Why Did Google Decide to Split Inbox from Gmail? - <AUTHOR> http://techcrunch.com/2014/11/16/why-did-google-decide-to-split-inbox-from-gmail/ <comment><USER2> The problem with this "You are not the user" criticism is it misses the point, which is that the users that totally rely on your product are the ones living with the edge cases. Most of the other users could just switch elsewhere and it's not going to bother them one iota. This is why MS Office has held on to the market so strongly, as seemingly every finance department is reliant on a different obscure feature that isn't replicated in alternatives.

This has been happening over at Apple too, where the power user experience has deteriorated dramatically now that they've decided that lot are all stuck in the ecosystem already. It's a dangerous game, and it's what caused MS to get unstuck as Linux rose up. Right now you'd be hard pressed to consider OS X, Windows, Android, Chrome OS or iOS as headed in directions power users (or content creators) want or need. This will lead to a division like in the early 90s again, where to do serious work you need a "workstation" which will be quite different to a normal machine.

<comment><USER3> Could you give examples for such developments on OSX? I'd consider myself a power user, but the issues I have with OSX are not related to features, rather to its stability and complexity (resulting in more bugs). I liked it best back at version 10.4, but today we have way more features, lots of them directed at power users.

<comment><USER4> When releasing iWork 2013, Apple ditched all AppleScript bindings[1]. In later updates, the bindings returned[2], but it still caused uncertainty about the future for users with AppleScript workflows.

Something similar happened when they released Final Cut Pro X[3], also fixed in later updates. But again: uncertainty, and many users prematurely switching to alternatives (like Adobe Premiere).

[1] [http://www.macworld.com/article/2058705/the-state-of- applesc...](http://www.macworld.com/article/2058705/the-state-of-applescript- lets-not-panic-yet.html)

[2] [http://www.macworld.com/article/2090831/applescript- makes-a-...](http://www.macworld.com/article/2090831/applescript-makes-a- comeback-in-numbers.html)

[3] [http://en.wikipedia.org/wiki/Final_Cut_Pro_X#Reception](http://en.wikipedia.org/wiki/Final_Cut_Pro_X#Reception)

<comment><USER3> Yes, the new iWorks (if it can still be called that) is clearly a step back - no new features and a dummed down UI. I don't consider it part of the OS though.

</comment></comment></comment></comment><comment><USER5> "All of the decisions revolved around the central fact that a typical Gmail user was receiving only about five emails per day, most of which were of promotional nature, and as such, required no response."

So, they designed Gmail around people who don't use email? That explains a lot.

<comment><USER6> That sentence in context applies to Inbox, not Gmail.

Edit: Not sure why downvoted. I'm not being sarcastic, please read the article, it's right there.

<comment><USER7> I genuinely can't tell whether the article is suggesting that Inbox is for advanced users or for non-advanced users (and GMail for whatever the other user is). I believe, based on my own understanding of the two products, that GMail will continue to exist for advanced users, and Inbox will be simplified. But, the article is not at all clear on that; the last sentence seems to flip the meaning of the rest of the article and indicate that Inbox is the "advanced" one, while GMail will be made more simple. Or something.

Author can't English good.

<comment><USER8> Inbox is created for high-volume users.

The backlash was because GMail was being used by high-volume users who struggled with the new, simplified version.

<comment><USER9> It seems to me the other way around. I am a high volume user and I have relied on Gmail for almost 10 years. I signed up for inbox (because I am always looking for something better). I found it slowed me down. It was pretty but superficial. I prefer the plain but functional Gmail. Just one data point, I realize.

</comment></comment></comment></comment></comment><comment><USER10> I'm not at liberty to give details and I know very few of them after early 2012, but this doesn't seem accurate to me. The original design of Inbox was the work of Michael Leggett ([https://www.linkedin.com/in/leggett](https://www.linkedin.com/in/leggett)) and while the project has always targeted the power user, its evolution was not so straight-forward as this article suggests.

<comment><USER11> The article seems correct to me. But I cannot provide more details either

</comment></comment><comment><USER12> So.. is Inbox the "advanced" product designed for users with a firehose of email, or the stripped-down version designed for everyday users? It seems to have elements of both. Snooze is a great feature for people practicing Inbox- zero (which anyone getting hundreds of emails a day and remaining sane likely is doing). The increased automation of filters, and the addition of bundles in the inbox all help.

On the other hand, the reduced compose window size, the removal of read message counts within labels, the inability to nest labels, the inability to specify advanced filters, and more, make Inbox (at least without occasional use of gmail) inappropriate for power users.

This article (at least the final paragraph) seems to suggest that Inbox is the power app designed for email-firehose users, but in its current implementation it appears more useful for the everyday user who wouldn't bother to manually set up filters for recurring emails (and could instead just use the new "sweep" feature).

Anyway, I very much hope they continue to develop both products, and continue to support their inter-operation, as well as porting features between them. (Snooze in gmail-proper would be great, for instance. Advanced filters in Inbox aren't really necessary, since they can be managed from gmail. Read message counts and a decent compose window are, though.)

As long as both products maintain a decent user base, perhaps this best case scenario will play out. On the other hand, if a feature-poor (but sufficient for most users) Inbox gains the majority of the market share, I could see gmail going the way of Reader, which would obviously be a shame.

<comment><USER13> The one that generates the most semantic, ad-useful data will survive.

</comment></comment><comment><USER14> > This was in contrast to a typical Googler who received an average of about > 450 emails per day, many of which were important to at least read, with a > good chunk of them requiring a reply

That's ... quite a lot. The fact that the company manages to produce so much IT products with such big overhead on the engineers is amazing.

<comment><USER8> Proper communication in an engineering company is never an overhead.

<comment><USER15> If we assume an average time spent dealing with each email of 15 seconds, that adds up to around 2 hours per day. If most emails require replies, then average time/email will be much greater than 15 seconds.

That looks like overhead to me.

<comment><USER8> It's not overhead.

Large scale engineering optimizes the _teams_ output, not that of individual contributors.

A key component of team output is communication.

Email is a key communication mechanism, especially within Google where (to a large extent) their development workflow is built around it.

<comment><USER15> Okay. But I don't believe that hundreds of emails per day is necessary. There's a low signal/noise ratio and the noise is overhead.

<comment><USER8> _There 's a low signal/noise ratio and the noise is overhead._

And that's exactly the situation people customised Gmail to do (using filters etc), and what Inbox is designed to do from the start.

The problem is that "noise" is very, very context sensitive. 30 messages of commit-spam, 10 comments on a bug and a 60 message long thread in an internal mailing list suddenly become very, very relevant when that bug lands on your desk.

</comment></comment></comment></comment></comment></comment><comment><USER16> What bugs me about "you are not the user" is the implied corollary: You engineers do not understand the user, but we designers do.

I've seen designers take too many decent usable designs and make them worse, for no apparent reason other than chasing the latest design trend. The latest Android Gmail app is a case in point. Its changes include:

* Garish distracting colors where the old one used muted colors that were easy on the eye.

* Thin spindly gray text for read messages in list view, where the old version used much more readable thicker dark text.

* When you pull a list view down to refresh it, a spinning circle appears that _covers up_ part of the topmost message in the list. The old version used an unobtrusive thin animated bar at the top of the list.

Or take the general OVERUSE OF UPPERCASE in modern design, such as the UPPERCASE MENUS in Microsoft Office and Visual Studio. When developers overwhelmingly complained that they hated the uppercase menus in comments on the Visual Studio blog, Microsoft circled the wagons around uppercase:

[http://blogs.msdn.com/b/visualstudio/archive/2012/06/05/a-de...](http://blogs.msdn.com/b/visualstudio/archive/2012/06/05/a-design- with-all-caps.aspx)

Ironically, this was a clear situation where the designers were _not_ the user, and didn't understand what the user really wanted, but the designers ruled the show nonetheless.

The funny part is that the complaints from developers weren't just based on aesthetics. Most of us work in case-sensitive languages most of the time. And in all of those languages, File and FILE are not the same thing! The uppercase menus aren't just ugly, they cause a speed bump for anyone who has trained themselves to look for accidental case mismatches.

Developers may not be "the user" in most cases, but I don't think designers are either.

Not that I can claim to be any kind of visual designer myself! But I do have a good sense of usability and I know bad design when I see it. I value the times when I've worked with good designers who know that not all their ideas will be right and listen to feedback about them.

It's harder to work with designers who think they always know best or that their user tests and focus groups always tell the whole story, and don't want to listen to developers - their job is just to _implement_ the designs. These designers get support from management who doesn't have a clue about design. Management _knows_ that the designers must be right because after all, they are the professional designers and they have all these impressive studies to cite. What could a mere _coder_ know about design?

