Why Putting SSH On Another Port is a Good Idea - <AUTHOR> http://www.danielmiessler.com/blog/putting-ssh-another-port-good-idea#.Umsq_hbdDzU.hackernews <comment><USER14>
      2. Next he talks about this non-root listener issue. He
      claims that you shouldn't run your SSH daemon on a
      non-privileged port because anyone can spin up a daemon
      up there. Great point, except you can still do that even
      if you run your main one on 22.

I don't think I understand this point at all. What is it that you're trying to say?

Are you sure you understood the original post's point?

      firstname.lastname@example.com:~$ nc -l -p 14
      nc: bind to source :: 14 failed: Permission denied
      nc: bind to source 0.0.0.0 14 failed: Permission denied
      nc: failed to bind to any local addr/port
      email@example.com:~$ nc -l -p 1414
      ^C

See the difference?

(Edit: The original blog entry has now been edited to slightly clarify the wording. But the update mostly seems like an attempt to rapidly justify the author's original point.)

<comment><USER15> Privileged ports are why I disagree with this rebuttal. I want some assurance that when I ssh into a box, that I'm hitting a true and sanctioned sshd.

<comment><AUTHOR> > I want some assurance that when I ssh into a box, that I'm hitting a true > and sanctioned sshd.

You don't get that from it being on 22; you get it from verifying host keys.

<comment><USER14> > You don't get that from it being on 22; you get it from verifying host keys.

You know how you just wrote a blog post talking about how more layers of security are better even if all you're gaining is _obscurity_? This isn't an exception. And it is a valid point that by moving from a privileged port to a non-privileged port, you just traded away a layer (arguably a more useful one than you gain by moving away from 22) for absolutely no reason. (You could move to a different privileged port and still get everything else.)

tl;dr: You advocate giving up an actual layer of protection for a layer of obscurity. This is especially puzzling when you could get both.

Further, the reality of the situation is that as a practical matter most sysadmins are terrible about key management and when they see those warnings the very next thing they almost always do is immediately delete the key and hastily attempt to login to the machine via ssh. (The better ones to see what's going on and try and fix it, and the worse ones just assume that the key changed because sysadmins change keys all too often without notifying users and don't investigate at all.)

It turns out that humans are annoyingly predictable.

<comment><AUTHOR> Ok, fair point.

I'd say it differently, though. Instead of defending the original point, which was bad, I'd instead say among all other controls--most important of which is patching, removing passwords, etc.--one control is running below 1024.

I could go for that.

Except I actually think the gain from being up high (over 60K) is greater than the gain from being below 1024. It's not about being invincible, it's about not being a target at all.

<comment><USER16> Firstly, I like the tone you used to concede your original point.

As to whether the port should be below 1024 or above 60000, I am undecided. I'd love to see some empirical data on this: let's say I run ssh over several days on port 22, port 762 and port 90332. How many connections do I get for each port?

<comment><USER17> For 90332, I suspect not many :)

</comment></comment></comment></comment></comment></comment></comment><comment><USER18> The reason he's right is most attacks on SSH are one-dimensional.

In most cases the dimension is IP range - an automated process moves from IP address to IP address examining port 22 for any common vulnerabilities. Rarely do these processes check all ports. Moving your SSH deamon to a different port prevents those automated processes from _then_ hitting your security layer on whichever port you are running.

The other dimension of attack is when an attacker is focusing on your IP address specifically. Then he probably is going to nmap your IP and discover which port(s) SSH is running on. Changing the default port for SSH doesn't help here, but this use case is far less common.

Like others have said, changing port doesn't remove the need for security measures (cert-based/passwordless login, disable root, fail2ban) but it reduces any of those even being tested in the first place when most of your attempted attacks are IP-range based.

<comment><USER19> Turning off passwords and only using keys also mitigates the standard brute force attacks that happen. Frankly I'd much rather do that then have my server on a non-standard port.

<comment><USER20> Attacks on port 22 end up consuming CPU.

<comment><USER21> and attack on other ports don't?

<comment><USER22> The assumption is that bots don't usually scan other ports: way too inefficient for them to scan all ports for every potential target host.

</comment></comment></comment></comment></comment><comment><USER23> In moving sshd to an alternate port, I've noticed two things: a _greatly_ decreased amount of log noise from dictionary attacks, and a moderately _increased_ amount of portscans.

It's reasonably clear to your average net malfeasant that any host running recognizable services is going to be running sshd.

So why not do both?

Put a dummy sshd on 22/tcp, deny all auth attempts, log whatever keeps you swimming in interesting data.

Then run real sshd elsewhere, possibly filtered, possibly port knocked, and hopefully permitting key-based auth only.

<comment><USER24> I've done this in the past with some pretty good results. Though, I've dropped it because I found myself constantly locking myself out of my own machines.

I can't deny, it is a cool technique though. PortSentry is a good tool to use for just this. Anytime someone came to :22 and the machine just disappears.

</comment></comment><comment><USER25> Actually, one thing I've found useful is keeping an sshd listening on port 443. I know, I know, sacrilege reusing the HTTPS port, right?

The benefit of this is that it can allow you to tunnel through an HTTP proxy (e.g., like in a corporate environment). Many HTTP proxies only allow traffic through to port 80 and port 443. The benefit of ssh on port 443 is that if the proxy is handed a CONNECT verb, it will transparently just transmit data between your client and the remote server, irrespective of what that content is. In fact, this behaviour is what makes HTTPS remain secure when going through an HTTP proxy.

You can use this to tunnel ssh through an HTTP proxy. Putty supports this out of the box, but if you're using openssh, you'll need corkscrew also.

You can always try to tunnel to an ssh server on port 22, but most proxies will hand you HTTP403 on any CONNECT request to a non-port 443.

More info at [http://daniel.haxx.se/docs/sshproxy.html](http://daniel.haxx.se/docs/sshproxy.html).

<comment><USER26> > Many HTTP proxies only allow traffic through to port 80 and port 443. The > benefit of ssh on port 443 is that if the proxy is handed a CONNECT verb,

Thats not how HTTPS works, there is no HTTP proxy for 443. You are in a corporate environment where nothing is let out on port 80, except through their HTTP proxy. However, port 443 is allowed out.

> In fact, this behaviour is what makes HTTPS remain secure when going through > an HTTP proxy.

That would be a MITM against https and it doenst work that way.

If you would go over the http proxy to connect to your sshd on port 443, that would be stupid as the proxy would see your connections. Its much easier and better to just connect directly without asking the proxy.

<comment><USER27> It can work like this - see: [http://wiki.squid- cache.org/Features/HTTPS#CONNECT_tunnel](http://wiki.squid- cache.org/Features/HTTPS#CONNECT_tunnel)

<comment><USER25> Right. Sorry, in case I wasn't clear, the HTTP proxy acts as a _proxy_ for HTTP on port 80, but _tunnels_ HTTPS traffic (and anything else including ssh) on port 443. The tunnelling is done using the HTTP CONNECT verb.

</comment></comment></comment></comment><comment><USER28> He's right that "security by obscurity" isn't the entire story -- it's more like a mnemonic device for the more complex idea that:

1\. In the real world, security resources aren't free.

2\. Security decisions are made by users.

3\. Humans will engage in risk compensation [1]

4\. Setting policy doesn't change people's brains, it just tells them what to do.

5\. It doesn't matter what you intend, it matters what users actually do.

The upshot of this is that any security policy that is highly visible and highly inconvenient will reduce your security, and has to have a _substantial_ benefit to justify its cost. You can say "I'll do stupid port reassignment tricks, and I'll also mandate that passwords are forbidden, and require that private keys be managed properly" but at three in the morning when the whatever is overdue and not working what you're gonna get is:

 _I 'll just do password auth with root:root, nobody ever hits port 24601 anyway. Besides, look at this page [2], using a strange port makes me invisible like the Predator and makes me four thousand times more secure! I really want to believe this so I do._

Also, subverting scanners is an anti-security move, not a pro-security one. Scanners are a helpful tool to identify what the hell is running on your network. Your security efforts have to find _every_ hole, the bad guys only have to find _one_. Don't put yourself at an even bigger disadvantage by making your systems harder to analyze.

[1] [http://en.wikipedia.org/wiki/Risk_compensation](http://en.wikipedia.org/wiki/Risk_compensation)

[2] [http://www.danielmiessler.com/blog/security-and-obscurity- do...](http://www.danielmiessler.com/blog/security-and-obscurity-does- changing-your-ssh-port-lower-your-risk)

<comment><USER29> I think you're making some assumptions about people in your argument.

This is really very simple, security is a multi layered thing and security by obscurity is never a good layer by itself but part of a larger "onion" it can be helpful.

Bottom line, good security always takes discipline because humans are the last line of defense. There is no one button solution and anyone in security should know this so the argument shouldn't even be present about that point. Changing the SSH port towards the internet is a very pragmatic solution to spam in your logs.

I know people will mention fail2ban but I'd rather not have a log parser running day and night on every internet facing server when I can just change the port and get rid of all that spam Forever. (I have yet to encounter one robot that can dynamically scan for SSH ports and use anything else than 22).

Also, in my personal opinion, using a high port like 24601 is insecure because if your SSH daemon ever crashes then an unprivileged user on your system can listen on that high port and receive your precious connections. So personally I always use an alternative ssh port under 1024.

<comment><USER30> > security by obscurity is never a good layer by itself but part of a larger > "onion" it can be helpful.

That's ok. Just don't pretend that you are getting anything worthwhile from that policy. All you get is a 10 bit door, added (not multiplied - so, it does not increase your overall security) to whatever security you already had.

In computer security, people normally consider anything with less than 64 bits worthless. A 10 protection can be brute-forced by hand.

As humans work, changing that port is a clear indicator of an admin that didn't care about avoiding the less secure modes of SSH. If you are looking for obscurity, I'd consider a non-standard port (and concern about bots) to be a huge flag announcing "This system is exploitable".

