Neal Stephenson: Why I Am a Sociomediapath (2015) - <AUTHOR> http://www.nealstephenson.com/social-media.html <comment><USER2> Comments so far seem to be focusing on the social media aspect of this piece, what struck me was the acknowledgement that he has a limited number of productive years left, and the Longfellow quote. In my mid 40's, I also have come to feel the weight of years passed, without achieving professional goals (ie starting a succesful software based company).

This feeling of unfinished business really set in after the birth of our second child. I had always claimed to be one of the best developers around, yet, I could not master myself to be truly productive when working of personal projects. Overcoming my self imposed limits is where I'm at now. Has anyone else experienced this?

<comment><USER3> I just turned 40, parent of a young child, and I know what you mean. I think the below article, a cover story in _The Atlantic_ , is really insightful and I found it helped adjust my thinking.

There are going to be things that I wanted to do, that I won't do in my life. Some may never have happened no matter what, like winning the Super Bowl or becoming an astronaut. But some of them will be things that I could very plausibly have actually done--but instead I did other things. The challenge of happiness is acknowledging that I made those choices for reasons that seemed good at the time, and anyway I can't go back and change the past. To be happy, I have to accept that it's possible to be happy, even knowing that I gave some things up for other things.

Essentially I'm working on believing that goals and happiness are separate things, each of which can be achieved independently of the other.

The link:

[http://www.theatlantic.com/magazine/archive/2014/12/the- real...](http://www.theatlantic.com/magazine/archive/2014/12/the-real-roots- of-midlife-crisis/382235/)

A quote:

> Long ago, when I was 30 and he was 66, the late Donald Richie, the greatest > writer I have known, told me: "Midlife crisis begins sometime in your 40s, > when you look at your life and think, Is this all? And it ends about 10 > years later, when you look at your life again and think, Actually, this is > pretty good." In my 50s, thinking back, his words strike me as exactly > right. To no one's surprise as much as my own, I have begun to feel again > the sense of adventure that I recall from my 20s and 30s. I wake up thinking > about the day ahead rather than the five decades past. Gratitude has > returned.

<comment><USER4> I'm experiencing those same emotions in foresight.

I'm young---I'm 26, and I have a wife and two young children (2 and 4). I'm at that age where I could have gotten involved in so much, personally and professionally---and still could. And I know that this will be a bit setback for things I'd like to do in the future. But time with my family is more important, and we also bought a house that needs a lot of work.

And I fully expect to be feeling exactly as you are describing. And I'm trying to come to terms with that today, while I'm still young: focus on what I can be happy for today, recognize how my decisions affect my future, how I might adjust my plans, and recognize that the decisions I made (or didn't) have desirable consequences that I wouldn't change if I had the option to go back and do it again.

Thanks for sharing your experiences.

<comment><USER5> Mike, I'm going to say that you can continuously improve and upgrade your career, you can't say the same about your wife and kids. So, it's more important to date and look for a wife early, while with your professional career you have all the time you need.

From your name, I'm going to guess you're Jewish, so you would have had even harder of a search, if you wanted to marry someone Jewish, than if you did not have this additional filter. So, don't worry... you've succeeded in choosing your wife, starting a family, and now you have plenty of time to keep improving in your career. Consider the opportunity cost of doing the reverse - career first, then kids.

<comment><USER4> I do agree---I'd rather have the family.

I'm not Jewish, but your comments stand all the same. Thanks for the kind words.

</comment></comment></comment></comment></comment><comment><USER6> This essay might be deeper than it first suggests.

My first interpretation: knee-jerk reaction after reading it that it's a very typical lament about social media getting in the way of doing more important things in life. There are thousands of blog posts repeating this message and this variation of it happens to be on HN because it's from N.S.

My second interpretation: I lingered on his chosen word " _sociomediapath_ ". Since it's a riff on "sociopath", I think what he's saying here is that he's going to _give the impression_ that he's a social media hound but behind the scenes, he's doesn't care. Likewise, a sociopath like Ted Bundy on the surface can shake your hand and charm you with his smiles but underneath it all, he'll kill you.

N.S. has to be a "sociopath" in media because he's a published author. He _can 't_ go full Howard Hughes detached-from-society-mode and therefore, has to at least fake out the public with a social media presence.

Maybe that means there's a need for a web service that generates random and periodic posts on behalf of users to give the appearance of "Facebook normality". E.g. the website service posts random inspirational quotes from dead people or TIL from random wikipedia pages. You never have to log into Facebook and yet it seems like you're "with it".

I believe other celebrities accomplish this with "public relations" staff. The PR firm makes the celebrity look "connected" to the fans via Reddit AMAs and Twitter updates but in reality, he/she really isn't.

<comment><USER7> Makes me think of a recent talk at ccc.de about libusb, and how there was a "hostile takeover" in part fueled by the maintainer failing to push out new releases even though there was activity on the tracker (he wanted to make sure the new stuff worked before releasing, others saw it as the project stagnating).

<comment><USER8> Do you know which talk that was?

<comment><USER7> [https://media.ccc.de/v/32c3-7547-libusb_maintainer_fail](https://media.ccc.de/v/32c3-7547-libusb_maintainer_fail)

</comment></comment></comment></comment><comment><USER9> Abstaining from "social media" is for _amateurs_!!! ;-)

Many years ago, I threw my TV out and it was one of the best decisions I've ever made.

Internet is the new TV.

I see the irony of writing this on HN but I really try to find the internet analogue for throwing out the TV.

The problem is that you need services like maps, online banking and tickets, mobile payments, etc.

What I want to get rid of though, completely, is news and noise. I tried and tried but self-regulation is too hard; I still waste so much time and poison my brain with all this crap; I think the time has come to try self- _binding_.

My current setup is to not have internet at home (where I work) except for a mobile connection, and to pull the SIM card out by default. I only put it back in when I need to do something specific (or when I am on the go, for maps).

Obviously, this is not a perfect solution yet (as I somehow found my way back to HN, grrr…) but I'm working on it.

I should probably get a dumbphone for emergencies, and I also want to habituate myself to a weekly rhythm where I bunch all the stuff (like emails, software updates, articles to be downloaded, references to be checked, etc) to one day a week (say Sat) and do all my "internet errands" in one go.

The rest of the time, I rely on my books and articles and downloaded documentations and offline Wikipedia. If I want to watch something, I can make a note and download the movie or entire season along with the other "internet groceries". To keep in touch with current events, I can read weekly news magazines. That also dials down the noise. Something like that. Interestingly, since I got a big tablet, I read news magazines like The Economist or Die Zeit in PDF format and it seems to also affect me somehow. There is no outside clicking and endless linkbait anymore, and I feel less monitored and stressed (even though I already have all these adblockers and Little Snitch and whatnot). It also gives me back a feeling of a natural end to my reading session when I reach the final pages of the PDF. On the web or online, the next article or curiosity is always right behind.

<comment><USER10> > What I want to get rid of though, completely, is news and noise.

Why? I'm being serious.

Everyone assumes that our lot in life is to be productive. For Americans it seems we need to be _as productive as possible_. It's untenable.

The most productive person is the one who dies at 40 because they didn't get enough sleep because they drank too much caffeine and augmented themselves with other drugs to maximize wakeful productivity. Is that worthwhile?

I can definitely see a problem with spending considerable amounts of time keeping up with social media because ultimately the thoughts, pictures, and videos posted by your "friends" aren't important. You, them, and everyone else will have long since forgotten what was posted in _a week_ and nothing of value will be lost.

On the other hand, "keeping up with the news"\--especially news in your industry--is important. There's a lot of things going on _all the time_ that could make a huge difference in our lives and careers. Things we need to stay on top of not just because we care but because _they have impact_.

I don't know about you but at my job it is a common occurrence for me to solve problems with tools and techniques I've learned about through sites like HN. Keeping up with these sorts of things also gives you insight on how to schedule things. For example, if you just read that the next release of ProductX will include a feature that you need you probably won't bother to spend time writing your own implementation since it will be obsoleted soon.

Then there's the entertainment aspect: What's wrong with "wasting" time if you're enjoying yourself? I enjoy reading the news and the occasional entertaining Reddit post. When I laugh at a meme was my time truly "wasted"? Or perhaps the time I spent trying to discover "something good" was wasted?

"Getting things done" in spite is the opposite of happiness.

<comment><USER11> >Then there's the entertainment aspect: What's wrong with "wasting" time if you're enjoying yourself?

About the entertainment aspect. I think the point here is following: modern web media/pics/etc is too attractive and people can't focus on things what really matter. Every website with "funny cats" tries very hard to retain you as user and your attention -> entertain you more. I think many people (myself included) fall in risk group and can't actually measure/control time spent on procrastination while browsing infinite number of subreddits or something for interesting stuff. Even when i really need things to be done - there is something that can immediately capture my attention. And I have to say I am not alone.

The root cause here is inability to focus on important things and finally quit procrastination.

</comment></comment></comment><comment><USER12> In Seveneves, Stephenson discusses "Amistics, the study of the choices made by different cultures as to which technologies they would embrace or spurn."