It's a crazy situation, but I've been in the midst of it too many times.

The weirdest part is when companies who claim to do "agile" development are really following a waterfall model:

1\. The designers build the design.

2\. The design is approved.

3\. The developers implement the design.

The designers don't even need to know what's feasible to implement! They don't work in the same tools as developers. They use Photoshop and various kinds of movie makers to make beautiful animated demos - with no idea of what can and can't be done in the actual operating environment where the code will run.

So they spec out things that just ain't gonna happen - and if they do happen it's a huge development effort and only after that do you find out that the animations are janky and can't be fixed and it ruins the whole experience.

Or you do get it done and it works well after a major effort - but you've lost development time that could have gone into features your customers actually want.

And all the SCRUM meetings your dev team holds won't fix the problem that the Big Up Front Design was broken from the start.

How agile is that?

<comment><USER17> _Garish distracting colors where the old one used muted colors that were easy on the eye._

The new Google calendar app pushed to Android within the last few weeks is a perfect example of this. In the old one, I could easily pick out dates and items. In the new one, the colors overwhelm everything and I literally have to consciously focus my mind to "see" the data they are presenting. It's a complete FAIL, IMO. I wish there was an option to opt out of the material design version.

<comment><USER18> I did the same - uninstalled it. For the most part I like Material Design, but on a Nexus 5 the new calendar app is woefully bad, and the reviews piling into the Play store tell that story - in the last week overwhelmingly 19k negative reviews, ouch.

[https://play.google.com/store/apps/details?id=com.google.and...](https://play.google.com/store/apps/details?id=com.google.android.calendar)

</comment></comment></comment><comment><USER19> I think more than just a product decision, this seems to be a more strategic decision. Inbox is great for consumers, for your personal email. But for power email users, there's very little, which is perhaps why they haven't even opened it up to Google Apps users.

There's an underlying trend, while consumer mobile apps have been embracing more and more unbundling, the good business mobile apps out there are actually bundling more and more. Inbox replaced Mailbox for my personal email.

But for work, once I moved to Acompli [https://itunes.apple.com/us/app/acompli- email/id829384901?mt...](https://itunes.apple.com/us/app/acompli- email/id829384901?mt=8), there was no turning back.

Acompli leaves a lot to be desired in terms of design, but I really don't care because it has seamless multi platform file integration and integrated scheduling features, stuff that I don't need for my personal email. But mailbox and now inbox is great for my personal email, because it focuses on stuff I really care about: quick replies, adding simple tasks and most importantly snoozing emails that I don't need to reply to rightaway.

<comment><USER20> "Inbox is great for consumers..."

That was the main point I took away from looking at the Inbox website. The top three categories it uses are promotions, purchases, and trips. It's an inbox for someone who's a consumer - literally. Looks like it's not a communication tool so much as method of more easily getting people to buy things.

</comment></comment><comment><USER21> The reason why I love GUI builders is because they allow me to focus on the design part and not on the code. My personal philosophy is that designing a GUI should only be done in a wysiwyg interface. If you create a GUI using code alone, there is a certain disconnection with the design which can lead to poor interfaces especially if you are on a tight deadline and is trying to keep the UI as simple as possible. My belief is that code should be strictly used for business logic only and everything else should be left to the compiler and IDE. Many fail to understand my preference for using VB for scripting purposes instead of a "nicer" language such as Python or Ruby. To me the GUI builder is one of the most important tools, many developers fail to understand that most end-users would rather click on a menu than type in the commandline even though sometimes it may be faster. What we should be doing now is making more powerful IDEs so that the GUI builder abstractions are less leaky.

</comment><comment><USER22> I love how the article starts off by telling us that the author "climbed to Everest base camp," as if that has any relevance whatsoever to the topic at hand.

<comment><USER23> ...?

He's guest authoring a post on TechCrunch - they probably asked him for a bio so he gave them a unique anecdote, an impressive one at that.

</comment></comment><comment><USER24> I imagine most who care have already found an invite, but just in case, I'll offer. I've got 10, pm with an email address to invite if you'd like one.

</comment><comment><USER25> Very confusing wording.

In the last paragraph, the author is (with poor wording) saying that Inbox, "the new Gmail", would be the new simplified "Email for people who only Get GAP ads and notes from grandkids", and there would be _another_ new Gmail for power users who like the old Gmail.

<comment><USER26> No the article implies that inbox is the streamlined, low featured version of gmail that got everybody angry and then finally ends up telling us that it is in fact inbox that is the power user version of gmail and normal gmail is the simple version.

</comment></comment><comment><USER27> In fewer words, Inbox started as a UX redesign, was met with so much resistance that the team lead had to write a "You are not the target user" post internally, and to salvage the sunk costs, they released it as a separate interface.

Personally, I hope that Inbox gets some of those currently missing features added back in, starting with support for Google Apps accounts. The ability to snooze emails is too powerful (followup.cc turned it into a business model) to allow it to get thrown into the Google Labs graveyard.

<comment><USER28> I didn't think I would, but I love Inbox. I really want it for my work Google Apps account. Snoozing stuff is a killer feature. Wiping entire lists is a killer feature.

I get maybe 5 marketing emails a day, and a few actionable emails a week in my personal email. I get about 10 actionable emails a day in my work account, and about 200 emails that could just be wiped. I'd get so much more value out of Inbox for Apps.

<comment><USER4> You could use Priority Inbox, which you can train by using Important markers on actionable/otherwise useful email. With the Gmail app on Android/iOS you can even get (push) notifications for just these important messages.

But sure, I'd love to see Inbox for Apps as well, because my personal mail account uses Apps on my own domain.

</comment></comment></comment><comment><USER29> What does the OP mean when it refers to Inbox as "standalone"?

Surely, it runs in a web brower; does it not?

<comment><USER30> He means separate from Gmail.

</comment></comment><comment><USER31> Designers don't understand the user...

Just look at the new Google Calendar app :-S, it's WAY to busy...

</comment><comment><USER32> "typical Googler who received an average of about 450 emails per day" ick

</comment><comment><USER33> the most obvious answer to this question-even after reading the article-is that this is just a continuation of what's always made google wildly successful: inserting itself between open architectures and your personal data

that's not meant as a criticism per se, but it's the core of their business model: serving jquery for free in exchange for tracking your users persistently via Google Analytics, building a browser to slowly but surely make it harder to opt out of Google's SSL-based tracking.

like all of its successful products, Inbox aims to create value for users while subtly moving more of your activities to a level of abstraction that Google controls and/or monitors.

<comment><USER34> > _serving jquery for free in exchange for tracking your users persistently > via Google Analytics_

jQuery on their CDN has nothing to do with Google Analytics, and it's served without a cookie and with long cache expire times, so it's not a very good tracking target.

> _building a browser to slowly but surely make it harder to opt out of Google > 's SSL-based tracking_

I have no idea what you're referring to here, but it doesn't sound like it makes much sense.

<comment><USER33> > jQuery on their CDN has nothing to do with Google Analytics

most production servers i encounter that serve google's copies of jQuery also serve GA. i know this because i have to manually allow those requests using RequestPolicy. yes, they're technically different products. but that wasn't my point.

> I have no idea what you're referring to here

check out: [https://sites.google.com/a/chromium.org/dev/Home/chromium- se...](https://sites.google.com/a/chromium.org/dev/Home/chromium- security/client-identification-mechanisms#TOC-Lower-level-protocol- identifiers)

<comment><USER34> > _most production servers i encounter that serve google 's copies of jQuery > also serve GA. i know this because i have to manually allow those requests > using RequestPolicy. yes, they're technically different products. but that > wasn't my point._

so...when you said "in exchange for" you meant that some sites also use Google Analytics?

> _check out:[https://sites.google.com/a/chromium.org/dev/Home/chromium- > se...](https://sites.google.com/a/chromium.org/dev/Home/chromium- > security/client-identification-mechanisms#TOC-Lower-level-protocol- > identifiers) _

That's not a page of "Google's SSL-based tracking" methods. That's an attempt to enumerate ways browsers leak information.

</comment></comment></comment></comment><comment><USER35> _A typical Gmail user was receiving only about five emails per day, most of which were of promotional nature, and as such, required no response._

Wasn't the whole point of Gmail supposed to be better spam filtering?

<comment><USER4> "promotional nature" doesn't mean spam; it's things like company newsletters that people did subscribe to and generally do want to read or skim.

<comment><USER36> I still maintain that just because someone subscribed to it, doesn't make it not spam anymore. I've even found myself on a few mailing lists for not being super diligent in unchecking when I signed up for something. I can only imagine the so called "average" user.

<comment><USER37> What are you suggesting?