<comment><USER31> > I'd consider a non-standard port (and concern about bots) to be a huge flag > announcing "This system is exploitable".

Every system is exploitable. How is changing a port indicative of someone who did nothing else to secure their shell access? I keep all mine on 22, but have been considering moving it just to keep the logs a little more sane for when I actually have to read them to find something.

</comment></comment></comment></comment><comment><USER32> Ouch, camouflage on a tank is a good analogy. Nice response post.

In addition to, as the author encourages, being "weary of the 'by obscurity'" argument (as I'm sure we all already are), I would also advocate being wary of it :)

<comment><USER33> No it isn't. Every server runs SSH, so this is more like there's a field, and you know there's a tank in the field, but you can't see it.

The next thing you do then is take out your standard radar device which scans the field, and pinpoints exactly where the tank is in 3 seconds, and then you aim your tank buster at that spot and fire.

<comment><USER34> Or, you put up a fake, camouflaged tank and let the enemy reveal themselves when they attack it. (Leave 22/tcp open as a honeypot, triggering an immediate iptables drop).

</comment></comment></comment><comment><USER35> As I understand his argument, it's "Changing port number add security, therefore it's a good idea." I think nobody argues that it _adds security_. The problem is that:

1\. It adds _very little_ security: 16 bits is not much, and the result is not 256 bits (say) of SSH key plus 16 bits equals 272 bits, but instead effectively still 256 bits, or 256+8×10⁻⁷³ bits.

2\. The security it adds is itself bad (sent in cleartext, easily brute- forced)

3\. These problems stand against the many drawbacks of this previously discussed (complexity, confusion, etc.).

And the final argument: If increased security is what you want, _simply increase your key lengths and /or password lengths_, and you will get much more than 8×10⁻⁷³ bits of security, without any of the above problems.

<comment><USER36> I changed it because it makes FreeBSD's nightly security run output not contain thousands of lines like this:

        Jul 28 23:53:57 hostname sshd[1068]: Failed keyboard-interactive/pam for root from 22.214.171.124 port 55040 ssh2
        Jul 28 23:53:58 hostname sshd[1076]: Failed keyboard-interactive/pam for root from 184.108.40.206 port 55155 ssh2
        Jul 28 23:53:58 hostname sshd[1076]: Failed keyboard-interactive/pam for root from 22.214.171.124 port 55155 ssh2
        Jul 28 23:53:58 hostname sshd[1076]: Failed keyboard-interactive/pam for root from 220.127.116.11 port 55155 ssh2
        Jul 28 23:53:59 hostname sshd[1084]: Failed keyboard-interactive/pam for root from 18.104.22.168 port 55460 ssh2
        Jul 28 23:53:59 hostname sshd[1084]: Failed keyboard-interactive/pam for root from 220.127.116.11 port 55460 ssh2
        Jul 28 23:53:59 hostname sshd[1084]: Failed keyboard-interactive/pam for root from 22.214.171.124 port 55460 ssh2
        Jul 28 23:54:00 hostname sshd[1092]: Failed keyboard-interactive/pam for root from 18.104.22.168 port 55566 ssh2
        Jul 28 23:54:00 hostname sshd[1092]: Failed keyboard-interactive/pam for root from 22.214.171.124 port 55566 ssh2

<comment><USER37> Here is an even worse log output nightmare: Enable logging in the firewall/ids, which show _all_ packets sent to a closed port.

It's massive. Endless. _Like looking into the endless void._

Of course, my computer does not log packets that are just bouncing against my computer. It would distract me too much, and maybe it would do so for you to. Easier just to tell the computer to not bug you about it, and trust that the "attack" is harmless enough so to not to bother logging it at all.

<comment><USER36> This is the default email that a freshly installed FreeBSD sends you every night. It also contains a bunch of other bits. That's a bit different than subscribing to firewall spam.

<comment><USER35> It follows, obviously, that creating these log entries in the first place (much less _reporting them_ ) is a silly thing to do, just as receiving firewall logs for every packet to a closed port would be.

</comment></comment></comment></comment></comment><comment><USER38> The "change-port" discussion for SSH is so boring :-/ OpenSSH is I guess the most secure daemon on all your servers. People should more think about to change the HTTP(S) ports of their non-public facing sites and other daemons and frameworks they use.

<comment><USER23> > OpenSSH is I guess the most secure daemon on all your servers.

Probably correct. However, sshd _should_ be the only public facing daemon that hasn't dropped root privileges immediately after binding to its privileged port.

So it should be the only daemon that can directly offer root privs to an attacker.

I say "should" because it's a big world out there and people do some bizarre and indefensible things. Sometimes merely lazy things, but the net effect is the same.

<comment><USER39> It is almost the same thing to offer non-root privs, because of the great number of patched and unpatched priv escalation holes in Linux. Almost guaranteed you will be able to get root if you get normal user privs.

</comment></comment></comment><comment><USER40> Better solution: require VPN connectivity and don't expose SSH on any port to the public Internet.

Running services on non-standard ports will make the next admin that takes over this server want to track you down and smother you in your sleep.

</comment><comment><USER41> Here is something to think about, the author is right, but if you follow many ssh setup tutorials that say to move to say port 25000, you are less likely to be port scanned than the default, but still more likely than if you had used something totally random like say port 42 or 818. By me even writing this clever hackers will start scanning those ports too, just to be sure they are hitting everyone. That being said, any port is better than the standard one and picking an unused port instead of the standard ssh port will give a reasonable 80/20 benefit for a lot of people.

<comment><USER42> Port scanning is generally automated (edit: and scans _all_ ports, not just the handful you listed), so it doesn't actually matter which port you pick as long as it's not 22. Port scanners like nmap are widely available, so the time to actually figure out which port is running SSH is quite short in practice.

Basically, there are two classes of people:

1\. Those who use port scanners.

2\. Those who do not.

If you are being attacked by someone in class 1, then moving your port gives you absolutely no protection. Thus moving your port is only worth anything at all if the percentage of class 2 people is significant.

However, if you also consider the probability a person in each class has of actually compromising your machine, then the security looks less convincing. Yes, it might be true that 95% of people don't bother to use a port scanner, but the most competent hackers are almost certainly going to be in the 5% that do use one.

<comment><USER43> those numbers don't look good at when you take a look at what those two classes of people are doing.

ie. 1. is targeting you specifically, 2. is bot targeting everyone

when presented with two options, thinking of those options as 50:50 is natural, but it's really more like 0.0000001:99.9999999

<comment><USER44> A bot doesn't necessarily only scan port 22 in a range - nothing stops the bot herder making it scan 1-1024 instead.

<comment><USER22> Yes there is. It's called economics.

</comment></comment></comment></comment></comment><comment><USER45> Standard or not standard port, you still should use port knocking in a way or another (or only enable it for the specific IPs that can access it ever). Internet don't even should be able to know that you have there a service that is only for you or for a very small amount of people.

If a remote vulnerability is discovered in the server (happened in the past, don't rule it out for the future), you will be attacked, and it won't be a brute force attack to be blocked by fail2ban or similar. You can be scanned in any time, put in a database as "having ssh version x running in y port" and get ready for future use.

And if well simple port knocking could be defeated inspecting your traffic, there are variants like fwknop that are resistant to that kind of interception or replaying.

<comment><USER46> Agreed. Contrary to the naysayers, port knocking is an _unalloyed good_.

Whatever your setup is, it's _better_ if it doesn't show up in a scan at all.

The "knock is a weak password" argument is silly - nobody suggests using _only_ the knock, but rather to use the knock in addition to your existing auth scheme.

</comment></comment><comment><USER47> Its kinda silly to move the port, a targeted attack is going to start with an portscan of you box, the attacker is going to say "oh what's this here on port 2222?" and promptly discover that its ssh listening on a high port. Port knocking would make that discovery less likely I suppose but its still all treating a symptom of a bigger problem.

So why not solve the problem with something a little more proactive like turning off password auth and go for sshkeys only. Maybe toss in something like fail2ban if you want to interrupt kiddies scanning your boxen.

That said high port ssh can be nice if you're frequently on restrictive networks and getting out on port 22 is impossible.

edit(spelling)

<comment><USER48> Yes, you have pointed out - a targeted attack.

What if non-targeted attack like a robot scanning all port 22 in your datacenter?

<comment><USER47> Thats where fail2ban is useful, pick a number of failed auth attempts on _any_ service you care to integrate, lets say 8 PAM failures, and trigger a rule that inserts an iptables rule to drop/reject the attackers IP for 5minutes. That will time out the ssh scan for all but the most patient scanners. If you shared the fail2ban database across hosts you could inject null routes for the offender into your router or block them at your firewall.

<comment><USER48> I think you have missed the point - you should tell why using non-standard port is less secure, not provide me an alternative, because I would also argue VPN is better fail2ban.

You cannot neglect the fact that there are vast amount of bots scanning only port 22 in the Internet. We know this because we have found the evidence in our OWN logs, not from those security experts always saying security through obscurity is bad and therefore we should do nothing.

<comment><USER49> Because moving your port has an opportunity cost.

Documenting and configuring it has a non-zero cost which could be spent doing something else more impactful.

I've never seen an infrastructure where there was a sufficiently advanced state of security such that obscuring the port numbers of services was the at top of the todo list.

Unless people recommending these things work for shadow organizations I've never heard of, I'm pretty sure it's something done without any kind of cost- benefit analysis.

What are the odds of a SSHd zero-day? Or, more specifically, what are the odds that someone with zero-day knowledge would be so stupid as to decide to risk the vulnerability being discovered by others by using it in a horizontal search of all running SSHds?

Because it has to both be more likely than any other attack that could be mitigated (and port obscurity would have to be the most effective solution) with the same effort.

Pretty sure that for virtually all infrastructures, auditing that your systems are properly isolated, users and services have the least privilege possible prevent massively more probable attacks, and that firewalling services or port knocking or really anything are more effective solutions for this attack.