"Anyone who bothered to learn the history of the developed world in the years just before Zero understood perfectly well that Tavistock Prowse had been squarely in the middle of the normal range, as far as his social media habits and attention span had been concerned. But nevertheless, they called it Tav's Mistake. They didn't want to make it again. Any efforts made by modern manufacturers to produce the kinds of devices and apps that had disordered the brain of Tav were met with the same instinctive pushback as Victorian clergy might have directed against the inventor of a masturbation machine."

You see those kinds of choices being made at a cultural level all over the world. Developed countries where nobody uses leafblowers, or in-sink food waste disposals, or what have you. People understand how those things work, they just don't want the effects.

<comment><USER13> About leaf blowers and waste disposals, I think it's not about the "effects" so much as the item itself. These devices do perform a function but their original reason for existing is arguably to profitably sell motors (or small engines in the case of the leaf blower). Having lived mostly in countries where they aren't used, I'd say it's a skepticism about the real utility of the device that makes them unsuccessful there, not a reasoned assessment of the effects of widespread use.

<comment><USER14> Leaf blowers are very overrated, unless you buy the industrial grade backpack type. And that's only a niche application.

I use a rake, which works faster for my consumer-level yard than a mid to high-range blower, to get the leaves all in once place. Then, I use the blower in reverse to chop the leaves for compost. Not the intended purpose at all, but it works for me.

<comment><USER15> Exactly how I use mine, and how my father taught me when I was a kid. I thought this was normal.

<comment><USER16> You can also drop the leaves into a large trash can and use a string trimmer lowered into the can to chop them as finely as you like. Works just like a giant immersion blender, plus it's cool to take a huge pile and reduce it down to almost nothing.

<comment><USER17> And I have one of those "Why didn't I think of that" moments.... Thanks!

</comment></comment></comment></comment></comment></comment><comment><USER18> I took a week off of facebook two weeks ago. No interaction with facebook, at all, except one messenger session with a design contractor who is doing our UI overhaul. I haven't been so productive in years. And, it mostly broke my facebook addiction...I check it once a day now, often just on my phone while standing in line at the grocery or during some other downtime. I'm able to ignore it most of the time (notifications have been turned off for years, because I hate anything dinging at me and interrupting my thought process; I leave the ringer on my phone off for the same reason, I can check my voicemail in Google Voice a couple times a day to deal with important stuff).

I'm considering doing the same "fast and then reduced consumption" for my other social media habits: reddit, HN, twitter. When I traveled full-time, in the past, I would often find myself with little or no Internet connectivity for a week at a time, and that imposed periodic social media fasting, and it was sufficient to keep the addictions in check. After living in a fixed house, with very fast Internet, for a little over a year, the urge to check my phone/tablet first thing in the morning and last thing at night has become notable and annoying.

In short: He's right, and I notice my own inability to do things of substance has been significantly impaired by the time and attention I give to social media, and it's only reasonable to abstain in the interest of spending more time doing the things I truly value. It can be hard to make that choice, however...one more shot of dopamine (or whatever chemicals the constant affirmation of social media provides) seems harmless.

(I note the irony of this being an HN comment.)

<comment><USER19> I hear ya. I started out 2016 by deactivating my Facebook account, culling my Twitter following to 12 and my Feedly subscriptions to 10. I also added Disqus to my hosts file to make news sites less enraging.

I've taken other measures in the past. Someone else in this thread mentioned unfollowing everyone on Facebook, that helped quite a bit. But there's a lot to be said for declaring social media bankruptcy and being freed from that involuntary compulsion to open up a new Chrome tab and waste time.

<comment><USER20> > _Someone else in this thread mentioned unfollowing everyone on Facebook, > that helped quite a bit. But there 's a lot to be said for declaring social > media bankruptcy and being freed from that involuntary compulsion to open up > a new Chrome tab and waste time._

I did this recently (unfollowing (almost) everyone on my FB friend list), and it has resulted in me spending less than 10 minutes a week on the site. I didn't do it so I would use FB less, I did it because my feed was full of nothing but hatred and negativity, and to see that from friends and family is extremely depressing. If I didn't use FB to promote a couple of projects I'm running, I'd drop it altogether and rely on my wife to keep me updated on family and mutual friends who choose to only have contact with the outside world via the FB window.

<comment><USER21> I also unfollowed nearly everyone for similar reasons. The unintended side- effect is that it's much less interesting now and as a result I spend less time on Facebook. Success!

</comment></comment></comment></comment><comment><USER22> I'm torn. On the one hand, I agree. On the other hand, I wouldn't have found this Neal Stephenson post if it wasn't for social media.

<comment><AUTHOR> I came across a reference to it while reading the first chapter of _Deep Work_ by _Cal Newport_ [0]. For anybody interested in _distraction free work_ , it seems to be quite a good book (can't give a thorough review, I'm still at the beginning). I enjoyed reading his blog so far.

[0] [http://calnewport.com/blog/2016/01/05/the-book-facebook- does...](http://calnewport.com/blog/2016/01/05/the-book-facebook-doesnt-want- you-to-read/)

<comment><USER23> I'm making this book my Bible for getting stuff done in 2016. Social media = crack.

<comment><USER24> Ironically, for me, re-reading Neal Stephenson's novels is one of my biggest crack-like time-wasters.

</comment></comment></comment></comment><comment><USER25> It's interesting. I thought I didn't lose much time to social media because I only used them in "dead" time, e.g. waiting for a train. But I've come to believe this was a mistake in two respects. Firstly, no time is truly "dead", and there's almost always something better I could be doing. Secondly, almost any use of social media trains me to crave more -- it genuinely is addictive, and the unreliability of the novelty ("refreshing in the hope of seeing something new") makes this all the worse.

<comment><USER26> > Secondly, almost any use of social media trains me to crave more -- it > genuinely is addictive, and the unreliability of the novelty ("refreshing in > the hope of seeing something new") makes this all the worse.

That's pretty much what it's designed to do. Really recommend reading "Hooked: How to Build Habit-Forming Products" [http://www.nirandfar.com/hooked](http://www.nirandfar.com/hooked) or watch some of the authors videos like [https://www.youtube.com/watch?v=hVDN2mjJpb8](https://www.youtube.com/watch?v=hVDN2mjJpb8) or his talk at The Next Web [https://www.youtube.com/watch?v=Z29RvrHPp1s](https://www.youtube.com/watch?v=Z29RvrHPp1s)

<comment><USER25> No disagreement here -- I know it's intentional. Thanks for the resources though.

</comment></comment></comment><comment><USER27> Perfectly captures the way I feel. I spend very little time on FB & twitter these days. I fear I'm still spending too much time on HN though...

<comment><USER28> I loved how the whole point of the essay is not to waste your time reading the comments and not to get bogged down in minutia, yet here we all are, reading the comments!

</comment></comment><comment><USER29> I was able to fully quit Facebook - with the help of my wife. Not that she needed to help me actually close my account, but rather she keeps me posted (via her Facebook) page on the comings, and goings of my/our family.

Without her I'd probably feel pressure to at least have FB for close family, however I'm not sure it would be enough to lure me back in, given the use of group texts etc.

</comment><comment><USER30> I just unfollow everybody by default on FB, and I can highly recommend this. (Basically I just use FB to find interesting events, and see where everybody is going).

<comment><USER31> Wouldn't FB be a ghost site like myspace or G+ if everyone is unfriended?

<comment><USER32> There's a difference (on FB at least) between being "friends" and "following" someone. If you unfollow a friend, you'll still be connected, can communicate, see events, etc, you just won't see their posts in your news feed.

<comment><USER33> Well I certainly didn't know that.

Is there a way to make it so it screens out all the content that comes from content factories ("You won't believe....!"), but still see things such as pure text or user-created photo posts?

<comment><USER34> You can unfollow individual sites. There's a down arrow in the top-right of a post, you click it and select 'hide all from clickhole'.

I unfollowed a bunch, and now I rarely see that kind of thing.

<comment><USER35> You can also use "fb purity", an extension that can hide posts based on string matches. For example "liked a post", "commented on", and other annoying things fb fills the feed with

</comment></comment></comment></comment></comment></comment><comment><USER36> I am almost 38 and I look at the founder of the company I work at in my day job. He started the company in his early 40s and now he is worth in excess of 8 billion. 40 is not too late to start something.

</comment><comment><USER37> Social media is a tool, useful for business and self promotion. Also handy for checking up on what friends and relatives are doing.

That said, I agree with Stephenson (I really enjoyed his latest book Seveneves) that it's use can get in the way of doing more creative and productive things.

I am a big fan of "self monitoring" to keep track of types of food eaten, time spent on social media, TV, etc. Personally, if I spend more than 15 minutes a day on social media that is a warning sign that I need to do better time management.

<comment><USER38> Automated monitoring of computer time can be very revealing. I use RescueTime[1] as a check of my productivity, and have found it helpful for ensuring I remain on-track.

1\. [https://www.rescuetime.com](https://www.rescuetime.com)

<comment><USER37> I also used rescue time for several months after one of my consulting customers recommended it. It is a good product, but after understanding my time use profile I stopped using it.

</comment></comment></comment><comment><USER39> Cut away branches that suck energy but don't bear fruit.