<comment><USER36> Basically that the entire point of something like Inbox seems to be to sift out what you want. We just don't go so far as to call stuff that you actually signed up for spam. We do want it to be easily ingored, though. And, at the end of the day, I'm not sure what the difference between my spam folder and my trash folder is. Add in my various "dumb subscription" folders, and they are basically the same.</comment></comment></comment></comment></comment>


How Crazy Is Elon Musk's Hypersonic Space Rocket Airline? - <AUTHOR> https://www.bloomberg.com/news/articles/2017-09-29/how-crazy-is-elon-musk-s-hypersonic-space-rocket-airline <comment><USER2> I know it is sacrilege to look askance at Elon Musk. And I know that he has an apparently real business enterprise or two that are running right now.

But I'm struck by the constant barrage of PR for some new massive scheme completely unrelated to his mundane businesses — none of which are quite self- sustaining at this point.

Pumping stock prices with press releases. Where have I seen this before?

Is the only difference between Elon Musk and OTC stock promoters the scale at which they operate?

Note: I admire Mr. Musk and hope he wins. But I am a bit put off between the disconnect between reality (turning Tesla into a high volume automobile manufacturer, for instance, generating its own free cash flow) and the hype machine.

</comment><comment><AUTHOR> I must agree with you both, he is the master manipulator with over the top promises and bunch of losing businesses, the modern wolf of wall street...

</comment><comment><USER3> Dumb idea. Great idea however, for anyone wanting to hide an ICBM on an airline though. I'm sure North Korea would endorse the idea.</comment>


CIA pulled officers from Beijing after breach of federal personnel records - <AUTHOR> https://www.washingtonpost.com/world/national-security/cia-pulled-officers-from-beijing-after-breach-of-federal-personnel-records/2015/09/29/1f78943c-66d1-11e5-9ef3-fde182507eac_story.html <comment><USER2> When Chelsea Manning leaked the documents, noone was put in danger.

When Snowden leaked the documents, no one was endangered.

This breach, and lots of people are endangered.

But are you getting calls for criminal investigation? Are heads rolling (other than the head of OPM, who was hated anyways)?

<comment><USER3> Isn't that what this article is about? We are pretty certain that this was an act of espionage by another nation state. Criminal investigations are not how you respond in those cases (unless we found the agent on our soil, which AFAIK we did not).

What is curious is that we aren't sure what the norms are for how to respond to cyber espionage, unlike with in person espionage which had a whole set of responses we could fall back on.

<comment><USER4> Criminal negligence?

Certainly, negligence that should incur public disgrace.

Also arguably demonstrating one of the points made by the whistleblowers: You can't trust the government to properly manage all the information they collecting.

<comment> irq-1 This isn't negligence. Instead of trying to protect data and networks the US government has made "cyber crime" a military issue. They've been doing it deliberately and publicly, for over a decade. Domestically they followed the same plan: companies get protection (financial, legal, image,) discouraging them from taking security seriously, and individuals get the CFAA which has a similar effect. They want data and network security to be a military problem, not to encourage security.

We can't blame the OPM for the security issues. They were a victim of a bad national strategy.

If you "see something, say something" unless its about cyber security.

<comment><USER4> Purposeful negligence?

It should be prosecuted, in the court of public opinion if no one will bring it to a judicial court.

</comment></comment></comment></comment></comment><comment><USER5>
      "We, too, practice cyberespionage and . . . we're not bad at it"
      - James Clapper

Ironic, for the intelligence leader of a country that had their defensive systems completely penetrated (with the federal personnel records), and their offensive systems fully outed in the most humiliating way possible (by Snowden)

It seems to me that yeah... you kind _are_ bad at it.

At the very least, a little less self-certainty might be in order.

<comment><USER6> For what it's worth, the CIA is the only federal agency that keeps their own employee records. Everyone else goes through OPM. They (rightfully) assumed that OPM couldn't keep secrets and that's where we find ourselves today. It's probable that these records are printed, locked in a vault.

James Clapper, the DNI, heads 16 intelligence agencies under him, one of which (CIA) didn't have their records stolen. Though the budget breakdowns are not disclosed, arguably, they are the largest of the bunch and only ones that have deployed field operatives.

<comment><USER7> this is exactly the problem. The CIA did not get hacked it was OPM and no CIA records were stolen. But by simple process of elimination china could look at all the embassy staff in beijing and find out who is not in the OPM records, since the CIA is the only one not keeping personel files with OPM anyone working at the beijing embassy and not in the OPM records must be a CIA agent

</comment></comment></comment><comment><USER8> As some previous articles have already mentioned, they probably already knew who they were anyways. Only their offices have special locks. They don't mingle with anyone else at the embassy but their own. They also don't have same 3-4 year requirement of staying at the embassy so they leave early; and when their replacements arrive, they take over the same offices.

<comment><USER9> I believe you're talking about [https://news.ycombinator.com/item?id=10291691](https://news.ycombinator.com/item?id=10291691)

</comment></comment><comment><USER10> I like the idea that CIA officers are directly identifiable by their absence from the database. It reminds me of submarines and sonars. I understand that modern submarines are pretty good at diverting sonar waves so that they have a small footprint. However when a fishing boat passes over a submarine while scanning the ocean floor looking for fish, the submarine becomes immediately visible as a dark shape of sonar waves not returning from the ocean floor.

<comment><USER11> That smells fishy, as it would be something exploited immediately by any anti- submarine vessel.

<comment><USER12> Anti-submarine vessels have to do one thing really well to have any chances; be quiet. Fishing vessels can happily plough the ocean wave pinging to their heart's content. An anti-submarine vessel that did that quickly becomes a target, or if the submarine is feeling generous, something to go around - thanks for telling us where you are.

There's a time and a place for active sonar in finding and killing submarines, but it's not from your anti-submarine ship, all day every day.

<comment><USER13> Then part of your navy is hacked fishing boat sonar kits and an uplink to the anti-submarine vessel. :)

<comment><USER14> Which, if the word of it ever got out, would paint fishing boats as a valid target in combat operations.

<comment><USER12> On an interesting related note, during the recent Russian occupation of parts of Ukraine, a helpful app was created and released by "Russia" [1] that would allow pro-Russian civilians in the region to act as reconnaissance for the Russian and pro-Russian forces. Very simple; if you see some Ukrainian military, push the matching picture on the app. Your location and chosen picture are uploaded, and whoever is sitting at the other end sees all the results.

Bingo; you've turned the civil population into military reconnaissance. Are they now a valid target? They certainly don't seem to be just plain civilians anymore, but they're not lawful combatants either.

As it turned out, I am led to believe that the app wasn't a great success, but it's still a disturbing trend.

[1] I say "Russia" because I can't dig out more detail right now. Obviously company X working with agency Y or some other such.

</comment></comment></comment></comment></comment></comment><comment><USER15> Another vindication of Ishamel Jones' position on the stupidity of relying upon State Dept covers for CIA personnel. For a hilarious and unparalleled informative look at the Agency:

[http://www.amazon.com/The-Human-Factor-Dysfunctional- Intelli...](http://www.amazon.com/The-Human-Factor-Dysfunctional- Intelligence/dp/159403382X)

</comment><comment><USER16> This OPM breach is an unmitigated disaster. What were they thinking, storing sensitive biometric information like fingerprints in an easily hacked database[1]?

One can envision a time in the very near future (if not already), when a random foreigner is stopped on the streets of Beijing and asked to press his finger to a reader attached to an Android phone. The device would then display his picture, official position, address, salary, clearance level, etc. Or else, just walk into the restaurant he just left and take the fingerprint off a used glass.

If he's there in some intelligence gathering capacity, the Chinese could then have him followed, or send him packing, or maybe even detain him for a day as a form of harassment, knowing that the U.S. government is powerless to do anything about it. They have us over a barrel.

[1][http://blogs.scientificamerican.com/observations/what- could-...](http://blogs.scientificamerican.com/observations/what-could- criminals-do-with-5-6-million-fingerprint-files/)

</comment><comment><USER17> I don't know why these hacking incidents are not considered acts of war.

<comment><USER14> Be thankful for that. Cyberattacks are so hard to trace back that it's very easy to set up a false-flag operation. Framing someone else for your attack would become a simple way of starting a war between two of your opponents.</comment></comment>


US Military Warning to Communication Satellite Pirates on 260.625 MHz (2012) - <AUTHOR> https://www.solarix.net/us-military-warning-to-pirates-on-260-625/ <comment><AUTHOR> Background: A lot of older U.S Navy communication satellites used linear transponders, that are essentially general-purpose repeaters that can relay a wide range of modulation, and some could be used without any authentication. Accessing them is not difficult. VHF is accessible using modified amateur radio equipment, and UHF comsats are accessible using a simple upconverting mixer. As long as one knows the frequencies and locations of these satellites, one could scan the spectrum to identify its uplink and downlink frequency, and use them as their personal CB radios.

