Netgear Signed TLS Cert Private Key Disclosure - <AUTHOR> https://gist.github.com/nstarke/a611a19aab433555e91c656fe1f030a9 <comment><USER3> Some commenters are decrying that this post fails to meet the bar for "responsible disclosure".

Please stop using that phrase. "Responsible disclosure". It's wrong and _harmful_ , and the person who coined it agrees with me: [https://adamcaudill.com/2015/11/19/responsible-disclosure- is...](https://adamcaudill.com/2015/11/19/responsible-disclosure-is-wrong/)

You want "coordinated disclosure" instead.

Netgear doesn't do coordinated disclosure. They do non-disclosure. In the absence of a coordinated effort, full disclosure is the responsible thing to do.

<comment><USER4> It should be noted that it's essentially _never_ the people who find bugs arguing for "responsible disclosure".

It sure is easy to tell others what to do with their work product when you have zero stake in the game.

There exists a really easy solution to the purported problem of full disclosure, vendors could just offer significant enough financial compensation for non-disclosure.

<comment><USER5> I think the millions of people with Netgear equipment deployed have some "stake in the game".

How does non-disclosure benefit them?

<comment><USER6> > _How does non-disclosure benefit them?_

And how does dumping the vulnerability without a fix help Netgear owners? They're all flapping in the wind right now.

IMHO, the best scenario is coordinated disclosure. Full disclosure may be necessary to force a vendor to do something, but let us not pretend it is a good thing.

<comment><USER7> > And how does dumping the vulnerability without a fix help Netgear owners?

It lets us know to buy another brand immediately and never buy Netgear again.

> IMHO, the best scenario is coordinated disclosure

The original post said that Netgear doesn't do coordinated disclosure, and subsequent posts were arguing whether non-disclosure or full disclosure were better. Nobody was disagreeing with what you said.

<comment><USER8> Netgear making worthless routers isn't really news.

</comment></comment></comment></comment></comment></comment><comment><USER9> Netgear has reliably demonstrated to me over more than 10 years that they are incapable of delivering secure products of an acceptable quality. I actively avoid this brand like the plague.

<comment><USER10> I have posted this in another thread, but I am posting it again because more people need to be aware of Netgear's practices:

I recently bought a couple of Netgear Managed Switches (for Business)⁰ and in their datasheet they list "Local-only management" as a feature. Only after they arrived we discovered that you only get limited functionality in the Local-only management mode, you have to register the switches to your Netgear Cloud account to get access to the full functionality.

Reading up on it, this was achieved only after a community outcry because in the prior firmware versions the switch would have to connect to the Netgear Cloud on every bootup.

Needless to say I would not have bought the swiches if I had knew I needed to register them to Netgear Cloud to have access to the full functionality specified in the data sheet. If I had bought them as a consumer, not as a business, I would have returned them immediately.

Netgear are now on our purchasing blacklist.

⓪ - the switches are Netgear GS-108Tv3

<comment><USER11> >Netgear Managed Switches (for Business)⁰

>⓪ - the switches are Netgear GS-108Tv3

are we not allowed to use any sane method of doing footnotes? Who does this? Why would you even use footnotes in internet comments other than to specifically screw over anyone who uses a screen reader?

<comment><USER12> > are we not allowed to use any sane method of doing footnotes?

There is no markup on HN for footnotes. [https://news.ycombinator.com/formatdoc](https://news.ycombinator.com/formatdoc)

> Who does this?

Blame the people running the site, this is just a small inconvenience compared with other lack of features.

> screw over anyone who uses a screen reader?

As GP's footnote is plain text – not markup – there is no problem with screen readers (or any user-agent, really). Curious why you would think otherwise.

<comment><USER11> Because it interrupts the flow completely when they could have just written the model number along inside of the already-used parens like a normal human being. With a screen reader, it'll get to the superscript 0, read that out, and then won't be able to read the actual footnote content until the very end. Can't jump around like our eyes can. "⓪" isn't even read by a screen reader (at least not narrator on windows 10). Footnotes in internet comments are useless and unnecessary anyway.

</comment></comment></comment></comment></comment><comment><USER13> I discovered this same thing in 2017. My bugcrowd report was shot down as dupe

[https://www.chaoswebs.net/blog/tls-key-reuse-on-popular- rout...](https://www.chaoswebs.net/blog/tls-key-reuse-on-popular-router- models.html)

<comment><USER14> The difference is that these newly discovered certs with private keys were signed by real Certificate Authorities trusted by browsers by default.

<comment><USER15> So their security got worse. It's a miracle people even bother attempting to do responsible disclosure to fools like this.

<comment><USER16> > so their security got worse

Only because current browsers makes it increasingly hard to run medium security, user-trusted networking.

</comment></comment></comment></comment><comment><USER17>
        Tuesday, January 14th 2020 - Initial Discovery

        Tuesday, January 14 2020 - Tweet sent attempting to establish communications with Netgear

        Wednesday, January 15 2020 - Reached out to Bugcrowd to attempt to establish communications.

        Thursday, January 16 - Bugcrowd responds, but we are unable to establish a communications channel outside of the Netgear bug bounty programs.

        Friday, Jaunary 17th - Conversation with bugcrowd proves inconclusive

        Sunday, January 19th - Feeling we have exhausted our disclosure avenues, we decide to publish

I didn't understand, can someone explain this to me - I see the author tried to talk to Netgear, then it's BUgcrowd the next day... it's not clear to me what the relation between Netgear and Bugcrowd is.

<comment><AUTHOR> Bugcrowd run bug bounty programs like [https://bugcrowd.com/netgear](https://bugcrowd.com/netgear) on behalf of companies

They explained earlier that if they entered the bug bounty program with Netgear, they would be agreeing to not disclose: "By submitting the security bug, you affirm that you have not disclosed and agree that you will not disclose the security bug to anyone other than NETGEAR."

So it seems they were trying to get Bugcrowd as a intermediary to contact Netgear on their behalf to "establish a communications channel outside of the Netgear bug bounty programs"

<comment><USER17> Thanks for the explanation!

</comment></comment></comment><comment><USER18> Netgear picked a terrible and clearly unacceptable approach. I I read through this discussion, trying to understand if there exists a good solution.

Using plain http isn't a good solution because it involves telling the user to ignore the "not secure" warnings by browsers. This seems like the best available solution.

Without network connectivity, the traffic can not be tunneled through a remote server with proper cert. Nor can the box request a cert in realtime at the time of setup.

Pre-provisioned cert won't work if the box is purchased more than 27 months after manufacturing (the current max validity period). For home network equipment, I suppose this isn't unusual.

I see TLS-SRP mentioned in comments. But the commenter hinted at its limited adoption in browsers.

<comment><USER19> When I can control the client configuration, I just set up my own trusted root CA and then have the distributed systems automatically submit a CSR on initialization. This doesn't work when you have to support end user's web browsers though (unless you're somehow lucky enough to own a public CA and don't care about ICANN rules). It really does seem like there should be an encryption-only option for TLS. Maybe anything that resolves by IP address and not name should display the green padlock even if the SAN doesn't match the name?

<comment><USER18> Encryption-only TLS doesn't protect MITM. It prevents sniffing.

At a higher level, TLS provides integrity and privacy when the network linked is not trustworthy. As a result, I'm not sure what your proposal achieves.

Similarly, resolution by IP address does not provide privacy or integrity unless you trust the network link.

<comment><USER19> The green padlock indicates two things about the server to the user: "This is really my name" and "no one can snoop on our conversation." It doesn't indicate anything about the trustworthiness of the server. The first one is meaningless in the context of an IP address. If a user is going to get pished by an IP address, then they could just as well get phished by 123.sketchydomain.com. The important part when communicating directly with a device by IP address, is that the payload is encrypted end to end.

> Similarly, resolution by IP address does not provide privacy or integrity > unless you trust the network link.

That's a fair point. It's certainly no worse than our current situation where you have to trust a self signed certificate on a case-by-case basis. The router could forge a self signed certificate even more easily than it could forge a certificate signed by a trusted CA.

<comment><USER20> > The important part when communicating directly with a device by IP address, > is that the payload is encrypted end to end.

Which you can't be certain of unless you can verify where the "end" actually is. The IP address is no help here; the ARP cache can't be trusted. Packets can be redirected to any host on the local network regardless of the official IP address assignments. If you aren't authenticating the other end of the link then you can't be sure no one is snooping. Active MitM attacks on local networks are trivial. You don't even need to compromise the router—any peer on the network will do.

> The router could forge a self signed certificate even more easily than it > could forge a certificate signed by a trusted CA.

Sure. As a form of TLS without authentication, one-time-use self-signed certificates would be worse than useless, offering only a false sense of security. The options here are "trust on first use" (betting against a malicious actor being present during initial setup) or offering some way to manually verify the fingerprint of the device's private key. Both approaches require authentication, not just encryption. For the second, more secure option, the cheapest way would be to permanently provision each device with a unique private key and print the key's fingerprint on the device's exterior. For more flexibility, store the key in a small removable HSM (similar to a SIM card) and print the fingerprint on the HSM itself and/or the accompanying documentation.

</comment></comment></comment></comment></comment><comment><USER21> The HTTPS cert is used for the router's login page - apparently putting an IP address on the box backside label confuses too many people. It makes sense to put it behind HTTPS because the browser _will_ whine "this page is insecure"... but how is a router vendor supposed to include the neccessary certificate that won't get leaked?

The only thing I can imagine here is a dedicated HSM chip... but that's overkill for a 10$ router?

