SSH hacks – a little sanity for remote workers - <AUTHOR> https://smallstep.com/blog/ssh-tricks-and-tips/ <comment><USER3> I always create and heavily use ~/.ssh/config

       Host x
           Hostname full.host.name.com  (or 220.127.116.11)
           User <myuser>
           IdentitiesOnly yes
           IdentityFile ~/.ssh/id_x_ed25519

I give hosts short names so you can `ssh x`

to do automatic login, I generate identities for some machines

      ssh-keygen -t ed25519 -f ~/.ssh/id_x_ed25519

use ssh-copy-id to copy the identity to the target machine so it lets you in:

      ssh-copy-id -i ~/.ssh/id_x_ed25519.pub x

or if your machine doesn't have ssh-copy-id (older macs);

      cat ~/.ssh/id_x_ed25519.pub | ssh x "cat >> .ssh/authorized_keys"

IdentitiesOnly means it will only send that one identity for that one machine (otherwise it will try all of them, like a janitor trying to open a locker with a big keychain of identical keys)

If you always want to use a password to log into a machine, but want to be able to log in in other windows to the same machine without a password:

      Host x
          ...
          ControlMaster auto
          ControlPath ~/.ssh/master-%r@%h:%p

this will multiplex all activity to that host through one tcp connection

you can also use Host * at the beginning of your config to do this for all hosts

to tunnel vnc over ssh to a remote mac(I do this with mac)

      Host foo
            ...
            LocalFoward 5900 localhost:5900

      ssh foo

then locally vnc to localhost:127.0.0.1

<comment><USER4> I love the multiplexing feature. We have a client who require password, ssh key and MFA. All services are behind a bastion host, which only accepts trafic from select IPs. SSH multiplexing and proxy configuration allows me to enter the password and TOTP just once instead of every time I need to access a service behind the bastion host.

<comment><USER5> Of course if the multiplex stalls or goes down so do all of the connections you have running through it. It's like screwing up Gnome Terminal or similar that uses a main server and multiple clients. Screw one pooch and you're whole session of things is similarly screwed.

<comment><USER4> True, but I never see SSH go down, unless there's a network issue, in which case I lose all my connections anyway.

<comment><USER6> Indeed; however, if you have a lingering control file (because an old ssh process was killed, or there was a power failure and it was somehow not removed), it will either refuse to use it, or (occasionally, and I haven't been able to pinpoint when), would just wait there forever.

edit: a typo

<comment><USER7> Sounds more like a bug than a disadvantage

</comment></comment></comment></comment></comment></comment><comment><USER8> > _What are your favorite SSH tips & tricks?_

        $ ssh -J user1@host1 user_final@host_final

or

        $ ssh -J user1@host1,user2@host2 user_final@host_final

Not many people know it, you don't need to launch a SSH within a SSH session - SSH has built-in support of using one SSH server as a proxy to another SSH server. Useful for <del>hacking servers</del> accessing servers behind a firewall, or using your own server as a proxy to bypass a bottleneck in the network.

<comment><USER9> Another lesser known tunneling trick is that SSH will happily act as a SOCKS5 Proxy. I've been using this trick for going on 20 years now.

Just do: ssh -D9090 user@remote

Then, in Firefox, set it to use a SOCK5 proxy of localhost:9090 and "Proxy DNS when using SOCKS v5".

Now, when you use Firefox it is as if you are using Firefox on the machine you are SSH'd into(including DNS resolution!). This is really handy for things like accessing otherwise unreachable resources or other internal resources externally. I use it for accessing iDRAC/IPMI/ESXi (you can also tell Java to use the proxy so VMRC works as well). It is also handy to be able to put all your web traffic as originating from a remote VPS with no advanced setup required.

<comment><USER10> I used to do this all the time over port 53.

My closest coffee shop would allow people to access Wi-Fi only if you gave them full access to your Facebook account. DNS was the only port open to the outside world.

<comment><USER11> Interesting that they permit TCP port 53, rather than just UDP port 53.

<comment><USER12> My guess is that it stems from lax firewall defaults. "Allow port 53 - [tcp/udp/BOTH]?" (Yeah, I know that DNS can also work over 53/tcp, but it's rare compared to the 53/udp volume)

<comment><USER13> It's not as rare as it used to be a couple decades ago. If you block tcp/53 you will find a surprising number of things breaking as record sizes have increased over the years.

</comment></comment></comment></comment></comment></comment><comment><USER14> One that has come in handy a few times: When a machine is so starved for resources that it can't even allocate a pts for you, but you want to run some forensics, use `-T`:

        $ ssh -T user@host <command>

Even if you're plumb out of file descriptors for example, you can run...

        $ ssh -T user@host lsof

...or whatever, and get your command output dumped to the screen, even if you don't get the niceties of a terminal.

<comment><USER15> Specifying a command to run automatically implies '-T'.

<comment><USER16> Unless you have "RequestTTY yes" in your ~/.ssh/config.

</comment></comment></comment><comment><USER13> I highly recommend using the canonicalization feature if you use multiple networks:

        CanonicalizeHostname yes
        CanonicalDomains example.org

That ensures that you never have the same host listed twice under the bare hostname and the fully-qualified version, avoiding the need to change keys twice when you rotate them.

This setting allows you to automatically accept keys for new hosts but still report conflicts for existing hosts:

        StrictHostKeyChecking accept-new

I highly recommend using the control-master feature to keep a persistent connection open to servers you access a lot. This makes new connections and tools like Git, scp, sftp, rsync, etc. much faster:

        Host *.amazonaws.com github.com *.github.com gitlab.com *.gitlab.com *.googleusercontent.com
         ControlMaster auto
         ControlPath ~/.ssh/control/%C.socket
         ControlPersist 600

On MacOS, you can use an x509 certificate on a device like a Yubikey as the SSH key so you can authenticate everywhere with the private key never leaving the token and, should you set it up that way, requiring a tap to use.

This will enable the provider:

        PKCS11Provider=/usr/lib/ssh-keychain.dylib

This will get the public key:

        ssh-keygen -D /usr/lib/ssh-keychain.dylib

(see [https://piv.idmanagement.gov/engineering/ssh/](https://piv.idmanagement.gov/engineering/ssh/) for other platforms)

</comment><comment><USER17> My advice is to make heavy use of your .ssh/config

Here is an example of some of mine (double spaced to read clearly on HN):

Host *

            Ciphers aes128-ctr

            Compression yes

            ServerAliveInterval 120

            ForwardX11 yes

Host example

            HostName example.url.com

            User my_name

            ForwardX11Trusted yes

I keep global settings behind the glob, and more specific settings for all the hosts I use.

No need to use aliases in your .bashrc or wherever. With this setup, typing 'ssh example' is equivalent to 'ssh -XCY -c aes128-ctr firstname.lastname@example.com' which definitely saves some keystrokes.

</comment><comment><USER18> > When debugging a complex issue on your servers, you might like to share an > SSH session with someone who is not in the same room. tmux is perfect for > this for terminal sharing! Here are the steps: > [..] > Both of you will > need to SSH to the machine using the same account.

If you want, it is very easy to do view-only tmux sessions with no third-party tools required. That is, you start your tmux specifying a socket (tmux -S ...), and then have a dedicated ssh user which references it (tmux -S ... attach -r, where -r is for read-only) as sshd's ForceCommand (a 10-liner [https://gist.github.com/madars/e6b957ea508be1dcd9044fd2c7096...](https://gist.github.com/madars/e6b957ea508be1dcd9044fd2c70969ac))

<comment><USER19> Or you can execute a shell inside ytalk.

</comment></comment><comment><USER20> I miss having a job that required SSH'ing into a server to get work done. Nowadays everything is abstracted, push your code to the magic cloud and pull in 1000x other stupid little APIs. It's so boring...

<comment><USER21> So, go make one of those APIs

</comment></comment><comment><USER22> IMO among the most useful ssh config settings is the Include directive, which supports wildcards. Hence, the following is the entirey of my ~/.ssh/config:

      Include config.d/*
      Include hosts.d/*

config.d is basically one 'Host *' file, but hosts.d lets me keep the random host/device settings for work and personal use separated.

</comment><comment><USER23> I'd recommend wemux[0] for anyone wanting to share tmux sessions with other people (or even just themselves). It supports several modes:

\- mirror: to attach to server in read-only mode.

\- pair: attach to server in pair mode, allowing the client to control the terminal as well.

\- rogue: attach to server in rogue mode, which allows both editing with the host and switching to windows independently from the host.

I personally use rogue to share tmux sessions between my own devices without affecting whatever I'm doing on the other devices.

[0]: [https://github.com/zolrath/wemux](https://github.com/zolrath/wemux)

</comment><comment><USER24> My favorite SSH trick is to have a machine at work SSH back to my home domain, and provide a tunnel back for Remote Desktop or what have you.

Wee, no VPN to deal with. No _lack_ of a VPN for remote access to deal with.

[https://cygwin.com/pipermail/cygwin/2020-April/244384.html](https://cygwin.com/pipermail/cygwin/2020-April/244384.html)

<comment><USER11> That's likely to be a firing offence, no? If I were running things I wouldn't want employees deliberately subverting my network's security measures in the name of their own convenience.

If you have to spend time wrestling the VPN while you're on the clock, that's their own time being wasted.

<comment><USER24> All you would have to do is disallow outbound SSH.

<comment><USER13> That's tricky, though, since there are many uses for SSH which are not circumventing security policy — blocking outbound SSH would also mean you couldn't use Git, manage servers in the cloud or other locations, transfer files, etc.

Using this to circumvent policy is exactly the kind of move which would lead to those other uses being banned and making life worse for all of your coworkers.

<comment><USER24> > _blocking outbound SSH would also mean you couldn 't use Git, manage servers > in the cloud or other locations, transfer files, etc._

That's right, and that's how it is with my current employer.

If you need outbound SSH to work with Git, that probaly means you're working on a side project, not work. Fetching public code needed for work from a hosting site can be done over https.

Managing servers in the cloud, ditto. If managing servers in the cloud isn't part of your job description, why would your workplace enable that?

