Poultry Workers in Diapers as Bathroom Breaks Denied, Oxfam Says - <AUTHOR> http://www.bloomberg.com/news/articles/2016-05-11/poultry-workers-in-diapers-as-bathroom-breaks-denied-oxfam-says <comment><USER2> I shouldn't have read this as I was eating. Anyways, this is another example of why I switched to a vegetarian diet. I am having a hard time wrapping my brain around the idea that there are people handling food products while defecating in an adult diaper. If they can't get bathroom breaks, that means they have to wear that dirty diaper until they are allowed to leave the line.

I don't know what interest Oxfam would have in pushing false allegations about the poultry industry, so this should be taken very seriously by these companies. They need to look at managers' and team leaders' incentives around time limits, etc. If a team leader is being motivated by a strict quota, if they are enough of a sociopath it could lead to terrible working conditions to those immediately below them.

<comment><USER3> I'm not sure that being a vegetarian protects you from the effects of poor working conditions in American factories. As long as there is widespread exploitation of undocumented or otherwise vulnerable workers, I think conditions like these will continue to be fairly common.

</comment></comment><comment><USER4> Maybe this is an indication of how out of touch I am, but I don't see why there is a push to lower the cost of chicken meat.

It is already super cheap. You can get a whole rotisserie chicken at Safeway for $5 or less. That's a whole damn chicken, and the labor of someone cooking it for you!

Unless you're eating a ridiculous amount of chicken at every meal, which you probably shouldn't, the cost of chicken could be higher if it means better working conditions and humane treatment of the animal.

<comment><USER5> >Unless you're eating a ridiculous amount of chicken at every meal, which you probably shouldn't, the cost of chicken could be higher if it means better working conditions and humane treatment of the animal.

This is a privileged viewpoint.

When dealing with food policy you need to view the food system from the perspective of those impoverished.

Cheap food is a big deal, and often it's the only thing keeping millions of people in this country from starving. As such, keeping food cheap is an cornerstone of governmental policy because hunger=revolution.

<comment><USER6> Keeping food cheap, or rather, as cheap as possible makes good food a luxury item. Redistribution of wealth would be much more effective.

<comment><USER7> Redistribution of wealth faces the problem of fleeing capital from your country.

Remember that the global elite (people who control the vast majority of the capital) is highly mobile and from their perspective there's no difference between being robbed and having their wealth "redistributed".

It should also be taken into account that even if the wealth was redistributed, each poor person would only receive a minute amount, for example let's say 1 share of Google, Amazon and a few more shares.

They would almost immediately have to sell this wealth to transform it into income for current needs.

<comment><USER8> In this case, redistribution would be raising wages. It doesn't matter if "the global elite" is mobile. They're not going to move their factory farming operations outside of the US, and if they do, you tariff them when they ship the product back in.

</comment></comment></comment></comment></comment><comment><USER9> What a fucked up world we are creating. Developed countries seem to be going backwards.

<comment><USER10> It seems most companies are hell bent on lowering wages and conditions to the lowest possible denominator across the world.

<comment><USER11> That's the natural order of unregulated labor-based capitalism.

<comment><USER12> This is the natural order of human nature. But it turns out that when you let people profit off of the productive capital they own, they end up investing a significant portion of their income into creating new capital.

This process of profit motivated investment leads to an increase in goods/services being generated per capita, and consequently, less need for manual labour, more leisure time, and a higher standard of living, for the masses:

[http://www.csmonitor.com/World/2016/0207/Progress-in-the- glo...](http://www.csmonitor.com/World/2016/0207/Progress-in-the-global-war- on-poverty)

>Almost unnoticed, the world has reduced poverty, increased incomes, and improved health more than at any time in history.

^ improvements in the standard of living is the natural order of the world and even more so when there is a free market in place, as historical cross-country comparisons show us.

These attempts at making edgy anti-capitalism comments, which essentially imply that we should impose authoritarian prohibitions, that abridge the right to private property and engagement in voluntary market transaction, are embarrassing.

<comment><USER13> I think this is going too far in taking the criticism of an edge failure of capitalism as an attempt for wholesale elimination of capitalism.

</comment></comment></comment></comment></comment><comment><USER14> Oxfam press release: [https://www.oxfamamerica.org/press/poultry-industry- routinel...](https://www.oxfamamerica.org/press/poultry-industry-routinely- denies-adequate-bathroom-breaks-to-workers-on-the-line-endangering-health-and- dignity/)

Oxfam report (PDF): [https://www.oxfamamerica.org/static/media/files/No_Relief.pd...](https://www.oxfamamerica.org/static/media/files/No_Relief.pdf)

</comment><comment><USER15> I used to work in food factories while at college, it was good money (over double the minimum wage), but this is over 15 years ago..

I remember one line manager having a go at us, and blaming us for holding up the production line, he wanted us to be back on the line within the hour. When it takes 15mins to get around the factory floor and change.

Since then the work force has switched to Eastern Europeans (many Portuguese were coming over to work when I left), it really depends on who are the poorest counties in the EU. Now the pay IS the minimum wage (it would lower if it wasn't a legal requirement).

It's a shame we have this race to the bottom, with so many willing to compete. It does feel like some sectors are moving back to the Victorian era, where a persons quality of means very little (even animals have these standards). All some employers care about is that staff don't get maimed, only because of the expensive legal settlements and risk of shutting down factories.

</comment><comment><USER16> This story was charging up the front page and then all the sudden it's near the bottom of page two. What's up with that?

<comment><USER17> Maybe someone influential down voted it? I'm not sure how the algorithm works, I think most people don't, but I use sites like "hckrnews" to just sort by time, so you never have that issue.

</comment></comment><comment><USER18> If you are interested in reading more about the food industry, I highly recommend Eric Schlosser's book "Fast Food Nation: The Dark Side of the All- American Meal":

[https://en.wikipedia.org/wiki/Fast_Food_Nation](https://en.wikipedia.org/wiki/Fast_Food_Nation)

</comment><comment><USER19> Oh good, people defecating themselves while handling the poultry that ends up on our dinner tables.

But I guess it's worth it to maximize those corporate agriculture profits. Maybe with all this money we're saving on chicken I can buy some antibiotics.

</comment><comment><USER20> Another issue that was in the media recently is the increased exposure to pesticides and harmful chemicals used in agriculture. I've heard that if most people saw how their food was made they wouldn't eat it anymore.

</comment><comment><USER21> Until people are willing to pay more for the products and services they receive, complaining about the working conditions of workers is a bit of a paradox to me.

</comment><comment><USER22> This seems like something that should be fined heavily by the FDA. Definitely does not seem sanitary in the least.

</comment><comment><USER23> The article doesn't say but I imagine many of these workers are pushing up against the minimum wage. If the minimum wage is above the market wage for unskilled labor, other dignities are denied to the workers. There is plenty of non-monetary compensation workers enjoy, including free coffee, generous vacation, and yes bathroom breaks. When employers are forced to pay more that the market wage in monetary terms, they compensate by removing other benefits.

<comment><USER24> Bathroom breaks are not a form of compensation any more than than breathable air is a form of compensation. They are bare necessitates of life. That kind of thinking is what leads to this kind of dystopian shit.

</comment></comment><comment><USER25> The solution is simple. Stop buying this crap. Know your farmer and buy your meat directly from the source.

<comment><USER26> Can't tell if sarcasm or not....

<comment><USER25> I am absolutely serious and entertained by the fact my comment was down voted.

Spend any time around agriculture and you will realize that the cheapest super market meat is raised completely unethically.

To have a clear conscious 90% of my protein comes from farms and hunters I know directly. Dairy is still the tricky one I'm trying to figure out.

</comment></comment></comment><comment><USER27> I think consumers and workers will begin to demand additional evidence of not bad (hopefully, good) conditions. I want to be able to see my product from beginning to end. Every moment of the product's life, from raw materials to reception, should be captured on video and I should be able to review the video before purchase.</comment>


Simulating the Meetup API while 20,000ft above the North Sea - <AUTHOR> http://www.specto.io/blog/hoverfly-meetup-api.html <comment><USER2> Nice. Thanks for the pointer to Hoverfly.

<comment><USER3> Definitely worth checking out. They will be presenting at Software Circus London sometime soon we hope.</comment></comment>


Microsoft Patent: How to Silence your Device by whacking it off - <AUTHOR> http://www.patentbolt.com/2012/09/microsoft-patent-how-to-silence-your-device-by-whacking-it-off.html <comment><USER2> Misleading title - the document is actually a patent application, it is not yet a patent.

<comment><AUTHOR> I just used the title from the article itself, to do anything else is just as likely to get it changed by the mods. I've ceased trying to provide better, more informative titles, they just get changed and my efforts are wasted.</comment></comment>


Using Magnets to Reduce Beer Foaming - <AUTHOR> http://www.sciencedirect.com/science/article/pii/S0260877414003380

<comment><AUTHOR> A much fluffier article with video is at: [http://www.theatlantic.com/technology/archive/2014/12/how- to...](http://www.theatlantic.com/technology/archive/2014/12/how-to-keep-beer- from-foaming/383775/)</comment>


The default OpenSSH key encryption is worse than plaintext - <AUTHOR> https://latacora.singles/2018/08/03/the-default-openssh.html <comment><USER2> Spoiler: the default SSH RSA key format uses straight MD5 to derive the AES key used to encrypt your RSA private key, which means it's lightning fast to crack (it's "salted", if you want to use that term, with a random IV).