<comment><USER22> 1\. Just let it be HTTP. Stupid browsers are stupid, but at least they don't prevent this page from working yet.

2\. Router coordinates with company server to get its own hostname like n-123123123.netgear.com (which points to 192.168.1.1 or whatever), generates private key and company server issues certificate for that key. HTTP requests to 192.168.1.1 return HTTP 302 to this address. It requires Netgear to operate CA or make some extended agreement with existing CA to let them issue certificates. I know that Plex does something similar, so it should be possible.

3\. Company server creates hostname which points to a public router IP address and router uses letsencrypt to get a certificate for that hostname. But that requires public IP and some providers are using NAT nowadays, so it won't work universally.

4\. To configure a device you're talking with company server, rather than your device and your device is talking with that server as well. It requires working Internet, so not a complete solution as well.

I don't believe that HSM chip would work. You would just extract that chip and use it as a private key and that's about it. You won't be able to extract private key bits, but you don't need them. May be it might work with very secure device like iPhone, where everything is signed, but yeah, $10 device and someone will still hack it, causing bad situation.

<comment><USER23> All but one make for an undesirable UX during initial setup before WAN is up, which is probably the only time most users login to their router.

<comment><USER22> Yeah, that's why I think that movement to HTTPS everywhere must at least exclude private IP addresses. While it's expected to have HTTPS on public resources, what happens in my local network is my business and should not be considered insecure.

<comment><USER24> The problem is, that someone setting up a public wifi (in a restaurant for example), will be vulnerable to sniffing attacks (if they don't know what they're doing).

<comment><USER25> So get a cert before setting up wifi. This is not a hard problem. 1\. Connect to AP with random key from the box 2\. Open admin panel over HTTP 3\. Follow instructions to get Internet access 4\. As soon as it has a connection, the router obtains a cert and redirects you to HTTPS 5\. Now you can make all your poor security decisions

<comment><USER26> Have you _met_ 'normals'?

Everything is a hard problem if it's any steps at all.

<comment><USER25> I meant that "how to make router setup secure without making it more difficult" is not a hard problem. My system is no more difficult than the currently most common ones and about as secure as it gets.

Although, one could argue that setting up a router really shouldn't be left to people who don't understand how they work...

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER27> 6 days is nowhere near a justifiable timeframe for full disclosure.

Even if you disagree with that, you should have first reported Key Compromises to Entrust and Comodo before publicly posting the private keys. They are bound by BRs and their own CPS to revoke certificates such as this one - and they would have done so promptly.

This is not what you should do as a security researcher - delete the gist until the CAs have a chance to revoke it via OCSP.

<comment><USER28> I think in this case it's to force browser vendors (who have the most exploitable endpoints) and companies like Apple and Microsoft at the OS level, to blacklist the offending certs.

Though the CAs in question should probably have an automated challenge- response system to which a timed signed reply of a given message of their choice causes a revocation of the key that signed the message. (As sufficient proof of "this is vuln, kill it now, ask questions after".)

<comment><USER29> The OS level actions won't be fast. So this disclosure is closer to an irresponsible attitude. At least CAs should be informed.

<comment><USER30> I tend to differ:

Netgear security is paid to manage security. They failed by not responding to these legitimate communications requests.

The researcher are not paid. They did what could be done to _really_ fix the problem. Of course you can always do better as a researcher, always, but consider time available and paid vs. pro bono time. Also consider all the people who probably found this before and may have sold it on black market, you're attacking the wrong people.

</comment></comment></comment></comment><comment><USER31> I don't envy Netgear. They sell home routers to people who hardly know the difference between HTTP and HTTPS. In this regard, I respect them for NOT making those people submit sensitive information by ignoring browser security warnings and/or accepting self signed certificates. I.e, not teaching bad habits.

On the other hand, making private keys publicly available is obviously far from ideal.

Damned if you do, damned if you don't. Again, I don't envy Netgear...

</comment><comment><USER32> HTTP(S) might just be the wrong protocol for initial setup of a router!

Maybe instead generate a password for each router and print it on the box along with the device's unique SSH Key fingerprint.

Technical users can then SSH in and bootstrap the system (also generate/upload their own TLS certs if they want to use a browser and connect over HTTPS, etc).

Non-technical users get an app and they can scan a QR code on the box which has the SSH user, password, and fingerprint for verification.

The App connects to the router over SSH to do router setup.

If an App is involved you wouldn't technically NEED to use SSH with the App but it was the first thing that came to mind.

<comment><USER33> > _Non-technical users get an app ..._

So now I need an already-working smartphone to set up my internet connection.

<comment><USER32> That's a good point actually. You'd need the internet to install the app too.

</comment></comment></comment><comment><USER34> The cert for www.routerlogin.net (Serial c1:a1:00:64:07:61:2c:07:00:00:00:00:50:f1:09:6a) isn't revoked yet: [https://crt.sh/?id=1955992027&opt=ocsp](https://crt.sh/?id=1955992027&opt=ocsp)

The reporters should have asked the CAs to revoke the certificate. If the CA doesn't do that within 24 hours, it's considered a violation of the rules that the CA needs to follow to stay in browsers.

<comment><USER35> Anyone with access to the private key can submit a problem report to the CA, they're obligated to revoke if the key is exposed to a non-subscriber.

I have submitted a report - they are obligated to revoke within 24 hours.

<comment><USER36> Looks like they've failed to perform the revocation in time -- other users reported to Entrust >24h ago.

<comment><USER35> They revoked it 7 minutes shy of the 24 hour deadline after my report.

If other users reported it and they failed to act, that's a BR violation and they're required to provide an incident reports to the root programs via Mozilla's mechanisms.

If they don't, and you have evidence of those reports, you should provide them to the root programs via the mozilla.dev.security.policy mailing list/group. There's already a thread about this issue, though not claiming that EnTrust was notified.

(Based on timestamps, it's also possible they revoked in response to that thread).

<comment><USER36> Thanks. Here is the timestamp showing that it took more than 32 hours from reporting to revocation.

[https://twitter.com/FiloSottile/status/1219147543667453953?s...](https://twitter.com/FiloSottile/status/1219147543667453953?s=19)

</comment></comment></comment></comment></comment><comment><USER37> Can anyone make out what the funjsq.com is about?

<comment><USER38> Chinese gaming VPN service or something, bypasses China IP blocks to allow them to play on NA/EU servers.

<comment><USER39> I'm wondering why such a VPN service is included in the netgear firmware image? Wouldn't this resonate negatively with Chinese authorities?

<comment><USER40> Unless it was mandated/deployed by a state actor, looking to MITM/monitor VPN users within the country?

</comment></comment></comment></comment><comment><USER41> This reminds me of something I have been looking for for a long time. If you know any reasonable way to fix it please let me know!

This "any CA can authenticate any domain" system is ridiculous. I manage my own CA, which is fine for my own self-hosted sites, but the issue is that it doesn't protect me from a cert made valid by some other CA.

Is there any way I can whitelist my own CA such that IT ALONE will work for my domains? (note: this is a me-only thing. Don't need anyone to be able to validate these domains).

PS, I've asked this question elsewhere [0] before. I did not find an adequate answer.

[0]: [https://security.stackexchange.com/questions/211401/can- you-...](https://security.stackexchange.com/questions/211401/can-you- whitelist-a-single-ca-for-a-domain)

<comment><USER42> See DNS CAA [https://en.wikipedia.org/wiki/DNS_Certification_Authority_Au...](https://en.wikipedia.org/wiki/DNS_Certification_Authority_Authorization)

<comment><USER41> Thanks for the reply!

This is very interesting, I will surely take a look. Only issue I see is that it seems to use DNS, and that's not exactly secure either.

In my mind I am thinking of something that would be more theoretically secure from any remote attack (closer to a form of key-pinning maybe?)

</comment></comment></comment><comment><USER43> This is a world after QUANTUMINSERT for you. Somehow everything should be encrypted but key management are still unsolved

</comment><comment><USER16> I guess I run a different firmware for my Netgear ReadyNAS 312.

This is easy to inspect because the FW is Debian-based, and enabling inbound SSH is easy.

Checking on mine, it has a cert only for the "nas.local"-domain, and the cert is stored in /etc/ssl/certs/ssl-cert-snakeoil.pem and /etc/ssl/private/ssl- cert-snakeoil.key respectively.

Have to admit I love the naming of those files :)

Edit: Obviously it is a different firmware. Mine is a NAS, this was a router. And "snakeoil" seems to be default debianism.

</comment><comment><USER33> > _These certificates are trusted by browsers on all platforms, but will > surely be added to revocation lists shortly._

So what about all the routers that were already sold and the customers that bought them?

Are we ok with leaving all devices that are already in operation or that are currently being sold unconfigurable for non-technical users, just to protect against a highly hypothetical scenario of abusing routerlogin.net?

</comment><comment><USER44> What's a good netgear alternative for switches from 5 port to 48 port - <USER2> late for us now but for next buying wave

</comment><comment><USER18> Is this cert revoked yet?

Sure, Entrust is required to revoke it. It is bound by BRs. If it refuses, Entrust will get itself blacklisted by browsers. On the other hand, having the cert revoked will cost Netgear dearly. As a result, I wonder if Entrust might be dragging its feet on the revocation.

<comment><USER45> mini-app.funjsq.com is revoked ([https://decoder.link/result/418b8d20793d3f4daa4153752e45e78b...](https://decoder.link/result/418b8d20793d3f4daa4153752e45e78b87e8e293)), can't check routerlogin.net/com as they didn't paste the public cert.

