Company survival does not imply job survival - <AUTHOR> https://whilewest.com/things-might-get-worse-2b5b88caa54 <comment><USER2> > People are laid off when they are not necessary to a company's future.

I think it is important for everyone to note that no one is necessary to a company's future. If you work for a company where that is true of you, or any other employee, it is a bad position to be in. You work for an extremely shaky employer.

At the end of the day, layoffs do not happen based on merit. They happen based on cost, or revenue, or a wide variety of other factors outside of your control. I've been in meetings where 1 group that was demonstrably better by every metric we picked was still let go over another group. The reason was the lease terms on the office space they were in.

Anyone that tells you that you can save your job in the face of layoffs due to changing your working habits is manipulating you.

<comment><USER3> This makes perfect sense. I like to describe corporations as sociopathic entities that will do anything to anyone if it makes or saves them a buck in the long run (including firing your ass).

<comment><USER4> As an employer, I agree.

As an individual, I'm a pretty nice guy, but as an employer, my motivations are much more directed toward the bottom line - balancing the company's business in a short term and long term view.

<comment><USER5> I don't mean to single you out, but I just think it's bizarre that people cease to be humans when they go to work and have an ultimate duty to their organization above human dignity. Or that there is this bifurcation of work reality and 'life' reality. It really commoditizes the idea of being a good person.

<comment><USER6> I'm not sure where you're reading "above human dignity" into the comments. In many situations, companies will try to accommodate people who are having issues of whatever sort; it's not always red of tooth and claw. But sometimes it does just have to be "just business," especially at the macro level for the benefit of not only investors but also other employees.

It's not that different if someone is just doing some work for me personally. If they have a personal issue someday, by all means they should go deal with it. But I'm not going to cut endless slack for poor workmanship or whatever just because I know they really need a job.

<comment><USER3> > In many situations, companies will try to accommodate people who are having > issues of whatever sort

That's probably because it's easier and cheaper to accommodate people to an extent rather than replace them. Think about how little tolerance minimum wage food service jobs have for peoples' personal life. That's because you can literally replace those people off the street and a brand new employee is extremely productive relative to an experienced employee in a very short time. None of those things are true in a professional environment.

<comment><USER6> There's certainly some truth in that--although I'm not sure how unique to business relationships it is. The more one has invested in a relationship generally, the more they'll generally put into smoothing over a rough patch or making changes that allow the relationship to continue. Conversely, the more transactional the arrangement is, the more likely you are to terminate it if the immediate benefits aren't worth it. This applies whether employees, suppliers, plumbers, or whatever.

</comment></comment></comment></comment></comment></comment></comment><comment><USER3> I wonder what this means for the 1x engineer -- the 50th percentile person who does good, solid work.

<comment><USER7> Probably the same as it's always been - VC backed unicorn-aiming startups aren't a great idea as a long term career spot. If you are a genuine 10x engineer _and_ you have a single digit employee number, a wanna-be-unicorn is a gamble that's worth at least evaluating. If you want a family/social life outside of work, and you're only prepared to put in enough effort to be "just" a good solid employee, startups have probably never been a great idea.

Not that the non-VC fuelled "corporate world"or even the small/medium business sector is any less intrinsically sociopathic towards employees and their drag on the legal requirement to "increase shareholder value" \- we don't live in the world out fathers/grandfathers did, where doing "a fair days work for a fair days pay" every day pretty much guarantees you a livelihood until retirement.

We're already seeing problems amongst the 50+ year old demographic finding it increasingly common to be looking for new jobs at the same time as finding their skills and employability are significantly less relevant to modern businesses. I suppose that's always been happening, there's not too many jpb openings for 55 year old buggy whip makers, or even automobile welders, but I _think_ the rate of change is getting faster and I seriously wonder what the job market and economy is going to look like with another decade or generation of people who spent the first half or more of their careers in serious debt and don't have the capital to live out a retirement, nor a skillset that'll allow then to remain employed...

<comment><USER8> And even _having_ a retirement was a mid-century innovation that garnered its share of opposition. America has always made the political and economic tradeoffs to maximize employment, but politically it seems difficult to sustain a system that results in lower wages, fewer benefits, greater uncertainty _and_ higher unemployment (plus ancillary social stress markers like opiate addiction) -- the Trump/Sanders dynamics this year may presage a future boom in populist politics on both sides of the political spectrum.

</comment></comment></comment><comment><USER9> Pretty sure everyone knew this was true. In fact, I've never heard anyone say the opposite. Every 1st quarter you can see where company survival means job survivial is tenuous.</comment>


Was Amazon Prime Day intended as a performance test in production? - <AUTHOR> http://techbeacon.com/was-amazon-prime-day-intended-performance-test-production

<comment><USER2> While I'm sure they gathered interesting data during the traffic surge, I'm not sure Amazon would want to damage their brand by risking failing so loudly with so many eyes on them. I'd bet that Amazon already invests heavily into load testing and ensuring the reliability of the AWS backbone their retail site runs on.

I think the real driving motivation for Prime day was to drive Prime memberships. I get the impression that Amazon is betting on the recurring payments and increased volume of sales generated from Prime members to offset the ongoing cost of free shipping/other services and user acquisition costs like Prime day offerings.

<comment><AUTHOR> Good point and agree but they certainly gather lot of data that will help them be "even better" during Cyber Monday. I use their mobile app daily and have used during spikes. Overall, much better shopping experience than other apps so they're certainly doing something right.

</comment></comment><comment><USER3> What a "Brilliant Marketing Stunt" and plan giving them the ability to do so much, and gather the results, so they will be optimized for the upcoming Black Friday / Cyber Monday / Holiday Shopping Season. Do you think performance issues in production, or perfectly planned execution in production?

