OmarAssadi

I think it is less Stasi and more so 30 euro dedicated servers with unmetered gigabit lines are ripe for bad clients.

You've got the general issue of abuse and fraud that all providers face. But I think there are two issues that make it worse for companies like Hetzner, OVH, and other low-cost providers:

1. Chargebacks are a big deal, both in terms of being cut off from payment networks but also the fees imposed, which are especially harsh if your margins are likely razor thin sometimes; looking at the server auctions right now, it's kind of wild that Hetzner manages to give you a place in a datacenter, 3700X, 64GB RAM, 2x1TB enterprise SSDs, and unmetered gigabit on a decent network for 33 euros while still making a profit.

2. I would imagine that attempting the proper credit-card theft kind of fraud is also more of an issue for low-cost providers, not only because of #1, but because I think you'd manage to keep and abuse servers bought with stolen money for a lot longer; I think legitimate owners of said cards are less likely to notice 30 euro charges every month compared to being robbed blind by unexpected AWS fees.

I've had to deal with anti-fraud paranoia from OVH, BuyVM, Hetzner, and many others, likely all for the same reasons as Hetzner.

Both Hetzner and OVH refused to provide me service without photo ID or a passport. BuyVM refused one of my Jordanian friends entirely unless he paid in crypto. And while minor in comparison, I've had to change my PayPal email to match my account email on BuyVM despite it literally previously being paypal@myfirstandlastname.tld.

Not meant to be a dig at BuyVM, btw, even though the crypto bit may seem harsh. I really like them; freedom to host pretty much anything that isn't straight-up illegal, even Tor exit nodes, the support is good, they're often around and transparent in the community chat, and it's hard to beat free BGP announces, up to 10Gbps speeds, anycasted VMs across Europe and the US for <$10/month, and optional $3/month DDoS mitigation -- especially since it's the kind of small enough, tight-ship type of thing to where you can moan about poor routing or custom mitigation filters and potentially have someone actually try to take care of it (and it's also hard to beat for abusive or awful clients too, hence the trouble).

They provide great service, even if only to use as a DDoS-mitigated tunnel for more powerful servers elsewhere, or as a CDN, etc.

I can't imagine it is war-related, or at least not in any direct sense, like literally trying to intercept soldiers or spies.

I think the more likely scenario is that someone was to catch carders/botnet operators, since Jabber/XMPP is still very popular amongst people in that scene in Russia; you'll see often see screenshots or logs containing @exploit.in, @jabber.ru, and various other servers pretty much in any Krebs on Security article, for example.

That said, I think mass-surveillance is usually pretty gross regardless of intent.

I don't know what the exact ratio of criminal to non-criminal usage of either server is, but just like how Tor simultaneously has a ton of obviously illegal content mixed with whatever percentage of legitimate use [1], they presumably still do have a fair amount of totally normal conversations going on. And so I'm not an exactly a huge fan of invading privacy in order to spy on random cybercriminals likely far out of your jurisdiction in countries unwilling to extradite in the first place.

And while I understand if Hetzner was forced to comply, unless they wanted to become another Lavabit, as someone who recommends them often, it'll still be a little disappointing, IMO, if it turns out they were aware and allowed or assisted in the MitM attack, because otherwise, I think they're one of the best hosting companies.

Their transparency is great. And I get better uptime, reliability, and support than the overwhelming majority of cloud providers without selling my organs to afford it. And their effort put into turning environmentally-friendly design choices into economically smart choices is commendable.

The "reduce" in reduce > reuse > recycle can be seen in their KISS designs—like the raised, angled roof, allowing natural heat escape rather than loads of HVAC [2]; server chassises that are more bare-minimum structural support and air-shrouds than actual chassises; and stripped-down standard motherboard designs with only the most minimal changes, like 90-degree rotated sockets to allow a single fan to cool the VRM, CPU, and memory [3], rather than a dozen screaming, power-slurping Delta fans for every server.

And their knowledge of "reuse" is evident by their server auctions, where they do Dutch-auction-style rentals of legacy hardware rather than scrapping everything, avoiding spending a load on new hardware while also avoiding the environmental cost associated with manufacturing new everything each generation.

I'd love to be able use them more if only they had dedicated servers outside of Europe.

[1]: "legitimate" is hard to define anyway; one country's journalist is another's "foreign agent", and one country's "freedom fighter" is another's "terrorist".

[2]: Der8auer: Over 200,000 Servers in One Place! Visiting Hetzner in Falkenstein - https://youtu.be/5eo8nz_niiM?t=259

[3]: Der8auer: Hetzner shows Special AM5 Board with 90° Rotated Socket - https://youtu.be/V2P8mjWRqpk

Assuming this was done at the government's request, I assume Hetzner is more than willing to comply with a court order mandating they allow them to monitor and physically size a machine.

And outside of nation-state requests, even ignoring the fact that someone could probably pay-off an employee, I think ease would depend a lot on the datacenter and target; judging by the awesome and hilarious story behind the Fremont Cabal accidentally becoming an internet exchange by essentially having some dude barely secretly slipping unauthorized cables into the raceways [1], I figure there are a lot of places where if your target is simply renting a couple rack units or single rack rather than an entire locked cage, you can probably get physical access by doing the same.

Also, a lot of Deviant Ollam's stories about industrial security and the dozens of ways he's broken into utility companies, server rooms, etc — mostly just by being confident, looking the part, bad doors [2], and badge cloning [3] — don't give me a ton of confidence that someone with skill couldn't feasibly either get direct access to servers they shouldn't, or at the very least, access to an important part of the supply chain for their target.

And speaking of supply chain, my processor died recently, so I ordered a brand-new in box replacement Ryzen, and when it arrived last night, out of curiosity, I wanted to see if I could get the CPU out of the box without breaking the tamper-evident authenticity seal...

... and about fifteen minutes later, after borrowing a syringe and hypodermic needle from my mom, a little bit of isopropyl alcohol, a blade from my safety razor, and a quick look at a video from LockPickingLawyer [4] and a couple from datagram at DEFCON's Tamper-Evident Village [5][6], I had the CPU out, put my old one for now, and re-applied the sticker with no visible damage to the box or seal.

