HP Replaces Jon Rubinstein as Head of webOS - <AUTHOR> http://www.macobserver.com/tmo/article/hp_replaces_jon_rubinstein_as_head_of_webos/ <comment><USER2> He was just moved to a different position. Probably to a better position with a wider reach. I fail to see this as a demotion.

</comment><comment><USER3> A shame, I have a Pre 2 and it's the best phone I have ever owned. Sure some things could be better - screen resolution for one, and battery life. But it's fast, as smooth as IOS and stable and the UI is so well thought out. There were problems with the original Pre but these have been resolved.

I also own an dual core LG 2X flashed with CyanogenMod but the WebOS UI is a class apart in terms of usability and polish. So much so that I am selling my Android. And so developer friendly - entering the Konami Code to enable developer mode FTW!

</comment><comment><USER4> WebOS is a great product, but over the years the team at Palm and HP lead by Rubinstein have failed to fix it's core operational problems - mainly it's sluggishness and bugs. Why have those two factors been so neglected?

The resulting operating system has a great design (and very few will detest that) but fails in operational every day use due to a sub-par user experience due to lag.

I'd love to see WebOS live on. Hopefully this management change isn't too late in the game and the new guy in charge of WebOS realizes it's problems.

<comment><USER3> Have you used a Pre 2?

Mine doesn't lag at all. It's a night and day difference compared to the original Pre/+, especially if you install the 'smooth scrolling' patch from Preware.

</comment></comment><comment><USER5> It seems to me like the only people hotly awaiting the arrival of the iPad killer are the tech pundits and people who desperately want to see Apple fail.

Normal people don't care. And that is why the tablets fail.. the market doesn't care, and the pundits can't _make_ them care. The dirty little secret of the tech press is that no one pays attention to it anymore.

</comment><comment><USER6> Can't say this is much of a surprise.

I'm sure Leo Apotheker (who's seat isn't exactly safe) wasn't thrilled that Ruby got so much more press then he did with a money losing division that can't crack 2% market share.

</comment><comment><USER7> Palm didn't hire Rubinstein, he (as part of an investment group) _bought_ Palm. He might not even want to work at HP.

</comment><comment><USER8> I guess the Touchpad's launch day sales weren't so stellar.

</comment><comment><USER9> Did anyone not see this coming?

</comment><comment><USER10> I liked WebOS and was enthused by the launch. I wanted to buy a device. I was in Taiwan, one of the world's consumer electronics centers. There were no devices. FAIL.

If you can't even distribute your product, then why bother building it? Seems like they spent so many years / so much money on R&D that their marketing failed.

I'm sorry but a forced-smile charismatic keynote (and that's being generous), even a very well presented one, cannot make up for the lack of global distribution. The US is not relevant as a leading consumer electronics market anymore. You need to either be global, or go to Asia.</comment>


Ask HN: What do you think of Medium? - <AUTHOR> <comment><USER2> As a blogging platform it's great. Content varies though. The tech scene there often has excellent content, but the political scene is slightly frightening. I've seen some rather radical views on there.</comment>


The Mysterious Lawyer X - <AUTHOR> https://story.californiasunday.com/lawyer-x-melbourne <comment><USER2> Ridiculously long</comment>


Science is not democratic - <AUTHOR> http://www.washingtonpost.com/blogs/on-faith/post/science-is-not-democratic/2011/08/24/gIQAdEgxaJ_blog.html

<comment><USER2> This is a political story of the most Reddit-y kind. It's understandable how it ranked here; the title sounds fascinating. But the story isn't. I guess I probably agree with the story, but that doesn't mean it belongs on our site.

Flagged.

</comment><comment><USER3> Actually, I'd argue the opposite. It has always been democratic, with the majority beating the outliers down when they disagree with groupthink, even if they're right.

It shouldn't be, but it is, and has been.

<comment><USER4> In a Thomas Kuhn kind of way, yes.

</comment></comment><comment><USER5> It drives me absolutely crazy when I hear evolution deniers use the excuse that it's "just a theory," as though the phrase _scientific theory_ means exactly the same thing as a _theory_ in everyday layman's terms. I'd go so far as to say that this quirk of the language is as big an impediment to the widespread acceptance of evolutionary science as religiously based objections.

<comment><USER6> Dawkins proposed it would be better to use "theorem" rather than "theory", due to this confusing ambiguity.</comment></comment>


YouTube will add information from Wikipedia to videos about conspiracies - <AUTHOR> https://www.theverge.com/2018/3/13/17117344/youtube-information-cues-conspiracy-theories-susan-wojcicki-sxsw <comment><USER2> Why just conspiracies ? Why not cults ? Political speeches ? Nutrition ? Science ?

And who decide what's a conspiracy ?

After all, we were regarded as paranoid lunatics wearing tinfoil hats about the NSA surveillance, until PRISM came out and it became obvious we weren't.

<comment><USER3> Before Bamford, there was little in public about the NSA. ECHELON was total conspiracy theory.

So is the Israeli attack on USS Liberty during the Six-Day War still a conspiracy theory? I guess not, because there's a Wikipedia page. But it was denied for many years.

<comment><USER4> Even worse, Israeli false flag bombings in Egypt. They attempted to frame the Muslim Brotherhood. This was just a couple years after Israel got statehood. They denied it until 2000. "Lavon Affair" if you want to look it up.

USS Liberty, Israel continues to deny they did it intentionally and that there was any pressure to cover up.

<comment><USER3> I used USS Liberty because it's arguably no longer conspiracy theory, but still more controversial than NSA snooping.

But alleged activities of Israelis during the early years? That remains highly controversial. I do see a Wikipedia article about Irgun (Zionists) bombing the King David Hotel, however.

</comment></comment></comment></comment><comment><USER5> I don't like it.

There are some absolute lunatics posting their content out there, but that will always be the case. I don't think it's a problem that really needs solving. Even if it was, I don't think that this is a solution. If you are too quick to counter a statement, people may suspect that you have ulterior motives. If videos come along with these "corrections" many viewers will see that as proof that they're right and that the "mainstream" is trying to cover something up.

A video is a creative production. The creator makes it in a certain way for a certain reason. When the publisher interjects, tries to mold and reshape the content, provides their own commentary with it, that restricts the creator's artistic freedom over their content.

I don't expect that this pseudo-censorship (that's what it is - they're saying "we don't think your content is right, so we'll be giving your viewers what we think is right) will be applied neutrally, either. There are nutcases in all ideological directions, but I have a solid suspicion that these annotations will only be applied to those that are not in line with the "politically correct" zeitgeist.

Of course, YouTube is well within their rights to do whatever they want with their platform. This isn't at all an uncharacteristic development for them, either. They've consistently demonstrated that their only interest is money; they don't care for the small creators - or really even the viewers - all that much. If this is what keeps the advertisers happy then it's only the logical step for them.

I just don't like it.

<comment><USER6> This is not censorship. It's another form of "people interested in X might also be interested in Y". It's something platforms do all the time.

<comment><USER7> More like "people interested in X are wrong".

<comment><USER8> But they're also in the business of responding to search with facts.

YouTube is a strange platform in that respect, but if someone searching for the moon landing gets a conspiracy video in the results because it's popular I don't see anything wrong with YouTube including a snippet of verified information that relates to the query.

</comment></comment></comment></comment><comment><USER9> I think there are a few problems with this:

1\. Definition of what is a conspiracy and what is not. There are some hot topics out there all the time (e.g. Trump and Russia collusion) - pointing out and not pointing out "conspiracies" is a statement within itself. You only have to think about Twitter and it's "verified accounts" hot water not so long ago [1].

2\. Adding fuel to the fire - for some conspiracies the idea of covering them up makes them more real for many people. There are many posts on various social media platforms with the tag line "share this before <X> takes it down" (e.g. Facebook videos [2]).

3\. Videos that debunk theories could also get thrown into this automated mess they'll undoubtedly make and will probably incur demonetization. The result of that may be less debunking videos, actually poisoning the well further.

4\. Generally squashing freedom of speech means that needed discussion on a particular topic can't happen.

What I think they should do:

1\. Have this as an opt-out feature which is mostly hidden, or an opt-in feature which is obvious.

2\. Pick controversial topics of any kind and find for and against cases for them, allowing the user to investigate them both. Picking a side is dangerous.

3\. Have smart humans go through and carefully select for and against cases - don't try to automate this as it _will_ be gamed.

4\. Don't use this information for classifying whether videos should be monetized.

[1] [https://www.businessinsider.com.au/twitter-clamps-down-on- ve...](https://www.businessinsider.com.au/twitter-clamps-down-on-verified- accounts-2017-11?r=US&IR=T)

[2] [https://www.facebook.com/TaxationIsTheft2/videos/51317619238...](https://www.facebook.com/TaxationIsTheft2/videos/513176192385963/)

<comment><USER10> The most glaring problem is that it simply doesn't work.

The only people who take conspiracy videos seriously, are people who have already decided they don't like the truth, and either want someone to agree with them, or want someone to invent the details/logic so they don't have to.

You're not dealing with people who aren't aware of the moon landings. You're dealing with people who have already chosen, for whatever reason, not to believe it.

Have you ever won an argument about a moon hoaxer with "yes, they did", or against a flat-earther with "no, it's round"? Embedding wiki summaries into youtube is simply taking the argument that never, ever works, and automating it.

"You cannot reason someone out of a position they did not reason themselves into."