</comment><comment><USER40> This strikes me as a pretty serious failure on the part of Facebook, Twitter and their ilk. I'm not sure what the solution might be, but I would prefer to read the posts of the actual author or personality, rather than a stream of PR posts. Neal Stephenson is not the first and surely won't be the last person who's account will now be ghostwritten (by publishers, agents, trusted people, etc.)

I understand why he's managing it this way and I might do the same if I were in his position. My hope is that Facebook, etc. start to realize that their current approach isn't the best fit for everyone.

</comment><comment><USER41> I think learning to do things in moderation is really the key here.

I liked that the article is not vehemently chastising social media as the bane of modern civilization nor praising it as the second coming. There are pros and cons to adopting most new technologies.

It's better to develop a discipline to use them in moderation rather than to cut it off completely or depend on them excessively.

</comment><comment><USER42> But why does Neal Stephenson of all people feel he needs to write as many more novels as possible? Sure, it's good for us that he feels that way, but strange that he thinks he still has something to prove.

</comment><comment><USER43> This is a bit offtopic, but his latest book is 'Seveneves', huh? I worked on a puzzle game for the DS and Wii called 'Neves', which was named that way because there was a 'puzzle in the name', being seven backwards, and there was seven pieces in each puzzle.

I feel like I should probably read Seveneves now, even though I know it's just a coincidence they're named similarly.

<comment><USER44> _I feel like I should probably read Seveneves now_

Do you like orbital mechanics?

</comment></comment><comment><USER45> HN is the only social media I use. Quitting social media is really the best thing I have ever done. I used to check facebook and twitter every 2 minuter when I had nothing else to do. The result was to never have a dull moment. It just stressed me out.

After quitting I realized how much I need all those small breaks. I am less stressed and much more productive. Jobs kept coming by word of mouth.

</comment><comment><USER46> Basically, he's just coming out and saying that he's doing what almost every other highly visible, busy person is doing.

</comment><comment><USER47> Well, I relate to both this and the older 'bad correspondent' article immensely. I have struggled with this for at least 2-3 years now. The only times I can be truly productive (in music, programming or visual stuff) is when I feel like I have a cocoon where there will be no interruptions with 100% certainty.

For me personally the cell phone is a bigger problem than the internet, since people get annoyed when I don't pick up the phone, but I also notice I need to stop clicking endlessly all night on web sites to calm my mind down to get to that mental space for creativity.

Basically the best periods I've had were when others were on vacation or I was, and there was some natural unbroken few days where there was no anxiety at all about being interrupted. The question is how to make it happen. I basically just turn off my phone, close the browser, go for a walk, try to get the nerves calmed down, and hopefully something comes out of it that night.

It's really quite annoying though, because 7 years ago it wasn't like this. I don't want to be a recluse, I just want to balance the two things and have that be okay.

</comment><comment><USER48> "With that said, here are the links to my social media:" <crickets>

I think a rendering issue in Safari hid them, or something, but I thought it was humorous to have that article, followed by no way to follow him on social media! (presumably unintended.)

<comment><USER49> An ad blocker that blocks social media sharing buttons will hide the link buttons at the bottom of that page.

</comment></comment><comment><USER50> > I completed SEVENEVES recently and have three other novel projects in the > works. Somewhat perversely, however, using social media has now become part > of a novelist's job.

I find amazing the fact that he manages to write 3 or 4 novels at the same time.

<comment><USER51> We can only hope that the other novels will be better than Seveneves.

<comment><USER52> They can hardly get worse. I used to be a huge fan of NS, but Seveneves was the last book of his I bought without reading review first. He seems to have decided that character development is for other people, not to mention the gaping plot holes. Sloppy and superficial.

<comment><USER53> Huh, I thought the book was pretty good. (Warning: spoilers ahead.) I couldn't put it down for the first 500 pages. Things got a little slow in the second part of the book, but I thought the character development in terms of the races of Eves was a really interesting twist. You still "knew" the characters based on their ancestors. I do wish he had fleshed out the history of the Diggers and Pingers, but that could be an entire book in itself.

</comment></comment></comment></comment><comment><USER54> I think this is a good time to repost a link to pg's "disconnecting distraction": [http://paulgraham.com/distraction.html](http://paulgraham.com/distraction.html)

</comment><comment><USER55> Not related to the content, but yeesh, this color scheme is awful. The yellow gradient... Blegh.

I couldn't make it through the article because my eyes kept getting lost between the lines.

<comment><USER56> What got me was the fact that the background image is a 3.4 MB (!!) file. Yowzas, talk about page boat.

<comment><USER57> Wow. And looking at it, it appears blurry and slightly pixelated, as if it has been upscaled. It also looks like it might have jpeg artifacts from a previous compression. Although it cannot simply be made a jpeg as-is because it is largely transparent. I used [https://tinypng.com/](https://tinypng.com/) lossy png to get it down to 770kB with virtually no loss of quality (since the quality was so bad to begin with). But it could be shrunk more by either using a smaller image and upscaling it in the browser (instead of upsaling it prior to saving), or merging the background gradient with the image and saving it as jpeg.

</comment></comment></comment><comment><USER58> If anyone else is interested, here's a link to someone's repost of "Why I'm a Bad Correspondent"

[http://www.carlkingdom.com/neal-stephenson-why-i-am-a-bad- co...](http://www.carlkingdom.com/neal-stephenson-why-i-am-a-bad- correspondent)

</comment><comment><USER59> Nothing to do with the function, but the form...

I really struggle with white on black text. Most of the internet is black on white, so, when switching back to a light screen I see black line after images. I really dislike it.

</comment><comment><USER60> If Charles Stross, Georges RR Martin could do the same, maybe we could stop having shitty milfan boy creepy SiFi and have good SiFi again with bits of humor.

If Neal read this and meet Charles please tell him to stop post photo of his cats on twitter and go back to work.

The quality of his writing is going down, and the only thing that make me stay away from social medias are good books.

I get it. I am a Sociomediapath because of him in fact. I blame him 100%!

PS neal makes good funny books, but he has difficulty making ends that don't involve deus ex machina. (REAMDE ending is a tad disappointing after quite a good development. Still it is a good essay on virtual currencies).

</comment><comment><USER61> "Cultivate an identity as a Luddite." This coming from someone who writes their first draft using pen and paper.

<comment><USER62> I dont understand this comment, should he be using quill pen, or starting an oral history to be more of a luddite?

<comment><USER63> The point is that the parent thinks he's already established himself as a luddite by using so antiquated technology as dead trees.</comment></comment></comment>


Open Mesh Network based on the Bitcoin Protocol - <AUTHOR> http://www.openlibernet.org <comment><USER2> I definitely hope they take a long hard look at what Maidsafe has been doing, especially at their anonymity model, and I think they have a pay-model, too, at least for the company itself.

But instead of seeing all of these different projects that are basically forking Bitcoin (OpenLibernet, MaidSafe, Bitcloud, GNS, Twister, Bitmessage, etc), and creating something very different each time, rather than having all of them being built on top of Bitcoin, like we were promised, I'd like to see these being integrated with Ethereum.

Ethereum promises to be that "Bitcoin as Internet/platform" thing that we eventually want, and on which all of these things and much more can be built, and be fully integrated with each other, which should make a lot of other things easier to build, such as P2P currency exchanges and so on.

With Ethereum we're going to see P2P services popping up with a _regular occurrence_ , because basically everything built on top of it will be P2P, and all could much more easily be integrated with each other, and could much more easily find a monetization and sustainable model, and also a way to incentivize users to join them.

Think Twitter, Facebook, e-mail, chatting, Dropbox, and probably even Youtube alternatives, all P2P, and some even anonymous if the developer decides to integrate that in them. I expect this to eventually bring us that "secure by default Internet", rather than making what we have now secure by default.

[https://www.youtube.com/watch?v=l9dpjN3Mwps](https://www.youtube.com/watch?v=l9dpjN3Mwps)

[http://www.ethereum.org/](http://www.ethereum.org/)

[https://www.ethereum.org/whitepaper/ethereum.html](https://www.ethereum.org/whitepaper/ethereum.html)

</comment><comment><USER3> I have been waiting for this since I learned about Bitcoin.

Thanks for trying to make this happen. Combining this with Maidsafe and Bittorent technology could prove to be a winning recipe for an almost free and a completely secure internet.

Any idea when you'll go into Beta?

</comment><comment><USER4> Seems like a great idea.</comment>


Sacrosanct Linux feature dies - <AUTHOR> http://mok0.wordpress.com/2012/03/23/sacrosanct-linux-feature-dies/

<comment><USER2> Dirwiz is right you win Hyperbolic Linkbait Title of the Week (HLTW)...

But more importantly ubuntu is _a linux distribution,_ it is not the platonic representation of Linux.

More over this probably makes sense for Ubuntu. Ubuntu's target audience is not people who remember mucking around with modeline settings terrified that they will bring about the flaming monitors described in the xfree86 doxumentation.

</comment><comment><USER3> Well, it seems with their aggressive feature schedule, that there may be more things that Ubuntu changes.

</comment><comment><USER4> Oh good, for a moment I was worried they removed the `ddate` commandline tool.

</comment><comment><USER5> Holy link bait...