All I had to do was tip it upside down at about 90-degrees, douse a little bit of the alcohol under the top of the seal, let gravity do most of the work, and then carefully lift the seal with the razor. After that, I just lightly squeezed the box to make the front tab come as forward as possible, and then carefully pushed the ear flaps down to prevent tearing, and then I was in.

I've seen others demonstrate it on older AMD boxes that had flexible cardboard in-place of the cooler, allowing them to pull the cardboard to make enough room for tools to get out the CPU without even touching the seal [7]. But in my case, it was a newer box with hard plastic inside where the cooler would've been, so that's why I went for the seal instead.

No surprise to me now that counterfeiting is rampant on Amazon, with people returning the box after putting in either random junk, dead Athlons covered by a counterfeit serial-matching IHS, or the cheapest socket-compatible CPU after deluding both and swapping the IHS.

I figure with a bit of practice and better tools, like Teflon spudgers and syringes, it'd be significantly easier to get past 99% of tamper-resistant/tamper-evident seals and into boxes you're not supposed to be without risking damage, and then you can intercept a package, compromise something critical, like the server BMC or firmware, reseal everything, and be on your way.

And given the relatively recent scare with loads of servers, including Dell and others, being shipped with "AMERICAN MEGATRANDS" labels on their BMC boards, with no one noticing until a YouTube commenter pointed it out during a teardown by ServeTheHome, I think it's totally feasible for an enemy to just compromise the entire physical supply-chain of a company, datacenter, or whatever else [8].

[1]: Oxide's On the Metal: Kenneth Finnegan - https://oxide.computer/podcasts/on-the-metal/kenneth-finnega...

[2]: Deviant Ollam @ Shakacon: The Search for the Perfect Door - https://www.youtube.com/watch?v=4YYvBLAF4T8

[3]: Deviant Ollam / Modern Rogue: Getting an RFID Implant - https://youtu.be/SZiRISGdQ4g?t=277

[4]: LockPickingLawyer: Did I Cheat On This Challenge? (Tamper-Sealed Abus) - https://www.youtube.com/watch?v=xUJtqvYDnkg

[5]: DEFCON 19: Introduction to Tamper Evident Devices - https://www.youtube.com/watch?v=W07ZpEv9Sog

[6]: DEFCON 30: Tamper Evident Village - https://www.youtube.com/watch?v=slhdowWjSuU

[7]: cycurious: How Counterfeiters replace CPU in Sealed Retail Box - https://www.youtube.com/watch?v=Bni8bgGlXDE

[8]: ServeTheHome: Dude this should NOT be in a Dell Switch… or HPE Supercomputer - https://www.servethehome.com/dude-dell-hpe-ami-american-mega...

I'm not sure truly verifiable "Secure" Boot is actually realistic in most scenarios, though, right?

I'm not super up-to-date on what's being offered right now, but I'm not sure if there is a way to have a proper trusted execution environment on most Intel or AMD offerings; I thought Secure Boot on AMD64 platforms generally rely on TPM or something like SGX for validation, with the former having seemingly a dozen different ways to be tampered with, and the latter being discontinued and being vulnerable to several different attacks, including DOWNFALL.

I think EPYC and Sapphire Rapids have some sort of Trusted Execution Environment stuff with SEV-SNP and TDX, maybe? But I don't think either option is really feasible for people paying Hetzner-like prices for hosting; Hetzner's newest Xeon offering is seemingly Cascade Lake, and the only EPYC offered is a single-socket Rome 7502P with 128GB DDR4 for 142 euros, which seems very hard to justify, given they also offer a 7950X3D with 128GB DDR5 for ~25 euros less.

Even then, I don't think I could put my confidence in a machine I don't own, didn't setup, can't physically inspect, don't know where it came from, whether the firmware has been tampered with, etc -- especially if it is something as complex as x86, where there is seemingly at least one new horrific hardware-level vulnerability that crops up every generation or two.

EDIT: I forgot Hetzner also started offering Ampere Altra servers for 200 euros. I think those have TEE of some sort with the TrustZone stuff?

Not sure how secure that really is, though; I haven't really looked into the ARM offerings as much as I should have, mostly since, if you don't want Apple, I'm not aware of a good middle-ground between a cheap SBC and a $3,000+ Ampere server, outside of jerry-rigging some second-hand Gigabyte Cavium ThunderX2 nodes off eBay.

Yeah, Palestinian-American; I was born in Israel with Israeli and American citizenship, but grew up mostly in Florida, did a government thing in high school that sent me to Moscow, stayed in Russia for university, and back in the U.S. now.

It's sort of strange to me how many Americans seem to share the same sentiment when my experience has often been the total opposite.

China has some of the best factories, supply chains, and collaboration in the world. And while yes, of course, loads of intentionally cheap, low-quality goods are churned out regularly, many Chinese companies also make really solid products, often even the best products until you reach a certain ultra-luxury price bracket that they simply aren't trying to compete in.

For example, sure, an LG/Samsung/Sony OLED will be way nicer in terms of picture quality than any Hisense on the market. But the cheapest OLED on BestBuy right now is a last-gen, clearance 46" LG that costs almost ~$700; if you want a 50"+ model, be prepared to spend $1,000 minimum. On the other hand, the 75" U6H I got for $600 was better than any comparable non-OLED offering by non-Chinese companies until you got into the $1,000-1,200+ price range.

Midea is another good example; sure, Bosch, Miele, and Zojirushi often have much nicer luxury products, but if you're a middle/working-class person who doesn't want to or can't spend $300+ on a rice cooker, it'll be hard to beat--unless you get lucky like me and find the one weird guy in your town who happened to be moving cities and selling off all his appliances, including some perfect-condition JDM Zojirushi with an inverter for $100 (and also happen to have a Japanese friend you can annoy to help you figure out what all the Kanji menus do).

Same can be said for handset manufacturers like Xiaomi, etc. And a lot of audio gear as well; $100-200 Russian Oktava microphones easily punch several hundred to several thousand dollars above their class, Chinese brands dominate the mid-range IEM market, and Chinese headphone brands like HiFiMan are difficult to beat in any price bracket -- first paycheck I got, I spent $1,600 on Sennheiser HD 800 S because I wanted the HD 800 as a kid, but realistically, $300 HiFiMan Sundaras will get you almost there for over a thousand less.

