While the entire world is beginning to learn about the power of the Bitcoin payment network, the real innovation behind this protocol is happening behind the scenes. There have been many different Bitcoin enthusiasts who have been talking about the holy grail of decentralized exchanges and using the Bitcoin protocol for more than just payments, and it seems that 2014 is going to be the year when we see these features finally get implemented into some real world applications. There are many different projects that are currently aiming to take Bitcoin to the next level, and it's likely that there won't be one clear winner when everything is said and done. Before we hop into the competition, let's take a closer look at exactly what these projects are trying to accomplish.

Decentralizing the Internet

Most people who learned about Bitcoin for the first time in 2013 look at it as nothing more than a currency, but the reality is that it's much more than that. At its core, Bitcoin is a new technology that allows everyone around the world to come to a consensus on who owns what without the use of a centralized third party. There are many different applications that can be built on top of this technology, and Bitcoin is only the first of many apps to come. When you forget about Bitcoin and just look at the technology, there are a large number of new possibilities that jump out at you. For example, if you can have a decentralized ledger that explains who owns which asset, then why do we need centralized stock exchanges? If we can have a global consensus on who owns which domain name or email address, then why do we need centralized versions of these services? If it's possible to create a global marketplace where buyers and sellers can find each other in a decentralized manner, then why do we need to use eBay? These are just a few of the possibilities that people are looking at right now when it comes to taking the technology behind Bitcoin and applying it to more than just payments.

Colored Coins

One of the first Bitcoin 2.0 platforms that was put into development was Colored Coins. They recently released the alpha version of their Chromawallet, and the developers behind this project expect to have a lighter version of the client released in a few weeks. So what will you be able to do with this specialized wallet? The main idea behind the Colored Coins project is that you will be able to apply secondary values to certain bitcoins on the Bitcoin blockchain. Those secondary values can then be used to create completely new digital currencies that are backed by real world assets. For example, let's say you own some gold at your house. You could hypothetically take 5 satoshis (0.00000005 BTC) and say that each one of those satoshis is equal to one gram of the gold that you hold in your home. You could then exchange those 5 satoshis backed by one gram of gold each on the decentralized exchange in the Chromawallet. This means that you could instantly exchange gold to bitcoins, dollars, euros, or any other user currency that is created in the Chromawallet. Another, and perhaps ever more exciting, example is creating stock in a company on the blockchain with Colored Coins. In this situation, you would take 1000 satoshis, or however many shares you want to create in your company, and say that those 1000 satoshis are now equal to one share of your new company. The Colored Coins project is a nice introduction to the kinds of features that will are going to see built on top of Bitcoin over the next few years.

Mastercoin

Mastercoin is a project that is somewhat similar to Colored Coins, but they are attempting to reach their goals in a different manner. The Mastercoin project was created in August of 2013 as a way to kickstart many of the features that are expected to be included in the Colored Coins project. The first mastercoins were created when early funders sent their bitcoins to a particular Bitcoin address. Their bitcoins were basically then converted to mastercoins and sent back to them. Mastercoin is a new protocol layer built on top of Bitcoin, so mastercoins are basically just small amounts of bitcoins that have certain characteristics. Some of the other exciting features being developed by Mastercoin include a decentralized betting exchange and using contracts for differences to create currencies that don't need to rely on a third party for physical backing. One thing that needs to be pointed out about the Mastercoin protocol is the mastercoins on that layer also have their own value separate from bitcoins. This means that Mastercoin is also an alt coin. There are some interesting features that are being added to the Mastercoin protocol, such as the ability to mark certain mastercoins in a savings account where payments can be reversed if they are made without the address holder's permission. The only real problem with Mastercoin is that it is going to be competing with Bitcoin. Although it is often stated that Mastercoin and Bitcoin are not direct competitors, the reality is that users will have to convert some of their bitcoins to mastercoins if they are going to be able to take advantage of many features of the Mastercoin protocol. If many of the features implemented on the Mastercoin protocol layer are also implemented directly on top of Bitcoin, then there really won't be any reason for people to switch from bitcoins over to mastercoins. There will actually still be an incentive to stick with Bitcoin if there are not major advantages of Mastercoin over Bitcoin because the price of bitcoins will likely be less volatile. The entire value of all the bitcoins in the world is currently hovering around $10 billion, while the value of all the mastercoins has dropped below $100 million. Liquidity is a huge factor when it comes to the viability of a currency, so it will be interesting to see if the advanced features of Mastercoin allow it to overcome the liquidity advantage of Bitcoin. Either way, the world is likely to benefit from the advanced features that are currently being implemented in the Mastercoin protocol. Mastercoin, much like Bitcoin, is a technology that is difficult to understand at first. The good news is that there a number of different videos on YouTube where Mastercoin Executive Director Ron Gross explains most of the important features of the protocol in various interviews and presentations from over the past few months.

Open Transactions

Open Transactions is a project that has been in development since before Bitcoin became a big deal. The lead developer behind the project, Chris Odom aka FellowTraveler, originally thought of the main idea behind Open Transactions with gold-backed digital currencies in mind. Once Bitcoin came along, it only made sense to integrate into OT. One of the main aims of the Open Transactions project is to decentralize the entire financial landscape by allowing anyone to issue currencies and various financial assets that are secured with cryptography. Anyone will be able to create digital tokens that represent real value on Open Transactions, but one of the most innovative features of this system is that the people who issue the digital tokens will not be able to alter the ledger for their currency or stock. For example, PayPal can technically go into their servers and change your account balance from $11,873.33 to $4,902.34 if they felt compelled to do that. This kind of action is impossible with assets issued through Open Transactions because of the way that the transactions are handled and signed. Of course, there is still the problem of having to trust that a third party who is backing their currency by gold, silver, dollars, or any other asset actually has the asset in a vault somewhere. The good news is that a solution for this problem has recently been found. In addition to issuing a currency, an issuer can also store collateral for the users of his or her currency in the form of bitcoins. For example, if there was a currency that was backed by one ounce of gold, then the issuer of that currency could send an ounce of gold's worth of bitcoins into an escrow account and agree to distribute those bitcoins to the holders of that particular currency in a situation where there is a "run on the bank". For more information on Open Transactions, I recommend this interview with Chris Odom and this panel on decentralized exchanges. You can also watch Odom's interview on Let's Talk Bitcoin where he talks about integrating Bitmessage into Open Transactions for transactions between different servers.

Protoshares

Much like Mastercoin, Protoshares is an altcoin that actually gets people excited because it offers something different than a simple clone of the Bitcoin blockchain. The idea behind Protoshares is that anyone who owns Protoshares will also get a stake in the decentralized autonomous corporations that are created by Invictus Innovations. Their first project, Bitshares, is basically their way of going after the problem of creating a decentralized exchange. Their solution is similar to the contracts for differences idea that Mastercoin is also implementing. Basically, various assets, such as BitUSD and BitGold will derive their value from two parties who own Bitshares and place long and short positions on that particular asset. You can find an explanation as to where BitAssets will get their value from bytemaster on the bitcointalk forum. Bytemaster, aka Daniel Larimer, is the CEO of Invictus Innovations. After BitShares is ready, Invictus will then begin to work on DomainShares and a number of other decentralized autonomous corporations that can replace some of the centralized online services that we use today.