<comment><USER11> Surely you can acknowledge that some conspiracies, including those involving high-level state actors, have occurred? Why do you pigeonhole all conspiracies in such a way?

<comment><USER10> I'll admit, I homed in on the moon hoax because that's what the screenshots in the article show.

But I am struggling to come up with any valid conspiracies which were unravelled on youtube, or disproven on wikipedia. Suffice to say youtube is not famed for its investigative journalism. That's not what nutjobs are soaking up.

I was watching a show that was profiling flat-eathers, and one lady made a comment that really stood out to me. "So I did my own research - I watched four hours of videos on youtube."

This isn't investigative journalism. This isn't classified leaks. It's monetising the gullible.

<comment><USER11> So, it happens that I have been indulging myself in watching flat earth videos on Youtube for the past few days. And I'm astonished that anybody can watch these and come to the belief that they're accurate. For example, no video explains the simple matter of how, in a "flat earth" model, seasons can occur without the sun traveling at different speeds across the sky through the year. Or how retrograde motion can be observed. These are obvious, glaring flaws.

On the other hand, I have found that there is a wealth of good information about the JFK assassination (although some whacky fringe bullshit too). In this case, I do think that the "establishment" narrative (if it's even reasonable to call the "lone nut" theory that anymore) is demonstrably false, and that Youtube provides good resources for showing it.

In other words: if you conclude, as I do, that the JFK assassination was a conspiracy but that the earth is not flat, then I think that the resources on Youtube does a good job of buttressing reasonable study on these matters.

<comment><USER10> I'm not nearly well versed enough on the JFK assassination to comment. But flat-earthers are pretty much the stereotype of what I had in mind with my original comment.

If you go into it disbelieving, you find something verging on absurdist comedy. If you go into it believing, you come out armed with theories and explanations to reinforce your belief.

What I do find interesting, is without knowing enough to form my own take on the JFK incident .. this same model also fits the experience you just described. You go in with your mind made up, and you come out with evidence. Whether you're right or wrong, you'll find exactly what you want to hear.

But to my original comment - would a wiki summary describing the "establishment narrative" have swayed you at all?

<comment><USER11> I went into the flat earth stuff absolutely ready to believe anything. I found some of the flat earthers to be surprisingly rational.

But at the end of the day, there are easy-to-observe phenomena (as I say, seasons and retrograde motion) which break their theory. And diving into the explanations of them drives the viewer much more directly into the insane and fringe elements of the group (you can confirm this yourself by searching "flat earth seasons" and comparing it to the results you get from searching simply "flat earth").

And while it's true that I already had a sense that the JFK murder was the result of a conspiracy, I wasn't certain when I started combing Youtube; I was prepared to accept evidence of any sort, pointing to any conclusion(s).

I remember finding "Rush to Judgment", a documentary-ish piece of media made just a year after the murder, and realizing how lucky I was to have a resource to find such a piece of media. Were my parents, who were just barely not yet born during this event, able to gain access to this media when they were my age? Of course not.

And then on the specifics:

I think that if there are similarly challenging facts to be found regarding the JFK assassination, on wikipedia or anywhere else, that I will be happy to accept them and change my mind. And I think that I'm fairly typical in this regard.

On the other hand, the lone-nut theory needs to overcome some basic facts that it can't explain, like the Sylvia Odio incident. And similarly, searching for explanations of this that fit into the lone-nut theory drives the viewer directly into the irrational and ad-hominem-driven portions of the available media.

</comment></comment></comment></comment></comment></comment></comment><comment><USER11> I don't agree with comments which assert that proper, well-sourced, sober information can't change minds among people seeking videos about fringe topics.

I also think that Wikipedia is a great resource for exactly this use case, especially where a small number of easily observable facts can overturn the thrust of the disinformation (think flat earth or anti-vax).

However, in some cases, it might not be as good a resource for this purpose. For example, here's the opening sentence in the article about Lee Harvey Oswald:

> Lee Harvey Oswald (October 18, 1939 – November 24, 1963) was an American > former Marine and Marxist who assassinated United States President John F. > Kennedy on November 22, 1963.

Of course Oswald enjoyed no trial, and the evidence against him is very flimsy. I (and I think many Americans who've studied the topic) don't think there's enough evidence against him to make such a brash declaration.

So, in this case (and I suspect, some others), Wikipedia serves to add bias rather than subtract it. I think that a sober, reasonable article on Oswald will offer a more nuanced and more factually-driven article.

I think it's especially important in these politically acrimonious times to investigate the Kennedy assassination, and the obvious conclusion from the evidence is that actors within our government executed a chief executive. Let's not misdirect people of a younger generation who try to study this topic.

<comment><USER12> Other articles on Wikipedia concerning the assassination go quite heavily into the conspiracy theory side (and there are dozens of them). I'd find it odd for someone to only read the Lee Harvey Oswald article lead and make their conclusions off of that.

Google will clearly be able to influence bias depending on what article they link to.

<comment><USER11> Yeah, the point in your first paragraph is part of what I was trying to point out. Even within Wikipedia, there is odd inconsistency regarding this topic.

> Google will clearly be able to influence bias depending on what article they > link to.

...and yeah, that's really the thing. How do you decide to which article to link given a particular topic or meta-topic? It's a tough challenge.

</comment></comment></comment><comment><USER13> Adding a Wikipedia box won't make Alex Jones viewers changr their mind about gay frogs, and could play into his victim complex. If they want to get serious, change the algorithm so it won't reward people like jones. That's the problem. You watch one dumb video, let it autoplay more, and next you know you're in a rabbithole of crazy. One night i fell asleep watching a vegetarian cooking show, i wake up and youtubes recommending some raw food nutcase telling me why cooked food is poison and how vaccines cause autism (true story)

<comment><USER14> Ironically, the Wikipedia link related to "cooked food is poison" might actually support it.

[https://en.wikipedia.org/wiki/Advanced_glycation_end- product](https://en.wikipedia.org/wiki/Advanced_glycation_end-product)

<comment><USER15> I don't see that as the case:

> This article may present fringe theories, without giving appropriate weight > to the mainstream view, and explaining the responses to the fringe theories

> A major contributor to this article appears to have a close connection with > its subject. It may require cleanup to comply with Wikipedia's content > policies, particularly neutral point of view.

</comment></comment></comment><comment><USER16> If there is never any reason to not believe the official narrative on every event then why not just censor any evidence to the contrary? This seems to be the direction we are going.

There's a bit of doublethink here though. Does propaganda work? Well of course it doesn't because the truth will always come out because the news wants viewers and thus the official story is never propaganda! But, wait.. These conspiracy theory videos made by some random dude in his bedroom are convincing some people of things that are apparently not true! How did they do that if propaganda doesn't work? Explanations about Russian troll bots with magical mystery deception tactics and various handwaving ensues...

So does propaganda work? If not then we don't have to worry about fake news. If it does, then how do we know the real news isn't propaganda? What empowers propaganda more than anything? Lack of criticism.

<comment><USER17> There is a serious blind spot most people have, or at least publicly act like they have to avoid ostracism, when it comes to challenging the mainstream narrative. Thank you for pointing it out directly. Everyone else is dancing around the gorilla in the room.

</comment></comment><comment><USER18> Won't this just take the battleground about what is "fact" or not to Wikipedia?

If someone was trying to discredit say, Obama, and saw "Barrack Obama was born in the United States - according to Wikipedia" surely they'd rush there and try to sneak conspiracy theories past the moderators.

So what happens then, Wiki has to lock down more and more pages, or effectively only allow approved edits to topics people are trying to shill over.

That happens, and it's no longer the crowd-sourced/accepted truth, it's Wikipedia moderators truth.

<comment><USER19> When pages are locked, they're not limited to only admins (who I'm assuming you are referring to by "moderators"; otherwise, any user can undo an edit, and it doesn't require an account). There are several levels of page protection: [0]

* _Pending changes protection_ : Anyone can edit, but edits must first be reviewed before becoming visible. Autoconfirmed [1] users have their edits go through right away, while other edits have to be approved by a pending changes reviewer. The criteria for reviewing edits basically boils down to "anything that is not vandalism" is reviewed and then it's treated like a normal edit that can be contested by other users. In effect it reduces the incentive to vandalize or make disruptive edits because they won't even be visible.

* _Semi-protection_ : Only autoconfirmed users can edit. See [1]. This is used for pages where a large proportion of the edits are vandalism rather than helpful edits. 99% of vandalism stops here because most vandals are too lazy to get autoconfirmed or don't know how, since their goal isn't really to be productive.

* _Extended confirmed protection_ : This is a fairly new option and requires an account 30 days old and with at least 500 edits. This is mainly used for pages under sanctions (namely the Israeli-Arab conflict), and in certain cases where autoconfirmed users are causing abuse.

* _Full protection_ : Very rarely used. Mainly used in instances where multiples experienced editors are editing disruptively on a page such as by edit warring. The protection is always very short because it otherwise blocks editing from all users. In most cases though, the editors themselves are usually blocked or warned instead of a page necessitating full protection.

[0]: [https://en.wikipedia.org/wiki/Wikipedia:Protection_policy](https://en.wikipedia.org/wiki/Wikipedia:Protection_policy) [1]: Account must be four days old and have made at least 10 edits, so not hard at all to obtain

</comment></comment><comment><USER8> They can't really win.

If you try to squash conspiracy theories like this there will be those free- speech hardliners who see it as crossing a line.

If you allow the crazy conspiracy stuff then there will be people who complain about the platform being a toxic influence and promoting hate speech etc.