<comment><USER34> routerlogin is not revoked: [https://crt.sh/?id=1955992027&opt=ocsp](https://crt.sh/?id=1955992027&opt=ocsp)

</comment></comment></comment><comment><USER46> Name and Shame.

Responsible disclosure ? How about reposonsible security pracitces first.

</comment><comment><USER47> This is why I use OpenWrt. Shout out to the dude sticking up for screen reader users to! Thanks friend. Shit like footnotes and captchirs are the bane of my life!

</comment><comment><USER16> To all the people shitting on Netgear and security in this thread, just how _do_ you propose one deliver a secure network appliance to end customers which they can deploy on their network? And which is user-accessible to common users in modern browsers rejecting everything not touched by a proper CA?

Really. Please educate the world with your ingenious insight. I'll be waiting.

The unavoidable truth is: You _have_ to stuff the key in there somehow. There's no way around that.

Either browsers have to start accepting "local" certs more easily, or end-user network deployed appliances can't have ssl.

Take a pick.

<comment><USER48> This was answered on the Gist in a comment[0] linking to a tweet[1]:

Things to do instead of shipping TLS certs and static private keys to consumer-grade routers you sell by the thousand:

Generate a unique keypair per device.

Use this keypair to communicate upstream, in a similar fashion to CloudFlare's Keyless SSL.

This keypair you generate on the device would need to be preloaded at the factory, unique per device, and the public key would need to be stored in a database.

When a TLS handshake comes in, you verify the entire request is signed by that keypair before signing it.

Delegated online signing for a TLS handshake isn't even in the top 10 engineering challenges for cryptography in the 2020s.

Oh, and, if you don't have connectivity to upstream and your need users to connect to configure something?

Fallback to HTTP reachable via port 80 on the private IP for the server.

[0] [https://gist.github.com/nstarke/a611a19aab433555e91c656fe1f0...](https://gist.github.com/nstarke/a611a19aab433555e91c656fe1f030a9#gistcomment-3145485)

[1] [https://twitter.com/CiPHPerCoder/status/1219228544548720640](https://twitter.com/CiPHPerCoder/status/1219228544548720640)

<comment><USER49> An attacker can just dump the unique key, impersonate the device and use that for a MitM attack. There's just no way to do this securely without completely locking down the devices using hardware key management (which would be unreasonably expensive for a cheap router, plus bad for people who want to flash their own firmware).

Same level of security, and a lot of extra complexity and cost.

<comment><USER48> Yep, and that compromises that one device in the field. Not every device globally, today and tomorrow.

<comment><USER49> Only if each device has a unique subdomain.

</comment></comment></comment></comment></comment><comment><USER50> This is intentional on Netgear's part, and does not in any way degrade security compared to the alternative (an untrusted cert or no HTTPS). It is neither a bug nor a security issue.</comment>


Loop Seems Like a Logistical Disaster That Might Work - <AUTHOR> https://slate.com/technology/2019/02/consumption-loop-might-actually-work.html <comment> core-questions They have to get this into grocery stores for it to work, IMO. I need to be able to bring back a pile of dirty containers, throw them in a bin, get back credits covering X new container purchases, and then go walk into the store and buy new things in the same sort of containers. To get started, all you should have to do is just buy something. The containers themselves should be as re-usable as any cheap Tupperware clone.

Shipping this stuff back and forth is pants-on-head retarded. It needs to be washed and sanitized in-store and filled up with bulk goods in-store.

<comment><USER2> The stores could send them to a local sanitation depot. I've seen setups in cities where all the restaurants used such a service. When you sat down the restaurant would issue you set of plates and bowls in an autoclave bag. You got to open it yourself so you knew it was fresh. At the end of the meal the dirty dishes were scraped and dumped into a bin for cleaning.

</comment></comment><comment><USER3> I got really confused when I saw Loop a few weeks ago as it seems really similar to [https://www.loopindustries.com/en/](https://www.loopindustries.com/en/), which is a Canadian company working on plastic manufacturing that has already partnered with lots of the industries (beverage, cosmetics) that the org in this article would like to target. They don't seem to be the same organization though? The similarities even go down to the logo...

</comment><comment><USER4> > Reusing the containers will save more material and energy than fashioning > new ones each time—even with all the additional shipping.

I 100% do not believe this.

<comment><USER5> Don't just think of shipping the container back to the bottling plant. Think of producing raw materials, then shipping the raw materials to the refinery, the refined materials to the container factory, and the new containers to the bottling plant. Roughly, this seems like _x < x + y + z + w_, which should be uncontroversial.

<comment><USER6> This completely ignores the economy of scale. The process of supplying containers to the factory is highly efficient, which is why only a little fraction of price you pay for the product corresponds to the container. You're replacing this with containers each being shipped on their own airplane and the postal service having to personally process each and every one (and do containers themselves need a box to ship them in?).

And that's ignoring the fact that Loop container is much heavier than a typical plastic container which makes shipping it even more expensive.</comment></comment></comment>


OpenBSD's httpd gets URL rewrite - <AUTHOR> https://marc.info/?l=openbsd-tech&m=152761257806283&w=2 <comment><USER2> I don't have much to say about this patch in particular, but I want to praise OpenBSD's httpd in general. I'm a hacker, not a systems administrator, and while I know how to set up Unix systems, I'm not an expert, nor do I have the time or inclination to become one. OpenBSD's httpd (and the other OpenBSD daemons for that matter) are distinct in that they have so few features, and are documented so well, that I can configure them and feel that I understand exactly the implications of my configuration. I trust that what I have built works. I have even read the code on occasion if I was unsure about something - it's short and simple, so it's perfectly feasible.

I have no illusions about OpenBSD's httpd being able to replace nginx or Apache in larger deployments, or that the latter cannot be configured to be just as safe and robust, but for the lone hacker or researcher who just needs a simple web server to serve static files or front FastCGI, OpenBSD's httpd is an excellent fit.

<comment><USER3> This is something I rather like about Lighttpd over in the Linux world

I want to have a simple web server on my server at home to run a distro mirror and some other HTTP-centric things

I install lighttpd, and just dump all the files I want to serve in /var/www/localhost/htdocs

Start the daemon, bam, working. No messing about with htaccess or other things

<comment><USER2> I used lighttpd before OpenBSD's httpd, and while it is close, it still has far more features and configuration knobs. It's not just about whether things work by default (Apache usually does as well), but whether I fully understand what my configuration actually _means_ , and what the server ends up doing.

</comment></comment></comment><comment><USER4> This is a patch. It was sent to a mailing list for review. It has not been committed.

Also here's the revised patchset, which is more thorough and changes some config syntax:

[https://marc.info/?l=openbsd- tech&m=152763303217829&w=2](https://marc.info/?l=openbsd- tech&m=152763303217829&w=2)

[https://marc.info/?l=openbsd- tech&m=152763343417988&w=2](https://marc.info/?l=openbsd- tech&m=152763343417988&w=2) (adds rewrite)

[https://marc.info/?l=openbsd- tech&m=152763318517884&w=2](https://marc.info/?l=openbsd- tech&m=152763318517884&w=2)

</comment><comment><USER5> What I really like about this is how short, and readable, the patchset for the feature is.

Sure, it lacks tests - and it's had a couple revisions since… but it's something to behold.

</comment><comment><USER6> I'm hopeful that someday httpd will support adding custom response headers -- for things such as adding a cache-control header.

Until then, it seems the recommendation is to run relayd in front of httpd, in order to add such headers.</comment>


Ask HN: suppose I parachute into mainland Africa, could I help the people with my Hacker skills? - <AUTHOR> In reaction to the "are you helping the world" thread, I really wonder what good could we do with hacker skills, on location? Like there are physicians who spend some months a year traveling poor countries and curing people.<p>Could we as programmers do something similar? <comment><USER2> To tell, you the truth, i don't think that your skills will really matter here, and this is from the horses mouth. I live in west africa, which is one of the most stable parts and i am itching to leave to a place where my skill swill be appreciated.

<comment><USER3> This is something that appears to be poorly understood in the tech/computer industry. Superb software design skills aren't as important in areas with serious social and infrastructure problems.

Also, to some extent, I think that those that have recently spoken out against foreign aid in Africa are correct: only Africa can improve Africa's well- being. (I say this even as a former member of a local community organization that raised funds to send an experienced hydrologist to Uganda for a year to work on water quality there.)

</comment></comment><comment><USER4> A short answer: Politics. That's where your hacker skills have leverage: Education, research, documentation, analysis, logistics, fundraising, diplomacy.

Of course, we can't discuss many details here, because politics is anathema on news.yc unless IP law is involved. :)

[And _that_ , BTW, is why we see all these posts lamenting that hackers "never do enough to solve the world's big problems" -- most of the world's big problems are _intensely political_ , and politics is to news.yc as sex was to Victorian England. Of course, just because we don't talk about political issues here doesn't mean we don't work on them, off camera.]

Actually, though, IP law is relevant: If you can successfully lobby to reduce the patent lifetime for AIDS drugs you will save an order of magnitude more lives in Africa than you could ever do with your own two hands.

Another source of leverage is, obviously, invention. Hackers are good at inventing things, much of which you can do in your own shop (where you are most productive).

None of this should stop you from traveling to Africa, but the most useful thing you can do there is _learn_ : Once you have a first-hand look at the life and problems of an African person you may have a better idea of how to apply your leverage.

<comment><AUTHOR> I don't think hackers are anti-politics by default. I for one am very interested in how to "hack" politics. I just don't think the "official politics" we see is the real politics. Like I don't think people's opinions are being swayed by debates. I don't know a good approach for changing people's opinions, unfortunately - but if somebody would present one, I would be very interested.