</comment></comment></comment></comment></comment><comment><USER25> Is your SSH session hung, and you can't even ctrl-C out? Typing ~. Enter (hit tilde, then period, then enter), will immediately kill the session and drop you back to your local shell.

</comment><comment><USER26> The coolest thing I ever saw in the wild, a guy I once worked with wanted to transfer a directory of files from my machine to his (and maybe show off a little.)

This was long enough ago that I didn't know quite how to proceed (time before rsync, scp...? Nah...) so he asked if he could do it and I let him have the keyboard.

He tar'd (with z) the dir, piped the output of tar to ssh, with a remote command to cat it out there through tar again, all in one CLI line. Blew my mind at the time. UNIX philo FTW.

<comment><USER27> From a _very old_ notes file I have ...

        tar cf - /mnt/data2 | ssh firstname.lastname@example.com "cat > /mnt/data1/file1/file_data2.tar"

... and if the directory is large, you can 'split' it into multiple files:

        tar cfp - /mnt/data1 | ssh email@example.com "split - -b 1024m /mnt/data1/file1/file_data2.tar"

This is really no longer relevant because, of course, we all just use rsync ... but in the _modern_ world, my favorite example of the unix philosophy is:

        mysqldump -u mysql db | ssh firstname.lastname@example.com "dd of=db_dump"

<comment><USER28> None of those are quite right IMHO:

tar -czvf - <sourcedir> | ssh <user>@<remotehost> tar -xzf - -C <remotedir>

This is _much_ faster if you're sending over a directory with a lot of small files, especially if the link has even a modest amount of latency. The 'z' parameter can be omitted if the source files are not compressible (media files or already compressed).

If the files are highly compressible but very large you might consider this instead:

tar -cvf - <sourcedir> | pbzip2 -c | ssh <user>@<remotehost> tar -xf - -C <remotedir>

</comment></comment></comment><comment><USER29> A few I can't live without off the top of my head:

* "-D" for ssh tunneling.

* "-L" for forwarding all traffic on a specific port.

* sshfs - mount small directories over ssh on your local machine (works with big ones but way too slow, for big ones I go rsync).

<comment><USER12> If you work with a large tree where a few files at a time change, you may want to look at lsyncd - backed by inotify and rsync, syncs the local changes to remote. Not really suited for interactive edits, but if you find yourself running rsync in a loop, this is a better replacement.

</comment></comment><comment><USER30> Are the numbers for the ServerAliveCountMax and ServerAliveInterval accidentally swapped? Wouldn't it make much more sense to check every second, and fail if five consecutive checks failed, rather than check only every five seconds, and then fail immediately if one check is dropped due to very transient network issues?

<comment><USER31> Yeah, I would set as well a higher value for "ServerAliveCountMax".

</comment></comment><comment><USER32> I would like to mention sshuttle if your access only is via a jumphost and you don't want to have to create a port forward for every single host/port you want to connect to on the internal network. It basically acs like a cheap VPN:

[https://github.com/sshuttle/sshuttle](https://github.com/sshuttle/sshuttle)

[https://sshuttle.readthedocs.io/en/latest/overview.html](https://sshuttle.readthedocs.io/en/latest/overview.html)

<comment><USER6> More votes for sshuttle!

It's a poor man's one way VPN: It inherits encryption/integrity/authentication (and some authorization) from ssh; It works incredibly well; For most practical network purposes it puts you on the computer you are sshuttlling to; And all it needs on that computer is the ability to ssh into it and some version of python - no special privileges or prior installations.

The bad: It only does TCP (and does some UDP magic to make DNS work, but not UDP in general). It's only one way (no one on the destination network can "call you back", as you don't have an IP on that network). The only config is which network addresses get routed across the sshuttle (no policy / rules / firewall / anything else). You appear to come from the computer you shuttled to (so, unlike a real VPN, for better or worse - no policy along the way can tell you are coming from outside)

<comment><USER33> Yep, sshuttle is awesome. It's also used under the covers by telepresence for connecting into a k8s cluster.

[https://www.telepresence.io/](https://www.telepresence.io/)

</comment></comment></comment><comment><USER34> One of my most used commands is Ctrl+d for closing the input stream and causing a remote or local shell session to exit

[https://unix.stackexchange.com/q/110240/8692](https://unix.stackexchange.com/q/110240/8692)

</comment><comment><USER35> The most gain I've had in the recent years was having vscode remote. Instead of fiddling with terminal editors forever, just have a decent ssh config with all your host, and connect instantly.

Still looking for a way to make sftp/scp work fast.

<comment><USER36> > Still looking for a way to make sftp/scp work fast.

Making it fast while still using it, not sure. But I can share an alternative, since a friend had the same issue and this was a literally ten times faster for a lot of small files (in the order of 30 minutes instead of 5 hours):

        cd path/to/target/location
        ssh user@target 'tar c /tmp/example' | tar x

Quick guide to tar, since it's super simple:

        c for compress
        x for extract
        f for file (since we send it to stdout / read from stdin, I don't use the f option)
        v for verbosity (not sure if that works on the remote side)
        z for zlib compression (ssh can do compression already, so also unused here)
        t for testing (reading) an archive without extracting it ("tar tv <your.tar" will show you the contents, it's almost like real TV!)

That's all I've ever needed.

So what this will do is run "tar create <directory>" on the remote system and, tar being a classic tool, it'll just output that binary archive data to stdout since you didn't specify a file ("tar cf your.tar <directory>"). On the receiving side, you pipe it to another tar command that reads from stdin (since, again, no file was specified) and extracts the files from the incoming data stream.

</comment></comment><comment><USER37> This skips my favorite reason to use mosh: it has predictive local echo and so makes high latency connections much more useable

<comment><USER38> Mosh would be so great if it worked with the mouse.

<comment><USER36> Isn't that called remote desktop?

<comment><USER39> Terminals can have mouse support. It works with some TUI apps like vim.

<comment><USER36> All the terminal software with mouse support I've found so far just messes with things, I wasn't aware that people actually use this (e.g. in vim enabling mouse support messes with the yank buffer and doesn't let me select things for clipboard copying anymore, I immediately turn that off in setups where some overzealous maintainer default-enabled it). The amount of software with support is very low anyway, so if one really wants to use a mouse, remote desktop might serve one better.

<comment><USER40> ?? Sounds like mosh is the only program in the stack that doesn't support this

</comment></comment></comment></comment></comment></comment><comment><USER41> I am missing certificates on this list, you never have to distribute individual public keys. And you can sign certificates with an API. It is also nice to give someone temporary access, because they are valid in a time interval.

<comment><USER42> Yea we like certificates at smallstep. We've got a couple[1] other[2] posts[3] that cover them pretty well. Should have probably made a more prominent mention though :).

[1] [https://smallstep.com/blog/use-ssh- certificates/](https://smallstep.com/blog/use-ssh-certificates/)

[2] [https://smallstep.com/blog/diy-single-sign-on-for- ssh/](https://smallstep.com/blog/diy-single-sign-on-for-ssh/)

[3] [https://smallstep.com/blog/smallstep- ssh/](https://smallstep.com/blog/smallstep-ssh/)

</comment></comment><comment><USER43> You need to press Enter before using the SSH ~ escape key.

<comment><USER44> Yup. I have no idea why they call it an _escape character_. It's an _escape sequence_ , always of length two.

<comment><USER45> And on an international keyboard it's ~~, because ~ defaults to being a character modifier. If you nest SSH sessions, then you add more ~s. So in your fifth nested SSH session on an international keyboard the escape sequence would be \n<comment><comment><comment>~.

<comment><USER44> Hmm. Is that right? I thought you could type ~~ to send a ~ through to the destination. So, ignoring the international aspect, I was thinking you'd type ~ to escape your first target, ~~ for the second, <comment>~ for the third, and <comment><comment>~~ for the fourth. (Too lazy to test it.)

Perhaps better is to set a different escape char for layers you care about.

<comment><USER43> I think the parent is still right, just a problem with international keyboards.

</comment></comment></comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER46> mosh + tmux for sessions of uptime length

ssh-copy-id to never enter passwords again

~/.ssh/config add servers to never write hostnames etc again

and repo on gitlab with bash script that installs all of this and sets up own config of zsh and tmux for me on any new ubuntu server machine.

what else to dream about? curious

</comment><comment><USER47> I was tired enough of losing connections to work systems I was working on when network topology changes, or my laptop was moved, or it went to sleep, or I moved to a new computer (e.g. I'm at home) that I wrote a simple script to jump all my ssh connections through a VM at work, but with the extra step that the connection from the jump VM happens in a tmux that's named based on the desired host, and with options to reconnect to an existing session if it exists.

With the script named "go", Here's what that allows in practice:

go foo.bar - Connects to host foo.bar

go foo.bar - Second connection to host foo.bar that uses same session, so keystrokes show in both, even if they originate from separate locations, like home and work.

go foo.bar 2 - Additional param is added to session name, so you get a new connection to foo.bar.

go -list - Lists all connection sessions, and only connection sessions, because there's a special prefix to distinguish them from normal tmux sessions that might exist on the VM.

go -restore - Spawn a new terminal for all open connections. Useful for getting all terminals back after the network drops, or you reboot, or you're on your home computer instead of work, etc.

Currently this is implemented in a batch script on windows with some ugly hacks to make it work well with what PuTTY's command line options support (commands for the remote host need to be in a file you specify...), and it's pretty ugly, but I'll share if if anyone is interested. It would be much easier in bash with openssh (it's even possible OpenSSH supports enough features to do this in the ssh config).

<comment><USER48> Why not just use Mosh? It's stateless connections that are persistent even when internet connectivity isn't.

<comment> sh-run Or better yet, eternal terminal. That way you can keep your scrollback

[https://eternalterminal.dev/](https://eternalterminal.dev/)

<comment><USER47> I do have my scrollback buffer. The tmux session is on the VM, and within that session is another ssh connection to the target system. If the target system and the VM are disconnected (very unlikely without either the target or VM restarting) then sure, I might lose my scrollback (since tmux is execed with the SSH command, when it exits the session will end), but in the much more common scenario that my side loses connectivity to the VM (or I change locations), the VM still has an active connection going on in a tmux session that I'm joining.

