Evaluation of five password managers - <AUTHOR> https://medium.com/@QuantopianCyber/head-to-head-evaluation-of-five-password-managers-8faa4851c767 <comment><USER2> In the end I've just been using the Unix pass password manager [1].

It's just cobbling together of GPG and git with shell scripts but it works like a normal git repository so you get all your synchronization, from that, your security from GPG which are all things I know and trust without introducing other components that I don't know / understand.

[1] [https://www.passwordstore.org/](https://www.passwordstore.org/)

<comment><USER3> My one concern with pass is that it doesn't encrypt filenames; it's a real pity, as that's an information leak itself.

<comment><USER4> Have you tried to use pass-tomb?

<comment><USER5> I'm not the parent poster but the added friction and configuring for pass-tomb made me choose to just use keepassxc instead. IMO, this kind of feature should be the default.

</comment></comment></comment></comment><comment><USER6> I wonder, why not a single word has been spoken about Keepass/X, which is available on all platforms (not sure about iOS, though), can work with UbiKeys, afaik, has huge im- and export support and is free from any corporate interests.

<comment><USER7> If you want the Qt one, make sure to use KeyPassX _C_ , the active fork of KeePassX.

[https://keepassxc.org/](https://keepassxc.org/)

<comment><USER8> I use keepassxc on MacOS, Windows, Linux, along with MiniKeePass on iOS. It's synced through my free Dropbox account. I just make sure to set the preferences so that every change to the key database results in a file save.

<comment><USER9> > synced through my free Dropbox account

I was always a bit paranoid about this, even though I did it myself.

<comment><USER10> The decentralised alternative is to use something like SyncThing[0]. It's what I use and is only slightly more involved.

[0] [https://syncthing.net](https://syncthing.net)

<comment><USER11> What about Resilio Sync? They have a discount for one-time license. And it was formerly BitTorrent Sync. I'll have to check out Sync Thing.

<comment><USER10> Well, SyncThing is open source as well as being free.

</comment></comment></comment></comment></comment></comment></comment><comment><USER12> > Mac OS, Windows, Linux, Android, and iOS ... full functionality can't be > dependent on an app which is only available on Mac OS and/or Windows. In > other words, lack of full Linux support is a show-stopper for us. This ruled > out 1Password...

...Huh? 1Password supports all of those platforms (including Linux) [https://1password.com/downloads/linux/](https://1password.com/downloads/linux/)

<comment> vhost- It really doesn't. I'm a full time linux user and I can tell you the support from both lastpass and 1password is abysmal. I have to copy and paste my passwords from both of those platforms using their half-baked browser plugins that rarely work with linux clipboards.

<comment><USER13> Interesting. Browser plugins, by nature, include source code. I wonder if there's an easy fix. Can you describe the issue in a little more detail?

<comment><USER14> I took a shot at building a browser plugin for 1pass [1] a little while back.

Turns out, the hardest thing is not the crypto or the browser to app communication, but parsing the HTML to accurately find the login forms. If I remember correctly, the browser plugin on Mac actually sends the entire HTML to the app for parsing. The parser is probably quite complicated and they avoid reimplementing it in extensions that way.

[1] [https://medium.com/@paulsc/making-a-1password- client-15dd39a...](https://medium.com/@paulsc/making-a-1password- client-15dd39ac1642)

<comment><USER13> Of course that also protects the IP :)

Also, great post. I love reading reverse engineering stories.

</comment></comment></comment></comment></comment><comment><USER9> Just idle curiosity, but I'd be curious to see BitWarden's commit on GitHub:

> ...at one point during our evaluation we submitted a bug report about > Bitwarden through its Github project; one of the product's maintainers > committed a bug fix _seventeen minutes later_ , and just a few days after > that the fix was released to the public.

<comment><USER15> That tells me that their testing is either extremely excellent , or extremely nonexistent. Rumors seem to point towards the latter, which is concerning for security software.

<comment><USER16> I don't know about the rumours, but "a few days" is a long time to test a bug fix.

It should ideally take from a few seconds to a few minutes. That's not extremely excellent, it's just good practice.

More than that and it hints towards heavy reliance on manual testing, and that's something I'd be worried about.

EDIT: Despite the parent comment's misguided logic, it seems his/her fears are actually in the right place.

An issue was opened about 6 weeks ago asking where the tests are and it received zero responses from the maintainers: [https://github.com/bitwarden/core/issues/399](https://github.com/bitwarden/core/issues/399)

<comment><AUTHOR> It was a cosmetic, not a security-critical bug, so there's really no reason why it needed to be released right away.

Also "a few days" was just a guess. I noticed that it was a problem, then I noticed a few days later that the fix had been release. I don't actually know exactly how long it took to release the fix after it was committed.

</comment></comment></comment></comment><comment><USER17> For me an important selling point of 1Password was that their software looks like native Windows software and native iOS software while Bitwarden is just Chrome wrapper or something like that for desktop and C# for mobile and I don't want to support that kind of cross-platform software.

<comment><USER18> 1Password felt like Mac/iOS software ported to other platforms.

<comment><USER19> Their windows app definitely needs some love. Actually kinda wish it was a direct port, UI and all.

</comment></comment></comment><comment><USER18> Glad to see Bitwarden up on top. They tick all the boxes for me - open source, transparent security (including recently published audit), feature-rich, optional self-hosted, and easy to use.

<comment><USER20> Except there isn't much info on who 8 bit solutions is. It seems like a 1 man effort and apparently he doesn't want to reveal much.

A few requests aren't exactly answered.

[https://github.com/bitwarden/website/issues/12](https://github.com/bitwarden/website/issues/12)

[https://community.bitwarden.com/t/who-is-hosting- bitwarden/1...](https://community.bitwarden.com/t/who-is-hosting- bitwarden/1614/12)

<comment><AUTHOR> This is informative: [https://opensource.com/article/18/3/behind-scenes- bitwarden](https://opensource.com/article/18/3/behind-scenes-bitwarden)

My impression is that Kyle cares more about spending time writing software than about hyping his company. ;-)

It's an unfortunate flaw in a founder, but not a fatal one if he hires people to do the communication that he doesn't want to be doing. It feels to me like he's moving in that direction.

<comment><USER20> It's not about hyping.

Just a general "About" page of where it's located, who's behind and a photo of CEO with added bonus if there's a photo of their office.

It's a very security oriented product. Not showing who they're can be taken as hiding.

<comment><AUTHOR> In this day in age it is common for a two-year-old SaaS startup not to have an office. I mean, I suppose it's possible that they have one, but my assumption is that the entire company is remote.

I don't see why their location is particularly important, but if you care, you can look on Kyle's LinkedIn profile, which I was able to browse my way to in about 45 seconds from a standing start from their web site.

The article I just linked to makes it perfectly clear "who's behind" Bitwarden, and you can find it out easily with a few seconds of Googling like what I just did. They're not trying to hide anything from anyone who cares to spend 30 seconds trying to find out.

I care a lot more about the fact that hundreds of vulnerabilities have been submitted to LastPass's bug bounty program and they haven't chosen to disclose any of them, whereas a much smaller number have been submitted to Bitwarden's program and they've disclosed several. P.S. I, personally have reported three different security issues to LastPass, none of which have been fixed ([https://medium.com/@QuantopianCyber/hi- george-a16d88a37355](https://medium.com/@QuantopianCyber/hi- george-a16d88a37355)).

It's clear to me that LogMeIn, which owns LastPass and has a big-deal, flashy "About" page, is much less security-focused than Bitwarden. What you're asking for feels more like security theater than anything that's actually relevant to security.

</comment></comment></comment></comment></comment><comment><USER21> No mention of enpass.io, i found their method to be completely safe. Encrypted sqlite files, shared across Dropbox/onedrive/Google-drive.

Apps used for Mac, Linux, windows, browser integration also works fine. All boxes are checked, don't know why isn't it popular among masses or nerd community.

<comment><AUTHOR> We did not set out to evaluate every single password management product. We set out to evaluate the products which where enough "in the ballpark" of what our company needed that there was a chance we would end up using them.

There was never any chance that we would use a product which required every user to set up their own cross-device synchronization. Turnkey synchronization across devices as a first-class feature is a hard requirement for us.

Also, as far as I can tell, Enpass doesn't support sharing credentials between users, another hard requirement for us.

The family of password managers like KeePass and Enpass have their place, but they aren't good solutions to password management for businesses.

</comment></comment><comment><USER22> Hi folks,

That's a thorough comparison. I just wanted to make an attempt on why someone should consider using Zoho Vault for password management.

Zoho Vault is an online password manager for teams, used by more than 20,000 small and medium sized companies across the globe. We offer client-side encryption, multi-platform support, auto-fill, auto login websites and cloud apps, fine-grained password sharing, bulk folder sharing with user groups, audit, reports, two-factor & multi-factor authentication, US/EU data centers, browser extensions (Chrome, Firefox, Safari), and mobile apps (iOS, Android, Windows), option to maintain personal vault.

Integrations: G Suite, Microsoft Office 365, Zoho Mail, Zoho Desk, OKTA, OneLogin, Single Sign-On for 90+ Cloud Apps, Windows Active Directory/LDAP, Azure Active Directory

Disclaimer: I work for Zoho Vault. If you need a comparison document of Zoho Vault with any product, drop an email to firstname.lastname@example.com.

<comment><AUTHOR> I've added Zoho Vault to the comparison grid.

</comment></comment><comment><USER23> > Yubikey support in browser (Personal) BitWarden: no

huh? I use my yubikey in the Bitwarden browser extension.

Otherwise, a very extensive collection of comparison data. Not surprised to see Bitwarden come out on top.

<comment><USER24> "Yubikey support" is a meaningless phrase, anyway.