</comment></comment></comment></comment></comment><comment><USER50> One question, why people always say that disabling passwords is important. AFAIK, passwords with keys is better than keys only. Now if someone gets the keys they can access the service with those keys without the passwords. Disabling passwords just makes security in one way worse. Think about chip & pin, because you have your credit card, wouldn't it be smart to disable PIN completely? Of course key ring could be encrypted, but that still allows off- line attack against it. If password is queried on-line, you can limit password attempts which you can't do in off-line situation. - <USER2>

<comment><USER51> Disabling password-only authentication doesn't prevent you from using a password on your key. When you login with key-based authentication you will be prompted for the password for your key, even if password authentication is disabled, because they are two separate & unrelated processes.

</comment></comment><comment><USER52> Anyone use Dome9? ([http://dome9.com](http://dome9.com)) they close all of your ports and open them on demand via chrome extension or mobile app for when you want to use SSH.

<comment><USER53> Seems kind of like inetd? Except having to trust the reliability and availability of a remote provider to manage it for you?

</comment></comment><comment><USER54> There's nothing inherently good or bad about running SSH on another port. Honestly this argument is a bit silly given how easy it is to port-scan and many scripts out there will do that before actually trying anything. Essentially all you're going to do is make things annoying for your users.

The really real good idea is running a VPN in front of all of your servers and never allowing SSH access to the outside world. I have two ports (at most) open on all of my servers: 80 and 443. OpenVPN takes less than an hour to setup. There's no reason not to set it up!

<comment><USER55> Agreed, VPN via physical firewall is a particularly nice solution.

Sounds like you've offloaded mail, dns, etc. elsewhere if you only have at most 80 and 443 open.

</comment></comment><comment><USER56> That was very fair response. Kudos for being able to attack the points, not the person.

</comment><comment><USER57> It's probably already been said, but it can be said enough: Security through obscurity is valid for marginally increasing the total security margin, but relying on any one practice or technique always smells like a dangerous approach. (Hence the hollistic practice of many overlapping features providing defence-in-depth.)

Changing ports reduces the threat surface in limited but practical ways, however far more effective would be using secure port knocking (say fwknop with GPG and is also time-based).

Secure port knocking and changing ports together would be perfectly valid. In fact, I have deployed these for openbsd jumpboxes guarding core infrastructure. So breaking in would require defeating fwknop with GPG and ssh.

(If anything needs public auditing, it's GPG and SSH. VPN code also considering the logic often makes OpenSSL look simple. )

</comment><comment><USER58> By experience, it just lets you avoid getting a shitload of brute-force attacks. So I do it.

</comment><comment><USER59> On my personal boxes I use a combination of non-standard ports, disabling password auth (seriously, this will do more for your security than anything else), and fail2ban. Even with key authentication fail2ban still blocks several IPs a day.

</comment><comment><USER60> I apologize but there is no such thing as "it is (ALWAYS|NEVER) a good idea" no matter how many blog posts people wrote about that.

It just depends on which are the tradeoffs between the antithetic goals that you have when you do any kind of security hardening.

Aside from that, since many already mentioned port knocking as another layer in the pile of this game, let me point out that not all port knocking (-like) implementations are __that weak __, look e.g. at knockknock [[http://www.thoughtcrime.org/software/knockknock/](http://www.thoughtcrime.org/software/knockknock/) ].

</comment><comment><USER61> Wasn't it posted on HY that modern exploit tools like metasploit scan all ports for SSH services by default now?

That was my biggest reason not to bother changing the port.

Is there any real reason beyond that? (I do use fail2ban to block repeated attempts.)

</comment><comment><USER62> He's overreacting a bit. Port knocking is not just an "obscurity layer". It's more akin to a PIN or weak password.

The condescending opening is a tip off ("people who _almost_ understand the topic").

<comment><USER63> Even so, it is still a very weak security layer that you are adding on to something that is already very secure. Does that really make it less secure?

Now running SSH on a different port is an even weaker obscurity layer, but still, it still adds some security.

<comment><USER35> I think _nobody_ is denying that it _adds security_. The question is, does the added security offset the increased complexity and associated difficulties?

<comment><USER46> This is, I think, the only valid argument against knocking.

The standard (and always condescending) responses are that it is either a very small password and/or that an attacker can record and replay the knock from an eavesdropping position.

Both of those are true, of course, but they neglect that the knock is always _in addition to_ whatever else you are already doing to protect ssh.

So I have always rejected those arguments and continue to evangelize for port knocking.

BUT, the added complexity part is a valid point. I try to keep systems as bare and simple as possible and hate to add even a single unnecessary dependency package. I am happy to say that (on FreeBSD, at least) knock[1] is light, simple, and has run for _thousands of days_ on busy production servers as well as my personal servers without even a single incident.

[1] /usr/ports/security/knock

<comment><USER35> I used the word "complexity" not in the meaning of "the installed system is more complex for having more software in it", but in the sense of "I don't want to feel like I'm entering Diagon Alley just for wanting to use SSH" – i.e. complex to _use_ , not complex to _set up_.

But your interpretation works too – they are _both_ valid arguments, in my opinion.

</comment></comment></comment></comment></comment><comment><USER64> How about: Why it doesn't matter what port you run SSH on

* Because anything but the IP address of your office or VPN connection should be blocked at the firewall level for that port

<comment><USER19> Why would I use a VPN when I have SSH? IE, why do you think that a VPN is somehow more secure than an SSH connection?

<comment><USER65> VPN is not mutually exclusive with using SSH. What he's saying is that people should firewall their SSH ports to only allow access from trusted IPs, and VPN's make that easier to do.

<comment><USER19> So that means you can't SSH into your remote machine from an arbitrary connection? What do you do when you're traveling?

<comment><USER64> You use a VPN and then connect to SSH

<comment><USER19> So then we go back to my original question. Why do you think a VPN is more secure than SSH?

IE, Why is it important that your SSH port only be connected to by known IPs, but your VPN port is OK to be connected to from anywhere?

<comment><USER64> It's not really about one being more secure than the other. They are both very secure. It's just good to have multiple layers of protection in case something goes wrong somewhere, whether it's caused by human error or something else.

</comment></comment></comment></comment></comment></comment></comment><comment><USER66> Let's start with a secure implementation for remote access:

1\. SSH:

Port - <USER3>

Protocol - <USER4>

PermitRootLogin - <USER10>

StrictModes - <USER11>

MaxAuthTries - <USER7>

PasswordAuthentication - <USER10>

PermitEmptyPasswords - <USER10>

ChallengeResponseAuthentication - <USER10>

UsePAM - <USER11>

2\. PAM_ABL (auto-ban by account after three retires)

3\. IPTables (auto-ban by IP after three retries)

So in the above implementation an attacker has three attempts, max. This means the logs are quiet, yet accurately depict intrusion attempts. This also stops brute force attempts in their tracks and requires no exemptions to normal workflow.

If, under the above circumstances, I were to obscure the port as well, this would serve no purpose than to completely side step script kiddie brute force attempts (as minimized as they would be in this configuration) with the horrific side effect of forcing my users to maintain (at the least) a config entry for the custom port assignment. Which, by the way, would become perpetually worse with the amount of servers and users in play.

This is why obscuring the port is such a bad idea.

And if you still want to obscure the port because the server, or network device, in question should only have occasional access by an extremely limited group of people, then just throw on a white list and possibly restrict access only through another server. Both provide more security than moving the port.

And moreover, this article isn't even about SSH. It's about the semantics surrounding the usage of the term "security through obscurity" in the previous article. Which is hilarious to me, as both articles are full of shit. For one, the security implications of non-privileged ports is moot as the attacker already has access. And two, being less likely of a target is still being a target. Those five people who found the port in the test sample. Those are the ones who win most likely to exploit; not the thousands of script kiddies brute forcing you.

Your time would be much better spent obscuring the actual version information for the service than the access point to it ...

(Reposted here, as the original site went down.)

</comment><comment><USER67> So, the guy's point is that if someone has access to your machine, then it's ok to make life easier for them to run a fake sshd?

</comment><comment><USER68> I still can't understand why things like port knocking or single packet auth schemes like fwknop never really took off ...

</comment><comment><USER69> I run SSH on port 22, but occasionally (when I travel) I will run it on port 443. Yes, know 443 is used by HTTPS, but:

1) I don't run HTTPS on the box I SSH into

2) I might hit an overly restrictive WiFi that only allows traffic out over HTTP and HTTPS

Which is another reason why you might not want to run SSH on another port. You might not be able to reach it.

</comment><comment><USER70> I run my ssh server on port 443 in addition to 22, because some network connections block anything except 80 and 443, and this allows me to easily proxy through that broken network connection.

(Actually, I appear to have stopped doing this. But it's something to consider if you are on weird networks on a regular basis.)

</comment><comment><USER71> Amend the title to include (if you run only one SSH daemon and you're the only one who needs to access it).

Then I agree.

Otherwise, hell no.

</comment><comment><USER72> I posted the original because I thought it was interesting. Elated to see an honest response. I love HN.

</comment><comment><USER73> Better yet, put a firewall in front of sshd and only allow connections from your management network ;)

</comment><comment><USER74> Is there a way to increase the privileged port range from 1024 in linux? If it's set to a high enough number, say 1024*1024, that would solve both problems (we could use a large port number for ssh and not allow non-root users to hijack the port).

<comment><USER75> 1024*1024=1048576 TCP port is a 16-bit value i.e. only values between 0 a 65535 are valid, it's not a wide range at all

</comment></comment><comment><USER76> After pondering this article, I think the only reason to run SSH on a different port is to prevent zero day ssh authentication bypasses, which I don't think is a decent reason -- I'll eat my hat when this happens again.

</comment><comment><USER77> I think he mentions port knocking precisely because he DOES understand point #1 ( the difference between security through obscurity as a layer but not your only layer), and is giving an example of using it as one such layer.