ET looks great for a lot of things, but not necessarily this environment, which is a few hundred systems administered by multiple people, with extremely high stability and security requirements. Honestly, all the extra stuff ET and MOSH does is to give you that extra 1-2% of features to make it seamless, but at the expense of separate protocols and new software, so you don't have to expend new hardware (or in this case, virtualized hardware.

Connectivity problems almost always come from the last mile, whether that's you moving to make the last mile somewhere else or your wifi or home connection having a problem. A VM at Digital Ocean, or in my case the highly redundant and available VMware cluster at work, is much less likely to have any sort of problems, as are the servers that are generally being connected to (and it those ARE having problems, you can't rely on sessions to them being kept anyway).

For 99% of the cases, you can get by easily by just SSHing to a highly available VM, starting a tmux session for the desired connection, and within that session SSHing to the desired system. Jumping through other systems with SSH is so common that OpenSSH has features built in to support it, even transparently (where your config can just make it automatic for a class of systems). In fact, I bet there's a way to get the OpenSSH Proxying SSH server to keep the session open to reconnect to from the client if it's only the client side that had a problem, so it doesn't even require the little script I have. It's actually on my todo list to figure out the windows included OpenSSH agent stuff and see how well the new Windows Terminal works as an SSH terminal, but I haven't gotten around to it (or just use the WSL stuff, but I haven't seen much need for it yet, I'm happy to do most my dev work in vim on a dev server).

</comment></comment></comment></comment><comment><USER49> I've also long used SSH in various simple tunnels for my personal laptop's Web browser and/or mail client, such as through EC2 instances (and at one point also through a filtering HTTP proxy). Here's one version of it.

        while true ; do
            # TODO: make this do desktop notifications instead of osd_cat
            echo "TUNNEL CONNECTING" | osd_cat --pos=middle --align=center --lines=1 \
                --font="-unregistered-latin modern sans-bold-r-*-*-140-*-*-*-*-*-*-*" \
                --color=green1 --outline=2 --outlinecolour=white --delay=1
            ssh -2 -4 -a -k -n -x -y -N -T -D 127.0.0.1:1234 firstname.lastname@example.com
            sleep 3
        done

Separate from these little personal tunnels, there's some additional SSH timeout options (sorry I don't have handy at the moment) that I've found frequently helpful in my uses of SSH at work, plus an external timeout wrapper that can kill the ssh process, for long-running scripts dealing with a non- OpenSSH server, but they've almost never been necessary in practice for these personal tunnels.

</comment><comment><USER50> If you are working on an HPC cluster:

[1] The ssh package for vscode is great

[https://code.visualstudio.com/docs/remote/ssh](https://code.visualstudio.com/docs/remote/ssh)

[2] Also check out rsub which allows you to open a file in your terminal locally

[https://github.com/henrikpersson/rsub](https://github.com/henrikpersson/rsub)

</comment><comment><USER51> Everyone probably already knows this, but enabling compression (-C) makes running remote X programs more usable over slower connections.

<comment><USER11> Not a bad tip, but using gzip compression over the wire seems pretty stone- age. The proper solution is surely to use a modern lossy video-compression algorithm. Is that possible with X?

It's not something I know a lot about. Is this where VNC steps in?

<comment><USER36> I don't know much about it, but I'm fairly sure that compressing the Xorg data stream with lossy compression is going to mess it up completely and would require a complete overhaul of the protocol to make that work. VNC is indeed the more standard unix thing (insofar as remote GUIs can be considered standard on unix-likes) that applies lossy compression to the pictures being sent over.

</comment></comment></comment><comment><USER52> This reminds me of the ugliest hack I have ever written.

For context: passwords rotate every 90 days, there are different passwords for client facing and "internal" servers, (and different passwords for linux machines vs Windows machines).

All connections to client facing servers (which is my job) must go via:

1) a VPN

2) a "local" jumphost (both ssh/rdp), only accessible via VPN

3) a "remote" jumphost (also, both ssh/rdp), only accessible via the "local" jumphost".

Additionally; The majority of my servers are Windows based.

So, what do you do when everything goes wrong? well, you VPN with your "normal" password, and your 2FA RSA token. Then you rdp (or SSH) to the local jumphost with the same password as the vpn, then you rdp (or, ssh) to the remote jumphost with a different password, then you finally RDP into the machine that is interesting.

So, being the lazy git that I am, I wrote a program that scrapes my passwords from 1password, and ssh's into those jumphosts creating a tunnel all the way through. Then I call freerdp on localhost.

For this to work I had to do a bunch of ugly things like:

1) figure out the dimensions of my display and scale everything, because freerdp doesn't do this automatically.

2) call python from bash because getting a unique random socket requires binding to "port 0" which is not something I think is possible inside of bash.

3) do the same on each hop.

4) determine which password is needed based on the "domain" of the machine

5) detect if the machine is actually accessible or not (IE; are you on the VPN? is the machine actually "local"?)

Anyway, I should share the code, we can all revel in its ugliness.

<comment><USER53> When will you share it?

</comment></comment><comment><USER54> At your home install nss-mdns on Linux. It uses avahi for mDNS name resolution on your LAN. You can then forgo /etc/hosts and DHCP reservations between your machines at home. It is compatible with Mac's. I don't know what you can use on Windows for the purpose.

Then to extend this a notch or two install Zerotier on all your hosts. Now you have virtual LAN between all your machines even outside of your home. It is P2P and does hole punching and whatever you need to work. You can connect to your computer via tethering from a puny little laptop while sitting on a bench outside your house. If you are a home admin for your family you can add those computers to your virtual LAN. Or your friends can also join. Then you can easily share photos or whatever straight with Samba or even an intranet of sorts.

<comment><USER55> Strongly seconded! (Tossing some further dots to connect into the mix: Mosh and tmux and iTerm2's tmux integration fit very well in too. I think Visual Studio's Live Share should also work faster over ZeroTier - it should serve as a direct connection. I'm also really keen to try Emacs multiuser editing on a remote terminal over mosh and tmux.)

And: I don't know if it's the placebo effect, but it seems to me that connections over ZeroTier are noticeably more responsive. Like slightly but noticeably.

<comment><USER54> Connections on Zerotier itself often survive roaming. I was amazed when I went from tethering outside to home Wi-Fi and ssh session was still responsive. Although it can freeze and definitely can timeout. I'm yet to try mosh.

I did not hear about Live Share, but was planning on using Visual Studio Code Remote Development. For my current work ssh -CX is often enough for me. I also intend to use Xpra, as I found X2Go a bit more rough around the edges.

It could be interesting to measure the effect. Probably they did some testing already, but probably as you said - placebo ;)

</comment></comment></comment><comment><USER56> Just run a remote command, via ssh foo the_command

I commonly do ssh remote '(cd foo; git pull; make && run)'

Of course with tramp I don't have to do this as much as I used to.

</comment><comment><USER57> [https://gravitational.com/teleport/docs/](https://gravitational.com/teleport/docs/)

Is another great tool for getting off SSH.

Similarly if you're in AWS and not using Session Manager, you're missing out on a huge value add: [https://docs.aws.amazon.com/systems- manager/latest/userguide...](https://docs.aws.amazon.com/systems- manager/latest/userguide/session-manager.html)

<comment><USER42> Disclosure: not OP, but work at smallstep

Smallstep has a product[1] that's a lot like gravitational teleport. That's how we got deep enough into SSH to write this post. Teleport isn't bad. The two biggest differentiators are probably:

\- Smallstep SSH is hosted (with HSM-backed private keys)

\- Smallstep SSH does user & group syncing from your identity provider (i.e., you don't need to adduser / deluser folks anymore) so you don't need to do any user or key management on servers at all

We're also doing everything using standard OpenSSH, whereas teleport replaces your SSH client & server (or at least it used to, skimming their docs it looks like that might be changing). Authentication is via OAuth OIDC (single sign- on), user & group sync is via SCIM, plus PAM & NSS on the host side. So it's all pretty standard stuff.

Finally, Smallstep SSH is built on our open source toolchain, step[2] and step-ca[3]. Actually, if you want something completely free that does all of this you can just use those tools and do something like gravitational yourself. We have a blog post[4] explaining how.

This product is only a couple weeks old, so feedback is very welcome!

[1] [https://smallstep.com/sso-ssh/](https://smallstep.com/sso-ssh/)

[2] [https://github.com/smallstep/cli](https://github.com/smallstep/cli)

[3] [https://github.com/smallstep/certificates](https://github.com/smallstep/certificates)

[4] [https://smallstep.com/blog/diy-single-sign-on-for- ssh/](https://smallstep.com/blog/diy-single-sign-on-for-ssh/)

</comment></comment><comment><USER58> 2FA for SSH sounds great but I can only imagine how cumbersome it must be for using on a daily basis. I've recently started permanently locking my SSH ports and only briefly whitelisting them for only my IP with a bash scripts whenever the access is needed [https://pawelurbanek.com/ec2-ssh-dynamic- access](https://pawelurbanek.com/ec2-ssh-dynamic-access)

<comment><USER42> Check out our single sign-on for SSH stuff at smallstep (where I work). Either in open source[1] or our product[2]. The hassle of 2FAing all the time is one of the big reasons I love single sign-on for SSH. Basically, you do 2FA when you're pushed through single sign-on. But then you're issued a short-lived certificate that gets put in your ssh-agent. You only need to 2FA to _get_ a certificate. So you can tune 2FA challenge frequency based on certificate lifetime.

It's sort of like a browser session where you "login" and then you can browse until your cookie expires. Here you "login" and you can SSH until your certificate expires. So you have strong authentication, but you're only asked to do it periodically.

[1] [https://smallstep.com/blog/diy-single-sign-on-for- ssh/](https://smallstep.com/blog/diy-single-sign-on-for-ssh/)

[2] [https://smallstep.com/sso-ssh/](https://smallstep.com/sso-ssh/)

</comment></comment><comment><USER59> Surprise not to see tmate.io get more attention:

[https://tmate.io](https://tmate.io)

It's packaged for most Linux distributions and offers a seam-less "share your terminal" experience over the web. Has an optional read-only mode. Users can access the terminal via https and ssh. Great for low-bandwidth videoconferencing.