The argument LVH makes here ("worse than plaintext") is that because you have to type that password regularly, it's apt to be one of those important passwords you keep in your brain's resident set and derive variants of for different applications. And SSH is basically doing something close to storing it in plaintext. His argument is that the password is probably _more important_ than what it protects. Maybe that's not the case for you.

I just think it's batshit that OpenSSH's default is so bad. At the very least: you might as well just not use passwords if you're going to accept that default. If you use curve keys, you get a better (bcrypt) format.

 _While I have you here..._

Before you contemplate any elaborate new plan to improve the protection of your SSH keys, consider that long-lived SSH credentials are an anti-pattern. If you set up an SSH CA, you can issue time-limited short-term credentials that won't sit on your filesystems and backups for all time waiting to leak access to your servers.

<comment><USER3> And/or use a smartcard to store your SSH keys. With YubiKey 4 being as cheap as they are, there's little excuses :-)

<comment><USER2> This is what I meant by "elaborate new plans". I like Y4's as much as the next nerd, but if you're going to put that kind of energy in, spend the energy on setting up an SSH CA.

<comment><USER3> I recently rolled out YubiKey 4s to my whole organization and it was a painless experience. There's not a single file-based key left. Provision the keys, replace the old file-based keys via our configuration management tooling, done.

Wouldn't a SSH CA just introduce a whole different kind of complexity?

\- How to protect the SSH CA and its key and make it highly available? I don't want to be locked out of my bastion host after something the CA depended on broke and my certificate has just expired.

\- How to authenticate users against the CA? Most solutions I've seen use a longer-lived client-side secret, which is just as susceptible to theft than a regular SSH key, or some sort of OAuth or SAML SSO. A malicious Chrome extension can now compromise the SSO process, you still need a U2F token (like a YubiKey 4) to properly secure the SSO account, etc.

\- How to make it work with our SCM and random things like a storage appliance and various JunOS devices, which support regular SSH keys, but don't know about SSH certificates?

I would assume that Latacora is using a SSH CA, and I'm legitimately curious how you approached these challenges.

<comment><USER4> You raise a bunch of valid points. Just to answer the one about authing against the CA (I'm in the LV airport for BlackHat and my laptop battery is about to die): yes, still get U2F tokens. You're right that malicious Chrome extensions will mess you up, but that's true for everything else you run too: you need to enforce Chrome extensions via MDM regardless of what your SSH key story looks like. I consider having to SSO in a good thing: it means onboarding/offboarding/audit logging is easier.

The context for SSH CA/Teleport is SSHing into a box. When you do actually need an SSH key, Yubikeys are the best answer. (I like using gpg-agent's ssh- agent emulation mode because I find it works better on Macs, but that's irrelevant to the security analysis.)

<comment><USER3> I agree that for a large organization - which has the necessary pieces in place - it makes a lot of sense to use SSO for SSH access. The SSO is mission- critical anyway, there might not even be direct SSH access except via an authenticated proxy, there's centralized audit logging and intrusion detection, ...

However, I would argue that unless this is the case, operating a SSH CA is riskier (both from a security and availability point of view).

</comment></comment></comment></comment></comment></comment><comment><USER5> A rogue npm package is my nightmare scenario, those packages are like the only (or I wish..) untrusted code my OS is running.

That's why I came up with a small script/service waiting for an "inotify" event on a honey-pot SSH key (and some other files like ~/passwords.doc) which will immediately shutdown the computer on any kind of access of those files.

        #!/bin/sh

        inotifywait -e open --fromfile ~/.config/killer/killer.cfg --outfile ~/.config/killer/killer.log

        if [ $? -eq 0 ]; then
            poweroff
        fi

<comment><USER6> I fear this might be too slow to stop an automated attack. Passing -f to poweroff, so that shutdown(8) is not called, might help a bit.

<comment><USER7> You could also just down your network interfaces.

<comment><USER8> Don't forget about ransomware. Imagine the rogue package encrypted your files and demanded payment to get the decryption key. With public key encryption or a symmetric key that is securely deleted, there is no need for network access for the attack to succeed. A fast shutdown could protect most of your files.

[https://en.m.wikipedia.org/wiki/CryptoLocker](https://en.m.wikipedia.org/wiki/CryptoLocker)

Although I think the best way to deal with ransomware is a strong backup policy, not a tripwire shutdown trick.

<comment><USER6> Non-mobile link:

[https://en.wikipedia.org/wiki/CryptoLocker](https://en.wikipedia.org/wiki/CryptoLocker)

</comment></comment></comment></comment></comment><comment><USER9> Okay. Sure. We should move behind the kindergarten stage of KDF selection. Still, look at the threat model. We're talking about the encryption of the private key at rest. In ~/.ssh, 0700. If an attacker can even _read_ your private key file, you've probably already lost, encryption or not. That attacker can probably change your .profile to include a keylogger. You lose.

I mean, sure. Change the KDF default to something modern. But the threat we're discussing is marginal, and it's not as if the security of the SSH _network protocol_ , which is paramount, is under threat.

If you care about this class of attack, you probably care about it enough to use an SSH CA anyway.

<comment><USER4> The blog post explicitly addresses this, but you don't seem to interact with its point. We have evidence that smash and grab attacks exist, and since they affect more people, you're more likely to get screwed by something like the recent eslint-scope thing than a targeted attack where the attacker does shit to your .profile.

That said; yes: you should have long-held auth on a hardware token and then use an SSH CA for temporary auth.

</comment></comment><comment><USER10> This argument seems to hinge on the following statement that I don't understand:

> an SSH key password is unlikely to be managed by a password manager: instead > it's something you remember.

Why is that the case? I've always been just as likely to use a password manager for my SSH key password—after all, I'm usually prompted for my SSH key password from my terminal, which accepts pasted passwords just fine.

Am I missing something?

<comment><USER11> Here's my anecdata:

I didn't know much about ssh keys when creating, so I followed directions online. The directions I followed created my key with no password. Soon my Mac encrypted the ssh key by itself, without my intervention (!), to use my Mac logon password. The encryption format was the old ssh format the article complains about, even though my openssh supported the new one. The password I use to sign into my computer is not grabbed from a password manager.

<comment><USER12> What? Are you saying macos changed the key to be encrypted SSH format? That doesn't sound right. In fact, implausible.

</comment></comment></comment><comment><USER13> >You might ask yourself how OpenSSH ended up with this. The sad answer is the OpenSSL command line tool had it as a default, and now we're stuck with it.

Given that (as far as I know) the decryption is handled only on the client side, why does an old default matter? Does it break any kind of compatibility to change that? Why only use the better algorithm for EC keys?

And even if it did break compatibility it's not like it usually stops the OpenSSH folks, old ciphers and hash functions are deprecated regularly (I have to whitelist a bunch of ciphers at work to connect to legacy systems running an old dropbear).

<comment><USER14> Some people move private keys. You shouldn't, but people do. And so they expect that an encrypted private key file from their brand new Mac will work when pasted into a five year old CentOS install.

<comment><USER13> Seems like simply issuing a warning on key creation "this key uses a newer, safer encryption scheme but as a result might not be directly portable to older versions of openssh, if that's an issue use <someflag> to use the older, weaker scheme instead" would probably solve the problem in 99% of the cases. After a few years you might remove the warning and move on.

For this type of applications security should trump backward compatibility, especially when in this case the breakage is fairly limited and easy to work around.

</comment></comment></comment><comment><USER15> I'm assuming that practically everybody who is a developer on ssh-keygen knows about this. This is not a bug, right?

It's basically bad usability, where the default is unsafe, and in order to make it safe, you have to know what you're doing. Or is it like the author writes in 'TFA' that "we're stuck with it", because it used to be a default in OpenSSL?

Some people will say, "if you're using ssh-keygen we can expect that you know what you're doing". But this is a wrong assumption that gets people into trouble. I'd even say a minority of people who invoke ssh-keygen really know what's going on in detail and what providing a flag like "-t ed25519" actually does. I certainly don't, and I've had to generate quite a few ssh keys so far.

<comment><USER4> The new format has been around for a pretty long while (2013). I think it makes sense to upgrade to -o. While it's obvious to developers (I hope!) it's not obvious to most end users I think :)

<comment><USER16> not only does it seem like this is a better default, this option is awfully well-hidden on my system; doesn't show up in the short help or the example usage in the man page; gotta scroll down to find it in the exhaustive list of flags

<comment><USER17> The utility also does not warn about insecure defaults.

</comment></comment></comment></comment><comment><USER18> This is a decent article with a click-batey title.

The argument that it's _worse_ than paintext hinges on you both using a weak password and using the same password for something else. If you don't do either of those things then it's much better than plaintext, although technically if you use the same strong password for something else then you may have weakened the password by using it for old-format ssh ... but it still has to be brute forced.

<comment><USER4> If you select from a 10k word list, you get 13.3 bits of entropy per word. 4 of those get you 53 bits of entropy. One p3.16xlarge does 450GH/s. So, as a first order approximation: 2 __53 / (450E9) = 2E4 or about 6 hours. Sure: you don't get to keep that performance, but we're talking a day. What kind of passwords do you have that make it "much better"? Or are you saying that already counts?