Personally, every "made in America" thing I've bought that wasn't manufactured before like 1990 either fell apart and/or was ridiculously expensive compared to things made elsewhere. My association of made in America is either:

A. Truly craftsman, low-volume, specialized products that have an inherently high price tag

B. More commonly, low-quality, over-priced junk that survives only because of nationalism or protectionism alone

I'm using Nix now on my macOS installs, so I might not be totally correct the current situation. But yeah, I believe most of those sorts of issues have gone away with the new prefix.

There's still some weird annoyances for me, though. For example, it's still intended for single-user mode only. The best solution I came up with was to create a separate user for Homebrew and then basically alias `brew` to `sudo -H -u homebrew brew`.

And generally, if you attempt to use a non-standard prefix, such as in your home directory, packages will have to be built from source. I understand why, but it sucks because this means when you need x86-only packages via Rosetta, you're stuck with the old `/usr/bin` prefix, unless you want to and can build from source.

Also, in general, maintaining multiple prefixes/architectures is annoying too. I wish the default command allowed me to just pass `--arch amd64/arm64` or something when installing packages

> Is anybody aware of anything that's price competitive in the US (or within a 50ms ping)?

OVH [1] is not quite as cheap, but I can't really think of anyone else in the area that is totally comparable. One draw of OVH, Hetzner, etc, for me over the truly small, cheap dedicated server providers is they both have pretty decent networks and free DDoS mitigation, which is really nice for things like game servers and such where CloudFlare isn't an option.

OVH's sub-brands like SoYouStart [2] will sell you decently specced dedicated servers started at around $30 a month in Quebec, which tends to be more than good enough for most of my "US" needs.

They do have a couple datacenters in the United States too, not just Canada (+ quite a few in Europe, one in Singapore, some in Australia, etc), but I believe the Virginia/Oregon servers aren't available on the cheaper SYS site -- still cheap, though, but not quite $30 cheap.

[1]: <https://www.ovh.com>

[2]: <https://www.soyoustart.com/> (main downsides compared to OVH proper is the connection is capped at ~250Mbps, and although all servers have DDoS mitigation, the SYS and Kimsufi servers don't allow you to leave it on 24/7 -- so when you get attacked, it might take a minute or so to kick in, and then it'll remain on for 24 hours, I believe)

> What's the catch?

To me, there kind of isn't one. I have generally had very good and fast support, even on the auction servers (which are even wilder in terms of pricing than the ones linked -- e.g., I was paying like 40 euros a month for 40TB storage + a modern i7 and 64GB RAM).

The real 'catch' is the more limited offerings; it isn't the kind of one-stop-shop that AWS is where you can rent 8x A100s in a dozen datacenters while having them manage your database and a billion other things.

But if you just need lots of CPU, memory or storage, don't want to pay exorbitant bandwidth fees, and Europe is fine, they are pretty great.

‎

> It seems like Hetzner is the only company in the world offering these kind of priced, right?

OVH is not quite as cheap, generally, but they have lots of inexpensive offerings, especially on their SoYouStart/Kimsufi lines [1], with much more variety in terms of datacenters, including Singapore and Australia, depending on what you need in Asia/APAC -- likely better DDoS mitigation than Hetzner as well.

‎

LeaseWeb can be really cheap as well. Their public pricing on the main website can appear kind of expensive, or at least not Hetzner-tier cheap, but if you're ordering a decent number of servers, they seem to offer great volume discounts.

For example, through a reseller [2], I've got 100TB of their "premium" bandwidth @ 10Gbps, Xeon E-2274G, 64GB RAM, 4x8TB hard drives, and a 1TB NVMe SSD in Amsterdam that I use as a seedbox for like 60 euros.

‎

Another semi-low-cost provider, depending on what you need, in Asia that is worth mentioning is Tempest.

I believe they are owned by Path.net, and they've so they've got better DDoS mitigation than most other providers without costing an arm and a leg; in Tokyo, $140 will get you an E3 1240v2 + 16GB RAM and $200 will get you a Ryzen 3600X + 32GB RAM, both servers are 10Gbps unmetered.

Not a great option for someone who needs a ton of variety in their hardware, but if you need something high-bandwidth with decent specs in Asia, it's not awful.

‎

[1]: Worth noting that, although unmetered, SYS is generally limited to something like 250Mbps speeds, and Kimsufi is 100Mbps. You do get lucky occasionally and sometimes your server magically has uncapped gigabit, but for guaranteed high-bandwidth servers, the main OVH site is the only option.

[2]: I'm using Andy10gbit, who is fine for my needs - e.g., I don't need to reinstall the OS 24/7 or have instant support since it's just used for torrents. It'd be a bad option for a business, though, since I wouldn't want to be relying on some dude on Reddit if something goes horrifically wrong. WalkerServers is another example of one of the ultra-cheap LeaseWeb resellers.

> Hetzner feels like a hard discount cloud provider.

Not to discount your experience, but honestly, my experiences with Hetzner support have generally been unexpectedly good. They've been very quick to respond, tend to immediately start on whatever my issue is if I provide enough info in the initial ticket, etc. And unlike OVH, I haven't felt like I needed to call them on the phone to get decent service. Kind of surprising to hear that their solution was just "rent another".

‎

Overall pleasant experience for me, especially given how cheap the servers are. My only real wishes would be dedicated servers in the US or Canada, and possibly something in between their unmetered 1Gbps and metered 10Gbps offerings -- being able to burst a bit higher than gigabit occasionally without paying the €1/TB bandwidth fee would be beautiful.

I pay for ChatGPT Plus and have paid a fair bit in OpenAI API fees; I don't care that they are making money. The problem is the openwashing, not the monetization.

Stable Diffusion will run on any decent gaming GPU or a modern MacBook, meanwhile LLMs comparable to GPT-3/ChatGPT have had pretty insane memory requirements - e.g., <https://github.com/facebookresearch/metaseq/issues/146>

I am tired of this idea that the US being large invalidates anything that happens in Europe as impossible.

I lived in Russia for a while, in a city in the middle of Siberia, and there is a night and day difference between how people live.

Russia is even larger than the US, but living in single-family detached homes is just not very common. So, most things tend to be within walking distance. And public transport is much more effective.

For the same reason you might have other external peripherals. A laptop, realistically, can only fit something so decent inside of it. The 2020+ MacBooks do have surprisingly OK internal mics, but that's about all they are: OK.