</comment><comment><USER60> screen.

If you are out there and you DO NOT want to lose your session due to a network error screen is for you! Even better, you can have your coworkers join your screen or reattach to it and watch you use ssh.

<comment><USER61> I loved screen in the 90's, but many of us prefer tmux these days.

<comment><USER62> Can I ask why? I've tried it out (albeit, very briefly), and it just seems like the same thing but with different command shortcuts. Is it just because it's newer?

</comment></comment></comment><comment><USER63> If you let ssh connection dies, these keys, in order, will kill the ssh process before the timeout kicks in: esc ~ .

</comment><comment><USER64> Port tunneling, X forwarding, keys + agents, sshuttle and byobu all make SSH a good solution for getting stuff done.

<comment><USER36> It would be nice if you could include at least one sentence about these product names to give an idea of what they do. For other readers:

sshuttle:

> Transparent proxy server that works as a poor man's VPN. Forwards over ssh. > Doesn't require admin. Works with Linux and MacOS. Supports DNS tunneling.

> Forward all traffic:

> sshuttle -r username@sshserver 0.0.0.0/0

byobu:

> Byobu is an enhancement for the GNU Screen terminal multiplexer or tmux > [...] that can be used to provide on-screen notification or status, and > tabbed multi-window management. It is intended to improve terminal sessions > when users connect to remote servers.

</comment></comment><comment><USER65> It's a bit annoying that the word hack is used to mean tips and tricks here. As hacking ssh is big area

<comment><USER3> hacker as in "hacker news" is closest to "tricks" of tips and tricks

[https://stallman.org/articles/on- hacking.html](https://stallman.org/articles/on-hacking.html)

However if someone said "hacking ssh" without the context of hacker news, I can see why the general computer person would probably think of the newer definition, which implies cracking or seeking security vulnerabilities.

</comment></comment><comment><USER66> Try using ssh-import-id to fetch your (or a friend or colleague's) public key from Github!

<comment><USER42> If you like ssh-import-id to pull keys from GitHub, you'll _love_ AuthorizedKeysCommand to pull keys from GitHub.

Depending on use case, though, this can be a bit sketch. At smallstep we like SSH certificates, which make life similarly easy on everyone with a bunch of other benefits. You can find a couple relevant posts on our blog if you're interested.

Incidentally, GitHub now supports SSH certificates (for enterprise edition, at least).

</comment></comment><comment><USER67> ssh not having support for --password argument is a big drawback. Usually requires to use some weird workarounds, especially when copying ssh keys to the machine are not an option.

<comment><USER68> It would put your password into your `~/.bash_history` and show up on the screen though; using a commandline argument to pass passwords is inherently unsafe.

Sure you could have a secure system that only you use, but the people behind ssh cannot make that assumption. Removing the risk entirely is better than trusting the users.

I'm sure there's a shell trick you could use to pass a password on the prompt anyway. For all other use cases, copy SSH keys securely.

<comment><USER36> > It would put your password into your `~/.bash_history`

I'm fine typing (or pasting) my password in an interactive prompt when I'm interactively using it; that's not the problem. What I would like a --password option for is when I'm not interactively using it, like from a script. It'll still show up in the process list (ssh could overwrite it but there are some µs where it's there) but my laptop is single-user so that's no big deal.

> I'm sure there's a shell trick you could use to pass a password on the > prompt anyway.

There is software that does it, but it's a real pain to find a short command that does it. Simply echo password | ssh user@host does not work, the openssh authors disabled that on purpose.

Ssh keys are, of course, the solution whenever possible, but that's not always possible. I'll be the first to admit that the legitimate uses for --password are rare, but they're definitely there and having to install extra software to make that crap work is just a real pain. I'd rather be able to shoot myself in the foot with unix tools.

<comment><USER69> It's quite likely that what you want in this case is to use SSH forced commands with sshkey auth and a remote account exclusively dedicated to serving this one request.

[https://binblog.info/2008/10/20/openssh-going-flexible- with-...](https://binblog.info/2008/10/20/openssh-going-flexible-with-forced- commands/)

<comment><USER36> But that would be server-side, if I'm reading it right? I'm trying to remember the last time I needed password auth and wanted to do it in an automated fashion (like I said, it is rare), I think it was a router where the filesystem was read-only (only /var and /tmp writable, or something like that, so can't set authorized keys).

<comment><USER69> That's annoying. Many such cases have an overlay filesystem or other mechanism for preseving specific settings (ssh configs almost always included) or reflashing the image with desired config changes.

Forced commands are implemented on _both_ sides of the session, as the previously linked reference ... doesn't entirely make clear. Locally you need to create, and generally configure, a specific key with the remote user@host Remotely, you associate that key with a specific command, in an authorized_keys file.

</comment></comment></comment></comment></comment></comment><comment><USER70> At my previous customer, we had to SSH through a bounce gateway (SSH key auth), then a bastion host (LDAP password auth), then the target host (LDAP password auth). Since it was quite annoying, I used multiple ssh_config tricks to make it work without having a 1000 lines SSH config, and I wrote a doc to share best practices. I anonymized it and posted it below.

\</comment><comment></comment><comment></comment><comment>----

 _ssh_config_best_practices.md_

      CanonicalizeHostname yes

      ##############
      ### GitHub ###
      ##############

      Host github.com
        User jdoe
        IdentityFile ~/.ssh/id_rsa_github

      ##################
      ### My Company ###
      ##################

      Host myproject-dev-*
        ProxyJump bastion-dev

      Host myproject-prod-*
        ProxyJump bastion-prod

      Host bastion-dev
        HostName bastion.myproject-dev.mycompany.com
        ProxyJump bounce.myproject-dev.mycompany.com

      Host bastion-prod
        HostName bastion.myproject-prod.mycompany.com
        ProxyJump bounce.myproject-prod.mycompany.com

      Host *.mycompany.com myproject-dev-* myproject-prod-*
        User john_doe
        IdentityFile ~/.ssh/id_rsa_mycompany

      ##############
      ### Common ###
      ##############

      Host *
        ControlMaster auto
        ControlPath ~/.ssh/sockets/%r@%h
        ControlPersist 2h

        # On OS X, UseKeyChain specifies that we should store passphrases in the Keychain.
        IgnoreUnknown UseKeychain
        UseKeychain yes
        AddKeysToAgent yes

\- "CanonicalizeHostname" ensures the config is re-parsed after hostname canonicalization. This means that when you SSH into "bastion-dev", SSH re- parses the config using the full hostname "bastion.myproject- dev.mycompany.com", which then correctly matches the entry "Host * .mycompany.com".

\- "ProxyJump" was added in OpenSSH 7.2 (2016) and is simpler and more powerful than "ProxyCommand".

\- "bastion-xxx" hosts are the only ones whose hostname can be resolved from the bounce gateways. To connect to other hosts, the trick we use in this config is to do two ProxyJumps: your machine --> bounce --> bastion --> target host.

\- "ControlMaster" lets you do SSH multiplexing, which in our case is particularly useful when channeling multiple connections through a bastion host. It also persists SSH connections for a while after we disconnect, which speeds up future connections, and avoids typing the password all the time.

\- When you ssh into a host, you must enter your LDAP password twice: first for the bastion, then for the target host. If you then ssh into a second host, you must enter your LDAP password only once, since ControlMaster reuses the SSH connection previously established to the bastion. Also, if you close those SSH shells, the connections will persist for two hours (see ControlPersist), so you won't need to type your password for those two hosts if you try to SSH into them again in the next two hours.

\- Using this ssh_config, there is no need to add an Host entry for each host. It is not even needed to specify the IP addresses, since they will be resolved using the DNS on the bastion host.

\- With this configuration, you can easily copy a file using scp between your local machine and the target host, without needing to first copy it to the bastion, then ssh to the bastion, then copy it to the target host, then remove it from the bastion...

PS: an ssh_config is parsed from top to bottom, so specific comes first, generic comes last. That's why "Host *" must be at the bottom.

</comment><comment><USER71> Some tips:

\- Customise ~/.ssh/config to suite your needs (be careful with storm - <USER2> ssh like a boss, it helps when scripting or searching hosts but has a outstanding bug converting keywords to lowercase [1])

\- Use ed25519 key over RSA

\- OpenSSH 8.1 added support for FIDO/U2F (use your YubiKey or equivalent)

\- Put `IPQoS lowdelay throughput` in your ~/.ssh/config if you run a rolling release (e.g. Arch, Gentoo) or your openssh rolls via homebrew on macOS. latest openssh client with older version of sshd may produce weird disconnection issues (server reset connection, client side is able to connect but terminal hangs in 5~10s). Spend quite some time digging only to find that it was caused by default change for IPQoS (to IPQoS af21 cs1) introduced in OpenSSH 7.8p1 [3]

\- leverage ssh-copy-id

\- ssh -vvv | ssh -G (troubleshooting from client side)

\- /usr/sbin/sshd -p 2222 -f /path/to/sshd_config -D -ddd (troubleshooting sshd server side)

\- Be careful with `UsePAM no`, make sur

\- use AllowUsers / DenyUsers vs DenyGroups vs AllowGroups , mind the order

\- know how to use ssh-add / ssh-keygen / ssh-agent / ssh-keyscan

\- audit SSH config (ssh-audit / lynis), version control ssh_config / sshd_config properly if possible

\- openssh + tmux ;-)

Personal favourite tips/tricks:

\- ssh -D (used to use this dynamic port forwarding, open a local Socks5 proxy to punch hole in firewall, encrypt traffic, it worked for a while against the infamous GFW, only a little while though)

\- ssh -L | -R TCP forwarding

\- ssh -X | -Y X11 forwarding (run X11 apps remotely and display it on X Server locally)

\- More personal SSH tricks put together over the years, surprise to find that my person OpenSSH notes are 150+ pages in Google Docs, sorry can't put all in a comment... [2]

\- RTFM works, OpenSSH is worth the time ;-)

[1]: [https://github.com/emre/storm/issues/157](https://github.com/emre/storm/issues/157)

[2]: [https://sites.google.com/site/imterry/computer/tools/ssh](https://sites.google.com/site/imterry/computer/tools/ssh)

[3]: ssh(1)/sshd(8): the default IPQoS used by ssh/sshd has changed. [https://www.openssh.com/releasenotes.html](https://www.openssh.com/releasenotes.html)

</comment><comment><USER72> If you have a Mac, the correct way to use SSH is:

1\. Install iTerm.

