I would expect this relates to Hashicorp's Vault product. It's gaining some notoriety and employs Shamir's secrets to seal/unseal the main vault.

Which sucks when it's 2am and you start blowing up a majority of shard holders phones to unseal it because it sealed itself causing a critical outage.

It's one of my least favourite things about vault as a product - it would have been technically feasible to not require unsealing for read-only operations, and thus not made a 2am restart a critical failure. I made a PoC once (I don't think it's still published anywhere) that does exactly this. Unfortunately they chose not to do this.

Admittedly simplicity is a feature in and of itself, and the read-only unsealing requires more complex asymmetric cryptography, but the excellent nacl[0] makes this a lot easier than it used to be.

0: https://nacl.cr.yp.to/box.html

I kid you not, the main reason we haven't implemented vault yet, is not because we're worried about security. It's because we're deathly afraid of locking ourselves out by making a mistake, taking the whole system down.

Meaning, this makes Vault more of a "let's really dedicate time to think of every possible scenario" type implementation rather than "let's just keep adding a couple of secrets a week".

What has other people's experiences been?

It is possible to control both the number of key shares and the threshold required to unseal Vault (and now to do automatic unseal too), so I’m not certain this particular condition should be too much of a concern anymore. That said, considering as many scenarios as possible is definitely sensible!

I really do not understand your frustration. We are running 5 node cluster in production with the keepalived and nobody needs to wake up unsealing if one, or two instances fail. Perfectly good to do it in the morning by copy pasting curl oneliner from the keepass.

They're moving Cloud Auto Unseal to the open source Vault soon, thankfully.

That said, for most organizations, I've never been all that convinced that the multi-key-holder model provides much benefit.

do not use single node instance, in a HA fashion it is not a problem. Even with the open source version, which we are using.

Frequently prototyping sites and always amazed how much value bootstrap adds. Thank you for all the work done!

Fantastic! Go-and-install-immediately!

Interesting Meta-Analysis of the Cochrane Collaboration: http://summaries.cochrane.org/CD004879/vaccines-for-preventi...

I really wonder why no ones mentions typography. In terms of great typesetting the Kindle is somewhere in the 60's. Since at least LaTEX (not talking about Adobe and Apple products) ligatures and other niceties found their way into computers. Any by all means - this is a dedicated reading-machine! I still love my Kindle, mainly for jgrahamc's reasons.

Is it just me or do you get a download forced upon you when you open the page? Mine is called 'ayUGOgFaCs8' and it's contents look executable.

Anyone can tell us if this is for real or a hoax? I am lacking sufficient ssl knowledge here...

Mikko Hypponen of F-Secure seems to think that it is real: http://twitter.com/#!/mikkohypponen

I'd say - it doesn't matter. As a person who faced the same choice two years ago, I went with RoR. Mostly because of the bigger community around it. By now I mostly consider it great because it is basically a best-practise sharing example. Any of these frameworks expose you to currently brewing technologies - and that helped me a lot along the way.

Thank you for sharing your experience. :)

To get a frequently updated version set a recipe up at http://readbeam.com. It's easy, just did this with TechCrunch and it worked nicely. (This functionality is still in beta but is expected to be released end of this week) So I get all the feed articles mailed right on my Kindle every day at 6 am and 6 pm (0 6,18 * * *).

I am using GoDaddy for m throw-away domains and regfish.com for more specialized TLDs. Regfish has a great, personal service, is based in Germany (how about that for a change ;-) and has decent prices. Great UI, lot less slack than GoDaddy.