Decentralized Autonomous Corporations

You may have noticed the term "decentralized autonomous corporation" being thrown around a few times in the section on Protoshares. What exactly is a decentralized autonomous corporation or DAC? A DAC is basically a way to use the blockchain technology behind Bitcoin to created a decentralized service. For example, Bitcoin is technically the first DAC ever created. There is no central authority that controls Bitcoin, and it keeps running without the need for some guys in a corporate office decide on what kinds of moves Bitcoin needs to make as a company. Namecoin is another example of a decentralized autonomous corporation, and it becomes much easier to understand this concept when you take a look at this altcoin. Namecoin is a decentralized service that allows you to register a .bit domain. They are also working on similar services for email and online identities. Namecoins are basically a commodity that allow you to purchase a .bit domain. This setup allows the original developers and early adopters of Namecoin to profit from their work. People who own namecoins also have an incentive to promote and build on top of Namecoin because it will help their namecoins increase in value. Without the profit motive, many of the decentralized services that we are going to see pop up in the coming years may not have been possible or viable over the long term. We will soon see many different DACs come about that will offer decentralized alternatives to services such as Facebook, Twitter, Gmail, online sportsbooks, voting booths, SSL, cloud storage, and much more.

So Who Will Win the Battle?

At the end of the day, the reality is that all of these Bitcoin 2.0 technologies are not really competing against each other. Open Transactions will allow people to trade protoshares, mastercoins, bitcoins, and everything else on their servers. Perhaps you will even be able to trade a protoshares-backed currency on top of Mastercoin for BitMastercoins one day. Humanity wins with the creation of all these new decentralized services and technologies, and we can all thank Satoshi Nakamoto for his, her, or their creation of the blockchain technology. In a few years, we could be talking about a situation where the entire Internet has been replaced with services that use the blockchain technology as the foundation of their development.

Image credit: Shutterstock

We all have things that we want to achieve in our lives -- getting into the better shape, building a successful business, raising a wonderful family, writing a best-selling book, winning a championship, and so on.

And for most of us, the path to those things starts by setting a specific and actionable goal. At least, this is how I approached my life until recently. I would set goals for classes I took, for weights that I wanted to lift in the gym, and for clients I wanted in my business.

What I'm starting to realize, however, is that when it comes to actually getting things done and making progress in the areas that are important to you, there is a much better way to do things.

It all comes down to the difference between goals and systems.

Let me explain.

The Difference Between Goals and Systems

What's the difference between goals and systems?

• If you're a coach, your goal is to win a championship. Your system is what your team does at practice each day.
• If you're a writer, your goal is to write a book. Your system is the writing schedule that you follow each week.
• If you're a runner, your goal is to run a marathon. Your system is your training schedule for the month.
• If you're an entrepreneur, your goal is to build a million dollar business. Your system is your sales and marketing process.

Now for the really interesting question:

If you completely ignored your goals and focused only on your system, would you still get results?

Related: How You Can Form Good Habits and Stick to Them

For example, if you were a basketball coach and you ignored your goal to win a championship and focused only on what your team does at practice each day, would you still get results?

I think you would.

As an example, I just added up the total word count for the articles I've written this year. (You can see them all here.) In the last 12 months, I've written over 115,000 words. The typical book is about 50,000 to 60,000 words, so I have basically written two books this year.

All of this is such a surprise because I never set a goal for my writing. I didn't measure my progress in relation to some benchmark. I never set a word count goal for any particular article. I never said, "I want to write two books this year."

What I did focus on was writing one article every Monday and Thursday. And after sticking to that schedule for 11 months, the result was 115,000 words. I focused on my system and the process of doing the work. In the end, I enjoyed the same (or perhaps better) results.

Let's talk about three more reasons why you should focus on systems instead of goals.

1. Goals reduce your current happiness.

When you're working toward a goal, you are essentially saying, "I'm not good enough yet, but I will be when I reach my goal."

The problem with this mindset is that you're teaching yourself to always put happiness and success off until the next milestone is achieved. "Once I reach my goal, then I'll be happy. Once I achieve my goal, then I'll be successful."

SOLUTION: Commit to a process, not a goal.

Choosing a goal puts a huge burden on your shoulders. Can you imagine if I had made it my goal to write two books this year? Just writing that sentence stresses me out.

But we do this to ourselves all the time. We place unnecessary stress on ourselves to lose weight or to succeed in business or to write a best-selling novel. Instead, you can keep things simple and reduce stress by focusing on the daily process and sticking to your schedule, rather than worrying about the big, life-changing goals.

When you focus on the practice instead of the performance, you can enjoy the present moment and improve at the same time.

2. Goals are strangely at odds with long-term progress.

You might think your goal will keep you motivated over the long-term, but that's not always true.

Consider someone training for a half-marathon. Many people will work hard for months, but as soon as they finish the race, they stop training. Their goal was to finish the half-marathon and now that they have completed it, that goal is no longer there to motivate them. When all of your hard work is focused on a particular goal, what is left to push you forward after you achieve it?

This can create a type of "yo-yo effect" where people go back and forth from working on a goal to not working on one. This type of cycle makes it difficult to build upon your progress for the long-term.

SOLUTION: Release the need for immediate results.

I was training at the gym last week and I was doing my second-to-last set of clean and jerks. When I hit that rep, I felt a small twinge in my leg. It wasn't painful or an injury, just a sign of fatigue near the end of my workout. For a minute or two, I thought about doing my final set. Then, I reminded myself that I plan to do this for the rest of my life and decided to call it a day.

Related: 8 Steps to Having Wildly Productive Mornings

In a situation like the one above, a goal-based mentality will tell you to finish the workout and reach your goal. After all, if you set a goal and you don't reach it, then you feel like a failure.

But with a systems-based mentality, I had no trouble moving on. Systems-based thinking is never about hitting a particular number, it's about sticking to the process and not missing workouts.

Of course, I know that if I never miss a workout, then I will lift bigger weights in the long-run. And that's why systems are more valuable than goals. Goals are about the short-term result. Systems are about the long-term process. In the end, process always wins.

3. Goals suggest that you can control things that you have no control over.

You can't predict the future. (I know, shocking.)

But every time we set a goal, we try to do it. We try to plan out where we will be and when we will make it there. We try to predict how quickly we can make progress, even though we have no idea what circumstances or situations will arise along the way.

SOLUTION: Build feedback loops.

Each Friday, I spend 15 minutes filling out a small spreadsheet with the most critical metrics for my business. For example, in one column I calculate the conversion rate (the percentage of website visitors that join my free email newsletter each week). I rarely think about this number, but checking that column each week provides a feedback loop that tells me if I'm doing things right. When that number drops, I know that I need to send high quality traffic to my site.

Feedback loops are important for building good systems because they allow you to keep track of many different pieces without feeling the pressure to predict what is going to happen with everything. Forget about predicting the future and build a system that can signal when you need to make adjustments.

Fall In Love With Systems

None of this is to say that goals are useless. However, I've found that goals are good for planning your progress and systems are good for actually making progress.

In fact, I think I'm going to officially declare 2014 the "Year of the Sloth" so that everyone will be forced to slow down and make consistent, methodical progress rather than chasing sexy goals for a few weeks and then flaming out.

Goals can provide direction and even push you forward in the short-term, but eventually a well-designed system will always win. Having a system is what matters. Committing to the process is what makes the difference.