2\. ssh -t remote.workstation 'tmux -CC new-session -A -D -s main'

<comment><USER73> I recommend iTerm2, not iTerm.

</comment></comment><comment><USER74> I often ssh then open a vim on the server. But it would make more sense to me if vim had support for open remote files via its own ssh connection instead. Does this exist (for vim or some other editors)? Then I could always use my local config and it would be easier to type on a bad connection.

<comment><USER75> > Does this exist (for vim or some other editors)?

It does:

            vim scp://server//path

Run

            :h netrw

inside vim to learn all about editing remote files.

<comment><USER74> Thanks, this looks like what I want.</comment></comment></comment>


Show HN: I made something that helps you land a remote job - <AUTHOR> http://openhub.co/find-remote-job <comment><USER2> I've browsed a few jobs and they seem to be mainly US based. Would be great to have that kind of information or timezone, because US companies mostly allow remote workers based in the US.

</comment><comment><USER3> The website completely fails with this error on any event:

TypeError: undefined is not an object (evaluating 'offset.top') app.js:132

I am unable to scroll and click any button, both actions throw the same error.</comment>


The amusing case of tech libertarians - <AUTHOR> http://mattbruenig.com/2015/06/06/the-amusing-case-of-tech-libertarians/ <comment><USER2> To get a better idea of how the ideas of open source (and free software) reconcile with those of libertarianism, consider that basically all such licensing regimes involve consent and contract on the part of the authors and their community of users and contributors. Classic libertarian values are voluntary, organic collaboration over centralized, coercive, command and control. Even the GPL is predicated on this.

Indeed, a symbiotic relationship that has developed between the world of open source and the proprietary projects of the tech giants startups and startups, all driven by the enlightened self-interest of all the actors involved, big and small.

As for the more dogmatic GNU-style Free Software movement, it makes a couple of (erroneous, in my view) assumptions about a inherent coerciveness of "non- free" software, and builds their entire philosophical vision out from that idea. However, the continued eclipse of the GPL by more "liberal" BSD/MIT- style licenses seems to demonstrate that those assumptions are increasingly failing to validate.

It's interesting to note that Eric Raymond, author of the Cathedral and the Bazaar, and one of the key collaborators that developed the term "Open Source" and the ensuing definitions, is a pretty staunch libertarian. He's written extensively about both topics at [http://www.catb.org/esr/writings/](http://www.catb.org/esr/writings/).

</comment><comment><USER3> I don't lean libertarian because I think I'm John Galt and want to "stop the motor of the world". I lean libertarian because I want to have access that motor at all.

I want to stand on the shoulders of giants, not ask giants for permission and I don't care at all if the system that allows for this is called "marxist", "capitalist" or any other "ist" you might dream up.

<comment><USER4> Aren't stood-upon shoulders of giants literally the reason why Atlas Shrugged.

</comment></comment><comment><USER5> I'm not sure the author actually understands what libertarianism is. What is un-libertarian about open and free software? The whole ethos of libertarianism is around mutual, non-forced, consent. Free and open software absolutely represents this. Socialism and communism are sharing by force, which open and free software is the opposite of.

In fact I don't think there actually are any sociopolitical ideologies which say making things and giving them away for free is something that is wrong or shouldn't happen, so I'm really not sure who or what the author is trying to call out here.

<comment><USER6> > I'm not sure the author actually understands what libertarianism is.

I'm almost convinced that _nobody_ understands what libertarianism is, including libertarians.

Almost invariably if libertarian X explains libertarianism to me, and after thinking about it I come up with some objections or questions and X is not available, so I find some other libertarian, Y, and bring up my questions, I find that Y is a different kind of libertarian and his flavor of libertarianism doesn't include the features I objected to.

Just look at the sidebar of /r/libertarian on Reddit. It contains a "Types of Libertarianism" section which contains links to sub-reddits for various libertarian types. It has agorism, anarcho-capitalism, christian-ancaps, geolibertarianism, libertarian left, mutualism, market anarchism, minarchy, objectivism, and voluntarism. (I realize this is not necessarily fully accurate...objectivists do not consider themselves libertarians).

I'm pretty sure that on almost every issue I've found some type of libertarianism that fits very well with my views (much better than the Republican or Democrat party platforms do), but is way off of my views on several other issues I find important.

I think this happens because I think libertarians (at least many flavors) construct their rules backwards from the way I think they should be constructed. They take an axiomatic approach, coming up with some general principles that they feel are self-evidently correct. Then they deduce the rules of society that follow from those axioms.

A good example of this is Rothbard. His "The Ethics of Liberty" is a wonderful examination of the consequences of a small number of general principles. He follows those principles wherever they lead, and gets to some points where he admits the outcomes can be terrible. For example, parents not legally required to care for their children--they cannot actively kill them, but if parents decide they don't want their newborn baby they can just ignore it until it dies. He thinks that this would not happen too often, because instead of letting the baby die, the parents could sell it on the free market to someone who wants to raise a child. (Children are a theoretical pain in the ass for many flavors of libertarianism, not just Rothbard libertarianism).

I take terrible outcomes as a sign that we didn't get the axioms right. We should be starting with the kind of society we want to have, and then pick our axioms to be a minimal set of general principles that generate that kind of society, rather than picking the axioms and then accepting whatever society arises from them.

<comment><USER7> This is true of any "-ism", especially ideologies.

Every person will give a slightly different answer as to what it is.

</comment></comment></comment><comment><USER8> The author falls into the false dichotomy between libertarianism as the far right and socialism/communism as the far left. (There's a link above the title that leads to another article by the same author that equates the GPL with communism.)

There are indeed a lot of right-wing libertarians in today's tech scene, but I also see a lot of left-wing libertarians here. If you have warm fuzzy feelings about Universal Basic Income, for example, you might be a left-libertarian. Left-libertarians support a strong social safety net to establish a safe minimum, as well as a relative lack of regulations on what you can do once that minimum is reached.

</comment><comment><USER9> What a stupid article. The author just proves that he has no clue what libertarianism is. His entire argument is that free and voluntary contribution spontaneously done by a large number of people under no coercion or threat of violence created something useful and wonderful. Ok genius. THAT is the essence of the market and the antithesis of the state (market does not need money to change hands, FYI any physical or psychological utility is enough). Non-aggression is the bedrock of libertarianism. Thanks for proving the libertarian argument. Now stop writing clueless blogposts and go read a book.

</comment><comment><USER10> how communism is presented and held en mass today seems to be as a bunch of people hating richness. how libertarianism is presented and held en mass seems to be people that hate non-trivial social demands that are created by any central authority. neither represent the actual theories or meaning behind communism or libertarianism.

if one assumes a purist theory of communism (something more akin to unionism) and an impure version of libertarianism (something closer to market neo- liberalism) -- then the article rings out. In any other combination the point of the article becomes debatable.

while I understanding that both communist and libertarian theories were about a lot more than being a grumpy white man, attempts to closely tie modern era decentralization movements to these nearly antiquated theories feels at many times to be a thing white men do to justify their grumpiness. The article didn't go there (it carefully only uses the word "communistically") but much of the discussion on the article does.

</comment><comment><USER11> Might want to tone down the smugness of the title.

<comment><USER12> I see no need for that - it was the very smugness (and the lack of basic understanding of libertarian tenets) that I found to be amusing.</comment></comment>


Apple's iMessage Encryption Has One Major Security Flaw - <AUTHOR> http://www.wired.com/2015/09/apple-fighting-privacy-imessage-still-problems/

<comment><USER2> > It's unclear why Apple has not implemented some sort of manual verification > method. The company did not respond to a request for comment.

Uh because most people would have no clue what it meant/did and just be more confused. Don't get me wrong I'd live this feature but I'm in minority and even with it I'd probably only rarely check the keys against friends.

Just because something is possible (showing key fingerprint) doesn't make it "unclear" why it hasn't been implemented....

<comment><USER3> I agree, I found that aspect of the article confusing as well. It's very clear why it isn't part of iMessage.

Though you could make the argument that by allowing manual key verification, Apple increases its trust with technical and privacy-conscious users. And while the vast majority of people might never know the feature exists, the technical users would become strong evangelists for the company's products.

It's a good long-term strategy for Apple to try to get the privacy and technically minded users on their side.</comment></comment>


Weird star - strange dips in brightness are a bit baffling - <AUTHOR> http://www.slate.com/blogs/bad_astronomy/2015/10/14/weird_star_strange_dips_in_brightness_are_a_bit_baffling.html <comment><AUTHOR> Currently, the article title is: "Did Astronomers Find Evidence of an Alien Civilization? (Probably Not. But Still Cool.)". I found it a bit too link- baity and flag-inviting for what is a pretty interesting article from Bad Astronomy, therefore used a title decoded from the URL. Let me know if I should change it back, or to something else.

Yes, there are aliens in the article - because the dips in brightness are _so_ baffling, that there are suggestions from serious astronomers that we may be - unlikely, but still - witnessing construction of a megastructure.</comment>


"But The Client Wants IE 6 Support" - <AUTHOR> http://www.smashingmagazine.com/2011/11/03/%e2%80%9cbut-the-client-wants-ie-6-support%e2%80%9d/ <comment><USER2> I'm a web developer, whenever a client asks me about IE6 support, i enthusiastically tell them i'll happily support it. I then show them usage statistics for IE6 and tell them IE6 support costs a flat fee of £10,000 and let them think about it. No client has ever taken very long to decide its not worth it and none have ever taken me up on it, although i'm sure 1 or 2 have asked a different developer to make them an IE6 version, but thats fine with me.

<comment><USER3> I haven't had a request for IE6 support in years, but if I got one I would say something like:

"No, I will not do IE6 support for you. You've trusted me to solve your problem in the best and most efficient way, and supporting IE6 would be a waste of your money (and my time)."