Bitwarden supports 2FA with Yubico OTP - although there's a bug so it works only for QWERTY layouts. Or you can use Yubikey's static password feature for your master password, I guess.

There's also OpenPGP Card and PIV, which, to my knowledge, is not used/supported by any password manager software except for `pass` and some compatible implementations.

<comment><USER25> No u2f support? :(

<comment> village-idiot U2f support is badly hampered by half-assed browser support. Only chrome enables it by default, Firefox disables it by default, and no love from safari. Even LastPass in the browser uses yubico's proprietary otp algorithm rather than u2f.

<comment><USER26> It seems that Apple is working to add support for hardware tokens. It is all a bit vague, but the latest Safari Preview notes state [1]:

 _Added support for CTAP HID authenticators on macOS_

It also gives me "Web Authentication" under "Experimental features" in the Develop menu.

[https://developer.apple.com/safari/technology- preview/releas...](https://developer.apple.com/safari/technology- preview/release-notes/)

<comment><USER27> Isn't that WebAuthn suppport? That is different from U2F.

<comment><USER28> Yes and no. U2F is basically the MVP of WebAuthn. If you're doing this today you should ignore U2F and just implement WebAuthn.

Firefox has WebAuthn out of the box, and there's a hack behind a pref to half- arse U2F if you still need that.

<comment><USER29> It doesn't, though. I've been trying to implement WebAuthn and, as far as I know, CTAP 2 doesn't work on any browser yet.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER30> What did you find changed in lastpass after the logmein acquisition? We've been using lastpass since before the acquisition, and i can't say i've noticed any substantial changes (either positive or negative)

<comment><USER31> Not sure if its related to the acquisition, but if you're a firefox user the app has gotten very slow in past few years. I think the issue is related to the move to chrome extensions but really that shouldn't be an excuse. Lots of add-on have done this move and haven't had a problem.

<comment><USER32> In the last few days it's had a good improvement. Copy username/password directly from the window is back (had to previously edit and view password, then copy) and speed is just as good as I see on chrome.

I'm using Windows an Linux and these improvements have come in the past week or so for me. Perhaps they recently updated, I haven't checked.

Worth taking another look if you can.

</comment></comment></comment><comment><USER33> I rarely see it mentioned, but when 1Password changed to a subscription model I switched to Enpass ([https://www.enpass.io](https://www.enpass.io)) and I've been very happy with it.

<comment><USER34> they don't make it very obvious, but note that 1password doesn't _require_ a subscription. i use it with vaults shared and kept in sync via dropbox for example.

<comment><USER35> Same. I recently purchased an upgrade and consider it well worth the price, although I'm considering switching to the subscription model / family plan to make it easier to support my parents and in-laws. However my main concern is that you can't _disable_ browser access when using ay of the subscription plans:

[https://discussions.agilebits.com/discussion/80105/cant- disa...](https://discussions.agilebits.com/discussion/80105/cant-disable-web- browser-access-from-1password-com-to-unencrypted-passwords)

<comment><USER36> I'm confused as to what the security issue is here.

> _Limiting the access of unencrypted passwords to only properly setup 1PW > applications would seem to eliminate the possible (probable?) web based > attack vector to a 1password.com account._

This doesn't make sense. What's a "properly setup 1PW application"? Presumably that's an instance of 1Password that has been given both the master password and account key for the account. But when you use the web-based portal, you have to give it, yep, the master password and account key.

Anyone who is able to access the passwords using the web portal _can already_ set up a local instance of the 1PW application that syncs with the same account.

Ultimately, asking to "disable browser access" is basically the same thing as asking to "disable the syncing API", which would obviously defeat the entire point of having the family account.

<comment><USER35> Right - I don't want 1Password to handle syncing and I don't want Dropbox handling / offering decryption of the encrypted store.

I trust the local 1Password apps enough to supply them my master password to unlock vaults locally.

I trust Dropbox enough to not sync the encrypted store somewhere I don't want it ending up.

It's a separation of concerns argument. I likely won't hold up to any targeted attack on my personal property given how careless I am with local devices but I should be somewhat protected against a your typical dragnet / mass attack against either service remotely.

</comment></comment></comment></comment></comment><comment><USER37> I'm surprised there was no mention of recent security audits.

BitWarden just famously had one.

<comment><USER38> Many of these have had audits, not just this Bitwarden audit. There are some disquieting things in that audit, for what it's worth.

I don't understand how this information is actionable. It would be worth knowing whether something has _ever_ been audited (again: most of the major password managers have been), but just knowing an audit has been done isn't sufficient to know whether it's secure.

<comment><USER39> Sure, but if it has been audited, it's more likely that security issues were found and resolved than if it hasn't gone through one.

Our company went through an audit and did quite well, and we fixed most of the findings. However, I know for a fact that there are things we can do to improve that weren't covered.

Not all audits are created equal, no audit will catch everything, and there's no guarantee that findings were patched sufficiently. However, I feel much better knowing that an audit was done, which means the author cares at least somewhat about security.

<comment><USER38> I think Scott knows that most of these other password managers have been audited, and I _know_ he knows audits are of varying quality and are virtually never conclusive, so I'm not sure what he's trying to say by pointing Bitwarden's audit out.

<comment><USER37> I thought the checklist was aiming to be _comprehensive_ and that the omission of the audits was an oversight.

The one for bitwarden being, as you said, disquieting, makes its omission a little suspicious.

<comment><AUTHOR> We didn't use the word "comprehensive", "complete", or "thorough", and obviously we didn't include every password manager in our evaluation, so I'm not sure what reason you have to believe that we were aiming to be "comprehensive."

We were aiming to evaluate the features / issues we care about against the password managers we were most likely to want to use. We published the results of our evaluation because we thought it might be useful to some people, not because we thought or intended for it to be all things to all people.

We didn't include security audits in our evaluation because, we are skeptical of their value and do not consider them a significant differentiator.

For example, in our experience trying to keep our own application secure, our HackerOne bug-bounty program has identified far more issues than the white-box security audits we've commissioned, at far lower cost.

</comment></comment></comment></comment></comment></comment><comment><USER40> Question about bitwarden: I found this issue saying there are no tests. [https://github.com/bitwarden/core/issues/399](https://github.com/bitwarden/core/issues/399)

Also in the comments here someone said there are no tests. Does anyone have any info about that? I am interested in the software but no tests would be worrying. (Had no time to browse the code yet.)

</comment><comment><USER41> As I want to protect all my passwords offline at one place but have them also available mobile, I developed Authorizer.

It is an Android password manager based on PasswdSafe with USB HID keyboard support to enter paaawords automatically on any device. Also stores TOTP/HOTP.

The idea is, to have a complete offline device (hardend android without network stack/always flight mode on, baseband overwritten, ...).

[https://github.com/tejado/Authorizer](https://github.com/tejado/Authorizer)

</comment><comment><USER42> This SAAS bias is untenable. "Use a big target" they say. "Store them with a big company" they say. "Give your data to someone, let them worry about it" they say. Meanwhile, breach after breach tells us that regardless of security, the likelihood of successful attack comes closer and closer to 1 as the size and exposure increases.

It's likely that these services have already been zerodayed, and we're just waiting for the shell to drop on an upswing.

<comment><USER43> Take in mind the whole evaluation was from company perspective. What those services are solving is company employees slacking passwords around, sending those via emails and using generic passwords like 'CompanyName123' or 'CompanyName!!!'.

Personally I am also not going to use cloud based solution.

</comment></comment><comment><USER44> I like the functionality comparison but I'm really curious how they stack up to each other security wise.

<comment><USER45> Bitwarden recently completed a 3rd party Audit[1] and Bitwarden is the only one to be completely open source[2] (server and client).

[1] [https://blog.bitwarden.com/bitwarden-completes-third- party-s...](https://blog.bitwarden.com/bitwarden-completes-third-party- security-audit-c1cc81b6d33) [2] [https://github.com/bitwarden/](https://github.com/bitwarden/)

<comment><USER46> It also has pretty much zero automated (unit, integration, etc) tests as of a few weeks ago.

<comment><USER47> But you only know that because you can see the source.

</comment></comment></comment></comment><comment><USER48> I'm using Chrome's built-in password manager. What are the drawbacks besides it being Google?

<comment><USER49> You're forever locked into Google Chrome!

I realize this is becoming an increasingly minor problem in the modern world, but it still bothers me. I don't know what future situations I'll find myself in, and I don't want to be locked out of all my accounts.

• What if a new browser comes out that's actually better than Chrome? (I don't want to admit to myself how unlikely this actually is.)

• What happens if I'm using a Windows 10 S device, or a locked-down library computer, or a Wii U, or some other weird gadget with a non-Chrome browser?

<comment><USER50> I recently starting using Firefox again, and getting my passwords out of Chrome was by far the most difficult part of the process for me. A few things I learned:

Chrome has a feature to export passwords to a CSV file, but I had to enable it via a chrome:flag, so who knows if/when support for this will disappear. This created a bit of a sense of urgency for me, as Google aggressively removes features that they don't want to support.

My employer MITMs all web traffic, so I would never log into my Google account from work. They also have an ridiculously strict password change policy (every 3 months). But having a password manager on my phone lets me store passwords for my various work-related accounts somewhere, which makes each password change fairly easy, and also lets me log into certain work-related apps/sites (e.g. Slack) from home.

If you have multiple accounts on a single website, it's a bit easier to do in a password manager (at least Keepass or Bitwarden).

Chrome is a web browser, so it only remembers passwords to websites. If you have passwords that don't map to a website - e.g. hard drive encryption password, a pgp/ssh key, a wifi password), it's a bit easier to do in a password manager.

Some password managers have OTP generators built-in, which can be convenient.