</comment><comment><USER78> I don't change the port, but use keys and instead allow a tiny, tiny subset of the the internet to talk to my servers on 22... my networks.

Very little hassle, no crap in the logs. Is there a drawback I'm missing?

</comment><comment><USER79> So really the only problem you had with the argument is the security via obscurity? Yeah, me too. Otherwise, his point were spot on and you didn't address them directly.

</comment><comment><USER80> A daemon that blocks the attacker address after a number of wrong attempts is much more secure. IMHO moving SSH to another port is kind of Cargo Cult Security.

</comment><comment><USER81> I still don't see any reason to change the port. Use _only_ key auth. Problem solved.

</comment><comment><USER82> if you have sshd on 22 you get 1000 hack attempts per day. if you move it somewhere else you probably get none the whole day.

the chance to get hacked is way higher. why would you not want to lower the risk?

</comment><comment><USER83> while I agree with most of the things in this article, he states the obvious...

Don't understand how this article got to the main page and it's still here after more than 11 hours.

</comment><comment><USER84> Thanks for writing up the same response I had to that article.

</comment><comment><USER85> a: $port != 22 is enough to thwart most bots and skiddies. If you think the port number is a guarantee that you are safe or that you are communicating with a blessed ssh you are sadly mistaken.

b: Uhh the port number means nothing. Host keys are there for a reason... Someone does not understand the functions of SSH. [http://www.snailbook.com/](http://www.snailbook.com/) <\- great book

c: If you are not investigating fingerprint issues when logging in via SSH and you call yourself a sysadmin, please stop. You are going to be the reason your company ends up in the news because your shit got owned and 2,000,000 user account hashes were leaked blah blah.

d: If you are not using key based auth and you have a fly by night keystore policy. Which means you have a keystore - stop. The whole keystore for SSH shit irritates me. I cannot tell you how many times I have heard sysadmins say a that a single private key is a "best practice". It is not a best practice it is a stupid practice and really prevents you from protecting unauthorized logins on other machines for the obvious reasons.

       Put your public keys on bitbucket.com or source
       management. Put your private keys on an encrypted disk
       in an encrypted archive if you must. This is still dumb
       imho because it is not needed.

       Leave one account (root) with console only/no ssh access
       that will allow for keys to be revoked/recreated when
       users need new keys.

e: The original article [http://www.adayinthelifeof.nl/2012/03/12/why-putting- ssh-on-...](http://www.adayinthelifeof.nl/2012/03/12/why-putting-ssh-on- another-port-than-22-is-bad-idea/) Is wrong and misguided. port knocking or knockd is an obscurity measure, precisely the kind he argues against. The linked article from the OP calls this out.

f: Spinning up daemons is a big deal for non-priv users? So spinning up a remotely accessible Lisp out of emacs from a screen that is running in the background is bad? Hmm, here I thought that computers were meant to be tools for humans to get work done... Sorry, background processes are part of getting shit done. Users should be able to spin up the stuff they want to spin up in the network segments they have access to without the bureaucracy of misguided fools making the jobs of others more difficult because they think spinning up a gunicorn process or a custom daemon is worse than their unpatched kernel, apache tomcat and mysql listening on a publicly accessible address. Stateful firewalls and hosts allow/deny are there for a reason.

Sorry for the snarky reply here but there are a lot of people chiming in that obviously have very little knowledge about managing *nix ops and remote access. I have pretty strong opinions about this kind of stuff. Especially the single key stupidity and not checking host fingerprints.

<comment><USER86> Sorry for deviating for the topic, but I think it must be said: "Sorry for the snarky reply" is not enough, considering that you wrote it at the same time you could have gone back and rewrite the text into a polite, well-worded argument. That's just condescension - if you really were sorry, you'd have rewritten your text.

By replying like that you've ensured that your point won't come across - <USER13> all I know you might be technically right, but using that tone ensures that lots of people will refuse to read past the second paragraph.

If your argument is solid, that's all you need. IMHO, snark makes your point come across as bragging, and no one likes that.

<comment><USER85> "Sorry for the snarky reply" is not enough, considering that you wrote it at the same time you could have gone back and rewrite the text into a polite, well-worded argument. That's just condescension - if you really were sorry, you'd have rewritten your text."

You are right. I am not sorry for the snarky reply.

"By replying like that you've ensured that your point won't come across - <USER13> all I know you might be technically right, but using that tone ensures that lots of people will refuse to read past the second paragraph."

Okay.

"If your argument is solid, that's all you need. IMHO, snark makes your point come across as bragging, and no one likes that."

Okay.

</comment></comment></comment><comment><USER87> This is a non issue. Set your iptables to start dropping packages after 3 failed login attempts.</comment>


The end of the road for OEMs - <AUTHOR> http://www.extremetech.com/computing/134203-the-end-of-the-road-for-oems?utm_source=rss&utm_medium=rss&utm_campaign=the-end-of-the-road-for-oems <comment><USER3> > You can empathize with the OEMs, though. For decades, these companies have > had an incredibly easy ride, producing mediocre, commodity computers, and > getting very rich in the process.

I love how someone who's never worked in the sector asserts that it's all trivially easy to do and the money just rolls in.

In reality, there is almost no market sector that's trivially easy. Problems are fractal. EVERYTHING is hard. I'm sure that if you dig deep enough into it, slicing bread is a tricky business to be in. Should the bearings be teflon or delrin? How do you compete with the new machines from China? What about that new OSHA mandate coming down the pike?

<comment><USER4> It doesn't matter what the sector is. Doing the same thing as everybody else, and doing the same thing year after year after year, is trivially easy.

Slicing bread is a dead easy business to be in. You buy a bread slicer, and you let it run. innovation, no matter the sector, is what is hard. And the point the article is making is that we haven't seen any innovation out of the tech OEMs in a long time.

<comment><USER5> > Doing the same thing as everybody else, and doing the same thing year after > year after year, is trivially easy.

No, it's almost impossible. Doing the same thing for year after year is impossible because someone comes along and does some part better from the customer's point of view, and then you don't have a business.

> Slicing bread is a dead easy business to be in. You buy a bread slicer, and > you let it run. innovation, no matter the sector, is what is hard.

There are no "easy businesses".

For starters, there's no "bread slicing" biz. Slicing bread is a small part of whatever it is your customer is actually paying for.

Never confuse "units of billing" (suc as "loaves of sliced bread") with the business. For example, the biz is often making sure that they can serve their customers profitably. Fresh, on-time, small-inventory, etc is what makes a difference, not the bread slicer.

There's innovation in every biz that lasts. Technology is usually the easy part.

<comment><USER4> >No, it's almost impossible. Doing the same thing for year after year is impossible because someone comes along and does some part better from the customer's point of view, and then you don't have a business.

That's what I'm saying. Nobody in the pc OEM game has done that lately, that's why it has been so easy to be a OEM.

<comment><USER5> > That's what I'm saying. Nobody in the pc OEM game has done that lately, > that's why it has been so easy to be a OEM.

You're wrong. You seem to think that PC OEMs just order some parts and slap them together. That's no more true than "buy a bread slicer and you've got a biz".

Being a PC OEM has always been hard and the ones that have survived have innovated. (Consider Starbucks. Pouring coffee isn't their biz.)

Never confuse "I don't know what they do" with "they don't do anything".

</comment></comment></comment></comment></comment><comment><USER6> I think the tech-press is misreading the situation. What Microsoft is trying to avoid is a slew of mediocre former Android slates hitting the market with the release of Windows 8.

Instead, they are trying to insure that there will be decent slate hardware available at the Windows 8 launch.

It's not as if OEM's have been knocking slates out of the park since the iPad was released. And I suspect that the OEM's haven't exactly been clamoring for a Windows slate OS, either, considering the lackluster profits for everybody but Apple (and perhaps the Amazon ecosystem).

Come 2013 Microsoft will have options - either to continue as a hardware vendor ala Xbox (and slates are a great product line extension); or having gathered meaningful data to scale back to OS provider as was the case with Kin.

Sure the OEM's will not get to set the tone for Windows 8 slates right away. Given their love of crapware, that's a feature, not a bug.

<comment><USER7> "It's not as if OEM's have been knocking slates out of the park since the iPad was released."

I've worked with a number of OEMs and original device manufacturers (ODMs) over the years and they have been a hugely important resource for getting technology into consumers hands. But one of the things which I have learned is that they don't make products, they manufacture them. The difference between those two statements is subtle and important. An OEM will manufacture exactly what you ask them to manufacturer, they will write into the contract what it is and they will build it. If the device they build is not competitive to some other product it really isn't there fault, its "you" the person writing the contract's fault.

iPads are made by FoxxConn, which is, an OEM. They make lots of stuff for lots of people. They aren't threatened by the 'newer than the new iPad iPad' because they know that Apple will likely ask them to build that one too. That the iPad is an iPad is because Apple drove a vision of what an iPad should be so hard they drove into FoxxConn's heads and they build them.

But not all OEMs are product companies. They are just good manufacturing companies. And sometimes they say "Why should we let these guys push our price down and take all the profits?! They buy those from us for $X and sell then for 3X$! We want that money too!" And so these manufacturers try to make a 'product.' And they do make it by looking at it and making something as similar as possible, but they often don't "get" what it is that makes the product the product because they haven't had the vision drilled into their heads. So you get 'knock off' products.

In all my dealings with OEMs the OEM assumes they are doing the hard job and the product design is the easy part, and the product guys figure they have the hard job and just making it is the easy part. They are both wrong, there is no 'easy' part.

<comment><USER6> I agree. I was using the term "OEM" in the same sense it was used in the article, as a stand-in for "PC company which purchases Windows OEM licenses in high volume," e.g. Acer. These companies generally are branded in a way that an automotive OEM such as GKN is not.