<comment><USER4> Let me tell you about the UK National Health Service. 1 million employees, they are literally saving people's lives every day, and all they are allowed to use is IE6.

What your statement shows is not a understanding of how to solve the problem for such a client, but a rather a complete lack of understanding. Check the audience metrics, check the real problem being solved, and leave the grandstanding aside.

And for the record, I hate IE (6 or otherwise) and never want to support it. But I am not going let me personal dislike for a technology get in the way of helping a client solve a really important problem.

<comment><USER5> I'm so glad I've never had a client like that here in Australia. Everyone seems to be OK with the idea of running multiple browsers. We do have clients that use IE6 but we've always managed to convince them to install Chrome or Firefox on their desktops so they can use our software. Some users end up using multiple browsers but that's ok.

I guess we're fortunate in the sense that our software is important enough and expensive enough for top management to make IT allow a new browser just for us.

At the UK NHS, who exactly is the CIO, who exactly is mandating IE6 and only IE6? Can't that person be reasoned with? Overridden for the good of the NSH? Fired even? Just saying 'oh they're only allowed IE6' is giving up too early.

<comment><USER4> Some historical background, which includes plenty of personal bias:

Governments, for all their posturing, love dealing with oligopolies, or even better, monopolies. They feel safer in making purchases from them. So around 2002, the UK government decided IT was so important, it was going to be done centrally for the whole NHS. They gave the job to Richard Granger, who then proceeded to divide England into five regions, each of which would have one vendor responsible for all software in the NHS for that region.

As part of that deal, they licensed MS Windows and Office. At that point, it became more expensive to use open source software than Microsoft's software. Then they standardised on IE6, and many vendors began using ActiveX.

When I ask departments to upgrade, they say they are going to do so, but first they need every single vendor to have signed off that their software works in the new browser. This will take a really long time.

Some will install a new browser for us, but this will actually result in a worse outcome for the clinicians because they have to use IE6 for most of their existing browsing, and then the other browser for us. They do not understand the point or the difference, and new browsers mean a different user interface, and they want to get on with treating patients rather than choosing between browsers.

The epilogue is that the UK government's national program wasted 12 billion pounds (about 20 billion US, ie the same amount the US government is also identically wasting to subsidise electronic health record purchases). And Richard Granger left the UK in disgrace.

He is now a consultant in... Australia :)

<comment><USER6> Would they be willing to use Chrome Frame? It seems like the ideal way to target IE6-only customers without "installing" another browser. That way they can use one browser for all their intranet apps.

</comment></comment></comment></comment></comment></comment><comment><USER7> Perhaps I am naive but this conversation seems easy to resolve with just a few words. Can anyone tell me how a client would respond to this:

You can have a site with newer, nicer features, or you can have a site that supports older browsers. If you want both then you are commissioning two distinct websites. If you want usage statistics for old browsers I have them, and if you want to be economical I can produce the second website for older browsers at a reduced cost with reduced flair, after all only X% of people would see that site and it would still look reasonable, just not amazing. What would you like to do?

<comment><USER8> To me that's lying to them.

While supporting IE6 is onerous extra work, it's still work that can be done and has little impact on the final product.

Take the other position, that 'Not supporting IE6 will mean I'll charge you 70% of my original quote, only x% of people use it in your target market' or better add it as an extra in the quote in the first place as the article suggests.

Then it's up to them, it's a risk assessment. But be up front in your quotes with it, not an after the quote is won 'I don't know how to do it!'.

The article's incredibly OTT on how much adding IE6 support costs, but I certainly would never go down the route of lying to a customer about it. If he charges double it's probably because he hates doing it and fair game to him.

<comment><USER9> I think the article is realistic in terms of IE6 support costs if you're not just building a simple website.

Trying to build a responsive, dynamic webapp, that is identical in IE6 to a modern browser can easily add a lot of time. Just as an example, producing all the graphics for rounded corners, rather than being able to do them in CSS.

<comment><USER10> I've found that people don't really notice or care when IE shows them square corners.

The thing about IE6/7 support is that it's a complete known quantity at this point. The problems & workarounds are well documented. There's tons of experienced HTML coders out there that know IE backwards and forwards. CSS frameworks like OOCSS include built-in workarounds.

So if IE support doubles the cost, it must either be something very complex, or a real nickle-and-dime project. (Either that or the webdev doesn't really what they're doing.)

</comment></comment></comment></comment><comment><USER11> > How many of us actually charge 30-100% extra for this work? I haven't heard > of many who do.

Actually I see the exact opposite around me: developers billing by the hour and warning that IE 6 (or later) will generate extra work (and costs money).

Most people I know just have a look at their site stats and see what is worth it.

<comment><USER12> Very much this, we informed the client that it was going to cost them more, and we itemized time spent fixing IE6 specific bugs and layout issues so we could offer them an idea of how much it was costing them. They needed this kind of data in order to convince their internal IT to migrate most of their user base off of IE6.

</comment></comment><comment><USER13> I usually take a much different approach with this issue. I had to support IE 6 for years after anyone could reasonably have been asked to do that. I did it because our customers used it a lot and asking them to upgrade wasn't in the cards for us. We could have lost 30% of our business or just not do all the cool things we wanted to do.

I realize it's not cool but we chose to just not do all those things. IE 6 does support a lot of what you need to do and once you figure that out it becomes easier to make it work without having to go back and fix it later. I'm pretty good at it now so I don't really complain if someone asks me to make something work in IE 6. It's not a huge deal if you know what the issues are.

<comment><USER8> IE7 only came out 5 years ago, IE8 2 years ago.

Making sure IE6 was supported was still commonplace even last year.

You're not as unique a snowflake as you think you are, we've all been having to do it. It's only becoming viable now to suggest otherwise.

<comment><USER14> "You're not as unique a snowflake as you think you are"

That's unnecessary. The point, without the invective, please.

</comment></comment></comment><comment><USER15> Unfortunately IE6 is still very _popular_ in the corporate world of Europe. I'm currently running an internal websurvey for a large car rental company and looking at this weeks http logs shows that IE6 is still getting 61% :(

<comment><USER8> Large car rental companies are not exactly cutting edge on IT. They tend to have a lot of small locations that's not exactly easy to start upgrading because of the cost of sending people out to do it all.

My local branches look like they had their last refurb in the late 90s for example.

One example does not a sample make.

<comment><USER9> It is not just car rental companies. Most of the UK's major banks use IE6 still.

This is because most of their intranet apps will only work in IE6, and they have the size to demand that their supplies support IE6 too. Corporate IT policy won't allow browsers apart from IE.

If only Microsoft allowed side-by-side installs of IE6 and a IE8 it might be a bit more bearable (given that IE9 is not available on XP)

<comment><USER16> > This is because most of their intranet apps will only work in IE6

How did it ever happen that IE6 ended up in such a long lasting and dominating position? Was it (I am just guessing here) the coincidence of tho things: (1) IE6 just happened to be the most recent Microsoft browser around the time when most of bigcorps initially build their inter/intranet apps, and (2) because this was the first wave of building such things, the web coders did not bother to think about a future when IE6 is no longer a modern browser?

<comment><USER17> Well, part of it was that there weren't other browsers to worry about. At the time there was no Chrome, no Safari (no one used Macs in a corporate environment if there was), and no Firefox. All that you had was IE and Netscape, and Netscape was on kind of shaky ground at that point.

Those two kind of fought with each other by introducing new features that made web pages incompatible with the others. Also, even then corporations weren't really keen on letting you use some other browser, so IE was the go-to since it was already installed. Since the market was so slim, and seemed to be increasingly vanishing, it seemed easier to justify going with IE's extensions.

If Microsoft had kept updating IE and hadn't let it linger for years, we'd probably still be in the situation where they're in control of the de-facto standard. It's only because they sat with their thumb up their ass that things like Firefox and Chrome were able to get footholds and start disrupting the situation. Already being present and practically being named "The Internet" are _really_ big adoption factors.

</comment></comment></comment></comment></comment><comment><USER18> The article mentioned "graceful degradation" but what is really described should coming from the the other direction as "progressive enhancement". As the author mentions, only enable each version of scripts and styles to browsers that support them. For those that don't, the content remains.

Here's an old article that gets the message across in a client-friendly way: [http://www.alistapart.com/articles/understandingprogressivee...](http://www.alistapart.com/articles/understandingprogressiveenhancement)

</comment><comment><USER19> Let me preface this with saying I long for the day IE6 is completely irrelevant.

The fact is, when doing client work I have a responsibility to design the site in a way that when their customer visits they get the information they need. If the website is broken, for whatever reason, that looks badly on my client and on me.

When I do a site I code and design for modern browsers. However, I make sure even IE6 users can get the information they need or order products or whatever the case is with the website.

True, the IE6 users are small in number, however in some cases they can make up an older or important demographic to a client.

</comment><comment><USER20> It all depends on the kind of site you are building and the technologies involved. On some sites it may be ok to deliver a "less beautiful" web but with all the contents, in others it won't. Oftentimes nowadays you'll face a complete rewrite.

In some recent projects I even worked hard to convince the client that it wasn't worth supporting IE8. It's not only that it loads faster with modern techniques (as CSS3 allows awesome effects that would need images/javascript with CSS2), but some functionality built around HTML5 would need a COMPLETE rewrite in Flash.

Of course that means that if they insist on supporting older browsers not only that would mean a 30%-100% increase in price but new features the want afterwards will be more expensive as well (because you're supporting two different projects).

</comment><comment><USER21> This seems like a relatively simple business proposition to a client. "X% of users on the internet today use IE6. I will be happy to provide pixel perfect support for Y dollars." Adjust Y up and down based on your ability and desire to continue to support web applications that use IE6.

</comment><comment><USER22> This article is great, but it works on the premise that IE6 support is a purely rational discussion by two knowledgeable parties before a contract is signed.

\--

In reality, you may develop a website, then the client is visiting their uncle bob one weekend who has an old computer with IE6 lying around, client + uncle bob open up the website to have a look, and it is "broken".

Client then sends you a hate mail about broken contracts.

You reply saying that you discussed IE6 lameness before you started the work.