</comment><comment><USER4> actually I think it was a full business test of something big they have planned for the holidays, and it involved performance and security testing as well. I expect Amazon to both create and grow new way to reach every potential shopper on the planet between Thanksgiving and New Years...</comment>


So you think you know C? - <AUTHOR> https://medium.com/@okaleniuk/so-you-think-you-know-c-8d4e2cd6f6a6 <comment><USER2> I'm pleased to note that I got them all correct.

I've been programming in C since around 1985. I still see people claiming C is a simple language. It is a simple language only in that it has a relatively small number of syntactic constructs and a relatively small standard library. In practice it isn't simple, although it _is_ massively useful and once you've gotten good at it, through years of trial-and-error, not that difficult to get right. It's those years of learning the pitfalls by study and trial-and-error that are hard.</comment>


The key ingredient of market bubbles: cheap money - <AUTHOR> http://articles.moneycentral.msn.com/Investing/JubaksJournal/the-key-ingredient-of-market-bubbles.aspx

<comment><USER2> It's largely a matter of supply and demand, with the recognition that "dollars" (and other forms of currency) are just another product.

Since about 1995, it's been easy to get dollars. Interest rates have been low, so present dollars have been easy to get for the promise of future dollars. With an oversupply of dollars, their value drops in relation to other products, particularly whatever the investment vehicle of chioce is (tech stocks, real estate, minerals, etc.)

Combine this with a herd mentality -- people wanting to invest in whatever's "hot" -- and dollars keep flowing into one particular sector long after it's no longer a fundamentally good investment. The bubble inflates, and then eventually bursts. For a short period of time, dollars are hard to come by (and those who have dollars can often pick up assets on the cheap) as everyone who just got burned hoards whatever they have left... until they go chasing the next hot investment.

The housing bubble was particularly nasty because, not only were interest rates low, but banks were loose with their lending standards because they weren't directly on the hook for the loans they gave out. This allowed people to get a lot more dollars than they should've been able to pick up -- big housing loans with no down payment and no proof of income. Unsurprisingly, this led to housing prices rising well beyond sustainable levels, and then to a lot of people not being able to pay off their loans. All because people had easy access to money.

</comment><comment><USER3> This is the basis for the Austrian Theory of the Business Cycle. Nothing new here really.

<http://en.wikipedia.org/wiki/Austrian_business_cycle_theory>

<comment><USER4> Yep -- old and true.

</comment></comment><comment><USER5> Biggest suppliers of cheap money - so called central banks underwritten by essentially clueless taxpayers - scratch that - future taxpayers.</comment>


Laws of Tech: Commoditize Your Complement - <AUTHOR> https://www.gwern.net/Complement <comment><USER2> Really great article from Stratechery that informs a lot of my thinking on the subject: [https://stratechery.com/2015/aggregation- theory/](https://stratechery.com/2015/aggregation-theory/)</comment>


Technical debt: The good, the bad, and the reckless - <AUTHOR> https://blog.ably.io/technical-debt-leverage-or-liquidate-7f6959ec7078 <comment><USER2> Buy vs build? Go ahead. Buy. Spend 40 million a year.

[https://www.nytimes.com/2019/04/10/nyregion/nyc-gps- wireless...](https://www.nytimes.com/2019/04/10/nyregion/nyc-gps- wireless.html)

<comment><USER3> I try to keep an open mind about things when it comes to build versus buy. However at my agency we have the expertise except when it comes to software development, good news is there are plenty of great people and companies out there that you could bring in. No instead we drop tons of money on a platform not meant for the specific needs we have. Well over budget by a lot, behind and slow because it's massive. Plus we get all the baggage of that company culture on top of it. It seems easy to buy but I think it's only the right choice in limited circumstances.</comment></comment>


Type Inference in JavaScript - <AUTHOR> https://www.kylesletten.com/2019/01/25/type-inference-in-javascript.html <comment><USER2> So dependent types. Unfortunately, not decidable.

[https://cs.stackexchange.com/questions/12691/what-makes- type...](https://cs.stackexchange.com/questions/12691/what-makes-type- inference-for-dependent-types-undecidable)

In general I am torn between the enthusiasm people like the author bring to the table and their apparent lack of due diligence regarding a discipline that has been subject to thorough research for decades.

<comment><AUTHOR> So, I'm the author and I'm aware there are smarter people than me working on things like this, but my question is mostly whether there's a threshold where things can be useful. As an honest question, in C++ I think there's a "stack limit" of like 15 deep for generic types to avoid the fact that the types are Turing complete. Is there something that can be done that addles the type system but makes useful things possible? I think that just because something isn't possible in the general case doesn't mean that the specific cases people are likely to encounter are impossible.

<comment><USER2> Of course there is a room for pragmatism when it comes to type system. Just lookup the computational complexity of HM inference. But to be useful, the restrictions need to be understood very well. Otherwise your implementation very probably ends up unsound.</comment></comment></comment>


Apache Removed from OpenBSD Base - <AUTHOR> http://undeadly.org/cgi?action=article&sid=20140314080734

<comment><USER3> Note this is about OpenBSD dropping support for OpenBSD's own fork of the skanky old Apache 1.3 line, which hasn't been officially developed in aeons, and no official security updates since 2010.

The title implies some vote of no confidence by the OpenBSD team regarding Apache, when in actual fact they're just cleaning up their own mess, due to objecting to an earlier licensing change in the 2.x line.

<comment><USER4> > The title implies some vote of no confidence by the OpenBSD team regarding > Apache

No it doesn't. It says what it says: Apache was removed from base. Now that there is a reasonable alternative with an acceptable license, it is time to move on.

> when in actual fact they're just cleaning up their own mess

You choice of words sure reeks of negativity towards the project. The fact is, _skanky old Apache 1.3_ has served the project well for a long long time, and it has had a good track record as far as security goes. Keep in mind that code in the base system has been audited, patched and maintained by the project.