Brazilians pirates has been doing it since the 80s, and today pirates around the world are still doing it. And there's nothing the U.S. military can do to stop them except for calling their local communication regulatory agencies to raid a few pirates...

[https://news.ycombinator.com/item?id=570233](https://news.ycombinator.com/item?id=570233)

</comment><comment><USER2> Make Love not war</comment>


Ask HN: Debian 8 or Ubuntu? - <AUTHOR>

I am going to update one of my servers (linux, apache, mysql, php) in the comming months. Should I use Debian 8 (it will come out this year, right?) or some flavour of Ubuntu?<p>My main goal is: A server that just works and gets security updates. For as long as possible. <comment><USER2> Security updates should be available as readily for Debian.

I think you should use whichever you're most familiar with and most comfortable using.

</comment><comment><USER3> Debian. Because less 'WTF!?'-stuff.

<comment><USER4> What is the 'WTF-stuff' in Ubuntu? What's wrong with it?

<comment><USER3> Let's start with invasion of your privacy; from gnu.org [1]: "As of October 2012, Ubuntu sends personal data about users' searches [2] to a server belonging to Canonical, which sends back ads to buy things from Amazon."

More at [3].

I don't know if this problem persists, but it's enough for me to choose a distro that never did something like this to begin with.

[1] [http://www.gnu.org/distros/common- distros.html](http://www.gnu.org/distros/common-distros.html)

[2] [http://www.omgubuntu.co.uk/2012/10/does-ubuntus-amazon- lens-...](http://www.omgubuntu.co.uk/2012/10/does-ubuntus-amazon-lens-break- eu-law)

[3] [https://www.gnu.org/philosophy/ubuntu- spyware.html](https://www.gnu.org/philosophy/ubuntu-spyware.html)

<comment><USER4> OK. That's all about privacy, right?

The good thing of Ubuntu is it's more stable than the other ones I used (Puppy, openSUSE,...), the last time I tried, Ubuntu booted ok with my Pentium 3, 128MB RAM, Intel onboard GPU.

The Ubuntu 8.x to 9.x sucks, but for 10.x and upper, it's cool again, at least, that's a good choice for Linux beginner :D

</comment></comment></comment></comment><comment><USER5> Debian - they test their packages properly and make sensible decisions (most of the time).</comment>


Python Style Guide from Google - <AUTHOR> https://google.github.io/styleguide/pyguide.html <comment><USER2> One thing I find odd is to prohibit classes / functions from being imported, instead forcing to always write their module names for the fear of namespace collisions. Is this common for Python in organisations? Did I get something wrong? Seems to a little bit too much on the Java side of this tradeoff.

<comment><USER3> I prefer importing whole modules too. One of the benefit is much easier code reviews:

Imagine this diff in the middle of a file (in Javascript)

      if (includes(users, userId)) {
        open(load(userId))
      }

vs

      if (_.includes(users, userId)) {
        Modal.open(UserApi.load(userId))
      }

</comment></comment><comment><USER4> Google's C++ style guide is much more interesting: [https://google.github.io/styleguide/cppguide.html](https://google.github.io/styleguide/cppguide.html)

<comment><USER5> In that it destroys a greater proportion of the language's expressive power? :-p

<comment><USER6> It has improved considerably since the adoption of (much of) C++11.

Still no exceptions, though.

<comment><USER7> The advantage of exceptions is not so much their "expressive power", but the fact that they provide an approximation to error handling even when nobody remembers to express it.

If my team had some process (via code review, static analysis, or anything else) that could ensure error returns were actually checked and handled, then the case for exceptions would be much diminished.

<comment><USER5> > some process

Or something like Rust's `Result<T,E>` type? You can't possibly forget to `match` it, and if you `unwrap` it, it will be plain obvious, both to humans and to linters.

[http://doc.rust-lang.org/std/result/index.html](http://doc.rust- lang.org/std/result/index.html)

</comment></comment></comment></comment></comment><comment><USER8> The only rule that would bother me is the max line width of 80 characters. Why still stick to this rule with today's screens? I usually set this to 200.

<comment><USER7> Just because you have a screen that can display an enourmously long line of text, it doesn't mean that text is going to be readable. Or that you want to use the whole width of your screen for displaying unreadable text.

Lines longer than 100 chars are very rare in readable code. And it is easy to break lines down to 80 or even 72. If you do that, then it becomes easy to place two windows of good sized text side-by-side.

</comment></comment><comment><USER9> Google internally does not always follow this guide. Different project can come up with its own style.

<comment><USER10> Note that this is the public style guide (intended for contributions to Google open-source projects). The internal style guide has some differences, mainly to more-closely match the styles of internal C++ and Java (things like naming and indenting).

In my experience, any Python code in the core codebase follows the (internal) style guide. Big mostly-standalone projects like YouTube have their own style.

</comment></comment><comment><USER11> 4 spaces? seriously? Why would anyone type out 4 spaces instead of one tab?

<comment><USER12> Personally, i use tabs of size four with expandtabs setting. That way i don't have to press four spaces and my files look the same across all editors and platforms.

<comment><USER13> I thought everybody does that..who the hell would type space 4 times?</comment></comment></comment>


Unidirectional Network - <AUTHOR> https://en.wikipedia.org/wiki/Unidirectional_network <comment><USER2> Unidirectional networks, or data diodes, are used extensively in high- assurance security for purposes like these:

[https://www.opswat.com/blog/why-data-diodes-are-essential- is...](https://www.opswat.com/blog/why-data-diodes-are-essential-isolated-and- classified-networks)

Strongest designs are done with light such as fiber or infrared. A number of products were analyzed and pentested by evaluators and intelligence agencies with resulting EAL7+ certification, the highest. Link below lists some of the products.

[https://www.securitywizardry.com/index.php/products/boundary...](https://www.securitywizardry.com/index.php/products/boundary- guard/data-diodes.html)

Owl's page has some more applications:

[https://www.owlcyberdefense.com/](https://www.owlcyberdefense.com/)

</comment><comment><USER3> Like the Tesla Valve...

[https://en.wikipedia.org/wiki/Tesla_valve](https://en.wikipedia.org/wiki/Tesla_valve)

<comment><USER4> Remember the _" The Simpsons Already Did It"_ episode of South Park? I feel like all inventors have to have a similar _" Nikola Tesla Already Did It"_ dread when they think they've invented something. Is there anything that guy didn't do?

</comment></comment><comment><USER5> How do they assure unidirectional transfer with out any feedback in reverse direction (TCP Acks for example ?).

<comment><USER6> Send a manifest and checksums as part of the transfer, then the receiving end can give a summary of what didn't work.

With a data diode, the physical medium is probably a short run with no packet loss anyway.</comment></comment>


Manhunt for assange ... because of sex without a condom - <AUTHOR> http://read.bi/gOIUNA

<comment><USER2> Please don't submit short URLs (or anything more about WikiLeaks, but maybe that's just me).</comment>


Show HN: RPC with plain Java interfaces over MQTT - <AUTHOR> https://github.com/SkPhilipp/mqtt-drpc

<comment><AUTHOR> Note that this uses Eclipse Paho for Java, which contains some issues, the Github issues on the project reflect this.

I've been thinking on creating a version of this library which uses AMQP, as Eclipse Paho for Java does not seem to do yet what it promises.

Any comments, suggestions?</comment>


Ask HN: Presentation Software? - <AUTHOR>

Ideally I wanted some wiki format -> HTML5 sweet animation generator, that also could output a PDF.
I looked at the ancient S5: http://meyerweb.com/eric/tools/s5/
But even Eric Meyers is back to using Keynote now: http://meyerweb.com/eric/thoughts/2010/05/07/web-2-0-talk-html5-vs-flash/
What do you use for presentations at Conferences? <comment><USER2> Keynote can output PDFs.

You may also want to check out 280 Slides: <http://280slides.com/>

<comment><USER3> 280 Slides is by 280 North, YC08.

</comment></comment><comment><USER4> <http://prezi.com/> ... most interesting thing to come to presentations in a looong time. Check out their take on Pecha-Kucha:

<http://prezi.com/j9anrjn-gdwj/prezi-pecha-kucha-bw/>

Danger is that you'll spend all your time futzing with the style and not put in enough substance.

</comment><comment><USER5> Prezi. I like their canvas style approach. You can really get the big picture that way. Although I kind of agree that it's easy to get lost in styling, I do think it's better that I get lost than my audience. It's a real attention- grabber, I know from experience.