Client says you were talking jargon, client didn't understand, and you need to fix their website so it loads on their uncle bob's computer otherwise they are suing you for not delivering a working website.

Good luck with that :)

<comment><USER23> As long as the contract clearly mentions that you are not supporting IE6 I wont mind client suing me.

<comment><USER24> Make sure you have the prevailing party's legal costs as part of the bargain in the eventuality of suit as well: Otherwise wining the lawsuit can be Pyrrhic

</comment></comment></comment><comment><USER25> We explicitly don't support IE on our heavy JavaScript web app.

Users get an alert saying, "Use Firefox or Chrome. If you want to use IE and are upset that you can't, let us know."

Nobody has said anything about it.

I think so much depends on your audience. Our audience is writers using their own computer. They're happy to use Firefox and Chrome.

I only see IE6 support as a problem for people on corporate machines who don't control their own software.

</comment><comment><USER26> Who are these clients and why are you not firing them?

You run a business, they run a business, and everyone is trying to make money. How much money do you think an IE6 user has? the browser is like a decade old. It's why we target iPhone and not Android in the mobile world. ( because iPhone users out spend android users. )

Tell your client the truth, tell them that you keep up to date on the latest trends and if they want to use someone else let them, and then tell them exactly what your work will do.

I would not even offer to support IE6 anymore. Maybe IE7. There are a few reasons.

#1 you can't download IE6 legally any more

#2 you can't install it legally on linux or mac systems to test.

#3 IE7 in quirks mode does not work exactly the same as IE6.

#4 web development for legacy browsers is less about building things, and more about working around problems. and i just don't find that fun.

It is your duty as a web professional to turn down this work. Microsoft does not even support his browser anymore.

<comment><USER26> when i was running the site <http://unity3d.com> less than 1% of our visitors could not properly render an html5 doctype.

<comment><USER27> Question is, what % of users have the unity plugin installed?

I think it's quite neat that unity let's you embed your game into a web page but I often wonder how many users change their minds once posed with the requirement of a plugin install since this is exactly the kind of thing that IT savvy people advise their less technical friends not to do!

</comment></comment></comment><comment><USER28> _If we choose to make a website pixel-perfect in Internet Explorer 6 to 8, then we are doing up to 100% more work._

Every clients/users should check this once : <http://www.ie6countdown.com>

<comment><USER29> As much as I like that site, I can't link people to it because as a Microsoft site it just wants to move people to newer versions of IE, rather than to a decent browser. (Any decent browser, really; I don't care which, just not IE.)

</comment></comment><comment><USER30> We tried to drop IE6 support for an ecommerce client recently. But looking at analytics, IE6 customers are still doing 5 figures a month in revenue. The client just can't risk the potential lack of conversion in a site with a 'graceful degradation'. The testing that's gone into making it convert as it has must apply across all the major browsers from which they get traffic.

Shame, it's a complete pig to develop for.

edit: They must look and behave more or less the same. Personally I have no qualms about the IE users not seeing rounded corners on some boxes. As long as they're in the same place and the same colour, etc.

</comment><comment><USER31> Previously submitted here: <http://news.ycombinator.com/item?id=3192237>

What I find curious is that the de-duper apparently doesn't check for case differences in the URL encoded characters.

[http://www.smashingmagazine.com/2011/11/03/%E2%80%9Cbut- the-...](http://www.smashingmagazine.com/2011/11/03/%E2%80%9Cbut-the-client- wants-ie-6-support%E2%80%9D/)

[http://www.smashingmagazine.com/2011/11/03/%e2%80%9cbut- the-...](http://www.smashingmagazine.com/2011/11/03/%e2%80%9cbut-the-client- wants-ie-6-support%e2%80%9d/)

</comment><comment><USER32> I don't offer IE6 support, offering IE6 support keeps the browser alive, and it has to be killed collectively.

I'm guessing that an example of a client that would ask for IE6 support would be Car Mechanic shops that have CRT monitors and super old computers. And probably a corporation that can't upgrade all people at once and their secretaries don't know what a browser is.

</comment><comment><USER33> It's interesting that despite all the investment that Google is making in Plus and their desire for a foothold in this market, they flat out refuse IE6: <http://i.imgur.com/ONRK4.png>

<comment><USER34> Good for them. There is a trade off to be made, better/quicker features delivered at the expense of supporting an obsolete browser.

</comment></comment><comment><USER35> Isn't this just like about anything else? There are still plenty of people who use VCR's. There is still good money to make for people who are willing to support older technology. If you don't do it, someone else will.

<comment><USER36> Except we stopped making new standalone VCRs years ago, and new movies haven't been published on tape for years as well.

The interesting part of the IE6 debacle isn't the fact that a legacy program is sticking around longer than we had hoped, it's how ridiculously strong the longevity of it is. Most likely IE6 marketshare will stay in the double digits in many countries long after the world has completely forgotten about VCRs.

</comment></comment><comment><USER23> If any client demands IE6.0 support then I demand 100% more. the reason is not just that involves near 100% more work but also the skills required to do that job will be worthless in future.

<comment><USER37> That's not unreasonable but the key thing is to break that out in the quote. They need to understand what that support is costing them to allow them to make the choice as to how much they need it.

</comment></comment><comment><USER38> Maybe I'm missing something, but recently there has been a lot of work in graceful degradation. Such examples include Modernizr (based upon yep-nope) which allow detection of features and asynchronous loading of polyfils for missing functionality. Missing css3 support for IE6-8 comes in a 10 second fix called CSS3PIE. To use it you add 1 css line to apply the htc to the necessary classes (or all with the * selector) and there you have curved corners in IE6-8 with no additional work.

</comment><comment><USER39> Somehow I had managed to completely miss the term "polyfill" until just now.

Handy!

</comment><comment><USER24> IE6 Support is currently handled here via a second, reduced functionality site as a standard practice (and charge accordingly).

</comment><comment><USER40> IE6 support can be made reasonable for most apps as long the client understands that the IE6 support will be usable, decent looking, but not 100% the same look and experience as with more modern browsers. You just need to explain to the client that they don't want to blow their budget wrestling with nit picky white space inconsistencies.

</comment><comment><USER41> "Even if they don't care about accessibility, my responsibility is to make the website somewhat accessible." I'm unclear on who the legal requirements for accessibility fall on exactly so I may not understand properly... but I'd think this is a legal requirement to make your website accessible (at least in the US under Section... 508?)

<comment><USER42> Section 508 only applies to US government organisations and businesses/agencies providing services to those government organisations.

US legal requirements for public sites are probably covered in ADA (Americans with Disabilities Act), under the provision of reasonable accommodations. So far legal rulings are varied and vague, swinging one way then the other about whether ADA applies to websites (despite a DOJ opinion that they do/should).

Some states have their own legislation, like California's Unruh Civil Rights Act which was used against Amazon (Target settled and agreed to make their website accessible).

</comment></comment><comment><USER43> Fight opinion with facts.

Ask your customers if they got IE6 support as advice from someone.

Show how many people use it now and what that sliver of IE6 users now see with gracefully deprecating css libraries.

</comment><comment><USER44> "Do what the client needs, not what they want."

Great advice I got once.

<comment><USER42> In the context of IE6 what's best for the client is the one that best serves their business objectives in regard to their customers. If their target market contains a significant-enough element that uses IE6 then what's best for the client is a website that supports those business objectives with that customer.

</comment></comment><comment><USER45> Then use chrome frame ;-)

</comment><comment><USER46> "We have a responsibility to ourselves and to the Web to follow the principle of universality."

Not feeling that at all, so speak for yourself. If I want to target a specific browser or device, I do it when it makes sense. Screw universality. The users install what I tell them to or they don't get the privilege of using my site or product. (Do you think Steve Jobs would disagree?)

<comment><USER47> Given how much he trumpeted HTML5 and the nixing of Flash from its, yes, I think he would disagree seriously.

People begged Apple for the ability to create real apps. The original plan was to build HTML apps, but comparing a web app to a native app was no comparison at all (and it still isn't; I hate almost all web view"apps").</comment></comment>


Progress in AI Isn't as Impressive as You Might Think - <AUTHOR> https://www.technologyreview.com/s/609611/progress-in-ai-isnt-as-impressive-as-you-might-think/ <comment><USER2> You can tell that by just looking at various AI startups - insane claims, nothing working to show, some servers crunching numbers but solving no real problem And the only thing that seems to be there is telling cats from dogs, but we've already solved that

And possibly related - what is left of the 'Big Data' fever? Where are we, what did it bring to the economy, did map-reduce change the way we live?

<comment><USER3> The URL for the original report is mangled in this article; the correct URL is [http://aiindex.org/2017-report.pdf](http://aiindex.org/2017-report.pdf)

</comment></comment><comment><USER4> I agree that AIs that can generalize to solve out of sample problems are a long way off and we are in a bubble.

I manage a machine learning team. My hope is that the tooling improves so it will be quick and inexpensive to build models and applications. In other words, make up for lack of AGI with great tools and well trained practitioners.

<comment><USER5> The difference this time is that artificial intelligence practitioners are not interested in general artificial intelligence. The AI Index report is claims its goal is to "ground the conversation." It does not address social issues. This continues the comfortable conversation practitioners are already having. It does not change its course.

Giving up the goal of general artificial intelligence is a strategy for taking ethical considerations as a starting point. As is always the case, today's AI will be tomorrow's ordinary programming technique (e.g. A _). It 's just that this time, "When I squint it's not _really* evil" is the governor on the engine.</comment></comment>


Is our world a simulation? Why some scientists say it's more likely than not - <AUTHOR> https://www.theguardian.com/technology/2016/oct/11/simulated-world-elon-musk-the-matrix <comment><USER2> The simulation argument, going back to Bostrom, relies on two flaws.

1) It leverages our optimism to corrupt our understanding of statistics and logic. It essentially says that if you think humanity doesn't destroy itself, then our descendants will probably try to simulate us. But of course if you just take a statistical view of the potential future ordered states of the universe, there are FAR more potential future states in which we don't exist, than states in which we do. The chances we are living in a simulation now are equally as small.