<comment><AUTHOR> Should I edit to "Ubuntu may break virtual terminals on some graphic cards" to better reflect content or leave the original title?</comment></comment>


Television White Spaces database receives FCC certification - <AUTHOR> http://blog.google.org/2013/06/television-white-spaces-database.html <comment><USER2> Apparently a "database administrator" is a kind of registry of spectrum and location, keeping track of what devices are using which frequencies in which places, and so ensuring no overlaps? Based on this description of the proposal they submitted: [http://googlepublicpolicy.blogspot.com/2010/01/our- proposal-...](http://googlepublicpolicy.blogspot.com/2010/01/our-proposal-to- build-and-operate-white.html) and this FCC page: [http://www.fcc.gov/topic/white-space](http://www.fcc.gov/topic/white-space)

It turns out that I live in one of the largest "black" areas on their map of channel availability, Los Angeles. The other large black spots are Salt Lake City and New York. There are also a couple odd black spots in New Mexico that must be regulatory rather than physical, since they don't have any "gradient" of decreasing channel availability around them. [https://www.google.org/spectrum/whitespace/channel/](https://www.google.org/spectrum/whitespace/channel/) (looks like it's US-only).

ETA: It looks like the NM rectangular black spot is the "Very Large Array" of radio-telescopes ([http://en.wikipedia.org/wiki/Very_Large_Array](http://en.wikipedia.org/wiki/Very_Large_Array))

</comment><comment><USER3> This is exciting progress on the (regulatory) future of radio systems in the US.

In a nutshell, in the past the FCC assigned exclusive use for a slice of spectrum to a particular user. A while back the FCC established spectrum ghettos (the ISM band) in 900Mhz, 2.4Ghz, and 5Ghz as a sort of power-limited free-for-all. This enabled the explosion of personal connectivity that we've experienced in the past decade.

They are trying a hybrid approach with the TV Whitespace (TVWS) spectrum freed up from the analog to digital TV conversion (~400-700Mhz). Multiple competitive databases were commissioned (Google, Spectrum Bridge, Telcordia, etc). When a TVWS AP powers up it checks for free channels with the database over the internet (each TVWS AP has a embedded GPS for location-awareness)[1]. This allows for APs to slot in between licensed users (TV Stations) and the politically connected illegitimate users, cough, I mean key stakeholders, such as stadiums and churches (wireless microphones).

1: The idea is database operators can charge for access and give you a API key to put in the radio or something.

The super exciting part comes (if this works to the FCC's satisfaction) when you can dynamically allocate spectrum that otherwise would have been reserved for users that rarely use it. E.g. DoD spectrum that is only used during natural disasters or spectrum used for ship to shore (if you are in the midwest).</comment>


Ask HN: Alternatives to Google Sheet for organizing 2k people 3D-printing - <AUTHOR> We are a group in Norway that are organizing 3D-printing for shields for use against Covid-19. The group have exploded the last day and we have problems loading+using Google Sheet. Hope you have some tips to help us grow (past ?) Google Sheet. <comment><USER2> Do they all need to be editing the same sheet? At work when we ran into loading issues we separated it out region wise and provided links to each sheet on a webpage.

<comment><AUTHOR> That could work. There is the drawback that on the biggest logical separation (like state in US) these are large boarders compared to area, so a lot of them would be overlapping in how people could work together across the regions

<comment><USER2> We did it sort of organically...started with just a North, South division which reduced loading issues...and then those pages slowly grew and branched into different zones. Most people only needed data from their zone. It depend I guess on what your users are looking for.

The few who needed data from all pages created and shared their own sheets with aggregation/tracking etc from all sheets.</comment></comment></comment>


Django 1.10 released - <AUTHOR> https://www.djangoproject.com/weblog/2016/aug/01/django-110-released/ <comment><USER2> Here are the release notes, they are excellently written, just like the Django docs are excellently written. I continue to be impressed.

[https://docs.djangoproject.com/en/1.10/releases/1.10/](https://docs.djangoproject.com/en/1.10/releases/1.10/)

</comment><comment><USER3> Shame about Channels, but I see the logic in not including it. Django is pretty awesome as a backend, and while it's not a 'cool' framework anymore (I feel old!) it's amazing for writing back-office applications.

I use it as an API backend with Django-rest-framework. The advantage is you get ridiculous amounts of packages that all integrate with Django that does pretty much anything you want. Also the ORM doesn't suck now so that's a bonus.

<comment><USER4> Huh. Your argument in favor of Django is basically "it may not be cool, but it's got a lot of libraries written for it." Which is basically the same thing people used to say (and still say) about Java, compared to something "cool" and "new" like, say, Django or Rails (at the time). In other words, Django used to be picked because it was the hot new thing, but since then it's no longer hot or new, but since enough people adopted it, they wrote enough libraries for it to make it worth continuing to use on new projects.

<comment><USER5> Was Django _ever_ the hot new thing? Python certainly isn't and has never been "hot."

In the 2000s, it seems much more like all the attention went to RoR. Now all the attention goes to JavaScript.

In the meantime, Django has steadily added new functionality while adhering to smart core principles. It really does seem to be in the sweet spot of dependability and convenience. I don't think anything else is faster to develop with.

<comment><USER6> You must have been asleep 5-10 years ago when Rails and Django were repeatedly being pitched against each other by hipster developers, leaving PHP, looking for the "new thing".

They were both scorching hot until somebody decided doing everything in Javascript was a good idea.

(Edit FTR: Given the topic thread, I feel it important to say that I didn't mean Node et al _are_ better than Django, just that these hipsters thought —by virtue of being newer and newer is always better— it time to move on. I'm a Django dev and judging by the positive state of development, will be for a LONG time.)

<comment><USER5> I guess I remember all the hype going to Rails, not Django. For example, dozens of coding bootcamps used a Rails curriculum but I haven't heard of a single one which taught Django.

</comment></comment></comment></comment></comment><comment><USER7> Recently after a 6 year hiatus from Django, I've experimented migrating a smallish flask API and wholly cow did the Django API get CLEANER. Like my god people talk about Django as if it hasn't changed in 6 years but it feels to me like many of the warts got removed and it's just down right pleasant to work with. I love Flask but there is just a little too much boiler plate when you compare it to modern Django for even small projects (IMO).

</comment><comment><USER8> Edit: looks like this is now the 2nd to last release to support Python2.

Original: It doesn't mention it on this page, but this is also planned to be the last Django release to support python2. Django 2 will require python3.

<comment><USER9> This is great news.

Now that the transition is in full swing, it's encouraging to see more projects adopt a Python 3 First attitude.

I only wish Ansible would catch up (a recent release broke the core Python 3 support that was there, and no-one seemed to care as Py3 isn't yet officially supported).

<comment><USER10> Ansible problem is 100s of libs that are python2 only. Sysadmins never got python3...

</comment></comment></comment><comment><AUTHOR> Some of the highlights:

\- Full text search for PostgreSQL.

\- New-style middleware to solve the lack of strict request/response layering of the old-style of middleware.

\- Official support for Unicode usernames.

</comment><comment><USER11> As a Rails dude...is there any reason for me to learn Django at all? Everything I've heard about it is that it provides a lot of sane defaults (like Rails) but has much less "magic" than Rails is typically thought to have.

And if the answer to my question is yes, what books/tutorials/screencasts/courses to people recommend to get started with?

<comment><USER12> As someone who picked Django over Rails ~10 years ago and has used it for everything since then-- I wouldn't bother.

Django and Rails, like Python and Ruby, look more and more similar as time goes on. Not because they are becoming more similar, but because the web ecosystem around them has become a lot more diverse. If you want a break from Rails, learn Phoenix! Or Node, I guess.

Furthermore, with the advent of fat front-ends, the utility of both of these frameworks has gone down in absolute terms. When they first came out, front- end features like form generation and HTML templating were really important, but now they're arguably better to avoid. (That's why channels are so important to the future of Django.)

That said, I still like Django a lot and use it all the time. I don't want to discourage you from learning it. But I wouldn't do it because you're trying to make a leap from Rails.

<comment><USER13> What a refreshingly honest answer...thank you. It's not often you see that sort of candor.

I was personally a Rails guy, then switched to learning Django, but had the experience you note...both frameworks solved many problems which aren't as relevant in this age of SPAs. I suppose if you really liked Django's ORM it might be worth it, but doubt there's a huge amount of value to be gained. YMMV.

<comment><AUTHOR> I suppose if the framework, community and ecosystem are on par with each other, then the deciding factor would be the language.

<comment><USER14> Exactly. I've chosen Django because of Python.

</comment></comment></comment></comment></comment><comment><USER15> I wonder why this release didn't include the class-based auth views ([https://github.com/django/django/blob/1.10/django/contrib/au...](https://github.com/django/django/blob/1.10/django/contrib/auth/views.py) vs [https://github.com/django/django/blob/master/django/contrib/...](https://github.com/django/django/blob/master/django/contrib/auth/views.py))

<comment><USER16> Django has a time based release schedule [1]. The class based authentication views weren't committed until after the feature freeze for the 1.10 alpha.

<comment><USER16> [1]: [https://docs.djangoproject.com/en/1.9/internals/release- proc...](https://docs.djangoproject.com/en/1.9/internals/release- process/#release-process)

</comment></comment></comment><comment><AUTHOR> Looks like channels was not included in 1.10. Is there still a plan to package it with Django or is it better served to be a stand alone app for now?