</comment><comment><USER6> I've used beamer on occasion and think its great, albeit because I use LaTeX elsewhere: <http://en.wikipedia.org/wiki/Beamer_(LaTeX)>

If you want to go the HTML5 route, I'm guessing pulling the relevant code out of the Google presentation highlighting HTML5 features would be a good exercise; source at: <http://code.google.com/p/html5-slides/>

For pure wiki syntax, I'd go with Pandoc which allows conversion to both S5 and PDF from a variety of markup languages: <http://johnmacfarlane.net/pandoc/>

</comment><comment><USER7> Although not exactly the right answer, but it might give some of you a few ideas. Here's a presentation that WebkitGtk's maintainer did for GCDS 2009: <http://webkitgtk.org/gcds.html>

And I use Beamer (Latex) myself because of the equations...

</comment><comment><USER8> If you follow the "Present like Jobs" school, then Keynote is all you need.

Of course, most people would rather futz with their animations than rehearse. check out: <http://wziwyo.com/?p=177>

</comment><comment><USER9> I create and present with Keynote on iPad, works great.

Before iPad, I used <http://280slides.com/> on my Thinkpad.

</comment><comment><USER10> I find Prezi very nice - although it doesnt meet your wiki to html5 generation critieria. <http://prezi.com/>

</comment><comment><USER11> Showoff (<http://github.com/schacon/showoff>), Markdown > HTML/PDF.</comment>


Is it the demand for semantic web? - <AUTHOR> http://www.readwriteweb.com/archives/hitwise_search_queries_are_getting_longer.php

<comment><USER2> This article has nothing at all to do with a semantic web, it is simply about the length of search engine queries steadily growing and google increasing its market share.

I _DO_ believe there is a demand for a semantic web, but saying so and implementing it are worlds apart. Earlier today I posted a link to a database that I think might be key in doing just that.

</comment><comment><USER3> I don't see why semantic features should get credit.

As information continues to mushroom, I find that I _have to_ use more search terms to narrow down the results to be more manageable.</comment>


AWS Single Sign-On - <AUTHOR> https://aws.amazon.com/about-aws/whats-new/2017/12/announcing-aws-single-sign-on--sso/ <comment><USER2> If this is interesting to you but you're iffy about setting up another directory service or having AWS be your central list of identities for all your apps, we're open sourcing The Identity Mutilator, a Golang SAML IdP, in a couple weeks. It's self-contained (for now) so doesn't depend on AD or LDAP --- just Postgres --- and runs just fine in a tiny Docker container.

<comment><USER3> As the author of a pluggable OAuth2 & OIDC Provider ( [https://github.com/ory/hydra](https://github.com/ory/hydra) ) I am looking for an OSS IDP that solves just ID management. Is there a URL where I can expect this to land?

<comment><USER4> What about Keycloak ([http://www.keycloak.org/](http://www.keycloak.org/))?

<comment><USER5> I want to be careful not to confuse between Keycloak and a few other suites like FreeIPA we (Latacora) tried because this was a while ago, way back when we started writing the IdP and I don't accidentally want to throw shade at another project, so mistakes mine... But the built artifact size is like, 10-100x larger. And that's a Go binary, so no cheating with e.g. grabbing an XML parser from the stdlib or something. You can much more plausibly audit the living daylights out of the Latacora IdP because it's tiny.

</comment></comment></comment></comment><comment><USER6> I tested this out just yesterday. It was fairly easy to set up - enable SSO, create a Directory Service, add a management EC2 instance, and you're pretty much up and running.

You've got to set up your own Active Directory using Directory Services, which is $288USD/month minimum for two domain controllers.

In order to have MFA for logging into the console (non-negotiable in my opinion), you have to configure your own RADIUS server.

And the question of how to manage access keypairs still remains unanswered, as far as I can tell.

I don't know if this is going to supplant Azure AD as our SSO method of choice.

<comment><AUTHOR> Hmm how did you calculate the DC to be $288 for total of two?

I believe you can use AD connector to connect to on-premise AD.

<comment><USER6> $288 comes from here: [https://aws.amazon.com/directoryservice/pricing/](https://aws.amazon.com/directoryservice/pricing/)

It looks like AD Connector is much less: [https://aws.amazon.com/directoryservice/other-directories- pr...](https://aws.amazon.com/directoryservice/other-directories-pricing/)

<comment><USER7> I think you're looking at the Enterprise domain controller pricing. the Standard size (up to 30,000 objects) is 12 cents/hour for two controllers.

$0.12 * 24 * 30 = $86.40/month.

<comment><USER6> You're right! Thanks for the pick-up.

I'd change the statement in my parent post, but I don't seem to be able to edit it.

</comment></comment></comment></comment></comment><comment><USER8> Wonder if and when we'll see decent Excel/Word replacements from Amazon, perhaps coupled with a thin Linux distro. At that point you'd be able to completely do away with Microsoft in many organisations, and Amazon could simply gobble up those dollars. They've got enough money they could make it work.

<comment><USER7> Google has been working on that for ~10 years, but still doesn't have a full replacement. Though it's about 80% there - we're a Google Docs office, but about 20% of employees (mostly finance and marketing) need real MS Office products.

<comment><USER9> Sheets... I just.. I can't.

I was a business analyst (excel grunt) for 2+ years in a biotech startup. Sheets is just different in enough ways to positively irk even the "casual power user" of Excel, IMO.

<comment><USER10> Sheets isn't meant to make Excel power users happy. Nothing can without being a shameless clone.

It's for the other 97%. A list here; a table and a chart there. Now to make it look pretty.

</comment></comment></comment></comment><comment><USER11> Sad day for Saml SSO vendors I guess. I know I would pick this next time over auth0/stormpath/one login because it's free.

<comment><USER12> But would you though? They only integrate with AD and looks like they are trying to address a gap that AWS has with managing access to resources. These other IdaaS have a lot more functionality.

</comment></comment><comment><USER13> PSA: Remember to keep your contact data up to date when using 2FA.

I lost my phone 2 weeks ago and i lost access to the reauth phone number years ago. I have not been able to get this resolved all this time. The German Website support is clueless about 2FA (that was recently introduced) and AWS support wants a form signed by an US Notary (which are hard to come by in Germany).... Really annoying

</comment><comment><USER14> I'm a little confused at the third-party thing - is AWS generating SAML assertions based on your internal AD that it sends to other websites like Box or Office 365 or Slack? Why would you want AWS in the loop?

Is this an alternative to running ADFS? I guess the fact that you're not running ADFS servers is nice, but as far as I understand, your ADFS servers don't have to be publicly facing. (And honestly, _not_ being able to sign in using corporate credentials if you're not on the corporate network is a security policy that will make lots of admins happy.)

It looks like there's an old AWS blog post about using ADFS to enable SSO to AWS: [https://aws.amazon.com/blogs/security/enabling-federation- to...](https://aws.amazon.com/blogs/security/enabling-federation-to-aws-using- windows-active-directory-adfs-and-saml-2-0/)

<comment><USER15> AWS SSO looks to be an IdP (identity provider) which maps artifacts from AD like ldap groups to entitle access to trusted service providers.

This would be an alternative to ADFS. It solves a big problem, because for many customers of cloud services, you're paying for 99.9% reliability from the service provider, but the ADFS farm in your office or in another cloud is a single point of failure with a lower uptime commitment.

</comment></comment><comment><USER16> Nice to see this, one that Google Cloud always had a nice advantage with seamless identities when using G-Suite for productivity and email. I'm expecting the next version to integrate deeper into workspaces/docs/mail so that they reach parity with the other clouds here.

</comment><comment><USER17> I'm trying to understand the use case of this over Cognito for a typical SaaS company. Anyone care to give a brief explanation?

<comment><USER18> Cognito is for authenticating users while AWS SSO is for authenticating employees. Users don't usually need to be stored in Active Directory, authenticate to other services with SAML, or assigned groups to control access. AWS SSO should also have better integration with AWS IAM.

<comment><USER17> Everyone is a user, and most are employees. So that doesn't really answer my question. Users need to be stored somewhere. The question is, is AD a good place to store them. AD is a standard, is flexible, and has been around a long time. So perhaps I should ask the question "Now that we have AWS SSO, why would I use Cognito?"

<comment><USER19> This blog post has a good explanation:

[https://stormpath.com/blog/sso-vs-centralized- auth](https://stormpath.com/blog/sso-vs-centralized-auth)

</comment></comment></comment></comment><comment><AUTHOR> Here is a blog post on AWS SSO.

[https://aws.amazon.com/blogs/security/introducing-aws- single...](https://aws.amazon.com/blogs/security/introducing-aws-single-sign- on/)

Would have been so smooth and so nice before implementing custom SSO...