2) Bostrom hypothesizes that our descendants will try to simulate us. But it is impossible to completely simulate a system from inside that system--that's basic thermodynamics. So simulation proponents argue that our simulated reality is running in a more complex universe than we experience. But if that is the case, then the beings running the simulation are not our descendants! They're the descendants of whatever more complex beings came before them. Once again the central logic of the argument fails.

</comment><comment><USER3> Don't want to make any judgements on the nature of reality, but I find it amusing that we went from thinking a pantheon of gods made the world, to a single god, to no god, and back to the idea that reality may be simulated by something/someone.

It's Intro to Philosophy all over again...

<comment><USER4> I'm completely new to philosophy but I'd like to read a little bit about it. Any chance you or some HNer could recommend a starting point?

<comment><USER5> I highly recommend the History of Philosophy Without Any Gaps Podcast __:[http://historyofphilosophy.net](http://historyofphilosophy.net). It gives a great cursory overview of (many of) the seminal events and is a great diving board to see what you may like to explore - the corpus of what you can study is gigantic.

 __As a degree holder in Philosophy I would have killed for a podcast like this; I have no affiliation with the podcast or its producers.

</comment></comment></comment><comment><USER6> If you are trying to simulate a large universe full of self-aware intelligent being who at some point also try run these simulations. And if these simulations eventually become N layers deep. At some point one of these generations is going to run into the limits of the simulation engine's computing power.

Since each supervising intelligence is watching the layers below them (and indeed started the simulation) they obviously know that those sub-layers are simulations but they don't know whether they themselves are simulations. Unfortunately, even the simulation that hits the limits can't tell whether they are computational limits or simply facets of their universe.

My short opinion ... It's turtles all the way down. At least until it stops but the question here is whether there are any turtles up.

<comment><USER7> As we exponentially create more worlds the base computing power can also increase exponentially if Moore's Law holds. Just keeping adding servers haha.

</comment></comment><comment><USER8> Have any of Terrile's friends and family taken him to a therapist? For him to be so certain of such an improvable (and largely irrelevant) fact seems like a sign of mental illness to me.

</comment><comment><USER9> It is simulation, the reality as we perceive is the simulation of our own brain, it is completely that when we dream and it is partially simulation when we're awake.

<comment><USER10> Why would you say the brain simulates reality rather than interprets it? A sundial doesn't need to simulate the sun's nuclear, gravitational and magnetic processes to cast a shadow...

<comment><USER9> The brain doesn't work like sun dial. Because it doesn't strictly interprets, even when we only try to observe the reality we unconsciously fill in the gaps. Ever wondered why humans are so susceptible to false memories? We create our own reality in our brain thus it's simulated. Of course we take in stimuli but the brain doesn't just interpret them. When we see, we already simulate the projection in our retina, there is a lot of processing that happens before impulses get send to the hemispheres by the optic nerve (eyes are part of the brain anatomically speaking). That processing in the retina isn't just interpretation, nerve cells actively suppress or amplify the signals depending on what is happening to the surrounding ones, as well as what happened shortly before that. I would argue that even on this basic level it's already a simulation of the reality. Interpretation is the higher order reasoning that your frontal lobe and lymbic system might do to decide what and how to act when you see a lion jumping at you.

</comment></comment></comment><comment><USER11> A repost.

Some speculations on the distant future.

> If we aren't actually living through a simulation, Mr Musk said, then all > human life is probably about to come to an end and so we should hope that we > are living in one. "Otherwise, if civilisation stops advancing, then that > may be due to some calamitous event that stops civilisation," he said at the > Recode conference.

I don't know why we should hope for that because any civilization in a layer in the stack of sims could be destroyed, which would destroy all nested sims beneath.

In fact you should hope you're further up the stack as much as possible because then the probability of destruction is lower.

However since this is about simulations it is more than likely that the physical parameters are not identical to those of the higher level simulation. Time could be experienced differently in different sims just like how animals have different lifespan ranges.

> computing technology has advanced so quickly that at some point in the > future it will become indistinguishable from real life

That is probably the case but we still cannot say so definitively. Since a simulation is not identical to the one higher than it we should also make a line between distinguishablity to observers and actuality. This is probably where the look, don't look 'testing' comes into play.

> "The full-on-crazy version of the merge is we get our brains uploaded into > the cloud. I'd love that. We need to level up humans, because our > descendants will either conquer the galaxy or extinguish consciousness in > the universe forever. What a time to be alive!"

I must admit I don't believe it happens like that. I do believe 'leveling up' is real, since we've done it before several times in our evolutionary past.

I think we're missing a piece here and that piece is the past which is biology. We have not begun to explore the possibilities of genetic modification of humans. I don't see the point of being an immortal brain or a EM without the ability to manipulate, use actuators in the physical reality.

Very seriously what is a 'neo-sapiens'? I think we have a good idea of what it would be in terms of intellectual prowess, being able to coordinate and understand vast quantities of information basically. What is much less clear to me is A: what does such a creature look like?

Perhaps, borrowing from my favorite science fiction book, we stop consuming food completely and simply obtain nourishment via water absorption and photosynthesize like plants only on a different level. That would massively improve our ecology surrounding us to improve our odds of survival. We'd still have qualia, sensation, to help us learn, just mediated by our technologies instead of being prompted indirectly by physical processes like injections or bars of chocolate.

I suspect traits like socialization, conflict, emotion and instinct have every reason to continue to exist long into our evolutionary future. It is just that we shall develop new ones. Goodbye old problem, hello new problems.

I also predict the QWERTY keyboard continues to exist for many thousands of years, like some kind of vestigial limb from millions of years ago as we were flapping about in the ocean. If you can't use CTRL-ALT-DEL to reboot your latest simulation creation then you've got to wonder if you have the same values as future-you.</comment>


Brazil Is Engulfed by Ruling Class Corruption - <AUTHOR> https://theintercept.com/2016/03/18/brazil-is-engulfed-by-ruling-class-corruption-and-a-dangerous-subversion-of-democracy/ <comment><USER2> And Argentina, Venezuela, Ecuador, Bolivia, Cuba and Nicaragua. Or: everywhere in Latin America where the so called "21st Century Socialism" took hold in the last decade or so. Luckily, the pendulum is swinging back...</comment>


Gccgo in GCC 4.7.1 - <AUTHOR> http://blog.golang.org/2012/07/gccgo-in-gcc-471.html

<comment><USER2> Anyone have any insight as to how Go will avoid the garbage collection latency issues that arise in some situations with other GC languages, such as those that run on the JVM or CLR? I ask this in particular since Go is frequently mentioned as a C++ alternative.

<comment><USER3> An "alternative" doesn't mean "has to be as good or better at everything that C++ does".

Most programs don't have garbage collection latency issues. Look at Android or Windows Phone - all the user-level apps are written in garbage-collected language and they work just fine.

Look at web - all the interaction is written in JavaScript and Gmail works just fine.

At this point in the discussion people usually bring "real time" applications. Approximately no-one writes those applications.

Go is an alternative to C++ in the sense that many (but not all) programs that you had to write in C++ you can now write in Go.

<comment><USER4> > Look at Android or Windows Phone - all the user-level apps are written in > garbage-collected language and they work just fine.

Aren't there people blaming Android's perceived laggyness on this?

<comment><USER5> Many do, but actually the problem is caused by UI using software rendering instead of the GPU. This was only changed in Android 3.0.

Another thing is that many developers do too much in the UI thread instead of doing it in the background or asynchronously.

</comment></comment></comment></comment><comment><USER6> Any word on an LLVM frontend for go?

Andrew Wilkins has written llgo, a compiler for Go, written in Go, and using the LLVM compiler infrastructure: <https://github.com/axw/llgo/#readme>

</comment><comment><USER7> I didn't know this info, about the other compiler. That's great. Near the end of a project I'll try gccgo to see what performance difference it makes. The testing package makes profiling relatively easy.

</comment><comment><USER8> I'm pleased that gccgo provides support for architectures outside of x86 and ARM, this is good news.

</comment><comment><USER9> Go feels to me like it is trying to combine C and Python. Much more efficient than Python, but not as efficient as C. Much more expressive than C, but not as expressive as Python. I can't quite decide if that's combining the best of both worlds, or compromising on both fronts.

What's up with the official Go binaries being incompatible with RHEL 5? I might have another look in about a decade or so.

<comment><USER10> > What's up with the official Go binaries being incompatible with RHEL 5? I > might have another look in about a decade or so.

Go runs on RHEL 5.2 and above (released in May 2008, and there have been 7 further point releases since). If you REALLY want to run it on 5.1 and have gcc then you can build your own Go tool chain in about 2 minutes.

Your whole post is FUD. You don't know anything about Go yet offer a negative assessment. Why bother?

<comment><USER9> Fact: C is faster than Go:

[http://shootout.alioth.debian.org/u32/benchmark.php?test=all...](http://shootout.alioth.debian.org/u32/benchmark.php?test=all&lang=go&lang2=gcc)

Fact: Python is more expressive than Go (less code):

[http://shootout.alioth.debian.org/u32/benchmark.php?test=all...](http://shootout.alioth.debian.org/u32/benchmark.php?test=all&lang=go&lang2=python3)

If I wasn't interested in Go I wouldn't complain about not having binaries. You may not be running RHEL 5.0 but there are many organizations which still have many systems on it. It's not always up to Joe Developer to decide to upgrade the OS on every box in an organization. Perhaps I need to know more about building go to compile my own binaries, but not having to deal with C is one of the reason's I was looking at Go in the first place.

How is this FUD? C is faster than Go, Python takes less code than Go and the binaries don't support RHEL 5.0. I thought my post wasn't particularly biased, but I'm pretty shocked at the reaction I got :(

<comment><USER11> There is compound failure at your organization as running _5.0_ is reckless and dangerous.

<comment><USER9> You do realise that security patches are still being provided for even RHEL 3? <https://rhn.redhat.com/errata/rhel3els-errata.html>

</comment></comment></comment></comment></comment><comment><USER12> Is this an indication of community support & language acceptance, or simply Google throwing mountains of money at the project?

<comment><USER13> The original work ongccgo was done by Ian Lance Taylor(of the gold linker fame) who works at Google, and now is being accepted and supported by the GCC project.

So the answer to your question is: both.</comment></comment>