</comment></comment><comment><USER5> You could probably help transferring an unclaimed fund of $25,000 from which I am in dire need of immediate assistance.

<comment><USER6> I don't see what value this adds

<comment><USER7> Pure entertainment value. As long as we are running 25:1 on entertainment to valuable info, I'm good with it.

<comment><USER6> I'm glad you got something out of it. I didn't.

I think it's a cruel stereotype, and the upvotes that comment has received are telling of the lack of sincerity on this topic.

There are many things you can do with IT/ICT to help the developing world. Here are some suggestions:

Build a non-literate UI on a cheap cellphone. Use it to provide rural villages with healthcare and market information, and financial management tools (like microfinance accouting).

Hack together a long-range WiFi to provide connectivity to a remote site.

Stream video from your cell phone to your favorite video-serving startup. Convince people to donate their time and money by showing them conditions on the ground.

Build a service that lets multiple villages form a cooperative using cellphones. Let them buy agricultural inputs in bulk at better prices, access wider markets for their goods, and coordinate transportation and tool sharing.

Use pcs or phones to educate rural farmers on modern agricultural techniques.

There are countless underfunded projects that are trying to do something in this space, going far beyond microfinance (though that may turn out to be one of the most important measures taken).

<comment><USER8> _non-literate UI_

this is brilliant (no sarcasm) and a good example of fantastic ideas being summed up in a single phrase. is anyone working on this?

<comment><USER9> [http://research.nokia.com/bluesky/non- literacy-001-2005/inde...](http://research.nokia.com/bluesky/non- literacy-001-2005/index.html)

<http://www.smallsurfaces.com/tag/nonliterate/>

[http://www.janchipchase.com/blog/mt- search.cgi?tag=Kathmandu...](http://www.janchipchase.com/blog/mt- search.cgi?tag=Kathmandu&blog_id=1)

<comment><USER8> thanks.

</comment></comment></comment></comment></comment></comment></comment><comment><USER10> I love the hypothetical and how you've asked it.

But to be serious, your programming skills are going to be of almost no use to them. Hell, go look at the Zimbabwe government's website to see how much they care - <http://www.gta.gov.zw/> (prepare to cringe).

What skills you DO have are compassion, finances, and the ability to get awareness up HERE. Tons of charities need better and more functional websites that come up more often in SEO. They need more prominent donation tabs, they need websites that better explain their mission and better recruit. You can create a site to promote a cause, you can team up with someone and start your own charity (I intend to).

There's tons you can do. Just because you're not on location doesn't mean you're not making an impact.

<comment><AUTHOR> What is a good way to find an appropriate organization to help, with an office where I live?

<comment><USER10> Charity Guide (<http://www.charity-charities.org>) is a place to start, though it mostly lists local branches of larger charities.

<comment><USER11> Not to discourage you, but pick wisely if you go the charity route. I've worked with some great charities, and with utterly incompetent ones rife with cronyism, bureaucracy, and flagrant wasting of donation money. It can be hard to tell which will be which before you actually work with it.

<comment><USER12> It's not a panacea, but if you can get ahold of the Combined Federal Campaign's big book o' charities, it tells what percentage of donated funds goes to administrative and other expenses, and which goes directly to the cause. <http://www.opm.gov/cfc/html/qfd.asp>

</comment></comment></comment></comment></comment><comment><USER13> Wouldn't it make a bit more sense to signup with an organization that is already working on this:

<http://www.geekcorps.org/>

As someone that has wired networks, written code and taught some basic computer skills in Africa, I would suggest narrowing down your search a little. Africa is a vast continent and there is a big difference between what you might find in Tunis vs. Kinsangani.

There are probably many projects that could benefit from having geek help but do not think you can just "parachute" into many places without a great deal of preparation. Without concrete plans for things like where you are going to live, how you are going to get medical care, etc. you may end up being more of a liability than an asset.

Good luck and do not give up trying to find a way to help. I lived and worked in Africa for four years after college and it was a great experience.

</comment><comment><USER14> Rather than parachuting in, you could simply book a flight to one of the international airports located on the continent.

Teaching would be the obvious useful occupation. However, everywhere needs good teachers, not just Africa.

<comment><USER14> More seriously, I spent some time in Africa after my first startup imploded. I volunteered in the pharmacy of a medical aid organization. Mostly I just got their ancient windows 3.1 machine set up with an ancient version of Access, (or something? I don't remember). I should have done a bit more teaching of how the system worked, but I wasn't even sure how it all worked. I'm pretty sure everything went to crap shortly after I left.

What I found more rewarding, and probably more useful than doing tech work, was helping kids have fun. The other bleeding hearts I was with were Ultimate Frisbee fans and we introduced the game to the local kids. We even had another aid worker bring a huge shipment of 144 frisbees into the country. This may seem frivolous, but one thing I noticed was that kids had tons of free time and were really eager to learn how to do fun stuff. Art, music, sports, etc. Computer programming would have been great, too... but there were hardly any computers.

<comment><AUTHOR> Interesting story, thanks.

</comment></comment></comment><comment><USER15> If someone would like to pitch in, and has has at least basic python abilities, consider helping out with Aaron Swartz's project: www.watchdog.net

There are a lot of bite-size python tasks they need help with. It usually pulling in data from a very unhelpful format and converting it to a helpful format. It's not terribly stimulating but it might be rewarding to enable the data to see the light of day.

Check out things you can do at: <http://watchdog.jottit.com/volunteer>

</comment><comment><USER16> hey, being from Africa: Yes, you could,though i dont in 'aid' and charity in Africa we need to resolve our problems, only then will we learn how to compete in the global economy. So for example, encourage entreprenuership etc.

Take a look at the bigger picture being how do can you use your technology skills to programme/code something to make a difference? To assist with the issues being faced in Africa (And globally).

i.e The current inflation being felt world wide, the energy crisis(fuel / power), the food crisis with the high prices of food, in places like the US it does not affect people and even for some people like myself it will not affect me since i can afford the higher prices. However when it comes to people who can just barely pay for their daily food, it leads to starvation.

So yes, while we build 199999 Facebook(x) clone or silly little online app, millions of people out there are starving and can barely make ends meet.

Think about that.

There is a group created to put into action practical technology solutions to target some of these issues, feel free to join.

<http://groups.google.com/group/technologyforchange>

</comment><comment><USER17> I think the way that you would be able to help the most is been able to educate them. A bit of a "teach a man to fish" mantra.

I live in South Africa and we have a serious shortage of programmers in this country, especially when it comes to the open source web based languages.

<comment><USER18> I live in England, we have lots of great South African programmers here :-)

<comment><USER17> Funny you should mention that I'm immigrating next year to England. :)

</comment></comment></comment><comment><USER15> Have you contacted <http://www.geekcorps.org/> ?

</comment><comment><USER19> This guy did it, but don't parachute in cuz you might break something and cause more harm...

<http://www.kuro5hin.org/story/2002/9/3/151048/0948>

</comment><comment><USER20> You can work with others. Develop point-of-sale software to improve efficiency at crowded stores. Cell phone software can make markets more efficient and prevent price-setting that farmers suffer from. Then there's medical records software.

All of these 1) require some domain expertise, even if small 2) are conceptually simple, but the delivery is hard

<comment><USER9> OpenMRS is a project to enable modern medical records technology, which is now used in Africa.

<http://feed.openmrs.org/tag/global%20health>

</comment></comment><comment><USER21> Check out these guys:

<http://www.inveneo.org/>

I recently met the founder at an event in SF. He gave me a demo of their very impressive solar-powered computer product. This is a high-tech nonprofit run in an entrepreneurial way by people who are trying to change the world for the better.

</comment><comment><USER22> You might not be able to provide medical help, but you could teach for free and help others to gain jobs. You could set up a website to help aid those in need (like Kiva, a donation site, or a blog that tells the world about conditions).

</comment><comment><USER23> Don't know about the parachuting in bit and most people won't have/use computers, but mobiles are making big impact/inroads in third/developing worlds. Ideally do something using them.

So, perhaps a _text based_ mobile service (most places do not have mobile- internet yet) to do something useful may be of value e.g. to find the current market price of rice (to buy/sell without being cheated) or warn about events like potential flood/hurricane risk or when the next bus is coming or text- based bartering system or even just teaching the kids how to use the OLPCs effectively.

</comment><comment><USER24> Your programming skills: No.

Your talents and engineering senses? Most definitely.

The idea is the same, the venue is different, that's all.

</comment><comment><USER25> Skill X, can not fix or much help a broken state.

Even a doctor could only help those in close physical proximity and in no need of advanced medical tech or much expensive drugs.

The fix for broken states is to fix the state, then the economy takes off and your stills are needed.

Most broken states are run by undemocratic governments, to "fix" them you need a change of regime. Undemocratic states often spy on their citizens to stay in power. So l337 crypto skill could help a democratic underground communicate and organize.

</comment><comment><USER26> To be fair no. Working for a charity isn't really going to help either (I refere you to the last 50 years where outside of disaster relief charity has done little to remove people from poverty).

If you really want to help, buy the things they make and lobby YOUR government to lower trade barriers.

<comment><AUTHOR> I am not even convinced "buy the things they make" is the right way to go. Maybe they should just make other things? Buying things "they" make would be the same thing as subsidization, which I consider mostly evil. It would lead to even more investment into making things nobody really wants, rather than investment into making useful things.

Trade barriers are probably a good point, though.

<comment><USER26> If you lower the trade barriers you will get a chance to buy the things they make and they will get a chance to make what we want.

