The World's Last Worm: A Dreaded Disease Nears Eradication - <AUTHOR> http://www.scientificamerican.com/article.cfm?id=last-worm-tropical-disease-near-eradication <comment><USER3> Interesting confluence of circumstances making this possible. For one thing, the worm can't survive in any form outside humans for any significant period of time; there's no dormant form that can lurk in the soil or water, and it apparently can't infect other animals. So if all humans were infection-free for 2-3 weeks (the longest its larvae can live in water supplies), it'd completely die out. And on top of that, it can infect humans through only one route, and that's a route that can be blocked with basic measures not requiring technological sophistication (e.g. filtering water through cloth), because it enters only via ingestion of macroscopic fleas that contain the larvae.

<comment><USER4> In other words, basic sanitation would have wiped this life form out - <USER2> continued existence speaks of tens of thousands of years of unbroken poverty. And it is only being eradicated because of cleverly-invented measures that can be undertaken while still poor.

Humanity, shame on you for leaving these people behind.

<comment><USER5> Or, if you want to try to be a little more positive, let's be happy that we have here another case of science lifting people out of misery.

<comment><USER4> No, it's particularly that kind of rah-rah I'm pointing out the hole in. Our well-resourced science and our well-resourced NGOs have allowed us to construct and communicate a solution to a disease of poverty that works without lifting them out of poverty.

It's certainly a small improvement, but lionizing it uncritically amounts to justifying the status quo.

<comment><USER6> So you're saying that the only acceptable solution is to lift these people out of poverty? What about the people that are affected in the meantime? The end of poverty isn't something that's just waiting for someone to snap their fingers for it to come to a crashing halt.

Also, depending on where you're talking about in the world, poverty is dependent on the local political situation. See North Korea for example. If I sent boatloads of supplies and money to North Korea, what are the chances that they were reach the common man (instead of going towards the military and ruling elite)?

</comment></comment></comment></comment></comment><comment><USER7> Also of note: Save the Guinea Worm Foundation.

<http://www.deadlysins.com/guineaworm/index.htm>

Took some Googling for me to verify that it's indeed a joke.

<comment><USER8> Yeah, the only real hints that it was fake were the bits about people volunteering to be infected with them, and the part where the foundation doesn't take donations so they can remain non-partisan.

But, in all seriousness, I think we should at least sequence this thing's genome before we purposely cause its extinction. Who knows if some enzyme it secretes might be valuable to modern medicine?

</comment></comment><comment><USER9> It's interesting that no one cries out over the extinction of species that are harmful to us. Not that I mind; some extinctions are good. Reminds me of a passage from a science fiction novel I read a while back.

"No ballads were written of this great battle; the official account was curt to the point of insult:

"'Technologically Super-advanced and Aggressive Alien Species VI Engaged and Genocided.'

"Alien Species II, III, IV and V had fought longer, more spectacular campaigns, but they were just as dead. ...

"For humanity remained, as it had always been, a decisive and a ruthless species. The Government of the Solar Neighbourhood preached peace and liberty, and tolerance for all sentient creatures. But any alien that threatened the wellbeing of humanity would be eradicated, without a second thought. That was the way it always had been, and always would be."

Palmer, Philip (2010-10-28). Version 43.

<comment><USER10> Define harmful thought. I do not want poisonous snakes or tigers or great whites exterminated.

I would even think twice about mosquitos.

But this creepy worm thing I have no problem with.

<comment><USER11> While I agree it's creepy, it would be possible in future to engineer these kind of ogranism, to work inside human bodies and cure them.

</comment></comment></comment><comment><USER12> I knew someone who handed these straws out in Africa a few years back: <http://www.gizmag.com/go/4418/> They are simple and inexpensive but they perfectly filer out the larvae from untreated water.

I'm sure he'd be super impressed to see how dramatically the numbers have fallen.

</comment><comment><USER13> Good news! Although am i the only one a little disappointed that this is only the 2nd we've wiped out in our long history?

<comment><USER14> There are plenty of dangerous lifeforms we could realistically stamp out -- grizzly bears, for example. The pertinent question is whether it would be worth the cost. This organism can be defeated forever with handmade water filters, and we'll never miss it. But we could burn all the swamps in the world (along with countless "bystander" species) and still fail to wipe out malaria.

<comment><USER15> > Grizzly bears, for example

And a terrible example!

<comment><USER16> It was a perfect example. His point was that it would be ridiculous to try.</comment></comment></comment></comment>


Marvin Minsky – Artificial Intelligence and the Future of the Human Mind - <AUTHOR> https://www.youtube.com/watch?v=g1DcIJgInF8 <comment><USER2> very sad, he was a great man.</comment>


Why Mars May Not Perpetuate Human Race - <AUTHOR> https://medium.com/@kiransajeev/why-mars-may-not-perpetuate-human-race-a7b404f89036 <comment><USER2> Because of some crackpot moon cycle theory? How about we back up a bit and start with the assumption of the title that Mars will "perpetuate human race" to begin with, what with the long, dangerous travel and an environment less hospitable than any we know here on Earth. Then maybe we can worry about something something menstrual cycles and moons.

 _"Given this small orbit time and the fact that life we know does not exist currently in Mars, this could well indicate the conditions will not be conducive for human life on Mars."_

Okay, that's it, I'm flagging this shit, if only because it's taking up space on the page that could used for a more useful bit of news.</comment>


Monster Russian off-roaders set off on epic 10,000km Arctic expedition - a-smith https://www.rt.com/viral/384832-russian-off-road-arctic-expedition/ <comment><AUTHOR> These machines are phenomenal.</comment>


Google Web Fonts Typographic Project - <AUTHOR> http://femmebot.github.io/google-type/ <comment><USER2> Using web fonts isn't enhancement, it's savig you money down the road from having to hire somebody like me to come and fix your site when it's broken on Windows but not OSX because the system fonts are different.

There is such great typography available in CSS now that there's no longer an excuse for crappy Arial and Times New Roman text.

<comment><USER3> Many web fonts render poorly on some combinations of OS/browser. Old windows + internet explorer and there is a big chance for the cool typekit font you picked to look like crap.

I use and like web fonts, but from a technical point of view I would rather use a generic "font-family: sans-serif" and let the browser do its thing.

<comment><USER4> I don't think the parent deserved to be downvoted. I wouldn't personally go as far as just using a generic font-family for most projects, but it is blatantly true that a lot of web fonts, even some popular ones from supposedly high-end font-as-a-service outfits, have rendering that looks worse under some conditions than tried-and-tested designed-for-screen fonts like Georgia, Verdana, and the more recent Microsoft "C fonts".

The web design industry, fad-driven as it so often is, seems to be in collective denial about this. It's like everyone waited so long to get some variety into their sites that now they'll use _anything_ that isn't one of the handful of long-standing, widely available screen fonts. Unfortunately, being different does not necessarily mean being better.

(Edit: Just to be clear, the above isn't intended as a criticism of _all_ web fonts, nor any reflection of the fonts shown in the linked examples, several of which render very nicely and show the technology of web fonts to much better effect. I just thought ogig's point that many web fonts render poorly on some OS/browser combinations was a fair one.)

<comment><USER5> Sometimes it's not even obscure OS/browser combinations--I've seen sites that were clearly designed on a Mac and never tested on Windows, because the text is completely unreadable on Windows 7 in any browser. I'm all for web fonts, but designers have to test them across at least the major platforms.

<comment><USER4> Sadly, what you describe seems to happen all the time. As an obvious example, it amazes me how many sites continue to use Proxima Nova as a web font. It renders poorly at almost any common size in almost every Windows browser.

One thing that has surprised me with web fonts is that there seem to be plenty of respectable choices available for free from the likes of Google Fonts and Font Squirrel, and relatively few fonts I would even consider for serious work from commercial font-as-a-service shops like Typekit and Cloud.Typography. After years of me telling people that professional quality results need professional quality fonts, the industry seems to be doing its best to prove me wrong.

I suspect the main difference is that the good freebies were designed for on- screen use from the start, while many of the commercial ones are adapted from existing print fonts already available from the likes of Adobe and Hoefler & Co. Unfortunately, many of those designs simply don't adapt well to the lower resolutions and anti-aliasing used for on-screen rendering.

The trouble is, I don't really care _why_ a font on my visitor's screen doesn't look good, and neither do they. The only thing that matters is that it _doesn 't_ look good, and in many cases that seems likely to remain the case until much higher resolutions become the norm for all screen sizes. Until then, as demonstrations like the one we're talking about show very well, there are plenty of decent screen-optimised fonts available from other sources, and they don't come with the financial and legal headaches of the rent-a-font services.

</comment></comment></comment></comment></comment><comment><USER6> Kudos to this project. Fonts and a tasteful use of them are a crucial portion of the visual revolution we've seen in UIs.

</comment><comment><USER7> This reminded me of a similar GitHub project that I had starred in the past: [http://hellohappy.org/beautiful-web-type/](http://hellohappy.org/beautiful- web-type/)

[https://github.com/ubuwaits/beautiful-web- type](https://github.com/ubuwaits/beautiful-web-type)

</comment><comment><USER8> the average internet user could care less about your fancy fonts</comment>


Redis GUI - <AUTHOR> FastoRedis (fork of FastoNoSQL) - is a cross-platform open source Redis management tool (i.e. Admin GUI). It put the same engine that powers Redis's redis-cli shell. Everything you can write in redis-cli shell — you can write in Fastoredis! Our program works on the most amount of Linux systems, also on Windows, Mac OS X, FreeBSD and Android platforms. <comment><USER2> [https://fastoredis.com](https://fastoredis.com)</comment>


Using a Yubikey for GPG and SSH - <AUTHOR> https://0day.work/using-a-yubikey-for-gpg-and-ssh/ <comment><USER2> One of our engineers wrote a series of blogs about how to use a Yubikey for SSH auth, OTP2FA, U2F, and logging into 1Password on shared machines.