</comment></comment></comment><comment><USER8> "For almost as long as Microsoft has existed, OEMs have ridden its coattails and made hundreds of billions of dollars in the process."

So did Microsoft, thanks to those OEM's. I for one hope that Microsoft's goal is to kill the OEM's. I mean, imagine if all of the sudden no other company but Microsoft could create a Windows machine. No Windows XP, no Windows 7, no Windows 8. Do you think hundreds of millions of users all would just buy from Microsoft their PC's?

I think it would create a huge vacuum in the market, and the OEM's would simply flood the market with Linux machines. Normal people would just buy those Linux machines, while the more savvy users would keep pirating Windows for a few more years until Linux becomes a more viable market.

Sure, Microsoft might get say 20% of the "PC" market on their own, just like Apple has in the mobile market globally. But the vast majority of the market would be filled with OEM Linux machines, just like 70% of the market is now filled with Android phones from other OEM's.

<comment><USER9> > Do you think hundreds of millions of users all would just buy from Microsoft > their PC's

Yes, if that was the only way to get Windows. Linux doesn't run their software. Windows does. They'll buy Windows.

<comment><USER10> Lots of Windows software will run under Linux with help from Wine. (<http://en.wikipedia.org/wiki/Wine_%28software%29>)

<comment><USER11> Lots of it won't, too.

I'd love to switch to Linux - but until Premiere, After Effects, and Photoshop all run as well on Linux as they do on Windows, I can't. (Not to mention various other bits and pieces of 3D software).

</comment></comment></comment></comment><comment><USER12> " incredibly easy ride, producing mediocre, commodity computers, and getting very rich in the process"

My god! Another way to say that they did all the hard work(the hardware itself) and earned 1-3% margin in the process.

...while MS will earn margins bigger than 95% on Office and Windows. >30% margins as the entire company(Once MS spent billions trying to extend his monopoly to other sectors).

OEMs are not going away. It is MS who is in danger. OEMs are the Vietcom, used to live on a cage or in the jungle, eating scraps. People that want cheap PCs will continue buying them with Windows 7, Linux or Android.

<comment><USER13> I can't tell if "Vietcom" is a typo or a clever adaptation of Viet Cong to high-tech companies.

<comment><USER14> Viet Cong that implement IUnknown. Crazy.

</comment></comment></comment><comment><USER15> It's a shame nobody is going to make components for all of the data centers running Linux anymore.

Also, I feel really bad for Apple and Google that Microsoft is going to deliver such an ass-kicking tablet that it puts them out of business, or at least into a distant second and third place.

Yeah, that was sarcasm.

My experience, over 25+ years, has been that MS products are almost always inferior to the competition (with the possible exception of XBox), and only exceed where they can exploit bundling. I don't see the leverage over tablet users. Also, how many places hung on to WinXP until support ran out, since Vista/7 sucks so bad? (7 might be less glitchy, but I still HATE the new UI, and I am relieved not to have to use it at home)

I suppose if MS starts to bundle their own PC hardware with Win8 at WalMart and BestBuy, it will make traditional PC components more expensive, alas.

<comment><USER16> Microsoft sells the best $20 keyboards and mice that money can buy, and has for the last 15 years.

<comment><USER17> Logitech does really well too (so maybe there is still room for OEMs?). I work at MS but I use a Logitech as my daily-driver mouse (it's hard to find a MS mouse that has a wheel with detents, is wireless, and has back/forward buttons).

<comment><USER18> I'm a Linux guy for two decades and all the hardware accessories I buy are from Microsoft - keyboards, mice, webcams, joysticks etc.

I did do Logitech for a while, but they were incredibly user hostile - <USER2> example they didn't have drivers available for download, at one point wanted to charge for them, and then the final straw was a driver for a USB keyboard that refused to install on the grounds that I was pirating the driver!

I detest the constant assumption in Windows that you are a vile thief stealing it, but the hardware accessories have been the other way around. Drivers always available, always worked, and even available for Mac. And on Linux the hardware has just worked out of the box.

</comment></comment></comment></comment><comment><USER19> Microsoft will make & sell, maybe 5M Surface units in the first 12 months. Maybe.

Who's going to make & sell the other 345M PCs that are sold every year.

This talk of Microsoft becoming a hardware company is crazy talk with no understanding of the underlying dynamics of the industry.

I recently wrote a post on this:

[http://ceklog.kindel.com/2012/07/25/a-mouse-and-keyboard- don...](http://ceklog.kindel.com/2012/07/25/a-mouse-and-keyboard-dont-make-a- hardware-company/)

</comment><comment><USER20> Buh, I think this article has totally missed the point.

First of all, I think the reason why the iPad and iPhone have been so good hardware-wise while most Android devices have been lackluster in comparison is that the vertical integration that Apple can achieve allows them to make decisions at this point that would be completely stupid if they were just another OEM or IHV.

Basically, because iOS is a very large ecosystem with a guaranteed large install base per product, Apple can afford to tape out chips that would have absolutely no chance of being profitable for a IHV (e.g., NVIDIA or Qualcomm). Since every iOS tablet sold for the next N years will use A5X, it makes sense for Apple to design and tape out their own SoCs specifically for that, but the device fragmentation inherent in the Android market makes it extremely difficult for IHVs to do the same. Look at A5X versus Tegra 3 in terms of die size. Tegra 3 is 80mm^2. A5X is 165mm^2. SoCs from IHVs (at least for the foreseeable future) need to be dual-purpose tablet/phone chips in order to deal the many devices the IHVs will need to target (differentiated using clockspeeds or binning), which means no huge die sizes allowed. Even if Android tablet sales increase to iPad levels overall, part of the reason for that is choice; OEMs probably won't be willing to use the same enormous processor in their $600 flagship as their $150 budget tablet due to their margins (or the chip wouldn't exist because IHVs wouldn't be able to make a profit at the cheaper levels because of the fab costs).

Vertical integration also means Apple can eat the cost of large die size SoCs because they don't have to worry about margin on the SoCs alone.

In other words, if bigger chips result in better experiences for tablets, right now the only way to guarantee that is to play kingmaker and only support one SoC. The way Apple has done that is to build their own SoCs and cut the IHVs out entirely. Yet, they haven't done this in PCs at all. PC hardware is all Good Enough at this point; there's no hypothetical 40%-perf-advantage-if- only-someone-would-build-it chip.

As the mobile market matures, platforms become more established, OEMs combine, etc, the need for vertical integration will disappear because mobile hardware will become a commodity, largely indistinguishable in meaningful ways besides minor perf/W or perf/$ advantages. IHVs will see enough sales to do what Intel or the GPU companies do in the PC space and build one scalable architecture for all platforms, there will be relatively established price points, etc.

<comment><USER21> I just want to mention that it's a lot easier to replace and swap parts in a PC than on a phone or tablet. Mobile devices are unmodular solutions that one can't swap out for 'newer parts', the way desktops, and to some extent laptops are.

I would also like to mention that Android integration is a bit poorly designed, IMO. If a hardware manufacturer writes drivers for Windows, those drivers are still likely to work as Windows itself matures with newer releases. However, with Android, each new release of its OS leaves dozens of models behind on a previous release. Couldn't Android have designed their OS to be a bit more... upgrade-friendly?

</comment></comment><comment><USER22> This article seems really weak on a number of points. It holds up the Nexus Q as an example that Google is moving into its own hardware manufacture?! And it claims that OEMs are unable to "innovate" - but when you look at actual hardware innovation they have been the _only_ ones innovating in the phone space; Apple has produced about 4 devices with identical form factors in 5 years. Contrast with Samsung and Asus who have produced all kinds of crazy stuff. It's not so much about innovation but quality, focus and finishing that the OEMs are not set up to do.

Personally I think these things are just cyclical: it takes a vertically integrated company to really break through into a new domain, that much is true. But then that new area will always be commoditized and the most open, flexible and widely available platform will "win" in the end - until the next major innovation cycle begins. We need both the yin and yang of this cycle to move things forward.

I do think MS may have unintentionally saved Android on tablets - the mere hint that Microsoft could possibly go its own way and leave the OEMs with nothing to sell will be giving them such nightmares that they will be doubling down on their investments in Android _if only_ to give themselves a lifeline to future viability if the unthinkable happens. Without that I suspect half of them were probably ready to completely jump ship and leave Android behind as a bad experiment.

</comment><comment><USER23> Some of the thin mini-itx offerings look interesting.

[http://www.engadget.com/2012/08/08/intels-thin-mini-itx- plat...](http://www.engadget.com/2012/08/08/intels-thin-mini-itx-platform- gets-stuffed-inside-a-monitor/)

[https://www-ssl.intel.com/content/www/us/en/hardware-develop...](https://www- ssl.intel.com/content/www/us/en/hardware-developers/thin-mini-itx.html)

[http://www.missingremote.com/review/lian-li-pc-q05-thin- mini...](http://www.missingremote.com/review/lian-li-pc-q05-thin-mini-itx- chassis)

True, you don't need an OEM to build them (and maybe that's the point here). But I don't quite get the Acer argument. Thin mini-itx devices easily bolt on to the back of their monitors.

Last time I looked, the inside of my Vizio 47" had nothing but room too.

Dell, Gateway, Acer and many others got their start with the DIY system builder -- and a Computer Shopper.

</comment><comment><USER16> Open computing as we know it requires choice when creating a system.

I don't want to have to pick my poison when it comes to walled gardens the next time I want a new system.

</comment><comment> old-gregg These two quotes make me feel very uneasy:

        Other companies do not physically possess the equipment
     or resources to produce anything that even approaches an
     iPhone or MacBook Pro

and

        Perhaps Lenovo can subsist at the bottom end of the
     market, or maybe it too will shut up shop.

While the rest of the article makes sense, I call the 1st quote a complete BS: Lenovo already makes vastly superior computers to Macbooks. They just lack the marketing (and confidence) to explain to the masses that cold and uncomfortable aluminum is actually a pretty shitty material for a laptop. The confidence situation is so bad that they even started replacing their supeiror keyboards with calculator keyboards. Because Apple does. Ughh...

