Show HN: An API for filling out PDF forms - <AUTHOR> https://formapi.io <comment><AUTHOR> Hi HN! I started FormAPI because I've been living in Southeast Asia for the last few years, and I've had to fill in a lot of visa application and extension forms. I want to build a service where you can fill in visa forms online, so I built FormAPI as the first step towards that project.

I also used to work at Gusto (a payroll company), and we had to fill out a lot of tax forms, which took a lot of work. I know this is something that many financial and legal startups have to do, so hopefully FormAPI can make this process a lot easier.

Let me know if you have any questions or feedback!

<comment><USER2> This is absolutely great and it will enable A LOT of very useful applications.

One question though: I assume that the automatic detection of form fields does not always work. Especially if the PDF does not exist in a "fillable" format. Am I right with that interpretation?

<comment><AUTHOR> Hi, at the moment we can only import fillable PDF forms (AcroForms or XFA.)

In the future we might implement OCR and machine learning to automatically detect fields in scanned or photographed PDFs. I think it could also be useful to build an index of fillable PDF forms (e.g. from the IRS and UCSIS), and then use those original fillable PDFs whenever we detect a matching scanned form. We might also build a public database of fillable forms.

But I don't want to build any of those features unless I have a customer who actually needs it. (Please send an email to email@example.com if this is something you would use!)

</comment></comment></comment><comment><USER3> From the terms:

 _FormAPI is not PCI DSS Certified or HIPAA compliant._

 _You understand that the technical processing and transmission of the Service, including your Content, may be transferred unencrypted and involve (a) transmissions over various networks; and (b) changes to conform and adapt to technical requirements of connecting networks or devices._

Unfortunately, this is a service that sees the data being entered on the form. If it processed a blank PDF form and sent back something you ran locally to generate a filled-in form, that would be great. But as a service, it sees too much user data.

<comment><USER4> agree... this looks amazing, but no way I could ever use it... can't send user data to a service like this... DOA...

<comment><USER5> What's with the 3 ellipses? A few of my friends text that way and it feels awkward.

<comment><USER4> It's standard for unexplicit continuation of a thought...

<comment><USER5> I honestly can't read this without visualizing someone rolling their eyes after every thought while finishing their sentence sarcastically with a vocal fry lol.

</comment></comment></comment></comment></comment><comment><USER6> To the OP: Can I ask what your process was? A project like this obviously takes a lot of time. How certain were you that you had a product people wanted before embarking on the dev?

<comment><AUTHOR> I mentioned this in another comment, but I've had to fill in a lot of visa application and extension forms while living in Southeast Asia. I wanted to make that process easier, so this was the first step towards that goal.

I've also worked at companies where we built something similar in-house. So while this is a very niche product, I know there's a least a few developers out there who may find it useful.

Building something like this is also a great way to find new problems to solve. I think even if it's a niche idea or something you're not sure about, it's better to start building something than to wait for the perfect idea.

<comment><USER6> Thanks for sharing that. I think using one's job to identify potential markets is a great idea.

</comment></comment></comment><comment><USER7> This api has inspired this idea:

Ever notice most new health care provider visits still require a ton of paper work?

Use mobile app to take a picture of their arbitrary form, use OpenCV to interpret it as as real data structure, autofill it from a personal database, and print it out on one of those tiny portable printers, and hand it back to them.

To try and make it viral: When used to process a form, the app also generates a web site for that office. Then anyone can search for dr. lowtech's office and use the site to form and print them at home before coming in.

Each printed form would have a header/footer asking the provider to register on the site, at which point it could become an official entry point into the system and leverage other efficiencies. Some hipaa stuff applies but nothing insurmountable.

I guess everyone else here also has 10 ideas a day pop into their head for a startup. So on to the next one...

</comment><comment><USER8> @nathan_f77: That's an unusually large plans and pricing page:

[https://formapi.io/sign_up](https://formapi.io/sign_up)

I'm not saying that it's bad, but I think it's strongly worth your while A/B testing that idea because it's quite granular.

You may find that with just 3 plans you would leave less money on the table over time.

(Of course you would also have a "call for enterprise options" link.)

Another option is (and I did this with pluggio) is to let, say, 50 people in for a very low special price and then observe exactly how many api calls they make.

Then based of that data work out your usage bands and magic levers.

Also, I note your only magic lever is usage but I bet there are other levers you can use to get people from one plan to another.

Anyway, I hope this is useful feedback!

Great job on the site :)

<comment><AUTHOR> Thanks for the great feedback! We definitely need to test various pricing and sign up pages. And yes, we will be watching how our customers use the service, and have already discovered a lot of things that we need to improve.

</comment></comment><comment><USER9> Hey guys,

Not trying to plug our co but its totally relevant here...we built a field detection algorithm to find the fields in any form. So you can drag n drop your doc and start filling it in and sign it within a couple of seconds. Feel free to check it out. Thanks guys! [https://www.paperjet.com/](https://www.paperjet.com/)

<comment><USER10> This is great! How do you detect the fields? Are you using image processing?

</comment></comment><comment><USER11> Most forms contain personally identifiable information. Some contain extremely sensitive information, for example the kinds of forms that you describe-visas, etc.- contain national ID numbers and so forth. The idea of providing this to a third party web site scares the daylights out of me. Is it possible for me to obtain the source code on Github and host it myself?

<comment><AUTHOR> I totally agree, these forms can contain very sensitive information. Actually there is some information that is too sensitive - We are not currently PCI DSS Certified or HIPAA compliant, so we cannot handle credit card details or protected health information.

We are very serious about protecting PII. One of the ways we achieve that is by using battle-tested frameworks and libraries with the default settings (Rails and devise), and not writing our own code for crypto and security.

By default, we delete generated PDFs and any associated data after 7 days. This can be configured in the template settings [1], so you can make the retention period much shorter. You can also immediately delete any submitted data by making an API request [2]. (Disclaimer: Data may be present in our automated database backups for up to 2 weeks.)

Finally, FormAPI is not open source, but we can provide a license for a self- hosted installation. For enterprise plans and on-site hosting, please contact: email@example.com

[1] [https://formapi.io/docs/template_editor/settings.html#expire...](https://formapi.io/docs/template_editor/settings.html#expire- submissions)

[2] [https://formapi.io/docs/api/expire_submission.html](https://formapi.io/docs/api/expire_submission.html)

<comment><USER12> > We are very serious about protecting PII.

Problem is, everyone (from Equifax to Yahoo) says that. If I can't trust a huge multi-billion corporate, I would certainly be nervous about trusting a very new startup with much more than my email address.

<comment><AUTHOR> Yes, that is very true.

I am planning to move my hosting to Aptible [1], and will become PCI certified and HIPAA compliant.

If anyone is interested in FormAPI, but requires PCI certification and HIPAA compliance, please send an email to email@example.com. We'll let you know when we are ready. You can also send an email to email@example.com to inquire about on-site hosting.

[1] [https://www.aptible.com/](https://www.aptible.com/)

<comment><USER13> Congratulations on your launch!

On the one hand, I understand the concerns about PII in your app.

On the other hand, I'd be willing to bet there are a ton of line-of-business apps that don't handle PII that could benefit from this (purchase orders, B2B shipping forms, etc.).

Unless you have investors, I would suggest waiting until you get >100 paying customers to find out whether you need to pay the premium for PCI/HIPAA hosting.

<comment><AUTHOR> Thanks for the feedback @runako, yes PCI and HIPAA compliance is very expensive. I will need to hear from more customers who need this level of security and compliance before I can afford to make the jump.

</comment></comment></comment></comment></comment></comment><comment><USER14> This looks really good and the demo is really effective. Best of luck to you!

Was DocRaptor a big influence on how you priced it?

Shameless plug: I've also recently been working with PDFs - a PDF template creator and API [0] - but I have a different use case in mind.

[0] [https://fetchpdf.com](https://fetchpdf.com)

<comment><USER2> Hi I like this.

Are you aware of [https://www.docmosis.com/](https://www.docmosis.com/) ?

How do you compare to them?

<comment><USER14> I wasn't aware of them, no. They're definitely more established and have more features.

The goal of FetchPDF was to let web applications give their users a way to create and edit PDF templates in the browser. e.g. to customise system templates for invoices, certificates etc.

I still have a lot of work to do to, it would seem.

<comment><USER2> Don't let it discourage you. They have their own set of problems, the first one being that they use libre office for templates, a piece of software that not everybody likes or is familiar with.

I've been a happy customer of docmosis, but I'm still interested in using your service if it provides easier templating.

<comment><USER14> Please feel free to sign up for the trial.

Send through an email to the support email address and I'll upgrade the trial and set an API key without you needing to put in billing details.

But be warned - it's still in MVP stage and may disappoint! (It also means that it's very receptive to feedback :)

<comment><USER2> All right, I signed up :)

The big selling point for me is that the template generation is right there. It is much easier to explain to people than saying: All right, so you download libre office, create a document, upload it here, name it like this or that...