</comment><comment><USER20> This is confusing. Does this thing speak LDAP or provide a way to add an LDAP adapter? I would love to move my LDAP server into a hosted service.

<comment><USER20> Ah. Never mind. I see now that it requires AD as a prerequisite.

</comment></comment><comment><USER21> Can SSO be used for SSH like Google Cloud? That's the coolest thing I miss from Google Cloud

<comment><USER22> Are you talking about the `gcloud compute ssh` stuff? I wonder what magic google is using to grt public keys on boxes. I'd think there'd have to be some coordination with the machine image being run for this to work, so it wouldn't be something Amazon could just turn on for everybody. You could probably roll your own using an SSH CA though.

<comment><USER23> They have daemons running to manage that and do stuff like add IP addresses when IP forwarding rules are added; [https://github.com/GoogleCloudPlatform/compute-image- package...](https://github.com/GoogleCloudPlatform/compute-image-packages)

<comment><USER22> Daemons running on user VMs? Or is ssh terminated in a bastion and forwarded somehow?

Edit: sorry didn't read far enough and have now answered my own question. In VMs. So yea, Amazon could not duplicate without getting people to change AMIs or install some agent. Still seems like an SSH CA is a better option. Curious why google didn't go that route. Maybe not an option when they built this?

</comment></comment></comment></comment><comment><USER24> looking forward to kicking the tires. i think that companies like Amazon's are the one's with the scale needed to do thus well.

</comment><comment><USER25> What's the advantage of SAML over Kerberos?

<comment><USER22> Kerberos / Needham-Schroeder usually refers to an authenticated encryption protocol that uses symmetric keys (shared secrets). It lets two parties who have never communicated, but who both mutually trust some third party, establish one another's identities and negotiate a symmetric key for encrypted communication.

The SAML core is an XML-based system for serializing, signing, and encrypting assertions. There are also SAML flows, and they likely use something Kerberos- esque. So SAML is to Kerberos what HTML is to HTTP, or what x.509 is to TLS, or something like that.

</comment></comment><comment><USER26> Ugh SAML

</comment><comment><USER27> Finally, a 15th standard.

Reference: [https://xkcd.com/927/](https://xkcd.com/927/)

<comment><USER28> They did not reinvent the wheel here. This is just the SAML 2.0 standard. The only consequence of launching this product is that there is another competitor on the SSO market, which is a good thing I think.

<comment><USER27> Technically true. But when it comes to writing a website, do you plan to add "SAML 2.0 auth" or "Google SSO, Facebook SSO, Amazon SSO"? I think all need to be configured, tested and debugged, even if they are based on the same communication protocol.

</comment></comment></comment><comment><USER29> Update: I realize now this is Amazon offering SSO services, not just supporting SAML / Federated authentication.

Ignore rest of my comment:

      Proof you can build a massive, multi-billion dollar enterprise business without supporting SSO.

      I would not have immediately guessed that statement to be true, and I would have thought AWS already had SSO support.

<comment><USER30> It was always pretty easy to build yourself with their federated auth system. Nice to have proper support now though.

Edit: no, it still isn't really anything like what I'm wanting. This particular product requires Microsoft AD. I just want our admins to be able to log into AWS via google apps. :(

<comment><USER31> You should be able to do this already[1]. What issues are you having?

[1] [https://support.google.com/a/answer/6194963](https://support.google.com/a/answer/6194963) via [http://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_pro...](http://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_providers_saml_3rd- party.html)

<comment><USER32> I want the ability to use Google/G-Suite as an identity provider to log into multiple AWS accounts. We have dev and prod workloads that run in completely separate AWS accounts. I want to be able to use Google SSO and the ability to select which AWS account to log into

<comment><USER31> I don't have access to a G-Suite account to test this with, but afaict you should be able to do this by just adding each AWS account in turn and giving it a different Application Name and description in the G-Suite interface.

</comment></comment></comment></comment></comment><comment><USER33> While this will undoubtedly make a lot of people's lives easier, I'm a bit hesitant to use SAML just yet.

SAML is still relatively new, isn't very widely used (AFAICT), and I'm not sure how much security research has been done on the topic thus far.

To illustrate, just a few weeks ago there was _" a new attack vector discovered that ... enables an attacker to create a ... forged SAML 'authentication object', and authenticate across every service that uses SAML 2.0 protocol ..."_ [0].

> _In a golden SAML attack, attackers can gain access to any application that > supports SAML authentication (e.g. Azure, AWS, vSphere, etc.) with any > privileges they desire and be any user on the targeted application (even one > that is non-existent in the application in some cases)._

Vulnerabilities like this one really do give up the proverbial "keys to the kingdom" and provide an attacker with pretty much everything they need to _really_ ruin your day.

Now, this particular attack isn't real practical as it requires things like the "token-signing private key". You don't need domain admin although you do need access to the ADFS account and if an attacker has access to that, well, you're probably already screwed (or well on your way). The point is that SAML is still shiny and new and there will almost certainly be additional flaws found in the future -- flaws which may very well compromise you completely.

It's certainly a nice solution to a big problem and, as I said, will make a lot of people's lives easier. I'm just not yet ready to trust it 100%.

 _Edit:_ To prevent a dozen more "2005!?" comments, I mentioned this in a reply:

> _True, but it 's still relatively new to most people, similar to how IPv6 > has been around for a few decades but is still "new" to many._

The spec has been around for a while. Common deployments -- outside of AWS, MS, RH, etc., haven't (unless I've just been unaware of them).

[0]: [https://www.cyberark.com/threat-research-blog/golden-saml- ne...](https://www.cyberark.com/threat-research-blog/golden-saml-newly- discovered-attack-technique-forges-authentication-cloud-apps/)

<comment><USER34> While there are a thousand reasons to hate SAML, your concerns are not accurate.

1\. I guess "relatively new" is a vague term, but SAML v2.0 (the current version) was standardised in March 2005 - it's now 12.5 years old, I don't call that _new_.

2\. SAML is very widely used in certain segments. Every SSO product supports SAML, including cloud vendors like Azure, Google and now AWS, and also specialist vendors like Okta and OneLogin. Within the dreaded "enterprise" space, SAML is absolutely the #1 SSO technology in play.

3\. The golden SAML attack is a load of crap. It basically says "If you can get the private keys of an identity provider, then you can impersonate that identity provider". Yes, SAML relies on the confidentiality of the signing keys. That "attack" is the equivalent of saying Linux security is broken because if you have the root password you can modify any file.

<comment><USER33> > _I guess "relatively new" is a vague term, but SAML v2.0 (the current > version) was standardised in March 2005 - it's now 12.5 years old, I don't > call that new._

True, but it's still relatively new to most people, similar to how IPv6 has been around for a few decades but is still "new" to many.

> _SAML is very widely used in certain segments._

Perhaps but it's only been in the last few years that I've been hearing about it, mostly WRT the cloud vendors (AWS, specifically).

> _The golden SAML attack is a load of crap._

Yeah, I think I mentioned it isn't very practical. To me, though, this seems like just the unexpected kind of thing that, some day down the road, is going to come back and bite you in the ass. That is, some major issue in some piece of infrastructure that is overlooked, forgotten about, or taken for granted (e.g. heartbleed or similar), that suddenly causes everybody to drop everything and react immediately to fix it.

<comment><USER15> It's new if you're not informed about identity as a technology area. Some people in that space consider SAML2 to be outdated!

The beauty of a federated identity system is that you keep your credentials away from business partners. If you were a corporate customer of Dropbox relying on them to host your identity, you were kind of fucked when they had an account breach. If you used federated identity, Dropbox _never had access_ to your account credentials.

Federated identity also lets you control posture and control access better. Perhaps your email system requires multi-factor auth, but your time card system does not, unless you are approving expenses. You can build that "step up" to multi factor auth on your servers, and use a single MFA credential to do so.

<comment><USER26> It's outdated enough that even the Enterprise vendors are starting to look at OpenID Connect to replace it.

The draw with SAML was definitely for enterprise requirements -- the main one, as I understand it, was the requirement of sharing metadata out-of-band between the IdP and SP to establish trust. While that sounded like a good idea at the time, it turns out that if your organization ends up needing to trust and exchange metadata with more than a few other entities, managing all those certificates and properly validating them is enough of a pain that metadata aggregators have sprung up to handle them.</comment></comment></comment></comment></comment>


Mac OS X hidden features and nice tips & tricks - <AUTHOR> http://apple.stackexchange.com/questions/400/mac-os-x-hidden-features-and-nice-tips-trickS <comment><USER2> A few I can think of:

\- Open the Apple menu. Now hold Shift. More menu options! Now try holding Opt. Even more menu options! This works for several Apple applications.