[http://www.engineerbetter.com/blog/yubikey-all-the- things/](http://www.engineerbetter.com/blog/yubikey-all-the-things/)

[http://www.engineerbetter.com/blog/yubikey- ssh/](http://www.engineerbetter.com/blog/yubikey-ssh/)

[http://www.engineerbetter.com/blog/yubikey-static- secret/](http://www.engineerbetter.com/blog/yubikey-static-secret/)

[http://www.engineerbetter.com/blog/yubikey-2fa/](http://www.engineerbetter.com/blog/yubikey-2fa/)

I wish AWS supported U2F, it'd make my day a lot less frustrating.

We do a lot of pairing and rotating on shared machines, so it's really danged useful.

<comment><USER3> For AWS you can use your yubikey indirectly for now via "Yubico Desktop" or "Yubico Authenticator" which emulate TOTP mode.

You can then go through the "Virtual MFA" flow in AWS and keep the TOTP secret inside the yubikey with a touch requirement.

This is nowhere near as ideal as U2F but it is a huge step above Google Authenticator which stores all secrets in plaintext in an sqlite database.

Also the 2FA support of 1password is entirely cosmetic if an attacker has malware on your machine. It decrypts your entire database against one secret.

I would encourage consideration of solutions that only decrypt the credential being reqested that don't expose the decryption key to the system: [https://github.com/lrvick/security-token- docs/blob/master/Us...](https://github.com/lrvick/security-token- docs/blob/master/Use_Cases/Password_Mangement.md)

<comment><USER4> _is a huge step above Google Authenticator which stores all secrets in plaintext in an sqlite database._

...I'm beginning to feel angry again! WTF Google? Why isn't Google Authenticator using an encrypted store with the keys stored in the iOS enclave?

<comment><USER5> This makes it sound like the secrets are just printed out and posted on a notice board somewhere, which is pretty much straight fearmongering.

The sandboxing between apps on non-jailbroken iOS (and to a lesser extent un- rooted Android) is such that having the secrets stored in an app's database renders them secure against basically any attack that doesn't involve physical access to the device.

Given that the app needs access to the symmetric TOTP keys for it to work, most of the available other options aren't appreciably changing the security model. Encrypt the DB with a magic secure-enclave-stored key? Now the app is just asking to decrypt the DB every time it's opened. What attack are you worried about where this new setup isn't equally vulnerable?

<comment><USER6> If someone gets a hold of your lost phone, without the secure enclave, rooting it is easy with physical possession. Whereas with a secure enclave, physical access with a locked device doesn't give the secret away.

<comment><USER7> > If someone gets a hold of your lost phone, without the secure enclave, > rooting it is easy with physical possession.

Rooting an arbitrary Android phone is not easy, and rooting an arbitrary Android phone (especially the Nexus/Pixel flagship devices) without wiping the storage is _really_ not easy.

<comment><USER6> After looking around, I agree that standard ways of rooting the phone do involve wiping it.

However, it still remains that the secret is sitting in plain text on a hard drive on the phone. If you unplug/unsolder the hard drive, you could just read it, like a PC.

Another advantage is that if the secure enclave is hardware/firmware linked to authentication (fingerprint / password), then there would need to be a vulnerability in that hardware process for a remote users to get a break.

This is the second factor of a 2FA, so I agree that in most cases, it won't be a large issue. Someone who phishes your password over email would empirically be unlikely to hack your phone.

<comment><USER7> > However, it still remains that the secret is sitting in plain text on a hard > drive on the phone. If you unplug/unsolder the hard drive, you could just > read it, like a PC.

"In plain text"... on a disk that is fully encrypted. Full-disk encryption has been available in Android for several years, and required for almost all of that time.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER8> As a Yubikey fanboi since 2013, who was very excited about the prospect of using it for airgapping GPG and SSH keys circa 2014, 2018 me says: "you almost certainly don't want to do this"

Let's start with SSH. It's just plain unstable. If you try to set this up, you WILL have constant stability problems. I can assure you I have both personally experienced them and asked several other people who have attempted it to confirm that they too have various timeouts or other errors.

One alternative is PIV. PIV is even more of a pain in the ass to get set up, and has similar stability problems.

If I have a prescriptive recommendation for SSH, set up Duo for 2FA and use Yubikey-AES in "long press" mode (putting the key in slot 2). This gives you a strong hardware-backed authentication factor and protection against "Yubispam" (i.e. accidental credential leakage, a problem more severe than most would consider it)

As for GPG, well... GPG is a tire fire. I also went through the Yubikey GPG PIN bypass (not their fault, but since Yubikeys cannot be field patched, this involved physically rotating every key, which Yubico replaced for free, but still). GPG suffers similar random faults, and gpg-agent can die in a fire, but at least unlike SSH you're probably not using it as frequently. Still, getting things set up is ridiculously arcane, thanks to gpg being a byzantine tool and the crazy mutable state nature of ~/.gnupg

If you end up attempting to replicate this sort of setup, I can bet you dollars to donuts you will wind up asking yourself "Why did I think this would be a good idea?" after a few months

<comment><USER9> I've been using this every day for about 2.5 years on each of the three machines that I use daily (each with its own Yubikey).

I sign anywhere from zero to 20 commits a day (providing my -- very long -- PIN each time) and open probably 200+ SSH sessions every day.

Once I've configured it on a new machine (e.g., I recently moved from Arch Linux to Fedora on these three machines), I have zero problems with it. There is no "unstable" issue for me at all.

Judging from my experiences as well as those of my siblings here, I have to wonder if perhaps "you're holding it wrong".

 _ETA:_ You will almost certainly run into trouble if you use Gnome (or, more specifically, gnome-keyring). I use XFCE everywhere, though.

<comment><USER8> I suppose one notable delta between our environments: OS X (me) versus Linux (you, ostensibly)

<comment><USER9> FWIW, I have a MacBook Pro here that I've used it on as well. That was the primary machine I used all day every day until I built this workstation about a year ago. Nowadays I don't use the MBP very often at all, but I did just go check and, yep, it still works on there too.

<comment><USER8> "Works" in a one-off trial or with daily use? What I'm talking about is an unacceptable failure rate in the course of daily usage (by which I mean failures at least once or twice a day, sometimes considerably worse, over the course of establishing several dozen SSH connections daily)

If your OS X daily driver setup is truly stable, can you share all of the details? What OS X version? Yubikey model? GPG version? OpenSSH version?

I know at least a dozen people who have shared my experience so if there is a magic path to stabilizing it, I'm all ears.

<comment><USER9> > _" Works" in a one-off trial or with daily use?_

It worked with daily usage from the time I set it up (shortly after buying that particular MacBook Pro, in October 2016) until the time I quit using that machine all-day every day (c. December 2017). In addition, it worked on the previous MacBook Pro I had as well.

It still worked when I spent five minutes on it earlier today. Obviously, that's not any extensive testing but I have no reason to believe it has somehow broken itself in the time it's been sitting on a shelf, turned off.

I'll grant you that it's certainly not the easiest thing to get up and running... but I also know that it can be done and that it can work quite well. TBQH, if it had been that much of a pain in the ass, I wouldn't have bothered.

FWIW, this is a mid-/late-2016 MacBook Pro, running 10.12.something (never updated it to High Sierra), with a Yubikey Neo. GPG came from homebrew, IIRC, and SSH as shipped with the OS. I'm on mobile at the moment but I'll try to remember to go back and check all the version numbers and such later, if you're truly interested in them.

It sucks that you experienced so many issues with this but I think there's enough anecdotal evidence here to show that this _can_ all be made to work -- and work reliably.

</comment></comment></comment></comment></comment></comment><comment><USER10> An alternative to this is [https://krypt.co/](https://krypt.co/) which generates keys on your phone's secure element/enclave and communicates with your laptop via bluetooth. It has a straightforward script to copy another public key from a backup phone to all your authorized servers, and the UI is excellent for signing git commits and authorizing ssh sessions. Doesn't yet support U2F.

<comment><USER11> From their FAQ:

> Can I backup my private key?

> Backing up your private key reduces its security to the security of the > backup. We do not currently support backing up or extracting your private > key. In the future we may add key splitting among team members or > transferring your private key directly to a new phone.

All my data that the private key would be protecting access to is backed up, so I've ALREADY bought in to the idea that my security is bounded by the security of my backups. It is not clear to me that not letting me back up the private key actually does anything to help my security.

In fact, it may weaken it. Their FAQ says that if I lose my phone what I'm supposed to do is remove my public key from all my accounts, get a new phone, install Kypton on it, generate new keys, and put the new public keys on my accounts.

To do this, I have to have a way to access those accounts without using my private key. That means my security is bounded by the security of my non- Krypton access method.

If my non-Krypton access method is strong, that means I've got to be set up to deal with strong non-Krypton secret management...but if I have to do that anyway what do I need Krypton for? I can just manage my primary access method secrets myself too.

Also, what if the site requires two factor for the alternate access method? I'm probably going to be using my phone for that...but remember we're talking here about the case where I lose my phone, so I lose both my primary access (Krypton) and my secondary.

<comment><USER12> Note that on iOS, Krypt supports key generation using the Secure Enclave on the iPhone 5s (Sept 2013) and newer. In those cases it's impossible to extract the private key without finding a zero-day in the Secure Enclave coprocessor.

From "Other uses for Touch ID and Face ID" in [https://www.apple.com/business/docs/iOS_Security_Guide.pdf](https://www.apple.com/business/docs/iOS_Security_Guide.pdf)

"App developers can do the following: [...] Generate and use ECC keys inside Secure Enclave that can be protected by Touch ID or Face ID. Operations with these keys are always performed inside the Secure Enclave once it authorizes their use."

edit: This page has more details [https://krypt.co/docs/security/privacy- policy.html](https://krypt.co/docs/security/privacy-policy.html)

</comment></comment></comment><comment><USER3> I feel the author missed a critical step.