A version of this article was first published on JamesClear.com.

The author is an Entrepreneur contributor. The opinions expressed are those of the writer.

Based in North Carolina, James Clear writes at JamesClear.com, where he uses behavior science to share ideas for mastering your habits, improving your health, and increasing your creativity. To receive his most popular articles, join his free weekly newsletter.

I hope I don’t get kicked out of Yale for this.

In January 2012, two Yale students named Harry Yu and Peter Xu built a replacement to Yale’s official course selection website. They it called YBB+ (Yale Bluebook Plus), a “plus” version of the Yale-owned site, called Yale Bluebook. YBB+ offered different functionality from the official site, allowing students to sort courses by average rating and workload. The official Yale Bluebook, rather, showed a visual graph of the distribution of student ratings as well as a list of written student reviews. YBB+ offered a more lightweight user interface and facilitated easier comparison of course statistics. Students loved it. A significant portion of the student body started using it.

Fast-forward two years. Last Friday (1/10/14), Yale blocked YBB+’s IP address on the school network without warning. When contacted, Yale said that YBB+ infringed upon Yale’s trademark. Harry and Peter quickly removed the Yale name from the site, rebranded it as CourseTable and relaunched. Yale blocked the website again, declaring the website to be malicious activity.

Later that weekend, Yale’s administration told the student developers that the school didn’t approve of the use of its course evaluation data, saying that their website “let students see the averaged evaluations far too easily”. Harry and Peter were told to remove the feature from the CourseTable website or else they would be referred to the school’s punishment committee.

On Tuesday, Harry and Peter published a blog post explaining Yale’s censorship policy and the Internet exploded. The post hit the front page of Reddit and the top of Hacker News. The Washington Post and Techcrunch covered the story. Around the world, commentators decried Yale’s censorship as a freedom of speech violation. The world waited as Yale’s administration was silent for three days.

Finally, Mary Miller, the Dean of Yale College, wrote an open letter to Yale on Friday night. In this letter, she defended Yale’s decision to censor Harry and Peter’s website and course rating functionality, stating: 

“[Yale’s course] evaluations… became available to students only in recent years and with the understanding that the information they made available to students would appear only as it currently appears on Yale’s sites — in its entirety.”

Worded less diplomatically, it appears the Dean of Yale College is expressing to students that, “You can use our course evaluation data, but only if you view the data as we tell you to view it”.

Before you get out your pitchforks, there is one more piece to this puzzle: Yale also told Harry and Peter that the CourseTable website infringed upon the school’s copyrighted course data. It appears to be true; CourseTable hosted Yale’s course descriptions and student evaluations, or, if not the exact evaluations, they at least hosted derivations of them.

This copyright assertion, however, reeks of hypocrisy and inconsistency. Yale Bluebook, the official course selection website, was originally a student-made websitethat used the same data as CourseTable. Apparently, the student creators of Yale Bluebook received a de facto license to use Yale’s copyrighted data when they designed their site in a manner that Dean Miller felt was “appropriate”.

Hypocrisy or not, Yale’s copyright assertion appears to be somewhat valid. Although one could argue that the CourseTable website constitutes transformative fair use, I’m told that Yale does have a copyright to its course descriptions. This is an unfortunate outcome, since Yale’s copyright assertion muddles the argument that Yale’s actions violate Peter and Harry’s freedom of speech.

The story does not end here, however, since there’s a way to distinguish the freedom of speech issue from the copyright claims. What if someone made a piece of software that displays Yale’s course evaluation data in a way that Yale disapproves of, while also (1) not infringing on Yale’s copyrights or trademarks, (2) not storing any sensitive data, (3) not scraping or collecting Yale’s data, and (4) not causing damages to Yale’s network or servers? If Yale censors this piece of software or punishes the software developer, it would clearly characterize Yale as an institution where having authority over students trumps freedom of speech.

Guess what? I made it last night.

I built a Chrome Extension called Banned Bluebook. It modifies the Chrome browser to add CourseTable’s functionality to Yale’s official course selection website, showing the course’s average rating and workload next to each search result. It also allows students to sort these courses by rating and workload. This is the original site, and this is the site with Banned Bluebook enabled (this demo uses randomly generated rating values).

Banned Bluebook never stores data on any servers. It never talks to any non-Yale servers. Moreover, since my software is smarter at caching data locally than the official Yale course website, I expect that students using this extension will consume less bandwidth over time than students without it. Don’t believe me? You can read the source code. No data ever leaves Yale’s control. Trademarks, copyright infringement, and data security are non-issues. It’s 100% kosher.

My intent behind Banned Bluebook is to demonstrate two points to Dean Miller and the Yale administration:

• If Yale grants students access to data, the university does not have the right to specify exactly how students must view the data.
• Censorship through IP blocking and Deep Packet Inspection is not only unethical, it’s also futile.

Dean Miller, I humbly request that you, on behalf of Yale, either uphold or deny students’ right, under school policy, to build software like Banned Bluebook.

If Yale affirms this right, I’d like you to publicly apologize for the events that have transpired over the last week, including Yale’s censorship of CourseTable and the pattern of hypocrisy we’ve seen in Yale’s copyright enforcement of course data.

If Yale denies this right, I’ll see you at the punishment committee.

Report a mistake in the video

At 2:33, Sal said "single bonds" but meant "covalent bonds."

Report a mistake in the video

Discuss the site

For general discussions about Khan Academy, visit our Reddit discussion page.

Flag inappropriate posts

Here are posts to avoid making. If you do encounter them, flag them for attention from our Guardians.

abuse

• disrespectful or offensive
• an advertisement

not helpful

• low quality
• not about the video topic
• soliciting votes or seeking badges
• a homework question
• a duplicate answer
• repeatedly making the same post

wrong category

• a tip or thanks in Questions
• a question in Tips & Thanks
• an answer that should be its own question

about the site

• a question about Khan Academy
• a post about badges
• a technical problem with the site
• a request for videos or features

Anyone who knows me will tell you that I don’t exactly have great fashion sense. I don’t wear bespoke suits. Our house is not “exquisitely decorated”, or “tastefully appointed”. I focus more on the practical than the aesthetic. That said, when I started this blog, I knew I couldn’t leave it looking like every other Octopress blog (you know, like this).

Easy tweaks

I started (and finished) with the low-hanging fruit — colors and fonts.

The color scheme was easy — only the best color scheme ever, Solarized. My iTerm is Solarized dark, my graphical Vim is Solarized light, let’s keep this train a-rollin’.

I quickly found two great fonts:Montserrat (headings) and Varela Round (body). Both are available on Google Web Fonts via the SIL Open Font License — what’s not to love?

The problem

As it turns out, the answer is “Google Chrome on Windows”, especially with Google Web Fonts. For whatever reason, Chrome (only on Windows) doesn’t render TTF or WOFF fonts well. Click the image below for a more detailed view:

This is especially frustrating because Google Web Fonts prioritizes TTF and WOFF fonts over others (they are listed earlier in the @font-face rule). If you use Google Web Fonts, you just load their CSS into your page, so there’s no way to change the order.