<comment><USER19> 53 bits of entropy is basically the same entropy as a 9 character alphanumeric password. That's not a strong password to begin with and makes this calculation senseless. Redo that calculation with 71 bits (12 char alphanumeric, still not really long) and it takes close to 200 years, thus making it impractible.

The problem with these word lists is, that they yield rather low entropy compared to random strings, when the attacker knows that a word list is used. That's because one word has just a little bit more entropy than 2 alphanumeric characters.

<comment><USER4> Do you have evidence that passwords for SSH keys are as good as you claim?

<comment><USER20> ...conversely, do you have evidence most people pick their passwords from a 10k word list?

And the Oxford dictionary has ~171k words, so not sure where a 10k list even comes into play

<comment><USER12> I think haveibeenpwned is good evidence people choose weak passwords and reuse them.

DICEWARE uses ~8k words, chosen so that people can remember and spell them.

<comment><USER20> haveibeenpwned provides no such statistic, other than reuse (75% of original set) -- a breached password is unrelated to its strength.

The simple fact that the HIBP password list contains 512 MILLION unique passwords...

<comment><USER12> > a breached password is unrelated to its strength

But most of them were weak. And most of them have been cracked by _hobbyists_.

[https://blog.cynosureprime.com/2017/08/320-million-hashes- ex...](https://blog.cynosureprime.com/2017/08/320-million-hashes- exposed.html?m=1)

512 MILLION is not a large number of passwords to check. What do you think the hash rate of modern GPUs/ASICs is?

[https://www.troyhunt.com/86-of-passwords-are-terrible-and- ot...](https://www.troyhunt.com/86-of-passwords-are-terrible-and-other- statistics/)

<comment><USER20> You're forgetting the salt added. Compared to the original post I commented on, 512 mil is way larger than 10k. So it's 512 mil _known_ passwords, times however large the salt is...it's not trivial -- and their 10k list was expected at 6hours...

Extrapolating, 10k:6hrs == 512m:35 years

<comment><USER12> A GTX1080 gets 25GH/s on MD5, that is 1.5x10^16 per week. The salt is known -- makes rainbow attacks impractical, but doesn't reduce the hashing rate.

Martin Kleppman explained the problem back in 2013: [https://martin.kleppmann.com/2013/05/24/improving- security-o...](https://martin.kleppmann.com/2013/05/24/improving-security-of- ssh-private-keys.html)

<comment><USER20> I conveniently forgot the salt is public ::facepalm::

I also was using the OP numbers, verses trying to do any math or research myself first ::second facepalm::

<comment><USER12> It alright, that's why we have HN - not to be always right first and fastest, but to go deeper.

</comment></comment></comment></comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER21> I'd suggest following the excellent guide at [https://github.com/drduh/YubiKey-Guide](https://github.com/drduh/YubiKey- Guide) and using one of your GPG subkeys (kept on a hardware device like a YubiKey) for SSH authentication.

</comment><comment><USER4> I wrote this; happy to answer questions.

<comment><USER22> Beside compatibility, is there any reason _not_ to use Ed25519 keys for everything?

<comment><USER4> Nope! Ed25519 is great and honestly I think the compatibility concerns are overblown. It was introduced in 2014. If you are running four year old SSH you have other problems, like probably RHEL or some nonsense.

That said: Ed25519 is a local optimum: the bigger win is to not have long-held credentials at all, and instead use an SSH CA or something like Gravitational Teleport. Doesn't work for GitHub though.

<comment><USER23> In a world where you don't have long held credentials - how do you get the short term credentials?

<comment><USER24> We do this:

Master user records in an identity/SSO system. We use ADFS.

Use a protocol which provides a portable "signed", temporary credential. We use SAML but OIDC also works.

Have a command-line client which auths to the SSO and then relays an identity proof to a trusted component (lambda, cloud function, dedicated instance, whatever your policy says is ok). The identity proof is just a saml assertion or oidc token.

Have trusted component validate the identity proof from SSO and generate time limited credentials (we issue ssh, kube and iam). Our client then auto-xfers those creds up to jumpbox but you could drop them on workstation instead if your policy allows.

<comment><USER25> I currently work in academic environments and I don't have much faith in the SSO systems. I thought about this, but often the SSO credentials are also the email password – the one password that gets entered and stored just about everywhere for the average user. I'm not willing to bet the security on a user's main login/email password, which seems to be a common setup. With that password or even just access to a user's main mailbox, a smart attacker might get through multiple layers of security by simply convincing services or staff to reset credentials.

Though it might work with a second, more limited (not-so-)SSO system for specific users and environments.

<comment><USER4> You're right that shitty systems train users to be phishable -- by typing their password all over the place -- all the time, not even counting the poor default password hygiene most users have. This is one of the reasons U2F/WebAuthn is so incredibly valuable.

</comment></comment></comment></comment></comment></comment></comment><comment><USER26> How about using macOS's Keychain to store keys?

On recent versions, need this in your ~/.ssh/config:

        # for Keychain (acting as agent) to load the ssh keyfile
        AddKeysToAgent yes
        # For ssh to then use Keychain as an agent
        UseKeychain yes

<comment><USER27> You can use the keychain to store keys, but if the key is ever saved in the old (broken) format, you've got a problem.

</comment></comment><comment><USER28> If you have a recent MacBook, use [https://github.com/ntrippar/sekey](https://github.com/ntrippar/sekey) for SSH keys. Private key is stored in the built-in HSM (Secure Enclave) and access is controlled by biometrics (TouchID). You can do the same with a Yubikey, but it's not quite as good because a) you can lose your Yubikey easily and b) there's no biometrics.

Private keys stored on filesystems is an antipattern.

<comment><USER29> Ahh, if only Apple released a non-touchbar MBP with Touch ID! I'd have used this in a heartbeat.

</comment></comment><comment><USER30> My ssh key is stored in a yubikey. Haven't had to type a password for ssh purpose in a long time!

<comment><USER31> A TPM chip is also easy to use with libsimple-tpm-pk11. Not a perfect solution but at least the private key cannot be stolen and misused without direct access to the computer.

</comment></comment><comment><USER32> If you have really old clients you may apparently be able to do this instead:

[https://martin.kleppmann.com/2013/05/24/improving- security-o...](https://martin.kleppmann.com/2013/05/24/improving-security-of- ssh-private-keys.html)

</comment><comment><USER33> >"You might ask yourself how OpenSSH ended up with this. The sad answer is the OpenSSL command line tool had it as a default, and now we're stuck with it."

Could someone elaborate on this? Is this saying that the ssh-keygen utility shells out to the openssl-command line tool which at one point defaulted to md5 for encryption? If this is the case why would be stuck with it?

<comment><USER4> Backwards compatibility. I don't think it shelled out, but close enough.

</comment></comment><comment><USER34> It's best to assume all passwords need to have sufficient entropy to withstand a brute-force attack on some super fast hash until proven otherwise.

I didn't change my macOS password to 8-characters (to save myself 20 seconds a day) until I thoroughly researched what key-stretching was being used under the hood.

</comment><comment><USER33> The author states:

>"Finally, most startups should consider not having long-held SSH keys, instead using temporary credentials issued by an SSH CA, ideally gated on SSO."

Can someone explain what "gating" SSH CA issued key with SSO means? How would SSO "gate" the keys?

<comment><USER4> You use SSO with strong authentication to sign a temporary credential for SSH.

<comment><USER33> Thanks, might you know which SSO implementations support this?

<comment><USER4> I like Teleport. It's not an SSO implementation but if you pay Gravitational you get SAML. BLESS, the Netflix solution, relies on you being able to call a Lambda. You can SSO that as well via STS' AssumeRoleWithSAML. (But be careful, AWS SSO should be like the last SSO you implement, generally hardening IAM is super complicated, talk to me for more details. We owe y'all a bunch of dinky "here's how you do IAM" blog posts.)

EDIT: I previously incorrectly claimed that you need to pay Gravitational for Teleport SSO. That is incorrect: you only need to pay for _SAML_, specifically -- I forgot that you can GitHub auth into it, which is a form of SSO. (Though for most of our customers I think that single trust store is a core part of SSO, and GitHub isn't a good SSO by that metric, by vritue of account reuse and the fairly tenuous links between users and organizations. GitHub does a great job of modeling open source interactions, but that model falls over a bit when translated to commercial software engineering orgs.)

<comment> old-gregg The open source edition of Teleport has SSO support for logging via Github [1]. The enterprise version adds enterprise SAML implementations like Okta, Auth0 and things like ADFS.

[1] [https://gravitational.com/blog/replace-static-ssh-keys- with-...](https://gravitational.com/blog/replace-static-ssh-keys-with-github- oauth/)

<comment><USER4> Whoops; my bad!

</comment></comment></comment></comment></comment></comment><comment><USER35> Use SSH keys generated and stored on some sort of PKCS11/PIV hardware device. It's relatively easy to do now. Don't trust a general purpose computer to keep your keys secure.

Better yet, use U2F where you have control of how you are authenticated.

</comment><comment><USER36>
        It's tricky to find out what this DEK-Info stuff means

This is really where the modern crypto protocols and libraries are doing well imo. Even if something that opaque is implemented perfectly, it presents a risk.

</comment><comment><USER18> tl;dr to move to the newer more secure format use

      ssh-keygen -o -p -f file_name

such as:

      ssh-keygen -o -p -f ~/.ssh/id_rsa

not necessary for ed25519 as it can only be stored in the new format.