You want to enable user interaction flags to defend against someone with remote access to your machine.

      $ ykman openpgp touch aut fix
      $ ykman openpgp touch enc fix
      $ ykman openpgp touch sig fix

This will require the yuibikey be physically touched for each sign/decrypt/ssh operation which while simple is something a remote attacker can't perform.

For more detailed notes from me deploying commit signing and ssh via yubikey at three orgs see: [https://github.com/lrvick/security-token- docs](https://github.com/lrvick/security-token-docs)

* Edit: you want to use "fix" instead of "on" to prevent an attacker from just turning it off again.

<comment><USER9> Instead of using those backticks (which don't work here), indent each line by two spaces. It'll render like this:

      $ ykman openpgp touch aut fix
      $ ykman openpgp touch enc fix
      $ ykman openpgp touch sig fix

_Edited after parent 's edit: s/on$/fix/g_

<comment><USER3> Fixed, thanks.

</comment></comment></comment><comment><USER13> On Android, we provide the OpenPGP implementation OpenKeychain that now also supports an impressive list of Security Tokens ([https://github.com/open- keychain/open-keychain/wiki/Security...](https://github.com/open- keychain/open-keychain/wiki/Security-Tokens)). In our newest release, we also support YubiKey 4 over USB-C, which is a great alternative to NFC (which is only support by YubiKey NEO).

Regarding SSH: We submitted a pull request to ConnectBot. You can try it out if you like: [https://github.com/connectbot/connectbot/pull/567](https://github.com/connectbot/connectbot/pull/567)

<comment><USER14> Out of curiosity, can software running in Termux (SSH, gpg, etc) talk to the yubikey?

</comment></comment><comment><USER15> Using a sc like yubikey is great for security, but has performance implications for parallel tasks like salt-ssh across a bunch of hosts. Yubikey can only handle a single thing at a time, and is a touch slow, so if you are using salt-ssh to run a command on multiple servers, and if that salt-ssh happens to use GPG to decrypt pillars, then you're going to be waiting hundreds of times longer than you would using the vanilla, parallelizable ssh agent and scdaemon-free gpg-agent.

<comment><USER16> I use GPG signed tar balls for that, mostly it's just to run scripts on multiple servers, but also useful for file transfers. You still have to fix secure transfers between hosts but you do not authenticate the connecting clients, but your client just need to verify host keys to protect against MITM. Works on pretty large installations.

I started doing it like this when I only had Debian machines, and just used apt and Deb archives, but I never could find the time to hack Apt to be a perfect fit for it and it ended up being hell on other OS.

</comment></comment><comment><USER17> On a tangentially related note - I wonder, are there any OpenPGP Cards with EdDSA support with a "true" tamper-resistant HSM?

Gnuk-based tokens (FST-01, Nitrokey Start) support Ed25519 keys, but while there is no obvious security holes (i.e. debugging is disabled etc), they're most likely not safe if left unattended in hands of an untrusted third party.

<comment><USER18> Pretty sure the Ledger Nano S meets your criteria, but I gave up using it as a PGP card after some seriously questionable issues like the fact that pinentry would always ask for my PIN on the host machine even though I had it set to only ask on the "card". It's just a big mess all around. Same thing with FIDO. It only seems to work in chrome even though Firefox theoretically has support.

<comment><USER19> Firefox supports the FIDO U2F spec to the letter while Chrome requires legacy polyfill script that doesn't use the same exact API. So it's possible to support both but it's not as straightforward as it should be.

</comment></comment></comment><comment><USER20> Btw you can also do SSH, GPG and 2FA also with Trezor, which has the advantage that for all functionallity you can have a one "24 words" seed backup, from which everything is determined. Oh and you can of course use it as bitcoin wallet :)

SSH: [https://doc.satoshilabs.com/trezor- apps/sshagent.html](https://doc.satoshilabs.com/trezor-apps/sshagent.html)

GPG: [https://github.com/romanz/trezor- agent](https://github.com/romanz/trezor-agent)

2FA: [https://doc.satoshilabs.com/trezor- user/u2f.html](https://doc.satoshilabs.com/trezor-user/u2f.html)

</comment><comment><USER21> All of you guys using a Yubikey, seriously, in production - do you have another one prepped, tested and sitting in a safe?

I just feel I have to look at the price, and order two, or it's just a toy.

<comment><USER22> We use Yubikey for our production systems and yes: every operator has two keys that have been configured and registered in our access database.

We decided though not to make our backup keys hot. It's a manual operation to enable it. The risk that everyone could simultaneously lose their key was lower than the risk of a backup key being lost and then used--since a person isn't likely to routinely check on their backup keys the later problem may go undetected for some time, whereas you know the day you lose your primary key and must report that situation anyway.

</comment></comment><comment><USER23> If the author sees it, `enable-ssh-supprt` in the SSH example is typoed.

<comment><AUTHOR> Hi,

thanks, I've updated the post!

</comment></comment><comment><USER24> I prefer a physical presence proof for SSH instead of this proposed solution:

[https://blog.habets.se/2017/10/Yubikey-for-SSH-after-the- inf...](https://blog.habets.se/2017/10/Yubikey-for-SSH-after-the-infineon- disaster.html)

(long version here: [https://blog.habets.se/2016/01/Yubikey-4-for-SSH-with- physic...](https://blog.habets.se/2016/01/Yubikey-4-for-SSH-with-physical- presence-proof.html))

Before that I used the method described in the article, blogged at [https://blog.habets.se/2013/02/GPG-and-SSH-with-Yubikey- NEO....](https://blog.habets.se/2013/02/GPG-and-SSH-with-Yubikey-NEO.html)

<comment><USER19> The blog post you linked to is using the PIV applet on Yubikey. You can do touch based OpenPGP operations on Yubikey too: [https://developers.yubico.com/PGP/Card_edit.html#_yubikey_4_...](https://developers.yubico.com/PGP/Card_edit.html#_yubikey_4_touch)

<comment><USER25> Only for YK4, the old neos and YK3 don't seem to support that. (Makes me consider buying a YK4 right now)

</comment></comment></comment><comment><USER26> I lose things. Frequently. Key fobs have fallen off my key chain. Someone once snail mailed me a flash drive which I'd lost (and which contained a single scanned invoice). I don't like physical access tokens. House keys are kind of a necessary evil (and I'm paranoid of losing them). But that's as far as I'm willing to go. Everything else can just live in my head. Including the strong passphrases to various SSH keys, GPG keys and whatnot.

For anything I don't want to remember, I use pass.

<comment><USER9> I've, fortunately, never lost my keys -- including my Yubikeys -- but I keep spares just in case I ever do.

When Yubico shipped me two new replacement Yubikeys (recent RNG issue), I just tossed them in the safe. I've also got a USB flash drive in there (in a tamper-evident bag) with a LUKS-encrypted filesystem that contains a backup of my GPG keys. I've got another such USB flash drive safely stored at another location too.

</comment></comment><comment><USER27> I use the YubiKey for SSH auth on several servers but didn't go the GPG route. I opted for the challenge SSH mode using PAM.

      Using username "gunni".
      Using keyboard-interactive authentication.
      YubiKey for `gunni':
      Using keyboard-interactive authentication.
      Password:
      Last login: Tue Jan  14 14:07:02 2018 from X
      [gunni@box ~]#

Works like a charm but I might look into the PGP variation if one of you can hard sell it to me.

</comment><comment><USER28> Yubikey is a step in the right direction, but afaik it is still vulnerable at the pin entry level unlike a dedicated smartcard wtih pinpad reader. Likewise, gpg-agent, if I understand/remember it correctly, is also subject to attacks that would not be possible with the dedicated reader+card combo.

</comment><comment><USER29> I think Facebook uses Yubikey together with ssh for their (internal) 2FA [https://www.youtube.com/watch?v=pY4FBGI7bHM](https://www.youtube.com/watch?v=pY4FBGI7bHM)

</comment><comment><USER30> There is a module to make it work with touchbar MBPs fingerprint readers. Not sure if this is custom to our work or something that ubikey provides. It's pretty seamless and much safer than using just a ubikey.

</comment><comment><USER31> Huh, is using SSH on a GPG key safe? Can't the server trick you into signing a "challenge" that is actually a meaningful statement?

<comment><USER32> No,

1) GPG has built-in support for this; presumably they are smart

2) GPG has an authenticate bit, which is required on the key in question.

3) You can (and typically will) create a separate sub-key, with the authentication bit set.

<comment><USER5> The "authenticate" bit isn't really material here. GPG keys are, at their heart, just asymmetric private keys (most typically RSA these days, but there are plenty of other options). The authenticate/sign/certify bits are flags that client tools use to know which key to pick, they aren't enforced anywhere.

The reason your auth key is used for auth and signing key is used for signing is just because most GPG tools are helpful.

It's also worth noting that an ssh agent using agent forwarding exposes use of all the keys it knows about, not just the one used for the initial connection. So if you SSH to 18.104.22.168 with "-A", that host has the ability to poke your agent and ask for any keys it's got loaded up.

The "presumably they are smart" bit is also rather concerning. Being smart is generally not protection against mistakes. This isn't to say that gpg-agent allows malicious action, but we should start from a presumption that bugs exist, rather than just assume they don't.

<comment><USER9> > _So if you SSH to 220.127.116.11 with "-A", that host has the ability to poke your > agent and ask for any keys it's got loaded up._

I'm sure you know this but just to be clear... if you're using "-A", that host has the ability to ask for _operations to be performed_ using any keys it's got loaded up.

It can't just say, "Lemme have all those private keys you got!". That's the primary purpose of storing them in a separate device -- the actual keys themselves become inaccessible and aren't exposed. Again, the device keeps the keys internally and performs operations using them on your behalf.