<comment><USER3> So I can see this getting boring pretty fast, but whatever.. on reading the title I wondered "why!", and on reading the article I find a recommendation for nginx. The reason for this appears to be entirely due to licensing in modern (and more comparable) versions of Apache 2.x than anything technical. The article does not make that clear at all.

Apologies if you read so much negativity into my choice of words, it wasn't meant as an attack on OpenBSD, forking unmaintained software, or whatever else, just intended to point out a correction in the way probably half or more of readers will interpret the article – as some kind of indication that Nginx is technically somehow better than Apache

<comment><USER5> Its not entirely due to licensing. OpenBSD has security patches to Apache that weren't accepted plus the license change. OpenBSD has been maintaining their own branch until the switch.

</comment></comment></comment></comment><comment><USER6> While I understand that if the choice were between the OpenBSD fork of Apache and nginx the only sane choice would be nginx (the OpenBSD fork is silly). But, I see people making the argument that nginx is "more secure", which would fit into the OpenBSD mindset. But, the reality is that nginx and Apache both have imperfect security records; Apache is pretty damned good on the security front and has been for a decade or more. Also, nginx makes it much easier for a sysadmin to screw up their security...including with some example configurations that are commonly found floating around on the web.

<comment><USER7> Aha, "silly". I see your comment is full of arguments why this was the case all these years. Most Apache security issues didn't affect or had lesser impact on OpenBSDs fork.

The only thing silly here is your opinion.

<comment><USER6> The OpenBSD fork was ancient. The only people using it were those who didn't actually need a modern web server...which is to say, not even OpenBSD users were using it, if they were using their OpenBSD server for serious web service. While I understand the motivation behind it, I believe it would be silly to build a web service on top of an effectively 15 year old version of Apache (1.3 was first released in 1998 and was EOL, even for security releases, years ago).

What is also silly is for a project that has so few serious developers to take on a project as massive as maintaining a fork of a project as large as Apache.

When Apache had security issues that didn't affect the OpenBSD fork it was often because the OpenBSD fork didn't have the module in question (most security issues in Apache in the past decade have been in modules, often not frequently used ones). People not using those modules wouldn't have had those security issues, and people using those modules on OpenBSD (after building from source to get those modules and a modern version of Apache) would have also been affected. I'll admit that there is a certain charm to software that has few bugs because it does very little, but Apache is what it is because people need it to be those things. It is certainly not through incompetence.

So, my opinion may be silly. But, it is not unconsidered. I've thought a lot about web service for the past 15 years, as it's a core part of my business. I could very well be wrong. Maybe OpenBSD would have been even _less_ successful for web service had they opted to include a modern version of Apache. (And, before you say "popularity isn't a measure of being right", I will point out that no matter how secure software is, it is useless if no one uses it.)

<comment><USER8> I always get funny feelings when people use "ancient" and "modern" as argument, without further explanation. Not that it is an invalid point, mind you. But certainly one that would bear expanding on.

<comment><USER6> I mentioned one reason above. The Apache developers are far from incompetent, and all the changes in Apache since 1.3 have been because somebody (usually a lot of people) needed or wanted those changes.

In most things I agree with you; I use vim, bash, shell scripts for automation, Perl, etc. All things that get the ancient vs. modern argument used against them...but, when it comes to software security old nearly always means "exploitable". Since Apache 1.3 became EOL in 2010, OpenBSD developers have been solely responsible for finding and fixing 1.3 security issues. That's a lot of work. If I were responsible for Apache packages (and I am; we ship a custom build of Apache for some of our supported operating systems in Virtualmin repos), I would want to leverage the knowledge and efforts of the people who _primarily_ work on Apache.

To continue...

There have been major architectural changes in Apache from 1.3 to 2.x. Performance on a number of use cases has nearly doubled in those 15 years, for example.

Modern web standards are more widely supported by recent versions, as well, either through modules or core HTTP protocol support changes. Wanna use SPDY? Yeah...gotta have 2.x.

A ton of security and QoS oriented capabilities are also "new" in 2.x. Given OpenBSDs security focus, I believe tools to help prevent exploits and DoS of web apps should also be considered...not just whether the web server has any directly exploitable bugs. Very few people are just serving flat files with their web server today. The code interacting with clients is often mostly in Python, Ruby, Perl, PHP, etc. Those are as much potential attack vectors as the web server itself, and 2.x has better tools for managing that risk.

</comment></comment></comment></comment></comment><comment><USER4> In somewhat related news, OpenSMTPD finally replaced sendmail as the default mailer on OpenBSD.

[http://undeadly.org/cgi?action=article&sid=20140313052817](http://undeadly.org/cgi?action=article&sid=20140313052817)

[http://www.opensmtpd.org/](http://www.opensmtpd.org/)

<comment><USER9> This is medium news. I'd rather use postfix. There's a ton of stuff missing from opensmtpd at the moment. Recently it had some serious crashing bugs when pipes were getting severed between the various privsep processes as well. It's getting there but it'll be a while yet before it should be in production on anything than really simple single nodes as a relay/local delivery.

<comment><USER10> Postfix was a no-go for OpenBSD because of the license. The only existing mail server with an acceptable license was qmail, which had its own issues, to put it lightly.

<comment><USER9> Gotcha - makes sense. First thing I do though is install postfix from ports still!

</comment></comment></comment></comment><comment><USER11> This is a good thing. Apache is a swiss-army chainsaw of last-resort, not a minimal webserver.

<comment><USER12> Apache is very modular. You enable what you need.

Apache's biggest problem is that it isn't cool and hip anymore. It's config file is too easy to understand.

Good { thing we = have; nginx; }

Phew!

<comment><USER13> It does have too easy of a config file. Who needs per directory config anyway? Or the ability to create redirects without a restart? I love nginx, but it has some flaws. The reality is it just has different flaws and strengths than Apache.

<comment><USER14> You can do per-directory config in nginx with the location block, it's just that you just can't put the config inside the directory itself and have nginx automatically load it.