Maybe I'm just an extra-big baby about it all. But what I find a little annoying with the COVID-era of work-from-home and distance learning is how few people seem to care about audio. Even as a teenager on TeamSpeak, rather than getting a more expensive graphics card or whatever, I spent my money on an SM7B. Now it is more important than ever.

Maybe this isn't reasonable, but I feel like if not for yourself, to prevent "sorry, can you repeat that?" moments, you kind of owe it to the people who have to listen to you. Like as an autistic person, hearing a dozen people's overlapping background static, tinny compressed audio, etc, it really, truly slowly drives me nuts. I can't deal with that level of auditory sensory stuff all day. If someone has a bad microphone, I want out of the call ASAP.

A Shure SM58 will last you a lifetime, fit on your desk, cost <$100, and no one will ever complain about sound again.

For me, it's less of a macOS inherent issue and more so that many, many things just assume Linux by default. Anything you find on GitHub that relies on some sort of native module is really hit or miss in terms of "will this just work, or will I need to go waste a couple of hours or resort to a VM?"

For example, I've run into a couple of occasions where I've needed to build some third-party thing that happens to also need something like QEMU, but the build scripts only run on Linux. Annoying, but whatever, setup a Linux VM/"container" and good to go, right? ... except there is no nested virtualization support on the M1 macs.

Outside of those sort of issues and other ARM-specific problems, while it doesn't usually impact my workflow too much, I wish I had more control over the system. I wish, for example, it could boot off of something other than APFS, etc. I don't want to have to deal with Time Machine when I've already got snapshots everywhere else, etc.

Everything is relatively minor, but there is always some new thing that makes me annoyed every week or two.

That feels about right to me too. I don't know if I'm usually just doing more computationally intensive stuff than most with my 16" M1 Pro, but I think the only way I could get anywhere near the advertised numbers is if I basically just had Safari open and the display on half brightness.

And not to beat the already long dead horse any more, but toss in some electron apps running in the background, I probably average somewhere around ~7 hours or so. I'm not convinced the 10+ hour lifetime is possible if you've got stuff like Discord/Slack/VS Code open.

But in terms of when I am doing truly evil things to it, I am surprised it lasts as long as it does, be it max CPU compiling or all of this morning when I was toying around with stable diffusion, it gets around ~4 hours or so.

Cool!

I love Nix, but really am not a fan of the Nix package listing website. So, it is nice to see.

And I guess worth mentioning, but if you or anyone else is ever feeling a little less lazy than me and want to add more available metadata, some of my main gripes with the official site:

- No easy way to see dependencies without viewing the package derivation source code.

- No easy way to see "reverse" dependencies, period, as far as I am aware, short of basically grepping the entire nixpkgs repo, and even then you won't get a totally accurate answer.

This seems like it'd be awful to implement given I don't think you can realistically know this information without evaluating the entirety of `all-packages.nix`. But it is something I miss about stuff like Arch Linux's package website. And I think in some ways, it is even more important with stuff like Nix if you intend to override a particular package globally, since you may end up needing to rebuild god knows how many things as a result.

- No easy way to filter by package types, outside of the very small set of existing package sets (e.g., `vimPackages`, `mpvScripts, etc).

As an example, I'd really like to be able to see all font packages in the nixpkgs repo, but there's just no nice way to do this easily, unlike some other package managers. It would be another kind of awful feature to implement, since there is not currently any grouping that I am aware of.

You /can/ kind of grep the `all-packages.nix` file and get a rough idea by searching for what packages call `./data/fonts`, but actually parsing that is pretty rough, since not everything is as simple as `font-name = callPackage ./data/fonts/font-name {};`

A good example of that parsing annoyance would be the noto-fonts [1].

- No easy way to see build options. For example, packages like `mpv` or `ffmpeg_5` have loads of different feature flags, some of which are unexpectedly disabled or enabled.

Again, I think this would be not fun to implement. But it is something that I think Gentoo gets really right with the listing of 'use flags' on their package listings [2] (in fact, Gentoo's site kind of gets everything right; it feels like the gold standard to me). NetBSD/pkgsrc is another one of the few that does well, albeit with a less-fancy design [3].

[1]: <https://github.com/NixOS/nixpkgs/blob/96c0fdeb6accc9f76f1887...>

[2]: <https://packages.gentoo.org/packages/media-video/ffmpeg>

[3]: <https://ftp.netbsd.org/pub/pkgsrc/current/pkgsrc/multimedia/...>

> here is definitely the correct answer this time and then it gives you another wrong answer.

My favorite is when it gets into some weird context loop, apologizes and claims to have corrected an issue, but gives you literally, character-for-character, the same answer it gave before.

Fortunately, it mostly happens to me when I am asking particularly ambiguous or weird questions -- e.g., asking for any assembly in AT&T/GAS syntax seems to always go wrong, not necessarily in terms of the logic itself, but rather that it ends up mixing Intel and AT&T, or asking explicitly for POSIX-compliant shell often gives weird Bash/GNUisms, presumably since so many StackOverflow posts seem to conflate all shells with Bash and always expect GNU coreutils.

Yeah, it seems to still be the case. This post ended up being longer than I intended, but I figure it might be interesting to anyone curious about curriculum in other countries.

While I'm American, I did a weird U.S. DoD/State Department language program (NSLI-Y) in high school, where they sent us off to Moscow to study Russian. I thought it was such a fun and strange experience that I decided to stay afterward and do my bachelor's there.

Initially, I wanted to go to Novosibirsk. But between passport renewal delays and everything else, I took the first and only thing I could in February, the preparatory program at Tomsk State University. And yeah, at least in 2018, all of the introductory programming classes were taught with Pascal and Lazarus.

I think the professors in the prep program must've been from the more traditional "Institute of Applied Mathematics and Computer Science" faculty, though, rather than their newer spin-off, the "Higher IT School", which probably explains the Pascal choice in my case.

Because when I enrolled in the proper degree-granting 'Software Engineering' program, it was surprisingly modern and practical.

They had built their own little LeetCode clone that they used for the introduction class to teach the general basics of programming, algorithms, data structures, etc., with some ~600 tasks or so that you had to complete a certain percentage of in each module (one thing I liked is that they had a mandatory regex section as well in that class -- I feel like too many people end up having to StackOverflow those types of things). You could use a variety of languages (Java, C#, C, C++, Python, Ruby, PHP, Pascal, and Perl, I believe -- looks like Ruby, PHP, and Perl are gone now, though) that ran in containers against a bunch of test cases.