Besides, in my case, even with an "offline master" key and three subkeys, the agent still only knows about the authentication key. The others don't get loaded into the SSH agent. I don't even use agent forwarding in the first place, but that's beside the point.

</comment></comment></comment></comment><comment><USER33> I believe the following security advisory applies to anyone interested in starting to use GPG + Yubikey:

[https://www.yubico.com/support/security- advisories/ysa-2017-...](https://www.yubico.com/support/security- advisories/ysa-2017-01/)

Seems the recommendation is to ensure you generate GPG private keys off the YubiKey (if you have an affected device).

<comment><USER34> All the keys affected are eligible for free replacement. Get a new one if yours is affected.

<comment><USER33> Yes I should've mentioned this. Thanks! Love my yubikey and would reccomend it to others.

</comment></comment></comment><comment><USER35> Also, check out how U2F works and how to use YubiKey with Teleport/OpenSSH:

[https://gravitational.com/blog/teleport-now- supports-u2f/](https://gravitational.com/blog/teleport-now-supports-u2f/)

</comment><comment><USER36> for this kind of gadgets to truly win the favor of security-minded folk, first it has to be durable, which most of the product (include this one) failed to show.

</comment><comment><USER37> Too bad that USB extension cord is trojaned...

<comment><USER32> you still can't copy the key :)

</comment></comment><comment><USER38> Yubikey is very useful as a 2FA authenticator. I wouldn't use it for SSH and GPG. I wish there were more websites that supported U2F out of the box, or supported using Yubikey as an authenticator without first adding a mobile phone number, which I don't share on a principle.

<comment><USER39> I have a Yubikey on my keychain, and never use it. I'm still looking for that application that will make me want to use it daily. I was thinking about using it to unlock my Mac, hoping this would add to its security after Meltdown and Spectre. Maybe add a second admin account which would require Yubikey. Then if that fails, I have another admin account without Yubikey as fallback login.

My main problem is how to handle the loss of the key. Now I have one, but how do I handle the loss of one or more keys and can I lose access to my encrypted laptop? Same goes for Lastpass or other password managers where 2FA might be used. On the other hand, if I have an accident with head trauma and forget my passwords, what then?

<comment><USER19> > Now I have one, but how do I handle the loss of one or more keys

The same way you handle loss of keys to your home, car, etc. - you buy a second pair. If you're using OpenPGP you can provision them with keys any time so it's not a problem but if you're using U2F then you better add at least two to all your services (Yubico has a cheap U2F only key).

<comment><USER40> Yep. I got multiple U2F keys. One is on my keychain, another is in a drawer in my desk, and a third is in a safety deposit box at the bank with my other important documents.</comment></comment></comment></comment>


Blood and cuts:  Unusually, some Chinese want more censorship - <AUTHOR> http://www.economist.com/news/china/21679842-unusually-some-chinese-want-more-censorship-blood-and-cuts <comment><USER2> Is this fundamentally that much different than the MPAA having all sorts of arbitrary hang-ups for rating movies?</comment>


ClojureCL – Parallel Computations with OpenCL 2.0 in Clojure - <AUTHOR> http://clojurecl.uncomplicate.org/

<comment><USER2> This is a bit of a name clash with Clozure CL, a common lisp implementation. [http://ccl.clozure.com/](http://ccl.clozure.com/)</comment>


Why Conservative Direct Marketers Should Embrace Wildly Creative Ideas - <AUTHOR> http://www.jslogan.com/why-conservative-direct-marketers-should-embrace-wildly-creative-ideas/ <comment><AUTHOR> Here's the point of the post:

"As direct marketers, we are not supposed to rely on speculation, opinions, and biases. In our marketing communications discipline, it is all about actual dollar votes.

And because this is marketing communications, it pays to pay attention to the communications end. In fact, it may be the source of your greatest triumphs."</comment>


Open Text Summarizer - <AUTHOR> http://libots.sourceforge.net/ <comment><USER2> I took a look at this once before, and it took me quite a bit of work to get it actually working. However, it works in a very simplistic manner, which may not be appropriate for you're use. In the basic case it just computes word frequencies and keeps the sentences which have the most frequent words.

The quickest extension to this idea would be to include WordNet to compute frequencies of concepts. Of course in reality you probably would use something better than WordNet...

<comment><USER3> WordNet is actually quite good. If you're looking for some accessible NLP tools, NLTK (<http://www.nltk.org/>) is nice. It's written in Python, and uses WordNet in several ways.

The author of ots isn't really interested in working on it anymore. A couple of the features are deprecated, but this isn't documented.

</comment></comment><comment><USER4> Mac OS X has something almost identical to this built into its Services menu. By the way, the Services menu is tragically underused and needs help.</comment>


Intelligence is Irrelevant: An MIT Alum's Advice to a Struggling Student - <AUTHOR> http://calnewport.com/blog/

<comment><USER2> url for the post itself is [http://calnewport.com/blog/2012/01/09/intelligence-is- irrele...](http://calnewport.com/blog/2012/01/09/intelligence-is-irrelevant- an-mit-alums-advice-to-a-struggling-student/) can someone update it?

</comment><comment><USER3> cal was in my study group for theory of dist systems. he's pretty goddamn smart. funny you see the title from him.</comment>


Ask HN: Who will save us from spam comments? - <AUTHOR>

Was rereading Steve Levy's great piece about YC on Wired.com just now and scrolled down to read the comments:
http://www.wired.com/magazine/2011/05/ff_ycombinator/
There are 17 comments on the article.  11 of them are spam comments.
I see this more and more on content sites.  I assume they all are using various spam filtering systems.  Yet the spammers win, again and again.
Is FB/Disqus the only answer? <comment><USER2> Disqus is not the answer. Those "blog comments [are] powered by Disqus"

</comment><comment><USER3> Phished Facebook accounts can be bought in batches of thousands and are relatively inexpensive. If Facebook's commenting system becomes prevalent, people will just start phishing/selling accounts even more.

As long as there's a profit margin, it will be automated or outsourced.

</comment><comment><USER4> Spammers will always win. If it is made by the hands of a human, it is pretty much common sense that it has aspects that can be exploited.

But, that's not to say the amount of spam can't be minimized. I can't say for sure, but it doesn't look like Wired has /any/ sort of spam prevention technology re: their article comment section. A tool such as Askimet (<http://akismet.com/>) can quell the amount of spam, but it won't eliminate it completely.

<comment><USER5> > Spammers will always win. If it is made by the hands of a human, it is > pretty much common sense that it has aspects that can be exploited.

They seem to be losing on HN. Mostly because we're very low-profile, but for a while there were bunches of spam comments by new users. They all ended up dead really quickly, and it seems to have petered out (nothing in the first two pages of /noobcomments), though there are occasional bursts.

There are also all the spam articles (look at /noobstories), but again, most of those end up dead instantly, and the ones which don't never go anywhere. The fact that every link off-site has rel=nofollow probably helps - no link juice gets given to other sites, so spamming HN doesn't improve search rank. The hellbanning system probably helps too - if a spam account is banned, it doesn't notice anything different, but everything it submits is autokilled.</comment></comment>


GPD Win is a pocket-sized Windows 10 laptop - <AUTHOR> http://www.gpdwin.com/ <comment><USER2> We're back to netbooks now? Resolution has improved since I had a 1024x600 eeepc, although 1280x720 is still not much.

<comment><USER3> It's more of a Windows version of a Pandora than a netbook.</comment></comment>


Ask HN: Which companies doing Clojure dev in Netherlands? - <AUTHOR>

I wonder which companies are pushing Clojure code to production  ? Please also indicate the city. <comment> ilya-pi Screen6, Amsterdam

Adgoji, Amsterdam</comment>


Ask HN: music for hackers? - <AUTHOR>

Hi, I have a simple question: what is your music? What is the music of hackers? <comment><USER2> > _what is your music?_

Mostly heavy-metal / hard-rock, along with some techno/eletronic music, euro- pop, some gangsta rap, and classical music. Mainly I listen to stuff like Anthrax, Alice Cooper, AC/DC, Alestorm, Armored Saint, Agnostic Front, Borknagar, Bonfire, Bon Jovi, Blind Guardian, Children of Bodom, Cinderella, Crashdiet, Cradle of Filth, Dokken, Dimmu Borgir, Danzig, Death Angel, Damageplan, Down, Dio, Europe, Emporer, Exodus, Firehouse, Finntroll, Foreigner, Gamma Ray, Grave Digger, Great White, Guns N' Roses, Hammerfall, Helloween, Iron Maiden, Immolation, Iced Earth, Incantation, Journey, Judas Priest, Jacob's Dream, Krokus, Korpiklaani, King Kobra, Lacuna Coil, Lita Ford, Manowar, Motley Crue, Motorhead, Metallica, Megadeth, Morbid Angel, Mortician, Nuclear Assault, Nevermore, Opeth, Overkill, Ozzy Osbourne, Poison, Pantera, Queensryche, Quiet Riot, Savatage, Slayer, Slaughter, Steel Panther, Testament, Trixter, Tristania, Tygers of Pan Tang, Uriah Heep, Van Halen, Vader, Vains of Jenna, Winger, Warrant, Warlock, Whitesnake, Y&T, Zebra, etc.

> _What is the music of hackers?_

I don't think there is any such thing... hackers have pretty broad tastes in music, in my experience. But there does seem to be a common thread of thought, suggesting that fairly repetitive, lyric-free music (techno of some sort, for example) is good for listening to when actually programming.

</comment><comment><USER3> When I code I prefer music without lyrics:

Math rock, dubstep and other energetic electronic music when I want to pump myself up to get through some boring grunt work. Jazz when I am doing a mix of activity. Ambient and classical when I need to focus on delicate or thorny problems.