</comment></comment></comment></comment></comment></comment><comment><USER15> Hey Nathan! Great to see another product in the PDF space. I see a few similarities to PDF Otter[0] and was wondering if you drew any inspiration from it.

[0] [https://www.pdfotter.com](https://www.pdfotter.com)

<comment><AUTHOR> Hey, I did come across PDF Otter a few weeks ago when I found your Show HN post [1]. There was some great feedback in the comments. I started building FormAPI a few months ago, and should have done more market research!

[1] [https://news.ycombinator.com/item?id=14805750](https://news.ycombinator.com/item?id=14805750)

<comment><USER15> No worries! Feel free to email me if you want to collaborate: Mariusz at PDF Otter dot com

</comment></comment></comment><comment><USER16> Looks good. I think some real life use cases would help on the sales site.

So the use case is you have a company that only accepts PDFs as an input and you have a digital data set that you need to get each individual row into one PDF?

How do you handle signatures?

<comment><USER17> Not OP but one use case is charitable grants. I made an app for a homeless agency my girlfriend used to work at for automatically filling out PDFs. They spent an inordinate amount of time filling out grant application PDFs, most of which requested essentially the same info. We made a simple WPF app that let them tag each field on the PDF as a particular info type (e.g. address, or address line 1, or statement of organization's purpose) then click a button to autofill. They keep all the data in a single underlying spreadsheet for convenience and just update that, rather than treating each of their hundreds of applications as bespoke.

Also I work at an accounting firm and we have a home grown solution that does precisely this for all of the standard IRS forms we fill out. For a larger firm like mine, we can afford to have someone code the solution in house, but for smaller firms or for in-house accounting departments, this could be worthwhile, depending on the price point.

</comment></comment><comment><USER18> There exists also php-pdftk ([https://github.com/mikehaertl/php- pdftk](https://github.com/mikehaertl/php-pdftk)). Great software for filling pdf forms.

</comment><comment><USER19> I like this service as well: [https://www.platoforms.com](https://www.platoforms.com).

</comment><comment><USER20> Would be interested to hear a bit about the internals. Which PDF libraries you tried, which one you ended up using, why, etc.

<comment><AUTHOR> I built the site using Ruby on Rails, and ended up trying all the PDF libraries I could find. In the end I had to use six different libraries and tools to solve various problems with parsing or transforming PDFs.

The libraries I use are: pdf-reader [1], prawn [2], prawn-templates [3], origami [4], qpdf [5], and pdftk [6].

There's a new PDF library for Ruby called hexapdf [7], and it looks really promising. I think it might even be able to replace all six of these libraries, but it's released under the AGPL license, and commercial licenses are not available yet.

[1] [https://github.com/yob/pdf-reader](https://github.com/yob/pdf-reader)

[2] [https://github.com/prawnpdf/prawn](https://github.com/prawnpdf/prawn)

[3] [https://github.com/prawnpdf/prawn- templates](https://github.com/prawnpdf/prawn-templates)

[4] [https://github.com/gdelugre/origami](https://github.com/gdelugre/origami)

[5] [http://qpdf.sourceforge.net/](http://qpdf.sourceforge.net/)

[6] [https://www.pdflabs.com/tools/pdftk-the-pdf- toolkit/](https://www.pdflabs.com/tools/pdftk-the-pdf-toolkit/)

[7] [https://hexapdf.gettalong.org/](https://hexapdf.gettalong.org/)

</comment></comment><comment><USER21> Will there be an API sometime in the future? Also will it be possible to whitelabel the template editor and/or make it embeddable?

</comment><comment><USER22> this is an interesting idea. i like how it is declarative.

acrobat FDF[1] and Apache PDFBox[2] provide something similar but are not declarative. i'd be interested in seeing an approach with mozilla/pdf.js ... though i'm not sure how usable it would be.

[1] [http://www.adobe.com/devnet/acrobat/fdftoolkit.html](http://www.adobe.com/devnet/acrobat/fdftoolkit.html)

[2] [https://pdfbox.apache.org/](https://pdfbox.apache.org/)

</comment><comment><USER23> Is this web form to pdf or pre existing fillable pdf to json?

<comment><AUTHOR> FormAPI converts any existing PDF into a template that can be filled out via an API call, or via an online form.

If you upload a scanned PDF (e.g. plain images), then you can add form fields in the template editor. If you upload a pdf with a fillable form, then we will automatically import all of the existing fields (and the imported fields can then be modified or removed.)

<comment><USER24> I'm really confused. Is this intended as a programmer's tool? Or as an end user tool?

If I understand it, create an HTML form, submit to server, spit back PDF. This has been built into ColdFusion for about a decade, and it is trivial. [and I assume other server side software can do the same thing].

Aside from that, the bulk of the PDF Forms I download these days can already be filled out with Acrobat. I'm not sure what benefit you're offering me in time savings.

<comment><AUTHOR> This is a tool for programmers who need to fill out a lot of PDFs automatically. For example, a freelancing service could use FormAPI to fill out W-9 forms for contractors.

Or if I built a service for end-users to fill out and sign PDFs, I would create a separate website and use FormAPI to generate the PDFs. (I don't think I will do this, though.)

You're right that if you just need to fill in a single form, then there are easier ways to do that. (Even just using the Preview app on Mac).

<comment><USER24> If I download a W9 from the IRS web site I can fill it out directly using Acrobat. I'm pretty sure the free reader is all you need.

I guess I'm not understanding the niche you fill.

Good luck with it, though.

</comment></comment></comment></comment></comment><comment><USER25> Why exactly is this a web API? Don't get me wrong, it's great work, but it seems like something that would be much better suited to a library.

<comment><USER26> He can make money off of a web API. A library would be hard to keep closed source.

</comment></comment><comment><USER27> Fantastic work! The UI looks really slick! How long have you been working on this project?

<comment><AUTHOR> Thanks! I've been working on this for about 2 months.

</comment></comment><comment><USER5> I've got formy.io if you want it. Was building something similar way back.

</comment><comment><USER10> Cool project!

Shameless plug: if you need the opposite, i.e. getting text/structured data out of filled PDF forms (or any kind of PDF document), feel free to contact me.

</comment><comment><USER28> Emailed you Nat (when you get a chance).

</comment><comment><USER29> How does this handle user signatures?

<comment><AUTHOR> There is currently no signature support on the online forms, but that's something I would like to add soon.

When generating a PDF via an API request, you can add an image field, and upload your user's signature as an image. You could also create a faux signature by using a text field with a handwriting font (The Dancing Script [1] font is available.)

This is a tool for developers to fill out PDFs, so in your own application you could use something like the signature_pad library [2], and then pass the signature images to FormAPI.

[1] [https://fonts.google.com/specimen/Dancing+Script](https://fonts.google.com/specimen/Dancing+Script)

[2] [https://github.com/szimek/signature_pad](https://github.com/szimek/signature_pad)

</comment></comment><comment><USER30> after you fill out the form, does this return back a PDF to you with fields filled out?

<comment><AUTHOR> Yes, when you submit the form, we fill out the fields, and then you can download the generated PDF.

<comment><USER30> will the generated PDF be in the original format of the PDF?

<comment><AUTHOR> Yes, we return the original PDF with the fields filled out. However, for PDFs with "fillable forms", we remove the forms, so the PDF is no longer editable.</comment></comment></comment></comment>


Ask HN: "You struggle to design solutions to complex problems." - <AUTHOR>

Hey all, back with an anon posting. I posted this a while ago:
https://news.ycombinator.com/item?id=6375141
Things have improved in some ways and worsened in others. I've had a chance to grow, but my work is becoming increasingly managerial. After failing to ship a project earlier this year, my boss made the comment in the title, citing it as a reason I would not be promoted this year.
I do not disagree with the criticism, but have decided to move on, believing that opportunities to improve and grow at this firm are limited to managerial tracks. I'd like to move into management a few years from now, but not immediately.
How can I get better at designing solutions? I'm often overwhelmed by the space of possible solutions, and freeze up when thinking of an approach.
EDIT: by "solution" I believe my boss meant either a feature or product that solves the desired problem. <comment><USER2> I guess this is obvious advice, but you should probably focus on getting better at designing solutions by designing solutions.

While I'm a little fuzzy on what exactly the word "solution" means for you, but if it means things like designing a product that accomplishes a goal from backend to front, then you can certainly do that without anyone's permissions, and it serves as great practice for learning the areas that actually must be considered when creating solutions for clients.

Also, struggling with the large space of possible solutions is the job of a person who creates solutions. Carefully weighing tradeoffs and making good choices in the face of uncertainty is kind of the reason they pay architects and people with those kinds of jobs so much

<comment><AUTHOR> Thanks for commenting. Agreed with your definition of "solution."

