency is not ideal for our eastern Canada customer base.

FWIW, we moved all our VMs from Linode to Storm because we lost confidence in Linode (DDOS, security, lack of transparency) even though the ratio performance/cost/reliability (in Newark, before the DDOS incident) was impossible to beat.

[1] https://www.stormondemand.com/

St-Clock··on An Important Message About Yahoo User Security
"encrypted or unencrypted security questions and answers"

This is bad right? Like, worse than your hashed password and your mailing address.

The only good thing is that if I ever implement security questions, I'll remember Yahoo! and how it could end up in the wrong hands.

St-Clock··on Kung Fu, Once Central to Hong Kong Life, Is Waning
And:

1. The floor is likely slippery.

2. It's dark

3. Glass mugs/Bottles can be broken and used as a weapon

4. There are hard table corners (watch out if you fall!)

5. There are chairs in the way (or maybe they can help you if you like to wield chairs!!)

A football team once picked a fight in a bar with a kung fu school. One of the best Kung Fu student slipped on the floor and his 15 years of kung fu went out of the window very very very quickly :-)

St-Clock··on Kung Fu, Once Central to Hong Kong Life, Is Waning
Kung Fu means "hard work" so of course it is waning :-)

More seriously, a couple of observations:

1. Most styles of kung fu require dedicating years of practice before one can be called skilled. Compare this to Systema or Krav Maga where one can become a killer very quickly and you can expect people with little time to train to prefer these more modern martial arts. This says nothing about the depth of these martial arts, just the way they are organized and taught. As a concrete example: one of the first block I learned in Flying White Crane Kung Fu is actually very difficult to use in a street fight. Once you're good with it though, the opponent is in a very bad situation. With Krav Maga, the first block you may learn is usually very basic, very effective to block a punch, but you get less counter-attack possibilities.

2. Most of us do not need to fight for our life so of course, martial arts are waning as a whole.

3. MMA is very popular and most Kung Fu styles are not suitable for MMA: again it takes time to become an expert and many techniques cannot be used in a MMA ring (can I put my finger in your eye? what about using pressure points while you are tackling me on the floor? can you hit the neck with a spear hand?).

4. Kung Fu masters are usually very secretive and they sometimes die with most of their knowledge, especially if they do not find someone suitable to transfer that knowledge.

5. Finally, a sibling comment mentioned youtube. Many kung fu schools hesitate to use Youtube and when they do it, they usually do not show the best they are capable of. When I was training, I remember a master asking to only capture the movements of the upper body and hide the footwork :-)

St-Clock··on Django 1.10 released
This was introduced in 1.8 (which is great if you move to 1.8 or beyond), but if you are trying to go step by step, 1.7 was not a fun release to migrate to. There were also many problems with custom user model and the like.

1.7 was a very important release in the history of Django, just not a fun release to move to if you had a large codebase.

St-Clock··on Django 1.10 released
Until you hit the migrations in 1.7.

But you are right. At my previous job, I spent countless hours getting from 1.4 to 1.5, but the step from 1.5 to 1.6 was relatively painless.

St-Clock··on Drop jQuery as a dependency from Rails
Right. The frontend story of Django is non-existent and it is a pain to reinvent the wheel each time. Need AJAX to work with CSRF protection? Just copy this snippet of code. Want to use SASS? Try to find a django app that provides an asset pipeline, or copy some django snippets, or do it yourself by bringing grunt/gulp/whatever is the latest hyped js build tool.

Now the remaining part of your comment is unfair. Pure frontend is just one small part of webapp development: templating, controller, ORM, i18n, user and session management, security, testing, etc.

You can do a lot of web backend stuff without websocket. Django is ok for that and if you combine it with Django Rest Framework, you get powerful tools at your disposal.

St-Clock··on Nginx security advisory (CVE-2016-4450)
Nothing on Ubuntu USN for now: http://www.ubuntu.com/usn/ :-(
St-Clock··on Google I/O 2016 Live Keynote
The best way to follow this keynote is through @pinboard twitter account [1]. It distorts the disruption.

[1] https://twitter.com/pinboard

St-Clock··on Pillow-SIMD: improving the performance of image processing
ImageMagick has also better default handling. For example, in a previous project, we were automatically resizing jpeg images. Surprisingly, some resulting images were blurry. After some investigation, we found that these images had been photoshopped and Photoshop was using a different sampling factor (one of the variables used in jpeg compression). ImageMagick automatically detected this sampling factor and reused the same, but Pillow was using a default sampling factor and was blurring the image.
St-Clock··on “Ancient Mayan city” discovered by teen may in fact be cannabis crop
So we've been in Le Monde[1], now BBC and Hacker News. All of this because a tabloid newspaper from Montreal thought it was better to gain exposure than to protect and correct a young aspiring scientist. A local "mythbuster" [2] already debunked the whole story, but alas, the trashy newspaper is still pushing this fiasco from new angles every day.

I fear this whole story will be extremely bad for the kid and most news outlets should blame the newspaper instead of focusing on the kid or the bad science part.

[1] http://mobile.lemonde.fr/big-browser/article/2016/05/11/l-hi... [2] http://journalmetro.com/opinions/inspecteur-viral/962214/ce-...

St-Clock··on CLA Assistant – Easily Handle Contributor License Agreements (CLAs)
I was recently asked by a third party to tighten the way contribution IP/license is handled with Py4J[1] and found this service, which looks painless for contributors.

I've been burned in the past by having to physically sign and scan or fax (!) contributor license agreements and I did not want to impose this additional hassle to potential contributors. Anybody has experience with this particular service or other alternatives?

[1] https://www.py4j.org/

St-Clock··on Core API – Hypermedia Driven Web APIs
I found this today and I really like (1) how the document layer is decoupled from the encoding layer, and how it specifies discoverability (HATEOAS?).