\- Hold Opt when clicking on a menubar icon for extra information. For example, holding Opt and clicking the WiFi icon in the menubar brings up the signal strength, IP address and other useful information. Likewise for the rest of the icons.

\- In Spotlight, select an entry in the search results and hit Cmd+Return to go to its parent folder. Opt+Return opens results in a Finder window.

\- You know you can drop files on dock icons? Did you know you can also drop them on the icons in the app switcher (the thing that comes up when you hit Cmd+Tab)?

\- This one is a bitch to describe, but very useful. You know you can hit Cmd+M to iconify ("minimize" in Windows-speak) applications to the Dock. But how do you get them back? Just do this: Cmd+Tab to the application, but don't release Cmd yet. Without releasing Cmd, press Opt. Now release Cmd. Done! This is equivalent to clicking the application's icon in the Dock, which means it has more uses than the one I described.

<comment><USER3> That fifth trick is superb. Apps that don't reopen their closed main window when cmd-tabbed to drive me nuts (Mail especially, as there's no shortcut to open the message viewer).

<comment><USER4> This has been one of my main sticking points of OS X window management for a very long time. At least there's a workaround, thanks!

</comment></comment></comment><comment><USER5> I couldn't see it in that list, but my favourite can't-live-without shortcut is CMD + ~ to switch between windows of the same app (for example, if you have 10 textmate windows open it will flip between them). CMD + SHFT + ~ to go the other way.

<comment><USER6> I use this frequently. Unfortunately it doesn't work with Photoshop.

<comment><USER7> The reverse does. cmd+shift+~

</comment></comment></comment><comment><USER8> The big one that I went through recently was killing startup items. You tend to hoard them over time, especially with a dev machine.

Look in, and clear out in /Library/StartupItems and /System/Library/StartupItems

Like any good UNIX, there are a dozen other ways that applications can launch themselves in OS X, so run a ps and find processes that you don't need and figure out where they are being started.

I alias everything in bash to run the scripts manually when I need them (eg. 'apu' starts apache, 'ngu' starts nginx, 'vbx' sets up virtualbox). Saves a ton of memory and gets boot time down to seconds rather than minutes.

<comment><USER9> I trust you know what you are doing. I'd like to warn others to be careful of what is removed, especially if you didn't put it there. The price is stability.

<comment><USER9> Can somebody explain how this doesn't contribute to the discussion? I was trying not to tell nikcub something they may already know, and trying to be helpful for anyone else while not making assumptions on the knowledge of anyone else.

<comment><USER8> I have no idea, I thought it was a valid point and probably something I should have mentioned

</comment></comment></comment></comment><comment><USER10> The first two are part of the reason why I hate using Windows at work.

The fact that you cannot drag files to their icons and have that file opened in the application seems like something out of the past.

To scroll a window in Windows, the window needs to have focus. To scroll a scroll pane in an active window, that pane needs to have focus -- it is maddening especially when hover events work for non-focused windows and panes.

I could go on and on, but this isn't a Windows hatefest.

<comment><USER10> I use spotlight for all kinds of math (12 / 4) * (44 + 35) etc

Command + c will copy the highlighted spotlight result.

Expose (show all windows) and drag and drop files to that window (i grab the file, while dragging show all windows by either a keybord key or hot corner and drop it to the new window)

Hold down command to move around background windows without giving it focus.

Ctrl + (arrows or numbers) to go to certain spaces.

While in spaces expose, hold down ctrl to move all of the windows of a certain application to another space.

Hold down a window's titlebar while switching spaces to move that window to the new space.

Drag folders that you frequent into the left side of finder. I have /private/etc in mine

Hold down command while clicking or pressing enter on a spotlight result will open its containing folder.

How did I forget about keyboard modifiers by holding down the alt key.

Drag a file/folder to terminal to get the path to that file printed in terminal. so I often type "cd " and then drag folder to get there

While switching apps via command+tab you can let tab go and either hide the application by pressing h or quit it by pressing q (I wish that you could minimize it by pressing m). You can also cycle backwards by pressing tilde (this only works if youre already command+tabbing) or shift+tab

* Gone from snow leopard, but i miss it* there used to be a keyboard shortcut (command, option, ctrl space) that opened a list of your last accessed files (i mistakenly found a bunch of porn website cookies on an intern's laptop once). This used to be useful to see which files you needed to upload /ftp.

<comment><USER11> IMO Spotlight is _the_ best example of minimalist software design.

In a single universal field you have instant: app launcher, calculator, dictionary, file search, email search, contact search.

My single best tip for Mac power-users: learn what you can do with Spotlight.

Edit: grammar

<comment><USER12> Spotlight also has keywords -

kind:pdf

date:yesterday

author:short_name

from:contact_name

And the boolean relations AND, OR, NOT work as you might expect.

There's a _lot_ of cool stuff hidden in Spotlight. Try

        man mdfind

to play around with command-line Spotlight.

<comment><USER12> Here is a particularly good resource on this aspect of Spotlight:

<http://hints.macworld.com/dlfiles/spotlight_cmds.txt>

</comment></comment></comment></comment></comment><comment><USER13> "I love the fact that OS X will scroll the window that the mouse is hovering over, even if another application has focus. That way I can scroll an example that I am coding in TextMate without having to lose keyboard control on TM"

This also happens on Windows (at least on Chrome) but Windows goes even further: you can click through a link or button on a non-focused window. On OS X, in order to follow a link or click a button on some non-focused window, you need to activate it by clicking and then click again on the desired link/button. This drives me nuts as I found out I use this all the time on Windows. I call this feature "smart focus".

<comment><USER14> Command click on buttons in background windows to click them without bringing the window to the front. Works for most things (at least anything using standard cocoa controls), although clicking links in Safari is a notable exception since it still seems to bring the window to the front.

You can also command+click and drag background title bars to move those windows without bringing them to the front.

<comment><USER13> It's a good workaround I guess. I'm still not sure which way is the best. OS X kinda prevents the user from misclicking outside the window while Windows doesn't but if you're in need of some speed (and fewer clicks/keys) then you might prefer the Windows way.

</comment></comment></comment><comment><USER15> Shouldn't people sign up and put their answers on StackExchange? They have pretty good search built into it. Search: [haskell] mysql

This will return all questions tagged haskell that mention mysql.

I'd love a HN article search by title, comment, author, or my saved stories.

</comment><comment><USER16> My absolute favorite is cmd+shift+/ which brings up the Help Menu search box. With this I can type any menu item string and execute the item rather than having to remember each shortcut.

<comment><USER17> To be fair, the shortcut should really read "cmd+?". Much easier to remember!

</comment></comment><comment><USER18> Bring up "About this Mac…" from the apple menu, then click on the OS version number and it will cycle through some extra information including the serial number so you don't have to try to read the 2 point tall, minimal contrast serial number printed on the case.

</comment><comment><USER19> I did not read the entire list, but my favorite "trick":

        CMD + SHIFT + g

... in Finder (or an open-file-dialog) opens up a "Go to folder"-dialog in which you can tab-complete your way to the desired destination. It's not perfect, but makes fs-navigation bearable in Finder.

<comment><USER20> Oh, wow, I didn't realise you could tab-complete as well. Thanks!

</comment></comment><comment><USER21> Don't post tips here, post them on apple.stackexchange.com so others can find them...

</comment><comment><USER22> The coolest hidden feature of OS X is probably the text input system.

<http://www.hcs.harvard.edu/~jrus/site/cocoa-text.html>

</comment><comment><USER23> What's even better is that many of the keyboard shortcuts are consistent across many applications. For e.g., Cmd-, opens Application Preferences.

<comment><USER24> Agreed. I miss that shortcut every time I use Windows or Linux.

</comment></comment><comment><USER25> One I like is Ctrl+Cmd+d while the pointer is over a word will pop up a small dictionary with a definition of that word. This does not work in every application (e.g. it doesn't work in Chrome or Firefox), but it should work in any Cocoa based application.

</comment><comment><USER4> I wish there was a way to do these (like you can in windows), maybe someone knows a way? \- Right click a file, "Send To". The nice thing about it is you can add items to the Send To folder so you can have a customized list of apps you can open files with \- Right click on a folder and "open in terminal" \- Type a path into a finder window and have finder open it

</comment><comment><USER9> I don't use OS X, but I thought I'd share a few bits of information. Also this page demonstrates why native local software is so great - no redundancy (exposing a dictionary to all apps), low memory footprint etc.

\- In 10.6 Snow Leopard, hold Space to zoom in on a window in Exposé.