The solution

Now, if you host your own fonts, or you can at least control your CSS, there is a fix. Chrome will render SVG fonts acceptably, so you just need to get Chrome to load the SVG font. You can do this in one of two ways. You can simply place the SVG earlier in the @font-face rule:

Or you can create a separate @font-face rule that applies to Chrome only:

It seems like the second method (Chrome-specific media query) is more widely accepted, and it should (in theory) work with Google Web Fonts, although you’ll obviously need to host the SVG file yourself.

Notes

These links were very helpful in solving this issue: Fontspring, Adtrak
It looks like this will be fixed sometime in the next six months! Chromium issue #137692

As a developer, I sometimes forget the power I wield. It's easy to forget that, when something doesn't work the way I'd like, I have the power to change it. Yesterday, I was reminded of this fact as I finally got fed up with the way payments are processed for my book. After being unhappy with the three different digital-goods payment processors I've used since the book came out, I took two hours and wrote my own solution using Python and Flask. That's right. Two hours. It's now powering my book payment processing and the flow is so incredibly simple that you can buy the book and begin reading it in 20 seconds.

Read on to find out how I created my own digital goods payment solution in an evening.

When I began selling the book, I used a combination of two services (one for credit cards and another for PayPal). Eventually, I found a single processor capable of supporting both. I've never been happy, though, with any of them. The most recent processor required users to create an account on the merchant's system and enter their mailing address (though there was no use for it).

Additionally, I've had a terrible time trying to get Google Analytics to properly track visitor flow through the entire visit, including the checkout process. I always sensed that, if I were able to get that working and run A/B tests on my book page, I could greatly increase sales. Without proper tracking however, I was out of luck.

Lastly, sending out book updates is terribly time-consuming using three different processors. None supported updates well, and I wanted a one-click solution to sending out book updates. Finding a service that supported that was basically impossible.

After receiving an email from a customer yesterday about how difficult the payment process was and informing me that I'm likely losing sales because of it, I got fed up. I decided to roll my own digital goods management solution. It needed the following work-flow:

Clearly, it's not that complicated. The trickiest part would be dynamically generating a unique URL that linked to the proper version of the book. Everything else seemed straightforward.

Spoiler alert: the resulting application is exactly 100 lines of code. Flask is a great choice for a web application of this size. It doesn't require a ton of boilerplate (cough like Django cough) but has good plugin support. Bottle would have been another fine choice, but I've used Flask more recently, so that's what I chose.

To begin, I needed to decide how I was going to store the customer and purchase information. I decided to use SQLAlchemy, since I've got a lot of experience with it because ofsandman. Flask has a plugin, Flask-SQLAlchemy, that makes using the two together easy. Since I don't need anything too fancy database-wise, I chose SQLite as my database back-end.

Having made these decisions, I created a file named app.py and created the following models:

classProduct(db.Model):__tablename__='product'id=db.Column(db.Integer,primary_key=True)name=db.Column(db.String)file_name=db.Column(db.String)version=db.Column(db.String)is_active=db.Column(db.Boolean,default=True)price=db.Column(db.Float)classPurchase(db.Model):__tablename__='purchase'uuid=db.Column(db.String,primary_key=True)email=db.Column(db.String)product_id=db.Column(db.Integer,db.ForeignKey('product.id'))product=db.relationship(Product)downloads_left=db.Column(db.Integer,default=5)

After adding the five different versions of the book to the database (I created a populate_db.py file and added them as SQLAlchemy models), I needed to decide how I was going to actually process payments. Luckily,Stripe makes accepting credit card payments stupidly easy, and I already had an account with them. Their "checkout.js" solution creates a form and button on your page. When the button is clicked, a simple and attractive payment overlay is displayed.

The action attribute of the form points to the page on your site that the user should be taken to after a successful payment. I added 5 of these buttons to my book sales site and added another hidden form field to contain the product_id (an integer between 1 and 5) of the product that was purchased.

Processing Payments

Clearly, I needed an endpoint in my application to process a successfully charged card. I added the following function to do so:

@app.route('/buy',methods=['POST'])defbuy():stripe_token=request.form['stripeToken']email=request.form['stripeEmail']product_id=request.form['product_id']product=Product.query.get(product_id)try:charge=stripe.Charge.create(amount=int(product.price*100),currency='usd',card=stripe_token,description=email)exceptstripe.CardError,e:return"""<html><body><h1>Card Declined</h1><p>Your chard could not be charged. Please check the number and/or contact your credit card company.</p></body></html>"""printchargepurchase=Purchase(uuid=str(uuid.uuid4()),email=email,product=product)db.session.add(purchase)db.session.commit()message=Message(subject='Thanks for your purchase!',sender="jeff@jeffknupp.com",html="""<html><body><h1>Thanks for buying Writing Idiomatic Python!</h1><p>If you didn't already download your copy, you can visit <a href="http://buy.jeffknupp.com/{}">your private link</a>. You'll be able todownload the file up to five times, at which point the link willexpire.""".format(purchase.uuid),recipients=[email])withmail.connect()asconn:conn.send(message)returnredirect('/{}'.format(purchase.uuid))

As you can see, I took a few shortcuts with the code (since I was coding angrily...). First, I have inline HTML to be returned from an unsuccessful charge and for the email that is sent upon purchase. That should be extracted to a global variable or, better, contained in a separate file. Second, I didn't do any error checking when creating the Purchase object. But really, the only thing that could go wrong is trying to insert a duplicate uuid, which doesn't concern me due to the probability of it happening (read: vanishingly small).

You can see I'm using a mail object. This comes from the Flask-Mail package, which makes sending email painless. I simply set it up to use GMail as the mail server and everything Just Worked.

OK, Now Give Me The Book

Now that I had the payment portion sorted out, I needed to add an endpoint for initiating downloads after a purchase. Since I'm using UUIDs as a primary key, I can also use them as the URL for the download endpoint. When someone hits the endpoint, I simply need to check that the UUID contained in the URL matches the UUID of a purchase in the database. If it does, serve the book file and decrement the downloads_left attribute. If not, return a 404 error. Here's the code I came up with:

@app.route('/<uuid>')defdownload_file(uuid):purchase=Purchase.query.get(uuid)ifpurchase:ifpurchase.downloads_left<=0:return"""<html><body><h1>No downloads left!</h1><p>You have exceeded the allowed number of downloads for this file. Please email jeff@jeffknupp.com with any questions.</p></body></html>"""purchase.downloads_left-=1db.session.commit()returnsend_from_directory(directory='files',filename=purchase.product.file_name,as_attachment=True)else:abort(404)

Very straightforward. Using the UUID as a URL variable, search for a purchase. If it exists, just check that there are still downloads left and serve the file attribute of the purchase's product. Otherwise, here's a 404 for you.

Lastly, I needed to add a test endpoint that would allow me to simulate the purchase process. Here's the code for that endpoint and the portion that runs the app:

@app.route('/test')deftest():return"""<http><body><form action="buy" method="POST"><script src="https://checkout.stripe.com/checkout.js" class="stripe-button" data-key="pk_test_w3qNBkDR8A4jkKejBmsMdH34" data-amount="999" data-name="jeffknupp.com" data-description="Writing Idiomatic Python 3 PDF ($9.99)"></script><input type="hidden" name="product_id" value="2" /></form></body></html>"""if__name__=='__main__':sys.exit(app.run(debug=True))

I was actually surprised at how quickly and easily I got this working. The entire application is a single file containing 100 lines of code. And it replaces a very important service I use everyday, one with which I've never been happy. Finally, I can track purchases without issue, which I'm convinced will increase sales.