Personally I don't see anything wrong with attaching additional information like this as opposed to outright censorship or something. But my guess is that plenty of other people will complain.

Side note: I can't help but notice how polarizing issues involving free speech have become in recent years. Any topics involving perceived censorship by any host simply ignite.

<comment><USER20> You don't get "free speech" on Youtube. Its not a government censoring you. Its a private company doing whatever they want on their private website. Same with Facebook, Twitter, etc. The only public spaces online are decentralized ones, and even then you are subject to nodes actually accepting your peerage. If every Mastodon instance deems yours toxic and blocks it you can't cry fowl of censorship to anyone.

<comment><USER21> I'm not sure how Google qualifies as a private company, but I would like to play devils advocate. Tell me how I can refuse to bake a cake for someone because their personal views differ from mine. I dare you.

<comment><USER22> _I 'm not sure how Google qualifies as a private company_

It qualifies as a private company because it is, as a matter of law, a private company.

 _Tell me how I can refuse to bake a cake for someone because their personal views differ from mine. I dare you._

Assuming, based on your choice of example, that you're talking about the US legal context: You absolutely _can_ refuse someone's business because of their beliefs. What you can't do is refuse someone's business because of their race, or their age, or one of small number of other protected characteristics.

</comment></comment></comment></comment><comment><USER23> Beyond the other (valid) points here, will YouTube be providing some kind of funding or support to the Wikimedia Foundation?

</comment><comment><USER24> This trend of attempting to outsource the faculty of skepticism is stupendously dangerous.

<comment><USER25> Agreed. It would be great if as a society we could start encouraging people to exercise proper critical thinking instead.

<comment><USER26> Linking to extensive Wikipedia articles with dozens of sources _is_ encouraging people to think critically.

</comment></comment></comment><comment><USER27> Now is as good a time as any to mention that I've been running a channel that I am moving from YouTube onto my soverign origin RasPi with some fancy scripts, and I've been doing daily 720p livestreams using it as the origin with CloudFlare CDN and syndicating out to 1-4 other services (YT, Twitch, FB, Periscope dep. on message). Github my username, tinydatacenter project.

Filling a void that I saw growing—we need open source systems on the level of the big guys; this is that. I am a disgruntled American being pushed out of jobs in SF and feel I am being censored on at least one platform and feel my service family member rolling in their graves recently.

</comment><comment><USER28> Google makes billions while the Wikipedia contributors providing their fact checks and knowledge graph data get nothing.

[https://newslines.org/blog/google-and-wikipedia-best- friends...](https://newslines.org/blog/google-and-wikipedia-best-friends- forever/)

<comment><USER29> That's OK. Google is about to send Wikipedia a bunch of newly informed editors.

</comment></comment><comment><USER30> If these were Hollywood produced films from Hollywood artists, there would be talk of defacement, interfering with the integrity of the work, etc...

<comment><USER31> Yeah, but they aren't Hollywood produced films, they're low-budget, low barrier to produce conspiracy videos. If Hollywood starts making videos about how chemtrails are turning your kids gay, then that will be a valid comparison. But the reason Hollywood gets to talk about artistic integrity is because they actually have some.

<comment><USER3> BS about chemtrails regardless, modern chemistry has given us lots of estrogenic substances in our food and bodies. And maybe not homosexuality, which may be mostly genetic. But maybe reduced sperm counts?

<comment><USER32> The studies mentioned here suggest nicotine, stress, and plastics may be to blame: [https://www.nytimes.com/2017/08/16/health/male-sperm- count-p...](https://www.nytimes.com/2017/08/16/health/male-sperm-count- problem.html)

Estrogenic substances such as atrazine have been correlated with lower sperm count in agricultural workers (e.g. [https://news.nationalgeographic.com/news/2005/04/0427_050427...](https://news.nationalgeographic.com/news/2005/04/0427_050427_strangedays3.html)) but I don't know of a study showing the effects through the food distribution chain, only ones on field workers.

<comment><USER3> > ... and plastics ...

The issue with plastics is mostly about plasticizers. Maybe in some cases, monomers. And plastics are ubiquitous in food packaging. Even steel cans are generally coated with plastic, rather than tin.

</comment></comment></comment></comment></comment><comment><USER33> > is an imperfect source of information, one which most college students are > still forbidden from citing in their papers.

Is that honestly the measure of how perfect a source of information is?

<comment><USER26> No, and the quote from the article is a horrible meme that makes absolutely no sense.

Of course people can't source Wikipedia, _they are meant to source the SOURCE articles!_ That's like the entire point.

<comment><USER31> You can't source encyclopedia brittanica either. Wikipedia isn't banned because it's a wiki, it's banned because it's an encyclopedia.

But apparently the people who write these articles have never actually been to school, so they think that wikipedia not being allowed as a source for college papers is somehow a significant indictment.

</comment></comment></comment><comment><USER34> Youtube already takes down anything they dislike. Definitions such as "hate speech" include literally all possible speech that is critical of anything, at any degree.

Their preferred weapon though is de-ranking. This is the American model of censorship, and it really does work. Why bother going after people who speak up, when instead you can make sure nobody can hear them? You think the video is up, you can share it with your close friends, but nobody else will discover it. It's also super convenient for them because they move the majority of content in coldline storage almost right away. It's not just Youtube either, it's Google, Facebook, Twitter and all their subsidiaries. We need a massive change in the way the internet is structured, both technically and legally, if we want the open web back.

<comment><USER26> > Youtube already takes down anything they dislike.

These are the funniest comments on HN. There seems to be a huge group of people that are more willing to believe that YouTube will push a narrative vs believing YouTube just wants to earn more profit.

If you make a video that people want to watch the algorithm will love you. It determines this by watch time and session time. If you make a video that people click away from, especially if it ends their watch session, the algorithm hates you. Remember, you have to compete against over 300 hours of content being uploaded _every minute._

This is how every social platform works. It's a function of content volume.

If they took down every video they didn't like PewDiePie wouldn't be the top channel, literally making fun of the platform almost every weekday. But most people on HN haven't actually bothered watching him, I'd hazard to guess!

</comment></comment><comment><USER35> This is just stacking one bias on top of another. Wikipedia is not a credible source of information, especially when it comes to topics like politics or conspiracies, and refering to it selectively is a clear statement on its own.

IMHO it would be much more productive to tell people to be extremely sceptical towards everything they see on the internet. YouTube is very capable of launching a successful campaign to do that. I'm sure a lot of creators would jump on board, and, seeing what's most likely to go viral these days, it seems necessary. This is obviously in direct conflict with the business model of platforms like YouTube, Twitter, and Facebook, since they rely on ad ravenue, so we're stuck with orwellian solutions like the one presented.

<comment><USER36> I don't think that teaching people to be skeptical would align with the business model of the world's largest advertisement company.

<comment><USER37> it does when it promotes YouTube from the status of "very unreliable source of information" to "fair source of source of information"

</comment></comment></comment><comment><USER38> I'm not sure how I feel about this. Correcting obvious falsehoods seems fine, but something about a platform moving from being (_vaguely_) neutral to directly critiquing content feels off. Further, where do you draw the line? Correcting things that are unequivocally, proven wrong casts a small net, but adding information to loose speculation, or discuss of events that are denied but not disproven, risks making a stronger statement than the evidence allows and risks shutting down legitimate discussion.

<comment><USER26> Pretty sure everything we are talking about is unequivocally proven wrong. That's the point.

</comment></comment><comment><USER39> A major global platform announces it will link out-of-platform to a community edited resource. That should be seen as major win to the open web and pretty much everyone else. But somehow YouTube manages to frame it in a way that no one feels comfortable about it.

It's all a conspiracy. [https://en.wikipedia.org/wiki/Cats_and_the_Internet](https://en.wikipedia.org/wiki/Cats_and_the_Internet)

</comment><comment><USER26> I can safely estimate that my daily life and my work have me deeper in the YouTube community than the average HN poster, and I say this is GOOD.

YouTube isn't censoring here, just making sure that the most despicable users cannot lead astray the most vulnerable minds without at least a warning label.

If you think that warning label is too influential you should consider the influence of well paid, highly watched liars on YouTube.

</comment><comment><USER40> I've thought about doing something similar before, but wikipedia is oriented toward summary, not to convince people who are dubious of some "mainstream" truth.

If you want to, say, convince someone that is watching Holocaust denial videos that it did happen, I'd actually dig into some past reddit or forum discussions. Some people have gotten rather experienced at refuting this kind of thing sussinctly, and you may as well borrow from them.

</comment><comment><USER41> I think this is an experiment. And given the current state of the internet in regards to fact checking, it's commendable that they are trying something to help address the issue. Maybe it won't work, if so, nothing lost.

I wonder if it will have any noticeable effect on Wikipedia though. By linking all of the conspiracy theorists to it, they might find that the articles get more contraversial editing going on.

</comment><comment><USER42> The audacity of YouTube to go after conspiracy theories while actively engaged in a conspiracy:

[https://www.wsj.com/articles/youtube-hiring-for-some- positio...](https://www.wsj.com/articles/youtube-hiring-for-some-positions- excluded-white-and-asian-males-lawsuit-says-1519948013)

</comment><comment><USER43> Much ado about nothing. You could say a waste of time is worth a waste of time.

I don't think there's anything to fix here, when the real problem is adults with the power to vote, can have their votes swayed by Saturday morning cartoons, because all they ever look at are Saturday morning cartoons.

