HNHacker News
TopNewBestAskShowJobs

amirmc

11,258 karma · joined July 31, 2009

email: <username> at gmail

Currently at Mistral.

Previous things I've been involved with:

https://docker.com ( past) -- via acquisition of http://unikernel.com. Still working on unikernel adoption but with the leverage of Docker's ecosystem. First product is Docker for Mac/Windows.

http://unikernel{.org|.com} (past) -- Working towards wider adoption of unikernels.

http://nymote.org (dormant|side-project) -- FOSS, OCaml-based toolstack for connected devices and personal clouds. Just as the LAMP stack enabled the modern web, the Nymote stack (aka MISO stack) will enable the 'Internet of Everything'.

https://mirage.io (past) -- MirageOS is the 'M' in the MISO stack. A new approach to the Operating System where developers compose their applications by pulling in OS components as libraries (e.g networking, etc) and let the compiler deal with optimisation to produce lean, single-purpose VMs (aka Unikernels). The 'I' in MISO is the Irmin, git-like data storage system.

http://www.cl.cam.ac.uk/projects/ocamllabs (alum) -- Co-created this group to push OCaml forward and make it more effective by working on tooling, documentation and a Platform. I herded cats here.

http://www.springboard.com (spun out, later acquired) -- Accelerator programme I set up in Cambridge in 2009. Worked with neilgd. Teams included PagerDuty (agmiklas, bpuvanathasan & alexsolo) and TidePowerd (profquail) among others. Now being run by jdbradford. Merged with Techstars in Q1 2013.

http://www.tidepowerd.com (board member) -- One of the Springboard teams that Red Gate invested in (profquail). Makes GPU computing accessible to .NET devs. Now shut down.

http://www.svc2uk.com -- Student run series of events with folks from the Valley. Chaired by Sherry Coutu and Reid Hoffman.

http://www.go-test.it (now sold) -- Red Gate acquisition. I worked with the founder, martinkl, who moved on to Rapportive (YC S10) with rahulvohra and samstokes. The assets were sold on.

---------------------------------

submissionscomments
amirmc··on OpenSSL Security Advisory
Yep, that the bug was recently introduced was implied from the notice they put out.

For interest, the line that was fixed from the first commit is:

https://github.com/openssl/openssl/commit/da084a5ec6cebd67ae...

amirmc··on Netflix and the Conservation of Attractive Profits
> "their strategy of releasing all episodes at once for shows they produce."

Interesting that they don't (can't?) do this for all the shows. For example, Better Call Saul was released on a weekly schedule in the UK in 2015, even though it had already been aired in the US in 2013. I wonder if this was just experimentation with the model or due to an agreement about how the show should be released.

https://en.wikipedia.org/wiki/Better_Call_Saul#Broadcast

amirmc··on Ask HN: What's the difference between a unikernel and an exokernel?
I think it's already taking off and the key difference between now and then is virtualisation. This provides a stable target and avoids the pain of having to deal with device drivers while also providing good isolation.

Another way of looking at it is that the libOS's time has come. Early versions like Exokernel and Nemesis were ahead of their time but the wider ecosystem is now ready to make use of new implementations. Also, Unikernel is a more general term, whereas Exokernel was largely for a specific project.

You might find the following two references useful.

http://queue.acm.org/detail.cfm?id=2566628

http://anil.recoil.org/papers/2013-asplos-mirage.pdf

amirmc··on Easy HTTPS Unikernels with mirage-seal
As an aside, you can also see how the self-hosted site is doing via https://mirage.io/stats/gc :)
amirmc··on Not-quite-so-broken TLS
One of the really useful things is that there is now a (peer-reviewed) paper on the work, which covers much more detail about the motivation, as well as performance results ("same handshake performance as OpenSSL and 73% – 84% for bulk throughput").

https://nqsb.io/nqsbtls-usenix-security15.pdf

amirmc··on Easy HTTPS Unikernels with mirage-seal
Making it straightforward and easy to build/deploy secure unikernels is an important step forward. It's pretty neat that we've been able to do this using our OCaml libs throughout (we previously had instructions that used OpenSSL as part of the certificate signing).
amirmc··on The Science of Pixar's ‘Inside Out’
Unfortunately, that article perpetuates the same (false) dichotomy between emotion and reason. It also suggests that emotions and higher-order functions are 'competing' for control.

The reality is that if the brain regions known to be involved in processing emotion are damaged/destroyed, then there are very negative consequences for your ability to make rational and well-reasoned choices. In other words, emotion (and emotional processing) is critical for logical thought to prevail. In that sense, I really like that the movie had emotions at the 'control panel' (I've yet to see it).

amirmc··on Rumprun Tutorial: Serve a static website as a Unikernel
I'm not sure your final disadvantage really applies. If we accept that most deployments to the cloud (eg. EC2) are essentially single-purpose VMs, then Xen is already scheduling resources this way (& presumably well enough).
amirmc··on Rumprun Tutorial: Serve a static website as a Unikernel
Each different Unikernel approach has its benefits and trade-offs. Rumprun lets you 'unikernelize' legacy software using well-established OS components (eg out of NetBSD) -- but you're still exposed to classes of bugs and potential run-time errors. MirageOS gives you safety, compile-time checks and produces really small binaries -- but everything is written in OCaml.