It's nice to be reminded that, as developers, we have a lot of power to shape our interactions with the digital world. I, for one, often forget that if I don't like the way some piece of technology works, I can change it. From automating mechanical tasks like data entry to automatically sorting and organizing email, developers have the power to simplify their everyday tasks.

Having libraries like Flask in your tool belt is crucial to solving these sorts of problems, though. As you progress as a developer, you should be building up a set of tools that work for "core" problem domains. Flask is a perfect example, since needing to throw together a web app is a common problem.

And of course, sharing what you made is critical as well. I would be remiss if I created something useful for myself and didn't share it with others. "Sharing" means more than "putting in a public GitHub repo". You also need to let people know about it. From mailing lists to forums to personal blogs, there's no shortage of avenues for making others aware of what you've created. I always try to give back to the community, since I've gained so much from it.

« How to Become "Internet Famous"

Feedly announced their new URL shortening service this week, and it turns out that they are much more subtle scoundrels than I expected.

Not only is this new service opt-out, it also siphons away page views from mobile visitors.

This URL shortener service is the same one which Feedly was caught using to hijack links and steal page views back in December (that was during the beta test). Feedly stopped hijacking links after being criticized from all sides, but they didn’t change their behavior. Rather than try not to harm publishers, Feedly found a more subtle way to steal page views and make it difficult for publishers to engage with readers.

It’s so subtle that I missed it, but luckily a reader (Thanks, Alan!) tipped me to a blog post by Martin Hawksey.

Martin wrote his post with a focus on how Feedly is inserting its own twitter metadata in place of the metadata that original publishers can include with links shared on Twitter, but he also posted a couple screen shots which make it quite clear that Feedly is harming publishers in more ways than simply messing with the metadata.

The 2 screen shots below were taken from the Twitter app on an Android smartphone. They show two different tweets which link to the same content. The screenshot on the left shows a tweet that was shared from the original publisher’s website, while the screenshot on the right shows a tweet that was shared from inside Feedly.

Can you see the differences?

I can see a couple key differences, and both are hostile to publishers.

One, Feedly is slapping their brand on someone else’s content, and two, they’re actively discouraging mobile users from visiting the original publisher’s website.

In the screenshot on the left you can see that the inset text lists the author as Doug Belshaw. In the screenshot on the right, Feedly wants you to think that they are the author. In other words they slapped their brand on work they did not create. They want people to think of them as the source of the content, probably in the hopes that this will boost Feedly’s profile and its userbase. And to make matters worse they are pulling this trick both on the Twitter website and in the Twitter apps.

Next, look at the button down below the text. In the screenshot on the left you see a button with the words “View on web”, while on the right you see a prompt to open Feedly’s app. (If you don’t have the app installed the prompt will suggest that you install it.)

The prompt to use/install the Feedly app is not visible when you visit the Twitter website, only when you visit via a mobile app.

This might seem like a small issue, but as of October 2013 Twitter reported that 75% of their 218 million users use the service via a mobile app. That means that Feedly has set itself up to steal most of the page views that a publisher could have gained when an article is shared via Twitter.

Feedly is depriving creators of recognition, and they are also stealing page views.

And to make matters worse, I have confirmed that this URL shortener is enabled by default. That means that Feedly users need to go to the Preference menu to disable the URL shortener or they will be inadvertent accomplices to Feedly’s theft of page views.

Feedly is a big fan of opting out. In fact, Feedly CEO Edwin Khodabakchian showed up in the comments for that post last month and defended his company with a justification which is going to sound just as bad to day as it did a month ago:

He thinks it is perfectly okay to expect publishers to opt out of being punched in the wallet.

I really don’t know what to say to that.

The Peelian principles describe the philosophy that Sir Robert Peel developed to define an ethicalpolice force. This philosophy is commonly known as policing by consent in the United Kingdom and other countries such as Canada, Australia and New Zealand.[1][2][3][4]

In the British model of policing, police officers are citizens in uniform. They exercise their powers to police their fellow citizens with the implicit consent of their fellow citizens. Policing by consent is the phrase used to describe this. It denotes that the legitimacy of policing in the eyes of the public is based upon a general consensus of support that follows from transparency about their powers, demonstrating integrity in exercising those powers and their accountability for doing so.[5]

Context[edit]

In early 19th century Britain, attempts by the government to set up a police force for London met with a lot of opposition:[6]

• People were suspicious of the idea of a large police force, possibly armed. They feared it could be used to suppress protest or support unpopular rule.
• Paris had the best-known, best-organised, paid police force. Britain was at war with France from 1793 to 1815, so many people disliked the idea because of the association with France.
• People did not think it was the job of the government to set up and control a police force; they thought it should be under local control.

The concept of professional policing was taken up by Robert Peel when he became Home Secretary in 1822. Peel's Metropolitan Police Act 1829 established a full-time, professional and centrally-organised police force for the greater London area known as the Metropolitan Police.[7]

Peelian principles[edit]

The principles traditionally ascribed to Peel state that:[citation needed]

• Every police officer should be issued an identification number, to assure accountability for his actions.
• Whether the police are effective is not measured on the number of arrests, but on the lack of crime.
• Above all else, an effective authority figure knows trust and accountability are paramount. Hence, Peel's most often quoted principle that "The police are the public and the public are the police."

The nine principles of policing[edit]

The following nine principles were set out in the ‘General Instructions’ issued to every new police officer in the Metropolitan Police from 1829.[1][8] Although Peel discussed the spirit of some of these principles in his speeches and other communications, researchers Lentz and Chaires found no proof that he ever actually compiled a formal list.[9] It has been suggested this list was more likely authored by Charles Rowan and Richard Mayne, the first and joint Commissioners of the Metropolitan Police.[1][8]

Policing by consent[edit]

As explained by the notable police historian Charles Reith in his ‘New Study of Police History' in 1956,[10] this was a philosophy of policing "unique in history and throughout the world because it derived not from fear but almost exclusively from public co-operation with the police, induced by them designedly by behaviour which secures and maintains for them the approval, respect and affection of the public". This gave rise to the philosophy of British policing known as 'policing by consent'.[1][8]

It should be noted that it refers to the power of the police coming from the common consent of the public, as opposed to the power of the state. It does not mean the consent of an individual. No individual can chose to withdraw his or her consent from the police, or from a law.[1]

References[edit]

Marketing Options

As a reseller, you sell in your own way. With the Namecheap Affiliate Program, you earn commission every time you refer someone to us. Or you can connect to our system via the Namecheap API and sell our products directly from your own site.

Wide Selection

Add value to your product line by reselling any product Namecheap offers. We have a huge selection available: Hosting packages, SSL certificates, new domains, domain transfers, WhoisGuard privacy protection and lots more.

Long-Term Support

We support resellers with some powerful tools: A full-featured control panel, wholesale pricing, dedicated Affiliate Program experts, even marketing consultation. All you have to do is ask. Contact our 24/7 support team for more info.

May 2008

Great cities attract ambitious people. You can sense it when you walk around one. In a hundred subtle ways, the city sends you a message: you could do more; you should try harder.

The surprising thing is how different these messages can be. New York tells you, above all: you should make more money. There are other messages too, of course. You should be hipper. You should be better looking. But the clearest message is that you should be richer.

