badgar

> But 'deleting' an account probably doesn't do much more than remove the data from the immediate web services.

If you think they delete the data at all from anywhere you're out of your mind. Records are tombstoned, moved to cold(er) storage for efficiency and then not displayed. Certainly not deleted.

You are responding to a stray Apple fanboy who spelled "come on" as "common." I recommend disengaging.

An more detailed writeup, but hardly satisfying. Like most of Heroku's technical choices made in the name of "simplicity" and "robustness."

But I guess I should accept that Heroku will never be a technically impressive PaaS provider. Just the one I hear about the most.

I don't think we should be too surprised with how FB will use the new data. I'm just wondering who Facebook is going to share this data with.

I know a guy who works at one of Facebook's "partner companies" that pays gobs for FB user data. This partner company gets (as far as they can tell) fully-populated user data in Facebook's user dumps - way, way more information than they need or ask for. So the partner company puts this data through arduous preprocessing steps to filter out most of the details before any user data hits real systems. They're scared of the legal liability of holding onto all the personal details they receive don't need but Facebook shares anyway because Facebook genuinely doesn't care as long as they're monetizing.

So yeah, I'm scared of where this new data is going to go. Not what FB uses it for themselves.

> Heroku still requires authentication, but doesn't filter access by ip.

Which means unauthenticated access to the postgres port as I said in my post. I didn't say "unauthenticated access to postgres" which would be plainly ridiculous.

> Any system that allows unrestricted access to the PostgreSQL network port, such as users running PostgreSQL on a public cloud, is especially vulnerable.

Heroku allows unauthenticated access to the Postres port to anyone on the Internet? I guess that makes development a lot faster for users... nobody has to think about the implications of secured ports if you just punt on securing them.

> 1k req/min

Also known as <17 requests per second... or a trickle of traffic. Hooray for using bigger numbers and a nonstandard unit to hide inadequacy!

Does Heroku use req/min throughout their service? I can't understand why they would, unless they also can't build the infrastructure to measure on a per-second basis.

> After extensive research and experimentation, we have yet to find either a theoretical model or a practical implementation that beats the simplicity and robustness of random routing to web backends that can support multiple concurrent connections.

Does this CTO think companies like Google and Amazon route their HTTP traffic randomly? No... he knows there are scaleable routing solutions and random routing isn't the best. So he cites "simplicity and robustness." Here, this means "we can't be bothered."

Engineers for startups are paid poorly and almost always work on technically uninteresting problems. Where are you going to get people who can write good code? And again, why would you bother if the hard part of startups is everything except getting the code to work?

Why should they settle for third tier cable stations? I want HBO, Showtime, ESPN. If you're in the clear rebroadcasting Fox News you're in the clear with ESPN. How could -or would- you possibly see a difference? Copyrighted content is copyrighted content.

Slide decks are created for different reasons. Some are made to fully contain and communicate ideas then widely circulated - these decks are content. These decks don't need someone to deliver them.

Decks accompanying presentations aren't those slide decks. Presentations are expected to use human communication skills to express more than what you can fit in slides. In school, you give just these kinds of presentations. You aren't asked to create slide decks and circulate them among your colleagues. The slides are not the content. Which is why these slides in particular mostly make no sense alone.

Quality of software is pretty much irrelevant for startups. The code is usually crap and gets thrown away over and over anyway. The real focus is on people.

Your friend is a genius and might be the next pg.

You're forgetting his loaded and well-connected parents.

To be clear, the opening force almost all comes from the wrist. The force you apply to the knife with your finger to get it going is quite negligible.

The "meaningful distinction" is that "assisted-opening" knives require a non-zero amount of force in the direction that the knife actually opens. Switchblades can just have a button.

The former takes a few minutes of practice to open smoothly, the latter doesn't.

There's no reason to buy an assisted-opening knife if switchblades are also available. So yes, they absolutely exist to exploit a loophole. Loopholes in laws do tend to create (often short-lived) markets.

> The high property taxes (or property values or however the market works it out) doesn't make the schools good, it filters out people who are indifferent to the school quality, and filters in people who place a high value on education.

See Scarsdale, NY, a town in westchester which features insanely high home prices to fund the public school district (virtually all houses cost millions in today's market - high even for Westchester). The rare apartment buildings found well within range of the school are deliberately zoned out of the school district because they aren't contributing tens of thousands per year in school taxes, and students living outside of the district are free to attend if they pay ~40k/year in tuition.

Extortion is one of the better possible reasons for their DDoS. Eventually, when the money doesn't show, its in their best interest to stop attacking. While new extortionists will keep showing up, they won't likely come back.

Ideological or government attackers, on the other hand, can't be reasoned with and can only be expected to escalate in the future. If that's who Github is dealing with, then they'd better figure out how to actually deal with DDoSes sometime soon, because they will only increase in size and frequency.

> Sure it is, obviously you don't take any small amount of blocks as a signal.

You do realize spammers are extremely good generating large amounts of things, right?

> By getting a significant amount though and looking at each persons block list to normalize there blocks I think it would be useful.

Spammers are also very good (though not great) at adding innocuous data alongside their spam to look like real users.

You don't realize it, but your solution has just exploded in complexity.

Comments like yours are great reminders of why real legal counsel is so valuable.

Thank you for identifying that Krugman is both an economist and an ideologue. HN readers identify closely with the former so they often ignore or excuse the latter.

This isn't a Fermi problem. It's analysis. Math.

How many keys do you have? Not something you should guess.

How many bytes per key are you saving? Not something you should guess.

AFAICT Rails does point releases by just taking whatever's at head on the 3.x master branch, building a release candidate there, and iterating until nobody is reporting bugs.

This isn't a security patch - a stable branch with deliberately cherrypicked fixes - it's just a plain old "point release." And as is to be expected with Rails at this point, point releases break apps.

Oh, I agree. I think I misunderstood.

I didn't realize this is the first MongoDB release for which you can even reasonably do capacity planning. How did people plan before if there were no metrics?

Not every comment on Hacker News is useful. I'd say I was going for poignant if anything.

Github's code doesn't rely on the security flaw to function. Their code should keep working after the security fix.

Anyone who has ever consumed an API to build something they don't want to break understands this.

The point isn't that they had a security flaw, it's that the patch release fixing it changed the god damn default ORM's semantics!

Yes, I was pointing out that Rails made backwards-incompatible changes to core functionality in a point release primarily targeting security. I don't know how much more succinctly I could have originally put it, and I thought that it was obvious that this is a Bad Thing. You can't reach everybody.

Rails security point release breaks apps by changing the ORM.

News at 11.

> you had to know both data and index sizes across your most common usage patterns.

This is called capacity planning. If you can't estimate what resources you use, I wouldn't expect great success scaling.

If you read HN, you're worth at least 10 users. We're special!