</comment><comment><USER44> Check out [https://play.cash/](https://play.cash/)

There are popups in between song videos giving you trivia about the album/band/song etc. Lot of fun if you care about such stuff.

</comment><comment><USER45> I honestly don't believe the way to discern the truth is by referencing a site that is written by volunteers, has no system for identifying and rating contributors, no way for the other side to express their view or refute what was said. This guy from Forbes wrote much more eloquently about what I'm trying to say whe he tried to fact check the fact checkers at Snopes. [https://www.forbes.com/sites/kalevleetaru/2016/12/22/the- dai...](https://www.forbes.com/sites/kalevleetaru/2016/12/22/the-daily-mail- snopes-story-and-fact-checking-the-fact-checkers)

</comment><comment><USER46> It's good. Let's make sure the following conspiracy theories and extreme views are highlighted:

Anything about men's rights, "rape culture", white "oppression", "72 genders", marxism, neoliberalism, fascism, Antifa, conservatism, libertarianism, white nationalist, black nationalism, "Irish" nationalism, hindutva, islamophobia, islamophilia, Catholic church paedophilia, pizza gate, Russia collusion, 9/11 was an inside job, 9/11 was by Al Qaeda, George Soros, Koch brothers, uranium one, Castro Trudeau, PewDiePie, Alex Jones, Rachel Maddow, Sean hannity, morning Joe, ... Just to begin with.

It would be nice if the list of conspiracies and extremist views was a open source list so that we get an honorable and democratic process of deciding it as a people and community. I am sure we as good human beings will be able to peacefully maintain such a list. I wouldn't mind the great overlords of YouTube to maintain such a list either.</comment>


Performance Testing React with Anonymous Functions - <AUTHOR> https://www.matthewgerstman.com/tech/performance-testing-anonymous-functions/ <comment><USER2> In general, the notion of "declaring functions in render is bad for perf" is a result of several things:

\- Declaring functions (especially arrow functions) _may_ have had a more noticeable cost in older JS engines

\- Misunderstandings about how React's rendering works. When a component renders, React recursively renders all its descendants by default, regardless of whether any of their props have changed or not. New prop references only matters when you are trying to optimize perf by skipping re-renders based on prop reference comparisons (ie, `PureComponent` and `React.memo()`.

\- Highly aggressive lint rules, such as the AirBnb ruleset, which include the "no arrow functions in render" rule as a warning or error.

As this post demonstrates, declaring functions isn't zero-cost, but in general the cost is meaningless and it's not something that should be avoided. Micro- benchmarks need to be taken with a grain of salt, but it's nice to have some actual numbers to look at.

Some other prior relevant articles for reference:

\- [https://reactjs.org/docs/hooks-faq.html#are-hooks-slow- becau...](https://reactjs.org/docs/hooks-faq.html#are-hooks-slow-because-of- creating-functions-in-render)

\- [https://cdb.reacttraining.com/react-inline-functions-and- per...](https://cdb.reacttraining.com/react-inline-functions-and-performance- bdff784f5578)

</comment><comment><USER3> I see many developers stressing immensely over optimizations that amount to rounding errors.

        if (list[i].type === SomeType && list[i].valid)

Refactored to avoid two array accesses:

        item = list[i]
        if (item.type == SomeType && item.valid)

Then a few months later, somebody refactors the second version to the first version, to avoid an assignment...

I wish people would simply relax and spend that time on more important things.

That said... the performance issue with arrow functions in React isn't related to creating those functions. It has more to do with those functions preventing proper memoization of the components that receive them as props.

</comment><comment><USER4> > Kitze was kidding (I hope), but for a while this was a very real debate. > Especially when render props were first taking off. Since then, Hooks have > made anonymous (inline) functions even more popular.

Isn't this missing the point? It's not about the overhead of declaring a new function, it's that you've made one of the props change on every render, so your child element needs to run its render function every time. The render function of Number only has to create a single H1 element which doesn't seem like a good test.

And the ExpensiveComponent example is strange to me. It's being memoized, so what exactly is the point?

<comment><USER5> > Isn't this missing the point? It's not about the overhead of declaring a new > function, it's that you've made one of the props change on every render, so > your child element needs to run its render function every time.

This is the larger issue, but the `useCallback` hook can be used to memoize anonymous render functions based on given values to avoid this problem.</comment></comment>


ASk HN: Do you set life goals, 3/5 year plans? - <AUTHOR> Hi guys,
Curious to know if anyone sets goals of places you'd like to be, several years in advance. Many companies make their employees write and define their career goals, I was wondering if any entrepreneurs/hacker/startup guys do the same thing and write out goals of where they want to be in several years.
Do they work? Does anyone actually follow and attempt to achieve their goals? Or is life too chaotic and the industry changes too fast to have realistic goals? <comment><USER2> No plan survives contact with the enemy -- Field Marshall Helmuth Karl Bernard von Moltke

I have always found that plans are useless, but planning is indispensable. -- Dwight D. Eisenhower.

Life is what happens to you while you're busy making other plans. -- John Lennon

<comment><USER3> Everybody has a plan until they get punched in the face - Mike Tyson

</comment></comment><comment><USER4> Achieving something by accident feels like failure in comparison to achieving something on purpose.

A sense of purpose is integral to your sense of worth, your self-esteem and fuels your ambition.

Goals are useless if you don't have any ambition. Ambition is absent when you have no goals.

You should never measure yourself with someone else's measuring stick. You should always establish your own measuring stick. So that you will always know what you have achieved and what you believe is success.

Leaving yourself open to being measured by others is an invitation to be controlled by others. Once you give up that control, you will never be happy with the direction they push you. You will never truly believe in what you do and you will lose your sense of purpose and feel like a puppet.

People who say their don't believe in goals are lying or aimlessly floating through life achieving nothing.

A goal is not a plan, it is an end result. A successful person will constantly assess and alter their plan to meet their goal.

Sometimes setting a goal is the quickest way to find out you aren't really interested in that goal and you are lead to what your really believe to be important.

</comment><comment><USER5> I once asked my mother what her New Year's resolution was and she responded, "To be around to make a New Year's resolution next year."

Ever since, that's pretty much summed it up for me.

<comment><USER6> I agree that survival is of the highest importance, but it's good to also formulate goals beyond just being alive.

</comment></comment><comment><USER7> My company makes employees set goals like you are referring to yearly but they are pretty much BS and everyone knows it.

However, I do set personal goals for each year around Christmas time. These aren't necessarily around work but areas in life I want to improve on or make some sort of progress in. These aren't new years resolutions like everyone makes but then makes no effort to achieve.

I usually do 5 to 6 a year and my goals are written out and most importantly quantitatively measurable. At the same time, before the new year I sketch out a rough timeline (again in writing) of each portion of each goal, what I need to achieve it, step by step etc. This has proven amazingly effectively over the past 3 years, getting me off my ass and accomplishing things that most people put off continually.

For example, one of my goals this year was to start a side business in x field with at least y amount of revenue in 2010. I did this successfully and learned a ton of stuff about starting a business, dealing with accountants, lawyers, business law, etc. Even better its already profitable.

To take an example of most common New Year's goal, go to the gym more and lose weight. Yeh, that is ill defined and the person will give up after gym visit 3.

The way I would phrase this one is along the lines of the specific outcomes I want. I mean you go to the gym as a means to an end, not to an end in of itself. So I would say my goal in 2011 is to lose 20 pounds, up my bench press by 30 lbs, and be able to run a 10 min mile for example. Then I would timeline this out (leaving it open for adjustments since shit happens and you want to experiment) such as by June 1, 2011 have lost 10 lbs, be able to do a 13 min mile etc.

Basically these have really helped me out and I'm already planning my goals for next year.

</comment><comment><USER8> Since I was a kid I have been thinking of what is my mission here on Earth. Today I got a pretty good idea of what I want to do in this world, so after I've decided that, I have now been struggling to set goals in the short/mid/long term till I reach that ultimate goal.

One might say plans are useless, but that isn't true. I find myself changing them from time to time, but they are the best tool I have to manage my time and life and check on my progress to reach the dream I have.

All I do is keep checking on them and constantly thinking if they need change or what progress I am having. Everyday I spend at least a few minutes reflecting on them.

This is a good example of goals: <http://www.sebastianmarshall.com/?p=84>

</comment><comment><USER9> I set myself such goals a few years back, at the behest of my employer.

As soon as I had quit that job and found something to do that I actually enjoyed, I stopped bothering... :-P

Mostly kidding.

Turns out, the thing I decided to do (start my own company with a heavy open- source emphasis, building something I hope will prove to be useful) was actually perfectly in line with the professional goals I had set myself, so I'm not sure it was exactly a wasted exercise.

Short-term plans can be somewhat detailed, but long-term plans should be vague enough to leave you plenty of room to adapt - for me the point of such plans is to provide some "rules of thumb" or rough guidelines when making big decisions.

Stuff (life) will happen no matter what plans you make, but there are lots of little choices to be made and if you've spent some time thinking about what you want to achieve long-term, that can make hard decisions just a tiny bit easier.

Whether it "works" or not is impossible to say, ask again in 30 years. :-)

</comment><comment><USER10> I have personal goals. I want to have all of my personal startup debt paid off by the end of next year (as I absorbed a lot initially and didn't pay it off when I should've, more fool me). I want to start paying off heavy chunks of my mortgage immediately afterwards. I'd like to fork() in the next year or two. I want to lose at least another 8 kilos before the end of the year.