What I like about Boston (or rather Cambridge) is that the message there is: you should be smarter. You really should get around to reading all those books you've been meaning to.

When you ask what message a city sends, you sometimes get surprising answers. As much as they respect brains in Silicon Valley, the message the Valley sends is: you should be more powerful.

That's not quite the same message New York sends. Power matters in New York too of course, but New York is pretty impressed by a billion dollars even if you merely inherited it. In Silicon Valley no one would care except a few real estate agents. What matters in Silicon Valley is how much effect you have on the world. The reason people there care about Larry and Sergey is not their wealth but the fact that they control Google, which affects practically everyone.

How much does it matter what message a city sends? Empirically, the answer seems to be: a lot. You might think that if you had enough strength of mind to do great things, you'd be able to transcend your environment. Where you live should make at most a couple percent difference. But if you look at the historical evidence, it seems to matter more than that. Most people who did great things were clumped together in a few places where that sort of thing was done at the time.

You can see how powerful cities are from something I wrote aboutearlier: the case of the Milanese Leonardo. Practically every fifteenth century Italian painter you've heard of was from Florence, even though Milan was just as big. People in Florence weren't genetically different, so you have to assume there was someone born in Milan with as much natural ability as Leonardo. What happened to him?

If even someone with the same natural ability as Leonardo couldn't beat the force of environment, do you suppose you can?

I don't. I'm fairly stubborn, but I wouldn't try to fight this force. I'd rather use it. So I've thought a lot about where to live.

I'd always imagined Berkeley would be the ideal place—that it would basically be Cambridge with good weather. But when I finally tried living there a couple years ago, it turned out not to be. The message Berkeley sends is: you should live better. Life in Berkeley is very civilized. It's probably the place in America where someone from Northern Europe would feel most at home. But it's not humming with ambition.

In retrospect it shouldn't have been surprising that a place so pleasant would attract people interested above all in quality of life. Cambridge with good weather, it turns out, is not Cambridge. The people you find in Cambridge are not there by accident. You have to make sacrifices to live there. It's expensive and somewhat grubby, and the weather's often bad. So the kind of people you find in Cambridge are the kind of people who want to live where the smartest people are, even if that means living in an expensive, grubby place with bad weather.

As of this writing, Cambridge seems to be the intellectual capital of the world. I realize that seems a preposterous claim. What makes it true is that it's more preposterous to claim about anywhere else. American universities currently seem to be the best, judging from the flow of ambitious students. And what US city has a stronger claim? New York? A fair number of smart people, but diluted by a much larger number of neanderthals in suits. The Bay Area has a lot of smart people too, but again, diluted; there are two great universities, but they're far apart. Harvard and MIT are practically adjacent by West Coast standards, and they're surrounded by about 20 other colleges and universities.[1]

Cambridge as a result feels like a town whose main industry is ideas, while New York's is finance and Silicon Valley's is startups.

When you talk about cities in the sense we are, what you're really talking about is collections of people. For a long time cities were the only large collections of people, so you could use the two ideas interchangeably. But we can see how much things are changing from the examples I've mentioned. New York is a classic great city. But Cambridge is just part of a city, and Silicon Valley is not even that. (San Jose is not, as it sometimes claims, the capital of Silicon Valley. It's just 178 square miles at one end of it.)

Maybe the Internet will change things further. Maybe one day the most important community you belong to will be a virtual one, and it won't matter where you live physically. But I wouldn't bet on it. The physical world is very high bandwidth, and some of the ways cities send you messages are quite subtle.

One of the exhilarating things about coming back to Cambridge every spring is walking through the streets at dusk, when you can see into the houses. When you walk through Palo Alto in the evening, you see nothing but the blue glow of TVs. In Cambridge you see shelves full of promising-looking books. Palo Alto was probably much like Cambridge in 1960, but you'd never guess now that there was a university nearby. Now it's just one of the richer neighborhoods in Silicon Valley. [2]

A city speaks to you mostly by accident—in things you see through windows, in conversations you overhear. It's not something you have to seek out, but something you can't turn off. One of the occupational hazards of living in Cambridge is overhearing the conversations of people who use interrogative intonation in declarative sentences. But on average I'll take Cambridge conversations over New York or Silicon Valley ones.

A friend who moved to Silicon Valley in the late 90s said the worst thing about living there was the low quality of the eavesdropping. At the time I thought she was being deliberately eccentric. Sure, it can be interesting to eavesdrop on people, but is good quality eavesdropping so important that it would affect where you chose to live? Now I understand what she meant. The conversations you overhear tell you what sort of people you're among.

No matter how determined you are, it's hard not to be influenced by the people around you. It's not so much that you do whatever a city expects of you, but that you get discouraged when no one around you cares about the same things you do.

There's an imbalance between encouragement and discouragement like that between gaining and losing money. Most people overvalue negative amounts of money: they'll work much harder to avoid losing a dollar than to gain one. Similarly, though there are plenty of people strong enough to resist doing something just because that's what one is supposed to do where they happen to be, there are few strong enough to keep working on something no one around them cares about.

Because ambitions are to some extent incompatible and admiration is a zero-sum game, each city tends to focus on one type of ambition. The reason Cambridge is the intellectual capital is not just that there's a concentration of smart people there, but that there's nothing else people there care about more. Professors in New York and the Bay area are second class citizens—till they start hedge funds or startups respectively.

This suggests an answer to a question people in New York have wondered about since the Bubble: whether New York could grow into a startup hub to rival Silicon Valley. One reason that's unlikely is that someone starting a startup in New York would feel like a second class citizen. [3] There's already something else people in New York admire more.

In the long term, that could be a bad thing for New York. The power of an important new technology does eventually convert to money. So by caring more about money and less about power than Silicon Valley, New York is recognizing the same thing, but slower.[4] And in fact it has been losing to Silicon Valley at its own game: the ratio of New York to California residents in the Forbes 400 has decreased from 1.45 (81:56) when the list was first published in 1982 to .83 (73:88) in 2007.

Not all cities send a message. Only those that are centers for some type of ambition do. And it can be hard to tell exactly what message a city sends without living there. I understand the messages of New York, Cambridge, and Silicon Valley because I've lived for several years in each of them. DC and LA seem to send messages too, but I haven't spent long enough in either to say for sure what they are.

The big thing in LA seems to be fame. There's an A List of people who are most in demand right now, and what's most admired is to be on it, or friends with those who are. Beneath that the message is much like New York's, though perhaps with more emphasis on physical attractiveness.

In DC the message seems to be that the most important thing is who you know. You want to be an insider. In practice this seems to work much as in LA. There's an A List and you want to be on it or close to those who are. The only difference is how the A List is selected. And even that is not that different.

At the moment, San Francisco's message seems to be the same as Berkeley's: you should live better. But this will change if enough startups choose SF over the Valley. During the Bubble that was a predictor of failure—a self-indulgent choice, like buying expensive office furniture. Even now I'm suspicious when startups choose SF. But if enough good ones do, it stops being a self-indulgent choice, because the center of gravity of Silicon Valley will shift there.

I haven't found anything like Cambridge for intellectual ambition. Oxford and Cambridge (England) feel like Ithaca or Hanover: the message is there, but not as strong.