If I find myself distracted by even sparse ambient or the world is cutting through I will just listen to noise from simplyNoise to block it out.

</comment><comment><USER4> When I code I usually listen to Ambient music, like Brian Eno. Otherwise I listen to brown noise generated by this site: <http://playnoise.com/>.

</comment><comment><USER5> I prefer music without lyrics because its easier to concentrate. I usually listen to classical music or jazz. I tried listening to noise but it makes me feel very uneasy. However the sound of rain (or other sounds of nature) work really great for me! I downloaded a recording of rain from <http://rainymood.com>

</comment><comment><USER6> I love dub. Also a bit of drum'n'bass, dubstep. Sometimes world music, electronica, UK Garage, hardtek.

But _the_ music of hackers is probably experimental/acousmatic/concrete. Stuff like Ryoji Ikeda, Pierre Henry, Kaffe Matthew, etc. That's really music hacking.

</comment><comment><USER7> I find musicForProgramming(); is good for when ever I'm using a computer or doing tech work. Otherwise I just throw on a radio for background noise.

Link: <http://musicforprogramming.net/>

</comment><comment><USER8> I've been recently listening to and enjoying Digitally Imported's Ambient channel. Not a lot of distracting lyrics in their songs, and usually very calming.

<http://www.di.fm/ambient>

</comment><comment><USER9> I've been digging these mixes that were posted last time the question was asked. Really helps to get in the zone.

<http://soundcloud.com/jaytechmusic/>

</comment><comment><USER10> Huge ska-punk fan, and I love catching the local college radio stations.

<http://somafm.com/> => has some pretty cool mixes when I need to hack.

</comment><comment><USER11> Anything from Duke Ellington to CCR and from U2 to Top 40. When I'm "in the zone" progressive or trance work really well (Armin van Buuren, Deadmau5, or more dance oriented such as Mike Snow).</comment>


Behind the Mic: The Science of Talking with Computers - <AUTHOR> https://www.youtube.com/watch?v=yxxRAHVtafI

<comment><AUTHOR> I found this particularly interesting even though it is quite light on details. The next step they illustrate at the end is really a major turning point in interactivity.</comment>


Russian Reflexive Control Theory and the U.S. Elections - m-watson https://www.rand.org/blog/2020/07/how-you-can-fight-russias-plans-to-troll-americans.html <comment> m-watson Note: The title was changed from "How You Can Fight Russia's Plans to Troll Americans During Campaign 2020" because it was too long for HN.

Also I just find this an interesting short piece on disruptive techniques. Removing nuance and creating an us vs them scenario seems to be both effective and all too easy to do.</comment>


Personal Blog Analytics – Which Numbers Really Matter - <AUTHOR> https://mmaksimovic.dev/personal-blog-analytics-which-numbers-really-matter-and-why-medium-analytics-sucks-cjv5kvndr0067u0s1znaivswz <comment><USER2> I use Fathom[1] for simple, privacy-conscious analytics on my blog. It is interesting to know which pages people are visiting and where they're visiting from. It's rewarding to see month-over-month increases in traffic, too--even if I don't get a lot of traffic. It's motivating to see that people are spending their own time to read what I've written.

Different people will use analytics for different purposes, and different metrics will matter to different people. For me, seeing people read multiple posts (when the number of page views is greater than the number of visitors) is the most rewarding metric. It's one thing to click through from Google. It's another to click through one article and want to read more.

[1] [https://github.com/usefathom/fathom](https://github.com/usefathom/fathom)

<comment><USER3> I saw Fathom a while ago and it looked very useful, but the fact that it only supported a single site per instance was a non-starter for me. Have they changed that?

<comment><USER2> Yep! They changed that in version 1.1.0[1], released back in October.

[1] [https://github.com/usefathom/fathom/releases/tag/1.1.0](https://github.com/usefathom/fathom/releases/tag/1.1.0)

<comment><USER3> Oh that's fantastic, thanks! I just tried the latest Docker image but saw no way to do that, I'll dig in some more.

</comment></comment></comment></comment><comment><USER4> I guess it all depends on your reasons for starting a blog. The author of this piece is a marketer, so is very interested in gathering metrics to see how well they are presenting themselves.

Personally, I think slavishly following metrics leads inevitably towards low- content click-bait articles, something that this article seems to be actually advocating for. The silliest things will get a lot of hits while more considered content will get ignored.

Additionally, although there are worse things than Google Analytics, you are imposing it on your users for your own gratification. Perhaps your users don't want Google to know every page they visit.

Here is my advice for starting a blog: start a blog.

Install GA if you want to look a pretty graphs but don't worry too much about the numbers unless you are selling something. And if you are selling something, worry about sales, not hits.

<comment><USER5> I agree. I think the exercise of writing improves my writing, and that's why I'm proud to use no tracking, cookies, or analytics scripts.

<comment><USER4> > no tracking, cookies, or analytics scripts

I am the same with my site, although I recent implemented a very simple page counter because I was curious.

I like your site, especially the Fun with Favicons article.

<comment><USER5> Thanks for the feedback! It means a lot (especially since no one is counting!)

</comment></comment></comment></comment><comment><USER6> > Which numbers really matter

Make sure you choose a goal before choosing the metrics you care about! The metrics OP lists look like they have a goal of driving traffic and engagement which is good for some blogs. But for most of our (hn-crown) blogs the goals look like "sharing info with others", "solidifying me as an expert in this space", or "storing info so I can get back to it later".

Metrics for those goals look very different!

</comment><comment><USER7> I think that analytics on small websites does not make sense anymore! A lot of people have adblockers these days and those often block Google Analytics for privacy reasons and also just for speed/less work.

Also with bots that execute javascript with Electron, it is nearly impossible to have correct metrics coming from anonymous users.

A better metric would be to measure newsletter signups, third-party client- side analytics is dead.

<comment><USER8> Long live awstats, the perl script that you put in crontab to analyze your apache logs. I have like 15 years of data from this and it's still chugging along. Not overly beautiful but it gives me the first order metrics. Traffic, referrers. No google needed.

Edit: I guess this doesn't help with the anonymous bots issue.

<comment><USER7> I think you can find filter out all the good bots, but there is a large number of crawlers out there these days :)

</comment></comment></comment><comment><USER9> This article was a bit of an advertorial for the blogging platform.

Collecting analytics is the easy bit. Even if you have not done it before you can get the job done with the Google Analytics approach with an hour of fiddling about, with no prior knowledge and from a standing start. If you want to do something server side or implement whatever Piwik is called these days you just have to follow the instructions. It is not a hard problem.

Content is king but I am questioning whether this blogging platform is deserved of fine content, regardless of how the clicks are measured.

The problem I see is that the platform lacks decent HTML vocabulary. It is not difficult to structure an HTML document and a platform should look after that aspect so people don't have to be an expert and can just focus on the content. But here I see the platform is selling people short. The basic HTML is not up to scratch, which is a fair thing to say when accessibility is compromised.

The page does not use a header, a main or nav elements. Yet it has what visually appears to be a header, main content and some navigation 'landmarks'. These should be surfaced with the correct HTML5 for the job rather than obfuscated in div groupings.

The images are not very accessible, they should be figures as that is what they are. The comments should also be 'articles'.

Medium may not be perfect but at least the HTML does get the basics right.

I don't see the point of having these websites that use fancy React thingamies and Bootstrap same-as-every-thing-else buttons but don't get the most elementary HTML right. Why can't people keep things simple?

Having explored the hash-whatever thing more it actually is some of the poorest HTML out there. This doesn't matter to most people but, as mentioned, you trust a platform to get this bit right for you, as is the case with Medium.

</comment><comment><USER10> The article claims that browsers drop referrer (well, "referer" :) header when you open a link in a new tab (look for those direct hits mention).

The last time I checked, that was not the case: can anyone confirm if this is true (I'll check myself later, but curious if someone knows off the top of their head).

If so, it'd be very weird.

<comment><USER11> I think most browsers don't include referrer information when clicking a link on a HTTPS site which leads to a HTTP site, but other than that I believe the information is kept by default.

Site owners can however tell browsers how much information they should include in the "referer" header via the "Referrer-Policy" response header: [https://developer.mozilla.org/en- US/docs/Web/HTTP/Headers/Re...](https://developer.mozilla.org/en- US/docs/Web/HTTP/Headers/Referrer-Policy).

</comment></comment><comment><USER12> If you're on WordPress and value your users privacy, do not use Google Analytics.

Sure, webmasters get to take advantage of big brothers' trove of fingerprinted browsers and fancy metrics, but you're also diming out your users to Google and feeding a beast that's already obese.

Google benefits most when you put Google Analytics on your site. Now they can track your users. Webmasters getting analytics out of the deal is the only way Google can sign you up to spy on your traffic.

That's why I use the 100% self-hosted WPStatistics plugin on my WordPress.org blog. And it's considerably faster than Google analytics too, because you don't have to make your clients do an extra DNS query and download external tracking scripts from 3rd party (Google) servers.

<comment><USER13> Web analyst here, not Google employee although I put bread on the table with GA.

I am reasonably confident that Google does not dip into GA data for its own purposes, unless you go out of your way to enable Advertising Features. Google disclaims ownership and controller-ship of the data collected by GA. This is a contract to its users, as well as the cornerstone of Google's plan to not get fined into the mantle of the earth via GDPR.

There are valid reasons to avoid Google Analytics, including privacy ones. But the idea that Google uses GA data for profiling is overblown (again, aside from Advertising Features, which establishes a connection between GA data and advertising data). It has plenty of other sources for personal browsing data, and those other sources are more reliable.

And since this always comes up: Google gives GA away for free because it's a strategic compliment to online advertising. If people can see how much ROI they get from AdWords, they spend more on AdWords. It's that simple. Google does not need to dip into the GA data in order to see a massive return.