I used to spend ages working on my business plan, updating it and so on. It was about 30 pages at one point. Then I realised that actually it was all fiction, except for that which already happened. So instead of planning I have a general idea of what we're doing and where we're going for the next quarter, six months and year in less detail the further you get out, and I use the information we get from sales, customer feedback and other areas to tweak the outline plan. There are no figures in the outline plan. They're worthless.

</comment><comment><USER11> Certainly; I've had good success so far in life with long-term goals.

Achieved:

* Graduate college in three years.

* Get a job in the tech sector that I enjoy.

* Marry the girl I love.

In-progress:

* Pay off my house in the next three years.

* Buy a large parcel of land (50+ acres) where my wife and I can build our dream house.

Still to be determined:

* Retire by 35 so I can spend my time on my terms.

There's nothing like the feeling of setting a big goal and eventually checking it off your list.

</comment><comment><USER12> I find that such goals, for me, don't work. I make daily and weekly goals (sometimes monthly) as that is about as far out as I can realistically plan. Anything much longer and I'm just fooling myself (and it has taken me a couple of decades to realize this).

Now, I am not an especially organized or focused person. My wife, who is laser focused and organized as precisely as the layout of a microchip, can make such longer term plans. I'm usually just pleased to have remembered to hit the bathroom far enough in advance of my noon meeting that I am not late for it and not left squirming in my chair halfway through (I'm serious).

</comment><comment><USER13> I am probably cheating, but:

(I'm 18 now) 1\. Finish Senior Year 2\. (College) Dual Major in CompSi and EE 5/2. Grad school if I have patience 3\. Experience working for companies like Google, Nvidia, Intel, ect. 4\. Start a (successful) startup

__

Annnnnd that's where I want to be in several years- well that's quite a bit more than five year, but it's where I want to be.

I know that some of those goals are clearly accomplish-able, and I'll be happy to answer any questions on if I think the others are likely. As for me- I've been programming for several years, and I've known what I want to do for quite a while.

</comment><comment><USER14> The last 5 year plan i made is to creating my own religion and currently i'm down to last year. It take a tonne of research to pull it off in the allocated time but somewhat doable. Since, my interests have gone off tangent the goal i set 4 years ago hardly matters. Now i'm hoping to get my startup realised and hopefully get taken in by the next few cycles. In a way setting goal(s) never work for me because i'll always look to something else to lust over. The only goal that's been consistent so far is to marry a supermodel.

</comment><comment><USER15> I find life goals and 3/5 year plans much more useful to me than the shorter- term 1-6 month goals. For example, "Go get your Ph.D." or "build a company with N employees" are longer-term goals and, more importantly, not the kind of thing you are likely to happen into either in the absence of any planning or with the tunnel-vision goal planning usually employed in your workplace or by many of the GTD folks I meet (other would of course would reply,"they're doing it wrong").

</comment><comment><USER16> I've done annual "chartering sessions" with my wife, where we write down values and goals, and what things we need to do to realize those goals while sticking to our values. Of course we don't follow our plans exactly, because life usually gets a good laugh out of our plans. But the annual sessions are a great way to make sure we're still the couple we want to be, living the life we want to live.

</comment><comment><USER17> I find fault in actually planning something 3/5 years in advance. It almost never happens, stuff you dont foresee comes up, its pointless to have a 3/5 year plan.

Personally i try to only plan my next 24 hours. I have goals in my life but they're not restrained to a specific timeline. The best thing to do is to get yourself in as good a position as you can be to execute a goal you have, then go for it.

</comment><comment><USER18> I would create a vision of who and where I would want to be in 5 years, however I would focus on the next few months on creating solid goals and plan on achieving them.

I believe goals are powerful as they do help you set a target for where and who you want to become. But you really need a good plan on achieving those goals, because without a solid route it's harder to get from point A to point B.

</comment><comment><USER19> I use Goal Mapping:

[http://www.petermichaud.com/essays/stop-planning-right- start...](http://www.petermichaud.com/essays/stop-planning-right-start- planning-left/)

[http://www.petermichaud.com/software/goal-mapping- alpha/comm...](http://www.petermichaud.com/software/goal-mapping- alpha/comment-page-1/)

</comment><comment><USER20> Not tech/startup/business related but I just made it a goal to climb the nose of El Capitan in 5 years.

<comment><USER21> I spent a summer in Utah and Wyoming a couple years back climbing in various spots, and have been pretty addicted to it ever since. Needless to say, I can definitely appreciate that goal!

<comment><USER20> Yeah I have a ways to go but a good amount of time to get there. If you aid the harder parts of it then it's not insurmountable. It's really getting over the 3000' of air below you, coming to terms with sleeping on the side of a sheer cliff, and pushing on huge pieces of granite that are not attached to the wall anymore(see texas flake).

Gonna be fun though. It is amazing how addicting climbing is though.

<comment><USER21> Definitely -- I can't imagine the 3000', as the most air I've ever had beneath me was about 250'.

Let everyone know when you do it!

</comment></comment></comment></comment><comment><USER22> It makes sense to have both short and long-term plans. You should have 3 year plans not because you'll actually follow them to the letter, but because it'll make you think about where you want to be in 3 years.

"Plans are useless but planning is indispensable." \--Dwight Eisenhower

</comment><comment><USER23> I am an AVID goal setter. I personally use a service called 43things.com that allows you to add your life goals, prioritize them and get advice from people who have completed the goals you want to accomplish. :)

Good luck in creating the life you want to live.

\- Apps

</comment><comment><USER24> "Life is what happens to you while you're busy making other plans" \- some wise guy

<comment><USER25> -John Lennon

One of my favorite quotes, btw.

</comment></comment><comment><USER26> I constantly consider and rework my goals and life strategy. I even keep my highest level goals on my website: <http://dustyreagan.com/goals>

</comment><comment><USER27> Yes, and I change them ALL THE TIME. But I see this as a really good thing. I find life is easier when I know where I'm going, and I don't mind so much if it's in the wrong direction.

</comment><comment><USER28> I find that the goals I set for the furthest time in the future are the goals I'm most determined to complete. So for me, the further you set a goal, the more likely it will come true.

</comment><comment><USER29> I have life goals but not 3/5 year plans - more just where I want to end up.</comment>


Equity Accrual Renting – A new form of home ownership — YC-R: New Cities - <AUTHOR> https://docs.google.com/document/d/1QBINYkFfWc2XJLQw9Gge6qXyxGPqhEuAE01gjOSBrWw/ <comment><USER2> Do these guys understand that rent-to-own financing is already a thing? The concept got a lot of play when the Great Bubble blew up and left a lot of underwater borrowers in foreclosure. This article doesn't address title issues or other problems with rent-to-own. Or even the vagaries of the housing market. What they're describing is a 20-year mortgage on a schedule that pays down 5 percent of the principle each year, with the title presumably held by the seller throughout. A homeowner's equity is the market value of the house less any debt still owed on the house. Market value is subject to volatility, so assigning equity by schedule makes no sense.

</comment><comment><AUTHOR> Please do give any feedback you have.</comment>


Complex Animals Led to More Oxygen, Says Maverick Theory - <AUTHOR> https://www.quantamagazine.org/scientist-questions-the-link-between-oxygen-and-cambrian-animal-evolution-20180321/ <comment><USER2> It could be a combination of both theories. Increased oxygen allowed animals take deeper vertical dives, and these deeper dives created yet more usable oxygen, making even more deeper dives possible. It could be that animals first had to reach a threshold of complexity to trigger the feedback cycle.

For example, there's less need to hide in the depths from predators if the predators are wimpy, and predators without enough oxygen will stay wimpy. The diving energy expenditure is not worth it under wimpy predation. Capability to dive deep enough and the predator/pray competition both had to reach a level to trigger the feedback cycle. Earlier generations couldn't get either the depth nor be potent enough predators because they were too primitive.

<comment><USER3> Does diffusion of oxygen really need active mixing? I would have assumed even with a low oxygen atmosphere the oceans would slowly get saturated with oxygen by diffusion and existing currently

Or do they mean that the rate needs to be diffusion higher than at what the animals are consuming it? That's a interesting question. Do animals actually make a dent in the ocean's oxygen content? If their rate of consumption is small enough it probably doesn't matter too much.

<comment><USER4> I mean, the guy putting forward this theory is an expect in fluid dynamics. So I expect the answer is "yes, animals do make a big impact on oxygenation of the ocean".

Here's another study from 2014 that talks about the link between animals and oxygenation of the oceans. (This paper just focused on the mixing of oxygen in the ocean, it doesn't claim that more ocean-oxygen led to a higher oxygen world like the OP. [https://www.sciencedaily.com/releases/2014/03/140309150540.h...](https://www.sciencedaily.com/releases/2014/03/140309150540.htm) )</comment></comment></comment>


VideoLectures.net - YouTube for hackers - <AUTHOR> http://videolectures.net
<comment><USER2> It's great idea. Youtube sucks for finding actually something educating. Arrington, I know you see this! You should cover this in TC.

</comment><comment><USER3> That's just one site of video lectures.

I have collected a few hundred of links to various video lectures:

<http://freescienceonline.blogspot.com>

</comment><comment><USER4> Someone likes machine learning...

Machine Learning (581) Total Videos (1520)

581 / (1 520%) = 38.2236842%

<comment><USER5> The machine learning lectures here are of fantastic quality. I hope this is the future of academia.