Paris was once a great intellectual center. If you went there in 1300, it might have sent the message Cambridge does now. But I tried living there for a bit last year, and the ambitions of the inhabitants are not intellectual ones. The message Paris sends now is: do things with style. I liked that, actually. Paris is the only city I've lived in where people genuinely cared about art. In America only a few rich people buy original art, and even the more sophisticated ones rarely get past judging it by the brand name of the artist. But looking through windows at dusk in Paris you can see that people there actually care what paintings look like. Visually, Paris has the best eavesdropping I know. [5]

There's one more message I've heard from cities: in London you can still (barely) hear the message that one should be more aristocratic. If you listen for it you can also hear it in Paris, New York, and Boston. But this message is everywhere very faint. It would have been strong 100 years ago, but now I probably wouldn't have picked it up at all if I hadn't deliberately tuned in to that wavelength to see if there was any signal left.

So far the complete list of messages I've picked up from cities is: wealth, style, hipness, physical attractiveness, fame, political power, economic power, intelligence, social class, and quality of life.

My immediate reaction to this list is that it makes me slightly queasy. I'd always considered ambition a good thing, but I realize now that was because I'd always implicitly understood it to mean ambition in the areas I cared about. When you list everything ambitious people are ambitious about, it's not so pretty.

On closer examination I see a couple things on the list that are surprising in the light of history. For example, physical attractiveness wouldn't have been there 100 years ago (though it might have been 2400 years ago). It has always mattered for women, but in the late twentieth century it seems to have started to matter for men as well. I'm not sure why—probably some combination of the increasing power of women, the increasing influence of actors as models, and the fact that so many people work in offices now: you can't show off by wearing clothes too fancy to wear in a factory, so you have to show off with your body instead.

Hipness is another thing you wouldn't have seen on the list 100 years ago. Or wouldn't you? What it means is to know what's what. So maybe it has simply replaced the component of social class that consisted of being "au fait." That could explain why hipness seems particularly admired in London: it's version 2 of the traditional English delight in obscure codes that only insiders understand.

Economic power would have been on the list 100 years ago, but what we mean by it is changing. It used to mean the control of vast human and material resources. But increasingly it means the ability to direct the course of technology, and some of the people in a position to do that are not even rich—leaders of important open source projects, for example. The Captains of Industry of times past had laboratories full of clever people cooking up new technologies for them. The new breed are themselves those people.

As this force gets more attention, another is dropping off the list: social class. I think the two changes are related. Economic power, wealth, and social class are just names for the same thing at different stages in its life: economic power converts to wealth, and wealth to social class. So the focus of admiration is simply shifting upstream.

Does anyone who wants to do great work have to live in a great city? No; all great cities inspire some sort of ambition, but they aren't the only places that do. For some kinds of work, all you need is a handful of talented colleagues.

What cities provide is an audience, and a funnel for peers. These aren't so critical in something like math or physics, where no audience matters except your peers, and judging ability is sufficiently straightforward that hiring and admissions committees can do it reliably. In a field like math or physics all you need is a department with the right colleagues in it. It could be anywhere—in Los Alamos, New Mexico, for example.

It's in fields like the arts or writing or technology that the larger environment matters. In these the best practitioners aren't conveniently collected in a few top university departments and research labs—partly because talent is harder to judge, and partly because people pay for these things, so one doesn't need to rely on teaching or research funding to support oneself. It's in these more chaotic fields that it helps most to be in a great city: you need the encouragement of feeling that people around you care about the kind of work you do, and since you have to find peers for yourself, you need the much larger intake mechanism of a great city.

You don't have to live in a great city your whole life to benefit from it. The critical years seem to be the early and middle ones of your career. Clearly you don't have to grow up in a great city. Nor does it seem to matter if you go to college in one. To most college students a world of a few thousand people seems big enough. Plus in college you don't yet have to face the hardest kind of work—discovering new problems to solve.

It's when you move on to the next and much harder step that it helps most to be in a place where you can find peers and encouragement. You seem to be able to leave, if you want, once you've found both. The Impressionists show the typical pattern: they were born all over France (Pissarro was born in the Carribbean) and died all over France, but what defined them were the years they spent together in Paris.

Unless you're sure what you want to do and where the leading center for it is, your best bet is probably to try living in several places when you're young. You can never tell what message a city sends till you live there, or even whether it still sends one. Often your information will be wrong: I tried living in Florence when I was 25, thinking it would be an art center, but it turned out I was 450 years too late.

Even when a city is still a live center of ambition, you won't know for sure whether its message will resonate with you till you hear it. When I moved to New York, I was very excited at first. It's an exciting place. So it took me quite a while to realize I just wasn't like the people there. I kept searching for the Cambridge of New York. It turned out it was way, way uptown: an hour uptown by air.

Some people know at 16 what sort of work they're going to do, but in most ambitious kids, ambition seems to precede anything specific to be ambitious about. They know they want to do something great. They just haven't decided yet whether they're going to be a rock star or a brain surgeon. There's nothing wrong with that. But it means if you have this most common type of ambition, you'll probably have to figure out where to live by trial and error. You'll probably have to find the city where you feel at home to know what sort of ambition you have.

Notes

[1] This is one of the advantages of not having the universities in your country controlled by the government. When governments decide how to allocate resources, political deal-making causes things to be spread out geographically. No central goverment would put its two best universities in the same town, unless it was the capital (which would cause other problems). But scholars seem to like to cluster together as much as people in any other field, and when given the freedom to they derive the same advantages from it.

[2] There are still a few old professors in Palo Alto, but one by one they die and their houses are transformed by developers into McMansions and sold to VPs of Bus Dev.

[3] How many times have you read about startup founders who continued to live inexpensively as their companies took off? Who continued to dress in jeans and t-shirts, to drive the old car they had in grad school, and so on? If you did that in New York, people would treat you like shit. If you walk into a fancy restaurant in San Francisco wearing a jeans and a t-shirt, they're nice to you; who knows who you might be? Not in New York.

One sign of a city's potential as a technology center is the number of restaurants that still require jackets for men. According to Zagat's there are none in San Francisco, LA, Boston, or Seattle, 4 in DC, 6 in Chicago, 8 in London, 13 in New York, and 20 in Paris.

(Zagat's lists the Ritz Carlton Dining Room in SF as requiring jackets but I couldn't believe it, so I called to check and in fact they don't. Apparently there's only one restaurant left on the entire West Coast that still requires jackets: The French Laundry in Napa Valley.)

[4] Ideas are one step upstream from economic power, so it's conceivable that intellectual centers like Cambridge will one day have an edge over Silicon Valley like the one the Valley has over New York.

This seems unlikely at the moment; if anything Boston is falling further and further behind. The only reason I even mention the possibility is that the path from ideas to startups has recently been getting smoother. It's a lot easier now for a couple of hackers with no business experience to start a startup than it was 10 years ago. If you extrapolate another 20 years, maybe the balance of power will start to shift back. I wouldn't bet on it, but I wouldn't bet against it either.

[5] If Paris is where people care most about art, why is New York the center of gravity of the art business? Because in the twentieth century, art as brand split apart from art as stuff. New York is where the richest buyers are, but all they demand from art is brand, and since you can base brand on anything with a sufficiently identifiable style, you may as well use the local stuff.

Thanks to Trevor Blackwell, Sarah Harlin, Jessica Livingston, Jackie McDonough, Robert Morris, and David Sloo for reading drafts of this.