According to channels' documentation:

> You can install Channels as a library for Django 1.8 and 1.9, and it (should > be) part of Django 1.10.

<comment><USER17> It was withdrawn from the 1.10 release about 3 months ago, I think:

[https://groups.google.com/forum/#!msg/django- developers/QRd4...](https://groups.google.com/forum/#!msg/django- developers/QRd4v7OErT8/oTv4APoOAwAJ)

<comment><USER18> Also see:

[https://groups.google.com/forum/#!topic/django- developers/24...](https://groups.google.com/forum/#!topic/django- developers/24DGLVVRV_s)

</comment></comment></comment><comment><AUTHOR> I'm still stuck with Django 1.4 for one of my projects, it's such a big hurdle to upgrade it. I wonder if it's worth to just straight up rewrite it in 1.10.

<comment><USER19> It's better to do it step by step: 1.4 to 1.5, 1.5 to 1.6, etc. You need to go through the release notes and have a good test coverage.

<comment><USER12> This. Go through the deprecation lists and backwards incompatibility lists item by item. Thankfully, they're very thoroughly done. It probably won't take as long as you think!

</comment></comment></comment><comment><USER20> In the middle of the changes is an important security fix for sites that take file uploads: [https://substance.brpx.com/hardening-django-one-dos-at-a- tim...](https://substance.brpx.com/hardening-django-one-dos-at-a- time-30bbfc8c853)

</comment><comment><USER21> As someone who's picked up Python only in the last few years, Django is amazing. I'm particularly fond of Django CMS.

Does anyone know of a working "static site generator" for Django that works with Django CMS? Or maybe Wagtail? Something that would build out the static HTML pages ready to deploy to S3. Django CMS (thanks to Django itself) has a wonderfully robust back-office UI, and I feel like my Google-fu has failed me in finding that last puzzle piece to static site nirvana.

<comment><USER22> See [http://docs.wagtail.io/en/v1.5.3/reference/contrib/staticsit...](http://docs.wagtail.io/en/v1.5.3/reference/contrib/staticsitegen.html) for Wagtail. I've been experimenting with django-bakery and wagtailbakery with much success.

<comment><USER21> How did I miss that? Thanks so much!

</comment></comment></comment><comment><USER23> If there are any Django masters in the building: If you were starting a project today would you use 1.10 or stick with the LTS release (1.8)? I have a fairly mature django project using 1.6 that I would be borrowing a bit from, and my experience _not_ upgrading off 1.6 due to pain makes it feel like an LTS path might be a good choice?

<comment><USER24> The next LTS will be released in about 9 months. If you're willing to make a small upgrade at that time, I'd build on 1.10 and then upgrade to 1.11 LTS, which will give you 3 years (I think..) plus 9 months of 1.10 support.

Moving from 1.8 to 1.11 shouldn't require any changes provided that you're running with 0 deprecation warnings on 1.8. The new release scheme means that if you're running on an LTS with no deprecation warnings, then you should be able to upgrade to the next LTS release with no changes (but lots of new deprecation warnings).

Hope that helps.

[https://docs.djangoproject.com/es/1.9/internals/release- proc...](https://docs.djangoproject.com/es/1.9/internals/release-process/)

<comment><USER18> > Moving from 1.8 to 1.11 shouldn't require any changes provided that you're > running with 0 deprecation warnings on 1.8.

Yes, this is how it's _supposed_ to be. This agrees with Django's roadmap (see the "I'm the maintainer of a reusable application. Which Django versions should I support?" question at the bottom): [https://www.djangoproject.com/weblog/2015/jun/25/roadmap/](https://www.djangoproject.com/weblog/2015/jun/25/roadmap/)

However, it depends on the third party apps you're using. I have a Django 1.9 site that uses django-mptt. The site was running warning-clean, but when I attempted to upgrade the site to Django 1.10, it broke because of this issue: [https://github.com/django-mptt/django- mptt/issues/469](https://github.com/django-mptt/django-mptt/issues/469)

<comment><USER24> Yeah dependencies are always going to be an issue unfortunately. Django can make as many recommendations as it likes, but you're still at the mercy of all other dependencies.

Moving from 1.9 to 1.10 is different than moving from LTS to LTS. The hope is that 3rd party packages will be testing against LTS releases at the minimum, which should allow you to make the jump after packages have time to update themselves.

<comment><USER18> > Moving from 1.9 to 1.10 is different than moving from LTS to LTS. The hope > is that 3rd party packages will be testing against LTS releases at the > minimum, which should allow you to make the jump after packages have time to > update themselves.

This is true. Good point.

</comment></comment></comment></comment></comment><comment><USER25> Django has managed to avoid collapsing under its own weight and for that it should be commended. If you've invested time in less-opinionated microframeworks, you're probably better off just not going the Django route(no pun intended).</comment>


Leaving Gmail Behind (2013) - <AUTHOR> http://nullprogram.com/blog/2013/09/03/ <comment><USER2> Don't bother running a mail server. It's hell. I did from 1998 until about last week. I started running it on a cable modem with an old Compaq desktop, migrated to a dedicated server (which hosted a load of other stuff) and finally onto VMs.

I have spent hours getting myself of blacklists after entire IP ranges were reported. I've spent hours working out why the hell Postfix won't talk to dovecot on a local socket, upgrading Linux distributions, postfix and dovecot and being fucked over by config format changes and periodically losing entire mailboxes to IMAP bugs. Oh and SELinux - hours of it.

The thing that finally killed it for me was Yahoo. My landlord uses Yahoo mail for comms and Yahoo just decided to stop accepting delivery from my server. It took a phone call from me asking him why he hadn't sorted something for me and for him to tell me that he didn't get the email to discover this. So I dredged through the logs, found an error from yahoo's mail servers saying I need to hit a web form to prove I was a legitimate sender. So I did that, and nothing, not a sausage happened. Googling around says I need to wait 6 months before submitting the request again.

I have no power in this situation. I can't email my landlord. I need to do business, not piss around with politics.

So in a fit of anger, I blasted my VM on Linode, went to my local supermarket, bought a Moto G2 in cash to replace my Lumia 630 (which was doing IMAP) that I just smashed the screen on, signed up for Google Apps free trial and just moved the domain over to that.

Just can't be fucked with it any more. I run "inbox zero" (i.e. I delete religiously) so there is no cost for me to migrate.

I don't care if they read my email or shop me to the feds; I'm tired of herding servers and software these days. A decade ago I could quite happily spend all day doing it but I have better things to do now.

<comment><USER3> There is a hybrid approach -- run a local mail server for receiving mail, and configure your Gmail account set the "From:" address to your domain, and forward any mail to Gmail to your domain. This way you are still mostly in control of your mail, but with the sending reliability of a major service.

<comment><USER4> This basically negates half the privacy though. And given most of the mail you recitative will be sent from gmails servers anyway...

<comment><USER3> For myself, I'm not too worried about privacy (if I want that I'll use PGP). I'm more concerned about vendor lock in. Because as long as people are sending you mail to a domain you own, you can change the sending email provider to any other one that allows a custom From: address. Now from a practical side, I currently let Google Apps completely handle my domain's email, but I can yank it off there at a moments notice if I had to (i.e., if Google decided that I'm not allowed to host my domain there anymore).

</comment></comment></comment></comment><comment><USER5> I'm trying to imagine an article written in 1996 about someone switching their email providers. It would be a complete non-event, there were so many to choose from back then and besides, your own workstation was likely running sendmail. So here we are in the data silo era, where running your own mailserver is seen as something as archaic as soldering your own CPU board.

Fortunately I never made the switch. I do have a gmail account (actually, I have a google account which translates into having a gmail account as well). The only times I've used it is as a fallback for not being able to send mail from my own server because the ssh tunnel was unavailable. This happened maybe twice over the last decade, in both cases I could have avoided the issue if I had thought about it a bit longer.

So gmail was a way out of the bind, but as soon as that was resolved I used my trusty old mailserver again. Setting one up and maintaining it over the years is probably less work than moving out of gmail once you've decided enough is enough. Cost of switching is _the_ way customer lock in is achieved in almost any situation, fortunately google make it relatively easy to get your data out.

Future product: family box. A simple rack mounted appliance a-la synology that takes care of the data, email, address books and so on of an extended family, administered by the family computer whiz. With an backup in the cloud via tarsnap to guard against mishap. A bit like a workgroup server but then applied to a family or some kind of loosely knit group of individuals.

With the option to migrate from one box to another if you want (and with forwarding in case you do).

<comment><USER6> In 1996 I'd say most people got their email address through a large institution and had to change email addresses every time they changed institutions.

For many that was their work or school email address. For the average folks that was their ISP. It's one of the huge reasons there are STILL people using AOL.

Running your own mailserver has always been difficult (depending on your skill level). Gmail came out and provided people an option for an email address that was highly portable and accessible.

The family box is a nice idea, but relying on the goodwill of the family computer whiz is unlikely to provide people with a stable email server.

<comment><USER7> Gmail? Hotmail came out in '96, Yahoo mail not long after.