<comment><USER12> I hear you loud and clear. I'm still not willing to risk it though. I had people calling me crazy when I started complaining-out-loud that Facebook was asking for my phone number "for account recovery reasons." Of course the word of Facebook is sacred!

Crazy like a fox [1][2].

1\. [https://www.extremetech.com/internet/286897-facebook- uses-2f...](https://www.extremetech.com/internet/286897-facebook-uses-2fa- phone-numbers-to-help-other-users-find-you)

2\. [https://bgr.com/2019/03/04/facebook-2fa-phone-numbers- securi...](https://bgr.com/2019/03/04/facebook-2fa-phone-numbers-security/)

</comment></comment></comment><comment><USER14> We've been using goaccess [1], we've been very happy with it and most important, we keep things private. Installing Google Analytics is def a NO for us.

[1] [https://goaccess.io](https://goaccess.io)

<comment><USER15> I've been planning to switch to goaccess (from piwik/matomo) for my personal sites. Do you have any tips? Generally I just want to know trends in unique pageviews/visitors; whether any page in particular is seeing a lot of referred traffic and from where, and what paths people are taking through the site once they arrive. I like the purity of going solely with log analysis, but I'm a bit concerned I won't get quite as much visibility.

<comment><USER14> I'd say start with the basic command of goaccess and then you can add extra options to the command line as needed. We have ours on a big display at our office running real time with only the most relevant panels that fit our needs.

Overall the stats are pretty accurate, we did some tedious/manual analysis of our weekly access log and the counts displayed by goaccess are on a par with our data results.

</comment></comment></comment><comment><USER16> "If you're just getting started with blogging, make sure to set up Google Analytics"

No. Please don't add Google spy code to your site.

If these sorts of analytics are actually important to you, consider using an analytic package (or, better, write your own or parse the information out of your server logs) that is entirely hosted on your site and doesn't report to a third party.

</comment><comment><USER17> Recommeding Google Analytics isn't really great. Google already has enough data and you shouldn't sell your visitors data to Google just because they offer "ananlytics for free". Thanks to UBlock Origin Google Analytics get's blocked by my Firefox.

Because I wasn't happy with any already existing analytics, also Fathom because they use cookies and I wanted to avoid this, I build my own KISS statistics tool called KISSS or kis3 using Go. It has minimal functionality, is easy to run everywhere and requires minimal resources. See [https://kis3.dev](https://kis3.dev)

</comment><comment><USER18> I block "Google Analytics" trackers. It makes me wonder how useful they really are.

</comment><comment><USER19> analytics were valuable / helpful when they included keywords and search phrases used with google - ever since google starting stripping those away, I've spent little time looking at analytics unless some kind of attack issue or something.

I wish google had a privacy option to let users decide if their search phrases should be sent / captured by the web sites people visit. One could dream that they are auto stripped if opening in incognito mode and sent in regular mode unless another setting was changed by the user in chrome or via google account or such.

</comment><comment><USER20> As usual, my mind frames such things differently.

There are a lot of assumptions baked into this post that will not universally apply. I look a bit at things like page views, but I'm much more interested in other things. Looking at the numbers can help me tease out a few things, but those numbers are generally secondary to how I parse things.</comment>


Ask HN: As a freelancer, how do you ensure clients pay? - <AUTHOR> What steps do you take to ensure clients pay you on time and what actions do you take when they don't? <comment><USER2> First thing is the payment schedule. I usually do 45% deposit, 45% at the end of the work, 10% when the site goes live. This ensure that I get at least 90% of the contract.

Also, have complete Terms and conditions. One important point is all the intellectual property that goes with your work => until complete payment, the work is yours, and usage of it is illegal. With final payment, I usually issue a letter transferring the intellectual property to the client.

An other important point is all the payment and refund policy. My policy is simple : no refund, projects started are to be paid in full. If the clients needs an explanation for that, explain that while you dedicate yourself to his project, you have to say no to other projects.

Make it easy to get paid. Set up an online payment system or anything that makes the relation frictionless. Even if it cost you a bit, it makes payment way faster to arrive (no need to go to the bank or post office, find the checkbook...).

One saying I like : Until you sign the contract, you have to be the mum of your clients, reassuring him, explaining things, understanding him. Once signed, you are his father : you are here to reminds him the terms of the contract. It means that you have to be thorough on revisions, delivery dates for contents, and of course, payments.

Trust your guts with clients. Usually, in my experience, clients who are hard to get payments from are the one hard to handle from the start. Usually individuals pr small companies, who try to get more for less. And know also that you have the right to fire a client if you feel that things go bad.

But the best way to get paid : make outstanding work, be nice and understanding. Know when you have to charge for a request and when it can be free. Little treats are always nice if it cost you close to nothing and it has value for the client.

I love this one : <http://vimeo.com/22053820>

<comment><USER3> What he said... That's what I've been doing since the 90s. It works well.

And, to answer the question what steps to do when they don't pay: not much you can do other than asking. There aren't any worthwhile legal resources for businesses or freelancers to be paid.

However, to not get there, make sure the payment schedule covers your work hours including profit and if they don't respect the schedule, stop working and mention there will be a delay in delivery. As he said, choosing well your client by avoiding people who are too difficult from the start usually avoids the worst kind of clients. As soon as your guts sees a red flag, don't ignore it and walk away. Your instinct is rarely wrong when sizing trustworthiness.

<comment><USER4> One problem is preventing the client from making use of the software when there is a dispute about payment.

Due to the laws regarding unauthorized access to computer systems, it may not be legal for you to remove or even communicate with your software once it has been deployed to the client. For internal systems it might not even be physically possible.

To combat this, I like to incorporate a "dead man's switch". This means that the software will stop working within a certain amount of time (say 30 days), unless I actively intervene. The switch is only disabled once final payment has been received.

A notice somewhere on the site or in the app will say "Evaluation software - nn days remaining", so the client is aware and gets a countdown.

The switch doesn't have to be super sophisticated but it should incorporate some element of encryption - that way if the client attempts to circumvent it you can threaten them with a DMCA claim.

</comment></comment></comment><comment><USER5> Be picky about clients. Payment risk is not equally distributed across all clients, all work, or all contracts. Exercising a bit of professional discretion upfront will save you grief later.

<comment><USER6> This.

The ebook career.fork() that came out recently had more on this. Basically, you can learn to spot "clients from hell". There are certain traits that are the equivalent of pointy horns and a whiff of brimstone:

\- excessive cheapness in initial negotiations

\- "but we can just find a guy on odesk for $5/hour" (reply: OK, you do that, and come find me when it falls apart).

\- no effort to understand technical issues. Of course, lots of good clients don't understand technical issues (that's why they hired you), but at least show some interest in what you're doing.

\- unrealistic expectations (I want the next Facebook!)

\- very vague ideas about what they want. "I need a website made!" Lots of good clients also have vague ideas, but its your job to help them figure out exactly what they need. Try sitting down with them with a pen and paper and listing what pages they need and an outline of the content for each one.

Now, some clients will happily sketch out Balsamiq type mockups, wheras others will just give you a brief list of the pages they need and let you work out the details. Both are fine. But if the client refuses this exercise, stay away.

My big surprise when freelancing was that most clients are not from hell. If you just avoid the jokers, there are plenty of good clients that value your work and pay on time.

Other tips:

\- taking a deposit at the start is always good. It's like the client has "broken the seal" and will be more willing to pay in future.

\- it's hard asking for payment. It's the social norm against asking for strangers for money. One advantage of paycheck employment is the only time you need to discuss money is in the interview. After the first few invoices, it gets easier.

\- avoid getting desperate. When you only have one week's rent in your account, you might be tempted to take on a bad client. Easier said than done, but maintain a buffer of savings and start looking for gigs before your current one finishes.

\- be a bit cynical. Even if the clients are the nicest, coolest people in the world, if your code is on their server and your money is in their account, it's quite easy for them not to pay you. If you control the code, and some of the money (ie, a deposit), you're in a much stronger position.

<comment><USER7> "- "but we can just find a guy on odesk for $5/hour" (reply: OK, you do that, and come find me when it falls apart)."

Yes, except skip the 'find me when ...' part.

<comment><USER8> My response to that kind of comment is "You can pay me now, or pay me later to fix it. Its cheaper now, but you decide."

</comment></comment></comment></comment><comment><USER9> In the famous words of Ben Affleck's character in Good Will Hunting, "RETAIIIINER!"

(for levity) - <http://www.youtube.com/watch?v=5hWIr9_noRo>

Just as with other professional services (Law, Advertising, Accounting), I use a retainer model.

This works for me and filters out the clients who I feel value my work.

For example:

      * $10000 put into an account that draws down against hours worked / daily / weekly output.
      * Invoiced weekly through freshbooks
      * As retainer moves below threshold in retainer it gets replenished.

This keeps all of us honest, and it keeps me in a cashflow positive situation (usually).

Also, read up on patio11's posts here on HN. He's a smart guy and offers a lot of insights into what it is like to consult for a living.

</comment><comment><USER10> Amazingly most people do pay (eventually) and the worst thing you can do is obsess about the ones that didn't pay.

When people owe you money it makes strange things to your brain. People may keep you hostage by withholding your money from you. You'll feel terrible. Best thing you can do is chalk up the ones that didn't pay as a cost of doing business and paid learning experience that tunes up your anti-asshole filter. My sanity immensely once I understood that sometimes you get screwed on your investments, it's impossible to avoid that in all cases and it's ok.

</comment><comment><USER11> This kinda goes against the trend of selling yourself as providing value and not merely your time, but you can also ask to be pre-paid for a certain amount of time.

Similar to a pre-paid cell phone plans, ask your client to buy 10 hours (or 5, or 20) of your time, work those X hours, repeat.

This is the system I've been using myself for the last couple years, and I've never had to worry about getting paid. And I know I'm going to raise some eyebrows with this, but I've never had clients sign contracts either.