The second semester, that class focused more on practical projects and teamwork. So we had to build a little Instagram-like mobile app with whatever tech, and then any game with any tech (my group just did Android + Java, and then we made a Source Engine-style surfing clone with UE4).

We also had a weird but fun "cross-cultural communications" course where all the students in the Russian and English programs intermingled, and it ended with us having to organize, find sponsors for, build teams, and play in a CS:GO/Dota 2 tournament (Russia moment).

Initially, the third semester felt like we were going back in time because we were forced to use some ancient version of Oracle for our database class. And, of course, because of licensing limitations, we had to physically go trek to university in -40 for that. But the professor was an interesting character; funny guy who wrote all of his own textbooks in English and Russian for us (for free), and I don't even know how long ago he must've gotten his doctorate, but I know he's been teaching since the 80s.

After Oracle hell, he forced us to pick any NoSQL database and build something with it. The nice part, though, was that he really, truly did seem to know everything there was to know and stayed up to date.

That same semester, we also had a mandatory "OOP" class taught with C# and .NET Core and a mobile development course, which taught modern Android development in Kotlin.

The fourth semester was machine learning and data science, mostly taught with Python. And a vaguely titled "Programming Languages" course, which was kind of brutally intensive and went through functional programming, concurrency and parallel computing (I did not have fun writing lots of OpenCL), and then forced us to design a language and write an interpreter and compiler for it.

We also had a front-end course, systems administration and networking, and then "Entrepreneurship," where they taught some basics of business and econ, made us come up with an idea for a software startup, do market research, build a tiny MVP, and then present (it was OK for the presentation to be a 'why we failed' -- which was the case for my team, lmao).

Fifth semester, you had a "Software Engineering" course, which was more so about project management, learning how to write issues correctly, UML, etc., a course on back-end web development taught with ASP.NET Core, and then essentially a more hard-core continuation of the entrepreneurship class, except this time you're meant to present to actual VCs, and if your idea doesn't suck, they offer to give you funding and let you work on it for the remainder of the program if you desire.

In the sixth semester, you are meant to prepare for the fourth year, in which you choose between an internship, research, or your own business. And you write a ~40-page practice thesis based on your work or research.

And then, the final year is a continuation of whatever track you chose + the real-deal thesis, and some various minor classes here and there -- like we had some group-work-based Scrum course where we had to build a learning management system.

I'm sure I've forgotten a bunch; we had so many damn classes all the time. Plus, the other mandatory non-programming-related ones, like calc, stats, linear algebra, Russian, history, philosophy, and FOUR YEARS OF PE, OH MY GOD (and four years of English, but the professor is the coolest woman in the world, and it was fun since it mixed the international and Russian students, so I didn't mind that, at least).

(Also, worth noting for anyone not super familiar with education in a lot of the post-Soviet states, you're generally assigned a 'group' where you'll be with the same dozen or so students during each and every class for the entirety of your degree.

So, that also tends to mean there isn't really the concept of picking and choosing different classes, etc. -- every class is mandatory, and you all share them together; you're either going to have an amazing bond by the end of it or be very lonely).

EDIT: Forgot about cybersecurity. That was cool too. We were given access to various servers and web applications, each with different vulnerabilities that we had to find, exploit, and then patch. It was fun seeing things like blind SQL-injection, etc.

Are you running arm64 or amd64 images? I switched from docker to podman, mostly due to other issues (e.g., the weirdness with the Docker VM seemingly growing infinitely in size and refusing to trim automaticity), but running arm-native containers has never really made my battery life significantly worse.

The 12+ hours, though, I’m not sure how people are getting that consistently. I feel like VS Code and some LSPs alone make that impossible for me.

I can’t imagine if I were doing some web dev stuff and needed Chrome installed of Safari too.

While you're not wrong RE: object references, Java does have the `final` keyword that you can apply to fields, local variables, method arguments, etc. This prevents the value from being re-assigned short of going out of your way to do reflection hacks and such. You can also apply it to classes themselves and prevent them from being inherited and modified that way.

The only real 'gotcha' there is that, while it prevents whatever it is applied to from being reassigned, if the value is a mutable object of some sort (e.g., an array, mutable collection, etc), it, of course, does not prevent you from modifying the contents of the array, etc. However, Guava provides nice immutable collections to mitigate that issue [1].

It's been a while since I've written modern Java, but I want to say JDK 14? also brought records, which I believe are basically the equivalent of having `final` and `public` on everything as well as overriding the equality and hashcode functions on everything by default so that comparisons are done based on the contents of the object rather than the reference.

And while I am sure many people are scared of the bytecode manipulation that it performs, Lombok [2] provides a lot of little utilities that make using immutable objects totally painless - e.g., applying `@Value` to the class generates all of the necessary boilerplate at compile time, or my favorite, `@With`, which generates methods for copying an immutable object with one of the fields changed (e.g., `val newUser = olduser.withName("Nayeon");`)

Lombok also offers Kotlin-style extension methods [3] which can be nice too for this kind of thing. Though, in my experience, it is the only feature in it that has bitten me at times.

[1]: <https://github.com/google/guava/wiki/ImmutableCollectionsExp...>

[2]: <https://projectlombok.org>

[3]: <https://projectlombok.org/features/experimental/ExtensionMet...>

There’s also something beautifully awful about blocking entire countries due to the reputation their IP addresses have, while making strange, sweeping xenophobic statements about the people that live there, meanwhile a non-insignificant percentage of some of those attacks originate from the United States (e.g., the Mirai botnet that compromised hundreds of thousands of IoT devices and also held the CloudFlare record at one point was created by an American and operated from the U.S. despite many of the infected devices being located in some of these countries).

Yep. For many years, horrific American providers like C…C….ing had been super well-known effectively allow DDoS amplification attacks.

Yeah, despite how little I comment on here, I use HN all the time for basically the same thing. I think the good moderation, smaller, tighter-knit community, and relatively high-quality of posts compared to Reddit has made it my first go-to when I am curious about something.