The opportunity regarding the family appliance, if there is one, is to make it self-managing.

<comment><USER8> It's true that Hotmail & Yahoo were available well before Gmail, but pre-AJAX webmail wasn't fit for serious use - it was more of a backup for people traveling, or for ad-hoc use, and most email use was from desktop software (Eudora, Outlook Express, etc).

Gmail was really the first webmail usable as a person's _only_ email address, lot least because of the 1G storage on offer.

<comment><USER7> Not sure I agree. Webmail has always been usable for normal people, while power users could and do use a dedicated program. Gmail did bring innovations, of course, but competitors copied them.

I've noticed Gmail users tend to be unaware of alternatives and always wondered why that is.

</comment></comment></comment></comment></comment><comment><USER9> It's interesting to see several posts about people leaving Gmail in the recent months pop up on HN.

What I don't get about this one is that the author, Christopher, put the email server on a Digital Ocean VPS. If I'm not mistaken, DO is a US company and the gov can probably get access to the server's contents as easily as to a Gmail account.

Of course, if Christopher uses PGP for everything, then the gov would still have to find a way to decrypt stuff. But PGP doesn't seem to be commonly used (yet).

I used to have a Gmail account too but switched to Fastmail about 16 months ago and recently renewed my account for 3 more years. It's reliable and the web client is crazy fast.

<comment><AUTHOR> 1 - Gmail is a much bigger and jucier target than any VPS provider. Though the bigger and more popular the VPS provider is, the jucier a target it becomes.

2 - Siphoning data from Gmail is much easier for three-letter-agencies than breaking in to coercing every VPS provider out there. Though the bigger and more popular the VPS provider is, the more likely it becomes that these agencies will go to the trouble of spying on them.

3 - Fastmail's servers are in the US.[1]

[1] - [http://blog.fastmail.com/2013/10/07/fastmails-servers-are- in...](http://blog.fastmail.com/2013/10/07/fastmails-servers-are-in-the-us- what-this-means-for-you/)

<comment><USER10> I wish Fastmail would add servers in Iceland.

They already have a datacenter there, it's fairly well connected (on top of multiple transatlantic cables), a sensible government and sensible, transparent judicial processes.

<comment><USER11> > it's fairly well connected (on top of multiple transatlantic cables)

Not as well as you'd think. We see substantial packet loss to Iceland for long periods at least once a week, and very occasionally the entire country disappears from the internet (maybe every couple of months).

Also so far we haven't found a datacentre that we feel we can trust to care about reliability as much as we do. I've just spent the last four hours dealing with our entire Iceland presence being taken off the internet because someone at the datacentre misinterpreted our normal replication load as a denial of service and blocked the entire thing.

We're trying, but so far we do not have the confidence that we could reliably provide user-facing services from Iceland, or at least not to the standard that we do from New York.

</comment></comment></comment></comment><comment><USER12> I left gmail and ran my own mail server too. It's harder and more stressful than you think.

After a year I decided I'd had enough and moved to runbox[1]. It's not that expensive and the peace of mind know I don't have to worry about my mail server is excellent.

1: [https://runbox.com/](https://runbox.com/)

<comment><USER13> How does Runbox compare to FastMail?

<comment><USER12> Cheaper for me since I have a bunch of domains and aliases.

I'm also happier with the location. Runbox is in Norway and FastMail is in the USA. I'm based in the UK.

<comment><USER13> Actually, FastMail is an Australian company and subject to Au laws. Although, I think they do have operations in NY (or maybe NJ).

"FastMail is an Australian company and as such is subject to Australian law."[1]

[1] [https://www.fastmail.com/help/legal/privacy.html?domain=fast...](https://www.fastmail.com/help/legal/privacy.html?domain=fastmail.fm)

</comment></comment></comment></comment><comment><USER14> I used to run my own mailserver. It was alright, but occasionally I'd screw up the config and not notice for days, or my auto-update of spamassassin would fail and I'd get heaps of spam.

I moved to Google Apps when it was in beta, and I was quite happy for a while, but GMail kept getting worse. I also host my family's email, so when GMail changed I'd get calls from my mum. I use IMAP clients, so I'd also be as stuck as her! Replacing all the nice text buttons with icons really doesn't help, and their spam filtering was getting too many false positives due to others marking mailing lists as spam instead of unsubscribing.

Finally the new compose view was the last straw. I signed up for Fastmail and migrated all my email accounts over, and I haven't looked back. Their web interface is simple and really fast. Search isn't as great as Google, but IMAP to my mail client sorts that for me. Spam filtering isn't as fancy as GMail, but I get fewer false positives - I'd much rather have spam hit my inbox than genuine mail get filtered out.

Plus Fastmail lets you write sieve filters if you're a power user, it's far better than the half-baked filters Gmail offers.

</comment><comment><USER15> Running your own server is great until something goes wrong and nothing works. It is just too much hassle to run your own mail server these days IMHO. Being blacklisted for spam is a nightmare to sort out and can happen so easily when you stick you server on something like DO. The control and privacy is nice but is there really much difference between running your own server on DO and using Outlook.com or Gmail in terms of privacy?

<comment><USER12> There's always that feeling in the back of your head...

"Why haven't I got a reply yet? Are they busy? ... Or maybe I've misconfigured something... Maybe it got marked as spam... Maybe my SMTP server is fucked..."

I always found myself using my gmail account for critical stuff...

</comment></comment><comment><USER16> I'm in the process of setting up my own email system but my biggest worry is incoming spam.

One of the reasons (thee reason?) Gmail is so good at blocking spam is because they have so many users using them that it becomes very easy to spot spam campaigns. But I also think it's true that the longer an email address is in use, the more targeted the spam becomes. Not because some evil script-kiddie turns his spambot up to 11, but because you'll start to get emails from legitimate people about things you're not interested in which aren't as easy to catch in a spam filter.

Another reason Gmail is good at blocking spam is because the answer to "what is spam" is influenced by every single user who tags a message as spam, or doesn't tag a message as spam. This is another critical-mass benefit that a small scale provider can't currently provide.

Given reputation systems and cryptography though, I also wonder if the only reason some kind of distributed email reputation database / system doesn't already exist (or isn't more widely known?) is because everyone assumes it isn't possible.

<pipedream>What if it wasn't you and your email server trying to catch spam, but you and every other independent server admin who runs their own email server. When a new email comes in you could check the reputation of the sender, you could check the reputation on the domain of any links, et al. Reputations would be signed and you wouldn't immediately trust the reputation report from new users, and wouldn't even need to trust reputation reports from email servers controlled by admins you don't know.</pipedream>

Edit: Typo, clarification

<comment><USER17> Couldn't you use your small size to an advantage, though? For example, when I ran a mail server over a decade ago for a small business, there were a couple dozen accounts. I would get email attacks that looked like they were being sent to "firstname.lastname@example.com", "email@example.com", "email@example.com", etc. Anything that went to these obviously bogus addresses, was spam and could be removed from the legitimate accounts (and blacklisted, of course). I wonder if there are other ways you could use the small number of accounts as an advantage?

</comment></comment><comment><USER18> Every time I read one of these articles, I go from optimistic of being able to switch over to frustrated by the end, both because of the complexity of setting it up and the end result not looking like something I could give my parents to run even if I got it set up completely. Why is it that nearly every other service that runs on the 'net can be stood up in one or two packages and maybe as many config files?

<comment><USER19> It really is not; my dovecot, opensmtpd and dkimproxy (needed almost exclusively to ensure delivery to Gmail) config is 45 lines total (with comments).

<comment><USER20> Do you have write up of your set up anywhere?

<comment><USER19> Nah; but here is the config with slightly more comments: [https://gist.github.com/mbq/7ddbfc2678961e10bb1f](https://gist.github.com/mbq/7ddbfc2678961e10bb1f)

</comment></comment></comment></comment><comment><USER21> I use Mandrill for domains I don't use much for email. It's great for sending and you can setup incoming mail. Mandrill has a web hook which can send each incoming email wherever you like with the info in JSON format. So, I just setup a simple Ruby app which receives the email info and then writes that info to maildir format. I have this setup on a VPS and then I read the email directly from there using Mutt.

Right now I don't have sending setup for anything but through my apps. If I get something I really need to reply to (rare) I just email with my main address (setup with Gmail) and mention that this address should be used for further messages.

With a bit more work and getting outgoing email setup, then I'm sure it would work fine for my main address as well.

</comment><comment><USER22> Anybody know how much revenue gmail makes per user? I'm pretty sure I'd be happy to pay that to not have them scrape through my email. I think they have great services but am turned off by the idea of them owning all of my data as they are pretty up front about looking through it to sell advertisements against me. They are also getting really good at sifting through it with all the latest deep learning neural networks. I'd like to see google open the business model to include selling me a service up front rather than incrementally selling my data. Of course, I've been saying this since 1996 and always have had people look at me odd, shrug and say "but it's free and it works great".

<comment><USER23> Why not just pay someone else? I'm paying fastmail 40 dollars a year and happy with it.

</comment></comment><comment><USER24> I've just setup a box especially for some mail accounts on DO by using [https://mailinabox.email](https://mailinabox.email) Looks like a pretty complete package for the job, let's see how it holds up.