This is why I'm leaving, actually: opportunities to design solutions are dwindling, as I'm getting more managerial work.

<comment><USER2> So I also have the same desire, but what I have found comforting is working on side projects, for work and for myself. As long as wherever you're working now isn't too strict with ownership (like they don't try to own everything you do all the time) then when you want to move to a more creative place, you can leverage the side projects (describe them, tradeoffs, etc) and they'll be very impressed.

Also, as long as the work isn't too soul crushing, you could get your design/creation itch satisfied elsewhere while they pay for you to do so.

While this might not be ideal, I always code outside of wherever I'm working at the time, that takes the pressure off the position to be super challenging.

Also, generally people at companies that have become somewhat complacent are always very impressed to find you have time for side projects.

Why not grab one of the ideas on here on the idea-sunday threads and start making it? Pick a language/framework/database that you don't know, and start fleshing out and app.

One of the cool recent things I've seen is strongloop, which does your whole API & DB layer (think ORM on steroids) for you, and you can pair that with some messing around on the front end, and instantly get a taste for a new technology, as well as getting something to put on your resume</comment></comment></comment>


Doctors Denounce Cancer Drug Prices of $100,000 a Year - <AUTHOR> http://www.cnbc.com/id/100673659

<comment><USER2> Nothing will ever be cured so long as Big Pharma can profit from it.</comment>


IPhone + iPad combined sales are higher than Android - <AUTHOR> http://snowedin.net/blog/2011/04/03/iphone-ipad-android/

<comment><USER2> > But if you ignore the keyboards and the screen sizes, and just look at all > of these as computing devices, what does the market look like?

It looks like Windows is kicking everyone's ass in.

<comment><USER3> Not if you look at trends. Windows has been around for over twenty years, Blackberry for twelve, iOS and Android for about four. So in the last twelve years Windows has gone from about 98% of devices to 50%. That's not kicking ass.

</comment></comment><comment><USER4> Seems to have missed iPod Touch sales, and not noticed that Comscore is U.S. only (Android's global share is roughly similar, but Apple's is much lower).

If you fix those issues then both should be about 33 million sales in the last quarter, but Apple can go a bit higher, or lower depending on what you think iPod Touch sales are (Apple doesn't break them out). It would be interesting to see the pie chart with accurate figures (I believe the PC sales are just a guess too).</comment>


Review of SmartQ 7 Mobile Internet Tablet - <AUTHOR> http://www.mobileread.com/forums/showthread.php?t=48934

<comment><AUTHOR> A few notes:

The reviewed device has a 7" 800x480 LCD screen, and lists for USD 190 at <http://www.eletroworld.cn/>

Besides the originally shipped Linux (Ubuntu derived, it seems), there's an image of Mer for it here: <http://wiki.maemo.org/Mer/Releases/0.14>

The same sellers also list an A700 tablet device with 8.9" 1024x600 LCD for USD 220. Also a few cheap and cheerful non-Intel netbooks.</comment>


Namecheap now offer .io domains - <AUTHOR> https://www.namecheap.com/domains/extensions-tlds/cctld/io.aspx <comment><USER2> Competitor to namecheap here. [1] [2]

We don't offer .io domains. Nor do we offer any of the TLD's that seem to be popular with some startups. Even though we could make money selling them. Like our competitors do.

Although popular (with startups) they aren't mainstream with the public. If you become successful you will just end up buying (at a much higher price) the .com equivalent. Or end up having misdirected mail and/or users or investors or bloggers or reporters etc. Whatever .com you can buy now will be much more expensive once the .com owner sees you have funding and a business model and a website.

I've been doing domains since the mid 90's. My strong advice is to stay away from anything but .com for your startup.

Despite what you may think there are plenty of .com's you can register (try leandomainsearch.com for ideas (I have no affiliation to that at all but use it from time to time).

And not all people holding domain names are vultures, cybersquatters whatever you want to call them. Some are actually fairly reasonable (I do some consulting on the side where I help people buy domain names).

[1] No we are not looking to get HN business if we were I'd have who we are in my sig.

[2] We aren't cheap.

<comment><USER3> >My strong advice is to stay away from anything but .com for your startup.

If you make it big enough to have to buy the .com from the current owner, then you are probably going to be able to buy it. When I discovered that new domains cost about 2 packs of cigarettes, I became a compulsive domain buyer. If the .com for my crazy idea isn't available, then I try .co, then basically whatever I can find. I use a combination of [http://domai.nr](http://domai.nr) and [https://iwantmyname.com/](https://iwantmyname.com/) to see weird combinations. I think you would be hard pressed to find a startup can attribute its failure to the fact that it had a fancy TLD.

Odd tlds that hit it big: del.icio.us, bit.ly

Odd tlds that I visit often: github.io, any.do, 500.co, domai.nr

I think in a world where non-technical people use google as their address bar, we should fee free to use exotic TLDs. Not to mention with the upcoming release of new TLDs .com is about to be as important / common as www.

<comment><USER2> "If you make it big enough to have to buy the .com from the current owner, then you are probably going to be able to buy it. "

Let me address that specifically. First, you get people who are unreasonable and perhaps would think that because you are valued at a billion you will pay them 500 million or something stupid like that. They are wrong but their irrationality is not going to make it easy for you to get the domain when you want it.

I have a case right now where a startup is willing to pay, say, $100,000 for a domain. But the domain (not being used) is owned by a company in Europe. And they aren't interested in selling at any price near that. And the domain is not worth $100,000.

Second, your thoughts assume either "make it or don't".

There is an in between state. Where you appear successful and profitable but you don't have unlimited google resources. And actually I think it's quite obvious that there are a few companies that fall into this category. Since of course most people are not going to be "big enough" to buy what they want "at any price".

<comment><USER3> I agree that squatters can be unreasonable or downright insane. I think that my main argument is that owning a ".com" neither helps nor hinders a startup and its quest for eyes. I could never remember how to spell del.icio.us, but it didn't matter, I bookmarked it. If I was on another computer, I googled it.

<comment><USER4> _> I agree that squatters can be unreasonable or downright insane._

There use to be a company called songbirdnest.com that made something that could be described as an open-source version of iTunes(but they preferred it wasn't thought of that way). The person who owns songbird.com refused to sell. Apparently a very hansom offer was made too...

[http://songbird.com/](http://songbird.com/) site looks the same as it did back in 2008. Considering that the site doesn't look like anything that's generating revenue, I don't understand why that person refused to sell...

<comment><USER5> > Considering that the site doesn't look like anything that's generating > revenue, I don't understand why that person refused to sell...

Maybe because unlike you, he's not an unquestioning whore to the almighty dollar. (I expected a small bird-feeder business before I clicked, but the point remains.)

<comment><USER4> _> username223 33 minutes ago | link

Maybe because unlike you, he's not an unquestioning whore to the almighty dollar. (I expected a small bird-feeder business before I clicked, but the point remains.)_

Ouch. You've hurt my feelings. Just like to add that if he said something about sentimental value or some such, I'd understand. Otherwise, why refuse _just for the sake of refusing?_ But, seeing as you're already on insult-mode, probably nothing good will come of this discussion.

</comment></comment></comment></comment></comment></comment></comment><comment> Link- For what it's worth, I've been using namecheap for over 2 or 3 years now, with around 10 domains registered with them, and I have to say that their service is quite good. The support is capable and promptly responsive. Very rarely, if ever, have I experienced technical difficulties. Even if it's not the cheapest in the market, the service is worth the extra $

<comment><USER6> Do they offer proper DNS services?

<comment><USER7> I moved all of my domains from GoDaddy to Namecheap. I host my own DNS. Recently, I decided to take a stab at implementing DNSSEC, but one condition is that your registrar must support it[1], and Namecheap doesn't[2]. I'm in no rush, but it's a little disappointing. I have no idea if DNSSEC is an option when Namecheap hosts your DNS. They've also only recently added support for IPv6 glue records. Nonetheless, I'm happy to be rid of GoDaddy and find the Namecheap interface to be much simpler and easier to use (concise email notifications of logins and account changes are also nice, and readable in more email clients than the noisy upselling HTML garbage that GoDaddy spews out).

[1] [http://www.internetsociety.org/deploy360/resources/dnssec- re...](http://www.internetsociety.org/deploy360/resources/dnssec-registrars/)

[2] [http://www.icann.org/en/news/in- focus/dnssec/deployment](http://www.icann.org/en/news/in- focus/dnssec/deployment)

<comment><USER8> Don't give up on DNSSEC just yet. You can use DLV (DNSSEC Look-aside Validation) if your registrar doesn't support it yet:

[https://dlv.isc.org/](https://dlv.isc.org/)

</comment></comment></comment></comment><comment><USER9> I've never heard of namecheap, but given their name I'm surprised they charge so much more than gandi.net ($39).