<comment><USER51> Does firefox not import passwords from chrome as part of the profile import? It's... certainly supposed to.

EDIT: Oh, you probably didn't mean getting them out and into firefox, you probably wanted to use something different to avoid the same issue (but with firefox) if you switch browsers again in the future.

<comment><USER50> Actually, at the time, I would've been perfectly happy to have just imported the passwords into Firefox!

But I don't think it is able to import them, at least not on my machine. I'm using the latest Chromium/Firefox on the latest Ubuntu, and I just had another look. When I select the option to import data from another browser, I get a dialog that says:

Import Preferences, Bookmarks, History, Passwords and other data from: Chromium

When I select Chromium, I see a list of things I can import:

Select which items to import: [x] Cookies [x] Browsing History

For some reason, "Passwords" does not appear in the list, and when I browse to a site in Firefox, it doesn't use the password that Chromium had stored.

Maybe this is an OS-dependent thing?

</comment></comment></comment></comment></comment><comment><USER49> One feature I didn't see mentioned—LastPass has a Bookmarklet that can be used in leu of a proper extension. This means that if I ever decide to start using a random niche web browser, I won't have to start copying and pasting from a web vault in order to log in to sites.

The freedom to do this is important to me regardless of whether I ever actually use it.

</comment><comment><USER52> My personal password manager: GNUPG-encrypted text file (org-mode). No extra fuss.

Reason? I have too much code to look/trust to add more and I do not keep log- in anywhere during my day, I do my best to avoid web-(cr)app as much as I can and try to live asynchronously connects via Emacs, being capable of operate as much as I can offline...

</comment><comment><USER53> No keepass? Disappointed.

<comment><USER54> The one issue I had with Keepass is that on iOS (and this is Apple's fault!) it is not possible to choose different cloud storage providers to keep the password database file on.

This silly thing alone would preclude me ever buying an iOS device! (My wife ran into it when I tried to get her up and running with Keepass, she gave up...)

I love keepass's simplicity, no browser plugins with pop up dialog boxes or UIs that conflict with the browser's own password management, just, a list of accounts and passwords.

<comment><USER55> It's not Apple's fault as it's possible to change the cloud storage to store your password with 1Password for iOS.

</comment></comment></comment><comment><USER56> Has anyone gone through the process of switching? I use Keeper for personal stuff, and I suppose there's always the chance to switch if one turns out to be technically or politically much superior, but there are dozens and dozens of passwords in there to transfer...

<comment><USER57> I switched from LastPass to 1Password. It was a quick and simple export -> import process.

<comment><USER58> As a current LastPass user, what prompted you to switch?

<comment><USER59> Not the person you asked, but I also switched from LastPass to 1Password. The reasons were (1) 1Password's more integrated/more convenient 2FA support, and (2) AgileBits seems to care more about design.

</comment></comment></comment></comment><comment><USER60> I only found out about Bitwarden a few weeks ago and it got me to change from KeepassXC and I'm overall very happy with the change.

The main selling points for me were that it's open source and they allow you to host it yourself.

Apart from these, I really enjoy the browser addons which don't require any jumping through hoops[1] and that they provide their own Android client and you don't have to play Play Store Columbus to find a decent one. It can also be used as an autofill service which allows it to interact with other apps which is incredibly useful.

But because nothing in this world is perfect, the downsides so far are:

1\. Lack of shortcuts to copy only the username or only the password and forcing me to reach for the mouse. That's really annoying.

2\. With KeepassXC you could have a keyfile that you was necessary to unlock your database while Bitwarden doesn't have that option. They do provide 2FA[2] but only TOTP and email for the free version (although $10/year for the premium subscription, arguably, is not much).

1: [https://keepassxc.org/docs/keepassxc-browser- migration/](https://keepassxc.org/docs/keepassxc-browser-migration/) 2: [https://help.bitwarden.com/article/setup-two-step- login/](https://help.bitwarden.com/article/setup-two-step-login/)

<comment><USER61> > The main selling points for me were that it's open source and they allow you > to host it yourself.

KeepassXC is open source too. And it does not require hosting. You can simply store your db onto a synced folder between devices and that's about the same anyway.

As for your comment regarding browser addons, I am not sure what "hoops" you are referring to. I installed the browser addons for KeePassXC and it took 5 minutes to setup and I have had no issue since. And the link you refer to is pretty self explanatory. Maybe Bitwarden makes that even more simple, but it's not that KeePassXC is utterly complex in the first place either.

On Android, KeePassDX is a good client that works with KeePassXC databases.

<comment><USER60> You are right about the synced folder, and that's pretty much the approach that I was using. But I was keeping my DB in one provider and my keyfile in another, which means that I had to remember (or have otherwise access to) a total of 3 passwords to unlock my db. It worked, but when I recently had to change phones two times in a period of a few days it was increasingly annoying. Of course I could have kept my keyfile and the DB in the same provider, but still that's one password too many for me.

Thanks for the recommendation for KeePassDX, I will take a look.

</comment></comment></comment><comment><USER62> I've been using masterpassword [1] which is stateless and requires no sync. I wonder what the HN crowd thinks of its features. Another option with the same paradigm is lesspass [2].

1\. [https://masterpassword.app/](https://masterpassword.app/) 2\. [https://lesspass.com/#/](https://lesspass.com/#/)

<comment><USER63> There's a few issues with the master password derived password system, including:

What if you need to change your password for a site to a different one?

What if the site changes its URL?

<comment><USER64> There's a counter on Master Password, so if the password expires or you need to change it, you just +1 and it's new.

They also have settings depending on password requirements (no special characters, etc.).

I'm unsure what the URL really has to do with it, you could just generate a new password for the new URL and change it.

<comment><USER65> Sometimes different URLs share credentials (LDAP). Changing isn't necessarily an option?

<comment><USER64> I guess in a situation like that you'd just choose the base URL you'd remember best.

</comment></comment></comment></comment></comment><comment><USER66> i find it hilarious, hilarious i tell you, that he felt the need to put a quasi-legal disclaimer at the bottom of his _medium post_. i suppose it is demanded by the field he is in (investment banking) but it just strikes me as nonsense.

too bad the article is quite thin.

</comment><comment><USER67> If someone is still looking for a good one, I use Keepass and can very much recommend it.

</comment><comment><USER68> i was using dashlane for a while. The features were great, but one thing really bothered me:

On macOS everytime I opened safari it launched a dashlane.com page reminding me to install the plugin. I did not want the plugin, and after much googling never was able to prevent this behavior. I had to uninstall it.

Switched to KeepassXC, its good.

</comment><comment><USER69> Here's a plug for DPG (zero storage password manager). I wrote it years ago and it meets my needs well.

[https://github.com/w8rbt/dpg](https://github.com/w8rbt/dpg)

</comment><comment><USER70> [https://pwsafe.org/](https://pwsafe.org/) by Bruce Schneier

</comment><comment><USER71> anyone use passbolt[0]?

interested to know your experience good/bad/etc...I am considering installing on a vm at home to use for family.

[0] [https://www.passbolt.com/](https://www.passbolt.com/)

</comment><comment><USER72> A comparison matrix would help.

<comment><USER44> Does the one further down on the page hosted on JSFiddle count?

</comment></comment><comment><USER73> _we decided that Bitwarden is the best choice for our company, and we've begun the process of migrating from LastPass to Bitwarden._

      whois lastpass.com
      LogMeIn, Inc.
      whois bitwarden.com
      WhoisGuard, Inc.

<comment><USER74> What is your point?

<comment><USER73> WHOIS Privacy on the website wasn't a consideration on the table the company used. Maybe it's not important in 2018, or is enabled by default, or an oversight, or they're using the spam filtering. But:

 _It's at the bottom of the page._

So why the discrepancy?</comment></comment></comment>


When Making Life Decisions... - <AUTHOR> http://www.trevormckendrick.com/life-decisions/

<comment><USER2> And also take a moment to pause and ask yourself why other people want that thing for you. You may be missing something.

Often people around you like parents or siblings only want to help you, I totally agree that theirs opinions is not necessarily the good ones but you should also try to understand them

<comment><AUTHOR> Agreed that they might want what's best for you.

But only because someone wants you to be happy, doesn't mean they know what will make _you_ happy, e.g. religious parents wanting their children to embrace the same beliefs.

<comment><USER2> I completely agree with you. You should understand them (because of their religious belief in your example) but not necessarily follow their advice

<comment><AUTHOR> Thanks by the way for the comment on my blog. Much appreciated.</comment></comment></comment></comment>


Could toxic air on planes make frequent flyers ill? - <AUTHOR> https://www.theguardian.com/science/2017/aug/19/sick-crew-toxic-air-planes-frequent-flyers-ill <comment><USER2> As a frequent flier I've found flying is much more stressful to my body than one might expect. Long flights make me completely miserable, sometimes for multiple days afterward. Plus there is social isolation and a strange sense of detachment from being away from home and friends for so much time. I was in denial flying was that uncomfortable for years (why would sitting in an uncomfortable chair breathing dry air for a few hours leave me THAT uncomfortable?

I'm skeptical of what amount to anecdotal claims about health problems from flying. It's an unexpectedly physically stressful job which I think will tend to make people over attribute health problems to it.

</comment><comment><USER3> The article does not mention the constant noise in a plane. For me that is also very invasive and feels very unhealthy. I always feel exhausted after a while.

<comment><USER4> I have no doubt about the noise being a problem. I always fly with either ear plugs or noise canceling headphones, and it makes a huge difference.

Side note: noise makes food high in umami taste better, and as a result tomato juice is one of the most popular drinks on a plane, when the same people rarely drink it otherwise.

</comment></comment><comment><USER5> Any time I board a plane I get the distinct sense that the cabin air contains toxins of some kind, as it consistently smells like exhaust air.

