HNHacker News
TopNewBestAskShowJobs

phunge

278 karma · joined July 27, 2012

submissionscomments
phunge··on Introducing d3-scale
Here's a writeup on a few approaches: http://slides.com/shirleywu/deck#/
phunge··on BayesDB – a probabilistic programming platform
Have a look at DeepDive too: http://deepdive.stanford.edu/, this looks very similar at first glance. The approach of treating data integration&extraction as a statistical inference problem is IMHO a big idea on the rise.
phunge··on What PostgreSQL has over other open source SQL databases: Part II
I had the same sentiment. I eventually ditched the gui and went back to psql (the CLI) based on this advice: http://www.craigkerstiens.com/2013/02/13/How-I-Work-With-Pos...

The CLI is really really good for a CLI. Wagon is also good, my coworkers have been using it to pull data and like it a lot.

Overall love postgres, it's been 6 months (since starting a new job) and I'll never go back.

phunge··on Heroku is no longer the hobbyist's friend
+1 Convox is worth looking at. Fully open source, feature-rich and leverages AWS&Docker instead of reinventing the wheel.
phunge··on The Global Bike-Share Boom: An Interactive History
Timeline seems to be missing Vienna, which tried it as early as 2001 and had problems with theft. The second iteration (2004 or so?) was a great success.
phunge··on Three quick tips from two years with Celery
Celery works, that's been my experience. It's buggy, complicated, and we've had unresolved issues, but it more or less does the job.

The language for building workflows is pretty half-baked, and there have been times when I've wondered whether RQ or raw message passing would be better in my situation. But it's better than any of the alternatives that I've had direct experience with.

phunge··on DataLake
Did netflix actually call it a "data lake"? Great idea, terrible name IMHO :)
phunge··on DataLake
I've worked on such a system before and am a fan of the idea. First I've heard of the term Data Lake though.

The main benefit as I see is when data sources are external, with ill-defined or ambiguous schemas. Often when you fit data into an ETL pipeline, you find out issues at the output of the pipeline, but the fixes need to happen way upstream. Often this involves rebooting the entire process entirely and renormalizing all your data somehow.

If you delay interpretation and normalization to later in the processing pipeline (i.e. in the system I worked on, we did it lazily at interpretation time), then doing smarter things with the data is a matter of changing code -- and it's a lot easier to ship fixes to code than to ship fixes to data!

phunge··on Peak car
Matt Yglesias's recent article on how car commuting is actually on the rise in the US: http://www.vox.com/2015/4/29/8505097/car-commuting

Was surprised when I read that. He also ascribed some of the misperception to a young urban journalist echo chamber effect.

phunge··on Best Linux server backup system?
I've been using duplicity for a few years now and have been quite satisfied. It did seem slow when I first started using it. I learned to live with it; you run backups overnight anyways.

From what I can remember, a lot of the slowness came from GPG, and specifically files being compressed before encryption. Disabling compression speeds things up, but trades off disk space (and security).

I wonder what it'd take to reengineer the thing to take advantage of multicore -- being CPU-bound on a single core is I think what makes it slow.

phunge··on Algorithms Every Programmer Should Know: Reservoir Sampling
Indeed I've always thought this was a very cool algorithm.

I once had to extend it for a distributed setting (think mapreduce) where you can cheaply iterate all records but not sequentially. Instead you have multiple reservoirs, and you can't resample those uniformly since each saw a different number of records.

The unbiased way to aggregate 2 reservoirs is to draw a random number from a hypergeometric distribution. You aggregate a larger number by combining 2 at a time.

Fun story, an interviewer at Google once asked me to derive reservoir sampling a long time ago, which I completely wiffed.

phunge··on Turning the database inside-out with Apache Samza
Please do -- I've been reading the linkedin/confluent/samza writeups and thinking there's a lot of truth to their ideas. It'd be great to hear more on-the-ground experience from a different perspective.
phunge··on Debian Jessie on Raspberry Pi 2
Though OpenEmbedded is a fantastic tool with lots of recipes, lately I've been cooling off on the whole idea. IMHO, no embedded linux build is finished unless you have a way to update the device (for security issues etc). For OE: 1) it's too much work to rebuild everything when you want to pickup security updates 2) upstream doesn't generally update packages in a timely fashion 3) divergence between your recipes and upstream is a big problem 4) opkg isn't as full-fledged as dpkg/yum etc.