Is it normal for a company branded as the low cost provider to charge above market for rare goods?

<comment><USER10> Maybe that's the price of free speech. Namecheap doesn't have any unusual restrictions on what you do with your domain after you buy it. Gandi does. You have to uphold their ethical code and affirmatively fight "deviant uses of the internet" to register domains through them. Hacker News would violate that code, and under the terms of Gandi's service agreement, they could revoke service and cancel this domain if it were registered through them.

[http://en.gandi.net/static/contracts/en/g2/pdf/MSA-1.3-EN.pd...](http://en.gandi.net/static/contracts/en/g2/pdf/MSA-1.3-EN.pdf)

<comment><USER11> I really appreciate you posting this information. I had considered Gandi in the past and would not have read their ToS; I'll stay away now.

As for our friend jjblue, you can safely ignore his citation trolling. The rest of us appreciate the warning. There's no point in waiting for victim #1 before telling your friends about danger. Thanks again!

<comment><USER12> Deviant uses is defined as "spamming, phishing, hacking, cracking, or attempts at hacking or cracking". That's a pretty standard ToS right?

<comment><USER10> Not at all. Neither is that the extent of the agreement. You agree that you will not use your domain to distribute any information in violation of their ethical code. You agree that you'll also police any 3rd parties with the ability to publish content (i.e. blog comments or forum posts). The list of things you can't talk about on your site include anything "prejudicial", not just illegal. It includes any discussion that doesn't respect the "image" and "honor" of any other person. It includes any discussion inappropriate to the "age and sensibility" of anyone the site is meant to be read by.

That's all from section 3.3 of the agreement. Making your ownership of your domain name contingent upon active monitoring and censorship to uphold ambiguous "moral standards" of a 3rd party is NOT a standard registrar ToS.

</comment></comment></comment></comment></comment><comment><USER13> I'm using [http://iwantmyname.com](http://iwantmyname.com) for [http://gitignore.io](http://gitignore.io) and they have been great. They update their DNS records very quickly and I haven't had any problems with their service and right now they are $49.

<comment><USER14> I was actually looking at building a site like that a few weeks back. Discovered the .io was taken and was what I wanted to build. Thanks.

<comment><USER13> Hehe sorry :) and You're welcome. The code is all on GitHub and I actually want to re-architect the site.

</comment></comment></comment><comment><USER15> I love the IO ccTLD, but it's just too expensive to justify on a free side project that doesn't make any money. First-world problem, eh?

<comment><USER16> Not coincidentally, that's also why so few .io domains are parked. Overall, I'm OK with this.

<comment><USER15> It's definitely a trade-off. For me, I just ended up doing -io.com :)

</comment></comment></comment><comment><USER17> I like the .io TLD but it seems like Namecheap and others haven't really done much to make it cheaper. I can't see myself paying more than $30 a year for a single domain registration, so I've simply used other TLDs when I've had opportunities to register a domain for a project. If .io was cheaper I'd buy a couple of domains in a heartbeat, though.

<comment><USER18> The upside is that the higher price may be inhibiting squatting and thus you're more likely to find a good name available.

<comment><USER2> "the higher price may be inhibiting squatting"

The high price is a result of the fact that the base cost of the domain is much higher than it is for .com/.net/.org/.info.

Here is the wholesale .io pricing which is based on volume (doesn't work that way for .com/.net/.org/.info)

[http://www.nic.io/join.html](http://www.nic.io/join.html)

So for example nic.io regular price is $60 US.

Even at the top bracket the best a registrar could do is $30 per domain.

This is compared to around $8.xx for .com that a registrar pays (we are a registrar).

<comment><USER19> Where do you see the nic.io price is $60? I just paid $96 us dollars last week from the site. Nic.io prices are in pounds.

<comment><USER2> Your right. I missed the pound saw it for EU but missed it on non eu.

</comment></comment></comment></comment></comment><comment><USER20> Doesn't seem to be avaliable for transfers:

"ignite.io cannot be transferred The domain name seems to be invalid or the TLD is not supported. Please make sure you entered the domain name properly and don't add www. in front of the domain name."

<comment><USER21> Same here. I just chatted with customer support and it's currently not supported. The guy I spoke with didn't know whether that was something they were working on.

</comment></comment><comment><USER22> I've transferred or am transferring about 10 of my domains from places like GoDaddy and 1and1 to NameCheap. I love NameCheap. I typically go for whatever registrar is the cheapest regardless of how crappy the interface is and NameCheap has successfully become the cheapest registrar for a number of my TLDs. The benefit is that their service and web interface are great! I highly recommend.

</comment><comment><USER23> Bleh. My personal domain renewal is coming up and Namecheap has gotten lots of recommendations here at HN. But on the other hand I'm bit reluctant to move domains from (my current) Swiss registar to US one, even if they all ultimately are based on ICANN.

<comment><USER24> \- Out of curiosity, who's your current registrar?

\- I don't know if you're talking about a ccTLD or a com/net/org but if it's the latter I don't think a non-US registrar can help you since those TLDs are directly under US control.

<comment><USER23> Currently at joker.com, and .net domain. Yes, I know escaping US control is ultimately futile, but that doesn't mean that I'd be wanting to give in any more than necessary. Even in the worst-case scenario a Swiss company should be able to communicate about the circumstances, while US based registar might be gagged with NSL or equivalent and I'd be left in the dark.

</comment></comment></comment><comment><USER25> I switched to Namecheap several years ago and have never looked back. They are one of the only registrars to offer two-factor authentication.

</comment><comment><USER26> Purchased a domain, went through all the steps, account acc. card info, process transaction. Well funded card etc.

Register <snip>.io 11 Year $58.88 Charged: $0.00 $0.00 There was an error connecting to the registry. Free WhoisGuard __1 Year $0.00 Charged: $0.00 Related item failed.

</comment><comment><USER27> I've been using Namecheap for five years, but my .io domain is registered at name.com. I'll move back it to namecheap once it nears expiration just to put all my domains in one place and of to pay 58USD rather than 99USD.

</comment><comment><USER28> I use Namecheap for my domains. Been a good company so far.

</comment><comment><USER29> Does anyone recall a few months back a 3 and 4 letter .io search engine someone made and posted here? I can't find it in the HN search.

<comment><AUTHOR> Here ya go: [http://shortdomainsearch.net/](http://shortdomainsearch.net/)

</comment></comment><comment><USER30> I tried to place an order twice and received this error both times: "There was an error connecting to the registry."

</comment><comment><USER31> I use NameCheap because it's simple. Nothing fancy about it. I hate the crazy amount of popups GoDaddy gives you.

</comment><comment><USER32> Hey, hover.com offers .io domains as well; and I couldn't be happier with them. (not affiliated whatsoever)

</comment><comment><USER33> hexonet and gandi are equally trustworthy and have .io registration for cheaper

</comment><comment><USER34> I suppose google.io is taken.

<comment><AUTHOR> Created 2002-10-01!

<comment><USER35> they will automatically buy any and all TLD as a matter of policy

</comment></comment></comment><comment><USER36> gandi.net offers a better deal at 29€ for an .io domain.

</comment><comment><USER37> A month too late :-) Gonna have to move it :)

</comment><comment><USER38> "as low as $58.88 per year?"

</comment><comment><USER39> dang! eie.io is taken.

</comment><comment><USER40> Oh good. Now to setup a blog about programming web api's in GO complete with a little round picture of myself.

<comment><USER41> Haha. This is the best comment in this thread.</comment></comment>


Beaker – The data scientist's laboratory - <AUTHOR> https://github.com/twosigma/beaker-notebook

<comment><USER2> Looks like an interesting competitor to IPython/Jupyter notebooks. But they basically do the same thing - at first glance I can't really identify any significant differences. It would be nice if the website would clearly answer the question "Why choose Beaker over the more established alternatives"</comment>


Campaign demands telecoms unlock the FM radio found in many smartphones - <AUTHOR> http://www.cbc.ca/news/business/fm-radio-cellphone-telecoms-1.3577447 <comment><USER2> It was jaw dropping for me to see how high handed American telocs are, when I first experienced it. I took a friend's phone and tried to make a wifi hotspot. I was shell shocked as AT&T popup announced that I cannot do that!

Try doing this in India and no consumer would touch your phone. Contracts are not allowed in India. I am mildly proud that third world country telcos are much more open compared to western ones

<comment><USER3> In Japan (except with some minor providers), your contract is linked to a concrete terminal. If you break your terminal, you must buy a new one from the company that is providing you the service.

Also, if you want to use iPhone, you must get a contract with Softbank.

<comment><USER4> >Concrete terminal?

What do you mean?

>You must get a contract with SoftBank

Why? What do they offer that requires a contract? I'm not doubting you, but everything I can find online is poorly-translated pages that don't tell me much.