</comment><comment><USER37> Filed [https://bugs.debian.org/cgi- bin/bugreport.cgi?bug=905407](https://bugs.debian.org/cgi- bin/bugreport.cgi?bug=905407) to change the Debian default.

</comment><comment><USER38> Is anyone aware of a successful infiltration of a system that occurred by stealing an encrypted SSH key with a reasonably good password and successfully decrypting it?

<comment><USER39> If such an infiltration is successful enough, nobody (besides the attacker) would be aware of it. :)

<comment><USER38> It's the damage we'd notice -- exfiltration of data, malicious destruction, etc. The intrusion is but a step towards the real goal.

<comment><USER39> The damage wouldn't necessarily be noticed for what it is. What if such exploit was/is used to get more compromised zombie boxes into botnets for hire (such as the one currently spamming Freenode and other IRC networks for the past week or so) ?

</comment></comment></comment></comment><comment><USER40> What are you thoughts on using Krypton? [https://krypt.co](https://krypt.co)

</comment><comment><USER41> All my ssh key passwords are generated from password managers. They are random and strong.

</comment><comment><USER42> What if you generate the public and private keys without a password but keep it blank?

</comment><comment><USER43> I'm finally vindicated for not using a password on my key :P

</comment><comment><USER44> Does this affect non-RSA key types too? I use ecsda25519.

<comment><USER45> > How do you fix this? OpenSSH has a new key format that you should use. "New" > means 2013. This format uses bcrypt_pbkdf, which is essentially bcrypt with > fixed difficulty, operated in a PBKDF2 construction. Conveniently, you > always get the new format when generating Ed25519 keys, because the old SSH > key format doesn't support newer key types.

</comment></comment><comment><USER46> So is that what happened? Somebody got a hold of one of the developers' private SSH keys, and cracked the encryption?

</comment><comment><USER47> Seems like gpg auth would be a much better choice the ssh keys

</comment><comment><USER48> Nice deflection of the real madness here that a compromised npm package gets to read stuff in your user directory.

<comment><USER49> I mean, of course it does. Most people run their development environments as their own user, and most package management systems have post-install script support.

Installing random software from the internet is problematic.

<comment><USER50> I'd be interested in running my dev environment with a dedicated user account -with no access to the main account's personal files, credentials, etc-, do you know of any guides for doing so?

(I could just give it a shot, but I reckon there will be gotchas)

<comment><USER12> What platform? GUI or shell?

Docker/LXD or a dev VM lets you access both simultaneously. Or create a separate user, but not as secure or convenient.

<comment><USER50> macOS. Not much interested in VMs, for efficiency.

Yeah I was playing with a separate user account, could get some basics working but I wonder how far could I get with that.

What are the bigger security risks for that approach? Assuming constrained file permissions, and that no secrets are in ENV ([https://gist.github.com/telent/9742059](https://gist.github.com/telent/9742059) )

<comment><USER12> A normal user has full access to the kernel API. Always kernel info leaks, occasional easy exploits.

On macos you can use Apple's native sandboxing. See for example [http://mybyways.com/blog/creating-a-macos-sandbox-to-run- kod...](http://mybyways.com/blog/creating-a-macos-sandbox-to-run-kodi)

</comment></comment></comment></comment></comment></comment><comment><USER51> Use key AND interactive password. This way attacker will have limited rate of password guessing and you will now from logs that your key is compromised. Your key will be used only for first step of authorization. You can slap additional password for that key but it is not even needed. Additionally from what I remember Ed25519 keys are stored by default in the new format.

<comment><USER4> Don't do this. Get an SSH CA and temporary credentials, and make your authentication to that SSH CA actually good (e.g. SAML with mandatory U2F).

<comment><USER52> What's the difference between SAML+U2F vs smartcard stored SSH key? Both cannot be easily stolen or abused. Additionally Yubikey have touch-to-use policy that further protects the key usage.</comment></comment></comment>


CRMs Are Not Sales Software  - <AUTHOR> https://elasticsales.com/blog/2012/07/13/crms-are-not-sales-software/ <comment><USER2> This makes it sound like the author hasn't really used Salesforce or other tools, which go way beyond CRM in delivering productivity tools for sales people. There is an entire ecosystem around extending the Salesforce platform to service particular needs that throughout and organization. IMO I think this startup would be better served by establishing credibility in their market space instead of making dubious claims and dogging the market leader.

<comment><AUTHOR> I actually have and think Salesforce is a great CRM solution. But that's not the point of this piece. The core argument is that CRMs are not sales software and not the right interface for sales reps as core user group. If you look at the UI/UX the closest thing to most CRMs (including Salesforce) is Amazons' AWS backend panel.

Think about that. The interface for engineers to manage servers is almost identical to the interface we give sales people to manage customers :)

We think there's something wrong with that and have tested it already with many sales reps and seen great results.

Just as a bit of background: we are currently running sales campaigns for many venture backed startups in the valley and are very familiar with the space.

Would love to invite you to visit our little "sales lab" in Mountain View and hear your feedback :)

<comment><USER3> During OracleWorld keynote, after Oracle bought Siebel, Larry said something like: "there are only 2 useful features in a CRM system - forecasting and analytics - and everything else exists simply to collect data for these features." See if you can find the original quote.

<comment><USER4> Larry is exactly right. I have never come across a company that believes their CRM is going to help them drive sales or has tried to trick their salesforce into using CRM by billing it as "sales software."

In my experience, a CRM is typically fed leads by a marketing automation system or bulk record loading from offline events. All the reps need to do is sort their list of leads by priority, call on them, and flip the status to "meeting" or "closed/won" when they're done. That's nowhere near data entry slavery, IMO.

With a CRM, we want to ask: * How full is our funnel? * Where are our leads coming from? * What's my projected revenue this quarter? * Is anything stuck? * Who isn't working their leads fast enough?

All of these things are hugely valuable and none of them have to do with being a "communication" tool.

<comment><USER5> You are right. But just answer honestly one question - is this data that sales people provide for their reports really 100% honest?? If you had CRM on top of the communication tool - or even better - CRM reports like pipeline would be in real-time generated based on real life customer interactions - that would be much more valuable right?

That is exactly what we do with Discourse ( <https://discoursehq.com> ) - there are couple of usecases where this makes a lot of sense:

\- real-estate brokers can track pipeline based on real life customer interactions \- car sales \- financial services sales \- telco services sales

We have integrated Discourse with Facebook fan pages so leads generated on fan pages can be immediately converted into prospects - right there on the spot.

We have a growing number of customers and we are looking for more :)

</comment></comment></comment></comment></comment><comment><USER6> Agree on the need to make sales tools more usable by sales people. The two biggest issues we've identified with CRM usage are around (1) compliance (e.g., Inputting sales info per company policy) and (2) currency (e.g., keeping the sales information fresh and up to date). The design point for most CRMs is as a corporate reporting tool, in essence a static db of outdated or missing data. The reality is that most CRMs fail to add value to a typical sales rep's daily effort, and the output (typically exported to Excel) fails to provide the level of insight or information to correctly "money ball" a sales team or manage a pipe. This requires a herculean effort of people and time with layers of sales management and sales ops to provide the rigor and discipline required to forecast a quarter. Net, net -- a hairball. Here's a good read if you are interested in a well thought out understanding of the issue: [http://birch.co/post/19234996380/the-failure-of-sales- analyt...](http://birch.co/post/19234996380/the-failure-of-sales-analytics). As CEO of Foretuit (www.Foretuit.com), the selling process is ripe with inefficiencies and inherently ineffective. Hence a huge area for disruptive tech. While no one vendor (established or startup) has cracked this code, the opportunity to leverage the $18 billion each year that orgs spend on CRM presents a solid opportunity now and in the future.

</comment><comment><USER7> It sounds like your gripe is with companies who have created CRMs with additional features and packaged them all together as a do-all be-all 'Sales Software'. That is not the entire CRM market. Not all CRMs are marketed like this.

As a CRM, a CRM is useful as a CRM. CRMs are by no means 'scams' or 'not useful' when youre using them as they are intended.

Here is the first paragraph on the SugarCRM website: "Sugar is an affordable and easy to use customer relationship management (CRM) platform, designed to help your business communicate with prospects, share sales information, close deals and keep customers happy."

See how they 2 of their 4 points are about sharing information and not sales? That is a properly marketed CRM. Can a CRM help you make sales? Absolutely. CRMs can help you get organized so you can stay on top of customers & know where youre at in your sales.

Should this be all your use to drive sales? Absolutely not. Why? Because it's a customer relationship manager and not a do-all be-all sales tool.

</comment><comment><USER5> We have built Discourse ( <https://discoursehq.com> ) with exactly that vision - that CRM is not a sales tool and good communication platform for sales teams, customers and partners will be much better. Anyone interested to learn more can see also <http://blog.smartupz.com> EDIT: this comment may sound like a plug but I'm really excited to see CRM discussion on HN and had to jump in :)

</comment><comment><USER8> Steli is right - in some cases. However, I have always wondered CRM systems are built with B2C subcribtion products in mind? In most cases it is hard to apply this CRM process to for example B2B distribution of phycsical goods. B2B orders usually require tons of seller/buyer collaboration and configuration. The only way to solve this is to combine CRM with B2B e-commerce platforms where orders can be collaboratively configured. Anybody tried a solution like that?