<comment><USER6> Not to mention the radiation, the circadian rhythm disruption, the poor nutrition, and the alcohol.

</comment></comment><comment><USER7> I wish they'd have mentioned that jet fuel uses leaded gasoline still. Lead poisoning could explain some of these symptoms.

<comment><USER8> No, jet fuel does not contain lead. Only fuel for piston-driven aircraft contains lead.

[https://www.faa.gov/news/fact_sheets/news_story.cfm?newsId=1...](https://www.faa.gov/news/fact_sheets/news_story.cfm?newsId=14754)

"Jet aircraft and turbine-powered, propeller aircraft do not use avgas, but instead use fuels very similar to kerosene, which does not contain a lead additive."

<comment><USER7> I stand corrected</comment></comment></comment>


Russia has a new robot soldier and it's a little troubling - <AUTHOR> http://www.businessinsider.com/russia-has-a-new-robot-soldier-2016-5 <comment><USER2> Sigh, nobody has a credible power source for a humanoid type robot, we don't even a decent source for a 'dog' robot that can save power by just standing there. You can deploy a gun on a rolling platform, but if you armor it so that it is resistance to small arms fire it gets to heavy to move and can't navigate rubble that you find in every war zone.

Basically, aerial drones are it for now. Maybe some "flying grenades" in the near future but probably just spotters for finding sniper perches etc.

And nobody is letting these things loose yet as fratricide is waaaay too likely.

Someday killer robots will be a thing, but thankfully that day isn't today. I'd be more impressed if the Russians decided to field a sentry gun. They are a reasonable force multiplier.

<comment><USER3> >>Someday killer robots will be a thing, but thankfully that day isn't today.

Why do you say "thankfully"? Isn't it better to have robot armies face each other than human armies? Wars will probably continue to happen no matter what.

<comment><USER4> It would be great if war gets to some point where human lives aren't threatened, but for the forseeable future, robot soldiers are going to be killing humans. Forces who can afford them aren't going to be squaring off anytime soon-- it's going to be military Goliaths like Assad vs. rebels. Like other bombs and advanced weaponry.

<comment><USER5> yet, as someone mentioned to me many years ago, robots aren't (probably) going to torture and rape.

E.g. in ww2-with-robots people would have been killed but the nanking massacre would not have happened.

<comment><USER4> You're saying a force with robot soldiers would have robot soldiers alone, with no human soldiers who would follow up, come in, and commit war crimes?

<comment><USER5> no, I am saying that if we replace some human soldiers with some robots, it's likely that the amount of war crimes goes down. E.g. the number of raped women in Nanking was 20000 per some accounts. If half the army had been robots, there might have been 10000 less rapes.

If you consider that battle frenzy is likely to de-humanize soldiers much more than "setup camp and hold ground" operations, it seems likely that the number of war crimes goes down even more, once you remove humans from active battle.

Of course, I cannot exclude rampaging robots taking revenge on puny humans, but that seems unlikely.

<comment><USER4> War crimes, for the most part, aren't some battle-frenzy or blood-lust, they are either a deliberate tactic or lack of discipline. Nanking wasn't soldiers gone crazy from war, it was deliberate punishment and demoralization of the Chinese. Also see more recent conflicts in Africa. As far as lack of discipline, see the US Vietnam war.

It just seems to me that we already have "robot" soldiers -- tanks, plans, bombs, artillery. When the purpose is to terrorize and demoralize an enemy's population, they're not going to have robots doing it.

</comment></comment></comment></comment></comment></comment></comment><comment><USER6> "The technology is still not as advanced as its American counterparts, said Singer" ... why isn't the fact that the U.S.A has even more lethal weapons troubling? (actually the real trouble is that attack weapons are starting to be much better than defense weapons, which is a good indicator for having a world war :( )

<comment><USER7> > why isn't the fact that the U.S.A has even more lethal weapons troubling?

Business Insider is an US publication. In their POV, they aren't threatened by the US armed forces. Armies of an antagonist state do represent a threat, particularly when these arms races are motivated by a specific demand to counter the capabilities of the US armed forces.

</comment></comment><comment><USER8> The military industrial complex is at it again, trying to scare up support for more funding by waving the russians around.

Meanwhile the koreans already have autonomous gun turrets in field testing and the Us operats something like half of all the carriers in the world.

<comment><USER9> People in power in today's Russia understand the only kind of arguments - force. Force of different kinds, but still - overwhelmingly force. This approach shouldn't be underestimated.

<comment><USER10> I have no idea why you were downvoted. Objective view of Russian foreign policy is that they gladly go for quick wins using any means at their disposal _if the odds are in their favor_. Having lots of credible force on the other side reduces these odds.

<comment><USER11> Because it's an idiotic simplification, like writing that "people in power in today's USA understand the only kind of arguments - money. Money of different kinds, but still - overwhelmingly money. This approach shouldn't be underestimated".

<comment><USER10> But it's not an idiotic simplification. Money, diplomatic relationships or international reputation are objectively irrelevant (if one wants predicatble outcomes) when dealing with the lords of Kremlin.

For example, observe the effects of economical sanctions on Russias de-facto war with Ukraine (none).

I'm not saying other large powers would be any better. The difference is, for example with US you can follow a little bit better as an outsider what is going on with their policies while Russias actions are far harder to predict.

</comment></comment></comment></comment></comment><comment><USER9> > "It's already pretty well acknowledged that if Russia wants to invade the > Baltics, they can do it in 24 hours and NATO can't do much about it," Asaro > said. "Them having some super sophisticated robot isn't going to change > that."

Really? It takes that long for a rocket to fly to Russia? Don't Baltics have some groups of American soldiers, strategically placed right in the harm's way, and wouldn't Pentagon react on harm to them? Won't NATO honor its obligations to defend its members? Does it REALLY take 24 hours for UK arms to reach Russia as well?

<comment><USER8> Well no, if you want to start nuklear war over the baltics the ballistic missiles can get there in a few minutes. But air power is the only thing that can get there fast, and the russians have actual anti air systems... And anyway, an airforce can't stop a ground invasion, only an army can do that.

The us does have som forces in place, but not enought to matter against a determined invasion, and since russia attacking the baltics pretty much is open war with the us, any plausible scenario involves a determined invasion.

</comment></comment><comment><USER12> I've looked up russian sources and according to them the robot in question is managed by an operator using special "steering suite". The suite reads operator moves and transmits them to control the robot. AFAIK "Atlas" is a bit more advanced.

</comment><comment><USER13> I always sigh when the link is to Business Insider. I don't follow the link as I know BI is the grocery store check out line fodder.

</comment><comment><USER14> this came from nowhere. it is way better then our atlas. russian did it again like before they did unmanned satellite race.

<comment><USER15> indeed its better than atlas at standing in place wearing uniform, or waving a hand to the camera

</comment></comment><comment><USER16> Well, if we would just put ethics aside and go down the road of reproductive cloning, we could have a clone army. And by the logic of Star Wars - Clones > Droids.

<comment><USER17> If you're putting ethics aside, you attack with a droid army, use a third party to sell clones to the opposing army to fight the droids, have the clones prove themselves in battle to get placed in all the strategic locations, then have the clones turn on them.</comment></comment>


Sun's Open-source Boss Slams App Engine's Java Support - <AUTHOR> http://tech.yahoo.com/news/pcworld/20090413/tc_pcworld/sunsopensourcebossslamsappenginesjavasupport <comment><USER2> Meh. Why not just write in python? It's a better language in almost every way anyway.

<comment><USER3> Yes, but if any other vendor decided to implement a half-assed and incomplete subset of a spec and tacked the name of the spec on it, you would be jumping in anger. MS's POSIX compatibility layer gets all the ridicule it deserves, so Google shouldn't get away with calling a bad subset of Java "Java".</comment></comment>


Show HN: I made a Chrome extension to reveal zero-width characters - <AUTHOR> https://github.com/chpmrc/zero-width-chrome-extension <comment><USER2> A bit tangential, here's a few unix utils you can use to inspect text:

`vis`: display non-printable characters in a visual format

`cat -e`: Display non-printing characters and display a dollar sign (`$') at the end of each line.

`hexdump -c`: Display the input offset in hexadecimal, followed by sixteen space-separated, three column, space-filled, characters of input data per line.

`od -a`: Output named characters.

<comment><USER3> Is `hexdump` not `xxd`?

<comment><USER4> xxd is part of vim IIRC.

<comment><USER5> Nope.

[https://linux.die.net/man/1/xxd](https://linux.die.net/man/1/xxd)

<comment><USER4> Yep:

      $ apt-cache show xxd | grep Source:
      Source: vim (2:8.0.1453-1)
      Source: vim

<comment><USER5> Oh I must've misunderstood what you meant by "part of" vim.

</comment></comment></comment></comment></comment></comment><comment><USER6> I agree with other users who said that it would be nice if this happened automatically instead of on click--I think after the initial novelty wore off, I'd probably forget to click it. It might be cleaner to just strip the non- printing characters and display a number of characters stripped, similar to how ad blockers display the number of ads blocked.

<comment><AUTHOR> I like the adblock analogy, might work on it, thanks.

<comment><USER7> Please do, and publish as a real extension - I'd definitely use it

</comment></comment></comment><comment><USER8> It might make more sense as a clipboard filter.

If you're an English speaker that doesn't often handle languages which gain from zero width characters you could just have a listener scan your clipboard for zero-width characters, silently strip them, and then re-populate the clipboard.

Although I've been thinking about building a clipboard filter for Windows a lot lately, I'm getting tired of copying text to the address bar or notepad to strip text formatting information.

<comment><USER9> Zero width characters can also be used to force long strings of text to wrap correctly, so this may break the layout of sites that allow things like URLs in UGC text.