The reality of africa is that Europe dumps a lot of it's produce into African markets at below market prices reducing the value of the local goods. There is no point in giving to charity until this stops. African countries don't want charity, they want markets and foreign capital so they can grow jobs for THEIR people.

<comment><AUTHOR> Maybe you are right, on the other hand "dumping produce below market price" could also be considered a gift.

Is this a deliberate scheme by European countries to destroy the African economy, or why are they dumping the goods? Or maybe their production methods are just more efficient and therefore the goods are so cheap?

<comment><USER27> "Dumping produce below market price" is the other side of the "farm subsidies" coin. See "Your Farm Subsidies Are Strangling Us", by the presidents of two African nations: [http://query.nytimes.com/gst/fullpage.html?res=9E04EFD8103DF...](http://query.nytimes.com/gst/fullpage.html?res=9E04EFD8103DF932A25754C0A9659C8B63)

<comment><AUTHOR> Sure, but why do they have to rely on cotton? I just question the assumption that all Africans should be farmers. In fact, is it likely that they will reach our standards of living if they all remain farmers? I don't think so - very few people in developed countries seem to be farmers, for all I can tell.

Of course if cotton can be produced cheaper there, it is a shame that the world doesn't make use of it. But other than that, I don't see why a nation should stubbornly insist on one kind of production.

</comment></comment></comment></comment></comment></comment><comment><USER28> You might help out with a project like OpenMRS (<http://openmrs.org/wiki/OpenMRS>). This is an open source medical records application used in several African countries, primarily for HIV/AIDS care.

</comment><comment><USER29> I had been considering doing something similar in Ghana. I thought about it for a few weeks and kept coming back to teaching. Teaching programming in particular probably wouldn't be very useful, but teaching basic computer skills definitely would be.

If you worked with a small town (provided they had access to reliable power), you could probably have a measurable impact on the local economy. That is really the only way I could sustain myself in such a situation- by being able to see the good I'm doing to a whole community.

</comment><comment><USER30> i think the root of all problems/evil in africa comes from lack of (bad.. very bad!) leaders. there's mugabe on one extreme and many other mini-mugabes who are "sly" enough to go unnoticed (they are not sly or clever or whatever but just downright stupid!), and worst of all, potentially "good" leaders will simply never get to lead because of the long queue of bad leaders waiting to get to the top and make themselves rich - and who , believe me , are ready to do anything to make sure that the "good" ones never lead - including murder. kenyan example - yet its not the worst 1\. MPs in kenya , one of the poorest countries in the world, take home AT LEAST 8000$ per month (it must be 10000$ by now) , much more than most rich countries. they vote for these salaries and block the parliament activities (hold hostage) if they dont get the amount they wanted - after all they are the law makers !. 2\. Before elections, several women who wanted to become MPs we're beaten , raped etc.. in order to scare them. 3\. Now , after elections, with the hard times and especially after a near civil war situation ( also because of "kenyan leaders greed for power" - that's another long story !) , MP revenue taxation was proposed ( i had forgotten to mention they are not taxed ) - they we're obviously up in arms against it and vowed it would never happen - even if they earn 1000 times more than the average kenyan, who pays taxes. i believe african countries have their share of talent ( intellectuals, artists, good leaders .. all what you want) only that they never (and might never) get to exercise it. many africans know this so they simply have no faith in govt and live like they dont have them - which is more or less true, this means living in some very chaotic societies where the strong survive and the rest are left to try and survive. let me cut it for now but if you can hack the bad leaders and replace them with good ones - maybe that might just be the hack of the century :)

<comment><USER31> _i think the root of all problems/evil in africa comes from lack of (bad.. very bad!) leaders._

You don't think IQ is a factor?

[http://en.wikipedia.org/wiki/IQ_and_Global_Inequality#Nation...](http://en.wikipedia.org/wiki/IQ_and_Global_Inequality#National_IQ_and_QHC_values)

</comment></comment><comment> bjelkeman-again With the right plan I think you can be more effective if you stay at home and deploy your Hacker skills.

Mechanical-fish wrote in another thread: "Wake me up when you have an actionable plan to solve a problem. That would be interesting."

We identified a big internet service/applications gap in the development-aid water and sanitation sector. Essentially these people are stuck in the LP/cassette tape age, when the rest of the world moved on to iPods and p2p networks.

Some basics:

Market size: 2.6 billion people lack adequate sanitation, 1.1 billion lack safe water to drink. Some US$10 billion is spent every year to try to resolve that problem. The goal is to halve those numbers by 2015 (UN MDG goals), but that isn't going to happen.

Problem: There are lots of problems with development aid, but we are focusing on a couple of specific areas: information exchange, funding and monitoring and reporting.

Information exchange – Information about low cost, appropriate technologies and sustainable water and sanitation solutions for low-income households and communities is very hard to find and collect for the non-specialists. Information is available, but spread over a large number of sources, and essentially disorganised.

Funding – The water and sanitation community struggles to attract additional flows of money and connect funds directly to where the demand is. It is estimated that around 15-30% of budgets are directed away from intended beneficiaries due to corruption and high overhead costs, partially due to a lack of transparency. It is specifically difficult to find grants and loans for local initiatives, even though these initiatives have proved to be very efficient.

Monitoring and reporting – Monitoring and reporting are often used as a means to 'justify' a correct use of funds, not as a tool to intervene pro-actively in projects while they are evolving. The sector is stuck in the "thick Word report" process, rather than using easy to use IT tools. Additionally the sector struggles to visualise and share results in an appealing way to those outside the sector.

You can take what I considere basic internet tools and drastically improve the "state of the art" that the people working in this field today use. Which is what we are doing, like picking low hanging fruit. We are putting together a non-profit foundation to work on this and deliver some tools.

We are putting together three integrated products:

\- Akvopedia – the first truly open knowledge platform dedicated to water and sanitation \- Akvo Matchmaking – an unique marketplace for water and sanitation projects screening and funding \- Akvo Really Simple Reporting (RSR) – an easy and transparent way to track projects in the field and to share and visualise results

Essentially a Wikipedia for water and sanitation knowledge, eBay, Blogger and YouTube for water and sanitation projects, rolled into one.

The tools we develop ourselves will be available under GPL and the platform is available at an "at cost" basis to the users, who are NGOs, government departments and companies. Which will be way below in cost what they can provide for themselves.

We are in the process of deploying the platform and building out the first product, Akvo RSR. The web site is essentially a wireframe which we used as part of our fundraising, which will be swapped out with the real thing during the summer.

We have more than a dozen development-aid partners and we are working with hundreds of field partners lining up to use the system, and expect to put the first 25-50 projects on the system over the next couple of months. The goal is to scale this up to thousands of projects over the next year and then further.

I could go to Africa and work as a hydrologist (I have the education) but I think that I am going to be much more effective rolling out some modern internet systems to make all these people working in this field more effective. Our funders agree with me, otherwise I don't think they wouldn't have given us money.

<comment><USER32> I think this is the right approach. I think by being inventive and creating ideas like www.freerice.com you can make a hell of a difference. John Breen the guy who created this has sent much $$$$ to the World Food Programme. It's a WIN/WIN situations users love it because they are learning, and the hungry get fed.

www.codewithcause.com

</comment></comment><comment><USER33> I'd have to say I think you'll end up using your nunchuku skills and bow hunting skills more than your hacker skills.

</comment><comment><USER34> If you parachute into mainland Africa, the most likely outcome for you is death.

I had a friend who worked in Kenya for a few months and the class conflict was so tense there that he had _six_ armed bodyguards on the advice of his employer.

<comment><USER35> Where in Kenya? I live there and unless your friend was doing drugs, his story sounds highly implausible.

</comment></comment><comment><USER36> No.</comment>


Mac Apps We Use Every Day - <AUTHOR> http://brickftp.com/post/1970045-21-mac-apps-we-use-every-day?utm_source=hn <comment><USER2> For those looking for a replacement for Skitch (which is a far cry from what it used to be, thanks Evernote), go check out Monosnap @ [https://www.monosnap.com/welcome](https://www.monosnap.com/welcome).

<comment><USER3> I don't know Mnosnap, but I'm very happy with Glui [http://glui.me/](http://glui.me/)

<comment><USER4> Last time I tried Glui it sent data to mixpanel with no way to disable it. Does it still do this (with no way to disable)?

</comment></comment></comment><comment><USER5> I would recommend Better Touch Tool over SizeUp. It allows you to setup keyboard shortcuts as well as touchpad gestures to resize windows, and do a lot of other actions.

<comment><USER6> Yes! I love that software. I used it to make the gestures the same between my touchpad and my magic mouse. It's stupid how it's 3 fingers on one and 2 on the other.

</comment></comment><comment><USER7> This is a great list, but two of my favorites that are missing:

Divvy - [http://mizage.com/divvy/](http://mizage.com/divvy/)

DragonDrop - [http://shinyplasticbag.com/dragondrop/](http://shinyplasticbag.com/dragondrop/)

<comment><USER8> Also, Slate is extremely flexible: [https://github.com/jigish/slate/blob/master/README.md](https://github.com/jigish/slate/blob/master/README.md)

</comment></comment><comment><USER9> I find Little Snitch absolutely essential. I've been using it for years and can't recommend it enough. [http://www.obdev.at/products/littlesnitch/index.html](http://www.obdev.at/products/littlesnitch/index.html)

</comment><comment><USER10> Beginning with mountain lion, apple ships the handy console program caffeinate so you won't need Caffeine anymore

<comment><USER4> Yup. A bonus of the cli utility is that you can pass a program argument to it, so when another script is done the "constant wake" state is ended. The man page has more info.