You can tell nginx to reload its configuration without restarting the entire server process by running "sudo /etc/init.d/nginx reload", or on ubuntu "sudo service nginx reload".

<comment><USER15> 'service' is not just on Ubuntu - i believe it started life on Red Hat, and has now spread everywhere. Including FreeBSD:

[http://www.freebsd.org/cgi/man.cgi?query=service&sektion=8](http://www.freebsd.org/cgi/man.cgi?query=service&sektion=8)

<comment><USER14> Oh, I thought it was part of upstart for some reason. Thanks for the the clarification.

</comment></comment></comment></comment></comment></comment><comment><USER16> can I ask why?

I am not an openbsd guy obviously but know httpd is popular. Is it because adding it to base install adds too many security concerns?

<comment><USER17> OpenBSD forked Apache 1.3, when the Apache 2.0 license was introduced. One argument could be that maintaining, patch and extend a web server on top of writing an operating system is to much work, especially if there's a better alternative, with a license you can accept.

Including a web server isn't necessarily a security concern, it's not running by default. The advantages is that there's a web server included, with privsep, chrooting and a sane default configuration.

<comment><USER18> What was the incompatibility?

<comment><USER19> The OpenBSD policy page is quite useless[0] on this, but I _believe_ the issue is that the Apache License 2.0 contains the patent clause that states something like "you can't sue apache if someone contributes stuff that infringes your patent", which limits the freedom of the openbsd users to sue apache.

The relevant thread[1] from the time may be of use, but a specific message sums it up:

"We've been clear: Their new license contains more stuff, and we do not accept MORE STUFF in licenses."

[0] [http://www.openbsd.org/policy.html](http://www.openbsd.org/policy.html) [1] [http://www.monkey.org/openbsd/archive/misc/0406/msg00412.htm...](http://www.monkey.org/openbsd/archive/misc/0406/msg00412.html)

<comment><USER10> On the one hand being against MORE STUFF is a perfectly reasonable position. There's too much accumulated cruft in legal documents that has no real purpose besides make-work for lawyers.

On the other hand it's absurd to dogmatically oppose MORE STUFF regardless of what the stuff is. The added terms in Apache-2 make sense for a US-based collaborative software project that accepts contributions from businesses that hold software patents. They may be pointless legalese for a Canadian-based project whose contributors are mostly individual developers, but that doesn't make them an assault on developers' freedoms.

<comment><USER4> Is simple, unconditional freedom really that absurd?

 _We want to make available source code that anyone can use for ANY PURPOSE, with no restrictions._

That's what we call a free gift.

That is one of the project's goals.

You're right, the patent clause might not necessarily be an attack against the OpenBSD developers' freedoms. But they do not care about their own freedoms only; they want it to be _free for anyone_ (this includes corporations who might hold patents, and also individual developers working for such corporations), _for any purpose._ It is really as simple as that.

<comment><USER4> Let me quote Theo --

      You guys keep missing the point really.

      We know what a free license should say.

      It should say

      Copyright foo

      I give up my rights and permit others to:
    		distribute
    		sell
    		give
    		modify
    		use

      I retain the right to be known as the author/owner

      When it says something else, ask this:

      - is it 100% gauranteed fluff which cannot ever affect anyone?

      - is it giving away even more rights (the author right)?

      If not, then it must be giving someone more rights, or by the same
      token -- taking more rights away from someone else!

      Then it is _less_ free than our requirements state!

      So why even BOTHER wasting your time trying to understand what they
      say?

      Who cares if it is legal or not!  We're not going to want to go
      quibble in a court!  We're trying to make it so simple that something
      can't even GO to court, because it's free and, anyone can tell that it
      is free because the language used to say so is SIMPLE.

(From [http://marc.info/?l=openbsd- misc&m=103283218106749&w=2](http://marc.info/?l=openbsd- misc&m=103283218106749&w=2))

<comment><USER10> That's noble and I respect that. Unfortunately it fails to address software patents at all, and that doesn't make the problem go away.

Copyrights are essentially about copying. Patents aren't - you can write a clean-room program that's entirely your own work, absolutely guaranteeing that you aren't infringing anyone's copyright, but it could still infringe a patent you've never heard of. Or you could accept code from a friendly company which has a few defensive patents on it, and some years later the friendly company comes under less friendly ownership and the defensive patents turn offensive.

Apache, being based in the US (which has many software patents) and accepting code from many companies that have patents, has to deal with these scenarios. OpenBSD, being based in Canada (with far fewer - but not zero! - <USER2> patents), isn't as affected by it so Theo calls it bullshit. But it's not so black-and-white.

<comment><USER4> You are right, copyrights are about copying. Copyright licenses cannot address software patents any more than they can address US export restrictions, trade marks, contracts, or any other international or local laws that might deny you some freedoms. Theo cannot grant you rights to Microsoft's or Cisco's patents. What he can grant you is rights to his code.

Now you can try to "address" software patents e.g. by obligating distributors to grant rights to their patents, but that is a restriction; _it might be giving someone more rights, and by the same token is taking more rights away from someone else!_ More importantly, that would be a restriction _imposed by the copyright holder_ , rather than an external restriction imposed on you by a third entity the copyright holder does not control.

OpenBSD does not want to impose such restrictions on you or anyone else. They make their code free.

You seem to think that OpenBSD or Theo simply disregard patent issues because they hail from Canada. Maybe you should learn about CARP[1][2], or figure out why many of the ports' Makefiles have a line like this:

      PERMIT_PACKAGE_CDROM=  patents

[1] [http://www.openbsd.org/lyrics.html#35](http://www.openbsd.org/lyrics.html#35) [2] [https://en.wikipedia.org/wiki/Common_Address_Redundancy_Prot...](https://en.wikipedia.org/wiki/Common_Address_Redundancy_Protocol)

</comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER20> How good is OpenBSD's USB support on recent motherboards? A USB bug that affects motherboards with Intel chipsets in FreeBSD 9.2-RELEASE makes me think of switching; it hit print servers bad.