<comment><USER8> Why would a website flow through a user's clipboard?

<comment><USER10> they're talking about OP's extension that modifies how the website is presented. Not the clipboard idea.

</comment></comment></comment></comment><comment><USER11> It's starting to seem like the universe has some fundamental order for things that we can escape temporarily, but that are inescapable in the long run.

1\. Photo and video evidence was a game-changer for establishing facts and chronologies. As we've seen, it's becoming harder and harder to distinguish fake photos and videos from real. It's not a stretch to predict a time when we'll only be able to make probabilistic statements about the veracity of photos or videos. (E.g., "60% liklihood of being undoctored.") This is probably already true about photos, although the expense of making a perfect fake is still pretty high, in terms of expertise.

I'd argue the "natural state" is one where word-of-mouth and first-hand accounts are the most authoritative evidence we can have (other than physical evidence like DNA left behind). And even physical evidence left behind can't tell us what the person did while there or how an event transpired.

2\. Tracking communications. In the digital age, we've some people have come to assume that all digital text is untrackable and anonymous. Your "11001110" is the same as mine. Historically, it was pretty difficult to transcribe information without leaving traces of the origin of that info. These zero- width characters plus all the other text fingerprinting methods, and ubiquitous tracking in communication logs make it nearly impossible, again, to communicate with others without leaving a trail. And then there's the writing style analysis which makes it tough to write anything without leaving telltale fingerprints.

So, I'm proposing that we are returning to the "natural state" of things. Probably overstating things a bit, but still an interesting thought to consider.

<comment><USER12> > _... the "natural state" is one where word-of-mouth and first-hand accounts > are the most authoritative evidence we can have (other than physical > evidence like DNA left behind)_

First-hand accounts aren't always reliable.

[https://en.wikipedia.org/wiki/Eyewitness_testimony](https://en.wikipedia.org/wiki/Eyewitness_testimony)

<comment><USER13> Neither is DNA for that matter.

[https://www.theatlantic.com/magazine/archive/2016/06/a-reaso...](https://www.theatlantic.com/magazine/archive/2016/06/a-reasonable- doubt/480747/)

<comment><USER14> DNA is pretty ironclad. What that article shows is that people in authoritative positions are fallible.

</comment></comment></comment></comment><comment><USER15> Have you thought about revealing things like non-breaking space, thin space, hair space, and so on? I think at least Fecebutt replaces non-breaking spaces with regular spaces in comments, perhaps precisely to frustrate such steganography. (Ironically, last I recall, they do preserve the difference between double and single spaces, e.g. after periods, which is even more invisible in HTML.)

I second the recommendations of vis, cat -e (or cat -vte), and od -a. I didn't know about hexdump; I always used xxd.

</comment><comment><USER16> The project is clearly motivated by _Be careful what you copy: Invisibly inserting usernames into text_ [0] (posted 12 hours ago on HN), and many people here might think zero-width characters (or rather, any esoteric Unicode characters) are the only (or the prominent) way to watermark texts, which is wrong. The whole topic - _watermarking_ \- is worth at the very least a lengthy blog post, and maybe even several articles, so keep in mind that this comment is just a very brief introduction to different methods (of watermarking)[x]:

(from trivial to more complex ones)

\----

1\. Using Invisible Characters

The linked[0] article basically talks about a very basic version of it, which should be enough to get the idea. Of course, more sophisticated techniques will use more than just two characters, and will take the _position_ of each invisible character into consideration while encoding & decoding watermarks, ensure it's uniformly distributed throughout the paragraphs etc.

Can be defeated by simply removing invisible characters.

\----

2\. Using Unicode Characters That Look Alike

The same working mechanism as _IDN homograph attack_ [1].

Can be defeated by simply removing "out-of-place" letters/characters, after determining the language of a given text/paragraph/sentence etc.

\----

3\. Using Unicode Equivalence

> Code point sequences that are defined as canonically equivalent are assumed > to have the same appearance and meaning when printed or displayed. For > example, the code point U+006E (the Latin lowercase "n") followed by U+0303 > (the combining tilde "◌̃") is defined by Unicode to be canonically > equivalent to the single code point U+00F1 (the lowercase letter "ñ" of the > Spanish alphabet).

[https://en.wikipedia.org/wiki/Unicode_equivalence](https://en.wikipedia.org/wiki/Unicode_equivalence)

Can be defeated by simply normalising the text, and line endings!

\----

(Now it's getting harder!)

4\. Changing the Layout of Documents

You can change (the rendering of):

      (a) the margins
      (b) the ligatures
      (c) the space between
        (i)  specific characters [kerning]
        (ii) consequent words/lines/paragraphs

to embed fingerprints. This is especially dangerous as documents are often leaked by taking screenshots or photocopies, which is secure against Unicode attacks, but not of these.

Can be defeated by copying the plaintext, and pasting it to a text editor, and applying steps 1, 2, 3.

Also, bear in mind that if you can still -unintentionally- leak information:

(a) when you use a document editor (LibreOffice Writer, Microsoft Word) as the layout engines might act differently depending on your software version, platform, file format etc.

(b) paper size (A4, US Letter, ...)

\----

5\. Substituting with Synonyms

If characters can be replaced by their equivalents, why not replace words or sentences even? Words can be substituted by their synonyms based on an algorithm that can create fingerprints accordingly, and I presume even sentences can be rephrased with the latest advancements in AI/ML.

Also, some of the substitutions will be _unintentional_ : a scribble on a piece of leaked document can also leak information about its leaker (different spellings in American and British English, ways of writing date & time, decimal separators etc).

Can be defeated by paraphrasing.

\----

The list can probably extended even further but this was all I could remember on the top of my head. =)

[0]: [https://news.ycombinator.com/item?id=16749422](https://news.ycombinator.com/item?id=16749422)

[1]: [https://en.wikipedia.org/wiki/IDN_homograph_attack](https://en.wikipedia.org/wiki/IDN_homograph_attack)

[x]: Not that I'm working in a related field, but I researched watermarking & fingerprinting techniques for a similar but much more extensive project for journalists/whistle-blowers to detect fingerprinting/watermarking in documents.

Let me know if you are interested and we can collaborate!

<comment><USER17> Excellent list. For completion's sake, I'd include intentional typos as an instance of category 5. This can be hard to catch if the typo is in a name. A logical extension of that would be entirely made-up names for non-essential people/places.

 _At the age of 5, Hawking visited Oxford, incidentally passing through Fakenamingham-on-Watermarkshire._

Dictionaries/encyclopedias have been known to insert entirely fake entries as a way of proving ownership.([http://articles.chicagotribune.com/2005-09-21/features/05092...](http://articles.chicagotribune.com/2005-09-21/features/0509200275_1_electronic- dictionary-new-oxford-american-dictionary-new-yorker)) In the age of ebooks and print-on-demand, those could be tailored to the individual licensee.

<comment><USER18> >Dictionaries/encyclopedias have been known to insert entirely fake entries as a way of proving ownership.

Just like non-existing places/roads on maps, so-called "trap-streets":

[https://en.wikipedia.org/wiki/Trap_street](https://en.wikipedia.org/wiki/Trap_street)

and similar:

[https://en.wikipedia.org/wiki/Agloe,_New_York](https://en.wikipedia.org/wiki/Agloe,_New_York)

<comment><USER19> also mountweazels [https://www.thoughtco.com/mountweazel-words- term-1691330](https://www.thoughtco.com/mountweazel-words-term-1691330)

</comment></comment></comment></comment><comment><USER20> Anything like this for VSCode? Just adding option-space accidentally in a ruby file (after an `end`) will cause ruby to explode and not tell you anything. Randomly deleting code until it runs was my only fix.

<comment><USER21> There is an extension called Highlight Bad Chars. I installed it after reading this

<comment><USER20> Brilliant, thanks!

</comment></comment></comment><comment><USER22> I'll be sure to add a link to [http://zerowidth.space](http://zerowidth.space)

<comment><USER23> It feels like you're trying to make a point on that site but I cannot fathom out what that point was. Are you saying zero width spaces are bad? Are you educating people that they exist? It's not all too clear what your point is.

Also I disagree with the following:

> _If you 're working on a website there's a good chance that someone will > want to copy/paste it, automate using it, etc. Zero-width spaces will create > no end of hassle to those people._

I could work around that with literally just 1 line of code:

        newString = replace(originalString, "", " ")

But these days many HTML parsers will tidy up the output for you so depending on the frameworks you're using, you might not even need to use the above line of code.

<comment><USER22> > _Zero-width spaces will create no end of hassle to those people._

It's up to you to decide what to do with that information.

> newString = replace(originalString, "", " ")

If I could have registered "zerowidth.character" I would have. You've got to handle different characters and such.

I should say that the site is mainly a joke because we had to use a particular tool which had a bunch of zero width spaces in it, and it got on our nerves.

<comment><USER23> > If I could have registered "zerowidth.character" I would have. _You 've got > to handle different characters and such._

Ahhh I didn't get that from the site. I thought it was focused on one specific type of zero width character

> I should say that the site is mainly a joke because we had to use a > particular tool which had a bunch of zero width spaces in it, and it got on > our nerves.

That's fair enough. :)

</comment></comment></comment></comment><comment><USER24> OP, does this mess up ZWJ emoji (like any of the skin-tone-modified emoji)?

<comment><AUTHOR> Sorry I'm afraid I don't understand the question.

<comment><USER24> It's a pretty obscure edge case. You could retain ZWJs when they were between two Unicode points with the Symbol or Emoji Symbol classes, but on further reflection, it would probably be more honest to just strip the ZWJs everywhere and decompose the emojis.

EDIT: also what jedanbik said

<comment><USER25> Hardly obscure. ZWJ emoji sequences are really common now.