</comment><comment><USER12> We use deliverables, milestones, a work breakdown structure (WBS), and statement of work (SOW) contract.

These describe the scope, schedule, cost, payment agreement, refund policy, etc.

<http://en.wikipedia.org/wiki/Work_breakdown_structure>

<http://en.wikipedia.org/wiki/Statement_of_work>

When we reach a milestone, we invoice the client for the amount we agreed to in the statement of work.

</comment><comment><USER13> It generally starts with the type of client you're dealing with. There's a type of client that will pay all the time and there's a type of client that will haggle with you every time. The better you get at learning how to spot them, the less trouble you'll have getting paid.

With my new startup matchist (<http://matchist.com>), we're actually tackling both these problems (finding the clients that will actually pay on time, every time, and guaranteeing that they will). We vet all clients and escrow payment so that you know you will actually get paid when work is complete.

</comment><comment><USER14> > What steps do you take to ensure clients pay you on time and what actions do > you take when they don't?

1\. I only work with clients that I trust. How do I find out if I can trust them? Extensive interview process. Is their business sustainable? Have they worked with freelancers before? Do they have references for me?

2\. I have clients pay me up front. No, seriously. I have a contract that lists my rate and asks for the money up front. If they want different payment terms, we can negotiate from there (and usually to a point that we're both happy with).

3\. I don't let myself get 'underwater' with a client. I use Harvest to monitor the time I spend working on client projects. It sends me a notification when I get within (80%) of the time allotted on the contract. I have a text expander snippet that I fire off to the client with something like 'Hey, we're at 80% of the time you've paid for on the project' and let them know if I think we'll need more time or need to reduce the scope.

4\. I attempt to collect in this order:

(a) Phone call to the company [the person I'm working with on their side] confirming they received my invoice (10 days after due) (b) Phone call to the person who signed my contract confirming they received my invoice (15-20 days) (c) Repeat phone call to the person who signed my contract (30-40 days) (d) Letter from my attorney

How often have I had to use these? Once. Why so infrequently? Because I follow points 1, 2, and 3 with new clients.

</comment><comment><USER15> Use a contract and set your payment terms clearly; bill at defined regular intervals (with a partial up-front payment).

Make sure there's a late fee, and enforce it! You will almost certainly find clients that don't pay on time, and letting them essentially get away with it will only make it worse.

The one measure I've found that puts honest but lazy clients on the ball, though, is stopping work as soon as payment is overdue and not continuing until they're current (including the late fee).

</comment><comment><USER16> Sorry, Major edit. I did not answer the question as posed first.

We are primarily a service business that also sells hardware and software, and we design custom databases. The software almost always has "pay as we go" milestones in the contract. This keeps us funded and forces checking in with the client at logical points to make sure the design is going the right direction.

All of our invoices show Due on Receipt, we grant 30 days, then either a cheerful reminder, or a late fee and reminder.

Too many late invoices (three - we are rather forgiving) with no communication ahead of time gets the client dropped.

On the service/sales side:

With new clients or large orders, we ask for deposits or retainers.

We also offer reduced rates of blocks of hours if paid in advance (can help with starting cash flow).

As an aside, we use referral fees paid to people who refer clients to us. Arbitrarily I arrived at 30% of first hour and %50 of second hour (None beyond that) charged to the new client is paid to the referrer (Service work only).

First, it gets us more referrals for work, and second we get to take advantage of the reputational value of the reference - Few people want to flake on their invoices if it is going to make it back to the referrer.

YMMV.

</comment><comment><USER10> Don't do anything beyond talking before money is on your account.

If you suspect that client might be opposed to paying all of the money up front double the price and take 50% up front. You can give discount afterwards if everything goes well. I noticed it improves relations with the client.

If your project is large and can be split into stages then do that and take all the money for each stage before starting it.

</comment><comment><USER17> 2011/03 Mike Monteiro | F*ck You. Pay Me. <http://vimeo.com/22053820> <\-- Watch it!

</comment><comment><USER18> I invoice weekly. I include a detailed list of tasks completed in each invoice and the time taken per task. I use toggl.com and bill in tenths of an hour. When working with clients with multiple employees/project-managers, I include who commissioned the work and for which project.

Since I check in my code, static files, documentation, and all resources along with the weekly invoice, the payment is due immediately. The client is aware of my progress on a weekly basis and knows exactly how many hours I have spent on which feature. I've worked like this for over a dozen clients and not one of them has ever had a problem with it.

I do not work on fixed-cost contracts but rather fixed hourly rate contracts. I give detailed estimate (Statement of Work) before the contract is signed and if I go over the estimated hours for any task through no fault of the client, I eat the overage costs (teaches me to quote better). If I am under the estimate, I bill exactly for what I worked on.

</comment><comment><USER19> I think Freshbooks makes it easier to bill (it sends the invoice in an email), easier to pay (they can click on a link and use their credit card) and provides a 3rd party record. Also since its completely online, there is no excuse related to waiting for things to go back and forth in the mail.

Usually if they don't pay right away I explain to them that I need them to always pay within a day or two. If they forget to pay after that, one extra email or IM is usually enough.

You might have to actually call them.

I also tend to not work on a project between the time that an invoice goes out and when it is paid.

From my experience once they are actually aware of the bill they usually pay within 0-3 days. If it takes longer than that, maybe you can get better clients.

</comment><comment><USER20> Our policy is 50% upfront before any concept meetings even begin and 50% upon completion before we deliver and launch their site. We never do Net terms anymore in the 15 years building web and mobile apps. We sometimes get the "accounting only pays net 15 or 30". Our answer to that is to invoice the balance and schedule delivery when the check arrives. If you are upfront with your terms, they will typically follow your standard. In our experience we had 1-2 clients in the beginning that did net 30 which turned into 60. We were small and cash flow was tight so it meant we needed to float expenses. No more.

</comment><comment><USER21> 1\. Get good clients.

2\. Get a deposit (ideally one month's pay) up front. If your client doesn't want to put down a deposit, find another client

3\. If client doesn't pay you for more than a month, _ALL WORK STOPS_ until you have their money _in your bank account_.

Problem solved. If your clients are in town and aren't paying, feel free to drop by their office and remind them that you aren't working until you get paid. An in-person reminder is a lot more influential than a piece of paper with a number on it.

<comment><USER22> "2. Get a deposit (ideally one month's pay) up front. If your client doesn't want to put down a deposit, find another client"

Same here , if they aren't willing to pay a % up front , the discussion ends there. Move on to the next client.

</comment></comment><comment><USER23> Unfortunately, the longer you freelance the greater the odds that you'll find one who doesn't pay you.

In general, I think that being nice to people, having fair billing practices, and doing good work are the best ways to make sure your clients pay on time. As well, when I'm preparing an invoice, I like to email a client and say that I'm preparing an invoice...I usually do net 30 but I wanted to know if there was anything I could do to make things more convenient.

</comment><comment><USER24> Spending time up front to understand payment terms, calmly, carefully, contractually, means that both sides understand what they are getting into. Nobody would have dared break that word, on both sides. Nobody broke that word. So it sounds like the upfront handshake was either rushed or nonexistent.

</comment><comment><USER25> Does anyone use a payment escrow? Like what some market places like Elance provide?

<comment><USER12> We used a payment escrow for a project and it went perfectly. The project had a clear deliverable and a clear way to verify success, which made it especially easy.

</comment></comment><comment><USER26> I am owed over $1000 by some companies in US and UK for freelance work. Over 6 months ago now. What do you suggest? Forget about it? Debt collection? Contact spouse via Facebook?!

</comment><comment><USER27> Milestones. For example, half up front and half at delivery. 25% up front, 25% at a reasonable halfway point, 50% at the end. That kind of thing.

</comment><comment><USER28> Warranty is valid only if invoice paid on time.

<comment><USER29> This is a great idea.

<comment><USER28> We NEVER get paid late using this approach, in 8 years of doing business. Admittedly we are not doing software development but the principle works as long as you can get a warranty defined in your terms that does not commit you to doing free feature work rather than bug fixes. Shoud be do-able.

<comment><USER29> I typically say when a feature is released to testing/customer acceptance, I'm done the spirit of what I was approved to work on, and the work is both billable in full at that point, and the warranty clock of 30 days starts.

</comment></comment></comment></comment><comment><USER30> payment up front, like a deposit. No money, no work. That simple. No promises either. Listen to Randall for a bit, [http://robots.thoughtbot.com/post/36071144342/episode-23-as-...](http://robots.thoughtbot.com/post/36071144342/episode-23-as- a-consultant-its-always-your-fault)

</comment><comment><USER31> Reward early payments.

<comment><USER32> This is what I do. I only have one main client, and it's a more-or-less ongoing arrangement, but I invoice on the 1st & 16th and give a percentage discount if they pay within 10 days.

<comment><USER4> This is a much better idea than trying to impose a late payment fee - set your rates 10% higher, offer a 10% discount on early payment.

</comment></comment></comment><comment><USER33> The squeaky wheel gets the grease.

</comment><comment><USER34> Fifty percent upfront. Unless it's a smaller project. Then, it's 100% payment upfront. No exceptions.

<comment><USER35> What price range are the projects? If you don't mind me asking.

<comment><USER34> I take into consideration the finances of the person or company, but usually it's $300. That or less gets paid in full before I begin.</comment></comment></comment>


Distributed Management Task Force - <AUTHOR> https://en.wikipedia.org/wiki/Distributed_Management_Task_Force <comment><AUTHOR> Excerpt:

"System Management BIOS (SMBIOS) – defines how the BIOS interface of x86 architecture systems is represented in CIM (and DMI)."