<comment><USER21> Have you tried 9-STABLE to see if the xhci bug is fixed there? It looks like some patches were committed for it, but not until after the change freeze for 9.2-RELEASE: [http://www.freebsd.org/cgi/query- pr.cgi?pr=181159&cat=](http://www.freebsd.org/cgi/query-pr.cgi?pr=181159&cat=)

If the problem is fixed in 9-STABLE, but you're only deploying RELEASE builds, 9.3-RELEASE should be available in a few months: [http://www.freebsd.org/releases/9.3R/schedule.html](http://www.freebsd.org/releases/9.3R/schedule.html)

<comment><USER20> Not sure if it's in STABLE already but I was aware of the patch. We have rolled back to 9.1-RELEASE for now and will wait for 9.3-RELEASE.</comment></comment></comment>


Notion 2.8, now free for personal use - <AUTHOR> https://www.notion.so/What-s-New-157765353f2c4705bd45474e5ba8b46c <comment><USER2> > Before, you could only add 1,000 blocks of content before needing to pay for > our Personal Plan. We just got rid of this limit for personal users! > Everyone should have access to Notion's tools to build what they need.</comment>


The Uberpreneur: How an Uber Driver Makes $252,000 a Year - <AUTHOR> http://www.forbes.com/sites/jonyoushaei/2015/02/04/the-uberpreneur-how-an-uber-driver-makes-252000-a-year/?utm_campaign=Forbes&utm_source=FBPAGE&utm_medium=social&utm_channel=Leadership&linkId=19411727 <comment><USER2> Yes, some drivers may make a lot of money by Uber. However, in some countries/ region, drivers complain they need to work so hard to get an order. They need to stay alert 24/7 since the competition is keen. The order can be taken within 1 second in some region. Not all of them can make money through Uber.

</comment><comment><USER3> Met one driver once who is also real estate agent. A lot of expats use Uber.</comment>


FIDO2 security key company publishes results of internal security audit - <AUTHOR> https://blog.doyensec.com/2020/02/19/solokeys-audit.html <comment><USER2> I see a lot of confusion in this thread (warranted, because it's a confusing subject), and I want to clarify a few things:

U2F is the old standard, it is only meant be used as a second factor.

WebAuthn is the new standard, it has different modes for usage as a second factor, first factor and single factor (usernameless). Only the usernameless mode requires state on the client side.

Usernameless strikes me as the holy grail of authentication, where we don't need to remember any usernames or passwords (or even have them), but I haven't seen any websites that support usernameless authentication, other than demo ones and my own.

If you want to see what a usernameless flow looks like, you can visit [https://www.deadmansswitch.net/](https://www.deadmansswitch.net/). You have to log in with an email link first, and then associate your FIDO2 credential with it. You don't need a hardware key, for example on phones you can use your fingerprint reader and it will work fine.

The problem with hardware keys, and which is not mentioned anywhere, is that because usernameless requires storage on the key, Yubikeys only support a maximum of 25 sites you can authenticate with.

In order to further my goal of some day ditching password managers, I also made a Django library for usernameless logins which you can use today on your Django sites:

[https://pypi.org/project/django-webauthin/](https://pypi.org/project/django- webauthin/)

<comment><USER3> When I try to create an account, I get an error message:

> Your security key can't be used with this site

> www.deadmansswitch.net may require a newer or different kind of security key

This is with a Yubico Security Key 2 which I thought supported FIDO2.

<comment><USER2> You can't create an account with a key on that site, you can only use it to log in after you associate it to the site.

</comment></comment></comment><comment><USER4> I am probably wrong, but I think Fido2 keys should be ubiquitous. They provide a hardened solution for some security situations, certainly they could be a good 2nd factor or 3rd, and hopefully they could reduce the password madness we have. Yubico appears focused on the enterprise and high end users resulting in higher prices. Solokeys seems more focused on individual users with lower prices.

Disclaimer I have two Yubico keys, and two Solokeys and they all work for me, but I don't need the extra functionality of the more expensive Yubico keys.

<comment><USER5> Don't get me wrong I love the idea of physical/hardware security; however, isn't the reason it is so effective right now because it is not mainstream?

<comment><USER6> Go on...?

<comment><USER5> Having a few vaults with security guards is a great deterrence as the reward is little for the high risk. Having many vaults with security guards draws a bit more attention...

<comment><USER7> I'm having trouble understanding what you're saying.

You'd think we'd be better off even with the higher attention, were it to exist, because the level of attention going into making FIDO2 as secure as possible would scale with its userbase. Same with any other security solution being implemented.

</comment></comment></comment></comment></comment><comment><USER8> I have two OnlyKeys I backup against the other to handle the lack of ubiquity of FIDO2. So many places are still only using SMS, but as an alternative, have built proprietary, in-app authentication systems that can't be audited. I had a phone break, and I wanted to purchase a new phone online to have it ship when I returned; and I couldn't access my remote work paycheck transfer (in- app), I couldn't log into my bank (SMS + in a different country so not the same SIM), and I couldn't log into the more popular online shopping (SMS).

Auth needs to be able to be decoupled from phones. With the OnlyKey, I've stored the important TOTP keys as well like my email as well as password for my password manager. Being as 'dumb' as they are, I've had it go through the wash still working fine.

<comment><USER9> If your bank is in EU, you can ask them to look into this EU regulation about strong authentication methods:

[https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A...](https://eur- lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32018R0389)

> Dynamic linking is possible through the generation of authentication codes > which is subject to a set of strict security requirements. To remain > technologically neutral a specific technology for the implementation of > authentication codes should not be required. Therefore authentication codes > should be based on solutions such as generating and validating one-time > passwords, digital signatures or other cryptographically underpinned > validity assertions using keys or cryptographic material stored in the > authentication elements, as long as the security requirements are fulfilled.