</comment></comment><comment><USER6> <http://www.lecturefox.com/computerscience/>

</comment><comment><USER7> This needs a 'download as MP4' link so I can watch it on my Video mp3 player

<comment><USER8> mplayer -dumpstream URL -dumpfile microsoft.corruption.wmv

</comment></comment><comment><USER9> Glad this exists. Would appreciate a less 'busy' design though.

</comment><comment><USER10> Killer idea - potential to create a lot of value for people

</comment><comment><USER11> Anyone find any particularly interesting lectures?

</comment><comment><USER12> Very cool</comment>


Show HN: Blockchain Implementation Using MongoDB - <AUTHOR> https://github.com/hoanhan101/blockchain-db <comment><USER2> Hey Hoanhan101, Love that you are working on this. I see listed in to-do's introduce multiple nodes.

I am working on a similar idea, to build a blockchain as a datastructure application. Would love to talk in more detail</comment>


YubiKey 4C - <AUTHOR> https://www.yubico.com/product/yubikey-4c/ <comment><USER3> I REALLY wish it were possible to use one of these devices without using your hands. I'm quadriplegic and would love to use one of these to unlock my computer, bank passwords etc etc. But you have to touch a finger to almost all of them to trigger the OTP, or whichever authentication and they happen to be using. I would absolutely love to be able to lock and unlock my Mac without an able-bodied person helping me, because really what is the point of me having a password if I tell it to a third party?!

Obviously the vast majority of people who use these devices are able-bodied and are able to use them as designed, but if somebody solves this problem there really is a market for it. They are great products, and if it weren't for this one stumbling block I would definitely be using them in my daily life. The inside of my laptop is the only privacy I have, and being able to have complete control over the locking and unlocking of it would be amazing.

It would be great if Apple made it possible to use the accessibility software on the login screen, that way I could tap in my own password but you can't use the accessibility software until you are inside the OS. Grrr.

Anybody got any ideas about how I could solve this, or any direction I could investigate?

(Sorry for mildly hijacking the thread, but thought it was somewhat relevant)

<comment><USER4> You could buy an Apple Watch and use that to unlock your Mac based on vicinity: [https://support.apple.com/en- us/HT206995](https://support.apple.com/en-us/HT206995) Only works on newer MacBook though.

<comment><USER5> 1\. enter company you don't work at and steal laptop at lunch hour

2\. walk to cafeteria with laptop that looks like any other. let owner watch unlock it for you.

3\. profit!

4\. optional, return laptop before lunch is over for full stealth.

<comment><USER6> There are a lot of attacks one can imagine when you have physical access to hardware inside the building. Why not just boot to a thumb drive and install malware?

<comment><USER7> Because the computer is locked?

<comment><USER8> There have been successful attacks on locked macs via the thunderbolt port.

I'm thinking of one in particular which I can't find at the moment, but I remember seeing a really fantastic video where one guy described in detail how he reverse engineered the mac thunderbolt interface and was able to flash malware bootcode on to it even when locked. Once that malware was installed, it could do pretty much anything, including get encryption keys to your hard drive, intercept all keystrokes, etc.

If anyone has a link to that, please post it here.

Also, there this:

[https://news.ycombinator.com/item?id=7123121](https://news.ycombinator.com/item?id=7123121)

</comment></comment></comment></comment></comment></comment><comment><USER9> Until these things work well with phones, I can't buy into them. I have a U2F key that I use as a shortcut for accessing things like Google's services. But I am sticking to always using either Google Authenticator or SMS, if it's available, as a primary option. When I am looking at a website in bed on my phone, and my YubiKey is in my laptop downstairs, I can't say I am happy that I can't access my account.

I think the form factor for these things is just wrong. I don't always have my keys with me. I do have my phone much more frequently. Even more frequently I have things like my Pebble. Maybe some kind of NFC interface with a wrist watch would be a better alternative.

<comment><USER10> I think I'm not understanding the problem. I have cloned keys (for backup + two locations), with Yubico Authenticator. Is the problem NFC on iOS or that you don't want to clone your keys?

<comment><USER9> My problem is that while I can reasonably guarantee that my YubiKey will be near my laptop when I use it, I generally can't guarantee that my YubiKey will be near my phone or tablets when I use them. I also don't really want to keep plugging in a physical key into my phone every time I want to log into, say, American Airlines to check the status of my flight, or into PapaJohns.com every time I want to order a pizza.

NFC makes this a little easier, but I still usually don't keep my keychain (that is my physical keychain with my house and car key) on my nightstand, while I do keep my phone there.

tl;dr: Laptop + 2nd Factor = YubiKey. That's OK and it works.

Phone/tablet + 2nd Factor = ???

<comment><USER10> Makes sense. Thanks. It seems as if what I would consider "natural usage" is a bit different than yours. I don't use my phone to access anything critical -- the attack surface is too big and changes too rapidly (sometimes outside of my control) for me to keep track of -- and I wouldn't worry about safety when checking a flight.

<comment><USER9> I consider most things critical. I treat my dating profile or my HN credentials the same way I treat me main email account's credentials.

</comment></comment></comment></comment></comment><comment><USER11> Do they work any better on iPhones?

\-----

I decided couple of months ago to secure entire family. Bought half dozen Neos, worked out all the kinks on my computer + Android phone first, put everything in LastPass (I know, I know, I know... but you have to consider the target audience ;).... only to discover on "go-live" that my wife's iPhone 6s is bloody useless with the thing. Apparently iPhone doesn't fully grok NFC or something? Not sure... :-/

<comment><USER12> Apple decided that users cannot use the NFC chip in it except for Apple Pay (for the foreseeable future). You don't really 'own' an Iphone in that sense.

<comment><USER11>
      users cannot use the NFC chip in it except for Apple Pay

That... boggles my mind :-O

Thanks for the info. My wife is unfortunately locked into iPhone due to work standard, but something to keep in mind long-term.

<comment><USER13> For U2F at least, Bluetooth solutions should be arriving. If Yubico does its on (they have said that they are working on it) they might additionally let you use the OTP stuff.

That said, LassPass says that when Firefox supports U2F, they will also try to support it. So maybe the OTP stuff is not that important.

Dashlane Password Manager already supports it.

</comment></comment></comment></comment><comment><USER14> Note that this isn't just a U2F key; if you're looking for a token principally to log into web services with, this isn't what you want, and the token that does that costs less than half as much (it's the U2F-only token).

You want a Y4 if:

* You SSH into sensitive machines.

* You log into a VPN that you control and can configure to use the Y4.

* You're actually relying on PGP.

<comment><USER15> Does anyone have a guide on how to store an SSH key on it? I only found PGP key guides (and I have my key on it), but not much for SSH. I also think it doesn't do ECC...

<comment><USER16> You can use the GPG key on the device for SSH authentication through gpg- agent. Here's their documentation[1] for this feature.

ECC keys should work, but haven't tried that (I use RSA-4096).

[1]: [https://developers.yubico.com/PGP/SSH_authentication/](https://developers.yubico.com/PGP/SSH_authentication/)

<comment><USER15> Thank you, I seem to recall trying gpg-agent but I'm not sure I went anywhere with it. Will try again.

</comment></comment></comment></comment><comment><USER17> So I got one 4 months ago and quickly found out that I understand next to nothing about it. I really thought it was going to be a plug-n-play solution but it was far from it. It took me nearly an hour to get my google account setup to use it. For some reason the little wizard thing on Google that "syncs" your yubikey was giving me trouble. After I finally got that part working i pretty much forgot about the whole thing. I had plans to also use it with KeePass in addition to Google but after reading that you basically have to hack this thing to work with both I pretty much decided it wasn't worth the effort. It's really sad how great this little thing is and how much of a pain it is to actually get any use out of it.

</comment><comment><USER18> I don't think that the people complaining about the price of this key appreciate all that it can do. Most of those people would probably be better off with the cheaper FIDO U2F Security Key.

I haven't found anything else that manages RSA Keys, TOTP auth and U2F in a single package. I'm going to buy this because it plugs into my pixel phone and it seems like it'd be more secure and convenient than my current Neo with NFC.

<comment><USER14> Annoying nerd pedantry: It's only sort of doing TOTP (Yubikeys don't have batteries, so need a software client to provide the clock), and on a slack with almost 300 crypto nerds in it, I don't know any of them that use the Y4 for TOTP (I'm preparing myself to be surprised in a minute when someone there reads this). TOTP is something you do on your phone.

<comment><USER19> TOTP with Yubikeys is great. You just need the Yubico Authenticator app to access the TOTPs. Works fine on phone using NFC as well as on my (Linux) desktop using USB. New phone? Install YK Authenticator, tap the YK and use your TOTPs.

<comment><USER13> How do you do TOTP on linux with your Yubikey? I keep using my phone.

<comment><USER19> Yubico Authenticator for Desktop:

[https://www.yubico.com/support/knowledge- base/categories/art...](https://www.yubico.com/support/knowledge- base/categories/articles/yubico-authenticator-download/)

If you're on Ubuntu you can use the package yubioath-desktop from this PPA:

[https://launchpad.net/~yubico/+archive/ubuntu/stable](https://launchpad.net/~yubico/+archive/ubuntu/stable)

</comment></comment></comment></comment></comment><comment><USER20> Until there's a YubiKey 4C nano, I'll wait. Having something of that size sticking out of my computer is not really practical. Not having it inserted defeats the whole point.

<comment><USER21> I'm kind of wondering what the benefit is over having something like Yubikey at all instead of something that's just software when you just leave it in all the time.

<comment><USER14> Your computer can in theory get owned up without you losing your SSH or VPN keys, even if your keystrokes are logged.