Also:

[https://en.wikipedia.org/wiki/NC-SI](https://en.wikipedia.org/wiki/NC-SI)

"NC-SI ("Network Controller Sideband Interface") is an electrical interface and protocol defined by the Distributed Management Task Force (DMTF), which enables the connection of a Baseboard Management Controller (BMC) to a set of Network Interface Controller (NICs) in server computer systems for the purpose of enabling out-of-band remote manageability."</comment>


Sony launches 20 inch tablet running Windows 8 - <AUTHOR> http://presscentre.sony.eu/content/detail.aspx?ReleaseID=7959&NewsAreaId=2

<comment><USER2> I've already got the tethered touchscreen predecessor of this (Vaio VPCJ1) and it's a piece of shit, even with Windows 8 on it. I'd have been seriously angry if I'd bought it but I was given it from someone else who was angry that they'd bought it.

It's heavy, slow, noisy, unreliable, hot and poorly engineered (the stand broke after about a week - 2x cheap self-tapping screws into plastic bearing the ENTIRE weight), the PSU started whistling after a couple of months resulting in a warranty job.

The kids use it as their "I don't care if they break it" computer.

Excuse the cynicism, but I doubt this will be any better.

<comment><USER3> As someone who's close to Japanese culture ('married into it') and has loved Sony products in the 90ies this stuff just makes me angry. At this pace Sony will soon need some berserk of Jobs' calibre to turn it around (they still aren't at the point Apple was in '97 but it's getting closer rapidly).

<comment><USER4> Sony is firmly in the 1993-1995 era Apple where they keep turning out decent products but never hit the high notes they used to.

They're effectively rudderless, with the television, game, movie, electronics and various other key enterprises not firing on all cylinders and often moving in opposing directions.

This is akin to Apple that, for a period that went on far too long, they were making dozens of different models that often differed in little more than price and badging on the front, with models specific to certain channels and retailers.

The problem is they don't have a visionary they can re-adopt. Changing a company as diverse as Sony, with so many competing interests and a typically Japanese corporate culture that's as flexible as someone suffering from rigor mortis... Prognosis isn't good.

<comment><USER3> I have the same concerns about Sony not having visionaries. The situation with Apple + Jobs was unique. Still, Apple's turnaround shows that stuff like that is possible. Sony has still enough assets they could sell in order to fire up R&D for one last hurrah, win or loose. But as you say, they need a visionary. I'd say it must be an outsider, so no Japanese. Renault-Nissan has done quite well with Carlos Ghosn I'd say, at least to me they look more innovative than most other Japanese brands.

What's so maddening about Sony is that they still hold so many good cards in their hands, they just don't have a game strategy.

<comment><USER4> It was in the 1990s that Sony was completely dominant in a few markets. Their PlayStation crushed a few upstarts, was probably the reason the then ruling console maker Sega rushed and later abandoned their Dreamcast system, and the PS2 was as much the de-facto console for a whole generation, an unprecedented position.

Their Trinitron TV technology was the envy of pretty much everyone, consumer or competitor, and was an essential component in any tech-savvy household. Well, at least until LCDs took over, and Sony seems to be a second rate player since they don't make their own panels.

Their cameras and video recording equipment were still superior to anything on the market, with Betacam being the unquestioned standard for broadcast video. Then digital pretty much squashed that.

Sony's always been a fighter even when it didn't work out. The MiniDisc was a bust. Their MP3 players never amounted to anything because of their stubborn insistence on some awkward, native encoding format until it was too late to matter. Their MemoryStick was too big, too expensive, just plain too _Sony_ to ever catch on.

Now they're desperate for a hit that isn't coming. The PS4 has zero hope of being the dominant platform, not with Microsoft still committed, with Nintendo nipping at their heels, and Apple positioned to throw their hat in the ring as well.

To fix Sony you'd have to tap into what little cachet they still have left. People like their stuff, their style, their charm. If only you could curtail their obnoxious arrogance and inability to focus on making a few amazing things instead of a whole plethora of junk...

<comment><USER3> See, I'd like to think of it a bit differently. If you look at the consumer market Sony does separately, none of it really has much growth potential, even worse, most of it is in a dwindling position.

The thing is, Sony is in a bit of a unique position because of their combination of home electronics, game electronics and media. The question they should ask themselves is: What advantage do we have over our contenders when we _combine_ those assets.

</comment></comment></comment></comment></comment></comment><comment><USER5> It's a shame they built a massive, 11-pound x86 desktop PC in a bloated tablet format rather than taking the opportunity to build an ARM-based tablet for WinRT with an unusually large screen. There are probably still quite few issues that need to be solved to make LCDs light enough for a truly mobile tablet at that scale, but Sony is in a good position to at least experiment in that space.

<comment><USER6> I guessing they would like to run some apps that aren't arm compatible, most desktop apps aren't yet. With the usual price tag sony puts on their computers, I'm guessing that they will market it as a touch screen desktop. Like the HP media center pcs.

</comment></comment><comment><USER7> Shameless Plug: I built a similar 23" Android "tablet" last year. [http://martin.drashkov.com/2011/09/android- megapad-23-androi...](http://martin.drashkov.com/2011/09/android- megapad-23-android-tablet-for.html)

I thought Android is a much better choice of an OS, seeing as how many apps would already scale up nicely. I still think this is a valid product category - various specialized kiosks and smartboards will soon be replaced. I guess we'll see whether it'll be Android or Win8 (or some Apple thing).

<comment><USER8> Wow that looks pretty awesome. I'll bet it would be _really_ nice with Jellybean on it. What are you using to make the touch screen work?

</comment></comment><comment><USER9> 1600x900 is too low for a 20" tablet. The 7" Nexus 7 is 1280×800

<comment><USER10> You can't compare resolutions between screens that differ in sizes...especially when the viewing distance is different. I can't imagine that you would hold a 20" tablet up to your face as you would a 7" one.

<comment><USER11> At 5+kg there isn't going to be much holding going on. It's designed for using on a table (or maybe your lap) which as you say means significantly greater viewing distances then an iPad/Nexus 7.

</comment></comment></comment><comment><USER12> No SSD? That's strange at this point.

</comment><comment><USER13> I've been thinking this extra-large format would be huge in some niches like design shops: a big slab of touchscreen you could pass around and run full on Pixelmator-type software on.

And then you find out it's a PC with a mechanical HDD and I get sad. Ship this in five lbs and an obscene battery life for $1000 and you're cooking with gas.

</comment><comment><USER14> Rectangular with rounded corners. Black bezel that is the same size on all four sides. Metal border. Is this another design patent suit about to happen?

</comment><comment><USER15> This more like a touch PC than a tablet at about 5.2 kg ...

<comment><USER16> Didn't initially see the weight. That's huge. Ten pounds! I don't even think my laptop weighs that much.

<comment><USER17> If it wasn't for having a battery, I'd presume it's intended to stay fixed to one place. It's still technically portable, but I don't imagine it going far given the size, nor any practical applications that wouldn't be better served by something smaller.

</comment></comment></comment><comment><USER18> If I had the money, I would put one of these on my coffee table.

<comment><USER19> At 20 inches, this thing could BE your coffee table!

<comment><USER20> Just hope your coffee mug doesn't start moving the mouse

</comment></comment></comment><comment><USER21> Title is rather misleading, this is not being marketed as a tablet but rather a full on touch PC.

<comment><USER4> Sony is a lot like Apple in that they have these designers cooking up crazy designs and inventing new things, and they have people who know how to make something very cheap and inexpensive to manufacture.

The difference is Sony doesn't put these two kinds of people in the same room.

</comment></comment><comment><USER22> Could anyone see any estimates for battery life? I seem to be blind.

<comment><USER23> About as long as it takes you to find the next one from your bag.

</comment></comment><comment><USER24> It's not a tablet, it's a .. table.

</comment><comment><USER25> Want this NOW! ...please</comment>


My quick setup for a more human Ubuntu 13.04 desktop - <AUTHOR> http://trumbitta.github.io/posts/unity-and-raring-tamed

<comment><AUTHOR> I'm quite happy with this setup.

It blows away almost all the things I hate about Unity (the launcher and dash) and keeps the good parts (screen real estate)</comment>


Negative SEO Reality Check - Spammer Outed - True Story & Case Study - <AUTHOR> http://kercommunications.com/seo/negative-seo-reality-check/ In the comments of this article, a negative SEO perpetrator is outed. While Google's stance on whether or not negative SEO works seems pretty clear: possible but not likely, people like this continue to try, while perpetuating the FUD (fear uncertainty and doubt). <comment><AUTHOR> In the comments of this article, a negative SEO perpetrator is outed. While Google's stance on whether or not negative SEO works seems pretty clear: possible but not likely, people like this continue to try, while perpetuating the FUD (fear uncertainty and doubt).

Is there something Google can do to deter this type of thing? While the outed spammer's petition to Google regarding spam is kind of ridiculous, his point that the belief in negative SEO is leading to more link spam being created is somewhat valid. But how could Google deter people from believing such things and acting based on those beliefs?

</comment><comment><USER2> Can you tell me a tool from which i can get all my backlinks stats with URL? Because recently, i get hit by Google Penguin, I think.

<comment><AUTHOR> Google Webmaster Tools will show you most of the links they have found. If you are going to try to figure out which links caused a problem, you'll want to use ahrefs and majesticseo to compile a list of your backlinks, then either start sorting through them manually or use something like LinkResearchTools as a starting point.

Keep in mind that removing links will probably not return your previous rankings, since the links that once caused you to rank well may now be the ones causing the problem. Removing them may restore your ability to rank well again.

Also, not every ranking drop means that you were penalized. If you know you had built lots of spammy links, and your traffic dropped off at the same time Penguin was updated, then it is more likely a Penguin problem. Otherwise, there are hundreds of reasons that would need to be examined. If you are not sure, consider hiring a reputable SEO consultant to help. It won't be cheap. Cheap is probably what got you in trouble in the first place.</comment></comment>