My bank (Swedbank Latvia) used this regulation as a pretext for removing authentication via passwords + code cards. They didn't do too well on the "technologically neutral" part though – you now have to use proprietary software or hardware to authenticate :-/

</comment></comment><comment><USER10> Excited to see an open source hardware key solution on the market to compete with yubico.

I've been working on my own saas app to handle authentication for any app using the web authentication framework.

hoping we start seeing more options to login using only hardware (plus pin to be extra safe) on all websites.

<comment><USER11> To date, the core of our firmware is also used by NitroKey [1], Signet HC [2] and OnlyKey [3]. We did a pretty significant refactor [4] to make the lib even easier to use as part of our MOSS award [5].

Hopefully we'll see even more products -and thus user adoption- of fido2/webauthn.

If anyone is reading, has a hardware project and would like to add fido2 functionality, please reach out!

[1] [https://shop.nitrokey.com/shop/product/nitrokey- fido2-55](https://shop.nitrokey.com/shop/product/nitrokey-fido2-55)

[2] [https://www.crowdsupply.com/nth-dimension/signet-high- capaci...](https://www.crowdsupply.com/nth-dimension/signet-high-capacity)

[3] [https://crp.to/2019/10/onlykey-beta8-release- announcement/](https://crp.to/2019/10/onlykey-beta8-release-announcement/)

[4] [https://github.com/solokeys/solo/pull/344](https://github.com/solokeys/solo/pull/344)

[5] [https://medium.com/solokeyssec/solokeys-achieves- fido2-certi...](https://medium.com/solokeyssec/solokeys-achieves- fido2-certification-thanks-to-mozilla-4c9ea52c05dd)

</comment></comment><comment><USER12> I got a Solokey as part of the Kickstarter and love em. USB-C + NFC in one device.

The one thing I'd love out of a security key is the ability to set up a "Twinned Pair". So I can have one key on my keychain that I use everyday and one I keep in my safe in case something happens to the primary. Yes, I know some services support multiple security keys - but setting up two is more work and not all services do support two.

<comment><USER13> I definitely would like the requirement to allow multiple keys to be a part of the standard. Allowing it at the key level seems dangerous to me, perhaps, in allowing an attacker to perhaps "clone" someone's key that hasn't setup a pair yet, though of course I'm sure there's mitigations for that if it was seriously proposed!

I have two Yubikeys, one in a safe and one on my person. It saved my butt when I lost access to the one on my person for a few days!

<comment><USER14> The fido2 protocol involves a counter that allows the server to detect cloning of a device :)

</comment></comment></comment><comment><USER15> Who is this company and why would I buy a key from them instead of Yubico?

<comment><USER16> SoloKeys appear to use open source firmware, whereas Yubico's firmware is closed source since the Yubikey 4 I believe. Other than that, they seem about the same. SoloKeys is a lot younger and missing a couple of Yubikey Neo's bigger features (like PGP support).

<comment><USER11> OpenPGP is arriving, will be available via firmware upgrade.

[https://github.com/solokeys/openpgp](https://github.com/solokeys/openpgp)

<comment><USER17> Note that for a PGP key, the idea of using cheap microcontrollers is _significantly_ worse.

U2F/FIDO2, sure, whatever- the worst failure state there is "your account is only secured by a password", and more likely attacks require physical access. I could post the secrets off the security key I use for my Google account right now and...eh, I'd probably be fine.

PGP? Ohohohoh. Now we're talking about long-term keys and non-forward-secure crypto.

If I leak your keys _once_ \- say, through power analysis, glitching, whatever- I can decrypt everything that has ever been encrypted for that key, and everything that ever will be. Compromise is total. Grab the device while it's unlocked, or use a camera, keylogger, or shoulder-surf to get your PIN- or just crack it, decrypting the encrypted keyblobs from flash ... the only thing protecting you is a barely-above-popcorn Cortex-M.

At that point, just use the fTPM in your CPU. Otherwise... hardened hardware is _much_ more important for PGP.

If I had to design a PGP key storage mechanism, I'd probably use a reasonably well-known, well-tested "secure microprocessor"\- or a 'TPM-on-a-chip' connected to an untrusted microcontroller (which would be basically just an adapter/protocol translato...hm, no, plaintext would still go across its bus, right? Forget the gpgcard spec right now, might do some link encryption, but that would be good and it's GPG so it probably doesn't. Yeah, no, I think you need the full stack on one die- or else open to attacks like replacing the untrusted microcontroller with one that logs all plaintexts it sees (and...is gpgcard challenge-response? Gotta be ...but if not, can log the pin too...anyways, ignore this aside))

Anyways, a secure microcontroller- hardware crypto engine so the microcontroller code never sees raw key material, hardware rate limiting/lockout if possible, reasonable secure boot, maybe even disable firmware upgrades entirely, self-zeroizes if you sneeze at the wrong time, etc. Attacks are still possible, but the cost goes WAY up- at least past the six figure mark, hopefully.

I'd also ban all use of RSA private keys- too easy to mess up generation, and especially since we're "secure hardware" now which means, apparently, we can't generate primes too good. No, EC keys exclusively.

Anyways ...a commodity STM32 is fine for fido2. Not great, but it's fine.

It's almost a nonstarter for PGP, and honestly any PGP support needs a _giant_ warning label that it shouldn't be relied on to protect against physical attacks.

<comment><USER18> _If I leak your keys once- say, through power analysis, glitching, whatever- I can decrypt everything that has ever been encrypted for that key, and everything that ever will be._

Doesn't it depend on the threat model? If your thread model does not include physical access compromise, then the commodity STM32 approach is quite ok right? At least, in most cases it provides more security than storing the private key on disk.

I do agree that given the low prices of secure elements it is surprising that keys still don't use them. But that may depend on the lower-priced parts not being fit for FIDO2 or OpenPGP (though the Nitrokey FIDO does use an ATECC608A).