<comment><USER22> Get owned = SSH is hikacked = I don't need your keys and can run any commands on your behalf.

This thing might protect from keyloggers but useless against proper malware that just waits for you to authenticate.

<comment><USER13> If your SSH private key is on the Yubikey then you will not lose your private keys. Even in the case of U2F, the attacker will not figure out your U2F private keys or even all the places you are registered.

<comment><USER14> His point, which is correct, is that you'll persistently lose access to your server anyways, because a backdoored SSH client is almost as bad as a compromised key. I use a Y4 for SSH, but it's good to be clear-eyed about the limitations.

</comment></comment></comment></comment></comment></comment><comment><USER23> Why are Yubikeys so expensive? I have one and use them but the price always gets in the way of having more.

<comment><USER13> They do lots of stuff. A YubiKey 4 has GPG Smartcard, U2F, PIV (SSH,CA, Windows Remote Login), Static Password, Yubikey OTP, Challenge Response Mode (HMAC) and HOTP. It does a lot of stuff, I am amazed how cheap they are.

Pure U2F sticks can be done much cheaper. The Yubikey one only costs 18$, but the U2F standards was designed for cheap devices. You can get U2F sticks for less then 10$ on amazon.

<comment><USER24> Yup. they're a bargain compared to most solutions

</comment></comment></comment><comment><USER25> alternative is u2fzero, available on amazon for 8$, and totally open source. the difference is that yubi uses an nxp secure coprocessor, whereas the u2fzero uses atmel. there is the possibility of side-channel attacks on the u2fzero.

but for your family, it is better than nothing and much more cost effective.

<comment><USER12> > […] there is the possibility of side-channel attacks on the u2fzero.

Interesting. How does that work? Have you any references to that?

<comment><USER25> The Atmel chips do not claim that they have implemented counter-measures for power analysis, etc. Power analysis on a key operation is a dangerous attack if proper counter-measures are not taken. You can literally read off the 0/1 of each bit of the key as the key operation is underway if you monitor the power/timing.

The NXP chips inside the yubikey claim to be hardened against several such attacks (although I have not confirmed).

NXP is a cagey company. For example, I am a researcher, and I wanted to get the yubi-key's unlocked to write and test new u2f protocols on their hardware. They wouldnt sell me development keys, and claimed that the restriction was placed on them by NXP. I wrote half-a-dozen requests to the NXP people, and they never replied.

</comment></comment></comment><comment><USER26> I have a Yubikey, but almost never use it. I still don't get it fully, don't have a use-case where it totally works for me. Having one key is maybe part of the problem. If I lose it, what then?

<comment><USER14> Some people will tell you to buy two Yubikeys and leave one as a backup. I don't think that's necessary. No matter what, you should generate a backup software key and keep it on offline encrypted storage; if you lose the token, just use the backup key until your replacement arrives.

It's even easier for Github and Google Mail. For web services, the right stack is:

* Hardware U2F token

* Backup software TOTP (Duo or Google Authenticator or whatever)

* Backup printed (or saved on offline USB key) passcodes

* Disabled SMS.

Unlike SMS, which is devastating to security even as a fallback, having a software TOTP option is basically fine; most of what U2F buys you is unphishability. This leaves you with two levels of backup, one of which is reasonably secure indefinitely.

<comment><USER27> Can you disable SMS on google? I've tried and have been unsuccessful. Phone is required to enable 2FA. Once that is enabled, I can add yubikeys. After adding yubikeys, I am unable to remove phone as a 2FA alternative.

<comment><USER16> It's possible to disable SMS-based 2FA. Perhaps you need another backup option before you're allowed to remove the SMS option. In my case, I was able to do it with two U2F keys, TOTP and backup codes enabled.

You might need to remove it as an account recovery number as well. Those can effectively downgrade your login to one factor.

<comment><USER27> >you need another backup option before you're allowed to remove the SMS option.

This was the answer. Google prompt isn't allowed with hardware tokens. Backup codes evidently don't count. So the only way is to set up Google Authenticator on a phone. Authenticator from f-droid works. After I set up Authenticator, I no longer got the "Something went wrong. Try again" toast when trying to delete the sms number.

Edit: Just realized what Yubico Authenticator is for :)

</comment></comment></comment></comment></comment><comment><USER28> I've a yubikey4 but i'm not sure how/why i should use it. I get the 2FA case, where it provides the One Time Password to login in some services, sort of what the phone does with the authy app (or am I wrong?). But, what about the ssh access? Should the key be used to decrypt the ssh key when accessing a server? so that, if i grab anycomputer i can login on my server if I've the yubikey with me? if so, how should this work and how can I set it up?

<comment><USER16> You can actually store the key you use for SSH authentication on the Yubikey [1]. The main advantage is that the key never leaves the device, so even if your computer is compromised, your key is still safe.

Same thing goes for anything else involving GPG keys - email, signing git commits or tags, software releases, etc.

I don't personally use it for OTP. I do use it for services that support U2F (which is different from OTP, and has the main advantage of being immune to phishing).

[1]: [https://developers.yubico.com/PGP/SSH_authentication/](https://developers.yubico.com/PGP/SSH_authentication/)

<comment><USER28> i'll give it a look. the potetntial of this device is still not clear to me.

</comment></comment></comment><comment><USER29> Is it still closed source?

<comment><USER30> Yes, still closed source.

<comment><USER29> /me closes tab and gets on with day :)

[edit] Interested to know why people find the need to downvote this, I asked a question and got an answer. Please enlighten me so I don't err again.

<comment><USER12> > /me closes tab and gets on with day :)

Rude dismissive instant messaging language, that doesn't contribute anything to the discussion.

This wouldn't have received any downvotes:

> Ah shame. That's a deal breaker for me. Having open source programming on > the device itself is a must-have for me because of [insert reason].

<comment><USER29> Thanks for the clarification, I didn't think/mean it to be rude/dismissive but I can see how that was taken.

I'll refrain from inserting IRC commands in future too :)

</comment></comment></comment></comment></comment><comment><USER31> Great to have a USB-C option available, though bummer they didn't include NFC in this one

</comment><comment><USER32> Here's my hands-on review with the new YubiKey 4C: [https://news.ycombinator.com/item?id=13637771](https://news.ycombinator.com/item?id=13637771)

</comment><comment><USER33> Do any of these RSA alternatives have an LCD display showing the id? Our work computers are locked down and USB is not an option.

<comment><USER34> The OTP functions basically as a USB HID keyboard. So you can plug it into something that is not locked down (like a phone or tablet), and then just copy the code.

The drawback is that the code could be _long_. A few years ago, the codes were just 6 digits. My latest nano spits out a very long (20 char?) alpha-numeric string.

<comment><USER8> I wouldn't mind a 20 char string. I regularly type passphrases significantly longer than that.

</comment></comment></comment><comment><USER35> It looks neat, can someone share personal experience or recommendations? Is this worth it? Is there a better alternative?

<comment><USER36> I use a Yubikey 4 with the GnuPG smartcard applet to secure all my password, sign my emails and connect to remote computers with SSH. It's super convenient and I'd never go back.

That being said I got a bit concerned about the use of closed source components in newer yubikeys (I believe that the yubikey 4 is open source and the later ones aren't, but don't trust me on that).

For this reason I also bought a nitrokey as a backup. It's a bit slower than the yubikey (I use 4096bit keys) but it works well. I really don't like the plastic cap on the nitrokey though, I feel like I'd lose it within a week if I started using it as my main key. The Yubikey doesn't have any protection at all but it looks sturdy enough that it doesn't really matter. It's been on my keyring for months and it seems to handle the abuse just fine.

<comment><USER37> To be honest, Yubikey was never really open source. Sure, they open sourced _some_ compomnents before but you coulnd't do anything with the source.

</comment></comment></comment><comment><USER38> I was just looking around yesterday for a programmatic way to encrypt/decrypt a file with a USB fob. I used an Aladdin fob a while back for a similar project. The encryption was symmetric but the fob kept the key and it couldn't be exported - so it was safe enough for my application.

Is this Yubikey capable of something similar?

<comment><USER39> You could do OpenPGP encryption. It will generate a symmetric key, encrypt the data with it, and then encrypt the symmetric key for the yubikey's pubkey.

</comment></comment><comment><USER40> I wish you could use these with macOS's CoreStorage to unlock FileVault 2's full disk encryption in combination with a password. I wonder if it'll be possible at any point...

<comment><USER41> I've done OSX authentication (mainly adding 2FA to the login screen), and Apple doesn't provide any mechanism to interact with unlocking FileVault.

However, with the Yubikey you can type in your password, then have the Yubikey enter your static password. That way you sort of get 2FA for the unlock screen.

</comment></comment><comment><USER42> I bought a HyperFido but it just doesn't work on Ubuntu...

Was expecting to be able to use it to log in to Google using their 2FA key.. but only works on Windows from what I can see...

Anyone know anything about this?

<comment><USER13> Probably a udev problem, you need:

[https://developers.yubico.com/libu2f-host/](https://developers.yubico.com/libu2f-host/)

or maybe even better:

[https://github.com/amluto/u2f-hidraw- policy](https://github.com/amluto/u2f-hidraw-policy)

On the Yubikey its also possible to deactivate individual modes. If somehow U2F mode was disabled, it should not work anywhere, but if you don't use the other modes, maybe deactivate them. In earlier version there were some problems.

Probably its the first one.

</comment></comment><comment><USER43> Make the price $5 and these will sell.