<comment><USER5> I think that they mean that you need a carrier-provided device, rather than bringing your own and popping in a SIM. As for the iPhone SoftBank thing: I'm assuming that they're the only Japanese carrier that provides the iPhone (Wikipedia's page on SoftBank says that starting with the iPhone 4S, it's available through KDDI as well, so maybe the previous commenter's information is out of date?)

<comment><USER6> SoftBank uses CDMA and LTE. I assume that they use SIM cards for LTE.

<comment><USER7> AFAIK the only way to get a SoftBank SIM is with a SoftBank phone. I walked into a SoftBank store many years ago and tried to buy a SIM for my phone, they thought it was very cute.

</comment></comment></comment></comment></comment></comment><comment><USER8> I think people should just "smarten up" and stop buying locked-down smartphones from telecoms. Almost every smartphone (and probably a lot of the dumb ones) that can be bought online from places like Aliexpress/Dealextreme/etc. has a working FM radio and are unlocked to be usable with any provider.

The reason is that the "FM radio chip" is usually not a separate IC that has to be designed in, but just a (tiny) part of an N-in-1 combo chip that provides WiFi, GPS, and BT, so all it needs is for support to be in the software to work. Here's one which has a FM _transmitter_ too:

[http://www.mediatek.com/en/products/connectivity/wifi/consum...](http://www.mediatek.com/en/products/connectivity/wifi/consumer- electronics1/mt6630/)

Since many of these relatively brandless smartphones are a direct copy of a reference design from the SoC manufacturer, designed to show off all the features, they automatically inherit those features and the companies who make them wouldn't spend extra effort just to remove functionality. The fact that the market for them is heavily feature-driven also means one less bullet point in the feature list is going to be noticed easily.

<comment><USER9> FM transmitters are great. No asking your friend to pull over to the side of the road to pair your phone to their car stereo, no messing around with USB cables, just tune your radio to 88.0 or similar.

My Nokia N900 had one and I've missed it ever since - it could even display text via RDS!

<comment><USER10> You must be joking. The only place I've ever gotten adequate audio quality from an FM transmitter is in a tunnel more than 1/4 mile long. They're crappy even driving through the middle of nowhere where 9/10 radio stations are noise.

<comment><USER11> No I'll have to agree with your parent. The N900 FM functionality ( among it's other great advantages ) was pretty good. I used to use it all the time.

</comment></comment></comment></comment><comment><USER12> It was not so very long ago that the National Association of Broadcasters and the RIAA were lobbying Congress for the inclusion of said FM chips [0] (or [1] if you want the tldr version).

NAB is involved [2] in this latest heroic campaign for consumer choice too, of course, although you wouldn't know it to look at the website [3].

[0] [https://arstechnica.com/tech-policy/2010/08/radio-riaa- manda...](https://arstechnica.com/tech-policy/2010/08/radio-riaa-mandatory-fm- radio-in-cell-phones-is-the-future/)

[1] [https://www.penny-arcade.com/comic/2010/08/18](https://www.penny- arcade.com/comic/2010/08/18)

[2] [http://www.prnewswire.com/news-releases/industry-wide- consum...](http://www.prnewswire.com/news-releases/industry-wide-consumer- awareness-campaign-launches-for-nextradio-300039436.html)

[3] [http://freeradioonmyphone.org/about/](http://freeradioonmyphone.org/about/)

<comment><USER8> Surprising to see the RIAA wanting this. Presumably they'd be against having the feature to _record_ from the FM radio, which a lot of these phones with FM radios do have.

<comment><USER12> RIAA may not be involved in this particular tilt.

Having radios everywhere is obviously always in the radio industry's best interests. Back in 2010 the music industry got involved because they were trying to wring extra performance rights fees out of radio, which the radio folks clearly were not interested in, but the proposed compromise was that music industry lobbyists would throw their weight behind the "radios everywhere" thing, and radio would presumably benefit enough from that to cover the new hefty performance fees.

The Performance Rights Act didn't go anywhere, looks like music industry tried again last year with the "Fair Play, Fair Pay" bill.

</comment></comment></comment><comment><USER13> No one has mentioned the antenna. Just because the silicon is there doesn't mean you'll get decent reception without an antenna, and a dipole at 100 MHz is 1.5 meters. Not trivial to put in a phone, unless they use the headphone wires. If they do enable it, then people will just complain of poor reception.

<comment><USER14> >unless they use the headphone wires

that's what they use in most of the cases. on my phone, the radio refuses to function until a headphone is plugged in.

<comment><USER15> It doesn't have to refuse to function. I have a Cat B15, with an FM radio. It will warn you if you don't have a headphone plugged in, but you can continue and try anyway. If you have line of sight to a strong station (in SF and can see the Sutro Tower), it will work without an external antenna.

Of course, headphones as antennas will stop working when headphones go USB-C or an Apple-specific connector.

<comment><USER16> Why would they stop working? You just use the cable shield as the antenna.

</comment></comment></comment></comment><comment><USER17> Okay, but at least on my phone (OnePlus One) the antenna to the FM radio is grounded. My guess is that they didn't think it was worth it to design an antenna or otherwise support the feature.

Am I wrong to think that other companies act the same? What else could be a reason to disable the FM radio in a phone? When you're designing a product, every feature costs money to develop and support, and in the race to the bottom nature of consumer electronics it might make sense to not support FM radio. Most of my friends (at least the normal ones) seem to prefer something like Pandora over FM for background music.

What's stopping someone from selling a phone that has a functional FM radio? I usually say the following jokingly, but this seems like a problem for the free market to fix.

<comment><USER18> _this seems like a problem for the free market to fix._

The market for phones in the US is not free because they're generally tied to carriers, and the market for carriers is highly unfree because it's a natural monopoly with a weak government regulator.

</comment></comment><comment><USER19> Okay, serious question: why can't I watch over-the-air TV on my smartphone?

It's got a screen, audio, and at least one antenna. I'm no electrical engineer but surely that's something that's at least theoretically possible...

<comment><USER20> This used to be very big in South Korea at least, before (modern) smartphones took off. I suspect it's less compelling than just watching internet video now that we have that.

<comment><USER19> I understand it for most things, but it's frustrating for live sporting events when I can't stream it without paying (if it's available at all) to my smartphone while at the same time I'm literally being bombarded with the free TV signal for that event.

<comment><USER21> If you are able to do that, you could stream it through the Internet from your house.

</comment></comment></comment></comment><comment><USER22> OK, old guy here. I bought a Note 4, one reason was that it had a FM tuner. The Verizon people told me it "wouldn't work on their network" which I took for BS. Hve been unable to find software to use it. Is 57 just too old to get it?

<comment><USER23> If you bought the phone from Verizon who know's what they've done to it - however this app should work: [https://f-droid.org/repository/browse/?fdfilter=radio&fdid=f...](https://f-droid.org/repository/browse/?fdfilter=radio&fdid=fm.a2d.sf)

<comment><USER22> Thanks I didn't find that. I'll give it a look.

</comment></comment></comment><comment><USER24> In some countries owners of radio receiver must pay license fee to public broadcaster. In my country its $24/year.

</comment><comment><USER25> Seems like this leaves a big unanswered question. Why haven't any manufacturers done this? Seems like it would give their product a big advantage.

In any case, as annoying as it may be that they don't offer free FM radio, I don't see why for-profit businesses should be under any obligation to do so.

<comment><USER26> What do you mean "why haven't any manufacturers done this?"

The whole point is that manufacturers _have_ done this, the phone hardware and software generally support FM radio, for many models the (non-US) advertising material lists that feature - but the carriers have intentionally gone out of their way to disable it.

</comment></comment><comment><USER27> I am sure I am missing many points in understanding this, but it seems like it would almost be a competitive advantage to now release a phone that had "free radio" on it. I would use it all the time, and it appears it would be easy to do if I am not too far off.

<comment><USER28> I must ask where you live that there is FM remotely worth listening to?

Around here the only thing at all decent is NPR, and that content is all available via podcast with much better audio fidelity, and seeking.

<comment><USER29> Check the low end of the dial. Most cities have one or more community/college radio stations, which tend to be the most experimental/well- curated/interesting sources of audio one can find.

</comment></comment></comment><comment><USER30> I remember the Droid X had a FM tuner in it. I thought that was pretty cool when I bought it, but then I never used it. When I bought it, I had forgotten that there is never anything good on FM... (though FM tuner was not the reason that I bought the phone)

</comment><comment><USER31> It's less of a telco issue and more of a manufacturer issue. Yes, most phones have an FM receiver in them as part of the wifi+bluetooth chip. However, in most cases the FM antenna pin of that chip isn't connected to anything, so it just won't work. The manufacturer would need to connect this pin to the headphone socket. Once that's done, the OS would need to support the FM radio. Some manufacturers bake this into their ROMs, others don't. Telcos are the last step, and might choose to strip the FM radio app out of the OS if they have a cozy relationship with the manufacturer.