I'll usually `query bla Talos II bla bla site:ycombinator.com`, and if that doesn't give me what I want, I'll try the Algolia search [1]. And only then will I give up and try `site:reddit.com`, unless there is a more specific site I know to try first [2].

‎

---

[1]: I'm sure most regulars here know it, but if you don't, it is super useful. I just wish it had more query operators to filter out stuff sometimes -- <https://hn.algolia.com>

‎

[2]: I'd be interested in what others here do. Off the top of my head, these are the ones I'll usually use, maybe it'll be helpful to someone else:

‎

• For questions about server hardware / networking equipment / weird second-hand HPC stuff, ServeTheHome has a surprising number of quality articles and lots of forum discussion -- `site:servethehome.com` or `site:forums.servethehome.com`

Level1Tech's Forum (site:forum.level1techs.com) can be decent as well for such topics and stuff like ZFS-related questions, but it tends to have a more 'inexperienced'/consumer userbase relative to STH (though usually more into it than, say, the LTT audience).

‎

• If you don't mind Google Translate, Russia's more-or-less HN equivalent, Habr [3] often has pretty high-quality, in-depth articles on a variety of tech/programming topics. It differs from HN a bit in that companies themselves tend to write them and they are displayed inline on Habr itself rather than more of a Reddit-like link-aggregation system like on HN.

The style tends to be similar to stuff like the CloudFlare blog posts -- `site:habr.com` (word of warning: great content, but the comments can be quite mean at times - e.g., the blog post on Cosmopolitan was just filled with awful transphobic stuff).

‎

• For anything video encoding-related, `site:doom9.org` is a great resource when Googling specific questions. And for finding out which country has the best quality release of a movie, outside of something like a torrent tracker, screencaps from <https://caps-a-holic.com> are great, and adding `site:forum.blu-ray.com` or `site:dvdcompare.net` to your queries can help a ton to find actual info about a disc.

Otherwise, certain Discord chats, like Beatrice-Raws, /r/av1's Discord, and the SeaDex Discord can have useful discussion.

‎

• Anything Linux-related, the Gentoo Wiki is really good, and Arch too - adding `https://wiki.gentoo.org` to a query can help a lot, particularly for weird compiler flags and old/obscure hardware, or `site:wiki.archlinux.org`. For LTO and optimization bugs, the Gentoo LTO overlay project is also really useful, between the patches/notes and the issue tracker discussions [4]. AUR comments can also be helpful for issues with somewhat bleeding-edge builds.

‎

• Arch's PKGBUILDs and Alpine's APKBUILDs are really easy to read, and I find actually getting to them/the sources for their patches is easier/quicker than most distros. If I'm running into trouble, I tend to check their stuff to avoid the useless Google searches.

‎

• For anything drug/medication-related, the Psychonaut wiki [5] and Tripsit [6] tend to be better than stuff like Wikipedia in terms of "wtf did my doctor prescribe me, what will this do, and do I need to worry about taking it in combination with XYZ".

As a last resort, if neither has good info on some obscure thing I've been given, like when I was living in Russia, if you're willing to Google Translate, I've found Russian Wikipedia to be really vast on all sorts of medications and chemicals, and also much more objective and skeptical about certain topics (e.g., there are tons of borderline placebo Soviet-era meds they'll give you there, and if you look them up on English wikipedia, you can tell some Nootropics-bro wrote half of it, whereas the Russian page will quickly tell you "actually, there's been basically no proof this does anything").

‎

• If I'm looking for a particular file that I can't seem to find normally on Google or torrent tracker, I've had success searching for Apache directory listings with some query abuse [7]. And if that fails, DHT indexers [8] like BTDig [9] can be helpful when you're in a situation where you know the filename, like a particular font that is no longer for sale, but seemingly can't find it on Google, Yandex, Archive.org, etc.

‎

• For finding new music / movies / anime, queries like "Films like Parasite" or "Best Korean movies" on Google tend to be useless due to all the SEO-spam WatchMojo-tier blogs, all featuring the same five films that barely relate to what you're looking for.

‎‎

The best way that I have found, personally, is to use the collages and comment sections on certain torrent trackers; as with HN, the communities tend to be tighter-knit and have higher quality discussion than you can find on Reddit.

‎

For general music, even if you don't intend on ever actually pirating anything, Redacted's ("RED") "collages" (think: ultra high-quality, user-curated lists of similar music) is unmatched. And they have relationship diagrams for each artist to show what other users tend to download. RED is a private tracker, but they allow anyone to sign up if they submit an application through IRC [10]. For East Asian music (j-pop, j-rock, k-pop, etc), Jpopsuki can be useful as well - almost the same system, but more targeted niche (and unfortunately, less curated/moderated).

Otherwise, Last.fm's recommendations tend to be better than Spotify/YouTube for me, and the ability to see which other users have similar taste to you / have the same current favorite song can be really useful, since you can then click on their pages and inevitably find something you've never heard before that matches your taste.

‎

Anime, unfortunately, does not have the same level of pirate curation as movies or music, so I tend to rely a lot on AniDB's tags [11] and MyAnimeList's user-curated recommendations [12]. For Korean and Chinese TV, MyDramaList is similar and pretty decent [13].

‎

And for movies, another torrent tracker, PassThePopcorn ("PTP") has the same sort of collections/collages and system as RED, which can be great if you're looking for very specific types of films. And even better, you have to "pay" credits (non-purchasable points you receive for seeding) to even create a collection, which adds a surprisingly nice, artificial barrier to ensure that the only collections that exist are ones maintained by people who truly care about that particular sub-niche.

‎

Like HN, the comments often have more value than the content itself. And unlike RED, where comments are for a particular torrent (e.g., Fake Record Label's 1997 Japanese-region CD of Fake Band's Self Title album), PTP comments are per torrent group (i.e., Fake Movie as a whole rather).

This can be really nice because the comments often turn into reviews and discussion about particular editions of a film.

As an example, I watched Wong Kar-wai's "Fallen Angels" much later than I should have (great movie, btw), but had I not read the comments, I'd probably have just downloaded the 4K Blu-ray, not realizing they re-colorgraded the film to have an entirely different style from the original, and changed the aspect ratio by cropping it from 16:9 to 2.39:1.