</comment></comment></comment></comment><comment><USER26> Does anyone remember how many years of pain were caused by different line endings -- "\n" vs. "\r" vs. "\r\n"? Unicode is 10x that, and the pain is just beginning.

<comment><USER27> Did you mean ^10?

<comment><USER26> Probably, since it's an omnishambles on a scale I won't pretend to understand. Eight-fingered and two-thumbed humans can't type it, but they've managed to make it a joke (see zalgo text), and it only gets more ridiculous with time (see how flags are done, or emoji skin-tone modifiers). It's only a matter of time before Metafont will be easier to read and write than the hieroglyphics we're supposed to call "text."

</comment></comment></comment><comment><USER28> I made two python script to encode and decode string into and from zero width characters: Encoder: [https://pastebin.com/DGansW69](https://pastebin.com/DGansW69) Decoder: [https://pastebin.com/ZVdvjnZc](https://pastebin.com/ZVdvjnZc)

I know it's pretty basic stuff but it does the job. The encoder outputs both in stdout and into a file so you can copy/past it more easily (from Sublime Text for example)

</comment><comment><USER29> What about Firefox?

<comment><USER30> You can use this addon: [https://addons.mozilla.org/de/firefox/addon/foxreplace/?src=...](https://addons.mozilla.org/de/firefox/addon/foxreplace/?src=search)

Apply an autoload rule with these settings:

      Name: zero length replacement
      HTML: Output only
      URL: <entering no url matches all sites>
      Replace: (\uFEFF|\u200B|\u200C)
      Type: Regular expression
      With: 😳

<comment><USER31> Thank you!

</comment></comment></comment><comment><USER32> Time to read the web exclusively in ASCII with UTF-8 characters inserted using their codepoint

~WHITE SMILING FACE~ ~THUMBS UP SIGN~

</comment><comment><USER33> lol you didn't even give anyone a chance. I saw someone asking about this in the comments from the article this morning.

<comment><AUTHOR> I was really intrigued by this zero-width characters thing haha

</comment></comment><comment><USER34> It would be a nice enhancement to do so automatically (rather than on-click), but at least for me, this serves the purpose.

<comment><USER35> Yes I agree, or maybe just update the app-icon if it detects presence of zero- width characters, and then you can click to show them.

</comment></comment><comment><USER36> I wonder if some sort of clipboard tool to detect and warn of sneaky looking things might be even more convenient.

</comment><comment><USER37> If it's a button to click anyway, couldn't this just be a bookmarklet?

<comment><AUTHOR> Yep, but it was also a way to learn how to build and publish a Chrome extension.

</comment></comment><comment><USER19> I wonder if this could be used on Tor to get a user ID.

</comment><comment><USER38> So does it show the ZWJ within emoji combinations?

</comment><comment><USER39> firefox ?

<comment><USER30> You can use this addon: [https://addons.mozilla.org/de/firefox/addon/foxreplace/?src=...](https://addons.mozilla.org/de/firefox/addon/foxreplace/?src=search)

Apply an autoload rule with these settings:

      Name: zero length replacement
      HTML: Output only
      URL: <entering no url matches all sites>
      Replace: (\uFEFF|\u200B|\u200C)
      Type: Regular expression
      With: 😳</comment></comment>


Ask HN: Is the Mac App Store the Death of Homebrew? - <AUTHOR>

Homebrew is wonderful, as we all know, but it calls itself the missing package manager for OSX, referring to the wonderful Linux package manager.  And I agree, that is pretty much what it is.  However, won't the Mac App Store do the same thing in GUI form?  Will there be apps you can install with homebrew (or other pm's like it) that you can't install with the app store, or vise versa?  Is the Lion eventually going to eat homebrew? <comment><USER2> Not sure what Homebrew is (not a mac user myself), but the App Store is intended for stand-alone (portable?) apps. The rules forbid libraries and system utilities.

So, if homebrew is anything like the debian package manager, then no, the AppStore probably won't kill it; at least not now.

</comment><comment><USER3> From what I've read so far, Apple has got rules about what kind of programs go into the app store, for example they have to be packaged with Xcode (correct me if I'm wrong).

I doubt they'll have the unix-based utilities most people use Homebrew for.</comment>


Dear advertisers: It's time to stop supporting BuzzFeed Video - <AUTHOR> https://medium.com/swlh/dear-advertisers-its-time-to-stop-supporting-buzzfeed-video-10f1f423a645#.qeqa0p5si <comment><USER2> I get why the author is annoyed, but that isn't how intellectual property works.

Let's dig into one example. In 2013 the author made a video series called "How Do Black People Feel About?", two years later BuzzFeed made a series called "Ask an Asian", and the author thinks it's a ripoff.

Is it a ripoff? Not unless they are both ripoffs. Looking around, that isn't even the first thing called "Ask an Asian". The Huffington Post ran a similar bit a year before either of the video series: [http://www.huffingtonpost.ca/tetsuro-shigematsu/asian- bc_b_1...](http://www.huffingtonpost.ca/tetsuro-shigematsu/asian- bc_b_1778549.html)

All that is going on here is that there is a limited amount of ideas for funny internet videos, and often you will see a funny video that is pretty similar to another. That's it. Maybe it was inspired by watching others, but it doesn't matter. You just can't own an idea as general as "making art with pancakes".

</comment><comment><USER3> Doesn't DMCA work against buzzfeed videos?</comment>


Gisp: A Lisp that compiles to Go - <AUTHOR> https://github.com/jcla1/gisp <comment><USER2> If you are wanting a native dynamic scripting language for Go, goluago is coming along quite nicely (alpha version released at New Year):

[https://github.com/akavel/goluago](https://github.com/akavel/goluago)

I think if I wanted to implement a native Lisp interpreter/ bytecode compiler for Go, I would build on top of this project rather than starting from scratch.

<comment><USER3> That looks useful, thanks.

</comment></comment><comment><USER4> For any programming language or platform without macros, a Lisp frontend appears.

<comment><USER5> Nisp: A Lisp that compiles to Nothing

the perfect zen...

<comment><USER6> And if you need a Lisp that is nothing : [https://en.wikipedia.org/wiki/NIL_(programming_language)](https://en.wikipedia.org/wiki/NIL_\(programming_language\))

</comment></comment></comment><comment><USER7> For those playing with this type of code generation, you get to learn more by targeting Assembly instead.

Define a proper interface between ASTs and code generation and retarding the compiler is also not that complicated.

Or generate LLVM bitcode and use the LLVM tools to compile it to native.

Way better than relying in other compiler stacks.

Of course, it is a matter how deep one wants to get into compiler stuff.

<comment><USER8> s/retarding/retargeting/? Or something else? I haven't been able to come up with an interpretation where "retarding" makes sense in that sentence, but of course I'm not a native speaker.

I guess targeting assembly is way harder, you must deal with register allocation and other scary-sounding topics.

<comment><USER7> > s/retarding/retargeting/?

Ooops, a typo.

> I guess targeting assembly is way harder, you must deal with register > allocation and other scary-sounding topics.

Not necessarily, if you are ok with just getting something to run.

You can pre-define a set of generation templates for each AST node, no need for register allocation.

</comment></comment></comment><comment><USER9> See also Kakapo, an effort at a lisp interpreter in Go.

[https://github.com/bytbox/kakapo](https://github.com/bytbox/kakapo)

</comment><comment><AUTHOR> Author here, in case anyone has any questions!

<comment><USER10> How does it actually work? Does it compile to Go's intermediate language and then use the normal Go tool chain to compile it into native code, and then execute it? Or is it just an AST interpreter?

<comment><AUTHOR> It takes a given Gisp program and then lexes/parses it into a Gisp AST. Then it translates that Gisp AST into a Go AST [1] and then just prints out [2] the Go program that would generate that specific Go AST.

[1] [http://golang.org/pkg/go/ast/](http://golang.org/pkg/go/ast/) [2] [http://golang.org/pkg/go/printer/](http://golang.org/pkg/go/printer/)

</comment></comment></comment><comment><USER11> Does look like it could use a little more documentation? Am I missing something or is the only list of supported syntax etc the (very limited) examples and the implementation itself? There's no design/goal document listing what's supported or not?

Other than that, this looks like a lot of fun :-)

<comment><AUTHOR> Indeed it was a lot of fun implementing it (author here), and yes it could do with some more documentation, though up to now no one besides me was really concerned about the functionality... :-0

</comment></comment><comment><USER12> Feels like this is the beginning of a trend: Clojure, Hy and now Gisp.

<comment><USER13> Traditionally C was the target language, many Schemes compile to it with great results. Writing a Lisp on top of something else has a very long tradition and certainly is not beginning just now. :)

<comment><USER14> What interests me is can these Lisp implementations facilitate easier translation between languages, e.g. write in Python, Python translated to Hy, Hy translated to Gisp, Gisp translated to Go. Whilst lisp dialects do differ, I'd imagine such links would be easier than a direct Python to Go translator.

<comment><USER15> Kind of - although these are all 'lisps', there's quite a lot of difference between them all. Most of these are keeping with their 'host' language scoping rules, for instance. Also external library calls, etc.

</comment></comment></comment></comment><comment><USER16> Is there a Scheme implementation that compiles to Go?

<comment><USER17> I haven't seen that yet, could be a fun thing to have. I just found an implementation of Tinylisp in go. It would be fun to have all the funky goroutines in a schemish design..