</comment></comment></comment></comment></comment><comment><USER19> Physical hardware seems like a promising replacement for passwords. But is there any real adoption in consumer services right now? The only two services I know that suppport Fido2 are Google and GitHub. Are there any other big services I'm missing here?

<comment><USER11> Microsoft supports passwordless login (you can try it out on outlook.com — some ppl refer to this as username less).

Dropbox is also an early adopter.

Plus you have all the u2f that are back compat, including facebook, twitter, aws, gitlab... (I may have confuse some u2f that already moved to webauthn, if so, sorry).

Considering that webauthn was standardized last March and that ios still has no in-app support, that's a pretty good start, I think.

<comment><USER20> So the reason for the usernameless / passwordless distinction goes like this:

U2F was explicitly designed only as a second factor. ("Universal 2nd Factor") but WebAuthn is not.

Even with U2F you could (it wasn't recommended) just not actually have passwords. Use their second factor as your only factor. In this scenario the user needs to provide their username (email address, whatever you're using) because their FIDO token doesn't know who they are either -- it needs to be presented with a cookie [which it gave the site when the user registered to use this FIDO token], and you've probably got a database table mapping users to cookies and public keys.

In FIDO2 the token is capable of handling resident credentials. No cookie, resident credentials are permanently inside the token itself.

The massive downside of this is that obviously the token has finite storage for such credentials, a Yubikey can store 25. Whereas for ordinary FIDO (all the WebAuthn deployments I've seen outside Microsoft) there's no practical limit.

The upside is that since the token has your credentials it can now do the entire sign-in, no need for even a username so the login flow is much nicer.

Of course while convenient on its own that's arguably worse security - if a bad guy steals your token they're in without even knowing your username, much like the proximity card badges often used for site access. So the fix is that a FIDO2 token in this mode can be (usually will be) set to require a PIN or some other factor. This seems like we're back to passwords again, but it's different because the extra factor is local to your device. Bad guys can't steal PINs from devices in bulk or brute force them, they need to steal your FIDO2 token and then brute force that somehow.

<comment><USER21> Is this right... so in FIDO2, the website only has to store the public key of the token (which will get sent on registration/signup and mapped to a userid)?

<comment><USER20> Not _the_ public key, that would violates FIDO's design requirement forbidding correlation. A key pair is minted during registration and the relying party (web site) remembers that specific public key. The FIDO2 device remembers which site it was and its corresponding private key.

That's why it needs storage for each such resident credential on the FIDO2 token.

</comment></comment></comment></comment></comment><comment><USER22> So I have a SoloKey. How do I check what firmware it is running? Is the firmware upgraded automatically, or do I have to do something? The SoloKey website from some quick skimming doesn't seem to have any information on the topic.

<comment><USER23> Their github repository of their python command line tool should have all the info you need.

[https://github.com/solokeys/solo-python](https://github.com/solokeys/solo- python)

<comment><USER24> I just did an upgrade to a few keys a couple days ago using solo-python and it was a breeze. Note that you might need to add the udev rules to your Linux machine if they are not detected as explained here: [https://docs.solokeys.dev/solo/udev/](https://docs.solokeys.dev/solo/udev/)

</comment></comment></comment><comment><USER25> Oh my... I saw FIDO2 and immediately (for some reason) thought it was a resurgence of FidoNet: [https://en.wikipedia.org/wiki/FidoNet](https://en.wikipedia.org/wiki/FidoNet) and somehow someone built a new FidoNet with security and audits.

</comment><comment><USER26> I was wondering if there is any driverless USB smartcard that can speak GIDS?

The GIDS login for our sysadmin worked wonderfully, but the downside is the reader.

<comment><USER27> Have you tried PIV in place of GIDS?

<comment><USER26> No</comment></comment></comment>


The People's Republic of China Was Born in Chains - <AUTHOR> https://foreignpolicy.com/2019/10/01/the-peoples-republic-of-china-was-born-in-chains/ <comment><USER2> One can only wonder if it was a deal with Stalin.. he gets china and europe gets out of a large part europe</comment>


Show HN: Croma – A palette manager – My first React Native app with web support - <AUTHOR> https://croma.app <comment><AUTHOR> It's open source: [https://github.com/kamalkishor1991/croma- react](https://github.com/kamalkishor1991/croma-react)</comment>


A Note on the Type (on Knuth's MetaFont) - <AUTHOR> http://www.servinglibrary.org/read.html?id=8

<comment><USER2> Dexter Sinister is a cool artist collective whose work I have enjoyed since learning of them when they visited Vancouver a couple of years ago.

If you're not up to reading the whole essay, it's sill worth it to scan down the PDF and see how the same font is represented differently depending on the how the initial variables are set. This gave me a better intuitive appreciation for how metafont works, and what makes it different from other font specifications, than anything else I've read on the subject.

</comment><comment><USER3> I found it very hard to read this. The whole time my brain kept getting distracted by how bad the fonts look.

</comment><comment><USER4> It's great to see Metafont put to use these days, while a wonderful concept, seems like it fell into the margins of adoption and use with the prominance of bitmap and later vector outline computer font standards.

</comment><comment><USER5> is the metafont source downloadable?

<comment><USER4> <http://tug.ctan.org/tex-archive/systems/knuth/dist/mf/></comment></comment>


Voce Podcast Player – Unlocking multimedia buried within podcasts - <AUTHOR> http://voceapp.com/ <comment><USER2> Very cool application! I haven't been listening to podcasts for long, but I recently got hooked on via 'Serial'.

Although I didn't think about it at the time, I think it would be fascinating to be able to reference specific documents, videos, artifacts, etc. while listening to the story. I hope a recommendation feature is in the pipeline. I think it would be interesting to find new podcasts based on the number and quality of supporting documents, show notes, etc. Perhaps something as simple as a top list of what your current users are getting the most value out of would be a great place to start.