So lately, for my own projects, it's gotta be dpkg-based with an active upstream repo.

phunge··on Long term support considered harmful
I've held jobs at both ends of the spectrum, from bleeding-edge to death-by-legacy. There's a good deal of pain with both approaches, that's the reality. Would your org rather deal with security vulnerabilities and no upstream support, or deal with things blowing up once in a while?

What I like about this article is it's talking about what the global optimum is -- what's the best approach for the entire ecosystem? Not just for one individual or one org. What's Pareto optimal? (Or maybe it's a little less general -- what's the best approach for those who depend on FOSS, and don't pay someone like RedHat for long-term support and CYA insurance).

And basically I agree. The world's upgrade cycles could stand to be a whole lot shorter than they are. Every time I think about all the hardware in this world that'll spend its whole lifetime vulnerable to heartbleed, or shellshock, or a gazillion smaller vulns, my skin crawls.

phunge··on Hopefully the last post I'll ever write on Dual EC DRBG
This was some recent advice for SSH: https://stribika.github.io/2015/01/04/secure-secure-shell.ht...

It was on discussed on HN, at the time noone pointed out anything glaring about the advice given.

phunge··on Environment Variables Considered Harmful for Your Secrets
There's a not-widely-publicized feature of Linux that allows programs to store secrets directly in the kernel: https://www.kernel.org/doc/Documentation/security/keys.txt That has some advantages, including the guarantee that it can't be swapped to disk. Kerberos can use it for secret storage, I haven't seen it used elsewhere though.

It looks like process-private storage is one of its features.

phunge··on Environment Variables Considered Harmful for Your Secrets
There's a (not widely publicized) feature of Linux that enables secure key storage inside the kernel: https://www.kernel.org/doc/Documentation/security/keys.txt Storing keys in the kernel has some advantages -- your key will never get inadvertently swapped to disk etc.

It's been too long since I used it to remember the details, but I believe process-private keys are one of this API's features.

phunge··on C++11 std::unordered_set and map are slower than a naive implementation
Just posted this on the OP:

There's a big issue with the unordered_map.erase(const_iterator) method -- STL mandates that .erase() returns an iterator to the next item in the container. There's no simple implementation of that for hashtables other than to walk the hashtable, which is quite slow.

This was once a serious performance issue with unordered_map (discussion here: https://gcc.gnu.org/bugzilla/show_bug.cgi?id=41975). I haven't followed up in years, but is the issue?

phunge··on Writing a Phase-locked Loop in Straight C
PLLs are fascinating. Software PLLs are less fun than messing with the hardware, in my experience!

I started working on a software PLL recently -- not analog like this one, digital. Specifically, I was trying to work out the math on a fully event driven type-II PLL -- i.e. instead of updating at a fixed sampling rate, it'd wake only when an edge happened on the input or VCO. I was starting to get curious whether there's a solution for that somewhere on the web.

This is a good intro to (hardware) PLLs in general: https://www.youtube.com/watch?v=0jzLDe950AY followed by http://www.ece.tamu.edu/~spalermo/ecen620.html

phunge··on Rust means never having to close a socket
Props to Rust for tackling this head on, more languages should provide resource allocation that's deterministic, predictable and syntactically convenient.

CPython's behavior is nice, but it seems to me it came about by accident. Big heavy resources use refcounting because everything uses refcounting. Plus, if CPython had true concurrency, across-the-board refcounting probably wouldn't have lasted nearly as long (reason being: multithreaded refcounting requires atomic ops which make them much more expensive).

But in the general language design world, IMHO, refcounting is actually a pretty good compromise for resource management. Because:

1) The efficiency lost compared to Rust's approach is probably immaterial (since the Big Expensive Object that you're mananaging dwarfs the refcounting -- syscalls and file descriptors are expensive). So I don't think zero overhead is critical.