</comment><comment><USER25> Mail through EMACS? Why go to so much trouble?

I have an IMAP mailbox at an ISP, and all my web sites forward to it. The desktop and laptop machines use Thunderbird, and Android phones speak IMAP just fine. IMAP has pretty much solved the problem of multiple client devices accessing the same mailbox, and everybody has good spam filters and lots of disk space now.

So what do you need GMail for, anyway? Or any webmail system?

</comment><comment><USER26> The only alternatives I will consider to Gmail are other web providers that take a few clicks to set up and can hold all my email forever.

I know that's not very 'hacker-ish', but, everything this article describes sounds so utterly unpleasant to suffer. Gmail obsoleted hosting your own mail, as far as I'm concerned.

</comment><comment><USER27> I run my own email server on my VPS that also hosts my site. Works pretty well.

Got it setup with Virtualmin which auto sets-up ClamAV and SpamAssasin + email accounts and also installed Roundcube for webmail. Works a charm with any IMAP/POP3 email client I've tried it with too.

</comment><comment><USER28> Gmail has made the email ecosystem much worse than it was. Sadly it just marks your domain as spam eve if you do ptr, SPF, dkim, dmarc etc. Really sad

</comment><comment><USER29> Mykolab is a good alternative.

<comment><AUTHOR> How so?

<comment><USER29> No data mining (you pay for your service with money and not with your privacy). It's located in place where privacy laws are taken seriously. It also offers all the common features like IMAP, CalDAV, CardDAV, WebDAV and etc. And also has a very good Web interface as an option. And, it's using free software, not some proprietary closed source platform which you have no clue about. So by using it you support free software projects. A win win situation for everyone.

For more details, see:

[https://mykolab.com/faq](https://mykolab.com/faq)

[https://mykolab.com/features](https://mykolab.com/features)

</comment></comment></comment><comment><USER30> Post should be dated with "(2013)" appendage.

What's with these endless bouts of Google-hate on HN? seemingly if there isn't anything going on at the moment someone would readily whip something out from the archives just to keep the Google-bashing going and they will be generously rewarded with karma.

What have they ever done to you?!

<comment><USER31> > What have they ever done to you?!

I don't dislike Google, but I think it's a problem that the vast majority of its users couldn't precisely articulate exactly how Google uses all the personal data they collect, from documents, searches, e-mails, phone usage, etc.

And I think it's improper to rely on the "people use Google voluntarily" canard. It's a classic case of information asymmetry: Google has all the information about how it uses personal data, and consumers don't. While I imagine most consumers understand that if they search for "laundry detergent" Google might show them ads for "Tide," what Google does goes far beyond that and I think very few people really understand what they are bargaining away in return for using their services.

<comment><USER30> Is it a Google specific issue though? I mean there is a policy users could read, they have the dashboard, transparency reports, bug trackers, forums, blog posts, the works, probably more than anyone else offers.

Also there are the many articles the keep popping up about Google with various motivations behind them, I think "people" are more "aware" than you give them credit for.

Also don't you think that data is/are a major part of the functionality of these products? they operate on data, data collection isn't a side effect but it's built into the utility of such services almost by definition.

<comment><USER31> At the end of the day, people don't read privacy policies.[1] They depend on intuition: if I watch a lot of cat videos on Youtube, I might get ads for cat products. When your data analysis goes outside the boundaries of what users would intuitively expect based on their knowing,[2] and voluntary interactions with your service, then I think you're on shaky ground.

And no, it's not a Google-specific problem. Google is just the face of this new industry based on privacy-monetization, and the criticism it gets is to be expected based on its leadership position.

[1] And I think it's wrong-headed to infer consent from inaction.

[2] When you're talking about, e.g., Android, many users don't even realize they're interacting with Google services.</comment></comment></comment></comment>


Heyzap's (YC W09) Flash Payment Platform Now Gives Publishers A Cut - <AUTHOR> http://www.techcrunch.com/2009/08/19/heyzaps-flash-payment-platform-now-gives-publishers-a-cut-of-the-action/

<comment><USER2> I have to say Heyzap seems to have one of the most promising online business models I've seen on a long time.

Well done guys.

<comment><USER3> What causes the reluctance? Just curious =)

</comment></comment><comment><USER4> Congrats Jude & Immad & James!

</comment><comment><USER5> Gotta Love this :)

</comment><comment><USER6> The SMS payment option is twice as expensive as the paypal or credit card option. Interested in seeing conversion rates on the various payment options.

<comment><AUTHOR> Surprisingly high. It is much easier than the rest of the methods.

Also the conversion between dollars -> Heyzap coins probably removes the mental coupling of the difference in margins.

<comment><USER6> Interesting. Is it close to Zongs claim of 10x a credit card?

<comment><AUTHOR> Nope, not even close :).

</comment></comment></comment></comment><comment><USER7> Congrats guys!!!

<comment><USER8> congrats crxnamja, the man apart of the team behind the curtain for this product</comment></comment>


Godaddy has issued at least 8850 SSL certificates without validating anything - <AUTHOR> https://groups.google.com/forum/?hl=en#!msg/mozilla.dev.security.policy/Htujoyq-pO8/uRBcS2TmBQAJ <comment><USER2> Interesting tidbit: The CA/B Forum passed a change to the Baseline Requirements attempting to standardize the methods of domain ownership validation back in August of last year[1]. Prior to that, it was essentially up to the CAs to come up with secure methods. The methods described in that change contained mitigations against this vulnerability.

The change never went into effect (practically speaking - it's actually a bit more complex) because a number of CAs in the Forum filed patent exclusion notices, and wouldn't you know it: GoDaddy was one of them. Hope it was worth it.

[1]: [https://cabforum.org/2016/08/05/ballot-169-revised- validatio...](https://cabforum.org/2016/08/05/ballot-169-revised-validation- requirements/)

[2]: [https://cabforum.org/wp-content/uploads/GoDaddy- Ballot-169-E...](https://cabforum.org/wp-content/uploads/GoDaddy- Ballot-169-Exclusion-Notice.pdf)

</comment><comment><USER3> Finder here, this is the history:

        12.12.2016: First contact with MS
        27.12.2016: Answer, saying its not a bug. (Notice the promise that you get an answer in 24 hours)
        02.01.2017: Explaining the issue again in more detail
        03.01.2017: Opening the ticket, saying I will get more information if something is available.
        12.01.2017: No answer from MS, and seeing randomly this post on HN

I hope I will get some details by MS soon so I can keep you up to date guys.

</comment><comment><USER4> tl;dr: they requested a URL and wanted it to echo a token passed in the query string. They accepted 404 pages that echoed the token as valid, too!

"In case anyone is wondering why this is problematic, during the Ballot 169 review process, Peter Bowen ran a check against the top 10,000 Alexa domains and noted that more than 400 sites returned a HTTP 200 response for a request to [http://www.$DOMAIN/.well-known/pki- validation/4c079484040e32...](http://www.$DOMAIN/.well-known/pki- validation/4c079484040e32529577b6a5aade31c5af6fe0c7) [1]. A number of those included the URL in the response body, which would presumably be good enough for GoDaddy's domain validation process if they indeed only check for a HTTP 200 response.

[1]: [https://cabforum.org/pipermail/public/2016-April/007506.html](https://cabforum.org/pipermail/public/2016-April/007506.html) "

<comment><USER5> So, in in this particular exploit, LetsEncrypt offers more verification, correct? How does the ACME spec mitigate this?

<comment><USER6> Based on what I know of a high level overview of ACME:

The client says "Hey, i have a cert here, and I want to verify i control domain.com"

The server says "Ok, take this [set of challenge data], encrypt it with your cert, and put it at .well-known/acme-challenge."

The client takes the challenge data. encrypts it. puts it at the challenge point and informs the server.

The server verifies that the encrypted data matches what they were expecting to get. They then sign the cert because only a person with the webserver/domain and the cert could pull off this magic.

The important part here, is that since the client already has the cert in hand when the verification is taking place - it can be used as part of the verification. Use the cert to do cert stuff. Only that cert can do those things. If I can't even get a cert until AFTER I've proven I control a location, then this obviously doesnt work and another "proof" has to be made - hence godaddy's issue.

<comment><USER7> Google Apps just asked you to upload random text files to certain locations or add DNS TEXT records to verify you own the domain. So does Amazon with SES. You just make an account with them and they give you the stuff.

Why isn't that good enough? No need to use a cert to verify it.

<comment><USER6> That would work. The point of ACME is to not need to generate certs. They just verify them. That removes a bit of computational burden from them. the acme challenge is probably "random text files" too, just generated using the certificate at hand to verify ownership of domain and certificate. Certbot basically is just a client to do all those things you described for you.

The difference between "prove you own this domain and we will provide you a signed certificate for it" and "prove you own this domain and this certificate at the same time, and we will sign it for you"

It's really not that different, except they have opted to make it such a way that it is easily automated. And it's open source, so if they wanted to google, amazon, or even godaddy could set up an ACME server that validates SSL/TLS certs... but would they be able to charge for it if you had to use the lets-encrypt process anyway?

<comment><USER8> What you wrote about not needing "to generate certificates" is quite wrong, though I suppose I get what made you think this.