And my very first Android phone (Nexus One) had a vastly superior (and practical) construction than the iPhone of the time. The thumb ball was great for precise scrolling and you can tell up/bottom or front/back apart when holding the phone in your pocket. But once again, there was no marketing to rub that into the brains of the shoppers.

Although it will indeed be irrelevant if Microsoft/Google push OEMs aside. For one, I am not looking forward to the depressing "glossy aluminum future". If nobody has ever managed a laptop even half as good as a Thinkpad, I am having doubts if Microsoft will.

<comment><USER24> Can you elaborate on your aluminum complaints? I like Apple's metal-centric industrial design there, and have ever since they introduced the first Titanium PowerBook, but I'd certainly be interested in another perspective there. I haven't seen a plastic machine that seemed anywhere near as solidly built, but I may simply have never been exposed to the right hardware.

</comment></comment><comment><USER25> > If the Surface tablet is a success — and with its design, specs, price > point, and Microsoft's marketing dollars, you have to assume it will be . . > .

Do you now?

</comment><comment><USER18> In Microsoft's case they have to get into the whole solution business in order to retain margins. Asymco has an excellent article with the numbers: [http://www.asymco.com/2012/06/20/who-will-be-microsofts- tim-...](http://www.asymco.com/2012/06/20/who-will-be-microsofts-tim-cook/)

Quote: "So Microsoft faces a dilemma. Their business model of expensive software on cheap hardware is not sustainable. The future is nearly free software integrated into moderately priced hardware. For Microsoft to maintain their profitability, they have to find a way of obtaining $80 of profit per device. "

</comment><comment><USER17> I doubt all the OEMs would leave. Surface may be great, but there's still room at the high-end for powerful desktop-replacement laptops.

</comment><comment><USER26> It's by now abundantly clear someone high up at Microsoft thinks the OEMs need them more than they need their OEMs.

It will be interesting to watch.

</comment><comment><USER27> That article mentions the "design, specs, price point" of the Surface like the price point is known.

Is it ?

</comment><comment><USER28> "seats upholstered with the tanned skin of Scandinavian virgins"

Ew?

<comment><USER15> Icky, but expensive.</comment></comment>


Friendfinder.io – Explore your extended social network - <AUTHOR>

I just built the world's first website that let's you search for users to do things with by number of mutual interests, friends, meetup groups, and more! I have been waiting for a site like this for so long, that I just decided to build it myself. Let me know what you think. :) <comment><USER2> I'm game. But you know the last time someone tried that... ended up buying Penthouse ..... so :)

I'm in the valley. Hit me up: Robert @ QuasiPreneur.com</comment>


Parts of AWS are down - <AUTHOR> RDS & S3 is down for me right now in US-East region and apparently some parts of Frankfurt are also down.<p>There own favicon is timing out: https://awsmedia.s3.amazonaws.com/favicon.ico <comment><USER2> DDos against amazon's DNS servers. One mitigation is to use regional endpoints for bucket hosting if your website relies on serving assets - i e foo- bucket.s3.us-west-2.amazonaws.com instead foo-bucket.s3.amazonaws.com

<comment><USER3> Where you see this is DDoS?

<comment><USER4> I just got off a chat with an AWS agent:

"We are investigating reports of occasional DNS resolution errors. The AWS DNS servers are currently under a DDoS attack. Our DDoS mitigations are absorbing the vast majority of this traffic, but these mitigations are also flagging some legitimate customer queries at this time. We are actively working on additional mitigations, as well as tracking down the source of the attack to shut it down. Amazon S3 customers experiencing impact from this event can update the configuration of their clients accessing S3 to specify the specific region that their bucket is in when making requests to mitigate impact. For example, instead of "mybucket.s3.amazonaws.com" a customer would instead specify "mybucket.s3.us-west-2.amazonaws.com" for their bucket in the US- WEST-2 region. If you are using the AWS SDK, you can specify the region as part of the configuration of the Amazon S3 client to make sure your requests use this region-specific endpoint name."

</comment></comment></comment><comment><USER5> We manually updated our `/etc/hosts` file with the static ip for our S3 bucket(s) and that fixed the issue temporarily.

</comment><comment><USER6> Glad to hear the issue is on Amazon's side. Our team panicked and tried to find every way to resolve this thinking it was possibly a misconfiguration at our end. I hope it's resolved soon. We're receiving complains from many users who are unable to upload their work due to this issue, I will let them know Amazon is on it.

<comment><AUTHOR> Same here. At the time the status check on AWS was not reporting any issues and there was nothing written about it online. As a result I assumed it was an issue with my account.

I only confirmed it was on their end when I noticed the favicon on the AWS console wasn't loading.

<comment><USER7> Same here, I was running around like a headless chicken and wondering what I was doing wrong when elasticbeanstalk just wouldn't deploy anything. The fact that we doubt ourselves rather than thinking aws is down is a good damn indicator how reliable they are, luckily it happened during daytime (EST anyways)

<comment><USER6> The issue started happening much sooner, around morning time in EST, but it got worse as the day progressed. It looks like the Amazon engineers woke up and realized something was wrong and they updated their status page 5-6 hours late. But I agree, AWS is super reliable, it's unfortunate that this problem occurred and I hope it's resolved soon.

</comment></comment></comment></comment><comment><USER8> From [https://status.aws.amazon.com/](https://status.aws.amazon.com/)

Intermittent DNS Resolution Errors

We are investigating reports of occasional DNS resolution errors with Route 53 and our external DNS providers. We are actively working towards resolution.

<comment><USER5> Finally acknowledging the issue.

</comment></comment><comment><USER9> Seeing major issues here as well. All my modules were not working for the majority of the day and all images were not displaying. This is no doubt a Ddoss attack, I just don't see any other reason that the entire east coast AWS DNS servers would just stop responding all of a sudden. If the issue is not fixed by tomorrow our IT guy is gonna have a damn field day implementing all the temporary mitigation's.

</comment><comment><USER10> Intermittent DNS Resolution Errors We are investigating reports of occasional DNS resolution errors with Route 53 and our external DNS providers. We are actively working towards resolution.

[https://status.aws.amazon.com/](https://status.aws.amazon.com/)

<comment><AUTHOR> Why does the status page say resolved when S3 is still down for parts of US?

</comment></comment><comment><USER11> status check: Tue Oct 22 22:50:22 UTC 2019

DNS resolution to AWS S3 and RDS is still buggy on other providers (DigitalOcean, etc as well)

[https://status.digitalocean.com/incidents/1z3kmlvz69v6](https://status.digitalocean.com/incidents/1z3kmlvz69v6)

[https://developercommunity.visualstudio.com/content/problem/...](https://developercommunity.visualstudio.com/content/problem/788578/job- fails-with-an-error-apparently-there-is-a-conn.html)

</comment><comment><USER5> Having DNS issues with s3-us-west-2 as well.

</comment><comment><USER12> Having issues here in US East as well.

</comment><comment><USER3> Seeing the same thing</comment>


Romanian firm touts 1PB optical disk technology - <AUTHOR> http://www.theregister.co.uk/2010/06/04/storex_1pb/

<comment><USER2> Assuming that this optical disk is Write-once/Read-many technology, let's find out how many time would be needed to read the entire disk. "Data access is said to occur at DVD-like speed." Let's say it can read 25 Mb/s

We have 1024 * 1024 * 1024 = 1073741824 Mb

1073741824 Mb / (25 Mb/s) = 42949672,96 s

42949672,96 / (60 * 60 * 24) = 497,1 days

497,1 / 365 = 1,3 years!!!

In conclusion, that optical drive is totally useless unless its driving speed is much higher.</comment>


Online Communities Are the Best Thing About the Internet - <AUTHOR> https://biznology.com/2018/01/online-communities-best-thing-internet-not-worst/ <comment><USER2> In my opinion the best thing about the Internet is it enables everyone to reach anyone, anywhere and share anything. It's a great levelling force, or it potentially could be. It's rather worrisome that in recent years the same kind of top-heavy power structures out in the real world seem to have taken control on the Internet too. It would be a pity were it to become just a glitzed up version of our world.

To reach its potential the most important single technology remains decentralisation. The average netizen should be able to serve and control his own data, even if he/she didn't create much of it in the first place.

I wouldn't want to live in a world where all real functionality moves to the Cloud and all our devices just become I/O thin clients. Saying that the average user won't care is frankly self-fulfilling and defeatist. How would they care if they are not provided alternatives to centralised services that are usable and compelling?

<comment><USER3> Per your second paragraph, even in the real world people have little to no control over what data of theirs is shared between third parties (eg gossip).

<comment><USER4> There's a baseline ability to control how much information third parties have in the first place - some people keep to themselves, some people tell anybody everything about themselves. People who care about it can, for the most part, at least know what other people know about them.

In any case gossip is lossy and low-bandwidth, and people understand those limitations when operating on information from that channel. The same cannot be said for, say, comprehensive real-time browser history.

</comment></comment></comment><comment><USER5> There's a nameclash here: _internet of the 90s_ which the OP pines for, and the current internet which is weaponized and truly has all the problems the OP calls exaggerations.

It's fine to pine for the 90s internet when nobody knew about your subculture much less tried to monetize it through advertising. But to actually get the spirit of obscure 90s internet on the current weaponized internet is a hard problem. The danger is that you implement some kind of nostalgic 90s interface and simply _hope_ that nobody on the internet hates your subculture sufficiently to destroy it. After all, that's exactly what you did in the 90s and it seemed to work.

The problem is that now a) a plethora of attackers know exactly how brittle and easily gamed these services are, and b) all your users know it, too. And that includes knowledge about how certain types of speech can attract the ire of people with bot armies, exploits, etc. So your userbase either self-censors in order to keep under the increasingly automated radar, or it doesn't and raises the likelihood of attacks.