Last week on Wednesday, January 8th, GitHub experienced an outage of our DNS infrastructure. As a result of this outage, our customers experienced 42 minutes of downtime of services along with an additional 1 hour and 35 minutes of downtime within a subset of repositories as we worked to restore full service. I would like apologize to our customers for the impact to your daily operations as a result of this outage. Unplanned downtime of any length is unacceptable to us. In this case we fell short of both our customers' expectations and our own. For that, I am truly sorry.

I would like to take a moment and explain what caused the outage, what happened during the outage, and what we are doing to help prevent events like this in the future.

Some background

For some time we've been working to identify places in our infrastructure that are vulnerable to Distributed Denial of Service (DDoS) attacks. One of the things we specifically investigated was options for improving our defenses against DNS amplification attacks, which have become very common across the internet. In order to simplify our access control rules, we decided to reduce the number of hosts which are allowed to make DNS requests and receive DNS replies to a very small number of name servers. This change allows us to explicitly reject DNS traffic that we receive for any address that isn't explicitly whitelisted, reducing our potential attack surface area.

What happened

In order to roll out these changes, we had prepared changes to our firewall and router configuration to update the IP addresses our name servers used to send queries and receive responses. In addition, we prepared similar changes to our DNS server configuration to allow them to use these new IP addresses. The plan was to roll out this set of changes for one of our name servers, validate the new configuration worked as expected, and proceed to make the same change to the second server.

Our rollout began on the afternoon of the 8th at 13:20 PM PST. Changes were deployed to the first DNS server, and an initial verification led us to believe the changes had been rolled out successfully. We proceeded to deploy to the second name server at 13:29 PM PST, and again performed the same verification. However, problems began manifesting nearly immediately.

We began to observe that certain DNS queries were timing out. We quickly investigated, and discovered a bug in our rollout procedure. We expected that when our change was applied, both our caching name servers and authoritative name servers would receive updated configuration - including their new IP addresses - and restart to apply this configuration. Both name servers received the appropriate configuration changes, but only the authoritative name server was restarted due to a bug in our Puppet manifests. As a result, our caching name server was requesting authoritative DNS records from an IP that was no longer serving DNS. This bug created the initial connection timeouts we observed, and began a cascade of events.

Our caching and authoritative name servers were reloaded at 13:49 PST, resolving DNS query timeouts. However, we observed that certain queries were now incorrectly returning NXDOMAIN. Further investigation found that our DNS zone files had become corrupted due to a circular dependency between our internal provisioning service and DNS.

During the investigation of the first phase of this incident, we triggered a deployment of our DNS system, which performs an API call against our internal provisioning system and uses the result of this call to construct a zone file. However, this query requires a functioning DNS infrastructure to complete successfully. Further, the output from this API call verification was not adequately checked for sanity before being converted into a zone file. As a result, this deployment removed a significant amount of records from our name servers, causing the NXDOMAIN results we observed. The missing DNS records were restored by performing the API call manually, validating the output, and updating the affected zones.

Many of our servers recovered gracefully once DNS service began responding appropriately. However, we quickly noted that github.com performance had not returned to normal, and our error rates were far higher than normal. Further investigation found that a subset of our fileservers were actively refusing connections due to what we found out later was memory exhaustion, exacerbated by the spawning of a significant number of processes on during the DNS outage.

Total number of processes across fileservers

Total memory footprint across fileservers

The failing fileservers began creating a back pressure in our routing layer that prevented connections to healthy fileservers. Our team began manually removing all misbehaving fileservers from the routing layer, restoring services for the fileservers that had survived the spike in processes and memory during the DNS event.

The team split up the pool of disabled fileservers, and triaged their status. Collectively, we found one of two scenarios existed to be repaired: either the node had calmed down ‘enough’ as a result of DNS service restoration to allow one of our engineers to log into the box and start forcefully killing hung processes to restore service, or the node had become so exhausted that our HA daemon kicked in to STONITH the active node and bring up our secondary node. In both of these situations, our team went in and performed checks against our low-level DRBD block devices to ensure there were no inconsistencies or errors in data replication. Full service was restored for all of our customers by 15:47 PM PST.

What we’re doing about it

This small problem uncovered quite a bit about our infrastructure that we will be critically reviewing over the next few weeks. This includes:

Summary

We realize that GitHub is an important part of your development and workflow. Again, I would like to take a moment to apologize for the impact that this outage had to your operations. We take great pride in providing the best possible service quality to our customers. Occasionally, we run into problems as detailed above. These incidents further drive us to continually improve the quality of our own internal operations and ensure that we are living up to the trust you have placed in us. We are working diligently to provide you with a stable, fast, and pleasant GitHub experience. Thank you for your continual support of GitHub!

Need help or found a bug? Contact us.

OP, this is a good question.

Eight hours in a day is an arbitrary number. It may be stated explicitly in your contract (which, I'm sure, your employer will conveniently forget about when he would like you to work more than that much,) but this is still arbitrary. Eight is just a number. It could be seven, it could be nine.

Take, as an example, the recommendation, commonly held, that you should drink eight glasses of water a day. As it turns out, this is based on the recommended water consumption for a 35 year old man weighing 250 pounds. The eight glasses of water is based on certain assumptions which may or may not be true in your case.

I feel there are two questions here - is it reasonable to work a flexible amount of hours, or otherwise ask for other special provisions that might not be considered standard, and is it reasonable to expect your manager to understand and cooperate this.

The answer to these questions is yes and no, respectively.

Do I Have To Work Eight Hours?

No, of course not. As stated above, this is just an arbitrary number. It is based on assumptions about how long a person can be productive, and how much time a person needs for their personal life, that may not necessarily be true for you.

You are probably the only person who knows for sure how many hours you should work. Personally, I am not very productive after six or more hours of working. When someone tells me I should be productive for eight, I ask them where did you get that number from, and what assumptions are you making?

CEO's and other execs are notorious for leaving at three, or otherwise setting their own hours. This is not because they are lazy - most CEO's are very hard working. However, since they have no one to answer to, they manage their day based on their needs, versus a roughshod benchmark, meant to apply to everyone.

Is it reasonable to assume there is a way to convince my boss to see things this way?

It is certainly not a reasonable assumption to make. Your boss is a human being, and it is therefore completely impossible to ever know, for sure, how he will react to something or how to get him to behave in a certain way.

Typically, the reason a boss will operate under a quota-based system of hours, is because they are confused and scared. Constantly existing in a state of uncertainty about their job security (because they are not very good managers, those that assume all employees require the same thing) they try to exercise as much control as possible over the situation.

People that are confused and scared are not reasonable. If you offer a person running for their lives from a stampede of cattle $500, he will probably run right by you. This is because such a state of mind makes us very resistant to outside input.

What Should I Do?

In my opinion, you should not do something that you think doesn't make sense, even if your boss tells you to.

It's important to independently evaluate everything that you are asked to do, and make sure it makes sense, before you do it.

I say this because to do so builds critical thinking, and independence. When you do something you think doesn't make sense, just to appease a manager, you build co-dependence and complacency.

At the end of the day, if you spend years of your life acting in a complacent manner, you will become complacent. And it's your life, so it's up to you.

If your boss is not reasonable, you should quit. Right away. As they say, "the person who lost their job for a dumb reason, always finds a better one fast."