</comment></comment><comment><USER11> I also recommend GeekTool. It allows for some cool customization effects. Available for free here: [http://projects.tynsoe.org/en/geektool/](http://projects.tynsoe.org/en/geektool/) You can find some cool themes from devianart or other sites.

<comment><USER8> It's sort of abandonware now, isn't it? There's NerdTool, which works well enough for me, but also hasn't been updated in a long time...

</comment></comment><comment><USER12> compliment: an expression of esteem, respect, affection, or admiration

complement: add to (something) in a way that enhances or improves it; make perfect

I do not believe that F.lux is expressing admiration for its surroundings.

/pet-peeve

</comment><comment><USER13> > Iterm2... One of the most awesome features is it's ability to trigger a full > screen, semi-transparent console at the push of a hotkey.

How did I not know about this? I'm almost looking forward to going to work tomorrow.

<comment><USER14> If you want some fun, try out Cathode. [https://itunes.apple.com/us/app/cathode/id499233976?mt=12](https://itunes.apple.com/us/app/cathode/id499233976?mt=12)

</comment></comment><comment><USER15> slate.app is great opensource replacement for sizeup [https://github.com/jigish/slate](https://github.com/jigish/slate)

<comment><USER16> Extremely user unfriendly though. Just installed it and it doesn't even sensible defaults for you to hit the ground running. Their answer: "Read the docs and write your own configs." Nobody has time for that!

Edit: Another commenter suggests [http://spectacleapp.com/](http://spectacleapp.com/) \- works really well out of the box - in fact it does what I expected Slate to do.

<comment><USER15> actually slate.app links to a config: [https://github.com/jigish/dotfiles/blob/master/slate](https://github.com/jigish/dotfiles/blob/master/slate)

edit: actually, spectacle doesn't do what slate does. doesn't spectacle basically give you some specific ways to tile no way to go beyond that?

</comment></comment></comment><comment><USER17> Here are some of my absolute favourites:

\- Spectacle, for easily tiling windows [http://spectacleapp.com/](http://spectacleapp.com/)

\- TotalTerminal, for globally accessible, full-width, semitransparent, sliding out Terminal. [http://totalterminal.binaryage.com/](http://totalterminal.binaryage.com/)

<comment><USER18> binaryages TotalFinder is also pretty awesome.

</comment></comment><comment><USER19> This is a nice list, but I tend to force myself not to use this, or to limit the amount of "modifications" I put in. Gives me bad memories of the days from OS 9 where half the programs I use one year get orphaned...

Plus the labor of maintaining 10-20 apps that modify default OS X behavior can get excessive.

</comment><comment><USER20> Documentation reader I can't live without: [http://kapeli.com/dash](http://kapeli.com/dash) File sharing app: [https://droplr.com](https://droplr.com)

</comment><comment><USER21> I would also recommend RescueTime, a YC company to track your time. You barely have to do anything, just let it run and see what it reports to you in terms of your productivity. Probably one of the best ROI that a app can have.

<comment><USER22> Yes really great app. You can also set goals like 'code at least 4hrs a day' and will be notified if you succeeded in, with your weekly summary.

</comment></comment><comment><USER23> HyperDock looks interesting. I was hoping it would exactly replicate a feature I _love_ from Flexiglass[1]: moving windows from any position by a (modifier, movement) combination. Unfortunately, HyperDock doesn't quite replace Flexiglass due to binding limitations.

Flexiglass allows (modifier key(s), two-finger move) to reposition a window. This is effortless and awesome. HyperDock requires (modifier key(s), left mouse click + movement). The click seems like a small thing but is more awkward, in my experience.

[1] [http://nulana.com/flexiglass/](http://nulana.com/flexiglass/)

</comment><comment><USER24> Excellent apps. Can't stand the distorted screenshots on that page.

<comment><USER25> Seriously! Feels like 1999.

I thought it was lazy resizing in an image editor, but it turns out it's just bad CSS.

They have a "max-width" on "BODY IMG", but then some script or some deployment process added "width:" and "height:" on each image individually.

The max-width alone would resize the image nicely, but the presence of the "height:" causes the vertical stretch.

(Sorry, the web-debugger in me kicks in without being asked.)

<comment><USER26> Yea... that was a typo that got cached. sorry, that was more painful for me than it was for you

</comment></comment></comment><comment><USER27> > One of the nicest features of The Unarchiver is it's ability to delete zip > files after they've been opened, so you you only need to click the file > once, rather than unzipping it, and going back and deleting all the original > zip files off your desktop.

This reminds me... why isn't there a Windows archive-extractor program with this behavior? I tried to search for it a while ago, but it seemed like every app developer who had the suggestion presented to them hated it.

</comment><comment><USER28> Sure, I'd love to have a terminal replacement that shows eight-colored letters on a black background just like Windows! I have no idea why Mac users love this kind of crapware utility. It's been so since 1984 - the big difference being the scores of semi-useful utilities no longer crash your machine every few hours - and I've never gotten the appeal.

</comment><comment><USER29> A question for those using sizeup, how do you make sure the hotkeys you create don't conflict with hotkeys in your apps?

<comment><USER30> I don't use SizeUp, so this solution won't apply to that particular utility, but I do use a window manager. Moom, which I use, is activated by a single keyboard shortcut. Once activated, Moom captures shortcuts that might otherwise be handled by other applications. This makes all window resize actions a two step process, but I find that's a worthwhile trade-off for avoiding shortcut collisions.

</comment></comment><comment><USER31> I recently got a bug report where using the unarchiver to unzip an app corrupted it. [https://github.com/PostgresApp/PostgresApp/issues/166#issuec...](https://github.com/PostgresApp/PostgresApp/issues/166#issuecomment-32012367)

</comment><comment><USER32> I ran into a weird bug with Visits where one of my sites is not visible in the drop-down list. I think it's because I exceeded some kind of domain limit. Has anyone experienced the same?

</comment><comment><USER33> One of my favorites is Shortcat: [http://shortcatapp.com/](http://shortcatapp.com/)

Maybe it's because I hate having to move my mouse cursor.

</comment><comment><USER34> [http://livejs.com/](http://livejs.com/) does the same thing as Live Reload but without the OS X dependency.

</comment><comment><USER35> Versions is easily my favourite Subversion client for Mac. [http://versionsapp.com](http://versionsapp.com)

</comment><comment><USER36> Writer Pro @ [http://writer.pro](http://writer.pro) for distraction free writing and note taking.

</comment><comment><USER37> I would love to somehow add "Restart in Bootcamp" to the global apple menu and not need a standalone app.

<comment><USER38> If you find yourself with a Terminal window open:

         alias win7="bless -mount /Volumes/win7/ -legacy -setBoot -nextonly; shutdown -r now"
         alias debian="bless -mount /Volumes/wheezy/ -legacy -setBoot -nextonly; shutdown -r now"
         alias arch="bless -mount /Volumes/arch/ -legacy -setBoot -nextonly; shutdown -r now"

Obviously change the volume paths as needed. Typing "win7" into terminal will restart into my Windows 7 install, likewise for "debian" and "arch". Any subsequent reboot will automatically reboot back into OSX

</comment></comment><comment><USER39> iTerm2 would be a lot better if they brought back the side dock. The system they replaced it with requires you to type out domain names to find them in the list. Way too difficult to use.

</comment><comment><USER26> <3 Bitcoin Monitor and Electrum

</comment><comment><USER40> Sip, Xscope, Alfred 2, Sketch,</comment>


Brin.gy - a protocol for human discovery - <AUTHOR> http://brin.gy/

<comment><USER2> Can I use it for dating?</comment>


Readers who feel threatened by equality no longer welcome - <AUTHOR> http://games.on.net/2014/08/readers-threatened-by-equality-not-welcome/ <comment><USER2> I think there is a greater psychological issue here at stake, a hidden game where outliers and performers turn into sadistic trolls.

I tried to take a better look at the phenomenon in this blog post: [http://flopinson.blogspot.com/2014/08/mass-trolling-in- arena...](http://flopinson.blogspot.com/2014/08/mass-trolling-in-arena-way- great.html)</comment>


World's first light rail on a floating bridge: Sound Transit, Seattle - <AUTHOR> http://www.seattletimes.com/seattle-news/transportation/light-rail-track-floating-bridge-i-90-sound-transit/ <comment><USER2> There are some more details and an interesting video showing the test track here:

[https://www.soundtransit.org/blog/platform/crossing-lake- was...](https://www.soundtransit.org/blog/platform/crossing-lake-washington)</comment>


Seoul is putting solar on all public buildings and 1M homes - <AUTHOR> https://electrek.co/2019/11/14/seoul-south-korea-solar-public-buildings-1m-homes/ <comment><USER2> Electricitymap.org South Korea current generation mix: [https://www.electricitymap.org/?wind=false&solar=false&page=...](https://www.electricitymap.org/?wind=false&solar=false&page=country&remote=true&countryCode=KR)

</comment><comment><USER3> Nice to see major cities leading by example. Kudos to the leadership in Seoul for taking a strong initiative in the transition from fossil fuels to renewable energy sources.

</comment><comment><USER4> Is Seoul a city that receives a lot of sun? And are there lots of buildings that are in a shadow 24/7 due to skyscrapers?

<comment><USER5> It get's an ok amount according to the global PV potential map [0], better than a lot of Wester Europe but not as much as much of the US. And like most cities there's a lot of space that aren't just sky scrapers.