So it's not quite about trading safety and portability, as you can retain those depending on the approach you take (eg, MirageOS currently lets you target Unix, Xen-on-x86 and Xen-on-ARM from exactly the same code-base).

You can also try out static sites in MirageOS [1] and I gave a talk at polyconf last weekend with slides at [2].

[1] http://amirchaudhry.com/from-jekyll-to-unikernel-in-fifty-li...

[2] http://amirchaudhry.com/unikernels-polyconf-2015/

amirmc··on The Science of Pixar's ‘Inside Out’
Sadly, no. Anyone who's studied human emotion know that the dichotomy doesn't make sense (especially if studying the neural basis of emotions [1]). I hope this movie will help to shift some of that mindset.

[1] My PhD was the interaction between human emotion and decision-making but even defining 'emotion' was tricky.

amirmc··on What happens to my late husband’s digital life now he’s gone?
If the opinion of the dead didn't matter, Wills would be pointless. In this scenario, if you don't want the living to access your phone, then just state that.
amirmc··on As More Tech Startups Stay Private, So Does the Money
"If you can get $200 million from private sources, then yeah, I don’t want my company under the scrutiny of the unwashed masses who don’t understand my business," said Danielle Morrill"

Wow. I get that private money is easier to deal with but disparaging the public markets as 'unwashed masses' seems rather uncouth. I expect leading a public company requires quite a different skill-set than a private company and the 'scrutiny' is a necessary part of that (information release etc).

amirmc··on Introducing s2n, a New Open-Source TLS Implementation
My point is that I don't believe any of the dynamics would actually change. White hats would still report issues (they're not necessarily doing it for the money) and nefarious types will still trade/sell exploits.
amirmc··on Leaked: What's in TPP’s intellectual property chapter
Your comment seems to conflate 'our', 'us' and 'we' with the drug companies themselves. There should be more to such negotiations than just whatever is in the (self)interest of US-based drug companies.

That all this seems to be happening behind closed doors doesn't inspire confidence.

amirmc··on Introducing s2n, a New Open-Source TLS Implementation
Isn't that pretty much what we have already with things like openSSL? Find an exploit and suddenly you've exposed everyone. I don't think public bounties would change any of the dynamics around this situation.
amirmc··on Introducing s2n, a New Open-Source TLS Implementation
edwintorok is comparing s2n with the OCaml-TLS stack. See the links at the end of his comment (and the one below)

https://github.com/mirleft

amirmc··on Introducing s2n, a New Open-Source TLS Implementation
> It's interesting, but isn't 10BTC($2500) prize too low to tell us anything about how secure is this ?

No amount of prize money can ever really tell you how secure something is. We knew this before we announced it (see background at [1]).

[1] http://amirchaudhry.com/bitcoin-pinata/

amirmc··on Reviewing the Bitcoin Piñata
Yup, I totally agree with your points. However, I also feel there's some 'fun' factor here too -- and we hoped to appeal to it. By having the entire code base available, it also reduces the need for reverse engineering that other programs might require.

We didn't really expect the money to be the main motivator. Just a hook to draw attention.

amirmc··on Reviewing the Bitcoin Piñata
We're aware that bounties can't demonstrate security (mentioned early on in the post). However, putting such items out there and inviting review helps to stress-test the stack.

Right now, unikernels aren't in major production use, so there's little to gain by holding on to an exploit (one would assume).

amirmc··on Reviewing the Bitcoin Piñata
I wonder that you're forgetting that this is an entire VM. Including all the other bits necessary to function, such as a networking stack, web server, etc. it's not really fair to compare it with just OpenSSL this way. It should really be compared with a full Linux stack+OpenSSL (which is at least one order of magnitude larger, and probably more like two).

Having said that, yes there are ways to make it even smaller. We're working on getting the pieces right first.

amirmc··on Reviewing the Bitcoin Piñata
Yeah, we thought these were pretty cute. Almost a social engineering attack.
amirmc··on Reviewing the Bitcoin Piñata
This is a follow-up to a post back in February. The Piñata was originally meant to run for about a month but the team has kept it running much longer (it's still going).

HN discussion when the Pinata was released: https://news.ycombinator.com/item?id=9027743

(some general background to the Pinata is at: http://amirchaudhry.com/bitcoin-pinata/)

amirmc··on Why Don't Software Developers Use Static Analysis Tools to Find Bugs?
This reasoning makes no sense to me. It's like:

Alice: "Doing X will prevent bugs like Y!"

Bob: "Oh, but it does nothing for bugs like Z. I just won't bother at all, then".

Why would you not want to try and remove an entire class of bugs if it were within your power to do so? Just look at all the effort companies like Facebook have poured into exactly this kind of problem with things like Hack and Flow (which make use of OCaml).

amirmc··on Management things I learned at Imgur
I find that view to be a little harsh. It demeans all those people who choose to work for organisations that can't/don't generally pay as much but are driven by other purposes (eg NGOs).
amirmc··on Say Hello to Nest Cam
Popular sentiment isn't really a sensible thing to compare with. Most people have no idea how technology works nor a proper understanding of what they're actually exposing themselves to.