Personally, regardless of what the director claims is his true vision, I am really glad I read those comments because what sticks out to me the most in Fallen Angels is the beautiful color work and the ridiculous decision to use a super-wide angle lens (possibly 9.8mmi adapted to 6.8mm?) [14] for most of the film, which gave it this immersive feel. However, like almost everyone else, I have a 16:9 TV, and so when you crop it to a cinema aspect ratio, something feels very, very wrong -- you lose that immersion and claustrophobia the lens created in the first place [15].

‎

• For anime watchers, you'll often notice that the official subtitles for certain, difficult-to-translate series, like Bakemonogatari end up feeling really robotic or simply don't make much sense in certain scenes.

However, while fansubs can be significantly better sometimes, there are always a dozen different groups, and often neither Google nor Reddit will have any information on whose subs are actually worth downloading.

For that, I tend to use SeaDex [16] or "A Certain Fansubber's Index" [17] -- these are spreadsheets with the current 'best' releases of most anime.

‎

[3]: this is the English version, which has much fewer articles, but it might help to get a general idea - <https://habr.com/en/all/> (also, note the company-specific and topic-specific filters)

[4]: <https://github.com/gentoo-mirror/lto-overlay>

[5]: <https://psychonautwiki.org/wiki/Adderall>

[6]: <https://combo.tripsit.me>

[7]: <https://www.reddit.com/r/opendirectories/comments/933pzm/all...>

[8]: <https://wiki.archiveteam.org/index.php/BitTorrent_DHT>

[9]: <https://btdig.com>

[10]: <https://interviewfor.red/en/starting.html>

[11]: <https://anidb.net/anime/7243#tab_main_4_1>

[12]: <https://myanimelist.net/anime/7785/Yojouhan_Shinwa_Taikei/us...>

[13]: <https://mydramalist.com/shows/top>

[14]: really cool video that tries to identify (probably successfully) the mysterious, seemingly non-existent lens the director claimed to have used - <https://www.youtube.com/watch?v=A2dq_7wu0Dw>

[15]: good comparisons of the WKW remasters - <https://youtu.be/OrvGqEdomLo?t=435>

[16]: <https://releases.moe>

[17]: <https://index.fansubcar.tel>

‎

(edit: sorry for the wall of text -- the U.S. Adderall shortage had left me unmedicated for the past two weeks, so I guess you can tell finally getting a refill has hit me like a truck!)

Oh my GOD. The 60 FPS 4K memescaling shouldn't drive me as insane as it does, but jesus christ, the amount of times I have wanted to show someone some opening, gone on YouTube, and literally everything is some tweened upscale.

I usually give up and end up having to go and StackOverflow the ffmpeg filters I'll never remember for burning in subs just to clip it myself -- `ffmpeg -i episode.mkv -vf "subtitles='episode.mkv':si=0" -c:v libx264 -preset slow -crf 18 -c:a aac_at -b:a 320k -ss start_duration -t opening_duration output.mp4` [1].

I think it bothers me even more given anime is rarely even natively fully 1080P 29.97/30 FPS, let alone 4K 60.

I try my best to live and let live, but it's my biggest pet peeve. It drives me nuts that basically all TV manufacturers do this too now by default -- everything I've purchased over the past ~10-12 years or so comes preset with """"smooth""" motion and a billion other video "correction" modes enabled, despite it just artifacting or making everything look straight up worse [2].

I'm genuinely really curious, does anyone here on HN use and enjoy those modes? Maybe there is something I'm missing.

Or maybe I'm just hyper-sensitive to that kind of thing. It made me laugh when I moved back to the US after school in Russia; family had gotten a new TV and within like seconds of being home and trying to watch a movie together, I'm immediately sitting there fiddling with the sittings, meanwhile no one else apparently even noticed the frame interpolation was on in the first place.

Anyway, sorry for the rant ;-)

‎

[1]: OK, this time it was from memory, so it might not quite be right. But maybe I've finally memorized the correct incantation?

[2]: good video on the topic - <https://www.youtube.com/watch?v=m1nUCyC8hGA>

I had already begun using my own domain for emails by the time it happened to me, but nothing accelerated that process faster than getting locked out of my Google account. I was lucky it wasn't permanent in my case, at least, but it was a wake up call that I really cannot trust them.

For me, it all happened because I tried to purchase, of all things, Minecraft from the Google Play store and typed my CVV in wrong a couple of times. That locked me out of my email and all Google services for about three days while they did some sort of fraud verification.

While, yes, things can happen to FastMail, etc, the likelihood of having my domain stolen from my registrar (which is very possible) is a lot lower than something happening to my Google account. And, god forbid it did happen, in my experience, getting in contact with a human at a domain registrar is easier than getting in contact with a human at Google.

Nix is pretty usable for both desktops and headless servers. Personally, I even use it on macOS without much trouble.

My system looks like any other install of Ventura, but all of my configuration, ranging from the terminal and VS Code to macOS-specific system preferences and Safari, is done declaratively in Nix [1]. The overwhelming majority of my installed software also comes from Nix packages, with some exceptions for stuff that is not packaged yet (e.g., I have Podman Desktop, the macOS ZFS port, Lulu, yubikey-manager-qt installed through Homebrew -- fortunately nix-darwin [2] also just lets me have an set of brews/casks in my config).

It was been a bit of a nightmare at first since the error messages are kind of horrific, and there can be a lack of good examples/docs on flakes. But I think the weekend worth of time I invested was worth it since I no longer need to rely on hacky shellscripts or remember to manually configure anything.

[1]: <https://github.com/nix-community/home-manager>

[2]: <https://github.com/LnL7/nix-darwin>

While crushing freedom of speech is obviously not okay, I find it strange to see this posted here. This post smells a lot like sinophobia. I do not want to assume malice; is there something I am missing, or is this literally just a Chinese individual who threatened someone for putting up fliers?

If the former, I think there needs to be some extra clarification. And if the latter, honestly, I find posts like this far more worrying from a societal standpoint than anything the accused has done.

One person does not represent an entire ethnicity or nationality. I am not aware of any literal epidemic of this sort of behavior happening, either. Strange people exist of all nationalities and ethnicities. As a Palestinian-American, if I posted similar things every time someone tried to silence dissent, it would be a full-time job.

On the other hand, I do see an alarming normalization of singling out China and Chinese people, treating them as if they are some hivemind. I find it very disturbing. There are real-world impacts of this sort of behavior, too.