And that's assuming nobody ddos'd you to oblivion in the first place.

Anyhow, I think it's correct to characterize online communities as dangerous and unhealthy places, because at present their brittle designs make them hazardous to use. Until programmers actually solve some of the deep problems of designing a social networking for use over a weaponized internet (in the same way that git has largely solved that problem wrt source code management), I don't see any reason to change that characterization.

People with nowhere else to turn and no money to physically move to a safer location will certainly still use these messaging services. But the best of a series of bad options is still a bad option.

</comment><comment><USER6> I think overall the connectedness is actually a bad thing, because it didn't come with education in critical thought and temperment. We're losing the battle of enlightenment to echo chambers of hatred and fear.

<comment><USER7> Having the option to live in an echo chamber also means we have the option to pick the wise and rational sources from which to listen to. Whereas before when TV and the local community supposedly was the source of diversity of thought, did you also have to put up with a lot of irrational bullshit that is inherent in socially propagated truth. I'm glad I'm not forced to live in that world anymore. For people who live in the outskirts, or who don't have access to a university culture to get their rational (isolated, echo chamber-y) conversation from, the internet is a godsend. Saying that you wish that echo chambers wasn't an option anymore also means that you wish people didn't have the option to experiment with a community whose values don't align with the norms of their local enviourment.

<comment><USER8> > Having the option to live in an echo chamber also means we have the option > to pick the wise and rational sources from which to listen to. Whereas > before when TV and the local community supposedly was the source of > diversity of thought, did you also have to put up with a lot of irrational > bullshit that is inherent in socially propagated truth.

I definitely have to deal with more socially propagated bullshit now than at any time in my history. Perhaps ironically, much more of it seems to be coming out of academia and journalism than ever before. For example, I can't think of a time when fields as patently ludicrous as "critical theory" have been taken as seriously as now. I can only speculate as to the cause.

</comment></comment></comment><comment><USER9> I wonder if part of the decline of small online communities is the sheer numbers of people using the Internet today (versus the 90's). I'll sometimes connect to an IRC channel about a niche programming topic, and see 1000 users. Likewise, I think it would be hard to make a personal connection to others in a large community like Hacker News where, outside of a handful of prolific posters, each discussion may be filled with different usernames than the last.

I guess this is sort of a "small town" vs. "big city" effect. I suppose the "small towns" of the Internet may still be out there somewhere, but under some conditions that keep them from growing into "big cities".

<comment><USER10> Eternal September?

<comment><USER9> I think a big part of Eternal September was a culture mismatch where newcomers didn't understand the norms and expectations of Internet culture, more than just the sheer numbers of new users. Now that Internet culture and mainstream culture have converged, this aspect probably isn't that big of a deal.

<comment><USER11> > probably isn't that big of a deal.

It's a _huge_ deal, we've just accepted it as normal. If I were to create something online today, where users were allowed to comment, I'd be an idiot if I didn't predict it would get abused by spammers and trolls as quick as you could say "4chan". Anonymity was previously believed to be a barrier to that, but comments on local news sites and Youtube comments continually prove otherwise.

While our systems have become more centralized (Twitter/Reddit/Facebook) compared to connecting to your ISP's Usenet server, there's no real digital- social-etiquette training system for new users given by those centralized authorities because we've simply accepted the ramificiations to Eternal September.

If I try to make a new Reddit account to post a bunch of hate speech, Reddit itself does little to dissuade me from doing so. There's a huge amount of effort to dissuade bots from creating accounts, but other than drop a link to "reddiquette" during account creation, what does Reddit do to teach me social norms during account creation? Better yet, what could they do _before_ letting me roam wild, hurtling death threats and hate speech until the post-per-second rate limiter kicks in?

Laughably little, that's what. Thats Eternal September's penalty.

The idea of giving an hour long lecture, followed by an hour long interview and training session, for every single person that wants an account on a site the size of Reddit, before granting them an account, is ludicrous on the face of it simply due to the sheer number of new users.

Moreover, Internet culture is not a single monolithic thing. /r/AskHistorians has wildly different standards of acceptability from /r/Nintento,and those are wildly different from /b/ or Facebook.

</comment></comment></comment></comment><comment><USER12> I would say the best thing about the internet is that it's not just one thing. It's multifaceted. It's a lot of things to a lot of people.

For instance, I personally don't do any social networking at all. But I immensely benefit from sites like wikipedia, or by other contents that I would have otherwise never read about.

So, I don't think you can say there's one thing that is the best about the internet. It's so many things. And that's great.

</comment><comment><USER13> Server seems to be hit with HTTP 503 Service Unavailable. Here's a Google cache in the meantime: [https://webcache.googleusercontent.com/search?q=cache:FkpouJ...](https://webcache.googleusercontent.com/search?q=cache:FkpouJV88UMJ:https://biznology.com/2018/01/online- communities-best-thing-internet-not- worst/+&cd=1&hl=en&ct=clnk&gl=ca&client=firefox-b)

</comment><comment> Chiba-City This is true. Ancient USENET was once fantastic before SPAM and trolls invaded. The stores of free non-fiction books and journal articles in PDF is also a giant treasure few could have imagined a few decades ago.

</comment><comment><USER14> Wow, thank you! -- the writer, Chris Abraham.

</comment><comment><USER15> Access to massive troves of academic writing, research and studies are far more valuable. Most of an education is available online now, and that's truly incredible.

Edit: This is not meant to be a complete list, just one example of something incredibly valuable which eclipses online communities. IMO obviously.

<comment><USER16> Of course it's subjective. Not all people have as much to gain from this additional access. There are people close to me that I'm pretty sure would've hung themselves by now without internet communities.

Though for humanity as a whole, obviously access to information is the biggest deal. But why stop at education? People today have more awareness than ever about everything. In some cases, including things that average civilians would _never_ have gotten to see, like government leaks, or videos of executions.

And neither of those things are always positive obviously. Not all educational materials are good, not all communities have a positive effect, and sometimes there's just too much information to find the signal in the noise.

So I think it's fair to argue either really. And, truth be told, it's possible we couldn't have had one without the other, given how much individual people have contributed to the internet knowledge stores.

<comment><USER17> > There are people close to me that I'm pretty sure would've hung themselves > by now without internet communities.

I wonder how this worked in the past. Were people less "weird" that the people they knew IRL were enough?

<comment><USER18> I remember when people were generally more tolerant of people who were different. If you were weird you kept the majority of your unpopular beliefs or behaviorsr to yourself and hung out with people with different interests.

Today, people seem to only want to hang out with people who are like themselves, who completely accept them. If someone has a different opinion or a different interest, they're a predator trying to eat your herd.</comment></comment></comment></comment>


The Time Zone Rebels of the World - <AUTHOR> http://www.hopesandfears.com/hopes/city/city/215293-the-time-zone-rebels-of-the-world <comment><USER2> "Urumqi simply adjusted their operation schedules to reflect natural waking hours, therefore, a store may be open from noon to 10 PM."

This is exactly why I would propose a single timezone for the entire world. Time notation is just numbers, after all. Why we still attach importance to having 12pm appear at the middle of the day boggles my mind. Why can't we just have different parts of the world start at different sections of a day?

<comment><USER3> For global communication, it helps to form a mental model of the other side. When you pick up the phone to call someone else, knowing it's 1am there would typically indicate you should likely think twice before calling.

It's a crutch to enable a more convenient mental model for most people to relate to what time of day it is 'over there'. Otherwise, sure, there's no real point.

<comment><USER4> right, but I never know what time it is there. I only know what time it is here. And maybe I have a relative sense that there is 6 hours east of here. Often I don't even know where it is I'm talking to. I called the help desk, I have no idea what continent picked up the phone.

"office hours are 22-6 UTC" would be much simpler than "office hours are 9-5 EST. hmm ...is that european standard time, or east coast of the usa?"

death to timezones and daylight savings!

<comment><USER5> All you have to do is Google "time in Chicago" or "time in Perth" to find the current time there.

</comment></comment></comment></comment><comment><USER6> Indiana is a very strange case. I had a business meeting there once where we met at the guys house. Coming down from Michigan I looked up the city hall just to make certain the time zone.

Well it turns out this particular guys subdivision was on a different time zone. He explained that the subdivision, being technically outside the city, voted to adopt the another time zone because the majority worked in a county with a differing time zone.

<comment><USER7> I grew up in a northern, rural part of the US along the MST/CST divide. Our county was MST, so everyone's homes, schools, events, etc. were all MST.

A significant portion of the area was employed by one of a few large mining/synfuel operations, which were headquartered an hour east in the capital, so they ran according to CST. Most employees wake up in one time zone, drive 5 minutes to work, spend the day in a different time zone, then switch back in the evening.

All the "stuff" you wanted or needed to do was also likely going to be in the capital city an hour east, so the constant math was bound to cause issues and consusion.

In 2010 the county voted to switch to CST [0]. I think it was a good change, and it really made life easier for people who live there. I was certainly in favor of it. But at least that was at a _county_ level. A change at the subdivision level seems like it would cause more problems than it fixes.

[0] [http://bismarcktribune.com/news/local/it-s-official- mercer-l...](http://bismarcktribune.com/news/local/it-s-official-mercer- leaving-mountain-time/article_1eb1b588-c758-11df-b472-001cc4c03286.html)

<comment><USER8> Out of curiosity, is there some reason you are not directly mentioning the state of the two towns?

<comment><USER7> Ha, no. I think I was just trying to make it non-specific because it could happen along any tz border. I added the article in case someone wanted specific locations.

</comment></comment></comment></comment><comment><USER9> > Russia actually changed Crimea's time, effectively moving the territory's > time two hours forward to Moscow Time. The peninsula of Crimea is completely > unattached to Russia and the decision _has no real geographical basis_

I am most definitely not defending Russia's actions, but Crimea is nearly due south from Moscow.