Products like this would be great if they could somehow be plugged into a user's existing, personal ecosystem (cf. concept of distributed personal cloud). I'm working towards this but it'll take time before such things are fully baked [1] (and there's also the question of business models).

Until then, we're just going to see more and more devices that require external back ends to operate and our homes/lives will become ever more porous, to (eventually) ever fewer companies.

[1] http://nymote.org/blog/2013/introducing-nymote/

amirmc··on Airbnb reportedly raising $1B at $24B valuation
You're correct that patio11 didn't say that but I think it's helpful to remind people that the power law still exists. It's really easy to fall into the trap of survivorship bias and I'm sure there are plenty of folks out there who would benefit from being reminded that "... no founder should delude himself or herself that being part of [YC] guarantees success ..."
amirmc··on Inside GitHub's Super-Lean Management Strategy (2013)
This was written about 5-6 months before the sexual harassment claims, lawsuit, investigation, and the later departure of one of the cofounders.

My take on this is that lack of 'management' might seem like fun but there's a reason most grown-up companies have more process.

http://mobile.nytimes.com/blogs/bits/2014/04/21/github-found...

amirmc··on The average American woman now weighs 166 pounds – as much as a 1960s man
To be fair, this article also mentions the increase in height.
amirmc··on Reasons the MI6 Story Is a Lie
With the above in mind, here's the text of the original post (https://www.craigmurray.org.uk/archives/2015/06/five-reasons...).

Five Reasons the MI6 Story is a Lie

The Sunday Times has a story claiming that Snowden’s revelations have caused danger to MI6 and disrupted their operations. Here are five reasons it is a lie.

1) The alleged Downing Street source is quoted directly in italics. Yet the schoolboy mistake is made of confusing officers and agents. MI6 is staffed by officers. Their informants are agents. In real life, James Bond would not be a secret agent. He would be an MI6 officer. Those whose knowledge comes from fiction frequently confuse the two. Nobody really working with the intelligence services would do so, as the Sunday Times source does. The story is a lie.

2) The argument that MI6 officers are at danger of being killed by the Russians or Chinese is a nonsense. No MI6 officer has been killed by the Russians or Chinese for 50 years. The worst that could happen is they would be sent home. Agents’ – generally local people, as opposed to MI6 officers – identities would not be revealed in the Snowden documents. Rule No.1 in both the CIA and MI6 is that agents’ identities are never, ever written down, neither their names nor a description that would allow them to be identified. I once got very, very severely carpeted for adding an agents’ name to my copy of an intelligence report in handwriting, suggesting he was a useless gossip and MI6 should not be wasting their money on bribing him. And that was in post communist Poland, not a high risk situation.

3) MI6 officers work under diplomatic cover 99% of the time. Their alias is as members of the British Embassy, or other diplomatic status mission. A portion are declared to the host country. The truth is that Embassies of different powers very quickly identify who are the spies in other missions. MI6 have huge dossiers on the members of the Russian security services – I have seen and handled them. The Russians have the same. In past mass expulsions, the British government has expelled 20 or 30 spies from the Russian Embassy in London. The Russians retaliated by expelling the same number of British diplomats from Moscow, all of whom were not spies! As a third of our “diplomats” in Russia are spies, this was not coincidence. This was deliberate to send the message that they knew precisely who the spies were, and they did not fear them.

4) This anti Snowden non-story – even the Sunday Times admits there is no evidence anybody has been harmed – is timed precisely to coincide with the government’s new Snooper’s Charter act, enabling the security services to access all our internet activity. Remember that GCHQ already has an archive of 800,000 perfectly innocent British people engaged in sex chats online.

5) The paper publishing the story is owned by Rupert Murdoch. It is sourced to the people who brought you the dossier on Iraqi Weapons of Mass Destruction, every single “fact” in which proved to be a fabrication. Why would you believe the liars now?

There you have five reasons the story is a lie.

amirmc··on Reasons the MI6 Story Is a Lie
and immediately following this article https://www.craigmurray.org.uk/archives/2015/06/cyber-attack...:

The site is under a strong denial of service attack from a bot trying to crash it by overloading with millions of pings from multiple locations. I presume the objective is to take down the revelation of the fake MI6 Snowden story, which had been read by tens of thousands already and is now really taking off.

While the copyright in that article remains mine, I grant permission for it freely to be reproduced by anybody, anywhere. I shall be grateful for multiple copies to be posted around the web so it can’t be taken down.

Some extremely brilliant people have put an awful lot of time and a bit of money on the defences of this blog, making it very hard to crash even by governments, through a cloud hosting system. (OK, you got me, I don’t understand how they do it). With any luck we won’t go down, but backups on that article very welcome.

This article will be deleted in an hour or so to put the MI6 lies back at top of the blog.

← PreviousPage 6 of 34Next →