ACME uses public key cryptography in (at least) three separate places, the keys pairs are different in each place. Like completely different - one could be 2048-bit RSA, one could be a shiny Elliptic Curve key, and one 4096-bit RSA.

1\. Access to HTTPS ACME service over SSL/TLS. Let's Encrypt has a private key, users of their ACME service get a public key, this allows them to be confident they are dealing with the genuine Let's Encrypt ACME service

2\. ACME accounts and associated challenges. Every would-be subscriber using an ACME service must create an account, this account has a private key (which they know, usually stored in a file on their computer) and a public key, which they send to the ACME service.

The ACME private key is used to sign data in ACME challenges. This proves that whoever is passing the challenges (e.g. by putting files on a web server) is also making the ACME requests. This provides the confidence to issue certificates to the account holder.

3\. The SSL certificates have a public key baked inside them, which corresponds to a private key owned by the subscriber. The subscriber proves they control the private key and want a certificate by signing a Certificate Signing Request, CSR with their private key.

The Certbot software often used with Let's Encrypt automates most of this, making the key pair for (2) automatically and just requesting you OK a PDF describing the rules for Let's Encrypt. By default it will make the key pair for (3) as well BUT if you're getting a certificate for some device that issues its own CSRs, you can hand over a CSR and it will use that one. If it didn't allow this, you couldn't get the right certificate for a device that only issues CSRs, because those devices provide no way to upload a different private key.

\--

Finally, we expect that third parties will want to offer ACME services where a mandatory challenge is like "Fax us all the paperwork and pay $50 verification fee" and then you get an EV certificate instead of the DV certificates that Let's Encrypt issues. Also, never underestimate the willingness of big businesses to pay money for things.

<comment><USER6> I see how what I said may have been confusing, but I meant that the ACME server does not generate a certificate for each user. They have their own cert for validating their service (not generated per user). And the user/client generates the certificate. The server isn't (necessarily?) generating the keys, the client is.

<comment><USER8> The ACME server absolutely does generate the end entity certificates for their subscribers (e.g. a certificate on your web server). Code which does this is part of Boulder, the Let's Encrypt implementation of an ACME server so you can go see for yourself (obviously their production system config is not on display but it's the same code)

You are correct that Let's Encrypt don't generate the subscriber's key pair. This is (or should be) true for every public CA offering Web PKI certificates today. The subscriber puts their public key in a Certificate Signing Request, and signs it with the corresponding private key. Let's Encrypt receives the CSR, verifies that it is correctly signed, establishes that the requesting Let's Encrypt user account is authorised for all the DNS names listed in the CSR, and other parameters are acceptable, then it creates a signed certificate for those names, with the public key from the CSR.

[Edited to add: If you use Certbot or similar to just issue a certificate all the CSR creation and signing is done for you. But it still happens, and Let's Encrypt are still the ones actually making and signing the certificate]

It is essential that Let's Encrypt create the certificate. Under the current Baseline Requirements they're obliged to ensure that the serial number is unpredictable yet unique across all their issued certificates. The only practical way to achieve these goals is for them to create the certificate from scratch and sign it.

The situation where a tbsCertificate (the certificate document before it is signed) is transmitted anywhere is unusual. The only example I can think of recently was where Symantec were arranging SHA-1 exception certificates and Google's process deliberately involved showing everybody the tbsCertificate before it was signed so that we (the community) could examine it and ask for anything unusual to be explained. If you go back and look at those discussions you'll see it was me who first asked for the weird OU value in certificates for TSYS to be explained or removed -- they were subsequently removed before the certificates were issued.

<comment><USER6> Thanks, Thats good to know. I was operating under the assumption that the key pair associated with the cert and the cert were essentially the same.

</comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER9> > Prior to the bug, the library used to query the website and check for the > code was configured to return a failure if the HTTP status code was not 200 > (success). A configuration change to the library caused it to return results > even when the HTTP status code was not 200. Since many web servers are > configured to include the URL of the request in the body of a 404 (not > found) response, and the URL also contained the random code, any web server > configured this way caused domain control verification to complete > successfully.

I'd bet that the library in question was libcurl, and they forgot to set CURLOPT_FAILONERROR[1].

[1]: [https://curl.haxx.se/libcurl/c/CURLOPT_FAILONERROR.html](https://curl.haxx.se/libcurl/c/CURLOPT_FAILONERROR.html)

</comment><comment><USER10> This sounds like responsible handling, disclosure, and remedying of the problem.

</comment><comment><USER11> \- request [http://example.com/<path](http://example.com/<path) or query containing random token>

\- if random token is echoed in the response, and the HTTP response code is 200, they consider that the applicant has control over the requested FQDN

Do I understand their validation method correctly? If so, I wouldn't consider it very secure.

<comment><USER12> I believe this is essentially what ACME does when using the domain challenge, granted it likely requires a certain set of content to ensure your misconfigured webserver doesn't return 200 for all paths.

<comment><USER13> ACME does not include the expected response in the path or query. So it can't be accidentally included in the response.

EDIT: quote by Nick Lamb in the discussion linked:

> ACME http-01 won't get tripped here because the checked content of the URL > is very much not the random string (it's a JWS signature over a data > structure containing that random string, thereby proving it was made by > whoever the ACME server is talking to). But yes, doing something that > _looks_ superficially like the ACME style of validation without such > subtlety will trip you up.

</comment></comment></comment><comment><USER14> Several of my customers were hit by this. What concerns me possibly even more is that GoDaddy, having revoked the certificates, then managed to "un-revoke" them on request with a grace period. This is unsettling, it's not how the CRL system is supposed to work!

<comment><USER15> That's... troubling. You should consider mentioning it on the mozilla.dev.security.policy thread:

[https://groups.google.com/forum/#!topic/mozilla.dev.security...](https://groups.google.com/forum/#!topic/mozilla.dev.security.policy/Htujoyq- pO8)

EDIT: GoDaddy themselves say they will never do this:

[https://www.godaddy.com/help/revoke-a- certificate-4747](https://www.godaddy.com/help/revoke-a-certificate-4747)

"The process cannot be reversed."

<comment><USER14> [https://medium.com/@SimonJGreen/godaddy-revoked-and-then- un-...](https://medium.com/@SimonJGreen/godaddy-revoked-and-then-un-revoked-a- certificate-without-request-11f86074bbf8#.wyx5czj27)

<comment><USER8> The first part of the story definitely checks out

[https://crt.sh/?id=29236482](https://crt.sh/?id=29236482) This certificate absolutely was revoked by GoDaddy

However, that certificate is _still_ revoked right now. A _new_ certificate for the same names was issued on the 12th of January, presumably once the re- validation was completed. This isn't in violation of any policies. Sites on that new certificate such as [https://royalduchy.co.uk/](https://royalduchy.co.uk/) do indeed work fine.

Can you update the medium story to reflect this? I mean, not your feelings about GoDaddy, say whatever you feel, but the facts aren't as portrayed in that story so far as I am able to see.

</comment></comment></comment></comment><comment><USER16> I own a SSL certificate when I bought a domain from NameCheap. The SSL cert is provided by Comodo. I recently lost my box so I also lost my cert and had to revoke the existing one and ask to re-generate. I would need to wait ~3-6 hours before a new cert is available (ugh), so I decided to go to Let's Encrypt. While the initial setup for starter is quite confusing, I managed to create one regardless and I haven't looked back.

I can't help but to think when someone was designing this challenge scheme he/she must have thought of this potential risk, but probably shrug it because "most people won't be able to come up with this method."

</comment><comment><USER17> According to TFA, the certs have already been revoked.

<comment><USER18> Relevant: [https://www.maikel.pro/blog/current-state-certificate- revoca...](https://www.maikel.pro/blog/current-state-certificate-revocation- crls-ocsp/)

<comment><USER19> Great article! Just the sort of thing I come to HN for.

I note it's a year old, though - has much changed since then? OCSP stapling sounds like a Very Good Idea, I hope it's been catching on.

<comment><USER2> Not all that much has changed. SSL Pulse[1] shows that use of OCSP Stapling went up about 3% in the past 12 months, currently putting it at 25% of observed sites. OCSP Must-Staple is now available in Firefox and can be added as an extension to certificates issued by Let's Encrypt. No other browsers have plans for Must-Staple AFAIK. Otherwise, OCSP is still soft-fail for everything but EV in most scenarios.

[1]: [https://www.trustworthyinternet.org/ssl- pulse/](https://www.trustworthyinternet.org/ssl-pulse/)

<comment><USER19> +3%? Well, that's less inspiring news than I'd hoped. Still, it's something, I suppose.

Anyway, that's another very interesting link you've got there - I knew about SSL Labs, but hadn't come across that report before. Looks like something worth keeping an eye on. Cheers!</comment></comment></comment></comment></comment>


Memory alloy bounces back into shape 10M times - <AUTHOR> http://www.bbc.co.uk/news/science-environment-32886000

<comment><AUTHOR> Link to research [0] (Ultralow-fatigue shape memory alloy films), for those that have access.

[0] [http://www.sciencemag.org/content/348/6238/1004](http://www.sciencemag.org/content/348/6238/1004)</comment>