[1]: [https://www.google.com/maps/place/Crimea/@50,34,5z](https://www.google.com/maps/place/Crimea/@50,34,5z)

<comment><USER10> That is true, but also Moscow is not on its "own" geographical time zone. The middle line of UTC+3 is 45°E, east of Nizhniy Novgorod or eastern Caucasus.

Crimea (Sevastopol) is about 33.5°E. Naturally, this time zone change is part of the process employed by Russia to severe Crimea from Ukraine and attach it back to Russia.

St. Petersburg, or Leningrad as it seems to be going, is also on the same UTC+3 zone even though it is even further away to the west, with the "geographical" UTC+2 line (30°E) passing through the city.

</comment></comment><comment><USER11> When I was in the Navy, my ship visited Petropavlovsk during the summer and they were on UTC+13. That was weird to begin with, what with the theoretical limit on only twelve time zones each direction from Greenwich. But then after the visit, we headed due south and then crossed directly over into the UTC+10 time zone for Guam. So one night we set the clocks back three hours.

Nice if you were asleep, not so nice if you were on watch...

[https://en.wikipedia.org/wiki/UTC%2B13:00](https://en.wikipedia.org/wiki/UTC%2B13:00)

<comment><USER12> Cross the border from China to Afghanistan, and you'll have a 3½ hour timezone change.

<comment><USER10> Cross the border from Finland to Karelian Republic in Russia, and "wind clock forward one hour, wind calendar back 50 years". In good and bad.

</comment></comment></comment><comment><USER13> A lot of servers are just set to UTC even if they are in a different time zone. It simplifies a lot of headaches and translation bugs.

It would be nice to get rid of time zones and daylight savings time. People are so slow to change. Who cares if the sun doesn't come up until 4 PM where you are at. Stores, schools, etc can just change what hours they are open.

<comment><USER14> It's really annoying when I order a new VPS and it is set to whatever time zone the company's headquarters are located in. As if I give a damn about what time it is in PDT! I don't know about abolishing time zones in the real world, but at least for servers it makes total sense.

That, and the missing UTF-8 locale, are among the most annoying defaults that I routinely encounter on newly ordered servers.

<comment><USER15> Yes, I set all of my infrastructure to UTC and then keep the clock on whatever UI I'm using set to display distance from UTC in my current timezone (and current Unix timestamp in UTC). I feel like timezones are an important tool for humans, and it's so easy to customize your development machine's clock to take care of these calculations for you. It's also millions of times easier to think in terms of events that happen across a system with wide distribution if everything is set to UTC, where a lot of companies and people will have to then start counting and scribbling arithmetic to keep track of what happened when, in two or more timezones.

</comment></comment></comment><comment><USER16> In an Internet (read: global) article about Time Zones around the world, and local customs related to such things, we get this gem:

> South Australian Premier Jay Weatherhill reintroduced the time zone debate > this spring

The linked article is from April 2015. Spring in Australia is September- November.

This concept of using weather seasons as terms of reference for periods of time, is ridiculous, and kind of reinforces the view that Americans can't think outside their own little world.

</comment><comment><USER17> When I was a teenager and more prone to rebelling against the shackles of conformity, I tried adjusting my desk clock and my watch to run on sidereal time.

It made it a bit more convenient when I wanted to observe a particular cluster or nebula to know when to take my telescope outside.

Everything else...not so much.

</comment><comment><USER5> _Observance is a state matter, and only two of five mainland states have chosen to participate. Therefore, continental Australia became five time zones for six months out of the year, a decision that has created a bull-headed debate among all its states._

This has an error - _three_ of five mainland states and one territory observe daylight saving time (SA, VIC, NSW and ACT).

</comment><comment><USER18> It is here I can get to quote the famous justification why Queensland does not observe daylight saving like the sensible rest of Australia: Because it would fade the curtains.

(Interestingly, I'm not sure if this is apocryphal or not: I thought it was Flo Bjelke-Peterson who said it, but I can't find a source.)

<comment><USER19> Oh, it was a real argument that people actually believed...there were some other rippers - the cows milk turning sour due to the "extra" sunlight was one that is particularly memorable.

</comment></comment><comment><USER20> Where is Saudi Arabia in this story? When I was there in the 90s I saw maps of time zones that listed Saudi Arabia as still using solar time. That was long after the official switch in the 60s. I understood the official "solar time" line as a nod to religion. Nobody was setting watches every sunset but the calls to prayer certainly moved with the sun.

</comment><comment><USER21> I am interested in the topic but the website has repeated loading failures on my iPhone. Fancy code drives away readers.

<comment><USER17> It fails on my iPhone when I'm on cellular (T-Mobile LTE) with a 504 error. It works if I switch to wifi.

</comment></comment><comment><USER22> It doesn't neatly fit into the "rebels" headline, but I think it should've given a sentence or two to the fact that countries like the UK, Canada, and (parts of) the US are now on summer time for most of the year. It's as though their timezones are all wrong.

</comment><comment><USER23> They missed Newfoundland, which is on Newfoundland Standard Time: UTC+3.5

Are there any other fractional timezones?

<comment><USER24> Darwin, Australia: UTC+9:30h

Others: [http://www.timeanddate.com/time/time-zones- interesting.html](http://www.timeanddate.com/time/time-zones-interesting.html)

</comment></comment><comment><USER25> I was hoping they would talk of all countries using 'local times' instead of UTC.</comment>


What if someone invented a better mousetrap and the world yawned? - <AUTHOR> http://www.nytimes.com/2008/06/08/technology/08stream.html?=&ei=5124&en=3cbf9c1a8a06c507&ex=1370577600&pagewanted=all

<comment><USER2> "Consider that Douglas Engelbart invented the mouse in 1964. It was obvious to many people that it was a better way to control a computer, yet it took two decades even to begin reaching a mass audience. Or consider the hyperlink, invented independently by Mr. Engelbart and the computing evangelist Ted Nelson in the mid-1960s. It took roughly three decades to reach the public in the form of the World Wide Web."

These examples are starting to wear thin. It took three decades for computers to become accessible enough, financially, for these things to even make sense to offer to the masses, and it required a critical mass of users to make sense to start doing business over the Internet. A wikipedia that no one could edit or an Amazon that no one bought anything on because they didn't have a computer in their home would be quite lame indeed.

The invention of the printing press didn't make everyone literate overnight; the 30 years it took for the mouse to enter widespread adoption is nothing.

<comment><USER3> That's not to mention that it's not "obvious" to me that a mouse is a better way to control a computer. If I had to construct a "find" query using a point- and-click interface, I would be highly annoyed. I use keyboard macros on GMail so that I can do everything without touching the mouse, and I get really annoyed when the page loses focus and I have to click inside it to restore it.

So not only does acceptance take time and require good timing, but it may also be that something that is "obviously" better may just seem obviously better to you.

<comment><USER4> A good (standardised, consistent) mouse-driven interface means one can use an unfamiliar program without reading any documentation first. This, I think, explains the popularity of the mouse (along with its low cost relative to touch-screens and other similar input devices). But giving a program input in this way can be very slow. The experienced user can't get much faster than the novice.

A mouse, of course, is a good input method when it makes sense for gestures in 2 dimensions to control something. (Hmm, that is rather tautologous.) E.g. drawing (but then a graphics tablet is probably better for this, but more expensive).

With a text-based interface, one must read and learn before one can use an unfamiliar program. But giving the program input can then typically be much faster, and the program can be easily scriptable.

</comment></comment></comment><comment><USER5> FTA:

 _"When I started I thought that this would take 6 to 12 months," Mr. Harman said. What he found instead were companies that had little interest in redesigning their products, even in the face of the promise of double-digit increases in efficiency._

I've found that you need for something to be at least 10 times better before people will consider making the effort to think about using it.

<comment><USER6> A factor of nine improvement has been noted elsewhere on this forum: <http://news.ycombinator.com/item?id=196994>

</comment></comment><comment><USER7> <http://news.ycombinator.com/item?id=211712>

</comment><comment><USER8> It's all about timing. Imagine if the first hybrid car came out when gas cost $10 a gallon.

<comment><USER9> Gas does cost $10 a gallon (in Europe).

</comment></comment><comment><USER10> As far as the power supply fan is concerned, their manufacturers don't care about improving its efficiency. This is because you are not the real customer. Dell, HP, et al are. When they place an order with the metal-bending shop in China, all they care about is price. If putting a more efficient fan in the power supply is going to raise the price by a few pennies, they won't be interested.

The only way anything that the high-efficiency power supply is going to fly is if it is going into a high-end product.

<comment><USER11> Or if it's going to a customer who is using a large enough quantity that efficency gains of a few percentage points are big savings.

If Google can shave .5 percent off their electric bill by using a more efficient cooling fan on PSU's going in to their server farms, it's worth it to spend a fair amount to realize that savings, especially since they know their usage is going to grow.

</comment></comment><comment><USER12> Of course no one would care. New ideas are always repelled by inertia. Why do you think we still use the terribly inefficient QWERTY keyboard?

</comment><comment><USER13> Does anyone have an idea how he could have managed to cast the vortex in his bathtube?

</comment><comment><USER14> Dvorak felt like that trying to topple qwerty.

<comment><USER15> Dvorak came first.

<comment><USER16> No, Dvorak came up with the Dvorak Simplified Keyboard after studying the behavior of typists using previously available typewriters and presented it as an alternative to Qwerty...

<comment><USER15> Just double-checked. Yup, looks like I have it wrong. For some reason I had it in my mind that alphabetical keyboards came first, then Dvorak and Sholes were introduced within a year or so of each other and Sholes won out.

<comment><USER17> The reason the QWERTY layout was created was due to typewriters. They tried to move the most commonly used letters away from each other to avoid the "typewriter levers/hands" from locking up against each other when someone was quick typing. Thus, QWERTY is quite inefficient since it's trying to make commonly used letters as far away as possible.</comment></comment></comment></comment></comment>