[http://www.oki-osk.jp/esc/golang/lisp.html](http://www.oki- osk.jp/esc/golang/lisp.html)

On another note, there is Chicken Scheme, which compiles to C and produces executable files. Nice stuff!

www.call-cc.org/

</comment></comment><comment><USER18> Oh my god, if someone wrote a bitcoin wallet that protected you chats from the NSA in this List that compiles to GO THIS WOULD BE THE PERFECT HN POST.</comment>


Can Emotional Intelligence Be Taught? - <AUTHOR> http://www.nytimes.com/2013/09/15/magazine/can-emotional-intelligence-be-taught.html?hp&pagewanted=all&_r=0 <comment><USER2> (Despite pulling a quote from the beginning, I did read the whole thing.)

I'm not intrinsically against the idea, but if you're going to teach children this sort of skill, the teachers themselves are going to have to be a bit more brutally honest with themselves about what the children actually deal with, or it really will just be one more feel-good exercise of no value.

        Recollecting himself, Reedhom sat up straight. "Mommy,
        I don't like it when you scream at me," he announced
        firmly.

        "Good," Wade said. "And maybe your mommy will say: 'I'm
        sorry, Reedhom. I had to go somewhere in a hurry, and I
        got a little mad. I'm sorry.' "

Let me tell you what the kid is hearing here, or at least what a lot of the kids are hearing: "If I say 'Mommy, I don't like it when you scream at me' Mommy will just stop screaming and I can get away with whatever it is I may have done to trigger it." Or, Mommy might just as well scream back "DON'T YOU TALK BACK TO ME LIKE THAT." and keep on going; what then? If you're not going to address either of those issues, you're just adding another place to the curriculum where the children will learn to parrot back at you what you want to hear without actually changing anything about their lives. Honestly, we have enough of those.

If this is going to work, the teachers are going to have to step out of the fuzzy-wuzzy bubble of school and address the real world interactions the children might actually experience, and not slant the coverage, so to speak.

<comment><USER3> It is acceptable to teach children "emotional intelligence" and to say that children are poorly behaved and need to be medicated[1] or sent for reprogramming or need behaviour modification plans. For some reason it's not acceptable to suggest that some parents need parenting lessons.

Thus, we teach children to say "Mommy, I don't like it when you scream at me", and we don't teach parents how to deal with children so they don't get to the point of screaming at them so often.

And while that's going on we have children being raped and murdered by their parents. About 5 children per day die in the US because of abuse or neglect. ([http://www.childhelp.org/pages/statistics/](http://www.childhelp.org/pages/statistics/))

([https://www.childwelfare.gov/pubs/factsheets/fatality.cfm](https://www.childwelfare.gov/pubs/factsheets/fatality.cfm))

([http://www.cdc.gov/ViolencePrevention/childmaltreatment/data...](http://www.cdc.gov/ViolencePrevention/childmaltreatment/datasources.html))

([http://www.cdc.gov/violenceprevention/pdf/cm_datasheet2012-a...](http://www.cdc.gov/violenceprevention/pdf/cm_datasheet2012-a.pdf))

> _In 2010, an estimated 1,560 children died from child maltreatment(rate of > 2.1per 100,000 children)_

> _Of the children who died from maltreatment in 2010, 40.8% experienced > multiple maltreatment types, 32.6% experienced neglect only, and 22.9% > experienced physical abuse only._

> _Of child maltreatment fatalities in 2010, 79.4% occurred among children > younger than age 4; 11.1% among 4-7 year olds; 3.6% among 8-11 year-olds; > 3.8% among 12-15 year olds; and 1.8% among 16-17 year-olds_

[1] Obviously some children do need to be medicated. But there's a worrying amount of over-prescribing of strong psychoactive meds among young people without much evidence of efficacy or need.

<comment><USER4> Sometimes, children _need_ to be screamed at. It's good for them.

<comment><USER3> Assuming for the moment that you're correct: How often is acceptable?

How about every day for a child less than a year old?

How about more than four times a day for an eight year old?

How about more screaming than talking for a fourteen your old?

But I reject your statement. Children almost never need to be screamed at, and it is not good for them.

<comment><USER5> You reject his statement but then you say that children "almost never need...", so you accept that sometimes they might need?

I am lost.

Why is screaming almost intrinsically "bad"?

You are trying to quantize behaviour and, sorry, it cannot be done. Would you ask how many times it is good to kiss one's mother? One? Ten? One hundred? Every time the child leaves? Just once? Uhu?

<comment><USER6> Perhaps you've never been _screamed_ at. Where by " _screamed_ at" I mean "the recipient of uncontrolled, unfiltered, absolute maximum strength, irrational, untempered, terrifying rage." I don't believe that's ever appropriate.

</comment></comment></comment></comment></comment></comment><comment><USER7> Emotional control can, most certainly, be taught. But it rarely is in our society.

When I was a kid, I learned from observing my father that being a "real man" means shaping the world according to your view of how it should be-- taking control, avenging wrongs, showing strength. In my 30's and 40's I've been totally reshaping my ideal of what a real man does, and it involves the opposite in many ways: making people feel safe, having excellent self control, and outstanding control of my emotions and attitude. The shocking thing to me is how often the behaviors I know as right according to my new ideals make me behave in ways that my father would see as pathetic and weak.

But it's completely possible to re-train one's own emotional composition and approach to life. That's what Stoicism is all about. I wish someone had taught me about this when I was young. A few things I wish I'd known about when I was a kid:

1\. The No Complaining bracelet challenge[1]. This was life changing to me, because through this exercise I learned that "letting it all out" doesn't really help much, and what really helps is reshaping your own mind. I'm still doing this challenge today, as a life habit, even after several years.

2\. Stop worrying and stop living[2]. You can boil this book down to a few pages, with a lot of stories that help you understand why and how. I did this book on audio during a long car trip. Also life changing for me.

3\. Stoicism. Reading Letters from a Stoic[3] taught me that there was an entirely different way to look at friendship that I'd never considered. And it taught me that there are people who constantly practice controlling their emotions in a positive way, the way a martial artist constantly practices how to move his body.

[1] [http://www.acomplaintfreeworld.org/](http://www.acomplaintfreeworld.org/)

[2] [http://www.amazon.com/How-Stop-Worrying-Start- Living/dp/0671...](http://www.amazon.com/How-Stop-Worrying-Start- Living/dp/0671733354)

[3] [http://www.amazon.com/Letters-Penguin-Classics-Lucius- Annaeu...](http://www.amazon.com/Letters-Penguin-Classics-Lucius- Annaeus/dp/0140442103/)

<comment><USER8> Whenever I'm faced with a decision, I just ask myself what my parents would do, then I do the opposite.

</comment></comment><comment><USER9> Giving children a voice. Being a Heat Start teacher I can tell you that it is EXTREMELY important. Instead of just making sounds or cry when Billy kicked or pushed him the child says, "Stop I don't like that." Changes a person from being a victim to being an advocate for themselves. If everyone could learn how to express their emotions into words we would never have Jerry Springer Show.

Words are better than fists.

<comment><USER10> This - and the article itself - doesn't seem to address the other half of that.

"Stop I don't like that."

"Too bad." Shove.

"Stop I don't like it when you yell at me."

"TOO BAD! NEXT TIME DON'T DO SOMETHING TO DESERVE IT!"

A child can't control teh reaction to advocating for himself. And if he does so and the reaction is negative, he will quickly learn not to do so.

I don't have a solution, but I know that simply teaching this more appropriate method of self-advocacy isn't enough. And depending on the circumstances, it can easily backfire.

<comment><USER11> Any half-decent emotional curriculum will teach that you can't control other people's emotions. (And that there's a lot you can't know for sure about those emotions - which kids are shown as picking up in the article.)

</comment></comment></comment><comment><USER12> See also: [http://en.wikipedia.org/wiki/Emotional_self- regulation](http://en.wikipedia.org/wiki/Emotional_self-regulation)

Prefrontal cortex is still developing through our early twenties. Mitigating the effects of emotional responses takes work, just like any other discipline. That work grows synapses and it's the reason mental health therapies change connectivity patterns in the brain. Leaving the word 'emotion' out (which some here seem to have strong reactions to), self-regulation is well-understood.

<comment><USER13> That's different than Goleman's pseudoscience of Emotional Intelligence, but maybe that's what NYTimes meant?

<comment><USER12> From the article here:

 _It may also make children smarter. Davidson notes that because social- emotional training develops the prefrontal cortex, it can also enhance academically important skills like impulse control, abstract reasoning, long- term planning and working memory. Though it's not clear how significant this effect is, a 2011 meta-analysis found that K-12 students who received social- emotional instruction scored an average of 11 percentile points higher on standardized achievement tests. A similar study found a nearly 20 percent decrease in violent or delinquent behavior._

Goleman isn't mentioned.

<comment><USER14> The big problem is that SATs are a good predictor of grades and not success in life.

</comment></comment></comment></comment><comment><USER15> My startup is indirectly dealing with this - some schools are currently testing out app that helps children (and teachers for that matter) identify and manage emotions.

Early signs are that children can be 'prompted' to apply empathetic reasoning with the right interfaces, and this can be more effective than average teacher-guided instruction.

It's really tricky stuff to get right but there's definitely potential for improvement in this area. There has been (in Australia at least) a focus for the last few decades on teaching the definition of emotions - this is what sadness is, this is what anger is - and hoping that students get enough out of that to learn how to apply it in day to day like. Focusing on context and leaving it open enough for children to work it out for themselves seems to be more effective. Really tricky to actually pull that off in a classroom though.

</comment><comment><USER16> My daughter goes to middle school in Moraga, CA. In the last 6 years since my son was in a nearby school, they've introduced a concept for making it easier for the children to tap into school counseling resources. Kids can visit the school's psychologist by pulling out a "Felt" card and giving it to the teacher. It serves as an emotional opt-out for whatever happens to be causing stress at the time and allowing the child to go talk about it to someone who has the skills and time to listen.

I asked her, "I wonder how many of those get used during dodgeball tournaments?".