Here is an example of a server application using Django REST Framework and the coreapi Python lib: https://github.com/core-api/heroku-game

St-Clock··on Cron in production is a double-edged sword
Shameless plug: we replaced most of our cron jobs with celery and django celery fulldbresult[1], which provides more info and features than the default django-celery integration:

- Save result as json, which is queryable in the database

- Save enough info in the task result to retry the task from the result.

- Retry a task from its result in Django Admin

- Run a periodic task now (e.g., to test your cron task)

[1] https://github.com/resulto-admin/django-celery-fulldbresult

St-Clock··on Schedule – Python job scheduling for humans
We prefer to use Celery to schedule periodic tasks [1] and are moving most of our cron jobs to Celery because it is easier to monitor, test, retry, and send reports on failed jobs.

We extended [2] django-celery db backend to store enough information about the periodic tasks to retry them directly in Django admin or to filter the results (we support storing the task results in JSON instead of pickle).

Celery is probably more difficult to configure but is far more flexible and robust than this lib...

[1] http://celery.readthedocs.org/en/latest/userguide/periodic-t... [2] https://github.com/resulto-admin/django-celery-fulldbresult

St-Clock··on Tmux 2.0 released
I also use C-s on my local machine because:

1. I can still use C-a with readline (go to first character)

2. If I ssh and then use screen, I can use C-a to navigate my remote screen and C-s to navigate my local tmux.

3. C-s is closer to C-a then other letters on my keyboard.

St-Clock··on Ask HN: Is Swift ready for production yet?
Swift is ready for production. XCode isn't.

Even if your project is written in Swift, you can still use CocoaPods through bridging header, and you can use embedded frameworks for pure swift libraries (caveat: if you are targeting iOS 7, you need to copy and possibly modify the source of the frameworks you use because embedded frameworks are not supported in iOS7). Although Apple APIs are available with Swift, the documentation for some of the libraries still only provides examples in Obj-C.

My main issue right now is with the stability of XCode. SourceKit keeps crashing on me (every 30 minutes). It has become more stable with 6.1, but it used to crash when I had too many parameters in a function or when I was trying to mix Obj-C and Swift. Sometimes I get build errors and after a few calls to clean, I can build my app (go figure!). This makes developing in swift not as enjoyable as it could be.

St-Clock··on AWS EC2 Container Service
The OP was referring to Linux Container Daemon LXD [1] which is built on top of LXC and promises to offer Docker-like features.

[1] http://www.ubuntu.com/cloud/tools/lxd

St-Clock··on AWS EC2 Container Service
Security-wise, if I understand correctly, this is a very interesting offering.

1. The containers live on "your" VMs so you get the isolation of a virtual machine and do not worry about the other tenants' containers.

2. The VMs are part of a "private cloud", i.e., the internal network is not accessible by other tenants' VMs and containers.

#2 is what worried me the most in other container service offerings. It's easy to overlook protecting your internal ip when you manage VMs, it's even easier (and expected) when you deploy containers.

St-Clock··on Weave – The Docker Network
I hear you about legacy systems. Two years ago, I had to support a Python 2.4 system that used a deprecated crypto c library and I did not want to "pollute" my clean production infrastructure. Containers would definitively help with this scenario. The thought never occurred to me that docker could be used to reproduce/encapsulate legacy systems, thanks!
St-Clock··on Weave – The Docker Network
I have yet to see real, complex, and distributed applications that share the exact same config in dev and production. I know that having the same versions of system libs in dev and prod can be a problem in some context and docker can help with that, but it's not the only solution and does not take care of the whole landscape (e.g., npm packages.json, pip requirements.txt, etc.).

I totally agree that startup time of a container is far less than a VM, but I don't see how docker "removes all the trouble of running applications that you need for your development: databases, application servers, queues"

You still need to install, configure these services, make sure that the containers can talk to each other in a reliable and secure way, etc.

St-Clock··on Readings in Databases
"Me, I tolerate writes that take a bit longer to keep things simple :)"

It's not just to keep things simple, it's to keep things consistent :-) Some NoSQL systems (e.g., MongoDB) introduced a new P in the equation (Performance) and used this to justify a lot of questionable decisions that affected consistency (and durability!). They have come a long way since these early decisions though.

If a system considers moderate latency as a partition, it would need to perform partition recovery on every write. That's why I'm not sure considering latency as partition is in line with the CAP theorem.

Maybe it is more related to availability though (not sure).

St-Clock··on Readings in Databases
I really loved reading "CAP Twelve Years Later: How the "Rules" Have Changed".

This sentence nailed what I thought was wrong with some early decisions in NoSQL systems: "because partitions are rare, there is little reason to forfeit C or A when the system is not partitioned."

St-Clock··on Detecting login state for almost any website on the internet
That depends on the definition of "disabling third party cookies".

If you are logged in Facebook, the facebook.com cookie is now first-party (because you visited facebook.com) and it is sent each time you make a request to Facebook from other domains. Blocking third party cookies usually mean that you block cookies from domain that you never directly visited (although Firefox has an option to disable ALL third-party cookies, even those from sites you visited [1]).

If the browser prevented sending cookies on cross-domain requests, it would block all authenticated cross-domain calls and that would severely limit the possible integration of web sites and applications. You could still pass session ids in the URL, but these can be sniffed by other servers, e.g., with the REFERER header.

[1] https://support.mozilla.org/en-US/kb/disable-third-party-coo...

St-Clock··on IntelliJ IDEA 14 Early Preview is Available
Starting from v13, JetBrains includes a 1-year upgrade on their intellij license. Example: http://www.jetbrains.com/idea/buy/choose_edition.jsp?license...
← PreviousPage 2 of 6Next →