</comment><comment><USER32> ITT: Cars should support buggy whips, says buggy whip manufacturers.

And yes, I get the arguments that this is a feature already on the phone, carriers are assholes, etc., but I've had multiple phones with this feature, and found multiple people who have phones who have this feature, and who don't care. And this was on Virgin Mobile, which on a freedom scale of 1 to Richard Stallman is a solid Steve Ballmer.

</comment><comment><USER33> In Europe, consuming radios via Internet is not such a big deal (fair use is usually at 50gb/month). But if you have the chance to have great local stations, listening to them via FM is draining almost no battery. And THAT is a big deal !

<comment><USER34> Might be in Western Europe, the packages may be as little as 50MB in "Central and Eastern" Europe (and than considerably slow connection).

</comment></comment><comment><USER35> This will be awesome. We will have a whole new generation with real life experience with intermodulation distortion, picket fence noise and host of other quirky radio anomalies.

</comment><comment><USER36> I think the advantage of nearly every citizen walking around with an FM radio for emergency mass communication purposes would be reason enough alone.

</comment><comment><USER37> Buy an unlocked phone and use a pay-by-month carrier. Anything less is paying for a pittance of financial convenience with features and abuse.</comment>


Computers are the new Dumb Money - <AUTHOR> http://thereformedbroker.com/2015/08/27/computers-are-the-new-dumb-money/

<comment><USER2> 1) Yeah because humans behave rationally.

2) If your algorithm does not take the value of the holdings of an ETF into account you deserve to lose money.

<comment><USER3> > 2) If your algorithm does not take the value of the holdings of an ETF into > account you deserve to lose money.

Even if there is a large discrepancy between the value of an ETF and the value of the holdings, it might still make sense to sell if you expect the value of the holdings to plummet further, and the mismatch to go away by the value of the original holdings tanking, rather than the ETF rebounding.

Maybe an intelligent trader could try and arbitrage this somehow (maybe buy/hold ETF, and short underlying assets), but your trading platform would have to have some form of extra option besides buy/sell a given ETF.</comment></comment>


All in One Guide to Become Machine Learning Engineer - <AUTHOR> https://www.techbeamers.com/how-to-become-a-machine-learning-engineer/ <comment><USER2> Nice info</comment>


IoT for the music world - <AUTHOR> https://healthystrings.com

<comment> k-mcgrady Interesting idea. I think you should push the marketing more towards expensive classical instruments and vintage instrument owners. I think they would be most likely to use it. As a guitarist I could never see myself using this unless I had a vintage guitar rare enough that it spent a lot of time in storage.</comment>


2FA on the command line - <AUTHOR> https://www.sendthemtomir.com/blog/cli-2-factor-authentication <comment><USER2> I would caution against this approach. This fundamentally changes the 2FA from a "something you have" to "something you know", which is the type of factor your password is. If you do want 2FA functionality on the command line, look into Yubikeys with their ykman CLI tool. ([https://support.yubico.com/support/solutions/articles/150000...](https://support.yubico.com/support/solutions/articles/15000012643-yubikey- manager-cli-ykman-user-manual#ykman_oathwicpwc)) You're able to store a TOTP secret on the Yubikey itself (maintaining it as a "something you have" factor), as well as optionally requiring the yubikey be touched before the TOTP is emitted.

<comment><USER3> I 100% agree with you, but I recently started putting my TOTP tokens in my password manager, and it's so much more convenient to just have the token pasted in while you log in, instead of having to find the phone, turn it on, launch the 2FA app, find the code from a huge list and type it in, that I'm willing to take the security hit.

We need WebAuthn yesterday.

<comment><USER4> Agreed, I hesitated for years to not put 2FA in 1password. But, after a few phone upgrades and resetting each and every account, it's worth it. It can take nearly 10 minutes per account to reset 2FA. Spending a few hours every few years doing that was just too much.

<comment><USER5> Putting your 2FA in 1Password sort of reduces your security back to 1 compromise (breach 1Password and you're screwed). I would recommend putting your TOTPs in Authy. Easy to restore and even in multi-device mode waaaay safer than storing all your TOTP next to your passwords.

<comment><USER6> While this is true I think if anyone had control of my password database they could remove the 2FA from most of my accounts without much issue.

Also where is the password to your Authy account?

And where are your 2FA backup codes?

<comment><USER5> You just give Authy a relatively simple password, and don't save it anywhere. If you don't have Authy in multi-device mode it will be impossible to activate another session, and if you do activate another session while in multi-device mode Authy will check if any other devices are active and if so will ping those devices with a verification request. It checks for an active device so that if you have only one device active and do a reinstall you can still activate. I have my 2FA backup codes in Dropbox, which itself is behind 2FA.

In essence someone has to both get my 1Password password, 1Password secret key and either compromise my phone (for Authy) or my phone number (to recover 2FA backup codes via Dropbox SMS recovery), or my computer (for direct Dropbox access). But very few organisations have that amount of capability and I have nothing stored in my accounts that is worth that capability. If I had, I would store it behind GPG and a password that is only in my mind.

Also, to lose access I'd need to lose my 1Password secret key or forget Authy password + get logged out of _all_ my Dropbox devices simultaneously. The chances of that are rather slim.

</comment></comment></comment></comment></comment></comment><comment><USER7> I'm no security expect (and a bit of alcohol is helping write this), but I do honestly feel like people are shooting themselves a bit, especially to the point of using pass-otp, which is presumably ALSO where you're storing your passwords... It really feels like you've got two keys to a safe that two seperate people look after. But then decide to go for a beer together and one holds the other's key whilst they get another drink...

Sometimes conveniece definitely comes at a cost, and getting to the point of having an application to 'remember' your passwords (ignoring the fact the passwords can then be completely unique and more secure) and then duplicating the OTP keys (that are meant to be kept on an independent device) into the same application seems like a step to far.. at least for me! Think I'd prefer the inconvenience :/ No offense to anyone else's comments intended!

</comment><comment><USER8> I was really hoping this was integrating 2FA into command line utils; e.g., doing SSH with 2FA. :/ I would strongly caution against the article's advice.

The scenarios I feel like most corporations want to protect against are:

1\. Accidental password disclosure, e.g., c/p password to someone who should not know it.

2\. Laptop compromised, e.g., with a trojan, keylogger, etc.

3\. Laptop physically compromised, e.g., stolen, or opportunistically available (e.g., locked, but sitting on a desk).

It's #2 that's the problem here, and the reason why you want your OTP on a separate device, or hardware designed for it like a Yubikey. In the case of #2, if your OTP secret is on your laptop, and protected by only your laptop password, someone with remote access only needs to log your activity until they have your password, and then they have both your password and OTP.

Were your OTP instead on a separate device, they would _also_ need to compromise that device; with things like a hardware key, this is by design exceedingly difficult, given that it's a separate device designed to never give up the secret, whereas a filesystem can't really tell the difference. That's the point: it should compromising _both_ factors, separately.

But if you're just keeping your OTP secret on disk, and ignoring #2? You're really only covering #1, and a good password manager will make accidental disclosures rather difficult to do anyways, so it seems like little benefit.

<comment><USER9> If your laptop's compromised the attacker can just steal your cookies and it doesn't matter how you're doing 2FA. In general, an actively compromised device is not a threat you can effectively defend against.

</comment></comment><comment><USER10> Been doing this for a while. There is a great extension for Pass:

[https://github.com/tadfisher/pass-otp](https://github.com/tadfisher/pass-otp)

Even works with Browserpass and the Pass Android client:

[https://github.com/browserpass/browserpass](https://github.com/browserpass/browserpass)

[https://github.com/zeapo/Android-Password- Store](https://github.com/zeapo/Android-Password-Store)

<comment><USER11> Seems like this is the appropriate way to do this - build it into a good existing system based on encryption. Thanks for sharing it!

<comment><USER10> Sure thing. If you're looking for GUI clients too, QtPass supports it too:

[https://qtpass.org/](https://qtpass.org/)

</comment></comment></comment><comment><USER12> We would sternly warn our clients against using anything like this. If you're really going to do this, just use a serious password manager like 1Password, and set random passwords. Desktop-based TOTP is pretty much just theater past that.

<comment><USER13> I mostly agree, though I still think adding 2fa to whatever password manager you do use is vaguely worthwhile. Long term creds can get checked into repos, accidentally pasted somewhere, etc. May as well have 2fa to mitigate this edge case .

</comment></comment><comment><USER14> This is less secure than not having 2fa at all.

2FA means _two_ factor authentication. It's a guarantee that even if someone hacks your password or steals your computer, if they don't also have physical access to the secondary device (phone, yubikey etc), they won't be able to gain access to your account.

If you put the secrets of 2FA into the same computer, you are back to 1FA.