2) Cycles are pretty easy to avoid when you're only refcounting Big Expensive Objects (FDs, mmapped buffers, etc. etc.) For a general runtime, refcounting is tricky. But if it's a special part of the language that's small, simple, and only for resource management, it's pretty convenient. I think it's worlds better than the approach of mixing GC and resource management -- language designers should admit that's a terrible idea.

phunge··on History of Apache Storm and Lessons Learned
Also worth checking out http://radar.oreilly.com/2014/07/questioning-the-lambda-arch... from Jay Kreps, who's part of the Kafka braintrust.
phunge··on Shellshock DHCP Remote Code Execution – Proof of Concept
I'm guessing it calls system() which uses /bin/sh which is symlinked to /bin/dash on debian, not /bin/bash?
phunge··on Everything you need to know about the Shellshock Bash bug
Default apache log doesn't show the contents of HTTP headers I believe.
phunge··on Americans abroad are giving up their citizenship as banks shut down accounts
Might be the case! Here was my impression though (based on what I read after the fact):

The laws were always on the books but rarely enforced. Only once the UBS thing broke did the IRS start cracking down. Then the OVDI happened, which presumes guilt (ie intentionally evading taxes) from the get go. So based on the timing, I always thought things got to the point they are because of swiss bank accounts and tax evaders. And I thought penalties were structured the way they were so the IRS could throw the book at those guys when they were caught.

phunge··on Americans abroad are giving up their citizenship as banks shut down accounts
I was personally bit by this (FBAR non-compliance). I worked abroad and was unknowingly violating it; found out about it from reading the news and hired a pro to extricate myself from the situation.

The bank account held five figures. The cost to come into compliance was low five figures. The potential penalties were easily high six figures. It was much larger than the either (a) my total earnings from 4 years abroad or (b) the maximum amount the account had ever held. I believe my tax guy was on the cheap end too.

I'm still angry about it; I feel like I was guilty of nothing more than ignorance. IMHO this is case of strict policies that were intended for rich tax evaders. And they're being retargetted at millions of expats & foreign nationals.

phunge··on ShellShock exploited in the wild: kernel exploit with CnC component
Any CGI script which was written in bash, that's the worry. Since mod_cgi uses environment variables to pass along HTTP headers, those programs are sure to touch the environment.

Even if the CGI script is in some other language, think of how many .sh wrapper scripts there are out there.

EDIT: http://lcamtuf.blogspot.com/2014/09/quick-notes-about-bash-b... explains it better

phunge··on For Cinephiles, Netflix Is Less and Less an Option
Or a startup for peer-to-peer resale of used DVDs?

Though Amazon might've already locked that market up. Why rent when I can buy for $0.01 + $3.99 shipping?

phunge··on Tah: Open Source BLE Arduino-compatible Board
Also worth investigating for BLE: BLEduino, McThing. I keep a list, but haven't been checking back on those campaigns. Oh and Intel Edison too.
phunge··on String Deduplication – A new feature in Java 8 Update 20
Here's a counterargument for this, just to be a fuddy-duddy:

One of the key activities in programming is reasoning about time and space cost, and this is a space optimization that's nondeterministic. It kicks in sometimes, or sometimes not at all, and happens behind the scenes at garbage collection time when it's nearly invisible. If you're sloppy, your program may have a huge asymptotic space usage, and this may paper over it. But the impl has heuristics, it may not work all the time -- even their example program needed Thread.sleep() calls! Unpredictable semantics help nobody. So I always liked explicit string interning (whatup, Lisp!).

All the same, faster is better and I'm sure this makes things faster.

Oh and can we talk about how broken it was that Java 6 and under had a fixed size pool for .intern()'d strings?

phunge··on Let's Build a Traditional City and Make a Profit
Counterpoint: http://www.slate.com/blogs/the_eye/2013/12/10/why_cul_de_sac...
← PreviousPage 2 of 3Next →