Will certainly be giving this a try -- fantastic work!

</comment><comment><USER3> I'll definitely give this a try. I'm always way too lazy to look at the show notes myself when Tim Ferris references them during his podcast.

<comment><USER4> This was precisely our motivation as well!

</comment></comment><comment><USER5> Many times while listening to podcasts I want to know more about something mentioned. My wish has come true with this</comment>


Ask HN: Which industries are the most varied in total comp? Most homogeneous? - <AUTHOR> I'm trying to get some guidance as to where to start looking for variance in total compensation, which usually correlated with work-life balance and career growth, among different industries. My first guess is that the heavily regulated industries like healthcare have less variation in total comp.
As a software engineer, I know that the bottom floor of compensation scrapes minimum wage in some companies, also usually they are least desirable for quality of time and work. The only one I can think of where the floor doesn't get that bad is perhaps doctors. There are tiers of pay there too, but the bottom floor is usually high for them.
Is there any research or dissertation done on this subject? Or even just a list ranking several fields from most homogeneous in total comp to least. <comment><USER2> I think what you'll find is that industries that use knowledge workers tend to have higher variance than those that don't; industries that have a high percentage of wages come from incentive pay will have a greater variance than industries that don't use incentive pay; and industries that are heavily regulated or unionized will have lower variance than industries that are lightly regulated or unionized.

Incentive pay: for example, sales people and wait staff have a highly variant distribution based on commission and tips respectively.

Knowledge workers: software engineers have an extremely high variance wage distribution.

High-regulation industries: mining is highly regulated and is unionized, leading to a very low degree of variance in wages between miners.

There are exceptions to this and the categories can interact in interesting ways: For example, medicine is highly regulated but they are knowledge workers, so there is reasonably high variance in wages, particularly for doctors (relative to other health professionals).

Another interesting effect is that highly unionized industries can see significant variance, but it is controlled almost exclusively by seniority within the union. Controlling for seniority, the variance in these industries tends to disappear.

This is an interesting paper on the subject that provides some pretty compelling evidence for the regulation and incentive pay claims: [https://www.bls.gov/opub/mlr/1981/04/art5full.pdf](https://www.bls.gov/opub/mlr/1981/04/art5full.pdf)

</comment><comment><USER3> The most freedom is in IT, because you can go remote, there is no licensing (change markets at will), and starting your own venture is always an option with relatively low barriers to entry. Also, the norm is that you get paid, unlike - say - pure art type creatives. Try thinking outside of the traditional wageslave context and see if you can save on living expenses, tax or get extra holidays by configuring your life around longer term remote projects, etc. instead of doing the mortgage in a major city thing. It's worked out well for me, YMMV.

<comment><AUTHOR> How would you live on, say, $1200 a month without leaving the US and without roommates/a partner? Currently I pay $400 a month to share an apartment with one of my family. And it's been hard in putting aside money to save. I'm trying to see where else I can get by that actually allows me to save on more expenses (and I don't know yet if I can ditch the car because the cheapest places in the US tend to be the most likely where cars are a major benefit)

<comment><USER3> I don't know the US well. Bicycles are cheaper than cars, which both depreciate and steal time while removing opportunity for exercise. Don't drink. Cook more at home. If all else fails, change jobs or marry money.

</comment></comment></comment><comment><USER4> An article on this subject with links to the data:

[https://www.bls.gov/careeroutlook/2015/article/mobile/wage-d...](https://www.bls.gov/careeroutlook/2015/article/mobile/wage- differences.htm)</comment>


Why Steve Jobs was not a jerk - <AUTHOR> http://my.counseling.org/2011/10/31/why-steve-jobs-was-not-a-jerk/

<comment><USER2> Wow. That post was just all types of awful in so many different ways.</comment>


Ask HN: Upgrade path from Trello? - <AUTHOR> My team and I have happily and successfully used Trello to manage software development project backlogs/sprints at my custom software house for about 5 years.
The business has now grown in size and we have outgrown Trello. Specifically, Trello's strength in its flexibility has now become a weakness. We need a tool that helps us to better enforce process throughout the software development life cycle.
We're currently considering ZenHub, Jira and Azure Dev Ops.
I wondered if any of you who had used Trello and migrated for similar reasons found the perfect replacement?
Thanks! <comment><USER2> Jira is awful, but if you're after a tool that enforces process, it can be set up to do that very well.

(The "flexibility" then gets moved from the tool, into the administration/configuration options for the tool. It's very very easy to configure Jira badly, and rigidly enforce crap processes...)

<comment><AUTHOR> The business already looked at Jira and concluded that like you say, it's awful.

There must be something out there that is Jira-esq but not awful, no?

<comment><USER2> To be fair, I've twice worked on projects where Jira had been set up in a way that made it a delight to work with and a 100% positive productivity boost. Both times the business had an Atlassian trained staff person to drive it (in one case that was her full time job - in a ~120 person agency running maybe 40 or so concurrent projects at any one time).

In spite of those great experiences, I've never been able to tweak any of the Jira instances I've had admin access too in just the right way to get that outcome. (Maybe I should look Rachel up and see if she's be open to coming in as a short contract for me...)</comment></comment></comment>


Almost 2M for this janky house in Palo Alto - <AUTHOR> https://www.redfin.com/CA/Palo-Alto/2120-Princeton-St-94306/home/602902

<comment><USER2> Most people think this janky house is for sale at $2M.

What's for sale here is a plot of land that's highly sought after, a school district with good ratings and the ability to live amongst wealthy peers.

<comment><USER3> So what you're saying is that instead of selling a janky house for $2M, what's really being sold here is a plot of land for $2M, with a fire-damaged house on it that you will have to pay even more money to renovate or raze and rebuild?

Must be one heck of a school district. :)

<comment><USER2> Basically.</comment></comment></comment>