However, you end up being less secure than not enabling 2FA in the first place. This is because when you enable 2FA, they can disable the regular checks that they have for 1FA accounts. It will also be incredibly difficult to regain access to the account if you don't have access to 2FA devices.

<comment><USER15> 2FA is protection against a lost password. It was never protection against a lost password combined with a stolen device.

Think about this scenario. You use Google authenticator on your phone, and have your banking app on your phone. A thief knows your banking password and steals your phone.

Now replace "phone" with "computer". I don't see how changing the underlying 2FA device changes security.

The only real danger is if that 2FA db on your computer is not encrypted. But again, the same danger exists if you use an unencrypted phone.

<comment><USER16> Assuming they know the passphrase/PIN for the phone. It's also much easier for rogue software to steal the 2FA token from the laptop than the phone.

<comment><USER17> Please enlighten me how is it easier to decrypt my 1password on my laptop than it is on my phone ?

</comment></comment></comment></comment><comment><USER18> It always seems to me like security solutions rarely take into account usability and user experience. Even something which should be simple like configuring a client to use SSL over plaintext can block productivity for a multitude of reasons until you finally put all the pieces together correctly.

Maybe it's out of necessity, because convenience features would be less secure. Maybe there's not much overlap between those concerned with security and those concerned with ease-of-use, except for cases where companies can develop tools that encourage good security practices while exposing the end user to other risks (e.g. password vaults with one entrypoint).

So what you end up with is people gravitating towards bad security practices and using shortcuts because it's a PITA to maintain the good ones. Let's skip using SSL because we need to get work done instead of troubleshooting the dozen possible misconfigurations. I'll use a really short password for my AppleTV account because it's too hard to type the damn thing with the on- screen remote. I'm tired of getting a 2FA code 50 times a day to get work done, so I'll implement a hot key to generate it from the command line.

Seems like ease-of-use for security solutions should be almost as much of a priority as the security implementation itself in some cases.

</comment><comment><USER19> Alternative: Use `gopass` which will generate OTP codes and can be used in conjunction with a Yubikey or other OpenPGP smartcard to keep the "something you have" factor in play. I made a PR that sees those codes available through the gopass browser extension, as well. It's pretty painless and is code and a security model that can be understood in an afternoon (though not my favorite and begs for a "RIIR").

</comment><comment><USER20> The best non-spam comment: "Hi, I'd suggest to encrypt the ~/.otpkeys file with pgp :-)"

</comment><comment><USER21> If you like oathtool, you may like oathgen and goathgen too (I wrote them years ago). They take stdin so you can store your secrets PGP or NaCL encrypted, etc. and pipe them:

[https://github.com/w8rbt/oathgen](https://github.com/w8rbt/oathgen)

[https://github.com/w8rbt/goathgen](https://github.com/w8rbt/goathgen)

</comment><comment><USER22> I use Bitwarden for TOTP generation, this is how I use it for command line TOTP code generation, with NPM's 2FA as an example:

      npm publish . --otp $(bw get totp npm)

_Note: it requires the Bitwarden vault to be unlocked for the current shell, as such:_

      export BW_SESSION=$(bw unlock --raw) && echo $BW_SESSION

</comment><comment><USER11> I built something like this (a bash script wrapper around oathtool) but ended up outputting the text to a picture with ImageMagick. This is much more polished, though. Using a proprietary program for two-factor (Google authenticator or Authy) is something I like to avoid and oathtool fits the bill. However, it's not something I'd recommend without caveats: Encrypt your tokens using GPG or something like that. Failing that, at least keep these on an encrypted hard drive, and don't put them on external media. Keep it on as few devices as you can, and not on a shared machine.

Edit: Suppose I should add the link. [https://gitlab.com/elagost/linux-2fa](https://gitlab.com/elagost/linux-2fa)

I build it for the clockworkpi device, so there were more constrains than a normal desktop system. [https://www.clockworkpi.com/](https://www.clockworkpi.com/)

</comment><comment><USER23> Here's a PHP library to achieve the same [https://www.idontplaydarts.com/2011/07/google-totp-two- facto...](https://www.idontplaydarts.com/2011/07/google-totp-two-factor- authentication-for-php/)

</comment><comment><USER24> I see a lot of hate here, but this concept fits my use case nicely.

I'm really not worried about my computer being stolen or pwned. I'm more worried about somebody trying to access some service from elsewhere in the world, with a password they would have obtains from another mean.

In which case, OTP on my laptop is sufficient, and it also has the nice property of being a backup of the seeds on my phone, which I can loose.

</comment><comment><USER25> Here's a OTP client (Google authenticator compatible) that's also an HTML5 PWA. Obviously you shouldn't assume it's secure or production ready. I found it useful for testing 2FA when adding it to another app. Also be careful, not all OTP clients you find online are GA compatible.

[https://otp.codebro.org](https://otp.codebro.org)

</comment><comment><USER26> A better idea would be to utilize U2F just like in browsers and use a hardware token like Yubikey.

Yubico provides a Python and C library for this: [https://developers.yubico.com/Software_Projects/FIDO_U2F/U2F...](https://developers.yubico.com/Software_Projects/FIDO_U2F/U2F_Host_Libraries/)

</comment><comment><USER27> The controversy of this tool vs Google Authenticator essentially boils down to how secure your laptop/workstation is vs how secure your phone is.

Without being purely "conservative", i.e. it was first done on phones therefore it should stay on phones, what are the actual arguments for one vs the other? What do phones have that laptops don't, and vice versa?

<comment><USER28> In theory, the phone stores the TOTP secret on a TPM that can't be backed up. So the TOTP secret is fundamentally tied to that specific phone. You can't back up the secret, and somebody with brief access to your phone cannot copy it. Even with unlimited access to your phone, it's unlikely anyone can copy the secret.

This solution stores the secret in your home directory, which is easily readable by any process that has access to your hard drive. Anyone with brief access to your laptop/workstation can easily copy the secret. If you back up your home directory, anybody with access to your backups has access to the secret.

<comment><USER27> What's a TPM? Is it this? [https://en.m.wikipedia.org/wiki/Trusted_Platform_Module](https://en.m.wikipedia.org/wiki/Trusted_Platform_Module)

Again, forgive my ignorance, but do smartphones routinely include TPM chips that Google Authenticator utilizes? Never heard of that before.

<comment><USER28> Yes, a "Trusted Platform Module." Now that I'm looking around it doesn't look like Google Authenticator actually does this, but it does make it more difficult to copy the TOTP secrets than this 2FA on the command line thing.

Though it could and probably should. (Really, this 2FA CLI app could probably do so as well, most modern laptops probably have a TPM.)

</comment></comment></comment></comment><comment><USER29>
        #!/bin/sh
        # expects keyboard shortcut to be super+2
        twof=`oathtool --totp mysecret`
        xset r off
        xdotool keyup --window 0 2 type --clearmodifiers --window 0 "$twof"
        xset r on
        sleep 0.3 && xdotool key 'Super' &

Shhh... (By the way real 2FA devices like yubikeys are great...)

</comment><comment><USER30> Can anyone explain to me why you would ever want to do this instead of proper public key encryption? A huge advantage of public key encryption is that it doesn't rely upon having well synchronized clocks like many 2FA solutions. Also, you can easily insert a "something you know" by putting a password on your private key.

</comment><comment><USER31> > Copy/Paste is easier than typing digits displayed on your phone

i'd say that if your main concern is having to type digits on your computer keyboard and you'd like to copy/paste it, KDEConnect can store an TOTP generated on your phone to your computer clipboard, as in 1- generate OTP on your phone 2- C-v on the computer 3- done

</comment><comment><USER32> Pretty cool. I've been using this 2FA tool written in Go which is easy to understand and works great:

[https://github.com/rsc/2fa](https://github.com/rsc/2fa)

</comment><comment><USER33> I will make a separate submission but since a lot of security minded people here- I want to ask- how does everybody manage their pins? I tend to forget them but password manager seems like an overkill.

</comment><comment><USER34> I did the same thing in Python a while ago. Our security team didn't like it. [https://pastebin.com/9CLhPiff](https://pastebin.com/9CLhPiff)

</comment><comment><USER35> Make sure you use that from an another computer, or this is essentially an anti-pattern for 2FA. Reason would be, it's no different than entering password at the same machine.

</comment><comment><USER36> I wouldn't expose your private keys for 2FA in plain text on your laptop. At least encrypt the file with GPG key to not expose it and read it in the script

</comment><comment><USER37> Russ Cos wrote another excellent one:

[https://godoc.org/rsc.io/2fa](https://godoc.org/rsc.io/2fa)

</comment><comment><USER38> Looks like the comments on that site need 2FA.

</comment><comment><USER39> I just use JIT SSH connections, which is practically a 2FA solution.

</comment><comment><USER40> This would be better if the key did not show up in the process list.