</comment><comment><USER9> I find CRMs are better once you have a client. What you are talking about building seems closer to lead management software. While CRM are not themselves communication software, you can easily integrate communication software like skype or leaddesk into salesforce and it's pretty much there. I would still like to see a better solution, as I don't like the salesforce pricing (yearly contracts) and some other things...

</comment><comment><USER10> love. i want to see your setup steli :) and if you have not already done so. see if you can find a way to add rapportive findings to your tool. being able to see who is emailing you and connect with them in realtime is an incredible sales edge.</comment>


Computer scientists take over electronic voting machine - <AUTHOR> http://www.physorg.com/news169133727.html <comment><USER2> _In 2007, Shacham first described return-oriented programming, which is a powerful systems security exploit that generates malicious behavior by combining short snippets of benign code already present in the system._

The only references I can find to _return-oriented programing_ are either by Shacham (who "invented" it) or his grad students. Is this another name for a technique that's been around for a while, an academic who's making it sound revolutionary to get grants, a legitimate new tool for analyzing exploits, or just some PR crap?</comment>


I Wish Headlines Did Not Have Capital Letters at Every Word, FFS, FFFS - <AUTHOR> <comment><USER2> What is the origin of capitalization. Is upper and lower case really a reference to cases full of printing press letters?

</comment><comment><USER3> Why does it bother you so much?

<comment><AUTHOR> Because when I read a headline like "Power Worth Less Than Zero Spreads as Green Energy Floods the Grid (bloomberg.com)" I'm like... wait, is "Zero Spreads" the name of a company, or "Green Energy", or "Energy Floods"? It just takes a lot longer to process.

</comment></comment><comment><USER4> "I Wish Headlines Didn't Capitalise Every Word" \- fixed that for you.

<comment><AUTHOR> Much appreciated</comment></comment>


It's 2020 and I'm building a CoffeeScript playground - <AUTHOR> https://github.com/huytd/coffee-now <comment><AUTHOR> In 60 lines of CoffeeScript :D</comment>


Pentagon's Cyborg Insects All Grown Up - <AUTHOR> http://blog.wired.com/defense/2008/03/for-years-now-p.html

<comment><USER2> This really scares me.</comment>


In California, Houses Burned. So Did the Toxic Chemicals They Contained - <AUTHOR> https://www.nytimes.com/2018/11/29/us/california-fire-chemicals.html <comment><USER2> Burned bottles of bleach? This seems like a bit of an over reaction, no? Bleach is relatively benign and decomposes pretty quickly with heat.

I'd say the burnt plastic is probably more a risk, but there is plenty of that all over the US.</comment>


Show HN: my weekends fashion project - <AUTHOR> http://re.mu this project started at a local hackathon and I spent another 4 or 5 weekends polishing it up. My girlfriend, who I brought along to the event, said she was getting 'tired of her friends asking her what she will be wearing tonight or the brand of the foundation she is using right now'. A digital wardrobe, for the lack of better words.
It was a fun project and some of the early adopters are her friends. And since this site is more female oriented, here's my manly profile: http://re.mu/alvin
I highly recommend bringing your significant other to a hack event. <comment><USER2> I see this growing into something if:

\-- You remove the profanity from you profile. It takes away from the concept.

\-- You allow people to easily share it through a mobile device. Kind of like -(SMS)- "Hey, tell me if you think what Im wearing is hot or not?" (/SMS) Then they include a link to their profile with their clothing combination.

Heck, if I could text my wife and ask her if what I'm wearing is up to modern fashion standards (I can't dress), and share with her a link for her (dis)approval, then my life would be much better. I hate arriving to some family gathering and listening to her say "That's what you wore? The Pac-Man Shirt?"

PS. I love my Pac-Man shirt, but would love to have someone upvote or downvote me wearing it depending on the occasion.

<comment><AUTHOR> yes mobile is next. the site is all broken in mobile browser as of now. i need to figure out which mobile angle to tackle first come weekend. (app/website/sms).

love the idea of asking for votes for outfit on certain occasions. thanks! related: i am also thinking of adding a new section called 'style' where you can mix and match your items from your collection and ask for votes.

<comment><USER3> Regarding the voting, I actually had a mobile app idea a while back, that I never got around to coding.

The concept was snapping pictures of clothing through the app, of clothing you want to buy, but couldn't decide on which to buy. Then other people would come in and vote on which piece you should buy. Ideally, you would be able to get feedback/poll results within a few minutes of posting. Of course, this would depend on having a large user base for it work properly.

I don't know how it would fit into what you're doing right now, maybe the same kind of thing but for what you're going to wear today (instead of what you're going to buy).

<comment><AUTHOR> definitely needs to be close to a real-time voting feedback. I've seen some of my friends shop - they just hop from one store to another in the space of minutes, even if they find things they like.

<comment><USER3> Haha yeah, real-time for sure. I don't go shopping much myself, but it is something my friends say they would use. Maybe that's why I haven't gotten around to doing it...

If someone were to do something like it, it would definitely be tricky at the start.

</comment></comment></comment></comment></comment><comment><AUTHOR> this project started at a local hackathon and I spent another 4 or 5 weekends polishing it up. My girlfriend, who I brought along to the event, said she was getting 'tired of her friends asking her what she will be wearing tonight or the brand of the foundation she is using right now'. A digital wardrobe, for the lack of better words.

It was a fun project and some of the early adopters are her friends. both our profiles: <http://re.mu/connywu> <http://re.mu/alvin>

I highly recommend bringing your significant other to a hack event.</comment>


Introducing 2nd Generation IPU Systems for AI at Scale - <AUTHOR> https://www.graphcore.ai/posts/introducing-second-generation-ipu-systems-for-ai-at-scale <comment><USER2> Half-floats in 7nm HW, a ML dream come true.</comment>


Microsoft: Mac Users Switching to Surface at Record Rates - <AUTHOR> https://9to5mac.com/2016/12/12/macbook-pro-disappointment-switching-surface/ <comment><USER2> This is a dupe of an existing discussion: [https://news.ycombinator.com/item?id=13158605](https://news.ycombinator.com/item?id=13158605) (Can a mod merge them?)

One of the things I've noticed that's pretty huge is that a lot of Mac- exclusive apps like Affinity and Tower have recently made full native Windows versions in the last few months. Developers who felt their customer base resided entirely or primarily on Mac seem to feel there's a market on Windows for artists and developers that there hadn't been before.

<comment><USER3> Yup. Comments moved to that thread. You might want to post your second paragraph as a new comment there too.</comment></comment>


Learn Front&Back end webdev or Back end for Devops – which is better for remote? - <AUTHOR> Im currently learning frontend but i stopped because i felt like, employability-wise, backend skills are a better option due to the easier transition into devops/cloud. but then people suggested fullstack is just as good (front+back) for remote employability. so i am not sure if i shoould continue learning frontend or if i should jump to python in the backend? keep in mind, i am from a developing country <comment><USER2> Is it frontend or backend problems that keep you awake in the half hour or so before you fall asleep? Which gets you out of bed early the next morning?

Truly think about this, and I think you'll have your answer. There's lots of jobs at the moment for both tracks.

<comment><AUTHOR> this is such a great answer. thank you, i'll really think about this!

</comment></comment><comment><USER3> Random advice from the internet. Just finish. Then learn the other. Good luck.</comment>


Symbian CEO: Android just another Linux platform - <AUTHOR> http://www.infoworld.com/article/07/11/06/Android-just-another-Linux-platform_1.html <comment><USER2> Well, I am too tired to translate today, but I _did_ write about the implications of an open platform like Android in a blog I write. (in portuguese: <http://log4dev.com/2007/11/06/pc-20>).

To sum up: I believe that Android, today, reminds of the idea of the IBM PC standard in the early '80s. Real innovation will only happen in mobile devices when developers have a more consistent platform and know that no one major player (say, Apple) controls everything.

<comment><AUTHOR> but isn't apple coming up with their iPhone SDK in the next coming months?

</comment></comment><comment><USER3> The Apple II and IBM PC? Those are just yet another von Neumann platform. We won't have to worry about 'em.

</comment><comment><USER4> Symbian is seriously threatened by Android; even if Android isn't very good some handset makers may switch to it simply to avoid Symbian licensing costs. AFAIK Symbian has no other business to fall back on.

<comment><AUTHOR> that is an interesting point and the way he stated his opinion and the timing of it sounds like he is a bit threatened as well

</comment></comment><comment><USER5> This guy is an ass. As with all platforms developers will have the last word. Developers will usually choose the most open and widely used platform ie google

</comment><comment><USER6> Oh. Symbian - not Sybian (<http://www.sybian.com/>).

</comment><comment><USER7> Famous last words.

</comment><comment><USER8> And symbian is terrible?</comment>


Engineers Should Blog - <AUTHOR> https://insights.excitingrole.com/why-engineers-should-blog-88ecf97d2628#.olwjketnr <comment><USER2> Engineers should blog publicly when they have something to say. Something useful for their colleagues. Engineers shouldn't waste time forcing themselves to blog instead of work just to push their career forward: frequently they just expose they don't have anything to say in extremely unreadable way. What a waste of time for everybody.

Soft skills helps you grow as an engineer, it's true, but I think it's important to understand that not every exercise should become a public material.