[0] [https://globalsolaratlas.info/map?c=36.137875,125.705566,6](https://globalsolaratlas.info/map?c=36.137875,125.705566,6)</comment></comment>


Dave Winer is working on a new Outliner - <AUTHOR> http://smallpicture.com/outlinerHowto.html

<comment><USER2> Isn't it a kind of workflowy.com?</comment>


Illustrated Self-Guided Course on How to Use the Slide Rule (2012) - <AUTHOR> http://sliderulemuseum.com/SR_Course.htm <comment><USER2> Shameless plug: I used a "slide rule" style UI for the Ohm's Law calculator on Perfboard (iOS app).

More specifically, I allow the user to slide logarithmically marked rules for two of the variables (and the calculator finds the third). Besides mapping well to Ohm's law and the way resistors are used in hobbyist electronics, I thought it was a fun way to explore various values for resistors, voltages, etc. More interactive than the "enter in two values get a third" text-field approach (although you can do that too if you want more precision).

[https://itunes.apple.com/us/app/perfboard/id465951871?mt=8](https://itunes.apple.com/us/app/perfboard/id465951871?mt=8)

</comment><comment><USER3> I learned from "An Easy Introduction to the Slide Rule" by Isaac Asimov.

<comment><USER4> Me too - actually bought the paper version from a vintage book shop. Looks like this covers much of the same ground.

<comment><USER5> That is an amazing find!

</comment></comment></comment><comment><USER6> I'm somewhat disappointed there is no content on the Nuclear Weapons Effects Calculator, a specialized circular slide rule included in a book of the same name. There is extensive documentation about it, and while a collectors item, can still be found on eBay or Abe books occasionally. A nice simulation of it, and templates for anyone willing to make their own, are available at [1].

[1] [https://www.fourmilab.ch/bombcalc/](https://www.fourmilab.ch/bombcalc/)

</comment><comment><USER7> I was watching season 2 of "The Wire" (never saw it before) and a detective was consulting with a representative of the Maryland Bureau of Mines, who subtly whipped out a slide rule to produce some result. What was nice was that it wasn't "look whose got a slide rule!" As much as "hey, he figured that out quickly!"

</comment><comment><USER8> This reminds me of "Have Space Suit—Will Travel" Science-fiction novel by Robert A. Heinlein, where the hero make frequent uses of his slide rule to save himself from dangerous situations.

[https://en.wikipedia.org/wiki/Have_Space_Suit%E2%80%94Will_T...](https://en.wikipedia.org/wiki/Have_Space_Suit%E2%80%94Will_Travel)

</comment><comment><USER9> I still have my father's slide rule. It was in storage for quite some time and I re-discovered it during house cleaning. It still works.

Here's my post on Google+ about it [1]

[1] [https://plus.google.com/+KamYungSoh/posts/6Fsv7mH7yf3](https://plus.google.com/+KamYungSoh/posts/6Fsv7mH7yf3)

</comment><comment><USER10> Is anyone still making reasonable slide rules? A few years ago Think Geek offered a slide rule, and I bought a couple, but they are nowhere near as smooth as the slide rules I had in the '70s.

I find it interesting that the pocket calculator quickly killed the slide rule, but did not kill the abacus.

<comment><USER11> If you want to get the ones you had in the '70s again, eBay has loads of gorgeous slide rules for around $10 or $20, sometimes with their original cases and instructions.

</comment></comment><comment><USER12> E6-B slide rule was still standard method for private pilots when I was flying, 15 years ago.

Simple, effective, reliable.

[https://en.wikipedia.org/wiki/E6B](https://en.wikipedia.org/wiki/E6B)

</comment><comment><USER13> Damn. Office has ruined me. I started reading thinking this was (a somewhat funny) post about the single important (presentation) slide rule.

This was cool as well though. Learned something more valuable today.

</comment><comment><USER14> My first class in Navy Nuclear School in 1975 was slide rule use.</comment>


Questions Answered: Invented Languages - <AUTHOR> http://schott.blogs.nytimes.com/2010/03/10/questions-answered-invented-languages/

<comment><AUTHOR> Paul Frommer (the developer of Avatar's novel tongue, Na'vi) and Arika Okrent (author of In the Land of Invented Languages) jointly take on some very interesting questions submitted by readers. I learned about some new resources on linguistics through this article.</comment>


Ask HN: How to build full text search at scale? - <AUTHOR> Data Store - <USER2> Scale - 10 million writes/day (500 GB/day), about 100K search queries per day
Trying to figure out
1 - How to control access to data (multi-tenancy where there are ~100K tenants)
2 - Database design - Indexes and Shards and best practices around mixing different types of documents in a single index. <comment><USER3> I recommend writing down what exactly scale means for your needs. Number of users? Number of queries? Number of sources? Number of 'result-sets'? Number of documents? Number of text fields?

Elasticsearch is built on-top-of Lucene which is a Java API that you can use in pretty much any application. If you already have a system that can search the MySQL clusters then I would recommend hooking Lucene into that system instead of standing up another one.

<comment><AUTHOR> Added more details

<comment><USER3> >> How to control access to data (multi-tenancy where there are ~100K tenants)

So basically, you need to run a web server that serves a search page in which your users can create and submit queries. The web server receives the query and then routes it to the appropriate search handler. The web server should handle access control and there are several standard different approaches for this.

Solr and ElasticSearch can both be used in this manner.

>> Database design - Indexes and Shards and best practices around mixing different types of documents in a single index.

Depends a lot on what your users want to get in their search results. A first step would be to identify the primary text fields they want to search in each document type, then create a standard text field in the schema into which each document's primary content gets indexed. You can get fancy by running different document types through different analyzer/tokenizer chains (for example if they were in different languages) and you can do a lot of 'cheating/preprocessing' here so that the primary search text field has good information in it.

</comment></comment></comment><comment><USER4> I doubt you will get a useful answer in a comment. Each of your questions is very broad. And you didn't even select a search engine yet. You didn't specify the scale you're dealing with. You didn't specify the number of reads/writes per second that you expect.

Choose one system and learn it well.

<comment><AUTHOR> Scale - Added details to the post.

Search Engine - Elasticsearch</comment></comment>


The Closing Bell - <AUTHOR> https://elasticsales.com/blog/2012/07/17/bell/

<comment><USER2> The bell reminds me of Pavlovs Dogs <http://en.m.wikipedia.org/wiki/Classical_conditioning>

<comment><USER3> Here the bell is a social reinforcement for choices and efforts in making a sale; it is conditional on something you did. That something was a complex and extended and learned activity, of the type that few animals other than humans ever exhibit. It shows appreciation and provides an occasion for positive interactions.

This is a far cry from a predictive signal which causes a relatively simple physiological response to occur earlier than it would otherwise, in preparation for some uncontrollable condition.

(Yes, I know I am a very humorless and literal person.)</comment></comment>


Brasil from an US viewpoint (report) - <AUTHOR> http://www.youtube.com/watch?v=DMM7OJ_Kj9I&feature=youtu.be

<comment><USER2> I don't know if I speak for everybody, but why should I go watch some random video about Brasil? I don't think the HN crowd has much interest in seemingly off-topic videos without the poster giving a comment as to why it's relavent.

<comment><AUTHOR> I felt it was interesting to point out it's economic evolution, even as a potential market. Also, as far as i read from the webs, there's a lot of momentum on open source and inovation (Lua for example)</comment></comment>


Steven Jenkins - How to Design (Declarative) Programming Languages - <AUTHOR> http://people.csail.mit.edu/gregs/ll1-discuss-archive-html/msg04323.html

<comment><USER2> While that response is interesting, it actually missed the point of the question: what is a good, single source to point someone to who needs to design a DSL?</comment>


PNC Bank testing dynamic CVV codes to combat online card fraud - <AUTHOR> https://arstechnica.com/information-technology/2018/12/pnc-bank-testing-dynamic-cvv-codes-to-combat-online-card-fraud/ <comment><USER2> This wouldn't prevent the bot problem, right? It supposedly takes seconds or minutes to brute force the CVV by trying on many different websites. That leaves plenty of time to use the CVV before it expires.

Which vulnerability is this targeted at? Large scale breaches of merchants who are storing CVVs when they aren't supposed to? Card skimmers? I'm not familiar with what the typical attack vector is for card fraud.</comment>


Mapping cherry blossom - <AUTHOR> https://medium.com/@yanhann10/mapping-cherry-blossom-2926a44fc9b1 <comment><USER2> And for Washington, DC: April 8-12

[https://cherryblossomwatch.com/peak-bloom- forecast/](https://cherryblossomwatch.com/peak-bloom-forecast/)

<comment><USER3> Seems late. The so-called "indicator tree" is in full bloom. I am told that this usually means the rest will reach peak in about 7=10 days.

<comment><USER2> Interesting! I didn't know about the indicator tree.

</comment></comment></comment><comment><USER4> This is a specific use of phenology, studying animal/plant life cycle events, like flowering time.

Since ancient times, people have noticed these events – the first snowdrops show spring, for example – and in the 19th century, some naturalist-nerds started recording the exact dates. This was then a surprise climate change dataset.

[https://en.wikipedia.org/wiki/Phenology](https://en.wikipedia.org/wiki/Phenology)

</comment><comment><USER5> Thanks for sharing! I've been following a bunch of car enthusiasts from Japan on Instagram, and the past week or so they've begun posting photos of the cherry blossoms. Very cool to visualize the actual progression with a map (since I don't know many of the mentioned areas in the posts, usually).

</comment><comment><USER6> Why aren't any blossoms shown in Hokkaido?