When I was living in abroad during the initial peak of the pandemic, the irrational fear of all Chinese people led to incidents like the police coming to my house to question me about the whereabouts of my Chinese roommate, despite him having not left the country in multiple years. During that same period, people in the supermarket bullied one of my good Chinese friends out of the building, telling him they were afraid of catching COVID.

Has anything changed over the last six months or so regarding piracy, though?

The last thing I had paid attention to was the Russian government lifting the blocks on RuTracker, the most popular Russian-language torrent site, in reaction to the sanctions—to which RuTracker responded back by blocking Russia on their end [1].

But yeah, in that sense, it would seem that keeping people happy, having access to entertainment, scientific material, etc., and retaliation is more important than the ridiculous anti-LGBT laws right now. Maybe I'm wrong here, but I would think Russia does not pose a massive threat to Z-Lib and LibGen right now.

---

[1]: https://torrentfreak.com/rutracker-found-itself-unblocked-in...

Would definitely consider paying for it; I had licenses for self-hosted JIRA, BitBucket, etc, ages ago before Atlassian announced the end of everything except the datacenter plans, which are just super not necessary/absurdly expensive for a small team of <10 people. And despite really preferring FOSS, I can accept using a significantly better proprietary service, but only if it’s something I don’t have to rely on you to keep stable and don’t have to rely on you to keep my data secure.

I am not sure whether the reasoning is mostly from a concern over IP theft perspective or piracy, but I would consider looking into whether you think you could sustain a self-hosted version in the future.

I think legitimate competitors tend to be unwilling to take the risk reverse engineering things and directly stealing your product. And legitimate businesses also tend not to be willing to take the risk of being audited and getting caught using pirated software, …or, actually, maybe…. story on that later ;-) [1]

And I will probably lose you here, but I would also consider whether a FOSS model could work for you; there are a number of open-source/open-core/semi-opensource services that are seemingly viable commercial products. One example might be GitLab, and another would be Drone CI.

Perhaps consider whether you could survive, and potentially be even more profitable, by doing something like offering the platform as a self-hosted, opensource service, ideally under something like the AGPL, and then require contributors to dual-license their contributions under the AGPL and an incredibly permissive license (e.g., ISC, BSD of some sort, MIT, Unlicense, etc — pick whatever).

This model would allow you guys do opensource the core for the paranoid among us while also preventing any realistic competitors from swooping in and yoinking your hard work for their own financial gain, since they’d likely not be willing to integrate AGPL code into their service.

And by requiring contributions to be dual-licensed under an incredibly permissive license, this’d essentially grant you the same benefits of having contributions sign a properly evil CLA that demands all copyright be transferred to you, etc (e.g., an open-core like GitLab, where you could upsell people on proprietary enterprise features) without the need to drive away potential contributors by being extra evil.

I think this may not even be that awful of an idea, in the sense that:

- A. I think many proper companies that would be big spenders also would rather delegate all the responsibility to you

- B. while I don’t love opencore as opposed to truly fully FOSS, many do seem to be willing to pay

- C. Ultra-broke indie devs, hacker types, etc, many who likely would not pay in the first place, and many of whom may not be willing to use non-FOSS stuff would still be increasing your mindshare, potentially contributing back, etc — free advertising, essentially.

As an example, I cannot count how many times I have heard users of opensource BitWarden praise it everywhere they get a chance, to the point to where I finally caved and decided to give it a try in order to get my parents to stop forgetting their passwords to everything.

And when I did, I actually did not use the FOSS version, despite being the type personally who would have normally; I just didn’t want to add yet another thing I needed to potentially help other people maintain, so it was worth paying.

- D. Lastly, I think it is good PR and branding. Cloud services change all the time. It adds a nice bit of trust knowing that you can only screw up the service so badly before someone decides to just fork.

Don’t take this too harshly, please, because I actually do think the service looks really good, and I do admire and respect the fact such a small team put in the grind to manage to launch it. And I plan to go pay for the lifetime service once I finish up this message.

But that said, man, being truthful, there are a lot of tiny software startups that offer pretty, polished cloud applications, and there are a lot of tiny startups that initially offer “unlimited” plans and “lifetime” subscriptions.

Yet, maybe this is my overly cynical take, but here is what always happens:

- either you simply decide eventually that it’s not worth the money to retain these lifetime users anymore, so you tell tell them that their lifetime service isn’t really lifetime, or you end up taking VC money, because, realistically, it’s hard to say no, and then they make that same decision for you.

- someone uploads 10tb of data to the unlimited service and then my unlimited account is suddenly “unlimited” in the same sense that my unlimited phone is unlimited — I.e. it’s not unlimited; either there ends up being an fair usage policy that makes me wish I’d have just paid for a couple of terabytes directly, or someone decides to add annoying rate-limits to prevent abuse.

In that sense, as I look at the website, I see a lot of red flags. And I just hope they are not as red as they seem.

As I think we both know, lifetime unlimited is not sustainable, so as you’ve said, you guys have chosen this model for the time being in order to avoid VC funding.

If that is the case, then here’s to hoping that you do end up treating all of the early funders right: some people will absolutely upload 2, 3, 5, 10TB worth of content to their unlimited plan.

And yes it may suck paying to keep their stuff stored indefinitely despite no longer receiving money from them (cause it’s a lifetime payment). But I think that is a fair trade-off to avoid the things that do suck about VC funding.

As an example, while I’m aware that being selected for YC brings more than simply cash benefits, when we’re talking about exchanging 10% of the company for $100k, well, dang, I think YC gets a very good deal there when things go well (e.g., Dropbox, etc).

Similarly, if people are gonna dump the cost of a typical annual sub for Dropbox/whatever into your company that may not be around in a couple of years from now, then I would hope you reward them by deciding they are worth the $50-100 a year that it’ll cost to maintain some of them in the future.

(P.s. again, it is perhaps brutal criticism, and maybe it is a little overly cynical and unfair of me, but I don’t mean any harm by it — so pls don’t feel a little bummed out, or I will be a guilty baby)

[1]: except the one time a certain multi-billion dollar electronics company decided to launch their gaming computer brand, and proceeded to try and pirate the Steam OpenID integration for XenForo I was selling $15.00 one-off payment — and had gall to ask for support of all things!!