<comment><USER13> These keys will never be $5 but pure U2F only keys are almost already there. You can get U2F keys for 8-10$ already.

</comment></comment><comment><USER44> Kind of useless to have a C-only device this early. An A/C-hybrid would be much more useful, like Kingston's MicroDuo[1] series.

[1]: [http://www.kingston.com/us/usb/personal_business/DTDUO3C](http://www.kingston.com/us/usb/personal_business/DTDUO3C)

<comment><USER45> It's an authentication key, not a flash drive.

<comment><USER46> The same point still applies.

</comment></comment></comment><comment><USER47> They appear to be sold out already.

</comment><comment><USER48> What are the current alternatives to Yubikey?

Preferably looking for something open-source and in no way associated with Google.

<comment><USER49> I haven't used it, but Trezor looks interesting, and there is a Trezor 2 coming soon. [https://trezor.io/](https://trezor.io/)

The sweet spot is for Bitcoin wallets, but it does the other stuff (U2F, ssh, gpg, passwords). Hardware is interesting. Everything open source. You can add your own "apps".

U2F: [https://blog.trezor.io/secure-two-factor-authentication- with...](https://blog.trezor.io/secure-two-factor-authentication-with- trezor-u2f-e940fd5a60af)

<comment><USER13> I use both this and Yubikeys.

The external screen add even more security and that is very cool. UAF/U2F both have support for external monitors in the protocol, so its really good security.

The ssh/gpg stuff is less advanced then that of the Yubikey, all guides suggest running some special scripts. With the Yubikey you can set it all up so this is not needed. Maybe this works with the Trezor, but I didn't find any guides for this.

I really want Trezor to support UAF as well, given that it has a PIN entry system, this should work.

If you need a Bitcoin Wallet, Trezor is cool, if you want a tool primary for login (U2F/OTP/TOTP), a Yubikey is preferable.

</comment></comment></comment><comment><USER50> I still don't get how people are ok using these things without a fingerprint reader...

<comment><USER30> Wouldn't that make it 3FA? I'd need my password, my physical key _and_ my fingerprints?

<comment><USER51> One could then argue the Google Authenticator app running on my iPhone is 3FA, as one needs to be able to unlock my iPhone to access it.

<comment><USER52> I would definitely argue that it's 3FA.

* Something you know - the service's password

* Something you have - the phone with the authenticator

* Something you are - your fingerprint

EDITED - <USER2>

</comment></comment></comment></comment><comment><USER53> Remember that closed source security-related products are a complete joke and you should spend your money somewhere else.

<comment><USER54> Reminder that open source projects are not provably more secure, nor is it easy (or even possible in many cases) to assert the source you see made the binary in question.

Yubikey has been around a long time and has made every effort to be a transparent company with a support for open source. Truth is, that is sometimes hard to do.

I found this article rather interesting, back when it first came out: [https://www.yubico.com/2016/05/secure-hardware-vs-open- sourc...](https://www.yubico.com/2016/05/secure-hardware-vs-open-source/)

<comment><USER53> I've seen that article and it's a heap of crap. There's no reason they couldn't make the firmware read-only so you could verify it, then publish the source to audit and verify against.

>Reminder that open source projects are not provably more secure, nor is it easy (or even possible in many cases) to assert the source you see made the binary in question.

I can (and do) read the code for security-related software, and I can at least check for obvious backdoors and flaws myself. With reproducable builds it is possible to assert the source you see made the binary in question (and security related software _must_ support reproducable builds for this reason).

If you want to convince yourself the product is secure, that's up to you, but it's not.

<comment><USER54> You obviously didn't read the article. There is no way for you to actually do that. And the secure platforms themselves have NDAs around their specs and software tooling.

So yeah, there is a reason they didn't do that. The hardware they're using specifically makes it difficult to do the verification you want to do. Which is directly related to foiling the kind of attacks they want to foil.

> If you want to convince yourself the product is secure, that's up to you, > but it's not

I think we have the same goal, but you have a conviction that open source stops "obvious back doors." It in no way would help that at all in this case. The hardware is configured before it is shipped, then locked in a way designed to prevent rewriting or inspection. You have no rational basis for the belief that the source code on a website and the binary a malicious and deceptive actor would deploy to the hardware are the same thing.

Being open source only affects the way security auditing can be done. It doesn't guarantee better quality.

<comment><USER53> I have read the article, several times, thank you very much. Don't take the easy way out by dismissing the opposition as ignorant.

>So yeah, there is a reason they didn't do that. The hardware they're using specifically makes it difficult to do the verification you want to do. Which is directly related to foiling the kind of attacks they want to foil.

Then they've chosen the wrong hardware. This doesn't make it more secure, it just explains why their product is _insecure_.

>I think we have the same goal, but you have a conviction that open source stops "obvious back doors." It in no way would help that at all in this case. The hardware is configured before it is shipped, then locked in a way designed to prevent rewriting or inspection. You have no rational basis for the belief that the source code on a website and the binary a malicious and deceptive actor would deploy to the hardware are the same thing.

I already addressed this - reproducable builds. I don't have to take anyone's word for it.

<comment><USER54> > Then they've chosen the wrong hardware. This doesn't make it more secure, it > just explains why their product is insecure.

If the hardware is more resistant to hardware and software attacks, it seems odd to then deem it less secure just because you don't get source code that isn't guaranteed to correspond to a given binary.

> reproducable builds

There's so much literature on how this methodology fails, some of it quite famous. There is no assurance that your device conforms to the build you can reproduce, unless you can arbitrarily inspect the state of the entire device at each step. Being able to do that would defeat the purpose of these devices.

<comment><USER53> >If the hardware is more resistant to hardware and software attacks, it seems odd to then deem it less secure just because you don't get source code that isn't guaranteed to correspond to a given binary.

It may be, but there's no guarantee it behaves the way it claims to. There's no guarantee it's not backdoored. There are powerful actors involved in these areas.

>There's so much literature on how this methodology fails, some of it quite famous. There is no assurance that your device conforms to the build you can reproduce, unless you can arbitrarily inspect the state of the entire device at each step. Being able to do that would defeat the purpose of these devices.

Care to cite some of this literature?

<comment><USER54> > It may be, but there's no guarantee it behaves the way it claims to. There's > no guarantee it's not backdoored. There are powerful actors involved in > these areas.

It renders your point about source code moot though, doesn't it. Security is ultimately the art of trust propagation.

> Care to cite some of this literature?

The most famous discourse here is the "untrustworthy compiler problem." Most famous citation is by none other than Thompson: [https://www.ece.cmu.edu/~ganger/712.fall02/papers/p761-thomp...](https://www.ece.cmu.edu/~ganger/712.fall02/papers/p761-thompson.pdf)

Trust chains are their weakest link, and people often put a lot of trust in compilers without really asking what it is doing. Not unlike crypto, we're told not to roll our own.

People have proposed ways around this, but they're not very good ([http://imgur.com/a/BWbnU#0](http://imgur.com/a/BWbnU#0)). The moral of the story is that at some point, you extend trust to someone. Security is never absolute.

<comment><USER53> >It renders your point about source code moot though, doesn't it. Security is ultimately the art of trust propagation.

I don't see how that follows. If I can audit the source code and confirm that the same code is running on the device, the weak link is reduced to my ability to aduit it (combined with everyone else who's auditing it as well and might publish their findings).

>The most famous discourse here is the "untrustworthy compiler problem."

I thought this might be what you're talking about, but this is ridiculous. Do you really think that the Yubikey folks have backdoored my copy of gcc? Dude.

<comment><USER54> > the weak link is reduced to my ability to aduit it (combined with everyone > else who's auditing it as well and might publish their findings).

And if the hardware itself has microcode that overrides your code?

> but this is ridiculous. Do you really think that the Yubikey folks have > backdoored my copy of gcc?

Actually, I think the first and foremest threat would be, "Could someone insert a yubikey into a malicious device that changed its behavior such that it now leaks information and does not provide actual security."

Because those kinds of attacks actually exist. Ultimately, what you're arguing for is the pleasure and moral superiority of being able to do that audit. Not only does that audit not give you many guarantees, but giving you the ability to do that audit opens you up to much more sinister attacks.

<comment><USER53> >And if the hardware itself has microcode that overrides your code?

Hard to defend against this, but it can be helped by using well understood architectures and letting us confirm that the microcode being run is the same microcode that the upstream CPU vendors are publishing.

>Actually, I think the first and foremest threat would be, "Could someone insert a yubikey into a malicious device that changed its behavior such that it now leaks information and does not provide actual security."

I'm not going to keep entertaining this discussion if you keep disregarding everything I've already said. I've already said I'm only asking for _read- only_ access. In any case, defending against physical compromise is close to impossible anyway.

<comment><USER54> > if you keep disregarding everything I've already said. I've already said I'm > only asking for read-only access.

And I've addressed that.

> In any case, defending against physical compromise is close to impossible > anyway.

This is a non-statement. I think your religion is getting in the way of further discussion. Goodbye.</comment></comment></comment></comment></comment></comment></comment></comment></comment></comment></comment></comment>


Sony Cancels PlayStation Vue - <AUTHOR> https://www.playstation.com/en-us/network/vue/faq/plan-updates/ <comment><AUTHOR> That's disappointing. I've used Vue for a few years and have been very happy with it.

I'm not interested in YoutubeTV as I just don't trust Google.

Anyone tried Hulu, or any other alternatives? What's a good option to get live sports without too much fuss?</comment>