</comment><comment><USER17> A complicated answer to a not focused enough question about a TL;DR Article. The social skills like how to say you dissatisfied by someone's action or reaction is. But is that intelligence ? Affect regulation is closer in my view to emotional intelligence and can be acquiered to some extent but is more akin to language - the earlier the better. And the traits are very dependent on attachment patterns - relationship with caregiver.

</comment><comment><USER18> "In the years since, a number of studies have supported this view. So-called noncognitive skills — attributes like self-restraint, persistence and self- awareness — might actually be better predictors of a person's life trajectory than standard academic measures."

Only after practicing did I achieved some success in the above abilities, late in my 20s, and it has a huge impact on general well being, career trajectory etc.

</comment><comment><USER13> Can emotional intelligence be proven to exist?

<comment><USER19> Can cognitive intelligence be proved to exist?

The thing that we call IQ (or g) is a set of cognitive abilities in pattern recognition, problem solving, puzzles, symbol manipulation, and so forth. Insofar as "something" is measured by these kinds of tests, then IQ/g can be said to exist.

Similarly, the set of traits and behaviors collected under the umbrella of "emotional intelligence" are a grab bag of self-regulation, resilience, emotional self-control, insight into one's own mind, ability to form a working model of the emotions of others, ability to "read" the emotions of others, and so forth. These are less well defined than the abilities grouped under IQ/g but insofar as they could be measured through well-designed tests, then emotional intelligence can be said to exist.

Alternatively, there could be a functional or "effectiveness based" definition of emotional intelligence, even if it were less quantitative than IQ/g.

</comment></comment><comment><USER20> I can answer this question without reading the article: Yes. And it has to be, for most people. Except some people, who are incapable of it for physiological reasons. And there are some people who are so naturally charming and can read what others want that (but on a superficial level) that they become pyschopaths.

<comment><USER21> > And there are some people who are so naturally charming and can read what > others want that (but on a superficial level) that they become pyschopaths.

That's not the definition of psychopathic trait (or disorder, or anti-social behavior) though. What characterizes it is diminished empathy and remorse, so in fact, it's a _lack_ of emotional intelligence.

The point is that if you're free from remorse but still have a working mental model of other's emotions (like most humans), you can better manipulate other's intentions without guilty or other thoughts influencing your decisions.

We all fall somewhere inside an empathy spectrum, only the ones that fall at one extreme are characterized as bearer of psychopathic disorder, while the functional ones live normal (or almost normal) lives. There's a big chance you work for one actually, these people tend to be successful in leadership positions.

<comment><USER20> well, if they're charming, they clearly have some level of emotional intelligence that far supercedes what most of us have. Saying that they lack emotional intelligence is like categorically saying that you "lack scientific intelligence" because even though you are smashing at physics - because you couldn't find your way a periodic table.

</comment></comment></comment><comment><USER22> Intuitively it would seem that if the desire is there, it can be taught. If someone doesn't want to learn, they won't. But if someone has an open mind, they can learn. There are many socially awkward people who bloom in college, or in leadership roles.

<comment><USER23> Open mind isn't enough. There are no clear unequivocal paths to improve social skills.

I suspect that lack of situational awareness and lack of concentration power/endurance is at the heart of most of these problems.

Knowing what to do isn't enough, you need to do it. But improving awareness and endurance of your awareness is only possible through months or years of training, especially meditation and trying to find more awareness in social situations.

</comment></comment><comment><USER24> I went through the book "The whole brain child" with my five yr old daughter recently. She absolutely lapped it up. I highly recommend it and the authors other books if you want to explore your children's (or your own) emotional landscape.

</comment><comment><USER25> an interesting bbc post here by director adam curtis: [http://www.bbc.co.uk/blogs/adamcurtis/posts/the_curse_of_tin...](http://www.bbc.co.uk/blogs/adamcurtis/posts/the_curse_of_tina_part_two)

all about how a lot of the need for emotional expression was invented at the esalean institute in the 60's and is also a type of conformity.

</comment><comment><USER26> How can you teach something that's total bullshit.

<comment><USER27> Hi there, where did you receive your advanced degree in psychology, education and/or psychiatry?

Please leave your pedantic quips on reddit.

<comment><USER26> _" [Goleman] exemplifies more clearly than most the fundamental absurdity of the tendency to class almost any type of behaviour as an 'intelligence'... If these five 'abilities' define 'emotional intelligence', we would expect some evidence that they are highly correlated; Goleman admits that they might be quite uncorrelated, and in any case if we cannot measure them, how do we know they are related? So the whole theory is built on quicksand: there is no sound scientific basis."_[1]

1\. [https://en.wikipedia.org/wiki/Emotional_intelligence#Cannot_...](https://en.wikipedia.org/wiki/Emotional_intelligence#Cannot_be_recognized_as_form_of_intelligence)

<comment><USER27> So it's a pedantic argument over the usage of the word intelligence. Sort of like your original quip, no?

Locke suggests the use of the word skill instead; however the definition of intelligence is the ability to apply knowledge and skills.

Given that the NICHD is pushing for consensus, and that I am not (and neither are you, given your non-primary source) qualified to determine the status of EI, let's not dismiss it outright.

How about contributing meaningfully to the discussion instead of alternating between trolling and non-authorative copypasta?

<comment><USER26> I'll dismiss anything outright that is being used by moronic business-school twits that are using EI as a way to bolster their non-skills and nonsense MBA programs.

</comment></comment></comment></comment></comment><comment><USER28> Another example of the government trying to be the parent here. How sad that the "nanny" feels that it must get it's hands on kids so early by nurturing them against those evil parents.

The government has largely supported things that have torn the family apart, now as the "nanny" it is trying to pick up all the pieces and completely replace (little by little) what is left of it.

Why? well two reasons... 1\. To maintain and gain ever larger amounts of power and control (which requires taking more and more freedom, privacy and choices away from the people). 2\. To rid the world of God and religion (which is necessary for number one to even be a possibility).

The government must weaken the people and make them dependent on it. Best way to accomplish this is to destroy what creates strong communities. Family and faith.

</comment><comment><USER29> Belief systems matter more than emotional intelligence. For example, if you live in the Incan empire and everyone believes you're a god, it doesn't matter what your emotional intelligence is.

</comment><comment><USER30> Sure. Nature beats it into people all the time. Some people just need more time for nature to act on them than others.

</comment><comment><USER31> If emotional intelligence can be taught (which it can't, because the concept is as bogus as those Baby Einstein videos that used to be so popular, but never mind), then smart people will be the ones to master it. Why? Because smart people are good at learning stuff.

<comment><USER32> Do you have any data that people who are smart (at learning math and computers - I assume that's what you mean) are also good at learning to deal with people, particularly non-math people?

If anything, I have observed a negative correlation. And I know some pretty f __*ing smart people.

<comment><USER31> You shouldn't reply to comments that you haven't read.</comment></comment></comment>


Live stream of SpaceX Boca Chica complex construction [video] - <AUTHOR> https://www.youtube.com/watch?v=-aDOpyUmfL4 <comment><USER2> Mind boggling. You can see the waviness in the thin stainless steel. Can it really stand up to re-entry? I guess it is more like a balloon that stiffens with internal pressure. I haven't followed the project very closely.</comment>


Web app ideas - <AUTHOR> http://lkozma.net/blog/quick-web-app-ideas/

<comment><USER2> While I'm not interested in pursuing any of those I appreciate thinkers out there that push their ideas live.

Would up vote this 5 times over some bit coin lulsecz space station news... Keep em coming!

<comment><USER3> Agreed. Only one of these ideas has financial potential, and even then it's not an easy market to tap for that particular service.

Still, it's nice to see some idea flow as it always gets the juices flowing.

</comment></comment><comment><USER4> 1\. Nice idea, maybe I should built this into "I Write Like" (BTW, it still works: <http://iwl.me>) ;-)

<comment><USER5> I remember it going viral! Curious to find out how it's doing now in terms of traffic.

<comment><USER4> Now it's down to about 1500 to 4000 visitors per day. As you can see here: <http://i.imgur.com/V5xMr.png> the viral effect lasted for about a month.

<comment><USER6> Nice to see that people are still visting it! Is most of the traffic direct or from search engines?

</comment></comment></comment></comment><comment><USER5> About the idea 4 (World map live postcard). I made something similar here: <http://iambored.wreally.com/>

It's a real time map showing who is currently viewing that page (you need HTML5 geolocation api). However it never took off because for it to be fun you need to get a bunch of people on it at the same time.

<comment><USER7> May I suggest the view starts out with the entire globe? It zoomed in for me, and had to intuitively know to press the + key to zoom out where I saw a couple of others. If you had clearer zoom controls and a more visible icon for each user it would be more interesting. Posting something like this to google+ right now could generate a huge number of people checking it out.

<comment><USER5> Thanks for your suggestion! There is a snag in Google maps which causes grey areas to start appearing outside the boundaries of the world map (on top and bottom). Which kinda sucks because it makes the map look ugly. That's why I had to set it in this zoom size. But what you said completely makes sense. I am going to go ahead and change it to a lower zoom.

</comment></comment></comment><comment><USER8> Does anybody know if there's already something like the world map radio? Can't find anything on google.

<comment><USER9> <http://radiomap.eu>

</comment></comment><comment><USER10> The world map in realtime is interesting. The iphone app Beluga does this (they got bought by FB) sorta, but in reverse. They focus on the chat, and have the ability to see a map of where everyone is located.

It's pretty slick.

</comment><comment><USER11> About Idea 2, Streema (<http://streema.com/radios>) offers a curated set of stations from around the world although not plotted on a map.

</comment><comment><USER12> Thought #6 was neat and I was bored so I created <http://www.namestofaces.com></comment>