But, in a generation publishing their every 2nd gym workout on instagram, who am I kidding anyway.

<comment><USER3> > Engineers should blog publicly when they have something to say. Something > useful for their colleagues.

This sounds a lot like saying, "You should only learn to code when you have something useful you want to build. Something useful for other people".

You can't write a good blog post without having already written some number of bad ones. If you think you might someday have something to say, you should practice blogging.

<comment><USER4> > You can't write a good blog post without having already written some number > of bad ones.

To add to this, I'd say: if you don't have a writing habit, the barrier to actually writing something when you _do_ finally have something useful to say will be incredibly high.

I am willing, however, to give the GP the benefit of the doubt because they said "Engineers should blog publicly when they have something to say", not "Engineers should blog when they have something to say". Practicing writing does not mean that you have to publish everything.

<comment><USER5> So how do you get feedback for non-public work? On _technical_ blogs, I always read the comments. Even for obscure/somewhat poorly written articles. Because someone who knows more than the author will sometimes leave feedback which will lead you in a better direction and expose you to more ideas.

And thankfully, technical blog articles don't attract too many comments on average. Quite often I find that a blog article on a technical point _actually_ advances discussion on that idea.

All I would say is to make a honest effort. Try and do a basic rewrite before hitting publish.

<comment><USER6> People have been practicing privately and only occasionally getting checkpoints of public feedback across all kinds of skillsets for centuries. It's silly to act like we don't know how to practice in private.

Yes, you need a good guide, good general principles so that you're not practicing in the wrong direction. And yes, you need occasional "recitals" where you test audience reactions. But 99% of the work involved in developing any skill is just raw, rote repetition that most audiences are not only not interested in, but actively avoid.

<comment><USER5> >> People have been practicing privately and only occasionally getting checkpoints of public feedback across all kinds of skillsets for centuries. It's silly to act like we don't know how to practice in private.

Fair enough. I can see why my comment came across as if I said there were no other options.

But my point is to use resources at your disposal. One of the amazing resource at our disposal today is the ability to cost-effectively publish a half-baked idea on our website knowing that a) that could still be useful for a small section of people and b) its mistakes could be corrected by another small section of people who know the topic in greater detail and c) all this happens in such a way that everyone is, quite literally, "on the same page".

</comment></comment></comment></comment></comment></comment><comment><USER7> I love blogging. The OP makes some great points about how it exposes you to a different set of people than answers on stackoverflow or HN do.

I have been blogging for over a decade and have definitely had some positive experiences, including a co worker finding a post when searching for a solution and an interviewer checking out my blog and mentioning it. I have also had a small bit of work come to me directly because of my blog. (However my blog is pretty unfocused in part because I am a generalist and primarily wrote for myself. I am sure a focused blogger could do better.)

However, the most important thing is to get started with some kind of public presence. If SO or HN or github are what you feel comfortable with, start there. Don't be an anonymous programmer.

If you are looking to blog, I think you should plan to stick with it for at least a year. Nothing is sadder than the abandoned blog. Here are some motivational tips: [http://www.mooreds.com/wordpress/archives/2129](http://www.mooreds.com/wordpress/archives/2129)

</comment><comment><USER8> I'm surprised he didn't encounter the 4th reason for not blogging:

4\. The topics I want to blog about are controversial.

That is, strong but controversial opinions on certain technologies are just as likely to help you get noticed as hurt you (i.e. get noticed in a negative way.) Even if the topic isn't technically controversial, it can still be a negative. Revealing that you helped {religious minority church} set up their network, or that you solved a problem with {porn website} can also put a mark on you that is not automatically good. Heaven forbid you worked for/supported {political organization} this election cycle.

So the answer is, of course, to self-censor. You have to strip out your opinion and context and only blog about technical details that you are very confident are correct. Keep your jokes gender neutral and your insights limited to your profession.

But that's boring. That's not blogging, it's writing a corporate memo. We've just ratcheted up the difficulty, limited the new thoughts you're allowed to think, and made you invisible to all hiring managers who can't recognize when your technical manuscript applies to their industry.

<comment><USER7> I don't know if this is strictly true. I don't deny that blogging about controversial subjects will turn off possible employers or close doors. That is definitely something to be aware of.

But you could look at the flip side of that and say that this is actually filtering out opportunities wouldn't be a fit. Much like qualifying leads in sales is something you want to do as quickly and easily as possible, doing the same for employment opportunities can help you focus on organizations where there is a culture fit.

With respect to your example, if an employer was offended by your support for a minority group or political candidate, is that an employer you'd feel comfortable bringing your whole self to work at?

I may be hopelessly Pollyanna, but I think I'd avoid that type of situation. If you are a software developer and those are the only type of opportunities you have access too, I agree, you should avoid blogging about such controversial topics. Or get good at remote work.

<comment><USER8> Strictly speaking, the only way my post can be untrue is if "fear of controversy" was _not_ a reason people avoided blogging, or they feared controversy for an entirely different reason than the one I provided.

</comment></comment></comment><comment><USER9> No, every engineer should not blog. It is hard enough to find the right information when you have to shift through clickbait and the signal-to-noise ratio is abysmal.

If I was interested in assessing someone's caliber, I'd rather look at their Github than their blog. Anyone can write a blog post, not everyone can write good code.

Blog if you have some insight into technology that hasn't been already elucidated or if you disagree with what's out there.

Having said that, I plan to start my own blog at some point. What will I be writing about? I'll start with reviews of technical books. Why? Because I have read a couple since the beginning of the year that I was unhappy with and had to return, but bought them in the first place because other people said good things about them. Hopefully if someone in the future considers them they will come across my view and take it into consideration.

<comment><USER10> I don't particularly want everyone publishing code, really.

"not everyone can write good code"

Not everyone can tell what's good, what's not, and why.

And searching through 20x the amount of code now to find something that a) works, b) is documented, c) is kept up to date (and is also accurate/correct) - just gets harder the more 'stuff' gets published.

</comment></comment><comment><USER11> Yeah I agree with this that most software engineers should consider this. It's another way to set yourself apart from the masses that most people will never put in the time and effort to do. The idea that other people put forward that you should only write about things if you think your ideas are innovative always seemed silly to me. A lot of things we think of as trivial could end up being useful and important information to someone else. Besides how are you supposed to know if what you're saying is 'innovative' before you say it and get feedback on it?

<comment><USER12> > _A lot of things we think of as trivial could end up being useful and > important information to someone else._

This is very true. There have been many, many times when there's a technical article on the top of HN on a topic that I would never have imagined writing about simply because it seemed too basic or "entry-level". There have even been a few topics that I had actually considered writing about but dismissed it, thinking to myself "nah, everybody already knows that".

<comment><USER13> Some of the highest traffic blog posts I've written have been on the "entry- level" side of things.

<comment><USER14> Now that I think about it, one of the pieces of advice I got most comments on was helping an indie writer figure out the intricacies of the "a" HTML tag :) [I left a comment on her blog and a lot of other indie writers thanked me for the details - they needed them when formatting books for Kindle.]

</comment></comment></comment></comment><comment><USER15> One of the rarest and most under-appreciated skills in tech is the ability to explain things. As an industry, we mostly focus on building and selling, and the twain don't always meet. Many of the builders have deep and excellent understanding of the tech they work with; many salespeople are excellent at persuading customers to do x. But there's a very important and underused bridge between insiders who understand, and everyone else. Blogging is a great exercise for deeply technical, because it's a chance for them to actively ask themselves: What do others not understand, and how can I explain it clearly?

<comment><USER16> "If a thing be really good, it can be shown to be such. If you cannot demonstrate its excellence, it may well be suspected that you are no proper judge of it."

\-- William Godwin

goo.gl/wylZZm

</comment></comment><comment><USER12> I maintained a blog for a few years (mostly while preparing to take the Cisco CCNP exams) but I haven't wrote regularly for going on five years. It was extremely beneficial to me in several ways.

I ran into an issue with some HP ProCurve switches that HP basically said "yeah, that can't happen". It was only after writing it up -- along with a video -- and someone from HP reading it that they reached back out to me, flew an engineer out to "witness" it firsthand, and fix it. Later, they flew me out to Roseville for a few days to hang out with some of their engineers. Later, they invited me (and paid all my expenses) to attend an HP Tech Day as well as Interop NYC.

In addition, I was invited to attend several Net Field Day [0] events where I got to hang out with some very smart people in the networking industry in Silicon Valley. Stephen Foskett, the guy behind NFD, knew about me from my blog.

Also, while I was at one of the NFD events, I got an e-mail from someone who "knew me" from my blog. An ISP in my area needed a new Network Engineer to replace their main guy who had just left. They were about to start doing some new things and needed someone with lots of experience with OSPF and BGP in particular. After I returned, I met the owners to chat over breakfast one morning. I've been working there a little over five years now.

I've done a handful of small "side jobs" as well, mostly for smaller companies whose IT guys found me via a Google search and reached out to me for assistance.

Last, it's certainly not making me rich but (even though I really haven't written much in the last five years) the ads that appear on my blog (and Youtube videos) still earn enough so that Google has to send me a 1099 every year. Beer money. :-)

 _ETA_ : I actually wrote up a similar post, "Why You Should Be Blogging" [1] in 2011. It was kinda sorta aimed at others studying for Cisco exams but I think it's probably general enough to apply to the HN crowd as well (I haven't re-read it recently, TBH).