<comment><USER7> Probably because it's too cold there?

<comment><USER8> They bloom later there because of the weather, but they still bloom.</comment></comment></comment>


Higher math proficiency test: An extended-problem-solving skill evaluation tool - <AUTHOR> https://mathvault.ca/math-test/ <comment><USER2> I looked at most or all of the questions, before the test system went down. (Cue rant about modern software.)

Some of the questions are quite poorly worded, and I'm highly suspicious about one question with non-integral boundaries on a probability distribution defined over the integers. Since I didn't get to see results, I can't say whether they screwed up or not.

It seems like the question level was appropriate for students that took Calc I/II and some course like Discrete Structures.

<comment><USER3> Yeah, the wording is quite poor.

The second question about the distribution of random answers to the test is literally incoherent. They probably _meant_ to ask a question about the expected number of random answers on a randomly completed test, but they worded it such that they are asking about the distribution of answers on a single test.

<comment><USER4> >Assuming that every question in this 20-question test has only 1 right answer and you choose to answer each question randomly, what is the chance that you're so bad that you only get 4 questions right or less?

They probably mean for you to assume that 1) each question has 5 answer choices, and 2) you select one of them with equal probability. But given that this is question #2, assumption (1) is kind of a guess, and (2) should be explicitly stated... (the answer btw has to do with the binomial distribution - and you definitely need some heavy arithmetic, so are they testing your gut instinct?)

<comment><USER2> The messed up question I was referring to, and I think bloaf was referring to, is a later one, the second one involving random answers:

> Assuming that every question in this 20-question test has only 1 right > answer and you choose to guess the answer of each question randomly, then in > terms of the number of correctly-guessed answers, approximately 68% of them > will fall between:

> A. 2.2 and 5.8

> B. 0.8 and 7.2

> C. 6.8 and 12.5

> D. 7 and 13

> E. None of the above

Another messed up question was the one early on asking whether the dot product operator is "associative/commutative on addition" or not. That's not a thing that actually means something.

<comment><USER5> I answered none of the above precisely because associativity doesn't apply to an operator that maps 2 vectors to a scalar. But it still felt wrong.

<comment><USER2> Oh, I was parsing the responses like "(Non-associative, commutative and distributive) on addition". And no, the dot product is not commutative on addition. But it's meant to be "Non-associative, commutative and (distributive on addition)".

</comment></comment></comment></comment></comment></comment><comment><USER6> Who is this test aimed at? It mentions the math GRE, which would make me think that it targets people applying to graduate programs, but it doesn't really have that vibe and I imagine becoming a test that graduate programs would consider is quite a difficult undertaking.

</comment><comment><USER7> I pretty much couldn't answer a single question. With a lot of time I could have "bruteforced" a few, maybe. Getting something better than a F? Impossible.

Soon I will have a MSc in Software Engineering... I simply memorized my way through college math classes, just like most of my colleagues.

Math always made me feel dumb. I never had intuition for it. Deeper understanding was always just out of reach. I truly loathe math.

<comment> ur-whale Given what you just said, if I was you, I'd strongly reconsider my career choice (if you ever plan to excel at it, that is).

</comment></comment><comment><USER5> The test fails to show you which answers (it thinks) you got wrong. Which makes is pretty useless...

<comment><USER8> The frontend actually receives all the quiz data with the correct answers from the server, here is cleaned up version of it: [https://pastebin.com/MF5TTBGr](https://pastebin.com/MF5TTBGr)

</comment></comment><comment><USER9> Haven't read the article (it's down) but isn't the best test for proficiency in higher maths that you can actually _do_ higher maths? Why do we need these proxies?

<comment><USER10> Cost of testing. You can get a good idea of someone's ability to do higher math in an hour with an IQ test. If instead you give them a test of higher math, you'd need to train them to do it first, which would take much, much longer. The added accuracy of that test won't make up for the several-orders- of-magnitude increase in cost.

<comment><USER9> Fair enough. But there needs to be evidence that this stuff actually works. I'm reminded of the fact that Richard Feynman didn't have a high enough IQ to get into Mensa.

<comment> barry-cotter > But there needs to be evidence that this stuff actually works.

[https://www.gwern.net/docs/www/www1.udel.edu/63a495ef6b79bb4...](https://www.gwern.net/docs/www/www1.udel.edu/63a495ef6b79bb4ce508ed205546bcba826e42a5.pdf)

Why g Matters: The Complexity of Everyday Life

Personnel selection research provides much evidence that intelligence (g) is an important predictor of performance in training and on the job, especially in higher level work. This article provides evidence that g has pervasive utility in work settings because it is essen- tially the ability to deal with cognitive complexity, in particular, with complex information processing. The more complex a work task, the greater the advantages that higher g confers in performing it well. Everyday tasks, like job duties, also differ in their level of complexity. The importance of intelligence therefore differs systematically across differ- ent arenas of social life as well as economic endeavor. Data from the National Adult Literacy Survey are used to show how higher levels of cognitive ability systematically improve individuals' odds of dealing successfully with the ordinary demands of modem life (such as banking, using maps and transportation schedules, reading and understanding forms, interpreting news articles). These and other data are summarized to illustrate how the advantages of higher g, even when they are small, cumulate to affect the overall life chances of individuals at different ranges of the IQ bell curve. The article concludes by suggesting ways to reduce the risks for low-IQ individuals of being left behind by an increasingly complex postindustrial economy.

<comment><USER11> The "not much more than g" era in research has ended. TLDR: cognitive ability is not just a single scalar value.

> For several decades, the question of whether measures of specific cognitive > ability contributed anything meaningful to the prediction of performance on > the job or performance in training once measures of general mental ability > were taken into account appeared to be settled, and a consensus developed > that there was little value in using specific ability measures in contexts > where more general measures were available. It now appears that this > consensus was premature, and that measures of specific abilities can make > important contributions even if general measures are taken into account.

[https://www.ncbi.nlm.nih.gov/pmc/articles/PMC6526477/](https://www.ncbi.nlm.nih.gov/pmc/articles/PMC6526477/)

<comment><USER9> The "g" hypothesis itself was built upon an abuse of factor analysis. An abuse that had a high chance of producing something spurious.

<comment> barry-cotter For a much, much longer treatment of the argument ogomad gestures towards, read Cosma Shalizi[1] g, A Statistical Myth. Note that most of the criticism applies as well to temperature or pressure as to g. For a detailed response to Shalizi, see Human Varieties[2].

[1] [http://bactra.org/weblog/523.html](http://bactra.org/weblog/523.html)

[2] [https://humanvarieties.org/2013/04/03/is-psychometric-g-a- my...](https://humanvarieties.org/2013/04/03/is-psychometric-g-a-myth/)

</comment></comment></comment></comment></comment></comment></comment><comment><USER12> Data point: 70%.

Background: Software Engineer.

I found this to be challenging.

<comment><USER8> Just so you know, the test sends requests to the server on every answer and sometimes these requests silently fail with 503 error code, you don't get any points in such case, even if you answered correctly.

</comment></comment><comment><USER13> looks like it's been slashdotted.

</comment><comment><USER14> (The link will not load for me, as of writing.)

The US SAT I of the late-1990's was far too easy (I only missed one Q with a mis-selected answer, but I'm no genius and didn't study or prep for it one iota (or epsilon, as the case maybe)). Static, multiple-guess Q&A tests aren't able to assess a broad range of orders-of-magnitude of capabilities because of their various vulnerabilities.

Professional Engineer and physics tests that include fewer, open-ended written-response problems that build on each other tend to be more rigorous forms of domain knowledge testing. Some Q&A can be used as a first-pass filter, but it shouldn't be relied-on how the US K-12 under NCLBA leans on excessive multiple-choice standardized testing.</comment>


First look at Waymo's fully self-driving Chrysler Pacifica Hybrid minivans - <AUTHOR> https://medium.com/waymo/a-first-look-at-our-waymo-fully-self-driving-chrysler-pacifica-hybrid-minivans-5677e5e67750#.lad0pktix <comment><USER2> This post reads like an advert. We're still a loooong way out from self- driving cars making it to consumers. I'd even say it's over a decade. There is a ton of regulation that needs to be worked out. As exciting as the tech may seem, there is still a lot that needs to be considered between safety and regulations. I recently did a post on this:

[http://penguindreams.org/blog/self-driving-cars-will-not- sol...](http://penguindreams.org/blog/self-driving-cars-will-not-solve-the- transportation-problem/)</comment>


Ask HN: How do you secure home network when you're not the only one using it? - <AUTHOR> Partner, kids and guests, you cannot expect everyone to follow good security practices. Heck, often you cannot even trust a lot of the software you use. So what do you do? Separate guest network? Separate network just for yourself? <comment><USER2> VLANs. Pretty much everything supports them now other than the crappiest commercial gear.

I have:

A "front-door" network, which is the network behind my firewall. Anything internet facing is there, as well as monitoring tools (e.g. Snort). Things here can't talk back to more interior networks.

A "family" network. Generally untrusted, all the phones, iThings, IoT that I decide actually needs to phone home, kids laptops, etc. There's a guest WiFi that dovetails here.

A "work" network. Network for my wife and mine work laptops and other work specific resources.

A "service" network for all the backend stuff.

I have an OpenBSD firewall segregating things. The fileservers are VLAN attached so they have an interface on each network.

</comment><comment><USER3> subnetting

its like putting up laneways in your network

its also possible to relay an internet connection from a primary router to a secondary router so you can have control over the traffic to and from the guest router

use an alternate DNS there are ones that filter certain content

you could also encrypt the network traffic</comment>