\- Not a hint exactly, but there exists at least one unnecessary dissatisfaction people have of Finder. In real life, you cut text and paste it in a scrapbook, but you don't cut an object like a folder with scissors in order to move it. You usually use a hand or two. Therefore the inability to "move" an object using "cut" (Cmd+X) is the correct behavior. Secondly it prevents you from accidentally pasting a file elsewhere, then needing to remember if you meant to do that, or undo. Adding visibility in some way is not enough, and you can still move by dragging the object to the desktop or wherever else.

Note: Edited for spacing.

</comment><comment><USER26> A more comprehensive DB of various tips for MacOS: <http://secrets.blacktree.com/>

</comment><comment><USER27> Anyone know how to set a default view option across all folders? Like overwriting the previously set option for all folders?

</comment><comment><USER28> Not a native tip, but using hyperdock has made window management on OSX so much nicer thanks to it's smart porting of win 7 features like dock window previews, dragging and window to the top and having it fill the screen. Can't rave about that little app enough!

</comment><comment><USER29> Wow, I just saw this nugget in one of the comments: VI mode for the standard Terminal.

Add "set -o vi" to your profile and you get access to same modality and commands of VI. Damn, I wish I knew about this option earlier.

<comment><USER30> Note that I think that's a Bash thing, and the default is Emacs-style bindings (C-a, C-e, C-p, C-n) which include C-r for reverse interactive search of the history. I use that every day, a dozen or more times.

<comment><USER31> It's actually a Readline thing.

<comment><USER32> Something I've always wondered though - did emacs take them from readline or did readline take them from emacs? How old is readline? Where did all of those C-a, C-e, etc conventions come from?

<comment><USER33> They came from emacs. Readline is now around v6, readline v2 seems to have been from the mid 1990s.

There is a smaller set of standard commands for killing (C-h for char, C-w for word, C-u for line) which are used in many terminal apps. They are orthogonal to emacs, and probably about as old (1970s).

<comment><USER34> Those emacs style editing commands actually came from TECO in the 70s. Crazy that those editing commands are hardwired into my brain nearly 40 years later.

</comment></comment></comment></comment></comment></comment><comment><USER35> View a powerpoint presentation: Option (or Option-Space for fullscreen)

My macbook air's measly 64 GB cannot accomodate a seperate powerpoint app, so I use the builtin preview features. It works great.

</comment><comment><USER36> Hold Ctrl-Shift while moving your cursor over the Dock to temporarily enable magnification.

Useful when your Dock is crammed with tiles.

<comment><USER37> you can also hold down ctrl and scroll up or down the trackpad with two fingers to magnify the whole screen. Really helpful for zooming in when your laptop is hooked up to a projector.

</comment></comment><comment><USER38> Is there a similar one for linux?

<comment><USER39> There are StackExchange sites for Unix & Linux: <http://unix.stackexchange.com/>

... and for Ubuntu specifically: <http://area51.stackexchange.com/proposals/7716/ubuntu>

You could search there.

</comment></comment><comment> matthew-wegner CMD-down will open the selected file in the Finder (same as double-clicking).

<comment><USER7> cmd-o too.

</comment></comment><comment><USER40> I like ctrl+opt+cmd+8 to toggle reverse video.

</comment><comment><USER41> Wow I feel ignorant, great stuff!</comment>


How to Start a Coffee Shop and Not Go Bankrupt - <AUTHOR> http://www.projectionhub.com/financial-projection-blog/how-to-start-a-coffee-shop-and-not-go-bankrupt/

<comment><USER2> This should be titled "Don't start a coffee shop, buy one".

</comment><comment><USER3> spam. it's just a fake article to sell their product.</comment>


PyCon Charlas - <AUTHOR> https://us.pycon.org/2018/hatchery/charlas/ <comment><USER2> This is an English speaking forum, so it's better to post in English in spite the content is for Spanish speakers. I recommend to link to the English version of the post [https://us.pycon.org/2018/hatchery/charlas/#eningles](https://us.pycon.org/2018/hatchery/charlas/#eningles) and try to use a title that is meaningful and as close to the original as possible and use some part of the article, something like "PyCon Charlas - Conference Talks in Spanish"</comment>


IBM Just Committed Cultural and Creative Suicide - <AUTHOR> https://www.inc.com/geoffrey-james/ibm-just-committed-cultural-and-creative-suicide.html <comment><USER2> Uh, it's a way to lay off employees.

The rest of us should see this as an opportunity to pick up talent.</comment>


New York City report pins millions in rent hikes on Airbnb - <AUTHOR> https://techcrunch.com/2018/05/03/new-york-city-report-pins-millions-in-rent-hikes-on-airbnb/ <comment><USER2> In an efficient market, the rental rate (controlling for unit quality) for long-term residents and short-term guests should differ only by as much as the landlord gains from the predictability of a long-term resident's rent payment stream and the lower upkeep costs. This result just tells us that this difference is smaller than the pre-Airbnb gap between hotel and apartment rates.

Airbnb is removing friction and making the market more efficient. It's not some kind of force for evil.

<comment><USER3> I haven't seen cities like NY or SF themselves proclaiming Airbnb is evil, or bad intentioned. It's not about friction of markets here, it's about a city having the capacity to house people. If the city was just concerned about getting a cut of the revenue they could just tact on hotel taxes and be done with it.

Of course it's not a black and white problem, but I am far more sympathetic to cities struggling to house everyone who actually want to live there and could care less about airbnb's inventory problem.

</comment></comment><comment><USER4> I'm surprised that anyone would think otherwise. AirBnB naturally removes stock from the rental market. The rest is supply/demand 101. The only question is how big of an impact AirBnB has.

<comment><USER5> NYC has rent controls, which themselves actually limit the quantity supplied. Arguably, AirBnB provides for a more efficient resource allocation since it allows the unit's price to float to the market equilibrium.

<comment><USER6> It's a different equilibrium though, where tourists are paying daily rates instead of locals paying monthly

<comment><USER2> So? Are tourist utility-hours somehow different from resident utility-hours?

<comment><USER7> Residents provide stability to a polity's long term tax base, and are also the source of votes that politicians of said polity need to get re-elected. So, unless you want wild, cyclical swings in your polity's finances, long-term is generally a better bet.

</comment></comment></comment></comment></comment><comment><USER8> Previous discussion:

[https://news.ycombinator.com/item?id=16986824](https://news.ycombinator.com/item?id=16986824)</comment>


Ask HN: Advice on selling bootstrap skins/themes - <AUTHOR>

Hi Friends,
   I have had some fun creating bootstrap skins. Now I would like to sell it. I would like to know if there is a demand for bootstrap skins minus any templates? Or do people prefer templates?
Also I identified http://codecanyon.net as a possible marketplace to sell at. Is there any other marketplace that I can cater to?
Thank you very much for your input! <comment><USER2> I have used [https://wrapbootstrap.com](https://wrapbootstrap.com) and [http://themeforest.net](http://themeforest.net)

<comment><AUTHOR> Thank you aburan28. Is there a good demand for bootstrap skins?</comment></comment>


Mozilla And Samsung Collaborate On Servo, NextGen Browser Engine Written in Rust - <AUTHOR> http://techcrunch.com/2013/04/03/mozilla-and-samsung-collaborate-on-servo-mozillas-next-gen-browser-engine-for-tomorrows-multicore-processors/

<comment><AUTHOR> This is really exciting. I'm glad to see rust being used for serious apps. This is actually the first new browser engine that I know of being written in the past 10 years.</comment>


TikTok E-Commerce Anchor Feature - <AUTHOR> https://jungletopp.com/tiktok-e-commerce/ <comment><AUTHOR> Together we'll look at how an E-Commerce feature will shape TikTok further as well as why Advertisers and Marketers should turn to this platform for their brand.</comment>


Ask HN: Simple email SaaS? - <AUTHOR>

Google Apps is way too bloated and has lots of options. I'm looking for a really simple email SaaS that I can bind to my domains.
Should support IMAP for syncing with my devices.
Any suggestions/experiences? <comment><USER2> Rackspace is pretty bare bones and lots of people like it: [http://www.rackspace.com/email- hosting/webmail](http://www.rackspace.com/email-hosting/webmail)

I use fastmail [https://www.fastmail.fm](https://www.fastmail.fm)

Depending on your uses one might be cheaper than the other, fastmail is pretty cheap if you only have 1 user for all the domains (you can alias whatever email addresses you want) ($40/year personal plan)

Rackspace I haven't really used so I don't know how they handle multiple domains it might be cheaper to use them with multiple users. They do require a minimum $10/month

</comment><comment><USER3> Zoho offer a pretty simple email service, only 5 mailboxes though (but you can get creative and use groups as well)

www.zohomail.com

</comment><comment><USER4> Yesware looks promising, but I decided on a dedicated CRM (Upvise) because I like to keep my peas separate from my mash potatoes if you know what I mean.</comment>