[0]: [http://techfieldday.com/](http://techfieldday.com/)

[1]: [http://evilrouters.net/2011/10/20/why-you-should-be- blogging...](http://evilrouters.net/2011/10/20/why-you-should-be-blogging/)

</comment><comment><USER17> You should certainly blog if you did something different, something that is innovative, if you solved an interesting problem. But.. lets be honest, political correctness aside. Most software engineers have nothing to blog about, they just glue some libraries and make couple of db requests and that's about all they do. Nothing what they do is innovative or worth blogging about. Not every engineer should blog or we would see tens of thousands of new links everyday on HN that would point to another blog that writes about how someone wrote an api and did 3 mysql requests - That's called spam. We already have thousands of resources/articles/blog posts that solved those problems and unless you are bringing something new to the table, what you wrote was already written.

<comment><USER18> The specific problems encountered and methods that proved to be a workable solution for an engineer when gluing any set of arbitrary modules is practically guaranteed to be unique information, though mired in a ton other, more mundane information.

It'll be the mark of a good writer to properly cut the content from the fat.

But this isn't about being a good writer. It's about improving your own understanding and simply widening our dataset of known engineering practices.

</comment></comment><comment><USER19> I think this misses another equally important reason, which is to do your part to help build the gift economy upon which we all rely in our day to day work. Near every common solution and recipe has been written up by someone, somewhere, and we all make use of these gifts.

When you learn to do something useful that other people will likely also have to accomplish at some point in time, write it up. Not only will it benefit people out there in the world, but it is also a great way to ensure that you yourself don't have to reinvent the wheel a few years down the line. Who remembers the details after that long? So write it down, and if you write it down, you may as well publish it.

<comment><USER20> While I agree generally with what you've written here, my only issue with it is that _writing it up_ takes about as long as building the thing, _and_ I'm pretty lazy.

Also, if someone, somewhere, has written up nearly ever common solution, how do I know which ones are novel enough to put the effort in to publishing. Most of things I build aren't novel or new in any way, I'm fairly sure.

<comment><USER21> You will know what to write. When you spend time searching for an answer to an odd problem but don't find it and have to do it yourself you will want to write about it afterwards because you will want others to know you figured out the solution.

</comment></comment></comment><comment><USER22> When I read ,,the only thing you need is an editor'', I thought how cool it would be if what I write would be reviewed by some people before going public...it would make me less shy about it.

Then I realized he means a text editor (though he's an editor himself)

<comment><USER23> That's my biggest problem, how do you improve your written communication without an editor? You can do the same thing over and over and call it practice, but without a reviewer how will you magically improve this skill?

<comment><USER24> 1\. Post stuff for people to view. Pay attention to what is popular, and what isn't 2\. Read stuff aloud before posting 3\. Read widely, and pay attention to writing you like.

I've built a business off of writing: [https://lsathacks.com/explaantions/](https://lsathacks.com/explaantions/)

I got started by writing a travel blog during a yearlong trip. I posted each entry to Facebook. When an entry got a lot of comments/views, I could tell it was better. I also got confidence that I was writing well.

As I kept writing, I always made sure to show my work. And I found that reading aloud helped me find awkwards parts.

Finally, I got started during a time when I was reading lots of blogs and novels. Good reading will help your writing.

That's about it. Practice, tempered by feedback and observing the work of others.

<comment><USER25> The problem doing that with technical writing is that your audience isn't going to be judging you on your writing skills, they'll be judging you on the technical content. OP isn't worried about their technical content, they're worried about their writing skills. The technical audience is going to be affected by writing skills (it'll affect how well points are made, etc), but they aren't going to give feedback on that part. "Just ship it" doesn't work with soft skills.

<comment><USER24> They don't have to start with technical writing. I didn't. I wrote a travel blog and shared it with my friends on facebook.

That transferred directly to my later technical writing.

You can also do technical writing, share that with a few technical friends, and get feedback.

I don't think any of my comment was about doing technical writing immediately though.

</comment></comment></comment></comment></comment><comment><USER26> I find that blogging helps me untangle messy reasoning, to the point where I often end up improving the code to make it easier to explain. The marketing angle is less interesting to me, I'm not selling anything. What's missing from the article is the bigger perspective; by sharing ideas and knowledge openly, everyone wins.

[https://github.com/codr4life/vicsydev](https://github.com/codr4life/vicsydev)

</comment><comment><USER27> > Marketplaces like UpWork and ELance, which were originally designed to match > US companies with global talent, have literally made it impossible for US > engineers to find work...

As a freelancer working from India - this stands true even for the good experienced freelancers in India. Upwork (and Elance that is now Upwork) make it hard to get good rates - forget about raising rates. And when Elance merged to Upwork - it just made it harder to filter out good clients (I had some respect for the former Elance). Most buyer's have this perspective - "You are from India, your cost must be cheap!". Add to that rated courses on Udemy that underline "Get your work done at 1/10th the cost" (that I subscribed too) and similar stuff on YouTube.

Blogging helps. Mine is a pretty small one. But I got quite a few leads from my blog and at one point I was heavily overloaded with requests that would give me acceptable rates. I stopped writing for 6-8 months and the leads stopped coming in. Also, these days video-bloggers(good ones) get to take much of the leads.

</comment><comment><USER28> Ok, I'm kind of cynical when a recruiter says "You should blog! It will make it easier for us to find you." It sounds like the hunters suggesting to the game wardens that deer would be better off if you painted them international orange. :-)

I certainly agree that public comments on the internet can help people get a sense of who you are, but just like sharing on Facebook or any other infinitely long lived expression of opinion there is also a huge down side to it. A number of good engineers have been fired over the years by blogging an opinion that their manager didn't like or mentioning an activity that their employer felt violated the inherent NDA in place in any employee/employer relationship.

</comment><comment><USER29> I used to have an issue with writing classes in college. Since the writers-to- be in the class aren't experts in any particular field, they are forced to pick sides in ridiculous polemic topics just to fill a page. This transfers over to the real world in the form of frivolous articles written to provide a constant stream of content to a readership.

People like engineers and other folks with technical jobs have some of the best writing material to work with - all they really need to do is recount their day's work and the problems they've encountered, and any non-expert interested in the field can read and learn from it.

There is a plumber who lives in my state who publishes video documentation of every job he goes on. Since I'm not a plumber, I learned a ton from these videos. All of the things he did would seem basic to anyone in his field, but for a lay person like myself, his videos were extremely educational.

<comment><USER14> > recount their day's work and the problems they've encountered

Damn... I never thought of this. Great idea.

</comment></comment><comment><USER30> I just like discussions on HN. I think if I aggregated them all over the years it would make a decent blog. I am lazy. With a blog I think I would just end up not updating it and after 2-3 years it would be abandoned. Is it better to see an abandoned blog or not blog at all...? I don't know I never really considered blogging for the recruiters, which it seems this article advocates.

I also prefer a conversational style so that needs a others who are engaged and want to discuss things, otherwise it seems like I am broadcasting into the ether with nobody potentially ever reading or seeing it. Well technically it would be showing off for the potential recruiters here. But so far I never had problem getting good offers without the blog. I don't have Twitter Facebook, G+ or a LinkedIn. My GH profile is probably how they find me, which is fine so far. Also probably language specific mailing lists.

</comment><comment><USER31> I think there is some truth to this. I landed my first startup engineering position via a blog post.

This particular post only took 30 minutes to write - they can be short and sweet.

<comment><USER32> This is awesome! Did you expect the post to get you a job? Do you have a link to it?

</comment></comment><comment><USER33> Reading this, at least from my perspective, makes it seem like the author asks three questions, then provides an answer that doesn't really actually answer the three questions.

In particular, from my own experience in blogging/twitter etc, getting an audience is a really hard thing to do, so much so that years later I haven't succeeded yet.

On top of that, what about people who don't blog because they feel they have nothing interesting to say? Why should I write about my experiences with moving to modern javascript practices when 500 other people have already written the same thing, said all the same things I would have and actually have an audience that gives a shit?

</comment><comment><USER34> READ: I target engineers with email advertising/recruiting, and want you to make my job easier.

</comment><comment><USER35> Engineers should stop telling other engineers what to do :)

</comment><comment><USER36> By far the most frustrating part of blogging for me (though certainly not the only one) is the assumption that no one will ever see it. I can probably solve this by options I dislike -- giving up ownership to Medium or obnoxiously cross-posting to all social media platforms -- but the end result is I am discouraged before I even start.

Oddly I love speaking at conferences...maybe because some nonzero audience is more or less guaranteed?

</comment><comment><USER37> Thanks to Beeminder I stuck to blogging for a while (my results, such as they are, can be found on my website) even though I wasn't happy, and they are all full of horrible grammar.

The only thing I learned from the project is that I really don't like blogging, I want to build stuff.

<comment><USER32> What's the link to your blog?

</comment></comment><comment><USER38> >Recruiting systems are optimized to filter out false negatives (i.e eliminate people that don't satisfy their bias) at the expense of false positives (i.e miss out on good people).

I thought the definitions of false negative and false positive were the opposite.

<comment><USER39> Yeah, I had trouble parsing that sentence, but I agree. Recruiting systems usually _encourage_ false negatives.