<comment><AUTHOR> I agree with you, however I'm the only user on my laptop so for the few milliseconds that oathtool is running it's not a problem for my use case.

$ time otp aws

otp aws 0.00s user 0.01s system 98% cpu 0.015 total

Even back in the 90's Mysql was able to hide the CLI supplied password from the process list. It would be cool if oathtool was able to do the same.

<comment><USER41> > Even back in the 90's Mysql was able to hide the CLI supplied password from > the process list. It would be cool if oathtool was able to do the same.

This has always been a brittle and not easily portable approach.

And doesn't protect you from an attacker doing something much simpler: reading your .bash_history file.

Passing passwords as arguments has always been a bad idea.</comment></comment></comment>


Why did Quora choose Python for its development - <AUTHOR> http://www.quora.com/Quora-Infrastructure/Why-did-Quora-choose-Python-for-its-development

<comment><USER2> Python is good choice</comment>


Ask HN: How to create a parsable/searchable resume? - <AUTHOR> I assume that some companies scale their efforts by automatically parsing/searching resumes. Unfortunately, text-dump tools like "pdftotext" mangle some text of my resume, which was created with libreoffice. <comment><USER2> build a static html version, host it online, e.g. on your github account (with github pages).

I'm working on a couple of tools to make that whole process easier.

\- ResumeExporter ([https://github.com/programmercv/resume_exporter](https://github.com/programmercv/resume_exporter)), a tool to extract your resume data from linkedin, stackoverflow, xing etc.

\- A jekyll theme, to host your resume on github pages ([https://github.com/programmercv/theme](https://github.com/programmercv/theme))

It's all very much still work in progress, so stay tuned :)</comment>


Radioactive Truck stolen in Mexico - What could they do with it? - <AUTHOR> http://www.bbc.co.uk/news/world-latin-america-25212648

<comment><USER2> History may repeat itself or who knows...

"The Goiânia accident was a radioactive contamination accident that occurred on September 13, 1987, at Goiânia, in the Brazilian state of Goiás, after an old radiotherapy source was stolen from an abandoned hospital site in the city. It was subsequently handled by many people, resulting in four deaths. About 112,000 people were examined for radioactive contamination and 249 were found to have significant levels of radioactive material in or on their body. In the cleanup operation, topsoil had to be removed from several sites, and several houses were demolished."

Source: [https://en.wikipedia.org/wiki/Goi%C3%A2nia_accident](https://en.wikipedia.org/wiki/Goi%C3%A2nia_accident)</comment>


"Visualizing Facebook Friends" was created using R - <AUTHOR> http://www.r-bloggers.com/visualizing-facebook-friends-eye-candy-in-r/?utm_source=feedburner&utm_medium=email&utm_campaign=Feed:+RBloggers+(R+bloggers)

<comment><USER2> I, for one, would love to see the drawing code, even if it's totally data free. Nothing else I see on the R Graph Gallery (<http://addictedtor.free.fr/graphiques/thumbs.php>) looks remotely as good as the fb graph, and sharing code like this is a great way to promote the language.

</comment><comment><USER3> 'I created an ordering based on the length of the lines, so that longer lines were drawn "behind" the shorter, more local lines. Then I used colorRampPalette() to generate a color palette from black to blue to white, and colored the lines according to order they were drawn.'

If I am understanding this correctly (I'm probably not), longer lines would never be as bright as short lines. Why? Let's say hypothetically, that all Bostonians had at least 10 friends in Madrid, then wouldn't we want to see that as a white line on the chart? Please correct me if I am wrong.

<comment><USER4> He addresses that in the paragraph before:

      My first attempt at plotting the data involved plotting
      very transparent lines. Unfortunately there was just too
      much data to get a meaningful plot — even at very low
      opacity, there were enough lines to make the entire
      image just a bright blob.

</comment></comment><comment><USER5> R seems pretty amazing. Any suggestions on how to go about learning it?

<comment><USER6> I can't imagine why the regular route of learning would not work with every language: wet your appetite with tutorials and then do a small project with it to grasp it better.

</comment></comment><comment><USER7> original post: <http://paulbutler.org/archives/visualizing-facebook-friends/></comment>


Squarespace 6-hour Outage Root Cause Analysis - <AUTHOR> https://status.squarespace.com/incidents/wsnw7mm8082n <comment><USER2> This is quite abstract. It would be nice to have more details about what stack they are running, what url pattern caused the problem, what code path was triggered and why did it use so much memory, what response did the clients get etc.

They don't say this was an attack, but it's not fully clear that it wasn't. And why did it start happening all of a sudden? So many questions...</comment>


The Need for Standardization in Crowdsourcing - <AUTHOR> http://www.behind-the-enemy-lines.com/2012/02/need-for-standardization-in.html

<comment><USER2> Having been party to this conversation for some time, I largely agree – MobileWorks (www.mobileworks.com) has been taking steps in this direction for some time, though I can't speak to what other crowd platforms are up to.</comment>


iPhone and Android Smartphone Duopoly Reaches Peak with 99.9% Market Share in 2017 - <AUTHOR> https://www.macrumors.com/2018/02/22/ios-android-duopoloy-reaches-99-9-percent/ <comment><USER2> Somewhat off-topic:

Any suggestions for a 0.1% phone?

What are the attack surfaces of the alt OSs?</comment>


Gnu screen with split screen - <AUTHOR> http://scie.nti.st/2008/8/22/gnu-screen-with-vertical-split-support <comment><USER2> You can split the screen at every level of the display stack: tiling window manager, dvtm, screen, emacs, now it's a big problem to choose which level to split.

</comment><comment><USER3> "Pound for pound," screen might just be the most useful GNU utility there is. (That is, for such a small program, it has a ton of uses and makes so many other programs more useful!)

</comment><comment><USER4> I haven't used screen for about a year or two. I can't stand the GNU/EMACS keybinding. Naturally I chose dwm+mrxvt

The only thing I miss is attach/detach ... Does anyone know any alternative to Screen?

Thx!

</comment><comment><USER5> I couldn't see what the news here was until I actually clicked the link. For a second I feared the obvious, ancient "look at what this tool can do!!!" links which digg and reddit are notorious for was hitting Hacker news.

Cool stuff. None the less, I think the submitter should have made the headline say "vertical split screen", since split screen really isn't news at all.

</comment><comment><USER6> I prefer the horizontal split. For reading say.. IRC, or websites, it's far more useful than a vertical split.

<comment><USER7> A vertical split is useful if you have, for example, a full-screen terminal window and a large monitor. It's not generally useful to have a terminal window 200+ characters wide.

A tiling window manager (e.g. dwm, xmonad) is often a better solution here, but it's good to have the option in screen itself.

<comment><USER8> ratpoison is pretty much gnu screen for x11

<comment><USER7> Right, and it's had vsplit for quite a while, too. Stumpwm (<http://www.nongnu.org/stumpwm/>) is another WM along the same lines, though I haven't tried it. It's written in Common Lisp, BTW.

I used ratpoison for a while, but I came to prefer tiling window managers (e.g. dwm, xmonad, wmii, larswm) -- They generally have the same strengths as ratpoison but fewer drawbacks. You still have to manage all of the actual windows yourself in ratpoison, and it's _considerably_ more awkward to use some programs (e.g. the gimp) that assume a typical WM. Most of the tiling WMs I've used have a "floating" bit to accomodate clients that shouldn't be tiled. Each has its own design quirks that make them hard to generalize about, but as a group they tend to be very keyboard-friendly.

<comment><USER9> I was under the impression that ratpoison was considered a tiling WM.

<comment><USER7> Actually, you're right, I wasn't specific enough. _Automatically_ tiling window managers, sorry. Ratpoison breaks windows up into non-overlapping tiles, but it doesn't (by default) automatically manage their placement anymore than screen does. Opening up a new terminal (or whatever) covers the previously active one.

The WMs I'm talking about automatically place windows into various layouts, such as "master window on one side, other windows stacked vertically on the other side", current window full-screen, current window floating with mouse- drag-based move and resize, etc.

In dwm or wmii you can tag windows arbitrarily, and each tag works as a separate workspace. Whenever you switch tags or add/remove a window, the others are repositioned according to the current layout rule. In practice, I often do things like run emacs on its own tag, but also on a tag shared with a pdf or something I'm referencing. Workspace #8 is emacs, #4 is split emacs+pdf+screen, etc. You just specify which windows to group together and it does the rest, usually needing little intervention.

You can add this sort of fast grouping behavior to ratpoison via scripting (and the scripting interface for it is pretty good), but it doesn't try to do this by default. Its priority is on avoiding the mouse, rather than avoiding manual window placement in general. The latter indirectly leads to an interface with less mouse use anyway, though, since you seldom spend time clicking to focus on, move, or resize windows except with programs that are too awkward to use in tiles.

This has less and less to do with screen, though.</comment></comment></comment></comment></comment></comment>