</comment></comment><comment><USER40> I think the biggest thing is that any kind of writing makes you visible to the right audience. The key though is to know who you are writing to and make it tailored to them on their level.

I think far too often people try to get their name out there and even though they should be writing for a specific crowd, in reality, they end up alienating the very people they were trying to tailor to. The writing should always be for yourself and in that way you will reach the right people. Let the rest fall into place.

</comment><comment><USER41> Yep, they definitely will. My blog posts usually make my job interviews easier, as usually I hear "oh, we have read your blog post, so let's omit some of the questions we usually ask".

Another funny thing is that you never know which posts will be popular. On my blog three old posts generate over 70% of the traffic. Some people have found them informative, and linked on a couple of pages.

</comment><comment><USER42> The best way I've found is to blog what you learn. There is always somebody who is learning what you are learning and is a day behind you. They will benefit from your "experience" and being able to teach what you just learned means you know it well. 5 years and I haven't stopped learning. Http://maxdemarzi.com

</comment><comment><USER43> If I wrote an engineering blog the first post would be about how meaningless the word 'engineer' has become.

</comment><comment><USER44> May be some hacker should make a NN to produce hipster-hacker blogposts so they don't need to. Just do a couple posts, train on those, and sit back and get both the creds for having a happening medium profile while maintaining your productivity.

</comment><comment><USER45> What do people view as good blogging platforms for this stuff these days? Jekyll on Github? Something else? I'd like to get going fast focusing on content, but of course want good syntax highlighting, comments, and such features.

<comment><USER46> Jekyll is pretty great (just chuck a disqus block in your footer), there's a real risk of getting bogged down in setting up the 'perfect' system with it and never getting round to publishing anything.

I think Wordpress still has one of the most outstanding install experiences, but keeping it up to date is a pain.

<comment><USER45> Cool, I may give Jekyll another shot(had a false start couple years ago).

I have tons of experience doing hardened WP installs(and compromise root cause) but almost no experience USING it haha. I'd prefer not to go down that rabbit hole if something like Jekyll is sufficient.

<comment><USER47> If you only publish an blogpost once in a while, you wouldn't even need Jekyll. Figure out your template, and save your post in an .html file, add a link to the index.html and upload both to /var/www/ on your own cheap Linux cloud webspace. Markdown is nice, but if you don't need much you can sprinkle some <h..> and <b> tags on your post and you're done. There are browser based syntax highlighting tools where you can paste in your code from your IDE and get it back nicely formatted with the appropriate CSS.

Might not be right for you, but I had to bring up the easiest, the truly minimalist, hey, the _original_ way to it.

</comment></comment></comment></comment><comment><USER48> ok then, lets turn this around: every blogger should code!

<comment><USER49> Most jobs have "good communication skills" as a prereq. Compare with the fraction of jobs that require coding.

</comment></comment><comment><USER50> I agree. Such an easy way to market yourself and get your name out. Also, being able to write clearly is an incredibly useful skill to have.

</comment><comment><USER51> 1999 called. It wants personal websites back.

</comment><comment><USER52> The title was editorialized. The word "every" was added to the title of the article.

<comment><USER53> Ok, we restored the original title, except for the leading "Why", which we typically remove.

</comment></comment><comment><USER54> No, they shouldnt.

</comment><comment><USER55> I stopped reading when you started to suggest engineers might work on Elance and the like..

</comment><comment><USER56> Blogging is waste of time. Most of blogs are paid PR/Marketing/SEO content that is low quality click-bait. Like this blog post that is PR piece for company that author works.

Engineer should sharpen theirs skills on github. During interview github profile is much larger hiring factor than blog.

<comment><USER57> > Blogging is waste of time.

It certainly is a waste of time for improving your engineering skills, it's a myth. But it isn't for PR, which is very important these days even to get somewhere in software engineering, not to mention for pushing any kind of product or attracting other engineers to hire.

<comment><USER56> You are either Engineer or not. Writing blog post will have less of effect on your engineering skills than writing code.

<comment><USER58> I was able to step up to a major tech company because they noticed my blog posts, Stack Overflow answers and conference talks.

That nearly doubled my income.</comment></comment></comment></comment>


Ask HN: Where is Assange? - <AUTHOR> So, where is he?<p>Why is HN not discussing this? <comment><USER2> There are many speculations like this:

> _Assange did not had Internet in last months, he couldn 't release keys on a > possible day of abduction. And I am sure gov did everything to jam wifi and > 3g and everything else that he could use to do it._

> _He has a DMS.... But internet cutoff might make him reconfigure auto > triggering conditions, which might made DMS vulnerable._

> _the 20TB attack (Nov 6) they were getting on their servers is what probably > suppressed it. we need to find it._

> _We know they have external servers -- that 's why the podesta emails kept > coming out on time. Whoever is in control now is a 3rd party._

> 1 _8 Oct: file.wikileaks.org /file is made publicly visible. The message > 'The Insurance files may have just been released' is shown for about an > hour:_ [https://i.imgur.com/6IMYfUK.png](https://i.imgur.com/6IMYfUK.png)

> _20 Oct, 21 Oct: Wikileaks posts 4 tweets with series of typos that spell > HELP HIM_ [http://imgur.com/a/m7trX](http://imgur.com/a/m7trX)

But after some reading:

15 october: Cut off Assange's internet access 5:00 pm GMT

26 October: Assange "speaks" at CISL (Argentina) – phone call.

5 Nov: Assange Pilger RT interview is posted, but there is no date when it was filmed (speculations regarding fact that Pilger mentions Oct 15th Internet, but Assange doesnt)

13 Nov Pamela Anderson visited him. Her previous visit was on Oct 15th

14 Nov, 15 Nov Multiple people were present at Swedish Prosecutor two day questioning

17 Nov Picture of Assange with Carlos Poveda Moreno posted on twitter (I am not sure if lawyer or EC counsel) [https://twitter.com/Mangazos/status/799367352060100608](https://twitter.com/Mangazos/status/799367352060100608)

Here is comparison of his appearance in Pilger interview and photo with Poveda [http://prntscr.com/d8sw3l](http://prntscr.com/d8sw3l)

</comment><comment><USER3> Not sure why this is upvoted?

He's at the Ecuadorian embassy. We know he gave a statement to, and was questioned by, the Swedish prosecutor there this week (as confirmed by his lawyer).

It'll be interesting to see if the prosecutor now drops the case.

<comment><USER4> According to this Reuters article [0], the Swedish prosecutor didn't speak with Assange directly. She spoke with an Ecuadorian prosecutor, who (likely) relayed questions to Assange. This leaves open the question if she even spoke to Assange, or if he is even at the embassy. This is the relevant section:

> _Swedish Chief Prosecutor Ingrid Isgren spent around four hours in the > embassy, where she posed questions through an Ecuadorian prosecutor, before > leaving without making comment._

Re his lawyer, he could not attend the interview because the Ecuadorian embassy barred him from attending.

> _Samuelson, Assange 's Swedish lawyer, said he had been barred from the > meeting. "Ecuador refuses to let me in and insists that the questioning will > continue without my presence, against my client's wishes to have me there," > he told Reuters._

In summary of the whole situation, what's making people worried is that Jullian Assange has not been publically seen, nor has he shared a signed message, in over a month.

[0] [http://www.reuters.com/article/us-ecuador-sweden-assange- idU...](http://www.reuters.com/article/us-ecuador-sweden-assange- idUSKBN13910T)

<comment><USER3> The article you reference does not say anywhere that Assange was not present. Also, you need a lot of supporting evidence to claim that Assange's lawyer (Jennifer Robinson) would

a) lie about her client

b) speak without his permission

and/or

c) go through this whole process without having access or speaking to her client for the last month

That is not how lawyers operate (and Assange is especially careful when selecting his representatives). Or do you think she has been coerced?

Edit: And Assange has more than one lawyer. His Swedish lawyer was the one not present.

</comment></comment></comment><comment><USER5> Still at the Ecuadorian embassy in London, I suppose?

<comment><AUTHOR> [https://www.reddit.com/r/WhereIsAssange/](https://www.reddit.com/r/WhereIsAssange/)

Has not been seen since 16th October, DDoS happened, since then wikileaks doesnt sign their twitter messages, latest hashes mismatch.

<comment><USER6> That is roughly the time that Ecuador cut off his internet over concerns he was trying to influence a foreign nation's election, right?

Odds are they are having a lot of behind doors talks about the terms of his stay in their embassy and how he will "report" on this event.

</comment></comment></comment><comment><USER7> > Why is HN not discussing this?

Because we don't care any more

<comment><AUTHOR> What do you care about now?

<comment><USER7> His friend Putin

</comment></comment></comment><comment><USER8> He's probably in a CIA black site.</comment>


Cognitive biases that lead to poorly designed products - <AUTHOR> https://invertedpassion.com/cognitive-biases-poorly-designed-products/ <comment><USER2> Decent list of biases on the work floor, although it does not seem to find ways out that much (just knowing about them and labelling them is only a start).

This part is pretty important for when it comes to addressing these issues though:

> _I find the implicit goals more interesting because those are the ones that > nobody talks about. If you've ever worked in a company, you'll know that > they are there for sure, but it's something that nobody would openly admit. > And that's what makes them dangerous. Because nobody even admits these > implicit goals, the reality that gets shaped by them is pretty biased._

How do you escape that mix of cultural and structural bias?</comment>